Users can't access under certain groups

[archialsta]

Hello,
I have installed TrueNAS 12.0 Release on my machine. I created a group 'family', added two users: user1 that is also member of wheel group that have read/write/execute permissions, and user2 that is only member of family group, and have also read/write/execute permissions assigned through ACL for the dataset 'Famiglia'. Now, the problem is when the user2, under the group family wants to connect to the 'Famiglia' folder through Windows 10, appears 'access is denied'. When I change the main group of user2 from family to wheel, he can connect. How can I solve that? Thank you.

 

[archialsta]

1. Here is user2 settings, you can see that the Primary Group is 'family'.

2. Here are the editing of the dataset Famiglia. Below at the right part, you can see that all the permissions are allowed, except delete and delete children.

3. Here you can see when I try to login with user1 credentials (family group). Appear 'access denied'. When I add user1 to wheel that have special permissions, the account can login.

4. Here is when I try to connect through a random username, appears: username and password are incorrect. So in the 3 part, is a permission login problem.

 

[anodos]

What is ACL on root of pool? "getfacl /mnt/Data-22TB-Z"

 

[archialsta]

 

[anodos]

View attachment 42765

That's your problem. You've cut off everyone who isn't a member of "wheel". chmod 755 /mnt/Data-22TB-Z

 

[archialsta]

Thank you, now is fine. I followed a tutorial on youtube, because I'm new to truenas. Next time I have to pay more attention.

 

[anodos]

Can you PM me a link to the tutorial?

 

[anodos]

Ugh. You are correct. He does say to chmod 770 the pool. I guess he doesn't computer very well.

 

[anodos]

To clarify this point. In unix, removing the execute (x) bit from "other" will cause the exact symptoms you were seeing. It basically prevents all users who aren't members of group (wheel in your case), or the owner of the directory, from being able to traverse. Windows has a similar concept, but it is not strictly enforced by default (but can be enforced by group policy).