The basic problems is that I have a Domain Connected QNAP and want to publish the RSnapshot snapshots via Samba so users can recover their own files from backups. (As per the original RSnapshot HowTo: http://rsnapshot.org/rsnapshot/docs/docbook/rest.html#restoring-backups)
However unless I set a Default ACL (setfacl -m g:MYDOM\Domain\ Users:rx) that the new snapshots will inherit, I simply can't browse the content of the shared snapshots.
It creates hourly / daily / weekly / monthly snapshots and are preserving the standard and extended Linux ACLs correctly. The snapshots are stored in the following directory:
To prevent changes in permissions from occurring, I have cleared the default ACLs of that directory and simply set default permissions. The permissions are:
# ls -al drwxrwxrwx 4 admin administ 4096 Nov 22 17:00 Local Backups/ # getfacl Local\ Backups/ # file: Local Backups/ # owner: admin # group: administrators user::rwx user:admin:rwx user:guest:--- group::rwx group:MYDOM\domain\040users:r-x mask::rwx other::rwx default:user::rwx default:group::rwx default:mask::rwx default:other::rwx
This means that the default permissions of the snapshot sub-directories (hourly.0, hourly.1 etc) looks like:
# cd hourly.0 # ls -al drwxrwxrwx 3 admin administ 4096 Nov 22 16:02 ./ # getfacl . # file: . # owner: admin # group: administrators user::rwx group::rwx mask::rwx other::rwx default:user::rwx default:group::rwx default:mask::rwx default:other::rwx
At this point RSnapshot is fully tested and working as expected. (The permissions are pretty liberal to work out if the FS permissions or Samba is the problem.)
I've created a Share through the WebGUI called LocalBackups, and reviewing the smb.conf file I would expect it to work without modifications. Though I can access the LocalBackups directory fine, every time I try to access on of the backups, i.e. hour.0, hourly.1 etc, I get the error message "You do not have permissions to access \192.168.1.20\LocalBackups\hourly.0.
From the smb.conf, the [global] section is:
[global] # Add this, apparently Windows 7 Bug. # acl allow execute always = yes log level = 3 passdb backend = smbpasswd workgroup = MYDOM security = ADS server string = encrypt passwords = Yes username level = 0 #map to guest = Bad User null passwords = yes max log size = 10 socket options = TCP_NODELAY SO_KEEPALIVE os level = 20 preferred master = no dns proxy = No smb passwd file=/etc/config/smbpasswd username map = /etc/config/smbusers guest account = guest directory mask = 0777 create mask = 0777 oplocks = yes locking = yes disable spoolss = no load printers = yes veto files = /.AppleDB/.AppleDouble/.AppleDesktop/:2eDS_Store/Network Trash Folder/Temporary Items/TheVolumeSettingsFolder/.@__thumb/.@__desc/:2e*/.@__qini/.Qsync/.@upload_cache/.qsync/.qsync_sn/.@qsys/.streams/.digest/ delete veto files = yes map archive = no map system = no map hidden = no map read only = no deadtime = 10 server role = auto use sendfile = yes unix extensions = no store dos attributes = yes client ntlmv2 auth = yes dos filetime resolution = no wide links = yes #force unknown acl user = yes force unknown acl user = yes template homedir = /share/homes/DOMAIN=%D/%U inherit acls = yes domain logons = no min receivefile size = 256 case sensitive = auto domain master = auto local master = no enhance acl v1 = yes remove everyone = yes conn log = no kernel oplocks = no max protocol = SMB2_10 smb2 leases = yes durable handles = yes kernel share modes = no posix locking = no lock directory = /share/CACHEDEV1_DATA/.samba/lock state directory = /share/CACHEDEV1_DATA/.samba/state cache directory = /share/CACHEDEV1_DATA/.samba/cache printcap cache time = 0 acl allow execute always = yes server signing = disabled aio read size = 1 aio write size = 0 streams_depot:delete_lost = yes streams_depot:check_valid = no fruit:nfs_aces = no fruit:veto_appledouble = no winbind expand groups = 1 pid directory = /var/lock printcap name = /etc/printcap printing = cups show add printer wizard = no realm = mydom.local ldap timeout = 5 password server = mydc001.mydom.local pam password change = yes winbind enum users = Yes winbind enum groups = Yes winbind cache time = 3600 idmap config * : backend = tdb idmap config * : range = 400001-500000 idmap config MYDOM : backend = rid idmap config MYDOM : range = 10000001-20000000 host msdfs = yes vfs objects = shadow_copy2 acl_xattr catia fruit qnap_macea streams_depot aio_pthread
The [LocalBackups] section is:
[LocalBackups] comment = path = /share/CACHEDEV1_DATA/Local Backups browsable = yes oplocks = yes ftp write only = no recycle bin = no recycle bin administrators only = no qbox = no public = yes #invalid users = "guest" #read list = @"MYDOM\Domain Users" #write list = "admin" #valid users = "root","admin",@"MYDOM\Domain Users" guest ok = yes read only = yes inherit permissions = no shadow:snapdir = /share/CACHEDEV1_DATA/_.share/LocalBackups/.snapshot shadow:basedir = /share/CACHEDEV1_DATA/Local Backups shadow:sort = desc shadow:format = @GMT-%Y.%m.%d-%H:%M:%S smb encrypt = disabled strict allocate = yes streams_depot:check_valid = yes mangled names = yes admin users = admin only = "admin" #nt acl support = no
Using this configuration, I can enter the LocalBackupds directory, but I can't enter any of the snapshot sub-directories, i.e. hourly.0, hourly.1 etc.
The commented out lines is things I have tried to see if it makes a difference, but the behavior has been consistent with or without the commented out lines.
If I change the ACL on one of the snapshot directories (i.e. hourly.0) to include the MYDOM\Domain Users, I am allowed to enter that directory (i.e. hourly.0) via Samba. The permissions of the directory is then:
# cd hourly.0 # ls -al drwxrwxrwx 3 admin administ 4096 Nov 22 18:00 ./ # getfacl . # file: . # owner: admin # group: administrators user::rwx group::rwx group:MYDOM\domain\040users:rwx mask::rwx other::rwx default:user::rwx default:group::rwx default:mask::rwx default:other::rwx
At this point I have not been able to work out how to enable proper logging on the QNAP. From the basic WebUI logging information I can see the SMB connection request passing with my user name etc. I'm leaning towards the Samba configuration being more strict than the FS Permissions, but I'm guessing.
At this stage I'm not sure if my knowlege of ACLs, Samba or both are failing me. Any ideas?