The basic problems is that I have a Domain Connected QNAP and want to publish the RSnapshot snapshots via Samba so users can recover their own files from backups. (As per the original RSnapshot HowTo: http://rsnapshot.org/rsnapshot/docs/docbook/rest.html#restoring-backups)

However unless I set a Default ACL (setfacl -m g:MYDOM\Domain\ Users:rx) that the new snapshots will inherit, I simply can't browse the content of the shared snapshots.

RSnapshot Overview

It creates hourly / daily / weekly / monthly snapshots and are preserving the standard and extended Linux ACLs correctly. The snapshots are stored in the following directory:

/share/CACHEDEV1_DATA/Local Backups

To prevent changes in permissions from occurring, I have cleared the default ACLs of that directory and simply set default permissions. The permissions are:

# ls -al
drwxrwxrwx    4 admin    administ      4096 Nov 22 17:00 Local Backups/

# getfacl Local\ Backups/
# file: Local Backups/
# owner: admin
# group: administrators

This means that the default permissions of the snapshot sub-directories (hourly.0, hourly.1 etc) looks like:

# cd hourly.0

# ls -al
drwxrwxrwx    3 admin    administ      4096 Nov 22 16:02 ./

# getfacl .
# file: .
# owner: admin
# group: administrators

At this point RSnapshot is fully tested and working as expected. (The permissions are pretty liberal to work out if the FS permissions or Samba is the problem.)

Samba Overview

I've created a Share through the WebGUI called LocalBackups, and reviewing the smb.conf file I would expect it to work without modifications. Though I can access the LocalBackups directory fine, every time I try to access on of the backups, i.e. hour.0, hourly.1 etc, I get the error message "You do not have permissions to access \\LocalBackups\hourly.0.

From the smb.conf, the [global] section is:

# Add this, apparently Windows 7 Bug.
# acl allow execute always = yes
log level = 3
passdb backend = smbpasswd
workgroup = MYDOM
security = ADS
server string =
encrypt passwords = Yes
username level = 0
#map to guest = Bad User
null passwords = yes
max log size = 10
os level = 20
preferred master = no
dns proxy = No
smb passwd file=/etc/config/smbpasswd
username map = /etc/config/smbusers
guest account = guest
directory mask = 0777
create mask = 0777
oplocks = yes
locking = yes
disable spoolss = no
load printers = yes
veto files = /.AppleDB/.AppleDouble/.AppleDesktop/:2eDS_Store/Network Trash Folder/Temporary Items/TheVolumeSettingsFolder/.@__thumb/.@__desc/:2e*/.@__qini/.Qsync/.@upload_cache/.qsync/.qsync_sn/.@qsys/.streams/.digest/
delete veto files = yes
map archive = no
map system = no
map hidden = no
map read only = no
deadtime = 10
server role = auto
use sendfile = yes
unix extensions = no
store dos attributes = yes
client ntlmv2 auth = yes
dos filetime resolution = no
wide links = yes
#force unknown acl user = yes
force unknown acl user = yes
template homedir = /share/homes/DOMAIN=%D/%U
inherit acls = yes
domain logons = no
min receivefile size = 256
case sensitive = auto
domain master = auto
local master = no
enhance acl v1 = yes
remove everyone = yes
conn log = no
kernel oplocks = no
max protocol = SMB2_10
smb2 leases = yes
durable handles = yes
kernel share modes = no
posix locking = no
lock directory = /share/CACHEDEV1_DATA/.samba/lock
state directory = /share/CACHEDEV1_DATA/.samba/state
cache directory = /share/CACHEDEV1_DATA/.samba/cache
printcap cache time = 0
acl allow execute always = yes
server signing = disabled
aio read size = 1
aio write size = 0
streams_depot:delete_lost = yes
streams_depot:check_valid = no
fruit:nfs_aces = no
fruit:veto_appledouble = no
winbind expand groups = 1
pid directory = /var/lock
printcap name = /etc/printcap
printing = cups
show add printer wizard = no
realm = mydom.local
ldap timeout = 5
password server = mydc001.mydom.local
pam password change = yes
winbind enum users = Yes
winbind enum groups = Yes
winbind cache time = 3600
idmap config * : backend = tdb
idmap config * : range = 400001-500000
idmap config MYDOM : backend = rid
idmap config MYDOM : range = 10000001-20000000
host msdfs = yes
vfs objects =  shadow_copy2 acl_xattr catia fruit qnap_macea streams_depot aio_pthread

The [LocalBackups] section is:

comment =
path = /share/CACHEDEV1_DATA/Local Backups
browsable = yes
oplocks = yes
ftp write only = no
recycle bin = no
recycle bin administrators only = no
qbox = no
public = yes
#invalid users = "guest"
#read list = @"MYDOM\Domain Users"
#write list = "admin"
#valid users = "root","admin",@"MYDOM\Domain Users"
guest ok = yes
read only = yes
inherit permissions = no
shadow:snapdir = /share/CACHEDEV1_DATA/_.share/LocalBackups/.snapshot
shadow:basedir = /share/CACHEDEV1_DATA/Local Backups
shadow:sort = desc
shadow:format = @GMT-%Y.%m.%d-%H:%M:%S
smb encrypt = disabled
strict allocate = yes
streams_depot:check_valid = yes
mangled names = yes
admin users =
admin only = "admin"
#nt acl support = no

Using this configuration, I can enter the LocalBackupds directory, but I can't enter any of the snapshot sub-directories, i.e. hourly.0, hourly.1 etc.

The commented out lines is things I have tried to see if it makes a difference, but the behavior has been consistent with or without the commented out lines.

If I change the ACL on one of the snapshot directories (i.e. hourly.0) to include the MYDOM\Domain Users, I am allowed to enter that directory (i.e. hourly.0) via Samba. The permissions of the directory is then:

# cd hourly.0

# ls -al
drwxrwxrwx    3 admin    administ      4096 Nov 22 18:00 ./

# getfacl .
# file: .
# owner: admin
# group: administrators

At this point I have not been able to work out how to enable proper logging on the QNAP. From the basic WebUI logging information I can see the SMB connection request passing with my user name etc. I'm leaning towards the Samba configuration being more strict than the FS Permissions, but I'm guessing.

At this stage I'm not sure if my knowlege of ACLs, Samba or both are failing me. Any ideas?


Instead of trying to solve this through Samba, I've reset the samba configuration to the default that the QNAP created. (I.e. un-commented the commented out lines. This also seems safer in the long run since the Web GUI can potentially overwrite the tuned smb.conf file if new shares etc are created by myself or other admins.)

I then change the file system permissions to add the extended ACL for the MYDOM\Domain Users group with read r+x for the directories:


This way when the files are backed up the domain users can navigate all the way to the homes directory. However since there is no default ACL that is inherited from the snapshots directory (/share/CACHEDEV1_DATA/Local Backups) and no changes to the user's home directories, only the original users can access their own home directories.

RSnapshot Changes

I though that the extended ACLs were preserved. They were not, it only looked right because the home directories' standard ACLs were setup with a domain user and group. So the standard ACLs were preserved, but not the extended ones. To fix this, I edited the rsnapshot script and added the -A flag to rsync by changing:

my $default_rsync_short_args = '-a';


my $default_rsync_short_args = '-aA';

To fix access, to the snapshot directories (i.e. hourly.0, etc), I also added a permission change to the create_backup_point_dir function by adding right at the bottom of the function:

system("setfacl -m g:MYDOM\\\\Domain\\ Users:rx \"$destpath\"");

It now works as expected and users can recover their own private files from backups. :)

I'll try and roll this into a patch for rsnapshot once I've done some more testing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.