Correct cifs mac & win7 working but correct settings?

[A_N_G]

Hi - First post, please go easy.

Currently exploring FreeNas and learning a ton about users and shares from the 9.3 manual. Had an issue come up with mac users who created files or folders locked (read only) to my Win7 users or Ubuntu. The root cause to the was the folder permissions were not inherited from the parent rw folder. After much searching and reading all sorts of "solutions" I was able to simply resolve this by changing two things:

services > CIFS settings > server maximum protocol > change from SMB2 to SMB2_10

sharing > Windows (CIFS) > (your share, mine was "public" > Advance Mode > VFS Objects > add the following "acl_tdb" and "acl_xattr"

Question is this configuration is "ok" before I go any further or am I asking for trouble? is the VFS additions even needed? Need more detail, see the ramble below.

thanks
AG


Scope: Using my old PC, create a encrypted local NAS to store / access Music, Photos, and documents/files for home use. I have a separate backup in place and stored off site. Out of scope for this post is Raid config, as i just have one 2T drive to test with.

Build detail
Build FreeNAS-9.3-STABLE-201505130355
Platform Intel(R) Core(TM) i5-2400S CPU @ 2.50GHz
Memory 3951MB(yup its not 8G, I have some on order)

Users: Admin, family, and visitors via Lan. Win7, Mac OSx, Ubuntu 14.04. Folders have mixed permissions, wr/r ect... First thing I did was make up an excel sheet for the users and groups to see who needs what access. Next, created the users and groups:

User - Group(s) - notes
fmlast1(me) - nasadmin, nasuser, public, wheel. - this will be the "super user"
fmlast2 - nasuser, public. - some r/rw in the future as a build up
fmlast3 - nasuser, public. - some r/rw in the future as a build up....ect....ect...
public - public. - read only​

IMPORTANT: Permissions will be configured and set on the windows side and your windows login/password must match "fmlast1" from the above groups. Took some time to fully understand this, but check out this vid for help. https://www.youtube.com/watch?v=PhYkZlbBbwk

storage > volume manager > Name = Tank
added a dataset called "public", set up User and Group owners. Set permissions to "windows"since I read this is the way to go for mixed win/mac shares. Finally, left "set perm recursively unchecked.

Shares: Created a new CIFS, gave it a name "public" with allow guest access unchecked. (*see first few lines of this post, more settings were applied due to a mac permission issue)

Services: Turned on CIFS and set up the name and work group.


Objective: Before migrating any files, test out the following to ensure all goes well in the event of a PC or flash drive failure. Verify I can recover the data from the encrypted HD

• Turn on full drive Encryption, add a pass phrase and backup keys.
  
• Save a copy of the FreeNas flash drive OS by backing up the "config" file.
  
• create a data set, share it, write some data to it and make sure win7, ubuntu and Mac users can read a write (note had some issues here, see below)
  

Results: Success!!! actually was pretty easy. Reinstalled the FreeNas OS, loaded up the backup keys and config and was up and running. Am i missing any gotchas ppl have been thru?

AG

 

[anodos]

I was able to simply resolve this by changing two things:

services > CIFS settings > server maximum protocol > change from SMB2 to SMB2_10

SMB2 is the same as SMB2_10

sharing > Windows (CIFS) > (your share, mine was "public" > Advance Mode > VFS Objects > add the following "acl_tdb" and "acl_xattr"

Those options should be mutually exclusive. Samba's goal is to effectively make a Unix file server behave like a windows file server. Broadly speaking, windows servers use access control lists (ACLs) to handle file and folder permissions. Windows ACLs are more complex than permissions on a traditional Unix filesystem, and therefore you need some way of storing these data if you are using a traditional Unix filesystem. The acl_tdb vfs object stores the windows-style permissions in a database file. The acl_xattr vfs object stores the permissions as filesystem extended attributes. Both schemes can incur significant a performance penalty as you scale up. Note that I mentioned "traditional filesystems". ZFS natively supports ACLs, hence there is no need to use ugly workarounds.

Question is this configuration is "ok" before I go any further or am I asking for trouble?

The parameters will not cause data loss and can be easily disabled at a later time with the caveat that you will need to redo your permissions.

is the VFS additions even needed?

No. They are not needed.

Scope

: Using my old PC, create a encrypted local NAS to store / access Music, Photos, and documents/files for home use.

This is a bad idea on two counts (1) not server grade hardware - look up threads on ECC and (2) encryption - don't encrypt pool unless you absolutely need to. It adds a whole new level of complexity and fragility to your pool.

Well, ran out of steam. Passing torch now.

 

[A_N_G]

anodos - thanks for clearing that up. Spent about 2 full days pulling my hair out on the mac read only file creation. when I get time, I'll remove each setting one by one to see which (1 or all 3) make an impact to the file sharing on the mac. I was exhausted when i wrote the 1st post....

This is a bad idea on two counts (1) not server grade hardware

Cant argue that... Long term plan is to purchase some quality hardware. For now im seeing how freenas plays with my other machines around the house (xbmc/kodi Mysql and RPis). Which it does great, got the Mysql jail up and running last night for the Kodi machines.

look up threads on ECC and (2) encryption - don't encrypt pool unless you absolutely need to. It adds a whole new level of complexity and fragility to your pool.

If encryption of the whole pool is not recommended, is there another option you had in mind?
The data stored on the HD must be somehow secure in the event of it physically being compromised. I will read up more on ECC and Encryp but do you have a source(s) or experience with disasters? I did test run a recovery and it was smooth, but that was single disk. My guess is if it were multi disk it gets complex fast? My plan is to run no more than 2x2TB western dig type Red drives. Is that low risk to a recovery of a dead mobo or flash drive? using keys to restore the HDs?


thanks
AG