Permission messed up (Unix/Windows) and CIFS share

[iBobbe]

Hi everyone,
after many hours of frustrating attempts I decided to ask some help.
Sorry in advance, I'm a novice and my english is pretty bad.

Info:
FreeNAS 9.3
LAN with Windows and Mac machines

How it should be:
I want a dataset, named "Storage", accessible by everyone on the LAN, where I store generic data/media files.
It should be accessible by a guest account without password, since that kind of data aren't sensitive and anyone who have access to the LAN should see/write into that dataset.
Inside "Storage" I want a dataset, named "Work", accessible by account&password and possibly hidden to guest accounts.

I made somthing similar by:

• Creating "Storage" dataset and "Work" dataset inside "Storage"
  
• Creating "guest" user, guest group, directory home /mnt/Storage, disabled password
• Creating "moderator" user, "moderator" group (created by me), directory home /mnt/Storage/Work
• Setting "Storage" permission: owner "root", group "guest", 775 permission
• Setting "Work" permission: owner "moderator", group "moderator", owner RWE permission only
• Enabling CIFS service: account guest "guest", allow empty password
• Creating CIFS share: enable guest access and an auxiliary parameter that hide Work folder to those who can't access that (I don't remember it)

That was done under FreeNAS 9.1, everything worked except that I can't access Work folder by Windows machine. Not a big trouble, I accessed Work folder by Mac machines.

Recently I updated to FreeNAS 9.3 and trying to solve jails permission problem I messed up something.
Now "Work" is accessible by guest users too. In fact, if I open "Work" dataset permission by GUI, I see 775 permission. If I try to change to RWE owner only, it doesn't change anything, leaving 775.

I think that it has to do with Windows permission type and ACL. If I try to create a new dataset inside Storage and setting Unix permission type during creation, it work like before (unaccessible by guest user).
Using Windows, I can see that "Work" folder has moderator user and "Everyone" user. I tried to remove read permission to "Everyone" without success.

Probably I have not exlpained it clearly, I'm very confused and frustrated, any help would be appreciated.

Edit: supposing to delete users and dataset that I crated and restart from zero, what do you suggest me to do?

 

[berrick]

Hi,

I a learner to but from my own recent experience using 9.1.1 the GUI doesn't always do what it should or says it has. See my update on my permissions issues https://forums.freenas.org/index.php?threads/cifs-and-ad-user-authentication.26386/.

I resulted to checking the permissions from the commandline with

ls -l /mnt/freenas
​

and using chown to change permissions to my needs

 

[TheEditor]

Yep. I went down that path. What I think I've finally figured out is that it has to do with copying to the freenas. There is something about how FreeNAS works with ad that it strips whatever extended acl's the macs need. No matter what i've tried i still get locked files. I'm to the point where I really do not believe this will work. It's absolutely on the freenas side.

I am having a hard time believing that something this simple doesn't work.

 

[Eniac74]

I think that it has to do with Windows permission type and ACL. If I try to create a new dataset inside Storage and setting Unix permission type during creation, it work like before (unaccessible by guest user).
Using Windows, I can see that "Work" folder has moderator user and "Everyone" user. I tried to remove read permission to "Everyone" without success.

I cannot say that I am 100% on top of permission settings, but I have spent the whole day messing with settings in Windows 7 and reading threads, so from your problem formulation I would say that you should remove the user 'Everyone'. Straight answer/guess to why it is not being deleted is that you probably just are doing in incorrectly.
When you write "...withous success", do you mean that Windows throws you an error message or just that it does not change, although you have pressed the 'apply' button after removing user 'everyone'?
I have read some other threads on similar issues and using 'chown' or 'chmod' commands in Shell does not work as this consciously has been blocked (in order to avoid permission messups), so you should be able to solve it through Windows.
I am myself on Mac, but have a Bootcamp installation with Win7 in order to do this.