Newb setting up storage server for the first time

[CCSav]

Hi folks,
I did a search but wasn't able to find the information that I'm looking for, so apologies if it's just poor searching skills on my part.

I've installed Free NAS on a custom built storage server for my church, where I'm the IT guy (my day job). We'd like to be able to have shared storage space for staff members, and expand the storage of our IP camera system as well. Ubiquiti has an article on how to point their NVR to an NFS share so I think I'm set on that part specifically, but I need a little help with underlying structure of the volumes/shares on the NAS. Our staff roster is fluid enough that using authentication would be a never-ending cycle of creating, modifying, and disabling users, and since it's not sensitive material, we're not presently concerned with who has access to whatever is on the staff storage, as long as they're on our hardline or staff wifi network. The trick is with the expanded NVR storage. The NVR has to have read/write permission, and I'd like to have another authenticated user or two with read-only permission for reviewing recordings and downloading copies as necessary, but otherwise I don't want the share to be accessible to anyone else - ideally it wouldn't even show up on the network, only allowing access via direct path.

I'm relatively new to Free NAS, so I don't know the best way to accomplish this. Two shares on a single volume? Separate volumes? We don't have AD, so on the NVR share we'd be authenticating via user credentials I create on the NAS, right? Lastly, what do I need to do to allow access only from staff wifi and ethernet? I want to make sure guests don't have access to this stuff, and set up our guest wifi on a separate VLAN - is that enough? Thanks in advance for any advice.

 

[seanm]

Welcome newbie. :)

You use the word "volume", are you familiar with the ZFS terms 'pool' and 'dataset'?

Without AD, yes, you'd create users/groups from the FreeNAS webui.

As for limiting networks, I think you'd have to use your switch/router/firewall for that. Of course you can forbid guess access to your shares from FreeNAS too.

 

[CCSav]

I have seen both "pool" and "dataset" but I'm not real familiar with them. If I understand correctly, a "pool" is the group of disks for RaidZ? I need to dig into this some more I guess. Any resources you recommend for learning this stuff?

 

[seanm]

There are many, but I don't have the links handy. Google for "Fester's guide" for example, even the wikipedia article on ZFS is good.

 

[garm]

@Chris Moore has a handy set of links to get yourself familiar with FreeNAS and ZFS relatively quickly. You really need to have a fairly high level of knowledge if the data stored on this server is of any value.

It would possible be a worth while investment to set up a directory if your user base is fluid, at least look at the the cost/gain of implementing eg OpenLDAP.

You have basically two high value choices when it comes to how the files are managed, network filesystems or Nextcloud.

 

[Chris Moore]

I'm relatively new to Free NAS, so I don't know the best way to accomplish this. Two shares on a single volume? Separate volumes?

Terminology, but also intent... If the shares have different intended purposes, like one is for file sharing and the other is for hosting virtual machines, you might need two different pools, with different characteristics, to get the most storage capacity from one pool and the most performance from the other. It is possible to use a single storage pool and create separate shares with different permissions, but Windows is very annoying about wanting you to authenticate all connections to a server with a single login name and password.

We don't have AD, so on the NVR share we'd be authenticating via user credentials I create on the NAS, right?

You can create user accounts on FreeNAS, you can also set FreeNAS up to be the AD server, if I recall correctly. You probably need to do some reading. There is a link to a resource in my signature. You probably need to spend some time investigating the options before jumping in.