FreeNAS 9.3 Stable: Permissions Set-Up and CIFS sharing

[Murphy.cz]

I have two datasets "Documents" and "Media" and one user "DocumentsCreator". I have two CIFS shares "Docs" (from "Documents" dataset) and "Meds" (from "Media" dataset). I have only Windows 7 clients in my network.

I'd like to grant full access for user "DocumentsCreator" to shares "Docs" and "Meds" and read only access to everybody in my network to share "Meds".

How to set up users and permissions for datasets and shares to achieve my goal with clean installation of FreeNAS 9.3 Stable?

(I used this set-up from bad old days of 0.7 but it's clear that with new features of 9.3 everything changed so please don't cite me old guidelines.)

 

[Glorious1]

I'll be interested to see the answer, as permissions that work don't always make sense to me. So I'll give this question a bump and hope one of the knowledgeable, helpful folks sees it!

The obvious answer, intuitively, would be to make DocumentsCreator the owner of both datasets, with full access, and set privileges for Other to Read, but no Write or Execute (for Media). At least, I think that would work on my Mac. But for some reason, in FreeNAS/BSD, I can't get anything to work write unless root is the owner of everything.

So, you have a group exclusively for Documents Creator. For Media:
Owner root: Read, Write Execute
Group DocumentsCreator: Read, Write, Execute
Other: Read

For Documents, you would just uncheck Read for Others.

Would that work?

 

[Glorious1]

Update: Actually Murphy, you should take a look at this How-To Guide:
https://forums.freenas.org/index.ph...-permissions-set-up-example-for-dummies.8894/

It's a very detailed description of a complete setup with ownership permissions. I changed mine to follow that and it seems to be working. I think the key is to assign the volume (actually shows as a top-level dataset that gets created automatically) owners to nobody:nogroup. I don't know why or what that does, but it seems to work. But do not share the top-level datasets, just the datasets you create under it. Those datasets can then be owned by actual user accounts.