Volume/Dataset/Folders/Users/Groups - and permissions for access

[urobe]

Hey there,

my first build is up and running, and I'm now trying to figure out how it should be setup.Right now I'm trying to figure out how to set up the users and permissions.

We're a total of 12 Users, a mix of family and employees. Therefor I'd like to have some restrictions on who can access what.

This is what my plan is, maybe one could give me feedback if this is a decent way of doing things, or if it's a terrible plan:

I have created one volume called homeone. within this volume it looks like this:

\Homeone(Volume)
\data(dataset)
\User(Dataset)
\User01(Dataset)
\...
\User12(Dataset)
\WorkFiles(Dataset)
\FamilyFiles(Dataset)

I have created 13 Users, 12 for the individuals and one for backup purposes.

Three Groups, Employess, Family, Admin. The admin would be me and the backup account.

I would create now a share for each User01 to User12 dataset, in order to make this the directory for the users personal files. Only the user and the admin should have access.

I would create another two shares for the work files and the family files, which should be accessible by the groups family and employees, however, 3 Users should have access to both the family files and work files.

The only way of setting permissions I found is in the dataset options by making a certain user the owner, and giving the group access (or not) and not giving "others" any permissions.

So I'm not sure how I get certain users to access the entire data, and the three users that need access to the work and family files, I'm also uncertain about.

If someone could point me in the right directions, that would be great. The guides I read through didn't really go into detail on how permissions are best set and used.

-Peter

 

[kdragon75]

The admin would be me and the backup account.

Service accounts should be given the least privileges needed to function. I would advise a separate
non-admin account for backups.

I would create now a share for each User01 to User12 dataset, in order to make this the directory for the users personal files. Only the user and the admin should have access.

You can do one share and use access based enumeration. If a user does not have access, they cant see the folder. This may save a fair bit of administrative overhead.

The only way of setting permissions I found is in the dataset options by making a certain user the owner, and giving the group access (or not) and not giving "others" any permissions.

What you are looking at are simple Unix permissions. You will need to use ACLs to setup "complex" permissions. This can be managed from windows. I know there are a number of guides on the forum for this and will be helpful for your setup.
Generally in large environments the share permissions are set fairly broad and narrowed with file system ACLs with authentication handled by Active Directory or LDAP. In your case you just need the users names and passwords to match on the PC that they are working from to the user accounts on the NAS.

 

[urobe]

aaaahhh, i see. Thank you very much. This was very helpful. I'll look for some acl guides in the forum.

 

[urobe]

Does anyone know of a good ACL guide?

I installed freenas, created a new group, a new user and a smb share. I can access the share from the windows computer (matching username and password) but I can't write on the share, nor change the permissions in the windows security tab.

Any hint is greatly appreciated!

 

[Redcoat]

Here's a windows share guide: https://forums.freenas.org/index.php?resources/freenas-and-samba-smb-permissions-video.8/

 

[urobe]

thank you very much! This was a big help!