I'm migrating data on an informal home server to a new FreeNAS (FreeBSD 10) based file server running samba, and I'm stuck in trying to plan how to lay the data out, to give correct access to different users. I think I need a bit of handholding to understand how to approach this in the BSD world (as opposed to the Windows world I'm used to), as I'm not sufficiently familiar with how a more experienced sysadmin would combine the use of unix permissions, ACLs, Unix home dirs, soft/hard symlinks, users/groups, and samba include/exclude parameters to achieve the desired outcome.
There are quite a lot of data dirs, and about 8 users, but to make it more general for others with a similar query, I've abstracted it quite a lot:
The logical data structure is something like this (not necessarily how it's laid out on disk):
media --- movies --- tv --- music --- books software --- drivers --- installers disk image backups development --- tools --- projects user non-public data --- user1's non-public data --- user2's non-public data ESXi VM store
The actual top-level dirs above are split physically across different mountpoints/file systems, because I'm using ZFS and putting data across different datasets lets me tune ZFS + samba properties better. E.g., all video+audio files are held in one dataset because they are very large in total yet probably won't dedup well (they'd just waste RAM); drivers, software and disk images are in a separate dataset because tests show they have a very high dedup ratio and dedup benefits of space-saving are very valuable; separating private and non-private data into different datasets might simplify security(?); and some small dirs need extra multiple copies or different snapshot setups.
That said, I want each user to see a unified logical structure (as appropriate for them) rather than the physical one, meaning that they see
software as two top level dirs in the same root share, not two separate shares, even though they physically reside on different file systems. So the root share a user accesses will almost certainly contain soft symlinks or similar (nullfs?) to do this.
I don't need to think much about lower level directories, once the top level dirs are set up. The only control I plan is on the top level dirs, and in a handful of cases 2nd level dirs (eg for individual user private data subdirs). Below that level it's always inherited permissions "same as parent" with the data being on the same volume, so it can be almost ignored.
Permissions once set up should be simple: in principle I'll manually set any needed perms on the handful of top level dirs (and symlinks to top level dirs) when I set up the general file system/users/groups, and then any further subdirs and contents forcibly inherit those permissions, so users won't have any knowledge or ability to set permissions further. Most users won't have shell access, so their only access apart from SMB shares will be a preconfigured rsync backup over ssh using authorized_keys to define a preset backup command. All data dirs are set up to use windows-style ACLs.
In effect the user list is short enough that I want to pick and choose for each user, what they can see and modify, and it's practical to do so on an individual basis. I have complete freedom to set up symlinks, or user/group relationships, unix permissions and ACLs, and symlinks. But doing it elegantly will make the difference between a system that's easy to manage and doesn't need me much vs. one that causes headaches all the time.
I know which folders I want users to see, and which they should have readwrite or read-only access, or traverse/non-traverse access. What I want to do is actually implement whatever's needed for each user, to set up which folders in the data filesystems they can see, and of that, which are read-write and which read-only, and the rest. There are a lot of ways to do so (set up various users and groups? perms+ACLs? Samba veto dirs? symlinks? mount union or mount_nullfs if samba and these symlinks wouldn't work well?); I don't have experience in how to plan this in the unix world, and I'm stuck.
Between trying to plan a file system I've never used before, and trying to figure out what's needed to ensure access is controlled (so users can't "escape" from their permitted dirs using "../" or similar), I'm now stuck.
There are tons of resources about how permissions and file systems functionally work, but none I can find about how to plan and set up a basic multi-user file server's data layout, and the consequences of the "different ways of achieving the same/similar outcome" in doing so.
How would an experienced sysadmin approach it?