O.k. from this point I’m assuming you have created your zfs shares via the zfs command and renamed appropriately like so….. (if you havent setup cifs yet then check read this)
zfs set sharesmb=on protected/backup
zfs set sharesmb=name=backup protected/backup
Now to check your current shares type…
sharemgr show
zfs
zfs/protected/backup
backup=/protected/backup
zfs/protected/photos
photos=/protected/photos
Now its time to look at NFSv4 ACL’s. This page has a great explanation of ACL’s and how to set things up. http://cuddletech.com/blog/pivot/entry.php?id=939
The ZFS manual here has the compact access and inheritance codes for chmod : http://opensolaris.org/os/community/zfs/docs/zfsadmin.pdf
Here are the current compact codes for access control;
add_file w , add_subdirectory p , delete d , delete_child D , execute x , list_directory r , read_acl c , read_attributes a , read_data r , read_xattr R , write_xattr W , write_data w , write_attributes A , write_acl C , write_owner o
Here are the current compact codes for inheritance control;
file_inherit f , dir_inherit d , inherit_only i , no_propagate n
So… The below command (referencing above compact codes) will give me (the owner) full permissions to files / directories, and read only access to everyone else. I have enabled inheritance so newly created files should also maintain their parents ACL without windows creating its own. Note: i used chown on the root of the my share first i.e. chown -R daz /protected
then…
chmod -R A=\
owner@:wACpdDo:d:allow,\
owner@:wACpdDo:f:allow,\
everyone@:rxaARWcs:d:allow,\
everyone@:raARWcs:f:allow \
/protected/
Remember to test that this has provided what you want. Connect to your share as guest test the permissions, then connect as the owner and test permissions again. The fun thing about this particular ACL system is that you are not restricted to just one owner and one group. You can add additional lines as required using user: and group: attributes. I’ve done a multi-user ACL post here.
There is alot of flexibility – i’d say even more than the samba server options by a long shot. Its probably a little bit more fiddly getting your commands right, but once up and running you can have alot more control.
There are also “ACL sets” which combine the above attributes into groups….. i.e .you can have just the word “full_set” (full permissions) or “read_set” (supposedly gives you read, but i couldn’t see any child files after using this) between the first set of colons in the above command… Using ACL sets the above command could be changed to…
chmod -R A=\
owner@:full_set:d:allow,\
owner@:full_set:f:allow,\
everyone@:rxaARWcs:d:allow,\
everyone@:raARWcs:f:allow \
/protected/
This should still give the owner full permissions (previously the owner just inherited the everyone groups permissions it didnt have as well)
These are the possible choices for ACL sets: full_set , read_set , modify_set , write_set
see here for more examples : https://sigtar.com/2009/02/15/opensolaris-cifssmb-server-configuring-acl’s-on-shares-part-2/
—– workgroup authentication —–
Assuming you are NOT using a domain:
Did you enable the password database settings?
user@solaris:~# cat >> /etc/pam.conf
# Seem to need this line for smb / cifs:
other password required pam_smb_passwd.so.1 nowarn
(Control-D to end)
user@solaris:~# passwd
passwd: Changing password for user
New Password:
Re-enter new Password:
passwd: password successfully changed for user