Opinion on UNIX Permission Layout to SAMBA

[Soloam]

I know that its recommended to use CIFS permission if we plan to have a share in SAMBA, but I still prefere the old fashion UNIX format. But it can be tricky to set the permission on a layout that will allow a "upgrade" to a user in permission, without messing up the total permissions of the folders.

So I was thinking on this layout, some opinion would be appreciated,

Lets assume this folder layout in freenas

/mnt - root - wheel (rwx r-x r-x)
/dsk0 - root - wheel (rwx r-x r-x)
/homes - root - wheel (rwx r-x r-x) - SAMBA Share (home mapping)
/user1 - user1 - user1 (rwx rwx ---)
/user2 - user2 - user2 (rwx rwx ---)
/user3 - user3 - user3 (rwx rwx ---)
/media - root - media_a (rwx r-x ---) - SAMBA Share
/photos - root - media_w (rwx rwx r-x)
/movies - root - media_w (rwx rwx r-x)
/downloads - root - downloads_a (rwx r-x ---) - SAMBA Share
/programs - root - downloads_w (rwx rwx r-x)
/movies - root - downloads_w (rwx rwx r-x)
/series - root - downloads_w (rwx rwx r-x)

So this is the ideia...
- user1 Groups: user1, media_a, media_w, downloads_a, downloads_w
- user2 Groups: user2, media_a, downloads_a
- user3 Groups: user3, media_a

So:
user1 will be able to access the media and downloads shares (the media_a and downloads_a groups) and write on both (the media_w and downloads_w groups).

user2 will be able to access the media and downloads shares (the media_a and downloads_a groups) but not write.

user3 will be able to access the media shares (the media_a) but not write.

So the ideia is that in the future if I want user2 to be able to write on the media folder, I can give him permission to media_w. If I what to allow user3 to the downloads I can give him downloads_a that will let him pass the first folder, and then all the files insides allow "others" to read, but now write.

The Samba will be configured to create files with 664 (rw-rw-r) permission and folders with 775 (rwx-rwx-r-x).

What do you think? Security and Scalability?

Thank you all

 

[m0nkey_]

What do you think? Security and Scalability?

UNIX permissions won't scale very well when using it with SMB.

If you've not already seen it, I cover SMB and permissions in this how-to video: https://forums.freenas.org/index.php?resources/freenas-and-samba-smb-permissions-video.8/

 

[Soloam]

I had seen this movies, thank you for the contribute. I just wanted to stick with UGE permissions, but I think that I'll start converting everything to ACL. Just one huge problem, the ACL editor, I use Linux on my main computer, I tested some ACL editors on Linux, but they do not work well on remote folders. I have two solutions, one I user setacl, but as you stated, not a good ideia, or I have to use a VM to edit the ACL in windows explorer.

Thank You