Does guest need extra Unix permissions on underlying filesystem of anonymous SMB shared folder?

icelava

Cadet
Joined
Mar 5, 2020
Messages
7
My company has an iXsystems FreeNAS NAS (11.2 U6) operating in the office. It was setup with a single volume out of the four hard disks, with two data sets. Each data set has its own designated admin user and group. For existing shared folders out of those data sets, they work since we use authenticated users who belong to those respective groups.

Now, we are trying to setup a custom repository for Lenovo computer updates (drivers), whereby the Lenovo Vantage service on each computer will be customised to refer to a UNC path (shared folder in the NAS) instead of the regular Lenovo support center web site. The key thing about Lenovo Vantage is, it runs as a service in SYSTEM context, so it does not take on credentials/identity of the current signed-in user.

So an SMB shared folder with [Allow Guest Access] and [Only Allow Guest Access] and {Export Read Only] and [Default Permissions] was created on top of
/mnt/vol1/set2/common/LenovoUpdates

Note: /mnt/vol1/set2/common has its own shared folder definition, which allows admins to copy update packages from Lenovo to the sub-directory.

However, I have not been able to successfully browse into the public share, no matter what extra configuration is supposed to be needed for Windows 10 to anonymously access it.


Re-enabling the Windows Guest account doesn't help either.

Furthermore, when I test using my own home NAS (Synology DS413) shared folder, I can access it as guest, but I later discovered it had been configured to run only SMB v1 all along. When I raised the minimum protocol to v2, my Windows client cannot access it as well. Which leads me to suspect something else extra needs to be configured on my local Windows?

Or, coming back to the FreeNAS implementation, the SMB service guest account is set to nobody. I see the tool tip suggests

Account is required to have permissions to the shared pool or dataset.

The existing permission set looks like

[set2admin@nas1 /mnt/vol1]$ ls -al
total 26
-rw-r--r-- 1 root wheel 0 Oct 30 18:52 .windows
drwxr-xr-x 9 root wheel 10 Mar 5 14:45 iocage
drwxrwx---+ 8 set1admin set1admin 9 Oct 29 18:10 set1
drwxrwx---+ 4 set2admin set2admin 5 Oct 29 18:11 set2


And when I try to adjust permissions

[set2admin@nas1 /mnt/vol1]$ chmod o+r set2
chmod: set2: Operation not permitted


The others group has r and x access to vol1. Am I missing something else? So is the problem with the FreeNAS shared folder server side or client side?
 

icelava

Cadet
Joined
Mar 5, 2020
Messages
7
Seeing that the datasets we have are formatted with ZFS, which I learn is using NFSv4 ACL types, looks like we have to use getfacl/setfacl tools to control permissions.

However, despite grant guest user nobody rx down the directory hierarchy,

$ setfacl -m u:nobody:rx::allow <dir>

I'm still not able to access that read-only shared folder as anonymous from Windows.

[Window Title]
Network Error

[Main Instruction]
Windows cannot access \NAS\LenovoUpdates

[Content]
You do not have permission to access \NAS\LenovoUpdates. Contact your network administrator to request access.

For more information about permissions, see Windows Help and Support

[Close]
 

icelava

Cadet
Joined
Mar 5, 2020
Messages
7
Also on a side note, I am not sure how to define default ACLs for new directories/files to inherit. setfacl does not allow the -d parameter since "there are no default entries in NFSv4 ACLs"

New directories and files copied in don't get ACLs for nobody user.
 
Top