Member Avatar for fantasyprints

Hi All

I have a few Mac Pros spare now we have updated our RIPS that control our printers. I thought I would turn one into a file server for our Windows SBS 2008 network. I have access to Panther, Leopard and Lion (inc server) OSs). I started with Leopard and setup a shared directory using SMB protocol and all the Windows PCs can access and save files BUT....

Problem I discovered first was if a user copies a file to this new OS X server the permissions only show for that user so other users can't ammend and sometimes can't access the files. I read using SMB only on the Macs might solve but hasn't. I read that Lion Server would be the answer so tried that but it's a nightmare to get connected to Active Directory but it was doing the same.

I setup in the Server to Propogate the Permissions but as soon as any Windows user adds a file to the OS X Server the permissions revert to that user.

I have spent a few hours now seeing a way to solve but reading through the internet I see issues with Lion with Active Directory and the older OSs not sure if this a problem or if there is a work around.

Any help would be grateful

Paul

  • 3 Contributors
  • 2 Replies
  • 244 Views
  • 6 Days Discussion Span
  • Latest Post Latest Post by cocolio

Dani AI

Generated

Short summary and a practical path forward (notes for , building on and ):

What you are seeing is normal SMB behavior: a file created over SMB is owned by the creating account and the server’s mapping between Windows ACLs and POSIX permissions controls who can later edit it. There are two robust ways to fix it so Windows users can both create and have group-edit rights afterwards: make Samba enforce group-writable creation (or store Windows ACLs) on Leopard, or use macOS ACL inheritance on Lion — but note Lion’s SMB stack changed from the older Samba code and AD/NT-ACL behavior became less predictable. (samba.org)

Leopard (Samba) — recommended edits

  • Put sensible masks and inheritance in the share section of /etc/smb.conf: set create mask = 0664, directory mask = 2775, force group = <shared-group>, and inherit permissions = yes. If your Samba build supports the ACL VFS, add vfs objects = acl_xattr so Windows ACLs are kept in xattrs. Restart smbd and test. Example (share stanza):
    [files]
path = /Shared
read only = no
create mask = 0664
directory mask = 2775
force group = staff
inherit permissions = yes
vfs objects = acl_xattr

    create mask / inherit permissions and acl_xattr behavior are documented in the Samba manual. (samba.org)

Lion / OS X Server — recommended edits

  • Use HFS+ ACLs so every new item inherits group write. Example pattern:
    chgrp -R sharedgroup /Shared
chmod -R g+rwX /Shared
chmod g+s /Shared
chmod +a "group:sharedgroup allow list,add_file,add_subdirectory,delete,read,write,append,file_inherit,directory_inherit" /Shared

    After that, ls -le /Shared should show the “+” ACL marker and new files should inherit the ACL entry. See Apple’s ACL documentation and the chmod manpage for the +a syntax and the inheritance flags. (developer.apple.com)

Testing and fallbacks

  • Verify with ls -le and from a Windows client. If Lion’s built-in SMB refuses to behave or AD binding is flaky, either run a recent Samba from MacPorts/Homebrew (so you can use the acl_xattr approach), or host shares on a Windows file server/NAS that natively understands NTFS ACLs. FTP (as suggested) avoids SMB ACL issues but loses fine-grained, collaborative editing features. Back up before changing permissions. (samba.org)

Recommended Answers

All 2 Replies

Member Avatar for sDJh

Hi Paul...

...and welcome to the wonderful world of multi-os-users! You know what? I'm using the same configuration as you but have also many Linux clients running. For years now, my best solution is the bare minimum: FTP. This is simple, reliable and can be accessed by all major and even minor OSs.
Have a look for a ftp-server that you like, install it and set the root directory to the same one as your smb. This should be done in a few hours time. But after that your problems will be past.

Greetings, Simon

Member Avatar for cocolio

have you tried running the chmod command from terminal? remember that CLI is very usefull when its time for administering servers-

commented: This would be the easiest and fastest way, +2
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.