problems with CIFS permissions and LDAP

Status
Not open for further replies.

fluca1978

Explorer
Joined
Sep 8, 2011
Messages
52
Hi all,
I've got FreeNAS running in my network, the user accounts are pulled from an OpenLDAP linux server and are working fine. I'm experiencing some problems with CIFS shares that I cannot understand very well. The first one is that a non-guest share does not always allow to put a file into the share from a mac osx (10.5, 10.6, 10.7): it could happen that the finder says that the file is already in use, but after a few tries of the same file from the same computer the file is copied. Other files are copied at the first try. Now, I've tried to manually cp the file from a mac console to the /volumes/RAY_SMB (where it is mounted my share) and it always work! I suspect it is a problem of the finder, but against another samba server (3.0.28.a) the problem is not present. My share is configured as follows:

[RAY_SMB]
path = /mnt/RPOOL/RAY_SMB
printable = no
veto files = /.snap/.windows/
writeable = yes
browseable = yes
inherit owner = no
inherit permissions = no
vfs objects = zfsacl
inherit acls = Yes
map archive = No
map readonly = no
nfs4:mode = special
nfs4:acedup = merge
nfs4:chown = yes


I suspect the problem has something to do with the zfsacl, but even commenting it out and restarting samba did solve the problem. If I execute an acl inspection I've got the following:

[root@nas] /mnt/RPOOL/RAY_SMB# getfacl .
# file: .
# owner: dany
# group: disegnatori
owner@:--------------:------:deny
owner@:rwxp---A-W-Co-:------:allow
group@:--------------:------:deny
group@:rwxp----------:------:allow
everyone@:-------A-W-Co-:------:deny
everyone@:rwxp--a-R-c--s:------:allow

where 'disegnatori' is the group to which all my users belong to (and the group is exported via ldap as well as users accounts). Cifs shares are mounted on the mac using the right username and password, and there are no authentication errors in the logs. The ZFS volume does not have the inherit permissions and owner and the ACL mode is set to Unix (I've tried Windows too without any success).

Now I've placed into the auxiliary parameters of the samba share the following two lines to see if something goes better:

valid users = @disegnatori
force group = disegnatori

Does anybody has an idea of what is going one here?
 

fluca1978

Explorer
Joined
Sep 8, 2011
Messages
52
Argh! The valid users options had the effect to lock out all my users even if explicitly named into the configuration parameter, so maybe there is something that is not going well with the ldap authentication? Removing the valid users options from the share provided the users access back using their ldap account.
Any idea?
 
Status
Not open for further replies.
Top