Delete the Everyone share Permission SMB

Status
Not open for further replies.
M

matis111

Dabbler
Joined
Jun 23, 2017
Messages
14
Hello, I installed FreeNAS ver. 11. I have a problem with share permission in SMB. I am trying to remove group Everyone from the share permission in folder. When i will remove inheritable permission in the parent folder for Everyone group the group "everyone" dissapeared. But if i i will create a new sub folder in FreeNAS the folder will get Everyone Group Permission. Can someone explain why its not working? And tell me what should i do step by step to remove the Everyone Permission?

I know only that it will works only when i will change something in POSIX ACLs ( or maybe smb4.conf) in the server.
 
anodos

anodos

Sambassador
iXsystems
Joined
Mar 6, 2014
Messages
9,554
matis111 said:
Hello, I installed FreeNAS ver. 11. I have a problem with share permission in SMB. I am trying to remove group Everyone from the share permission in folder. When i will remove inheritable permission in the parent folder for Everyone group the group "everyone" dissapeared. But if i i will create a new sub folder in FreeNAS the folder will get Everyone Group Permission. Can someone explain why its not working? And tell me what should i do step by step to remove the Everyone Permission?

I know only that it will works only when i will change something in POSIX ACLs ( or maybe smb4.conf) in the server.
Click to expand...

Post the following:
- contents of /usr/local/etc/smb4.conf
- getfacl output for the root of your share getfacl /mnt/Tank/Share
 
K

katit

Contributor
Joined
Jun 16, 2015
Messages
162
I'm not OP but I was about to ask the same question. I see group/user on Windows side properly just like I set it in FreeNAS, but Everyone also there.

Sorry for screenshots, not sure how to copy from terminal :(

SMB_global.JPG


SMB_share.JPG


SMB_Share_conf.JPG
 
BigDave

BigDave

FreeNAS Enthusiast
Joined
Oct 6, 2013
Messages
2,479
katit said:
Sorry for screenshots, not sure how to copy from terminal
Click to expand...
From a SSH terminal, you use your left mouse button to to hold and drag (highlighting the text), then release.
Go back to your browser window and find the "code" icon and click it and it will place the tags in the window,
then just right click your mouse and select paste from the drop down (this assumes you're using Windows).
You can play with this until you get the hang of it, just click on the "More Options" button and click Preview
to see how it will look before you post it. ;)
 
anodos

anodos

Sambassador
iXsystems
Joined
Mar 6, 2014
Messages
9,554
katit said:
I'm not OP but I was about to ask the same question. I see group/user on Windows side properly just like I set it in FreeNAS, but Everyone also there.
Click to expand...

Well, your server is showing the default ACL on your samba share, which includes everyone@:read_set:allow. Any new files / folders you create directly under the share will inherit this ACE. Post output of zfs get aclmode main-4TB-mirror/IDATTLC
 
K

katit

Contributor
Joined
Jun 16, 2015
Messages
162
Just posted another topic on this: https://forums.freenas.org/index.php?threads/how-is-it-possible-that-win10-sees-those-files.55634/

I deleted this "Everyone" from list using Windows client and it doesn't show on FreeNAS anymore. Yet I can browse/modify..


Code:
root@HOME-NAS:~ # zfs get aclmode main-4TB-mirror/IDATTLC
NAME  PROPERTY  VALUE  SOURCE
main-4TB-mirror/IDATTLC  aclmode  restricted  local



Code:
root@HOME-NAS:~ # getfacl /mnt/main-4TB-mirror/IDATTLC/
# file: /mnt/main-4TB-mirror/IDATTLC/
# owner: nobody
# group: ditat
  group@:rwxpDdaARWcCo-:fd-----:allow
  owner@:rwxpDdaARWcCo-:fd-----:allow
 
anodos

anodos

Sambassador
iXsystems
Joined
Mar 6, 2014
Messages
9,554
katit said:
Just posted another topic on this: https://forums.freenas.org/index.php?threads/how-is-it-possible-that-win10-sees-those-files.55634/

I deleted this "Everyone" from list using Windows client and it doesn't show on FreeNAS anymore. Yet I can browse/modify..


Code:
root@HOME-NAS:~ # zfs get aclmode main-4TB-mirror/IDATTLC
NAME  PROPERTY  VALUE  SOURCE
main-4TB-mirror/IDATTLC  aclmode  restricted  local



Code:
root@HOME-NAS:~ # getfacl /mnt/main-4TB-mirror/IDATTLC/
# file: /mnt/main-4TB-mirror/IDATTLC/
# owner: nobody
# group: ditat
  group@:rwxpDdaARWcCo-:fd-----:allow
  owner@:rwxpDdaARWcCo-:fd-----:allow
Click to expand...

Post output of smbstatus while browsing.
 
K

katit

Contributor
Joined
Jun 16, 2015
Messages
162
I did in other thread, let's move to single thread. Sorry for the mess :)
 
M

matis111

Dabbler
Joined
Jun 23, 2017
Messages
14
Code:

  GNU nano 2.7.0			File: /usr/local/etc/smb4.conf			Modified
[global]
	server max protocol = SMB3
	encrypt passwords = yes
	dns proxy = no
	strict locking = no
	oplocks = yes
	deadtime = 15
	max log size = 51200
	max open files = 125372
	logging = file
	load printers = no
	printing = bsd
	printcap name = /dev/null
	disable spoolss = yes
	getwd cache = yes
	guest account = jkowalski1
	map to guest = Bad User
	obey pam restrictions = yes
	ntlm auth = no
directory name cache size = 0
	kernel change notify = no
	panic action = /usr/local/libexec/samba/samba-backtrace
	nsupdate command = /usr/local/bin/samba-nsupdate -g
	server string = FreeNAS Server
	ea support = yes
	store dos attributes = yes
	lm announce = yes
	hostname lookups = yes
	time server = yes
acl allow execute always = true
	dos filemode = yes
	multicast dns register = yes
	domain logons = no
	local master = yes
	idmap config *: backend = tdb
	idmap config *: range = 90000001-100000000
	server role = standalone
	netbios name = FREENAS
	workgroup = WORKGROUP
 security = user
	pid directory = /var/run/samba
	create mask = 0660
	directory mask = 0770
	client ntlmv2 auth = yes
	dos charset = CP437
	unix charset = UTF-8
	log level = 1
[test]
	path = "/mnt/A"
	printable = no
	veto files = /.snapshot/.windows/.mac/.zfs/
	writeable = yes
	browseable = yes
	vfs objects = zfsacl acl_xattr posix_eadb streams_xattr aio_pthread
	hide dot files = yes
	guest ok = no
	nfs4:mode = special
	nfs4:acedup = merge
	nfs4:chown = true
	zfsacl:acesort = dontcare



Code:

root@freenas:/ # getfacl /mnt/A
# file: /mnt/A
# owner: jkowalski
# group: jkowalski
			group@:rwxpDdaARWcCo-:fd-----:allow
			owner@:rwxpDdaARWcCo-:fd-----:allow
 
M

matis111

Dabbler
Joined
Jun 23, 2017
Messages
14
There is no group Everyone in /mnt/A because i deleted it from windows explorer. But when i create a new subfolder the folder will get permission for everyone Group
 
M

matis111

Dabbler
Joined
Jun 23, 2017
Messages
14
And this is the post with smbstatus while browsing
Code:
root@freenas:/ # smbstatus

Samba version 4.6.4-GIT-3909b46
PID	 Username	 Group		Machine								   Protocol Version  Encryption		   Signing
----------------------------------------------------------------------------------------------------------------------------------------
5610	jkowalski	jkowalski	192.168.30.1 (ipv4:192.168.30.1:56103)	SMB3_02		   -					partial(AES-128-CMAC)
5852	jkowalski1   jkowalski1   192.168.30.1 (ipv4:192.168.30.1:56164)	SMB3_02		   -					-
5898	jkowalski1   jkowalski1   mateusz (ipv4:192.168.30.1:56167)		 NT1			   -					-
5852	jkowalski	jkowalski	192.168.30.1 (ipv4:192.168.30.1:56164)	SMB3_02		   -					partial(AES-128-CMAC)

Service	  pid	 Machine	   Connected at					 Encryption   Signing
---------------------------------------------------------------------------------------------
test		 5852	192.168.30.1  Sat Jun 24 12:01:54 2017 CEST	-			-
IPC$		 5852	192.168.30.1  Sat Jun 24 12:03:33 2017 CEST	-			-
IPC$		 5852	192.168.30.1  Sat Jun 24 12:01:53 2017 CEST	-			-
IPC$		 5898	mateusz	   Sat Jun 24 12:03:34 2017 CEST	-			-
IPC$		 5610	192.168.30.1  Sat Jun 24 11:58:08 2017 CEST	-			-

Locked files:
Pid		  Uid		DenyMode   Access	  R/W		Oplock		   SharePath   Name   Time
--------------------------------------------------------------------------------------------------
5852		 1001	   DENY_NONE  0x100081	RDONLY	 NONE			 /mnt/A   .   Sat Jun 24 12:01:54 2017
5852		 1001	   DENY_NONE  0x100081	RDONLY	 NONE			 /mnt/A   .   Sat Jun 24 12:01:54 2017
 
zoomzoom

zoomzoom

Guru
Joined
Sep 6, 2015
Messages
677
This is being way over-thought, and is a situation where doing this for currently established shares via CLI is more time consuming that doing so directly on the client PC
  • Provided the share has a relatively small number of files, i.e <1k, else recursively changing permissions to 0660 [files] / 0770 [directories] in CLI would likely be more efficient.
  1. If Windows, go the the root of the server via \\<FreeNAS Hostname>
  2. Right click on the share which needs Everyone removed, select: Properties -> Security -> Advanced
  3. Highlight Everyone -> Remove
  4. Tick the the box to "Replace all child..."
  5. OK
For new shares, the permissions for the root directory or dataset need to be 0 for others (for example, 0770 for directories).
 

Attachments

  • Screenshot.png
    Screenshot.png
    380.2 KB · Views: 662
Last edited:
anodos

anodos

Sambassador
iXsystems
Joined
Mar 6, 2014
Messages
9,554
matis111 said:
Code:

  GNU nano 2.7.0			File: /usr/local/etc/smb4.conf			Modified
[global]
	server max protocol = SMB3
	encrypt passwords = yes
	dns proxy = no
	strict locking = no
	oplocks = yes
	deadtime = 15
	max log size = 51200
	max open files = 125372
	logging = file
	load printers = no
	printing = bsd
	printcap name = /dev/null
	disable spoolss = yes
	getwd cache = yes
	guest account = jkowalski1
	map to guest = Bad User
	obey pam restrictions = yes
	ntlm auth = no
directory name cache size = 0
	kernel change notify = no
	panic action = /usr/local/libexec/samba/samba-backtrace
	nsupdate command = /usr/local/bin/samba-nsupdate -g
	server string = FreeNAS Server
	ea support = yes
	store dos attributes = yes
	lm announce = yes
	hostname lookups = yes
	time server = yes
acl allow execute always = true
	dos filemode = yes
	multicast dns register = yes
	domain logons = no
	local master = yes
	idmap config *: backend = tdb
	idmap config *: range = 90000001-100000000
	server role = standalone
	netbios name = FREENAS
	workgroup = WORKGROUP
security = user
	pid directory = /var/run/samba
	create mask = 0660
	directory mask = 0770
	client ntlmv2 auth = yes
	dos charset = CP437
	unix charset = UTF-8
	log level = 1
[test]
	path = "/mnt/A"
	printable = no
	veto files = /.snapshot/.windows/.mac/.zfs/
	writeable = yes
	browseable = yes
	vfs objects = zfsacl acl_xattr posix_eadb streams_xattr aio_pthread
	hide dot files = yes
	guest ok = no
	nfs4:mode = special
	nfs4:acedup = merge
	nfs4:chown = true
	zfsacl:acesort = dontcare



Code:

root@freenas:/ # getfacl /mnt/A
# file: /mnt/A
# owner: jkowalski
# group: jkowalski
			group@:rwxpDdaARWcCo-:fd-----:allow
			owner@:rwxpDdaARWcCo-:fd-----:allow
Click to expand...

Remove acl_xattr posix_eadb. vfs_acl_xattr is almost certain to cause problems. You shouldn't mix up multiple methods of storing ACLs on a Samba server. Choose either (1)ZFS ACLs or (2) XATTR-based ACLs. (1) is preferable.

While you're at it, post the output of the following command zfs get aclmode <pool>/<dataset>. This is assuming that you're sharing a dataset you created specifically for the share (which you should do).
 
M

matis111

Dabbler
Joined
Jun 23, 2017
Messages
14
Code:
root@freenas:/ # zfs get aclmode /mnt/A
NAME  PROPERTY  VALUE		SOURCE
A	 aclmode   restricted   local
 
M

matis111

Dabbler
Joined
Jun 23, 2017
Messages
14
anodos said:
Remove acl_xattr posix_eadb. vfs_acl_xattr is almost certain to cause problems. You shouldn't mix up multiple methods of storing ACLs on a Samba server. Choose either (1)ZFS ACLs or (2) XATTR-based ACLs. (1) is preferable.

While you're at it, post the output of the following command zfs get aclmode <pool>/<dataset>. This is assuming that you're sharing a dataset you created specifically for the share (which you should do).
Click to expand...
I removed 2 VFS Objects
 
M

matis111

Dabbler
Joined
Jun 23, 2017
Messages
14
When i will create a new folder in windows explorer its fine but if i will create New Data Set in FreeNas got still same problem (everyone got permission)
Code:

root@freenas:/ # getfacl mnt/A
# file: mnt/A
# owner: jkowalski
# group: jkowalski
			owner@:rwxpDdaARWcCo-:fd-----:allow
			group@:rwxpDdaARWcCo-:fd-----:allow

Code:
root@freenas:/ # getfacl /mnt/A/foo
# file: /mnt/A/foo
# owner: jkowalski
# group: jkowalski
			owner@:rwxpDdaARWcCos:fd-----:allow
			group@:rwxpDdaARWcCos:fd-----:allow
		 everyone@:r-x---a-R-c---:fd-----:allow
 
Last edited:
M

matis111

Dabbler
Joined
Jun 23, 2017
Messages
14
zoomzoom said:
This is being way over-thought, and is a situation where doing this for currently established shares via CLI is more time consuming that doing so directly on the client PC
  • Provided the share has a relatively small number of files, i.e <1k, else recursively changing permissions to 0660 [files] / 0770 [directories] in CLI would likely be more efficient.
  1. If Windows, go the the root of the server via \\<FreeNAS Hostname>
  2. Right click on the share which needs Everyone removed, select: Properties -> Security -> Advanced
  3. Highlight Everyone -> Remove
  4. Tick the the box to "Replace all child..."
  5. OK
For new shares, the permissions for the root directory or dataset need to be 0 for others (for example, 0770 for directories).
Click to expand...
I made it but when i will create new Data Set in storage it will get Everyone permission
 
M

matis111

Dabbler
Joined
Jun 23, 2017
Messages
14
Its bugged? Its other way to configure FreeNAS to remove Everyone permission for new DataSet?
 
Status
Not open for further replies.

Similar threads

A
  • Locked
everyone Share permission
Replies
2
Views
2K
Andres Gonzalez
A
A
Question about share permission and emby folder mapping
Replies
0
Views
1K
anchen
A
S
Serious issue with SMB Share permission
Replies
2
Views
1K
sulfy
S
S
  • Locked
Cannot add/delete folder in CIFS share
Replies
1
Views
849
seanwang
S
B
smb share permission setting issue
Replies
3
Views
918
anodos
anodos
Top