SOLVED Managing permissions from Windows

[PabloUserT38]

I find the permissions manager for SMB shares in TrueNAS very confusing.

Can I just manage permissions on Windows by using the folder properties secutiry tab on the mounted share?

 

[anodos]

I find the permissions manager for SMB shares in TrueNAS very confusing.

Can I just manage permissions on Windows by using the folder properties secutiry tab on the mounted share?

Yes.

 

[PabloUserT38]

Thank you very much. It has saved my life. For some reason, TrueNAS wasn't understanding my ACLs to give full control to a group of users. I had to give full control from Windows and now it works.

EDIT: Very interesting the link on your signature.

 

[anodos]

Thank you very much. It has saved my life. For some reason, TrueNAS wasn't understanding my ACLs to give full control to a group of users. I had to give full control from Windows and now it works.

EDIT: Very interesting the link on your signature.

There shouldn't be any difference between the GUI and doing it through Windows (both eventually translate into the same OS system calls). There will be some effort to improve UI ACL manager in future.

 

[PabloUserT38]

My joy didn't last much. While this worked for a few minutes, it stopped working. I'm back to square one.

Here's the situation:

I have two datasets A and B. B is a child of A. Both are shared with the exact same respective names for the SMB shares.

I have two Windows domain groups: Advanced and Basic. (Advanded is for a higer rank group of employees, while Basic corresponds to a lower ranked group.)

Both datasets A and B have user:group as root:wheel, which is fine to deal with SSH access.

Now I select a restricted ACL preset, then add Full Control permission to group Advanced and check both "Apply permissions recursively" and "Apply permissions to child datasets". Now I check on a Windows workstation and everything is working as expected.

Next, I go with share B. Open its Filesystem ACL, where I find the previously given permissions for group Advanced, then add full control to group Basic too.

This should provide full control to the whole of A, (including share B, since it's a child of A) to Advanced users, but also access to B for Basic users.

But it doesn't.

First, when checking permissions of A on Windows, I can see the Basic group has not been given Full Control permission, but all the rest are checked. I check Full Control and apply. Go back to TrueNAS GUI and nothing seems to have changed there. At first, B got access from this operation (that's when I thanked you for your help), but a few minutes later, it had no more access.

I don't know if there's a bug in TrueNAS or I'm doing something wrong.

Since Advanced seems to have full access to the A share and it worked from the beginning just fine, I'm tempted to simply move B outside A and reshare, but I'm not sure how that would change things, since B will still need to have permissions for two different groups (Advanced and Basic), unless I make the whole group Advanced a member of group Basic (which I haven't tried, honestly).

Sorry for the winding explanation. I hope I made myself clear, but if not, please don't hesitate to ask.

Thanks in advance.

 

[anodos]

So you have
/mnt/tank/a
/mnt/tank/a/b

"Advanced" needs access to a/b, and "Basic" needs access to only "b".
You need to grant "Basic", the "TRAVERSE" permissions set on "/mnt/tank/a" with the "INHERIT" flag set to "NOINHERIT". This basically allows him to go through "a" to "b".

 

[PabloUserT38]

That seems to have made it. Didn't know about the "traverse" concept, but makes sense (shouldn't it be applied automatically when a group is given permissions to read a dataset that's inside another?).

Thank you so much. I must buy you a coffee, man.

EDIT: I'm new to these forums. Should I edit the title to "mark this thread as SOLVED"?

 

[anodos]

That seems to have made it. Didn't know about the "traverse" concept, but makes sense

Windows has a similar concept with the "Bypass traverse checking" security option.You can think of Unix as having this permanently disabled.

(shouldn't it be applied automatically when a group is given permissions to read a dataset that's inside another?).

I'd rather avoid automated permissions changes because a bug in that area can be catastrophically bad for users.

 

[Redcoat]

EDIT: I'm new to these forums. Should I edit the title to "mark this thread as SOLVED"?

As the OP it's yours to do - see the top right corner of the thread above post #1

 

[PabloUserT38]

As the OP it's yours to do - see the top right corner of the thread above post #1

Done. Thank you.

 

[zerowalker]

Oh gotta try this, couldn't make figure out how to make the permissions work.
Does this require that the truenas is joined in the domain?
cause i can't seem to make that work, i can make ldap work i think (at least it doesn't fail)