[Solved]upgraded from old 11 to latest 13, looks like only the GID 1000 can access samba

[Jay629]

Anyone has a hint where to look for?
I upgraded it few days ago, was running for a few minutes, then got the doorbell handshake error (yes freenas in VM), searched around, the host reboot appears to have fixed it.
Later I also upgraded the pool version.

I also moved the VM to another net, since then samba has been very intermittent, DHCP can't correctly receive a gateway, so I have to manually enter the default route.
Then the web GUI can't stick with the IP address even when the interface already receives an IP.
Besides, the interface already has the new net IP, but web GUI is still trying bind the old address.
Eventually I disabled DHCP, manually entered the static IP, gateway / default route, DNS; after this the new address shows up for the web GUI binding.

During the above processing, I did a factory reset, so I imported the pool, have to re-do the samba share too.
After creating group, user, shares, etc, during testing, only the 1st created group can access samba.
users on all other groups will get access denied error.
(the builtin_users doesn't seem to do anything, having it or removing it from user's aux doesn't effect samba acess)

I then deleted all groups and users (keeping only the root of course),
created group1 GID 2000, group2 GID 3000.
created user name test password test, assign it to group1,
restart samba, try the test/test account, no access.
changed the primary group to group2 (the aux is the automatically added builtin_users), restart service, no access,
then I created group3 with GID 1000, changed test's primary group to group3, restart service, now samba works.

Anyone got a hint?
It appears that only GID 1000 can have access to samba.
Not sure if a known issue, or a "feature" along all the updates?
Thanks

 

[Jay629]

Finally found the issue...
While selecting the restricted mode, it removed the 3rd Everyone entry, leaving only the owner and owner group saved.
It works after adding a 3rd ACL entry for Everyone or just the user, and add Execute permission.

So I have 3 folders shared:
/mnt/tank/NAS/share1
/mnt/tank/NAS/share2
/mnt/tank/NAS/share3

for the NAS dataset only two entries in the ACL setting,
if I make a share with /mnt/tank/NAS/share3 for example, and map it as network drive under windows, access will be denied until I add a 3rd entry with Execute permission for the NAS dataset.

Appears to be all working like before now, phew~

 

[Jay629]

the 13 U4 worked for an hour or so, then started to become intermittent again.
decided to do a clean install with the 12 U8.1 rather than the 13 U4
from the fresh start, dhcp works wonderfully, no more bizarre disconnect.

and from the fresh install, found out that the builtin_users group is automatically added to dataset with traverse permission,
this is probably why my nas didn't work even though they all had this group in the aux.
the upgrade didn't add this group to datasets.

Anyway, guessing I'm sticking with 12 U8.1 for now.