NAS shares and permissions

[Infidelus]

Indulge me a few minutes if you will.

I was a bit bored over the weekend, so I decided to do a bit of tinkering.

I've got an old netbook that I just don't really use anymore, and a friend mentioned he was thinking of setting his up as a NAS. My current Synology DS109 is getting slower and slower with the applications I use on it (SABnzbd and Sickbeard), and when I'm trying to stream music it sometimes just starts stuttering - which is highly annoying.

The netbook seemed like a good choice for a low powered machine that could take some of the strain off my DS, so I figured I might have a play around too and see how difficult it was.

I've spent the last three days messing around with Freenas and Nas4free (both based on FreeBSD I believe) to see which one I preferred. I even installed Mint .... just for the hell of it .

I settled on Nas4free as Freenas really seemed to want a machine that had a whole lot more RAM.

After trial and error on the various setup types, I've managed to get the system up and running on a full install (the embedded install was just too slow with the USB sticks I've got loafing around - and I'm not that patient ).

-- Ensue many hours of Googling as I have very little technical knowledge of Linux --

The basic configuration.

Nas4free installed
Disk installed and mount point created as volume1
Two user accounts created - Infi and HTPC
Two user groups created - sabnzbd and recordings
Two shared folders created - Recordings and Public

After much trial and error and finding the right guides on t'internet, I now have SAB and Sick Beard fully functioning.

The problem I'm having is setting permissions on these shares. I originally created them by SSH'ing into the netbook as root and mkdir /mnt/volume1/recordings etc. The owner is therefore root and the group is wheel (administrators).

I don't really need to change the permissions for Infi, but I'd like to set the Recordings share so that only the admins and users of the recordings group can access the Recordings share.

If I make Infi and HTPC members of the wheel group, I can access the netbook and shares fine, but if I take them out, I can't even see the shares from Windows.

I've spent another 1/2 day Googling around trying to find out how to set these permissions up correctly so that everyone isn't a member of the wheel group (as that kind of defeats the purpose of permissions in the first place), but all I seem to come across is people on the Nas4free forums (and other places) linking from one discussion to another to another to another and never really answering the question (well not for me anyway), or people talking in extremely stilted English so that it just really hurts my head to read.

So I thought I'd take a punt and ask here and see if anyone can point me in the right direction, as I'm sure that in the future I'll want to create more shares on there and it'd be nice to have a basic understanding of how to configure shares/permissions on the netbook without having to spend hours trawling the internet. That, and I do occasionally like to learn new things.

I'm sure it's all very simple when you know how, but I've come from many years using Windows, and even though I have dabbled with the commandline in my Administrator days, it was never really necessary for setting up Windows shares - it was just a right-click away.

 

[Infidelus]

After spending a few more hours searching for answers, I happened across a utility called WinSCP which gives me a nice little GUI and makes the task of setting/checking permissions and ownership a little easier.

As for the problem accessing the NAS, it looks like it might be down to the NIC in the netbook. It's only a 10/100, and I noticed that when I tried to connect from the HTPC, it initially failed and the Windows diagnostic prompt came up. If I then sat there for a minute and tried again, the shares opened up as they should.

I'm wondering if it's a combination of the slow NIC speed and the fact I have to use powerline adapters that could in fact be causing the problem.

I've seen a StarTech USB 3 to RJ45 gigabit network adapter that I'm contemplating buying. It's not going to get me full gigabit speeds, especially on a USB 2 device, and it may not even be supported by nas4free, but it's not particularly expensive and it might be worth a bash. I can always retask it somewhere else if it's any good.

 

[jack.mitchell]

Hi mate,

I'll give you a quick run down of how I understand it.

The 'wheel' group is mainly for people who are allowed to use sudo, aka gain administrator priviledges. Directories and files are not usually under the wheel group.

I think your issue may be related to the fact that you are using Samba, i.e. Window shares which doesn't necessarily map correctly to Unix groups and permissions.

You need set write groups and permissions in Samba rather than on your filesystem.

WinSCP works because it doesn't use the Samba protocol and uses native Unix groups and users.

I hope this helps a bit and I wish I could help more but it would require a bit of a thesis!

EDIT: Read these posts to get a better understanding.

http://www.cyberciti.biz/tips/how-do-i-set-permissions-to-samba-shares.html

http://www.linuxplanet.com/linuxplanet/tutorials/6844/1

 

[Infidelus]

Thanks for the links. I've saved 'em to my favourites and will take a gander at them later on.

The main problem I was having was adding groups to shares/folders. I'd managed to create the folders and chmod the permissions for the folder all in a terminal window, but I really struggled to find info on adding user groups to them, which is where WinSCP came in really handy and stopped me banging my head on the table

Still, I've had a bit more practice today. I foolishly tried to get newznab installed on nas4free. There's very little info out there on doing it, as I don't suspect many people have got it working yet (me included ). I managed to break the nas4free web interface and most of the other options on the menu in the process , so I ended up doing a fresh install today.

On the plus side, I've gone from 3 days of reading getting the netbook set up to having it all back up and running in about an hour or so

 

[SKILL]

As jack mentions seems like there might be two issues, Samba permissions and local user permissions, his links cover the samba permissions but just for reference I'll briefly cover local user permissions...

Firstly, this works for both folders and files, also worth noting that there are other, weird at times, permissions that I'm gonna ignore in favour of just the basics

So a file/folder has a set of 3 permissions, an owner and a group 'owner', doing "ls -l" will provide a line such as:
drwx------ 8 root wheel 4.0K Jan 20 14:26 Dropbox

So a directory called "Dropbox", created on Jan 20th at 14:26, owner is root, group is wheel and only the owner has the ability to read, write and/or execute it. (I believe you need execute permissions on a directory to 'ls' inside it, but I could be wrong on that)

So the important fields here are the "dwrx------", "root" and "wheel".

So the first field consists of a special character, in this case 'd' to signify a directory, it can be other letters but lets ignore that, and then 3 sets of 3 characters (so "rwx", "---" and "---" in this example) which show the current permissions in the order of owner-group-everyone.

So you've used chmod to alter the permissions of the folder, not sure your knowledge here but the general way to use chmod would be something like:
chmod 700 Dropbox

This would emulate the permissions we have here, 7 is made up of 4 for read, 2 for write and 1 for execute (so 4 is read/write, 5 is read/execute etc etc), the other way sometimes used for scripts etc would be:
chmod a+x foobar

This would set the execute bit (x) for all users (a), using "a-x" would remove the execute bit for all users.

So that's the basics of chmod, now the two new tools we'll use are "chown" and "chgrp".

chown is used to change owner, chgrp to change group. So going back to the original example we could do say:
chown Infi Dropbox

Which would make the owner Infi, note that all these commands need to be done either as root or as the owner of the file, so the user Infi can't chown a file to themselves that belongs to another user.

Then if you setup a new group called, say, "foobar", you could then do:
chgrp foobar Dropbox

After the chown and chgrp commands you'd now have:
drwx------ 8 Infi foobar 4.0K Jan 20 14:26 Dropbox

And only Infi would be able to do anything with it, doing say:
chmod 750 Dropbox

would give members of the foobar group read+execute permissions.

Adding a -R flag after the command name (so chmod -R 750 Dropbox) applies the permissions recursively, so the folder and every file/folder inside it.

For more information you can type "man chmod" or similar into the terminal and it will give you the manual page for that command, if it has it installed.

 

[Infidelus]

So you've used chmod to alter the permissions of the folder, not sure your knowledge here but the general way to use chmod would be something like:
chmod 700 Dropbox

Learning

Then if you setup a new group called, say, "foobar", you could then do:
chgrp foobar Dropbox

I think this is the bit that had me confused where I've read stuff before. I was misreading chgrp as a change group command, not an add group command.

Thanks for the writeup

 

[SKILL]

chgrp does change groups, so it changes the group that the file/folder 'belongs' to (from what you said this is what you need, from wheel to <something else>)

So I should've probably added some brief stuff on how to add groups/add a user to a group.

So to add a group, called nas_admins, use:
groupadd nas_admins

Then you'd want to add users to the group (user Infi to group nas_admins) with:
usermod -a -G nas_admins Infi

And finally use chgrp on the directory so:
chgrp -R nas_admins recordings

So now you'll have a folder called recordings which is 'owned' by the group nas_admins, and the user Infi is a member of the group and hence Infi's permissions in that directory are given by the middle block of permissions.

 

[Infidelus]

chgrp does change groups, so it changes the group that the file/folder 'belongs' to (from what you said this is what you need, from wheel to <something else>)

So I should've probably added some brief stuff on how to add groups/add a user to a group.

So to add a group, called nas_admins, use:
groupadd nas_admins

Then you'd want to add users to the group (user Infi to group nas_admins) with:
usermod -a -G nas_admins Infi

And finally use chgrp on the directory so:
chgrp -R nas_admins recordings

So now you'll have a folder called recordings which is 'owned' by the group nas_admins, and the user Infi is a member of the group and hence Infi's permissions in that directory are given by the middle block of permissions.

And that's the final piece! I am now an eggspurt!

Seriously though, thanks for the explanation. I'm not sure why I had such a hard time finding the info for something that's relatively simple. I obviously didn't explain myself very well to Google, or anyone else