How to configure FreeNAS users for a windows network without DC

[luke404]

Hello there.

I usually manage linux servers on the internet and I never bothered with windows and how it manages users and credential in the network, so I'm asking a little help here.

There's a LAN with some Windows XP Pro and some Windows 7 Pro systems, no domain controller nor anything fancy. There's a strict 1:1 relation between human beings and PCs and windows users and IPs (1 person = 1 desk = 1 PC = 1 static ip address = his windows user).

We want to add a FreeNAS and build some shares with the following requirements:
- one share should be accessible to every system on the lan
- one share should be accessible only to some PCs/users (let's say they are A, B, C)
- one share should be accessible only to some other group, with some users also part of the former (let's say they're users C, D, E)
- one share should be dedicated to Windows Backup scheduled runs
- people should be free to change their local Windows password without requiring a central authority to update network credentials (ie. the password they need to log in to the local windows o.s. and use their computer)
- that actually means the network password of the same user could, and should, remain the same without changing
- it's ok if there is need for an administrator to actually change a user's network password
- there's no need to track different 'owners' or 'groups' for a share contents (files and directories), everything that is inside a share should be accessible r/w to everyone who has access to that share

I was thinking about creating one user in FreeNAS for every human being of the lan and assigning a password, then configuring all the CIFS shares to allow access to relevant users but then "force guest" so all files on the FreeNAS side actually belong to the same user. In my mind Windows should ask for user and password on the first connect to the shares and then remember the password for future login / powerons and never ask it again, even if the user changes its Windows login password. Am I assuming it right?

I could then do whatever I want with the backup share as long as windows backup does work - I could leave it without 'force guest' so people will not be allowed access to each other's backups.

Another idea is to give up working with users on the FreeNAS side at all, put everything under guest and just control access to shares based on the IP address of the client (not the best in the world but perfectly acceptable on this specific LAN).

As I'm really a windows-ignorant I'm seeking confirmation and/or advice on the above plan because I'm not really sure how those systems will react to using network credentials (on FreeNAS/cifs) different than the local one (password of local windows user). I tried doing some googling but the SNR is really low... there's plenty of material about integrating FreeNAS or other Samba-based systems in an existing AD domain or about trying to implement an AD controller on Samba, but I haven't been able to find userful material about users on a 'workgroup' LAN...

Any help will be appreciated, many thanks. I hope I'm posting in the right section of the forum, just tell me if I'm not or simply some moderator please move/delete my post.

 

[polpan]

Hi, we are on the same case... and on a wishlist for this scenario....
have you got your answer? if you have kindly share it so everyone like can get some ideas too...
TIA

 

[polpan]

he he he... yeah I know.. but still I'm confused in setting it up....
Still my setup any user can see what is inside on other user's folder.... I just want User1 can see his own folder, not User2's folder or User3's folder..or any users :)
It's been a week.. trying to follow all the guides I found the net.. but no luck.... I can't find a perfect guide :)
BTW my volumes are on UFS.
:)

 

[ewhac]

Here's how I set things up:

On FreeNAS, for each user, I created an account and home directory. This username/password bore no relation to the username/password they may or may not have been using on their Windows machine.

In the Services/CIFS panel, I set up:

• Authentication Model: Local user
• Guest account: nobody
• File mask: 0644
• Directory mask: 0755
• EA support: Off
• Allow empty password: Off
• Enable home directories: On
• Enable home directories browsing: On
• UNIX extensions: On
• Zeroconf share discovery: On
• Hostname lookups: On

I also set up what I called a Common Share -- a directory that was read/write to all logged-in users, but not available to unauthenticated guests:

• In Account/Groups, create a new group called 'sharing'. Give it an ID number well out of the way of group IDs (like 10000 or so).
• Make all your Windows-enabled FreeNAS user accounts members of the 'sharing' group.
• Enter a root shell.
• Create a directory somewhere ("/mnt/zvol/CommonShare").
• Change the directory ownership to owner 'nobody', group 'sharing' (chown nobody:sharing /mnt/zvol/CommonShare).
• Chmod the directory to 01775 (chmod 01775 /mnt/zvol/CommonShare). This will set the sticky bit for the directory, which lets users create files in the directory (because they're members of the 'sharing' group), but may only modify or delete files they own.
• Under Sharing/Windows (CIFS) Shares, create a new share:
  • Name, Comment: Something reasonable for your site.
  • Path: The directory you just created ("/mnt/zvol/CommonShare").
  • Browsable to network clients: On
  • Inherit {Owner,Permissions}: Both off
  • Export Recycle Bin: Off
  • Show Hidden Files: On
  • Allow Guest Access: Off
  • Only Allow Guest Access: Off

Phew! Okay, once done, go to your Windows machine and open a file explorer window. In the address bar, type the name or IP address of your server as a DOS network path ("\\freenas-server\"). You should be presented with a password dialog. Enter the username and password of one of the users created above. Once done, you should see the user's home directory as well as the "CommonShare" directory. You should not see any other user's directory.

This setup has some drawbacks. For one, there's no way for a user to change their FreeNAS password from the Windows GUI; they'll have to SSH in to FreeNAS to do it.

Second: Windows will hold on to the FreeNAS login credentials across reboots ("convenience"). There is a way to force a logout from the file explorer, but I don't know it offhand.

Third: This setup is a very UNIX-y way of setting up a CIFS fileshare. Some of Windows' wacky metadata, such as ACLs, are not necessarily preserved using this setup. This could prevent other things from working in the Expected Way (such as preserving file modification dates when backing up files).

I think I covered all the details. This setup has been working for me for several months now. Let me know how it goes.