Linux based NAS with a Windows domain controller: Permissions


Recommended Posts

Hello

I seem to have trouble with a Linux based NAS that I have made part of a Windows (SBS 2003) Active Directory domain. When I made it part of the domain, all the domain users have passed to it.

I cant write to the "root" of the NAS so I make a folder. Inside this folder, I copy all of my old data to it. The problem is that the permissions dont seem to pass or pass only sometimes....

To copy I use this: http://ipmsg.org/tools/fastcopy.html.en because it supports ACL.

The domain clients are Windows 7 and Windows XP. The NAS is a QNAP TS469U-RP.

Thank you for all the help

And what are the permissions? Just set them! And don't copy ACLs -- when you copy files they should use the permissions of the folder / drive you copy them too.

Set the permissions you want on the drive/folders of your nas! Sounds like you want to be able to copy to root? if so then correct the permissions..

What are you having trouble with about understanding permissions?

  On 16/07/2013 at 11:14, BudMan said:

And what are the permissions? Just set them! And don't copy ACLs -- when you copy files they should use the permissions of the folder / drive you copy them too.

Set the permissions you want on the drive/folders of your nas! Sounds like you want to be able to copy to root? if so then correct the permissions..

What are you having trouble with about understanding permissions?

The problem is that it is suppose to be automatic: When I copy from the server to the NAS, the permissions go with it. The permissions I am talking about are:

FolderA : User1 can write, User2 is owner, All of group Users can write, etc.....

That is what is not being passed.

And I do not want to do it manually because there are a lot files/folders and one of the features is that it supports passing ACLs....

Lets see the permissions please!

Screen shots works, lets see the effective permissions tab as well with a couple different user names put in.

example - this is from a client just right clicking on the share

post-14624-0-60632500-1373995178.png

If you NAS is linux based, make and model like sc302 suggested would be helpful.

ls -la listing from linux console for your files and directories would be helpful in seeing permissions set via linux.

for linux to use windows permissions you have to map them to a linux user normally.

Also you can copy ACLs with /0 in the builtin xcopy command

 /O           Copies file ownership and ACL information.
Or robocopy as well, another built in tool can copy permissions

/COPY:copyflag[s] :: what to COPY for files (default is /COPY:DAT).
                     (copyflags : D=Data, A=Attributes, T=Timestamps).
                     (S=Security=NTFS ACLs, O=Owner info, U=aUditing info).

      

             /SEC :: copy files with SECurity (equivalent to /COPY:DATS).
Keep in mind where you making a copy from - if any local permissions have been set its unlikely those would work, match up to domain accounts via SID, etc.

As setting permissions on your NAS, I would assume your wanting to remove the old files after you copy them.. So its just easier and cleaner to create the permissions you want to use on the device doing the shares vs trying to copy them.. Only reason to take the permissions along would be if you had complex permissions on each file, etc.

You can run into problems if inherit flags are being used on source or dest and they conflict or don't line up, accounts to map correctly, etc.

  On 16/07/2013 at 23:19, sc302 said:

what I would suggest is to use iscs vs nfs.  it will be much better for you if your ad permissions aren't being applied.  It would be best if you could dedicate a nic for it, but it is not needed.

I actually was intrested in iSCSI the problem with it is that Im not completely sure how it works and we were already using a "shared folder" type structure so the transition would be "transperent", we just decided to go with this.

If you could share some document with iSCSI and AD permissions, Ill consider trying it out :)

Another kicker: On the server there are groups I can add permissions for and on the NAS I cant!

On the left side, you see users/groups I can add for setting their different permission settings. This is the AD server.

But on the right hand side, you see the users/groups I can add for the NAS server. Shouldnt it, since I am accessing from the AD server, be the same?

Scratch all that: Just read it is by design. God, this is going to make my life a bitch :(

Not sure how in-depth you want to get into Linux but I managed to set this up using Software RAID6 on Linux with mdadm, 4TB  and got results of about 300MB/s read and 300MB/s write (That's MegaBytes not bits).  Wired that up through my place over a 1Gig/s network for around 120MB/s R/W to from that.  About 6 steps. 1 step to do the RAID.  So around $800 for 4TB and those speeds.

 

Here's the page about all that and it actually works as posted:  

 

All shared with CIFS and secured by selinux (Having said selinux, maybe that's where the issue is with yours?  Not sure.  Ran into the same thing with my custom one):

HTPC / NAS Backup

 

Sharing with Samba / CIFS

 

But like I said, not sure how in depth you want to get into Linux though having an entire OS behind the setup will give you lot's of tools in case of issues and not a closed down box.

 

HF!

  • 3 weeks later...
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • I think you answered why it gets so much attention in your comment. It's designed to make Windows accessible to everyone! It's a core component of the Windows UI, and 30 years of its existence is why it remains such a key component and receives so much attention to this day!
    • I agree with your points, particularly around workflows. But I think this is a symptom of the way Microsoft plans, builds, and releases its OS's, not about its UI ideals itself. It has historically been large jumps in UI changes between releases, XP > Vista > 7 > 8 were ALL significant changes in how we performed tasks. Then Win10 was released and updated twice a year with minor changes. This was somewhat nice as the changes were often minimal, however as it looked like the same OS for the most part, when something did change (like the start menu), it was a bit confusing for people who didn't understand that they had actually been upgraded, and why just this one key part of their workflow had changed. But I believe that was too slow, and didn't allow their future designs to be played out in that release structure. So the "last Windows version ever" was superseded with a new UI and overhauled once more. It too has changed quite a bit in its 4 years, but I think there needs to be an understanding of that change, which I guess we have in the "24H2" version numbering, but not in the marketing that most users know. The most consistent and clear communication of changes I think is done with MacOS. While I'm not a fan of Apples software, their clear and consistent release schedule, and progressively planned changes to the OS is easy to understand, leading towards a well thought out goal. Their users understand the branding of the big updates, and that changes will occur when they update, yet these are more subtle than changes we see in Windows 7 > 8 > 10 > 11 releases. On that, Windows 10/11 version updates just get lost in the vast collection of update types in Windows Update, and as such most users wouldn't know if the were on 22H2, 23H2 or 24H2, or even know what those meant. My thoughts are that Microsoft will drop the Win11/Win12 branding once Windows 10 has finally died. And hopefully, make it a bit more consistent with feature/UI updates sticking to an improved branded version/year release rather than "moments" or just randomly enabled elements in a random monthly update. Until then, even us tech users rarely know what features are in what release and if we will see it on our own computers. Get with it MS!
    • Hello, Horizon Data Systems, the developer, has been around for 27 years.  I do not recall hearing anything bad about them, but I also haven't used their software, either. Regards, Aryeh Goretsky  
    • Hello, I am wondering if this will go through an appeal process, or if the ruling is final? Regards, Aryeh Goretsky
    • Hello, I think it also depends upon what sorts of software you develop. My employer makes software that does rely on operating system version-specific functionality, and that is typical and normal behavior for our industry. While we do provide support for older versions of operating systems, it is only for a certain amount of time. If you still want to use our software after that, it becomes a custom support package, which isn't cheap. Regards, Aryeh Goretsky
  • Recent Achievements

    • Reacting Well
      pelaird earned a badge
      Reacting Well
    • Mentor
      The Werewolf went up a rank
      Mentor
    • First Post
      Myriachan earned a badge
      First Post
    • Week One Done
      DrRonSr earned a badge
      Week One Done
    • Week One Done
      Sharon dixon earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      603
    2. 2
      ATLien_0
      214
    3. 3
      +FloatingFatMan
      169
    4. 4
      Michael Scrip
      151
    5. 5
      Som
      151
  • Tell a friend

    Love Neowin? Tell a friend!