SMB AD Share ACL questions / example

[StevenD]

Current SCALE version: TrueNAS-SCALE-22.02.3

So I am testing setting up SMB shares from AD and want to make sure I am doing the permissions correctly (not missing anything important).
The goal is to setup a single main share directory (dataset) with sub directories (datasets) for each department. The user should only see the shares they have access too.

Note that there are no users configured in TrueNAS server, aside from root. All other accounts are AD users with appropriate department security groups.

Under Storage:
data (pool root dataset)
+shares (dataset) [sharetype smb] [this is the actual share setup below]
++department1 (dataset) [sharetype smb]
++department2 (dataset) [sharetype smb]
++department3 (dataset) [sharetype smb]

---

For the permissions on the Shares dataset:
owner@ - root Allow | Full Control
group@ - root Allow | Modify
Group - builtin_users | Allow Read (modify or read works, traverse breaks being able to view any shares. )
Group - builtin_administrators | Allow Full Control
Group - AD\Domain Users | Allow Read (modify or read works, traverse breaks.)
Group - AD\Domain Admins | Allow Full Control
Group - AD\deparment... | Allow Traverse (each department group set to traverse. This works unlike above. Possibly because of the read setting.)

For the permission on the department sub data sets:
owner@ - root Allow | Full Control
group@ - root Allow | Modify
Group - builtin_administrators | Allow Full Control
Group - AD\Domain Admins | Allow Full Control
Group - AD\deparment... | Allow Modify

Do you need builtin_users or domain users here? (The department group already grants access to the people that should have access.)
I could see setting builtin_users and domain users to read if you want read only access to all users, but modify only for a specific department.

---

Under shares -> Windows SMB Shares
Path: /mnt/data/shares
Name: shares
default share parameters
auxiliary parameters: hide unreadable=yes


So far I can login as a user and it only shows me the files for there group as expected. I think I got everything setup correctly.
Also, hopefully this post can help anyone else trying to this.

 

[anodos]

traverse breaks

Clicking through a path in file explorer requires opening / reading a directory, which of course requires READ permissions. TRAVERSE is for case where you're sharing "/mnt/tank/ds1/share" and need to alter ACL to prevent users from reading "/mnt/tank/DS1" locally or via another share.

builtin_users and bultin_administrators is really only important for case where you have local (on NAS) users.

 

[anodos]

auxiliary parameters: hide unreadable=yes

This will negatively impact directory listing speed. Perhaps very significantly.

 

[StevenD]

This will negatively impact directory listing speed. Perhaps very significantly.

Would the checkbox for "Access Based Share Enumeration" also have a significant impact on listing speed?
At this time, that checkbox is not selectable as an option. I am not sure why it is greyed out for SMB shares.

 

[anodos]

Would the checkbox for "Access Based Share Enumeration" also have a significant impact on listing speed?
At this time, that checkbox is not selectable as an option. I am not sure why it is greyed out for SMB shares.

Access Based Share Enumeration is about response to RPC request for list of available shares. It is not ABE in windows. We have not implemented ABE in SCALE because it would have significant impact on metadata performance by adding permissions checks in a _very_ hot code path in the Linux kernel / ZFS.