Back to graph

Page

SMB Shares

Page IDsmb-sharesUpdated

What do I set my ACL permissions to in truenas scale for my SMB dataset that has ACL mode set to restricted, so that when I create a new file via the SMB share on windows that it maintains the correct owner and group as set in the ACL?

🔑 TrueNAS SCALE SMB ACL Permissions Guide (Restricted Mode) 🔑

Goal: Maintain correct owner & group for new files created via SMB from Windows in a Restricted ACL mode dataset.

🔎 Understanding the Challenge

Windows & TrueNAS handle ownership differently. Restricted ACL mode requires specific settings to bridge this gap. Without them, new files default to nobody ownership.

⚙️ Configuration Steps

1. SMB Share Settings: 🖥️

  • Access Based Share Keys: ✅ Enabled (Highly Recommended for Security)

  • ACL Mode: 🔒 Restricted (You've already set this!)

  • VFS Objects: 🧩

    • fruit: 👍 Enabled

    • streams: 👍 Enabled (Important for Windows extended attributes)

    • xattr: 👍 Enabled (Crucial for ACL persistence!)

    • posix: 👍 Enabled (Necessary for owner/group translation)

2. posix VFS Object Settings (Advanced): 🛠️

Within the posix VFS object configuration (accessed by clicking the ⚙️ icon next to it):

  • mapall: 🚫 Disabled (Let's be precise!)

  • maproot: 👤 Typically root, but consider a dedicated SMB user if preferred.

  • mapto: 👤 The user/group to map to. This is where the magic happens. See “Mapping Strategy” below.

  • noperm: 🚫 Disabled (We want permissions to be applied!)

  • prefixes: 📝 Add a comma separated list of windows users to translate. Example: domain\user1,domain\user2

  • suffix: 📝 Add a suffix to usernames. Example: @domain.com

3. Mapping Strategy: 🗺️

This is the core of the solution. How you map Windows users to TrueNAS users depends on your setup.

  • Option 1: Direct Mapping (Recommended): 👯

    • Create TrueNAS users that exactly match Windows usernames (case-sensitive!).

    • Within the posix settings, add prefixes to map those Windows users to the TrueNAS users. This ensures a 1:1 translation.

  • Option 2: Group Mapping: 👥

    • Create a TrueNAS group that corresponds to a Windows user/group.

    • Map the Windows user to this TrueNAS group using posix. This simplifies management but might be less granular.

4. ACL Configuration on the Dataset: 📂

  • Dataset Properties > Permissions > ACL Mode: ✅ Restricted (Again, verify!)

  • Dataset Properties > Permissions > ACL Type: ✅ POSIX ACL

  • Set ACLs: Apply POSIX ACLs to the dataset defining default owner and group. For example:

    • User:domain\username:Owner

    • Group:domain\groupname:Group (Or a specific TrueNAS group)

    • Apply these to the root of your SMB share and consider applying them recursively if desired.

⚠️ Important Considerations:

  • Case Sensitivity: TrueNAS is case-sensitive. Usernames must match.

  • Windows User Mapping: Ensure the Windows users have corresponding accounts in TrueNAS (or map them to a group).

  • Testing: Always test with a small number of users before rolling out changes widely. Create a test file via SMB and verify ownership/group.

  • Restart SMB Service: After making configuration changes, restart the SMB service in TrueNAS SCALE for them to take effect. 🔄

ℹ️ Troubleshooting:

  • Files Created as nobody: Double-check your posix configuration and ensure users are correctly mapped.

  • Permissions Issues: Verify ACLs are correctly applied on the dataset and that the mapped user has appropriate permissions.

  • SMB Logs: Examine the TrueNAS SCALE SMB logs for errors or warnings. 🔍