Despite set permissions, everyone is accessing

[NMGMarques]

Hi all. Just finished installing my first 9.1.1 FreeNAS box. Have an issue. This is going to be long but I'll try to detail as best as I can.

Box is pretty simple. Booting off a 120gb SATA. Have an extra 120gb that I'll use for trash files and a 1TB that will use for backup and file storage (250 gb + 750gb datasets).

After install, with everything still left in default regarding network, I was able to log on to the web UI and set admin password. Also created a "backupusers" group and gave it a "backupguy" user. Created a "administrators" group and a "ptadmin" user.

In storage went to ZFS volume manager. Created "VOL1" using the 1TB drive. I'll be installing a 2nd 1TB drive on tuesday for mirroring this drive in case of data failure. Also created a "TRASH" volume with the 120gb drive.

In "VOL1" I created a "backups" dataset.

For "VOL1" volume I set permissions to user "ptadmin" and group "administrators", owner r-w-e, group r-w-e and other r-e; unix ACL.
For "backups" dataset, user "backupguy", group "backupusers", owner r-w-e and group r-w-e. Other is unticked. Also unix ACL.
For "TRASH" volume, user "ptadmin" and group "administrators", r-w-e for all; unix ACL.

With CIFS service on, defaults in the settings, I created shares next. I created a "VOL1" in /mnt/VOL1; "backups" in /mnt/VOL1/backups and "trash" in /mnt/TRASH. All browsable and the remaining options unticked. Rebooted.

I was now able to see the shares, but trying to log in I was prompted for username and password. None worked. I am on a corporate domain and noticed that the windows machine I am on was trying to auth against the "mycompany" domain. So I tried auth freenas\backupguy and password to try and force local machine authentication. No joy. I am not domain admin so I cannot add this NAS box to ADS. This box is used locally for backup of data from 3 machines that are not connected to the domain and 1 more that is, but has some local data on it.

Jumped to services, directory services, active directory. Set domain name to "PORTUGAL"; netbios name to "freenas"; workgroup to "backup" and administrator to "ptadmin" and left use default domain checked. Reboot. Was now able to login to the shares, no auth needed.

I can access ALL shares. Went to the "VOL1" volume and changed permissions. Unticked r-w-e for other. Now I can't access anything.

So my question: how do I setup so that only "ptadmin" can access /mnt/VOL1 and subfolders and /mnt/trash? How do I get backupguy to access only /mnt/Vol1/backups and subfolders?

All help greatly appreciated.

Bunch of pics I hope will help. http://imgur.com/a/Z0qiE

 

[Dusan]

Bunch of pics I hope will help. http://imgur.com/a/Z0qiE

In the last image you expect that the user should not be able to access trash nor vol1. Why? The previous images show that you set other (i.e. everybody) to have full access to trash and read access to vol1. So, it is behaving correctly as configured.

 

[NMGMarques]

In the last image you expect that the user should not be able to access trash nor vol1. Why? The previous images show that you set other (i.e. everybody) to have full access to trash and read access to vol1. So, it is behaving correctly as configured.

As soon as i remove the Others permissions I can't access anything anymore. That's why I put the others back in there. Tried this last friday and again today after your post. No permissions, no access for anyone to any share. With permissions, everyone gets to ride that choo-choo train!

Edit:
So I just added 3 more images to the gallery over at http://imgur.com/a/Z0qiE (first 3 images) and as you can see, after removing the others permissions I can no longer access any share. Doesn't even ask me to authenticate and just straight up tells me I don't have necessary permissions. Tried with Windows and Unix ACL.

 

[mauirixxx]

While I've never actually tried using FreeNAS in a workgroup setting (I run a domain @ home as well as @ work), check out this post - specifically down near the bottom where I put the ACL fix I found elsewhere on our forum here.

It *might* help, it might not - again, I don't run a workgroup so I can't say for certain, but in a Windows domain setting, that command is required in order for domain permissions to work.