Help With CIFS Shares

[Christmas]

Hi could someone help me please.

I really apologise if this has already been asked but after struggling with this for several hours I need some help

I’m in the process of building a new NAS for home use and have decided to base it on FreeNAS, downloaded the 9.3 stable version and installed on a development machine.

My environment will be the FreeNAS box as the main server storing all my data and several windows machine that need access to this data. All users need to be authenticated against accounts that are stored on the FreeNAS box and requires access/restricted access to shared folders.

I have read that you need to fine tune the permissions for the shares from within windows and edit the ACL’s which is working but here is the problem.

One how do I stop the everyone group keep getting read permissions to everything despite me removing it from the folder permissions.

Two how do I stop other users that have access to a folder edit the permissions and grant other users to the folder that they shouldn’t have.

I appreciate that things move on but the old version where you could use the Unix permissions to control access was a lot better and appeared to be a lot less problematic.

Hopefully someone out there could kindly help.

Thanks in advance

 

[Christmas]

Finding this really frustrating trying to achieve something that should be so simple to setup that is fundamental to a storage system

Still struggling to get any kind of sensible permissions to work. Tried windows ACL’s and Unix ACL’s. The Unix ACL’s are more sensible but keep resetting there self’s. Very annoying. Got what I wanted working with Windows ACL’s but then it broke itself and there is no way no stopping a user granting other users access to folders that they should have. This is where windows user the share permissions that a Unix system would have.


After spending countless hours disappearing up somewhere dark I am now thinking of changing to an older version of FreeNAS or moving to NAS4Free.

 

[anodos]

Post /etc/local/smb4.conf. If you grant users "modify" permissions, but not "full control" then they will not be able to modify permissions.

 

[Christmas]

Well after a lot of work I have finely got my permissions working the way I wanted. Took a few days, some research and a lot of hours trying different configurations but it now all working.

I ended up making sure the owner and primary group setting were all configured appropriately. Editing the shares ACL’s from a windows machine. Thanks to Anodos for reminding me about giving users modify and not full control to a share. Not sure why I didn’t remember this. And lastly I used some auxiliary parameters to add some additional control to the shares and make sure the response from the server was consistent.

I found a couple of issues trying to get this working:

· Firstly my windows client wouldn’t see any of the groups that were on the server whilst editing the ACL’s. After rebooting the server this seemed to resolve the issue.

· Secondly after rebooting the server the ACL permissions get screwed up. If you open a share from a windows client you only see the GUID of the user or group and the permissions don’t work. I managed to find some command in another tread that you run on the server which resolves this. I created a script and run this when every this happens. I think this maybe a bug

A lot of work but happy that everything is now fully working the way I wanted it.