SMB shares show even if user doesn't have permission

[icdadmin]

I've created datasets in a pool that have permissions set only giving certain groups to each dataset. Then, I've created Windows shares that each have their path set to each dataset created.

When users connect to the NAS either in Windows or in MacOS, Windows Explorer / Mac Finder both show shares that the user doesn't have access to. When the user double-clicks to try to access them, they cannot and the system indicates they don't have permission, which of course is correct.

But, how can I get those shares (the ones that user's don't have access to) to not show up at all. I would like the user to only see a listing of shares that they should be able to connect to.

 

[Yorick]

This thread might help
https://serverfault.com/questions/144339/hiding-samba-share-from-browse-list-for-unauthorised-users

 

[icdadmin]

Is there a place in the GUI (web GUI) where Samba configuration files are accessible for editing?

 

[Basil Hendroff]

But, how can I get those shares (the ones that user's don't have access to) to not show up at all. I would like the user to only see a listing of shares that they should be able to connect to.

Refer to 'Access based share enumeration in SMB' in SMB Tips and Tricks

 

[Basil Hendroff]

Is there a place in the GUI (web GUI) where Samba configuration files are accessible for editing?

Global parameters in SMB Service - https://www.ixsystems.com/documentation/freenas/11.2/services.html#smb
Local parameters in individual SMB shares - https://www.ixsystems.com/documentation/freenas/11.2/sharing.html#windows-smb-shares

 

[icdadmin]

I added "access based share enum=yes" to the SMB Service area so that it would be global to all shares, but they're still showing up. I'm not using AD or anything. Just straight file sharing with local (on FreeNAS) user accounts. I must be doing something wrong someplace.

 

[Basil Hendroff]

access based share enum=yes

It's a local parameter and not a global parameter and must be added to the share.

 

[icdadmin]

Still not working. Do you know if I would need to do the steps related to Windows "Computer Management" in the "Access based share enumeration in SMB" article you referenced if I'm not in an AD environment? I've added the "access based share enum=yes" line to each of my shares, but they all show up for users regardless of whether they have permission to view them or not.

 

[Basil Hendroff]

Follow all the steps. Get it working on one share first.

 

[Yorick]

This might be relevant: https://forum.openmediavault.org/in...ound-for-workgroups-Hide-shares-that-users-d/

This may have changed by now - at one point, that option only applied to domains, not workgroups

 

[seanm]

The awesome 'SMB Tips and Tricks' @anodos wrote say "This how-to is for AD member servers, but the steps can be modified to accommodate standalone samba servers.". Unless I'm just not seeing it, there's no discussion for the latter case.

At step 2 I don't see my FreeNAS shares at all, despite being connected to one at the time.

 

[anodos]

The awesome 'SMB Tips and Tricks' @anodos wrote say "This how-to is for AD member servers, but the steps can be modified to accommodate standalone samba servers.". Unless I'm just not seeing it, there's no discussion for the latter case.

At step 2 I don't see my FreeNAS shares at all, despite being connected to one at the time.

I guess I never really finished that how-to. This will be easier to set up in 11.2-U4 (we will add a dropdown for an SMB admin group that has the required privileges to manage a standalone server via Computer Management).

 

[seanm]

But until then... is using "sharesec" the only way?

 

[seanm]

@icdadmin these two related threads may help you:

https://www.ixsystems.com/community/threads/restrict-access-to-one-share.44413/#post-297190
https://www.ixsystems.com/community/threads/methods-for-fine-tuning-samba-permissions.50739/

After reading all that, I think I got it to work. Let's say your share is named FooBar

1) add "access based share enum=yes" as an aux parameter on the FooBar share.
2) from the shell, use 'net usersidlist' or 'net groupmap list' to determine the SID of a local FreeNAS user or group ex: S-1-5-21-7567469271-2383756280-2683756379-1001
- add a 'share permission' for the SID (remember this sets maximum permissions) and remove the default one:

sharesec Test -a S-1-5-21-7567469271-2383756280-2683756379-1001:ALLOWED/0/FULL
sharesec Test -r S-1-1-0:ALLOWED/0x0/FULL

3) stop/start samba

As I understand it, you should still use Properties > Security (from Windows) to configure file permissions.

 

[icdadmin]

Thank you so much everyone! Between adding "access based share enum=yes" to each share's settings and then using sharesec using the steps @seanm suggested, it is now working perfectly. I really appreciate everyone's help and guidance.

 

[seanm]

@anodos I was going to file a bug, but searched first, and found that a checkbox was added for "access based share enum=yes":

https://redmine.ixsystems.com/issues/25936

but that's it's missing in the 'new ui':

https://redmine.ixsystems.com/issues/73650

So in 11.2U3, where the latter is fixed, does that checkbox only set "access based share enum=yes", or does it invoke 'sharesec' internally to limit the share visibility? If so, to who?

 

[anodos]

@anodos I was going to file a bug, but searched first, and found that a checkbox was added for "access based share enum=yes":

https://redmine.ixsystems.com/issues/25936

but that's it's missing in the 'new ui':

https://redmine.ixsystems.com/issues/73650

So in 11.2U3, where the latter is fixed, does that checkbox only set "access based share enum=yes", or does it invoke 'sharesec' internally to limit the share visibility? If so, to who?

It only sets the smb.conf parameter. You will need to use computer management MMC snapin to define who can see the share in the browse list.

 

[shota]

Just for your interest, this will be fixed in 11.3 hopefully...
https://jira.ixsystems.com/browse/NAS-100103
https://github.com/freenas/freenas/pull/3206

 

[anodos]

Just for your interest, this will be fixed in 11.3 hopefully...
https://jira.ixsystems.com/browse/NAS-100103
https://github.com/freenas/freenas/pull/3206

It's exposed via the websocket API. There will be no UI integration in 11.3. The main reason why I put this in is to persistently store changes to the share_info.tdb.