Some accounts have "Access is denied" error for CIFS shares

[engphys]

I'm having a problem with "access is denied" when attempting to connect to FreeNAS Windows CIFS shares.
The problem started with a change in the configuration of my FreeNAS storage. I had a Z1 array with a main volume (/mnt/Stor1), and with 4 subvolumes in the main volume (/mnt/Stor1/myacct, /mnt/Stor1/Mom, /mnt/Stor1/Movies1, /mnt/Stor1/Movies2). In each of the subvolumes I created one Dataset with the same name as the subvolume (myacct, Mom, Movies1, Movies2). As I became more familiar with ZFS, I decided the redundancy in the Volumes and Datasets might not make much sense, so I rebuilt the Z1 array using a single primary volume (/mnt/Stor1) and 4 datasets in the main volume (/mnt/Stor1/myacct, /mnt/Stor1/Mom, /mnt/Stor1/Movies1, /mnt/Stor1/Movies2). I created three server accounts - the account I use (myacct), the account my wife uses (Mom) and the account for my home theater pc (htpc). My account (myacct) can access the CIFS shares without problem, the other two accounts (Mom, htpc) cannot access the shares. Each account can login to the server using ssh.

The following is my attempt to determine why the two accounts are denied access:
Server configuration:
FreeNAS-9.2.1.5-RELEASE-x64 (80c1d35)
Host Name = MediaStore
Accounts: htpc(group=user_access), myacct(group=user_access,wheel), Mom(group=user_access)
ZFS Volume = /mnt/Stor1
ZFS Dataset = /mnt/Stor1/Movies1 (CIFS share = Movies1)
Owner=htpc(permissions=RWE), Group=user_access(Permissions=RWE), other(Permissions=RE) Windows ACL
ZFS Dataset = /mnt/Stor1/Movies2 (CIFS share = Movies2)
Owner=htpc(permissions=RWE), Group=user_access(Permissions=RWE), other(Permissions=RE) Windows ACL
ZFS Dataset = /mnt/Stor1/myacct (CIFS share = myacct)
Owner=myacct(permissions=RWE), Group=user_access(permissions=RWE), other(permissions=RE) Windows ACL
ZFS Dataset=/mnt/Stor1/Mom (CIFS share = Mom)
Owner=Mom(permissions=RWE), Group=user_access(permissions=RWE), other(permissions=RE) Windows ACL

Using my windows desktop to test access to the share:
Windows 8.1 Pro 6.3.9600 Build 9600
Hostname=video
User Accounts: myacct(local user, password protected, non-admin), htpc(local user, password protected, non-admin)
These tests were an attempt to access \\MEDIASTORE\Movies1 ----------------------------------
1) Login using htpc --> File Explorer --> Network --> MEDIASTORE --> Movies1 --> Windows Security (Username=htpc, Password=testpass) --> access is denied
I confirmed that the local account name and password matched the server account name and password.
2) Login using htpc --> File Explorer --> Network --> MEDIASTORE --> Movies1 --> Windows Security (Username=MEDIASTORE\htpc, Password=testpass) --> access is denied
3) Login using myacct --> File Explorer --> Network --> MEDIASTORE --> Movies1 --> immediate access to files in Movies1
The Windows Security window for authentication did not appear (same account name and password on deaktop and server).
The same thing occured with the other 3 shares.

Using a windows laptop to test access to the same share:
Windows 8.1 Pro 6.3.9600 Build 9600
Hostname=laptop
User Accounts: htpc (local user, password protected, non-admin), myacct(local user, password protected, admin)
The tests to access \\MEDIASTORE\Movies1 ---------------------------------------
1) Login using htpc --> File Explorer --> Network --> MEDIASTORE --> Movies1 --> Windows Security (Username=htpc, Password=testpass) --> access is denied
2) Login using htpc -->File Explorer --> Network --> MEDIASTORE --> Movies1 --> Windows Security (Username=MEDIASTORE\htpc, Password=testpass) --> access is denied
3) Login using myacct --> File Explorer --> Network --> MEDIASTORE --> Movies1 --> immediate access to files in Movies
4) Login using Administrator --> File Explorer --> Network --> MEDIASTORE --> Movies1 --> Windows Security (Username=htpc, Password=testpass) --> "Windows cannot access \\MEDIASTORE\Movies1" Error code: 0x800704cf "The network location cannot be reached" --> Diagnostics --> "You don't have permission to access the share"
5) Login using Administrator --> File Explorer --> Network --> MEDIASTORE --> Movies1 --> Windows Security (Username=myacct, Password=mypass) --> immediate access to files in Movies1

The results were the same when my wife attempted to access the shares using the (Mom) account on her Windows 8.1 laptop. Access is denied on my home theater pc using the (htpc) account, but my personal account (myacct) has access.

The one difference between my server account (myacct) and the Mom and htpc accounts, is the participation of myacct in the wheel group. I added htpc to the wheel group and reran the tests with no difference. Other than the secondary wheel group, I could not find any other differences, but why only one account working? I do not know what to try next and any suggestions or advice would be great!

 

[engphys]

I found a solution, but still don't know why. I rebuilt the server using an immediately downloaded 9.2.1.5 image onto the 4gb usb thumbdrive. I created new volume, datasets and shares (myacct, Movies1, Movies2, Mom) with no data loaded. Testing share access from the Windows systems produced similar results. The only difference was no account could access the shares - even my account (myacct) was no longer working.

I was starting to panic a little and decided to pull out my 9.2.1.2 4gb thumbdrive (archived in case I needed to return to an earlier release). Installed the 9.2.1.2 thumdrive and the system booted with no problem, the Z1 file system was recognized with no error, I had to enable shares for some reason and then everything worked without a flaw!!! Shares access from each account. I uploaded a small amount of data from backup to populate the shares - ownership and permissions all looked and worked as expected.
Saved the 9.2.1.2 config. Installed the 9.2.1.5 thumbdrive. Loaded the 9.2.1.2 config into the 9.2.1.5 OS and everything worked fine - shares access by each account. I guess this had to be a configuration issue, but I didn't save the non-working 9.2.1.5 configuration to make a comparison with the restored 9.2.1.2 config.

Oh well - if someone has a comment about what might have been the issue I would appreciate the feedback.

 

[anodos]

It's hard to tell what went wrong without viewing log files and doing some troubleshooting. Most likely cause I that you misconfigured it.
I noticed you mentioned 'Z1'. You should not be using RAIDZ1. When a drive fails there is a significant likelihood that resilvering will fail and you will lose your data. You should use RAIDZ2 or mirrors. See here: http://doc.freenas.org/index.php/Hardware_Recommendations
You may also want to verify that your computer meets the above-linked hardware requirements (especially RAM).

 

[engphys]

Thank you for your response and yes, your right. I'm using RAIDZ1 and am not using ECC memory on the server. The server is a home server used mostly to store media content for xbmc pcs and content change is slow. All data is actively backed up onto external storage on a windows client, so if 2 drives are lost, hopefully I can replace the data when needed. If this were a production server, I wouldn't be too cheap and would avoid both of these potential problems.

Below is the server config and has been running since the first of last year, so I feel pretty good about the hardware. It is only with the recent conversion of volume to dataset shares on 9.2.1.5 that I had the CIFS problem (though I did have a question about the ZFS 28 to 5000 conversion earlier).
Gigabyte D3H UltraDurable mb, AMD AD680KWOHLBOX Black A10-680K quad-core 4.1GHz FM2, 2x - AMD Radeon RE1600 8GB DDR31600 PC3-12800 CL 9 1.5v memory, 5x - WD Red WD30EFRX 3TB hdd, SanDisk 4GB USB flash drive

Unfortunately, I did not track the system and CIFS log files on the non-functional 9.2.1.5 install. I will make sure the logs are available in the future. I also believe it is a configuration issue and I think some of the problem is my not being familiar enough with CIFS config/operation in Samba and in Windows. I still don't know fully how to manage ownership and permissions from the windows clients for share folders and files, a suggestion for a good CIFS reference source would be great!

 

[anodos]

You will manage ACLs from a windows workstation (assuming that ACLs are set to windows). See this article for explanation of different premissions under Windows: http://windows.microsoft.com/en-us/windows/what-are-permissions#1TC=windows-7

 

[engphys]

A great reference - Thank you again!