CIFS problem making basic guest share

[chufi]

Trying http://forums.freenas.org/index.php?threads/cifs-windows-sharing-guide.20948/ Going for the guest + admin type access though at the moment I am just adding a guest only share for music.

I have a guest account set up, I have the share set up with guest access checked, CIFS is on with my guest account selected. I try to log in and get a permission denied error using either guest and a blank password or blank/blank. I have logging set to debug, what I find curious is I can't seem to find where it logs the permission denied error?!

I don't use windows so most of my stuff is managed my mac shares (including the volume this window share is on) but I have Sonos Music system that connects with SMB so thus making a readonly windows share for it to access.

I realize I probably have something misconfigured but I can't quite figure it out so any thoughts would be appreciated.

I attached screenshots of what seems to be the appropriate GUI config and here is the smb.conf

[global]

server max protocol = SMB3

encrypt passwords = yes

dns proxy = no

strict locking = no

oplocks = yes

deadtime = 15

max log size = 51200

max open files = 11070

syslog only = yes

syslog = 1

load printers = no

printing = bsd

printcap name = /dev/null

disable spoolss = yes

getwd cache = yes

guest account = guest

map to guest = Bad User

obey pam restrictions = Yes

directory name cache size = 0

kernel change notify = no

panic action = /usr/local/libexec/samba/samba-backtrace

server string = FreeNAS Server

store dos attributes = yes

map archive = no

map readonly = no

map hidden = no

map system = no

time server = yes

null passwords = yes

acl allow execute always = true

local master = yes

server role = standalone

netbios name = FREENASSMB

workgroup = WORKGROUP

security = user

pid directory = /var/run/samba

smb passwd file = /var/etc/private/smbpasswd

private dir = /var/etc/private

create mask = 0644

directory mask = 0755

client ntlmv2 auth = yes

dos charset = CP437

unix charset = UTF-8

log level = 10





[MusicLossless]

path = /mnt/PeelerLake/Pool/Music

printable = no

veto files = /.snap/.windows/.zfs/

writeable = no

browseable = yes

inherit owner = no

inherit permissions = no

recycle:repository = .recycle/%U

recycle:keeptree = yes

recycle:versions = yes

recycle:touch = yes

recycle:directory_mode = 0777

recycle:subdir_mode = 0700

shadow:snapdir = .zfs/snapshot

shadow:sort = desc

shadow:localtime = yes

shadow:format = auto-%Y%m%d.%H%M-2m

vfs objects = shadow_copy2 zfsacl streams_xattr aio_pthread

hide dot files = yes

guest ok = yes

guest only = yes

inherit acls = no

nfs4:mode = special

nfs4:acedup = merge

nfs4:chown = yes

zfsacl:acesort = dontcare

 

[SweetAndLow]

my guess is that the guest user doesn't have permissions to access the movie folder. Because of this you can't mount the network path. Need more information, what are the permissions and owner group of the directory you are trying to share?

 

[chufi]

I have the main zfs volume /mnt/PeelerLake owned by root/wheel under that is /mnt/PeelerLake/Pool which is owned by chufi/wheel both set to mac/windows acl so the options for unix style permissions are grayed out. In the /mnt/peelerlake/pool is a directory Music which I am trying to export vis the windows share.

 

[SweetAndLow]

yeah ok, I'm going to repeat myself from my previous comment, so what are the permissions on the directory you are exporting via windows share? This means the permission of "Music".

 

[chufi]

Heh, I'm definitely not processing, as I was clearly just looking at the volume - not even sure how to see the permissions on a particular folder from inside freenas gui. I'm not anywhere I can access that network at the moment but will poke at it tomorrow and let you know.

 

[SweetAndLow]

How did you create the folder on the first place? Only way would be to use the share or CLI. And since you don't have the share working I'm assuming you used the CLI. So in the GUI there is a shell option. And if you cd to the dataset you can do a ls -l and see the permissions.

 

[chufi]

I have a mac share of /mnt/PeelerLake/Pool which works fine with a user/password. I created the folder using that. If SMB is using the underlying unix 'other' permissions for guest it is easy enough to ssh over and make sure the music folder has them. Do you know where permission denied errors might be logged with smb as it seems like something that should be logged with full debug turned on. Still not near that network to check at the moment but hopefully soon.

 

[SweetAndLow]

From what you explained the permissions are working perfectly. You created a folder with a different user from a different computer and can't access that with a different user. Your going to have to ssh in and use setfacl and getfacl to modify the permissions or modify them from the Mac GUI. It's hard for me to give you specifics on what to set things to, that is up to you and you will probably have to play with it.

 

[chufi]

I'll definitely go poke around. I thought I had the original user who created the folder set with default file/dir permissions set to allow world read but that is clearly unix permissions not acl so not sure how/if that translates. Thanks for putting up with me, I've not dealt with acls/windows before. Will post success/fail.

 

[SweetAndLow]

I'm also assuming you are using acl's because this is a windows/mac share. And if you clicked that box on the dataset creation then you are using acls. if not then you are using posix permissions and you can use chmod and chown.

 

[chufi]

Hmm didn't have any luck, I haven't used get/setfacl before so I suspect I'm just missing something or mis-interpreted the command examples. Here is what I did:

[root@freenas] /mnt/PeelerLake/Pool# getfacl Music
# file: Music
# owner: eric
# group: wheel
owner@:rwxp--aARWcCos:------:allow
group@:------a-R-c--s:------:allow
everyone@:------a-R-c--s:------:allow

[root@freenas] /mnt/PeelerLake/Pool# setfacl -m everyone@:read_set:fd:allow Music
[root@freenas] /mnt/PeelerLake/Pool# getfacl Music
# file: Music
# owner: eric
# group: wheel
owner@:rwxp--aARWcCos:------:allow
group@:------a-R-c--s:------:allow
everyone@:r-----a-R-c---:fd----:allow

[root@freenas] /mnt/PeelerLake/Pool# find Music -print0 | xargs -0 setfacl -m everyone@:read_set:allow

At which point I tried mounting the share and got permission denied again.

 

[chufi]

Ok tried this:

[root@freenas] /mnt/PeelerLake/Pool/Music# find . -type d -print0 | xargs -0 setfacl -m everyone@:r-x-D-a-R-c---:fd----:allow

[root@freenas] /mnt# xargs find /mnt/PeelerLake/Pool/Music -type f -print0 | xargs -0 setfacl -m everyone@:r-x-D-a-R-c---:------:allow

which seems to have gotten me able to mount as guest. The second command still hasn't finished which I find a little weird since it's been 30 minutes and there are only 8717 files in there.

 

[chufi]

Of course it didn't finish because I'm an idiot and have xargs in the front. All seems quiet on the western front now.