Share Permissions Setup That Works - Help

[kjameson]

Just upgraded from 9.1.01 to the latest & greatest 10.3.0.3 2987 ... big, big mistake! After a week of struggling, researching, building a half dozen test servers, etc. I am going back to 9.2.0.1 / 9.1.0.1 ... tonight! They just work ... out of the box ... like a file server is supposed to ... so frustrating and such a waste of time. I cannot get a set of Samba permissions that work ... tested & tested! First user creates a file, and when second user opens the file, it is "Read Only" ... If anyone knows a way to get the "latest & greatest" working, I'd like to buy you a "Coke" ... I've read so many "fixes" that don't work ... all I want to do is simple file sharing ... nothing complicated! Seriously, I'd like to understand what the deal is ... what am I missing?

No easy way to get my V28 pools back ... what a mess!

[crowi]

Did you save your 9.1.x.x config file, install the 10.3. and import your old config?
That's the usual and painless way to upgrade

[kjameson]

Thanks for your response ... yes, I did! My only problems surround permissions ... apparently Samba 4's use of ACLs or ??? I see you are using several 10.3 setups ... are you not having permission issues? Mine consist of Windows users opening files in Read Only mode ... even though they have permission ... even 0777 ... functionally unusable! Thanks!

[crowi]

no I have no issues as I don't use any sophisticated user management
You can switch to smb3 / smb2 in The SAMBA/CIFS settings --> Max Protocol
and you can en-/disable the ACL features at Services|CIFS/SMB|Share|

[kjameson]

Crowl ... thanks for responding ... I fail to understand ... If USER1 creates a file ... USER2 opens that file OK ... when USER2 re-saves that file NAS4FREE changes the owner to USER2 ... and nobody but USER2 can open it except READ ONLY!
Now complicated ... does not work! Any recommendations? 0777 & both users are in the same group!

[juddyjacob]

I too have noticed a issue with permission inheritance and enabling ZFS ACL controls. Currently I do not have a working solution but to disable ZFS ACL's & ACL inheritance. Then all works as expected after restarting Samba. Though this doesn't exactly help me as I need the use of ACL's on ZFS. Looking forward to the answer however.

[kjameson]

juddyjacob ... thanks for "confirming" my suspicions ... I was beginning to doubt my own sanity ... just finished moving all my data from 10.3.0.3 zfs v 5000 ... back to 9.2.0.1 and it works ... this is crazy ... wondering if anybody checked this out before releasing ... ??? If I get an answer ... I'll talk about it here ... I didn't try disabling ACL ... will test that! Thanks!

[juddyjacob]

I've been playing around a bit. I was able to get it to work by editing the group@ ACL and using pass through for ACL Inherit and ACL mode. But really should not have to do that. Strangely the files and directories did not reflect the ACL inherited mode set, but did allow me to change the files. I too think I will hold off on the new versions. I feel for you, I have 1 to roll back too now...lol

[kjameson]

For your entertainment ... I maintain a domain for a client of mine ... have access to numerous servers, workstations ... I set up the following scenario ... after I realized NAS4FREE had a problem ... created a dataset just for testing ... wheel, staff 0777 ... shared it with Samba ... created two workstations ... made them users in NAS4FREE in primary group wheel, secondary group staff ... on my administrative workstation I ssh'ed into the NAS4FREE 10.3.0.3 (AMD 6128, 32G ECC RAM, 4-2TB HD in Raid 6) ... using PUTTY ... so I could watch file ownership within the dataset, etc. ... went to workstation "STA192" (user STAT192) and created a file in MS Word 2007 ... saved it in the test dataset ... file showed STAT192:staff 0777 ... STAT192 can reopen document back up ... write it back, etc. ... OK! ... went to STAT129 ... opened file in MS Word 2007 ... file opens as READ ONLY ... PUTTY machine shows file ownership changes to STAT129:wheel ... now STAT192 opens file READ ONLY ... this stuff is not normal ... makes "file server" unusable ... I don't think it is a "mis-setup" issue either ... any way, before I realized that there was an issue, I had copied almost 2 Terabytes of data to the machine ... using ZFS 5000 ... NAS4Free 9.2.0.2 doesn't offer that version of zfs ... so I had to create a dummy machine on NAS4Free 9.2.0.2 and copy data to "dummy", reload NAS4Free new server from 10.3.0.3 back to 9.2.0.1 and copy data back! Loads of fun ... thank God for rsync ... pot of coffee ... long story short ... problem disappeared on 9.2.0.1 ... all seems well! Not sure where to go from here ... wait for new version & hope it works (somehow)? Thanks for your help!

Love ZFS ... love that NAS4Free allows GUI set up of users being in multiple groups!

[KimmoJ]

Your writing style is extremely painful to follow.

Might I suggest short, clear sentences, followed by an actual carriage return?

I'd like to help but about three lines into your explanation my eyes glaze over and I can't be bothered to try to figure out what you're saying.

Using "..." constantly is extremely annoying to read.

Now, permissions in general are not difficult. You should set them on a per group basis. In other words, if you have users with similar security settings that need access to the same files, add them to a group. Then give that group permissions.

The owner of the share should not be one of these users personally. Use groups as much as possible.

[kjameson]

Kimmoj, truly sorry my "writing style" annoys you so much. Thanks for all the "pointers" regarding sentence structure, etc. I do appreciate you taking the time to respond ... I am very familiar with how permissions are supposed to work. While I am by no means an expert on ACLs, I do have users who are members of several groups in order to have access to different datasets, directories, and files which are somewhat sensitive. And, it appears to me that something is seriously awry with 10.3.0.3. It is probably me, but I could not get 10.3.0.3 to function as (I thought) it should, and apparently others have experienced similar problems. Version 9.2.0.2 works fine. I am planning to build a "test" server and go back over my findings. The though of reporting this issue occurred to me, but I don't want to be premature, and posted here to see if any other users had similar problems, and they do! Again, thanks!

[juddyjacob]

It's not you, something is broke in 10.3

[kjameson]

juddyjacob , Thanks for the vote of confidence. After a few days of craziness, you begin to doubt yourself. Wondering if I should report this as a "bug"?

[juddyjacob]

Yes, I was going to report it, but I was busy rolling back a server lol

[kjameson]

That is probably the only way it'll ever get fixed!

[kjbuente]

One thing that I did to my shares that helped on the READ-ONLY front is adding these lines...

Code: Select all

inherit owner = yes
map archive=no
map readonly=no

Maybe worth a shot?

I also agree that there is a problem with samba and ACLs, even with adding the above. My problem specifically comes to play when I am trying to apply permissions on existing data. They are simply not getting mapped correctly in the system.

[kjameson]

kjbuente ... Thanks!

[kjbuente]

kjbuente ... Thanks!

You are welcomed?

[juddyjacob]

New release 10.3.0.3 - 3065. I will be testing shortly, and I will let you know of my findings. Now where is my test box? LOL

[juddyjacob]

Well I just tested 10.3.0.3 - Pilingitam (revision 3065) with identical results to the previous versions. As soon as ACL inheritance is enabled, all files seem to be locked to the owner. Maybe it's something different, or I am missing something. Still working on it...

[kjameson]

Thanks for all your effort ... I loaded up the "new" NAS4Free 10.3.0.3 (rev 3065) as well ... it works no better ... this should not be this hard. I'm in this ... really want this to work ... Thanks!

[juddyjacob]

Hmmmm, Still trying to figure out whats going on here. Let's see if we can agree on a few things. first off I created a testing dataset called testacl. I used ACL Inherit passthrough, as well as the ACL mode set to passthrough. I have verified the mode in the console as showed

zfs get aclmode,aclinherit
DATA RZ1/testacl aclmode passthrough local
DATA RZ1/testacl aclinherit passthrough local

OK Looks Good!!!

Created a directory in the dataset called "test"

drwxr-xr-x 3 root wheel 3 Nov 6 00:36 test - OK simple so far right!

Created a share for the file, note* after it not working as expected I have added some options


[test]
comment = test
path = /mnt/DATA RZ1/testacl/test
writeable = yes
printable = no
veto files = /.snap/.sujournal/
hide dot files = yes
guest ok = no
inherit permissions = yes
inherit acls = yes
vfs objects = shadow_copy2 zfsacl aio_pthread
nfs4:mode = special
nfs4:acedup = merge
nfs4:chown = yes
shadow:format = auto-%Y%m%d-%H%M%S
shadow:snapdir = .zfs/snapshot
shadow:snapdirseverywhere = yes
shadow:sort = desc
shadow:localtime = yes
veto files = /.zfs/
inherit owner = yes
map archive = no
map readonly = no
strict locking = no
store dos attributes = yes
csc policy = disable
nt acl support = yes

OK, so lets have a look at my folder created within the share "test folder"
drwxrwx---+ 3 root wheel 6 Nov 6 01:20 "test folder2"

getfacl test\ folder2/
# file: test folder2/
# owner: root
# group: wheel
user:juddyjacob:rwxp--aARWcCos:fd-----:allow
owner@:rwxp--aARWcCos:-------:allow
group@:rwxp--a-R-c--s:-------:allow
everyone@:------a-R-c--s:-------:allow

Are we in agreement I should be able to write to this directory, modify files with this directory?

I can create a text document
I can edit the text document I created.... this is weird ?!?!?! This is how the document I created through the file share shows!!!
I can delete files

----------+ 1 root wheel 9 Nov 6 01:41 New Text Document.txt

getfacl New\ Text\ Document.txt
# file: New Text Document.txt
# owner: root
# group: wheel
user:juddyjacob:rwxpD-aARWcCo-:-------:allow

I can open and read other documents within this folder
I can rename a existing file "That I did not create or own"

I cannot create a folder
I cannot edit a document

OK so lets try this..............

CONSOLE-----> touch test4.txt
-rw-r--r--+ 1 root wheel 21 Nov 6 01:51 test4.txt

I can edit test4.txt
I can rename test4.txt
I can delete test4.txt

I have never seen zfs act this way. Anyone else ?? I really think there is a bug somewhere. But after this I am leaning to thinking there is a issue with Samba

Samba version 4.3.11
Locked files:
Pid Uid DenyMode Access R/W Oplock Share Path Name Time
-------------------------------------------------------------------------------- ------------------
21655 1002 DENY_NONE 0x100081 RDONLY NONE /mnt/ DATA RZ1/testacl/test . Sun Nov 6 01:54:35 2016
21655 1002 DENY_NONE 0x100081 RDONLY NONE /mnt/ DATA RZ1/testacl/test test folder2 Sun Nov 6 01:54:44 2016


I did not try 10.3.0.3.3105

[juddyjacob]

if this is true.. there may be light at the end of the tunnel soon
03 November 2016 - Samba 4.3.12 Available for Download

[UMMS]

juddyjacob, I have replicated your test with the latest version of the NAS4Free (10.3.0.3.3105). I can confirm, there is the bug. I also believe that the bug is in Samba or its interpretation in Nas4free. When ZFS ACL inheritance controls are disabled all seems to be returning to normal.

My install was fresh and on a fresh pool and hardware.

If anyone has an option to check the latest beta based on BSD11, that would be great. At least we would get a better sense of the problem spread-up.

I recall the topic here or on freenas forum regarding the similar issues, and the suggestion was to change permission using windows' file permission interface/applet,while change the owner of the dataset/folder to something like Administrator:workgroup (user:administrators) or other 'standard' Windows credentials. I can't find this topic again, but I stated what I remember here.

I found, someone already opened a bug. It would be good to add a link to this topic there.


Thank you for your help in debugging this, juddyjacob
UMMS.