SOLVED Unable to copy file permissions

[tbol.inq]

Hello Forum,

I'm facing a really strange issue when migrating from NetApp Storage to iXsystem TrueNAS 13 by using robocopy.
The error is:

Code:

PS C:\Users\admin.bolduan> robocopy /E /MIR /COPY:S /R:0 /W:0 /NDL /NFL "X:\images" "Z:\DFS-CC-JEN\IT-Images"

-------------------------------------------------------------------------------
ROBOCOPY :: Robust File Copy for Windows
-------------------------------------------------------------------------------

Started : Mittwoch, 29. März 2023 17:06:41
Source : X:\images\
Dest : Z:\DFS-CC-JEN\IT-Images\

Files : *.*

Options : *.* /NDL /NFL /S /E /DCOPY:D /COPY:S /PURGE /MIR /R:0 /W:0

------------------------------------------------------------------------------

2023/03/29 17:06:41 ERROR 1307 (0x0000051B) Copying NTFS Security to Destination Directory Z:\DFS-CC-JEN\IT-Images\
This security ID may not be assigned as the owner of this object.


------------------------------------------------------------------------------

Total Copied Skipped Mismatch FAILED Extras
Dirs : 1 0 1 0 0 0
Files : 0 0 0 0 0 0
Bytes : 0 0 0 0 0 0
Times : 0:00:00 0:00:00 0:00:00 0:00:00
Ended : Mittwoch, 29. März 2023 17:06:41

so I checked the permissions on the source and found out that there is an issue, when TrueNAS sees Owners or permissions like "<SYSTEM>\Administrators" or BUILTIN\Adminsitrators. I fixed that and most of the folders now work and robocopy do not show errors for them anymore.

But there are some folders and files that still shows the error above. All the permissions are the same like the working folders. ls -l and getfacl shows that they have the same permissions and owners but robocopy still breaks down to the error 1307.

So I looked into the smbd logs on TrueNAS shell and compared what I see there for a working migration folder and a non-working.
Here are the results:

Code:

## working:
[2023/03/31 09:40:14.047759,  3] ../../source3/smbd/trans2.c:3506(smbd_do_qfsinfo)
  smbd_do_qfsinfo: level = 1001
[2023/03/31 09:40:14.047842,  3] ../../source3/smbd/trans2.c:3506(smbd_do_qfsinfo)
  smbd_do_qfsinfo: level = 1005
[2023/03/31 09:40:14.074453,  3] ../../source3/smbd/dir.c:1034(smbd_dirptr_get_entry)
  smbd_dirptr_get_entry mask=[*] found DFS-CC-JEN/IT-Install/Adobe Reader/. fname=. (.)
[2023/03/31 09:40:14.074515,  3] ../../source3/smbd/dir.c:1034(smbd_dirptr_get_entry)
  smbd_dirptr_get_entry mask=[*] found DFS-CC-JEN/IT-Install/Adobe Reader/.. fname=.. (..)
[2023/03/31 09:40:14.074584,  3] ../../source3/smbd/dir.c:1034(smbd_dirptr_get_entry)
  smbd_dirptr_get_entry mask=[*] found DFS-CC-JEN/IT-Install/Adobe Reader/AdbeRdr1001_de_DE.exe fname=AdbeRdr1001_de_DE.exe (AdbeRdr1001_de_DE.exe)
[2023/03/31 09:40:14.074617,  3] ../../source3/smbd/smb2_server.c:3956(smbd_smb2_request_error_ex)
  smbd_smb2_request_error_ex: smbd_smb2_request_error_ex: idx[5] status[STATUS_NO_MORE_FILES] || at ../../source3/smbd/smb2_query_directory.c:160
[2023/03/31 09:40:14.083850,  3] ../../source3/smbd/posix_acls.c:1124(unpack_nt_owners)
  unpack_nt_owners: owner sid mapped to uid 90000001
[2023/03/31 09:40:14.083878,  3] ../../source3/smbd/posix_acls.c:1145(unpack_nt_owners)
  unpack_nt_owners: group sid mapped to gid 100000514
[2023/03/31 09:40:14.085956,  2] ../../source3/smbd/open.c:1659(open_file)
  CORP\admin.bolduan opened file DFS-CC-JEN/IT-Install/Adobe Reader/AdbeRdr1001_de_DE.exe read=No write=No (numopen=3)
[2023/03/31 09:40:14.086272,  3] ../../source3/smbd/posix_acls.c:1124(unpack_nt_owners)
  unpack_nt_owners: owner sid mapped to uid 90000001
[2023/03/31 09:40:14.086298,  3] ../../source3/smbd/posix_acls.c:1145(unpack_nt_owners)
  unpack_nt_owners: group sid mapped to gid 100000514

## non working:
[2023/03/31 09:41:07.760624,  3] ../../source3/smbd/dir.c:1034(smbd_dirptr_get_entry)
  smbd_dirptr_get_entry mask=[*] found DFS-CC-JEN/IT-Install/Admin/_Check fname=_Check (_Check)
[2023/03/31 09:41:07.760662,  3] ../../source3/smbd/smb2_server.c:3956(smbd_smb2_request_error_ex)
  smbd_smb2_request_error_ex: smbd_smb2_request_error_ex: idx[5] status[STATUS_NO_MORE_FILES] || at ../../source3/smbd/smb2_query_directory.c:160
[2023/03/31 09:41:07.767268,  3] ../../source3/smbd/posix_acls.c:1124(unpack_nt_owners)
  unpack_nt_owners: owner sid mapped to uid 90000001
[2023/03/31 09:41:07.767873,  3] ../../source3/smbd/posix_acls.c:1140(unpack_nt_owners)
  unpack_nt_owners: unable to validate group sid.
[2023/03/31 09:41:07.767890,  3] ../../source3/smbd/smb2_server.c:3956(smbd_smb2_request_error_ex)

So the problem must be something with the validation of the group sid, but I can't figure out why the sid vannot be validated because the SID are the same like the ones in the other folder. So, where's the difference?


Any idea what I can do?




PS: There is no AntiVirus/File-Screening/Firewall/IPS active.


Best regards,
Toni

 

[tbol.inq]

For everyone who runs into the same issues and is about to get frustrated as hell.
If you are in a multidomain setup, please make sure that your other domains are also added to the IDMAP settings.

If not add a new entry at IDMAP settings, choose RID, your new domainname and a range of IDs to be used for that domain.

Next to that add a aux parameter to the SMB server:

Code:

force unknown acl user = yes

Finally, avoid Ownerships and Permissions on the source that have non domain specific objects like <FILESERVER>\<LOCALUSER>. TrueNAS does not map such users because they are not known.

Topic can be closed and marked as solved.