need some help with SMB

[lupinlicious]

Hi all,

I'm having some problems letting other people to access a SMB share.

I can mount the drive and it looks like in Windows it accepts the username/password returning with no error messages.

This is how it looks like when I try to mount the drive from another computer/username (username = maria).

From the server:

Samba version 4.10.16
PID Username Group Machine Protocol Version Encryption Signing
----------------------------------------------------------------------------------------------------------------------------------------
6170 maria Gemensam 192.168.20.4 (ipv4:192.168.20.4:52798) SMB3_11 - partial(AES-128-CMAC)


Service pid Machine Connected at Encryption Signing
---------------------------------------------------------------------------------------------
Gemensam 6170 192.168.20.4 Sat Jul 25 12:41:13 2020 CEST - -


getfacl /mnt/MEDiA/Gemensam
# file: /mnt/MEDiA/Gemensam
# owner: nobody
# group: Gemensam
owner@:rwxpDdaARWcCos:fd-----:allow
group@:rwxpDdaARWcCos:fd-----:allow
group:Gemensam:rwxpDdaARWcCos:fd-----:allow
user:maria:rwxpDdaARWcCos:fd-----:allow
everyone@:--------------:fd-----:allow


[Gemensam]
aio write size = 0
ea support = No
mangled names = illegal
path = /mnt/MEDiA/Gemensam
read only = No
vfs objects = streams_xattr shadow_copy_zfs ixnas
nfs4:acedup = merge
nfs4:chown = true


On my computer and if I have look in the security tab for the folder called 'Gemensam', I see the following:

But if I look on Maria's computer I got this:

On the server I have a lot of these error messaages in /var/log/samba4/log.smbd:
[2020/07/25 13:31:58.542425, 0] ../../source3/smbd/uid.c:448(change_to_user_internal)
change_to_user_internal: chdir_current_service() failed!


Anyone who can point me on the right directions, and I would be appreciated.
Let me know if there is something else I can provide with to make this easier.

I have no problems mounting the drive from my computer with my username..

Thaaaanks

 

[lupinlicious]

Version: FreeNAS-11.3-U4

 

[Samuel Tai]

On FreeNAS, is maria a member of the Gemensam group?

 

[lupinlicious]

On FreeNAS, is maria a member of the Gemensam group?

Yes and it looks like this:

 

[Samuel Tai]

What do ls -ld /mnt/MEDiA and ls -ld /mnt/MEDiA/Gemensam show?

 

[lupinlicious]

What do ls -ld /mnt/MEDiA and ls -ld /mnt/MEDiA/Gemensam show?

Code:

ls -ld /mnt/MEDiA
drwxrwx---+ 24 puffe  puffe  28 Jul 25 10:59 /mnt/MEDiA


ls -ld /mnt/MEDiA/Gemensam
drwxrwx---+ 2 nobody  Gemensam  2 Jul 25 10:59 /mnt/MEDiA/Gemensam

 

[Samuel Tai]

Is MEDiA your pool? The permissions and ownership are set too restrictive at this level

1. setfacl -b /mnt/MEDiA to remove the ACL from this level
2. chown puffe:Gemensam /mnt/MEDiA

 

[lupinlicious]

Is MEDiA your pool? The permissions and ownership are set too restrictive at this level

1. setfacl -b /mnt/MEDiA to remove the ACL from this level
2. chown puffe:Gemensam /mnt/MEDiA

Yes MEDiA is my pool.

Awesome it works now :) Thank you so much
But now I can see all other folders in MEDiA (but cannot add/delete and it should be like that)
How can I limit so Maria won't be able to see anything else besides the folder Gemensam?

 

[Samuel Tai]

You need to enable "Access-based share enumeration" for the MEDiA share. See this thread for some examples:

SMB shares show even if user doesn't have permission

I've created datasets in a pool that have permissions set only giving certain groups to each dataset. Then, I've created Windows shares that each have their path set to each dataset created. When users connect to the NAS either in Windows or in MacOS, Windows Explorer / Mac Finder both show...

www.ixsystems.com

Then you can set share permissions via /usr/local/bin/sharesec.

 

[lupinlicious]

You need to enable "Access-based share enumeration" for the MEDiA share. See this thread for some examples:

SMB shares show even if user doesn't have permission

I've created datasets in a pool that have permissions set only giving certain groups to each dataset. Then, I've created Windows shares that each have their path set to each dataset created. When users connect to the NAS either in Windows or in MacOS, Windows Explorer / Mac Finder both show...

www.ixsystems.com

Then you can set share permissions via /usr/local/bin/sharesec.

Ok, thank you again and have a nice evening/weekend.

Best regards