• This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn more.

Samba DC - ZFS ACL Permissions

davidrx

New Member


Messages: 3

#1
I setup FreeBSD Samba Domain Controller and installed second machine running as NAS.
I joined the second machine to the Samba Domain Controller.

I used groups and users from the FreeBSD Samba Domain Controller.

But I'm fighting with the permissions currently.
My goal is to have a share where only 1 user has modify access and admins have full access.

The odd thing I noticed when I remove the everyone ACL rule on user01 it removes all FreeBSD rwx permissions for ower/group on the folder?

Code:
$ ls -alf
total 55
drwxrwx---       4   david        domain_users    4 Jan  4 22:52 .
drwxrwxrwx    11   root         wheel          11 Jan  4 22:53 ..
d---------+       6    user01     domain_admins  25 Jan  5 01:57 user01
drwxrwxrwx+ 14    user02     domain_admins  15 Jan  5 11:49 user02
while on ACL it looks like this:
Code:
$ getfacl user01/
# file: user01/
# owner: user01
# group: domain_admins
            group@:rwxpDdaARWcCos:fdi----:allow
            owner@:rwxpDdaARWc--s:fdi----:allow
        user:david:rwxpDdaARWcCos:-------:allow
As result my Samba user share isn't accessible.
So, my question is what is the correct way of creating a secured folder for 1 user + admin users?

I noticed when I add everyone line to the ACL it allows me to have access again, but I don't like the everyone permissions. It feels less secure :)
Code:
everyone@:------a-R-c--s:-------:allow
 

SirDice

Administrator
Staff member
Administrator
Moderator

Thanks: 5,508
Messages: 25,692

#2
The odd thing I noticed when I remove the everyone ACL rule on user01 it removes all FreeBSD rwx permissions for ower/group on the folder?
What was the exact command you used? I have a feeling this is just a consequence of not setting the ACL correctly.
 

davidrx

New Member


Messages: 3

#3
when I add ACL rules I do this:
Code:
setfacl -m u:david:full_set::allow directory or filename

to remove a rule:
Code:
setfacl -x0 (0 for first rule or 1 for second rule ...) directory or filename
 

davidrx

New Member


Messages: 3

#4
I probably found my issue:

This:

Code:
 group@:rwxpDdaARWcCos:fdi----:allow
           owner@:rwxpDdaARWc--s:fdi----:allow
should be:

group@:rwxpDdaARWcCos:fd-----:allow
owner@:rwxpDdaARWc--s:fd-----:allow




Code:
setfacl -m owner@:full_set:fd:allow [directory]
That seems to work out what I want :)

not sure what the inherit_only flag does?