NAS4FREE with SAMBA 4 in Active Directory – fun with ACLs

 samba, server  1 Response »
Nov 062015
 

ACL set codes

insta-25
Working with permissions on NAS4FREE shell is pleasant and enjoyable experience …. *cough*, *cough*.

$ getfacl /tank/shared

# file: /tank/shared
# owner: aduser
# group: 500
                         everyone@:rwxpD-a-R-c---:------:allow
                            group@:rwxpD-a-R-c---:------:allow
                      group:aduser:rwxpDdaARWcCo-:fd----:allow
 group:adgroup_shared_share_access:rwxpDdaARWc---:fd----:allow

full_set = rwxpdDaARWcCos = all permissions
modify_set = rwxpdDaARWc–s = all permissions except write_acl, write_owner
read_set = r—–a-R-c— = read_data, read_attributes, read_xattr, read_acl
write_set = -w-p—A-W—- = write_data, append_data, write_attributes, write_xattr
NFSv4 ACL legend (read from top, down and exit on first match)

            
                 owner@:--------------:-------:deny
                 owner@:rwxp---A-W-Co-:-------:allow
                 group@:-w-p----------:-------:deny
                 group@:r-x-----------:-------:allow
              everyone@:-w-p---A-W-Co-:-------:deny
              everyone@:r-x---a-R-c--s:-------:allow
                        ||||||||||||||:|||||||
           (r)read data +|||||||||||||:||||||+ (I)nherited
           (w)rite data -+||||||||||||:|||||+- (F)ailed access (audit)
              e(x)ecute --+|||||||||||:||||+-- (S)uccess access (audit)
               a(p)pend ---+||||||||||:|||+--- (n)o propagate
               (d)elete ----+|||||||||:||+---- (i)nherit only
         (D)elete child -----+||||||||:|+----- (d)irectory inherit
          read (a)ttrib ------+|||||||:+------ (f)ile inherit
         write (A)ttrib -------+||||||
           (R)ead xattr --------+|||||
          (W)rite xattr ---------+||||
             read a(c)l ----------+|||
            write a(C)l -----------+||
         change (o)wner ------------+|
                   sync -------------+

 

Changing permissions over NAS4FREE console is possible

setfacl -m u:aduser:rwxpdaARWc:fd:allow folderHere
setfacl -m g:adgroup_shared_share_access:rwxpDaARWcCo:fd:allow shared/

But it’s probably easier to manage it from Windows workstation

Pick one responsible user and grant him/her SeDiskOperatorPrivilege

net rpc rights grant aduser SeDiskOperatorPrivilege -U adadmin
net rpc rights list accounts -P
net rpc rights list -P

Also add in NAS4FREE web interface under Services|CIFS/SMB|Share|Edit|Auxiliary parameters

admin users = aduser
valid users = @adgroup_shared_share_access, @"ADgroup Shared Share Access"
write list = @adgroup_shared_share_access, @"ADgroup Shared Share Access"

And just let him do the hard work of dealing with other users.

Useful links

https://wiki.samba.org/index.php/Shares_with_Windows_ACLs

http://wiki.nas4free.org/doku.php?id=documentation:setup_and_user_guide:services_cifs_smb_samba

http://wiki.nas4free.org/doku.php?id=documentation:setup_and_user_guide:services_cifs_smb_shares

Monitoring NAS4FREE with check_mk

 monitoring, server, storage  12 Responses »
Nov 032015
 

I’ve got one AD integrated NAS4FREE server running on Supermicro hardware.  It is rock solid but still, it would be nice to pull some monitoring info from it, innit?

Related to previous post about local checks with check_mk – based on Monitoring FreeBSD but slightly adapted for use with NAS4FREE, here are quick steps to make it happen. Tested on 9 and 10.

 

pkg install xinetd
vi /usr/local/etc/xinetd.conf
defaults
{
# Please note that you need a log_type line to be able to use log_on_success
# and log_on_failure. The default is the following :
# log_type = SYSLOG daemon info

service check_mk
{
 type = UNLISTED
 port = 6556
 socket_type = stream
 protocol = tcp
 wait = no
 user = root
 server = /mnt/tank/service/local/bin/check_mk_agent
 only_from = 10.10.8.130
 disable = no
}
}

vi /etc/services

 check_mk 6556/tcp #check_mk agent

vi /etc/hosts.allow

check_mk_agent : 10.10.8.130 : allow
check_mk_agent : ALL : deny

vi /etc/rc.conf

xinetd_enable="YES"

and then

/usr/local/etc/rc.d/xinetd start

 

Check_MK comes with a dedicated agent for FreeBSD: check_mk_agent.freebsd – make sure to copy it from OMD server /omd/sites/mysite/share/check_mk/agents/ to /mnt/tank/service/local/bin/check_mk_agent on NAS4FREE server.

 

Oh, and check out my sophisticated check_mk script that pulls SMART status from disks!
https://github.com/zmielna/smart_diskinfo/blob/master/check_mk_smart_freebsd.sh

That’s a real piece of art, init?

 

 Older Entries  Newer Entries