jail and smb share using the same dataset?

[Dunuin]

Hi,

I set up the emby plugin and samba shares but now I have a problem with the rights management because both need to read and write to the same folder.
Can someone help me and tell me what would be a good way to setup groups, users and folders inside Freenas itself and the jail so emby and samba dont create interferences?

Say for example I have these three shares:
"\\FreeNAS\Movies"
"\\FreeNAS\Music"
"\\FreeNAS\Backups"

And they point to 3 datasets on a pool:
"/mnt/HDDpool/LowSec/Movies"
"/mnt/HDDpool/LowSec/Music"
"/mnt/HDDpool/HighSec/Backups"

I want some Windows users to be able to access all shares (in this case "Backups", "Music" and "Movies" datasets/shares with read/write/delete rights).
But I also want some Windows users to be only allowed to Access specific shares (with read/write/delete rights).

For Example:
"Admin" should be able to access alle three shares.
"Alice" & "EmbyFreeNAS" should be able to access only "Music" and "Movies"
"Bob" should be only allowed to access "Movies"

I did this right now by creating a new unix user for each Windows user with the options "Microsoft account: yes", "Shell: "nologin", "allow password login: yes" so each Windows user has its own unix account with name and password for use with samba. I also created a new user "EmbyFreeNAS" as a counterpart of the user "emby" inside the jail.
These users are members of multiple groups that define what shares are accessible to the users:

"GroupA": Admin
"GroupB": Admin, Alice, EmbyFreeNAS
"GroupC": Admin, Alice, EmbyFreeNAS, Bob

So I set the owners of the 3 datasets to this:
"Backups" -> nobody:GroupA
"Music" -> EmbyFreeNAS:GroupB
"Movies" -> EmbyFreeNAS:GroupC

But then there is the emby jail which runs as "emby:emby" and I mounted 2 of the 3 datasets to the jail via gui (Jails -> emby -> Mountpoints -> Add):

FreeNAS "/mnt/HDDpool/LowSec/Movies" -> Jail "/media/Movies"
FreeNAS "/mnt/HDDpool/LowSec/Music" -> Jail "/media/Music"

But the emby jail needs rights to write to the mounted folders to store metadata next to the media files in that folders. That wasn't possible without changing the userid of the user "emby" inside the jail to the userid of the user "EmbyFreeNAS" outside the jail. But what to do with the groups? I can't set the groupid of the group "emby" inside the jail to a groupid used outside the jail, because the mounted folders are owned by different groups.

How to do that the best way?

I didn't encounted problems right now what confuses me and I have some question how that works.

What are the standard sambashare ACLs behave like? It looks like all created files are owned by the group which is the owner of the dataset, like the dataset would inherit its group like a "setgroupid bit" was set with chmod. So it isn't important what primary group any user is assigned to, because that group is ignored while creating files/folders?

Do I need "EmbyFreeNAS" (which shares the same uid with jails user "emby") to be the owner of the datasets? Is the jails user "emby" allowed to do all that what "GroupB" and "GroupC" is allowed to, because the hosts user "EmbyFreeNAS" is member of that two groups, so it isn't important which user owns a file or folder, as long as all users share the same group?

Greetings

Dunuin

 

[0x4161726f6e]

I use ACLs everywhere that won't break something. What I have done is enter the user (in this case running emby) from the jail into FreeNAS user management with the same UID. This should allow you to give permission to the jail user from Windows, and the beauty of ACLs is you can have as many entries as you need/want.

 

[Dunuin]

These are my settings now:

Samba:
I set the default creation mask to 0660 and default folder mask to 0770 so only owners and groupmembers are allowed to access the files on freebsd itselt. Guests aren't allowed.
Each shared dataset creates all files/folders as a single user and access is limited to members of the owning group. Only those group members are allowed to access the share and whoever of that members is using the share is doing it as the owning user of the share. Therefore I added the auxillary parameters...
valid users = @ownergroup force group = +ownergroup force user = owninguser create mask = 0660 directory mask = 0770
...to each share.

And I edited the ACLs of the shares via Windows so only the members of the ownergroup and the owning user have access (full access).
I created new users and groups for the shares, so using "force user" grants nobody rights to root or wheel.

Is that ok or could that be a too big security issue? As far as I know with SMB4 and up "force user" and "force group" are only applied if the "valid users" matches, if it is set.

At first look that seems to work. I can only access shares with credentials of users which are members of the ownergroup and every new created file is owned by the user owning the share, which was important for me, because the "emby" user must be the owner of each file in the shares mounted to the emby jail, because I need to mount the folders directly without network shares, because emby isn't in the same subnet of the samba shares.

 

[0x4161726f6e]

For these datasets
"/mnt/HDDpool/LowSec/Movies"
"/mnt/HDDpool/LowSec/Music"
"/mnt/HDDpool/HighSec/Backups"
what do you have set as the 'share type'?

If you are using Windows for the 'share type', check out getfacl, samba NFSv4 ACL Mode, and maybe samba inherit owner = [Yes|No].

I missed this earlier: Using nobody for permission is a bad idea, nobody is a bit like everybody/unauthenticated/guest (depending on service & settings). FreeNAS natively supports NFSv4 ACLs (even jails), so if that is enabled then you CANNOT deny the owner read data or read/edit ACLs. For your backup dataset use an admin/root user as the owner.

If you go the ACL route it is highly recommended that you use Windows to do adjustments. FreeNAS/NSFv4/*nix does not enforce any rules about the order ACL rules are enteried, so if you enter things in the wrong order some entries might get ignored. Microsoft's canonical order for ACLs