TrueNAS Core SMB Shares Multiuser Access

[zbyte]

I have been using TrueNAS for a few months, it's been working exceptionally well (knocking on wood), as a pure NAS appliance really I find nothing to complain about.

I do have an issue with operation, specifically understanding the SMB shares and how TrueNAS implements the Datasets and Shares.

I read the documentation, the permissions sections and other forums posts as well, and in my specific environment there is something I quite don't comprehend yet after dedicating a few hours to it.

Initially I followed some YouTube video or forum to create my 1st Dataset, named "plxmedia" and per suggestions from that forum or video I created a subset dataset named "plex", permissions assigned were for a user I created as "plex", I was able to access the resource and add files to it with no issues. Later on I added other datasets with other names for other types of data but I followed logic during creating these and are functional with no subset (more on that later).

This is my 1st dataset

And this is the associated SMB share

Now apparently the share that is actually functional is not "/mnt/p19tbz2/plxmedia" but "/mnt/p19tbz2/plxmedia/plex" however when accessing this share with the user plex it shows on my Windows Workstations as sharename "plxmedia"

Now this "plex" subdataset permisssions are these:

And the share like I mentioned is functional.

First Question if someone can help

1. Why does the share is presented to Windows workstations are plxmedia and not plex? and why there is no actual share (the Sharing/Windows Shares plxmedia share is pointing to the root plxmedia dataset not plxmedia/plex), basically how come is the share resource working with no actual SMB share directly mapped.

My main purpose is to have one user "plex" with full access to the share but I want another user "jellyfin" to have read access only. Reading the documentation found I could just add another user so I do this on the "plxmedia/plex" dataset adding an ACL ITEM

This change doesn't allow me to access the plxmedia share, but this shows on the Pools section

If I add the jellyfin user to plxmedia as a 3rd ACL item it will give me access but to an empty share with no files which I believe is actually plxmedia but it won't show the contents of plxmedia/plex

This is very confusing on the way it operates, I would like to simplify and have everything under plxmedia (not plex) withount needing to copy the 4.5 TB from media to another media and then back.

Additionally this happens.

On a separate Dataset named "audiodataset" I have 2 users, "audio" and "roon", "audio" with full control and "roon" with read only access

This is working as intended with the permission set as intended and both users can access the share with no problems.
Visually I get this on TrueNAS's console

Why when the share is accessed by these users there is this "ghost" dataset created under "plxmedia", even with the access close the ghost share remains, I can delete it and it doesn't affect anything but why does it shows there? to me it seems like a bug but it might not be not sure.

Any help or comments will be greatly appreciated

Thanks

 

[tauronux]

I have been using TrueNAS for a few months, it's been working exceptionally well (knocking on wood), as a pure NAS appliance really I find nothing to complain about.

I do have an issue with operation, specifically understanding the SMB shares and how TrueNAS implements the Datasets and Shares.

Did you ever solved this? I have the exactly same problem.

 

[zbyte]

I did, it was really simple, I'll get back to you later

 

[zbyte]

Starting from the beginning:
1. you create your pool of course with 1 vdev or multiple ones
2. Then you add your datasets under the pool.

3. You create a user and a group and you apply these to the dataset as an ACL (this is where the confusion comes in, the ACL allows full control typically unless you want to restrict it more. See attached. There may be cases you would like to have multiple users for the same dataset. For example audio and media datasets. I read 2 days ago someone that was attacked by ransomware which encrypted his plex library. For my audio library I have 2 users. User=audio which has full control and user roon which has read only access. If my Roon PC is compromised the share I'm exporting to it is read only so that PC cannot delete or alter the contents of my audio folder.

4. Then you go into SHARING - WINDOWS SHARES SMB and create the names for the shares and you map these to the datasets

5. For the share permissions you edit the SHARE ACL not the FILESYSTEM ACL

6. You want the share ACL to have Full permissions (typically, YMMV)

Summarizing:
1. Create dataset and assign users permission there, some full control some read only (filesystem ACL)
2. Create SMB share and assign full permissions (typically, not always, it depends), this is what the SMB structure permissions will be on the dataset but the users on the dataset ACL are the ones deciding the access

Hope this helps

 

[tauronux]

Actually i solved it by starting from scratch and redoing everything. I don't know why it was not working as intended the first time as i've followed the official documentation, but now it works. Thanks for sharing