I am building a backup server using Linux, ZFS, and Samba. All clients other than me will be using Windows 10, therefore my focus is on supporting Windows 10 properly, but that does not mean the permissions on the Linux side should be allowed to be insecure (i.e. world readable and writable).
After mistakenly removing the POSIX ACLs on all files, thinking they were something initially set to allow group access, all the permissions on the files on the Windows side got broken.
This was fixed by going over every option in the manual and redoing the config I figured out which options to set to get the behavior I want, namely to set the permissions on the Windows side alone, while keeping the UNIX permissions safe, however there are still 2 things I do not understand about how Samba deals with UNIX permissions.
acl_xattr:ignore system acls = no causes UNIX permissions to become entries in the Windows ACLs (CREATOR, GROUP, and EVERYONE entries), which I did not want, however when set to
yes, the owner, group and permissions still seem to impact the permissions on the Windows side, they are still enforced by Samba. If a directory had
root:backup 0660 permissions, then a random
Domain User will not have access to that directory, even though the Windows ACLs had an entry for
Domain Users. Changing the group from
users maps to the NT group
Domain Users, then it will work. So clearly the UNIX permissions are still enforced.
Is there a setting to make the Windows ACLs veto the rest, i.e. if the Windows ACLs allow
Domain Users, then they will be allowed regardless of what the UNIX permissions might say? Or could I just disable Samba using the UNIX permissions?
The other question is how Samba stores the UNIX permissions. In the new configuration I had
inherit owner = yes. This seemed to work as expected on both Windows as UNIX, except when I tried to change the UNIX group to something else. Initially the setgid bit was set on the shares with
john as their group, thinking
inherit owner only affects the owner, not the group. However when removing the setgid bit from the shares and changing the group to
users recursively, with
inherit owner = yes new files and directories made from a Windows 10 client were still created with the group
john. Nowhere in the directory tree was there a directory with group
john left, I tried restarting my Windows client and the Samba server just in case, but that did not change anything.
Does Samba store the UNIX permissions elsewhere, so my changing of the UNIX group directly from the file system does not affect the group tracked by Samba? Or what might be the cause that Samba still uses this old group for new files and directories?
Below you can find the potentially relevant options of the Samba version 4.7.6 configuration. If more information is needed, let me know.
[global] access based share enum = yes acl group control = no acl map full control = yes acl_xattr:ignore system acls = yes acl_xattr:default acl style = windows create mask = 0775 directory mask = 0775 dos filemode = yes dos filetime resolution = no dos filetimes = yes ea support = no force create mode = 0600 force directory mode = 0600 force unknown acl user = no guest account = nobody guest ok = no guest only = no inherit acls = no inherit owner = unix only inherit permissions = no invalid users = root map acl inherit = yes map archive = no map hidden = no map readonly = no map system = no map to guest = never nt acl support = yes obey pam restrictions = no read only = yes restrict anonymous = 2 security = user server role = active directory domain controller store dos attributes = yes unix extensions = yes vfs objects = dfs_samba4 acl_xattr shadow_copy2 [backups] create mask = 0660 directory mask = 0770 ea support = yes path = /mnt/pool/backups read only = no