SOLVED CIFS shares become read-only to Windows clients

[Noctris]

I looked at your debug file and it indicated that you authenticated to your FreeNAS server with an account other than your guest account. Since the share is owned by your guest user, this would typically confer read-only access to the share. See reply #12 above.

For as far as i know, samba IS supposed to use the guest account, despite thr user doing the request, when configured as guest only share. This is how samba always has worked ( although i admit i am less familiar with v4) and should work. So that would indicate samba not behaving as it should. Did you see a username of sid mapping?

Sent from my HTC One_M8 using Tapatalk

 

[SweetAndLow]

I looked at your debug file and it indicated that you authenticated to your FreeNAS server with an account other than your guest account. Since the share is owned by your guest user, this would typically confer read-only access to the share. See reply #12 above.

I have seen a couple post recently of people doing this exact thing.

 

[Noctris]

If you remember then, please pm me. This isn't normal behaviour of samba and should not happen.

Sent from my HTC One_M8 using Tapatalk

 

[anodos]

If you remember then, please pm me. This isn't normal behaviour of samba and should not happen.

Sent from my HTC One_M8 using Tapatalk

For as far as i know, samba IS supposed to use the guest account, despite thr user doing the request, when configured as guest only share. This is how samba always has worked ( although i admit i am less familiar with v4) and should work.

There is a difference between configuring a guest account with "guest ok=yes" and a "guest only" share. In the former case, (and with "map to guest=Bad User") user logins with an invalid password are rejected, unless the username does not exist, in which case it is treated as a guest login and mapped into the guest account.

Note that forcing users / groups (through "force user", "force group", and "guest only") will often prevent users from being able to modify ACLs through Windows Explorer and may lead to permissions headaches.

 

[Noctris]

Which is why i said that :) the box i have to issues with is a home machine which was completely forced guest on all sharues. Not just guest ok but forced guest only with all datasets owned and 0777 for that guest. No acl was set on windows. Ever.

Sent from my HTC One_M8 using Tapatalk

 

[anodos]

Which is why i said that :) the box i have to issues with is a home machine which was completely forced guest on all sharues. Not just guest ok but forced guest only with all datasets owned and 0777 for that guest. No acl was set on windows. Ever.

Sent from my HTC One_M8 using Tapatalk

Well, if you're having an issue with permissions on your server start a new thread. As it is this one is becoming a rat's nest. Most of my posts have been in response to the OP.

 

[mudshark]

Sorry, i wasn't really clear. It's called CIFS in freenas. Samba is the name of the software handeling the cifs protocol.
All steps are to be done on freenas.
first, go create the user in Account -> Users like this:
* Image deleted *
Then go over to services, edit CIFS config and set it like this
* Image deleted *
Finally, set permissions on your datasets you share:
* Image deleted *

After following the steps above (your screen shots) my phantom user is gone, replaced by the new "Samba" user I created.
Seen here:

I am still unable to grant "Full" rights to the "Everyone" user though. :(
-----------------
anodos wrote,

I noticed that you have mapped a directory within one of your shares and are attempting to modify its permissions. ... Don't map "\\FREENAS\MUSIC" and change permissions on "Frank Zappa".

Ah! I did *not* try to chg permissions on the folder within the share. I just happened to right-click on whatever folder was open at the time in order to get to the "permissions" display dialog. That screen accurately represents the whole share. I never would chg permissions on any sub- folder.

I noticed your datasets owned by "nobody" (your guest user), but you are authenticating as "richie" this will effectively make your permissions level that of "everyone" which tends to be RO.

Not having been aware "Everyone" is normally a RO group I now wish I'd recorded permissions BEFORE the issue starts! No idea how to was working before the big bang...

So literally wanting EVERYONE to access CIFS shaers ... What to do???

------------------

And to cyberjock:

Thanks for your thoughtful (and expansive) reply! It does not in any way come across as condescending at all. It does offer me an opportunity to reply to things so as to hopefully make them clearer.

This issue is completely reproduceable. I've rebuilt the server many many times and the same thing happens each time.
Yes, this would seem to point to an omission on my part (certainly probable) -OR- something else is just not right in some combination of sub-systems I am using (possible).

Best of luck on the white paper. Trust me, I know what it is to have to prioritize time! I look forward to reading it.

Admittedly, my UNIX permission knowledge is weak. (No kidding, right?) But I am following the FreeNAS manual and, here's what's so strange about it...

It works for some time. A week, a month, whatever, then fails to this state. Suddenly permissions just change.
In the middle of a session copying batches of files to a share, CIFS just stops working.

I'll be editing files on my Win7 PC (local or USB HD) then, when done editing, copy those files to a folder on a FreeNAS CIFS share (Music, in this case).

Edit a batch of files then copy them to a folder on the Music share,
edit another batch of files, copy them to a different folder on the Music share,
edit another batch of files, copy them to a different folder on the Music share...
Then BAM!

Right then, between batch copies, permissions just change.
Copy files A-G to Music/folderZ one moment is fine, w/o issue
and files H-R to Music/folderY FAIL... Time for a server rebuild!

==> Even stranger, at that exact moment is when each and every CIFS share on the FreeNAS server are re-permissioned, not just the Music share I was working in.

That's all I have.

 

[Robert Trevellyan]

Even stranger, at that exact moment is when each and every CIFS share on the FreeNAS server are re-permissioned, not just the Music share I was working in.

Does the timing by any chance coincide with a snapshot?

 

[Noctris]

I'm just wondering why you want everyone to have full acces? If you are using guest allowed and guest only on the share, everyone that acceses this share will default to samba user and it's privelleges. This means that in this case , by default, everyone has full acces. I must honestly say i didn't bother to try and change the acl since these steps provide a working solutions on a home box for me.

Do you have both guest ok and guest only enabled on the share?
Do you have all rights you require from a client?
Migght want to take a screenshot from samba config page, share page and dataset config page if you still have this issue

Have you tryed setting the permissions to the share itself?

I must say for me this behaviour was the first time but it doesn't make it less strange. The 'ghost' user you refer to is something i only have seen before on samba boxes where an active directory user that had acl was deleted and samba was unable to resolve the sid to a human readable user name. Which should not be the case here.

For me, no snapshots where made at any point.

Sent from my HTC One_M8 using Tapatalk

 

[mudshark]

No snapshots, screenshots, or logs from BEFORE the permissions change. BUT no worrys!
==> Unless I find a way to fix this so I can delete files from the shares, I'll AGAIN have to rebuild the server from the ground up for like the 6th time!

I don't need EVERYONE to have access, that's just the way FreeNAS creates the share. I never manually set any particular user or group.
So you're saying that if I go to FreeNAS and make myself (user: Richie) a member of the "samba_user" group I should be able to read / write?

HEY! What do you know! Fixed!
Live and learn.

Love y'all,
Rich

 

[boston243]

I had this problem. Solved it by adding "map readonly = no" (without quotes) to the auxiliary parameters section in the CIFS settings. Didn't even have to reboot CIFS. Problem solved.