10. Sharing

Once you have a volume, create at least one share so that the storage is accessible by the other computers in your network. The type of share you create depends upon the operating system(s) running in your network, your security requirements, and expectations for network transfer speeds.

Beginning with version 9.3, FreeNAS® provides an Initial Configuration Wizard for creating shares. The Wizard will automatically create the correct type of dataset and permissions for the type of share, set the default permissions for the share type, and start the service needed by the share. It is recommended to use the Wizard to create shares, fine-tune the share settings using the instructions in the rest of this chapter if needed, then to fine-tune the default permissions from the client operating system to meet the requirements of the network.

Note

shares are created to provide and control access to an area of storage. Before creating your shares, it is recommended to make a list of the users that will need access to storage data, which operating systems these users are using, whether or not all users should have the same permissions to the stored data, and whether or not these users should authenticate before accessing the data. This information can help you determine which type of share(s) you need to create, whether or not you need to create multiple datasets in order to divide up the storage into areas with differing access and permission requirements, and how complex it will be to setup your permission requirements. It should be noted that a share is used to provide access to data. If you delete a share, it removes access to data but does not delete the data itself.

The following types of shares and services are available:

  • Apple (AFP) Shares: the Apple File Protocol (AFP) type of share is a good choice if all of your computers run Mac OS X.
  • Unix (NFS) Shares: the Network File System (NFS) type of share is accessible by Mac OS X, Linux, BSD, and the professional and enterprise versions (not the home editions) of Windows. It is a good choice if there are many different operating systems in your network. Depending upon the operating system, it may require the installation or configuration of client software on the desktop.
  • WebDAV Shares: this type of share is accessible using an authenticated web browser (read-only) or WebDAV client running on any operating system.
  • Windows (CIFS) Shares: the Common Internet File System (CIFS) type of share is accessible by Windows, Mac OS X, Linux, and BSD computers, but it is slower than an NFS share due to the single-threaded design of Samba. It provides more configuration options than NFS and is a good choice on a network containing any Windows systems. However, it is a poor choice if the CPU on the FreeNAS® system is limited; if your CPU is maxed out, you need to upgrade the CPU or consider another type of share.
  • Block (iSCSI) shares: this type of share appears as an unformatted disk to clients running iSCSI initiator software or a virtualization solution such as VMware.

If you are looking for a solution that allows fast access from any operating system, consider configuring the FTP service instead of a share and use a cross-platform FTP and file manager client application such as Filezilla. Secure FTP can be configured if the data needs to be encrypted.

If data security is a concern and your network’s users are familiar with SSH command line utilities or WinSCP, consider configuring the SSH service instead of a share. It will be slower than unencrypted FTP due to the overhead of encryption, but the data passing through the network will be encrypted.

Note

while the GUI will let you do it, it is a bad idea to share the same volume or dataset using multiple types of access methods. Different types of shares and services use different file locking methods. For example, if the same volume is configured to use both NFS and FTP, NFS will lock a file for editing by an NFS user, but a FTP user can simultaneously edit or delete that file. This will result in lost edits and confused users. Another example: if a volume is configured for both AFP and CIFS, Windows users may be confused by the extra filenames used by Mac files and delete the ones they don’t understand; this will corrupt the files on the AFP share. Pick the one type of share or service that makes the most sense for the types of clients that will access that volume, and configure that volume for that one type of share or service. If you need to support multiple types of shares, divide the volume into datasets and use one dataset per share.

This section will demonstrate how to fine-tune the configuration of AFP, NFS, CIFS, WebDAV, and iSCSI shares. FTP and SSH configurations are described in Services Configuration.

10.1. Apple (AFP) Shares

FreeNAS® uses the Netatalk AFP server to share data with Apple systems. This section describes the configuration screen for fine-tuning AFP shares created using the Initial Configuration Wizard. It then provides configuration examples for using the Wizard to create a guest share, configuring Time Machine to backup to a dataset on the FreeNAS® system, and for connecting to the share from a Mac OS X client.

To view the AFP share created by the Wizard, click Sharing ‣ Apple (AFP) and highlight the name of the share. Click its “Edit” button to see the configuration options shown in Figure 10.1a. The values showing for these options will vary, depending upon the information given when the share was created.

Figure 10.1a: Creating an AFP Share

_images/afp2.png

Note

while Table 10.1a summarizes the available options for fine-tuning an AFP share, you typically should not change the default settings of an AFP share as doing so may cause the share to not work as expected. Most settings are only available when you click “Advanced Mode”. Do not change an advanced option unless you fully understand the function of that option. Refer to Setting up Netatalk for a more detailed explanation of the available options.

Table 10.1a: AFP Share Configuration Options

Setting Value Description
Path browse button browse to the volume/dataset to share; do not nest additional volumes, datasets, or symbolic links beneath this path because Netatalk lacks complete support
Name string volume name that will appear in the Mac computer’s “connect to server” dialogue; limited to 27 characters and can not contain a period
Share Comment string only available in “Advanced Mode”; optional
Allow List string only available in “Advanced Mode”; comma delimited list of allowed users and/or groups where groupname begins with a @; note that adding an entry will deny any user/group that is not specified
Deny List string only available in “Advanced Mode”; comma delimited list of denied users and/or groups where groupname begins with a @; note that adding an entry will allow all users/groups that are not specified
Read-only Access string only available in “Advanced Mode”; comma delimited list of users and/or groups who only have read access where groupname begins with a @
Read-write Access string only available in “Advanced Mode”; comma delimited list of users and/or groups who have read and write access where groupname begins with a @
Time Machine checkbox when checked, FreeNAS will advertise itself as a Time Machine disk so it can be found by Macs; due to a limitation in how Mac deals with low-diskspace issues when multiple Mac’s share the same volume, checking “Time Machine” on multiple shares may result in intermittent failed backups
Zero Device Numbers checkbox only available in “Advanced Mode”; enable when the device number is not constant across a reboot
No Stat checkbox only available in “Advanced Mode”; if checked, AFP won’t stat the volume path when enumerating the volumes list; useful for automounting or volumes created by a preexec script
AFP3 UNIX Privs checkbox only available in “Advanced Mode”; enables Unix privileges supported by OSX 10.5 and higher; do not enable if the network contains Mac OS X 10.4 clients or lower as they do not support these
Default file permission checkboxes only available in “Advanced Mode”; only works with Unix ACLs; new files created on the share are set with the selected permissions
Default directory permission checkboxes only available in “Advanced Mode”; only works with Unix ACLs; new directories created on the share are set with the selected permissions
Default umask integer only available in “Advanced Mode”; umask for newly created files, default is 000 (anyone can read, write, and execute)
Hosts Allow string only available in “Advanced Mode”; comma, space, or tab delimited list of allowed hostnames or IP addresses
Hosts Deny string only available in “Advanced Mode”; comma, space, or tab delimited list of denied hostnames or IP addresses

10.1.1. Creating AFP Guest Shares

AFP supports guest logins, meaning that all of your Mac OS X users can access the AFP share without requiring their user accounts to first be created on or imported into the FreeNAS® system.

Note

if you create a guest share as well a share that requires authentication, AFP will only map users who login as guest to the guest share. This means that if a user logs in to the share that requires authentication, the permissions on the guest share may prevent that user from writing to the guest share. The only way to allow both guest and authenticated users to write to a guest share is to set the permissions on the guest share to 777 or to add the authenticated users to a guest group and set the permissions to 77x.

Before creating a guest share, go to Services ‣ AFP and make sure that the “Guest Access” box is checked.

Then, to create the AFP guest share, click “Wizard”, then click the “Next” button twice to display the screen shown in Figure 10.1b. Complete the following fields in this screen:

  1. Share name: input a name for the share that is useful to you but which is under 27 characters and does not contain a period. In this example, the share is named afp_guest.
  2. Click the button for “Mac OS X (AFP)”.
  3. Click the “Ownership” button. Click the drop-down “User” menu and select “nobody”. Click the “Return” button to return to the previous screen.
  4. Click the “Add” button. If you forget to do this, the share will not be created. Clicking the “Add” button will add an entry to the “Name” frame with the name that you typed into “Share name”.

Figure 10.1b: Creating a Guest AFP Share

_images/afp6.png

Click the “Next” button twice, then the “Confirm” button to create the share. The Wizard will automatically create a dataset for the share that contains the correct default permissions and start the AFP service for you, so that the share is immediately available. The new share will also be added as an entry to Sharing ‣ Apple (AFP).

Mac OS X users can connect to the guest AFP share by clicking Go ‣ Connect to Server. In the example shown in Figure 10.1c, the user has input afp:// followed by the IP address of the FreeNAS® system.

Click the “Connect” button. Once connected, Finder will automatically open. The name of the AFP share will be displayed in the SHARED section in the left frame and the contents of any data that has been saved in the share will be displayed in the right frame.

Figure 10.1c: Connect to Server Dialogue

_images/afp3.png

To disconnect from the volume, click the “eject” button in the “Shared” sidebar.

10.1.2. Creating Authenticated and Time Machine Shares

Mac OS X includes the Time Machine application which can be used to schedule automatic backups. In this configuration example, a Time Machine user will be configured to backup to an AFP share on a FreeNAS® system. It is recommended to create a separate Time Machine share for each user that will be using Time Machine to backup their Mac OS X system to FreeNAS®. The process for creating an authenticated share for a user is the same as creating a Time Machine share for that user.

To use the Wizard to create an authenticated or Time Machine share, enter the following information, as seen in the example in Figure 10.1d.

  1. Share name: input a name for the share that is useful to you but which is under 27 characters and does not contain a period. In this example, the share is named backup_user1.
  2. Click the button for “Mac OS X (AFP)” and check the box for “Time Machine”. If the user will not be using Time Machine, leave the box unchecked.
  3. Click the “Ownership” button. If the user already exists on the FreeNAS® system, click the drop-down “User” menu to select their user account. If the user does not yet exist on the FreeNAS® system, type their name into the “User” field and check the “Create User” checkbox. If you want the user to be a member of a group that already exists on the FreeNAS® system, click the drop-down “Group” menu to select the group name. If you wish to create a new group to be used by Time Machine users, input the name into the “Group” field and check the “Create Group” checkbox. Otherwise, input the same name as the user. In the example shown in Figure 10.1e, a new user named user1 will be created, as well as a new group named tm_backups. Since a new user is being created, this screen prompts for the password for the user to use when accessing the share. It also provides an opportunity to change the default permissions on the share. When finished, click “Return” to return to the screen shown in Figure 10.1d.
  4. Click the “Add” button. If you forget to do this, the share will not be created. Clicking the “Add” button will add an entry to the “Name” frame with the name that you typed into “Share name”.

If you wish to configure multiple authenticated or Time Machine shares, repeat for each user, giving each user their own “Share name” and “Ownership”. When finished, click the “Next” button twice, then the “Confirm” button to create the share(s). The Wizard will automatically create a dataset for each share that contains the correct ownership and start the AFP service for you, so that the share(s) are immediately available. The new share(s) will also be added as entries to Sharing ‣ Apple (AFP).

Figure 10.1d: Creating a Time Machine Share

_images/afp7.png

Figure 10.1e: Creating an Authenticated User

_images/afp8.png

At this point, it may be desirable to configure a quota for each Time Machine share, to restrict backups from using all of the available space on the FreeNAS® system. The first time Time Machine makes a backup, it will create a full backup after waiting two minutes. It will then create a one hour incremental backup for the next 24 hours, and then one backup each day, each week and each month. Since the oldest backups are deleted when a Time Machine share becomes full, make sure that the quota size you set is sufficient to hold the desired number of backups. Note that a default installation of Mac OS X is ~21 GB in size.

To configure a quota, go to Storage ‣ Volumes and highlight the entry for the share. In the example shown in Figure 10.1f, the Time Machine share name is backup_user1. Click the “Edit Options” button for the share, then “Advanced Mode”. Input a value in the “Quota for this dataset” field then click “Edit Dataset” to save the change. In this example, the Time Machine share is restricted to 200GB.

Figure 10.1f: Setting a Quota

_images/afp9a.png

To configure Time Machine on the Mac OS X client, go to System Preferences ‣ Time Machine which will open the screen shown in Figure 10.1g. Click “ON” and a pop-up menu should show the FreeNAS® system as a backup option. In our example, it is listed as backup_user1 on “freenas”. Highlight the entry representing the FreeNAS® system and click the “Use Backup Disk” button. A connection bar will open and will prompt for the user account’s password–in this example, the password that was set for the user1 account.

Figure 10.1g: Configuring Time Machine on Mac OS X Lion

_images/afp5.png

If you receive a “Time Machine could not complete the backup. The backup disk image could not be created (error 45)” error when backing up to the FreeNAS® system, you will need to create a sparsebundle image using these instructions.

If you receive the message “Time Machine completed a verification of your backups. To improve reliability, Time Machine must create a new backup for you.” and you do not want to perform another complete backup or lose past backups, follow the instructions in this post.

10.2. Unix (NFS) Shares

FreeNAS® supports sharing over the Network File System (NFS). Clients use the mount command to mount the share. Once mounted, the NFS share appears as just another directory on the client system. Some Linux distros require the installation of additional software in order to mount an NFS share. On Windows systems, enable Services for NFS in the Ultimate or Enterprise editions or install an NFS client application.

Note

for performance reasons, iSCSI is preferred to NFS shares when FreeNAS is installed on ESXi. If you are considering creating NFS shares on ESXi, read through the performance analysis at Running ZFS over NFS as a VMware Store.

To create an NFS share using the Wizard, click the “Next” button twice to display the screen shown in Figure 10.2a. Input a “Share name” that makes sense to you, but which does not contain a space. Click the button for “Generic Unix (NFS)”, then click “Add” so that the share’s name appears in the “Name” frame. When finished, click the “Next” button twice, then the “Confirm” button to create the share. Creating an NFS share using the wizard will automatically create a new dataset for the share, start the services required by NFS, and add an entry for the share in Sharing ‣ Unix (NFS) Shares. Depending upon your requirements, you may wish to fine-tune the NFS share to control which IP addresses are allowed to access the NFS share and to restrict the permissions of the mounted share.

Figure 10.2a: NFS Share Wizard

_images/nfs6.png

To edit the NFS share, click Sharing ‣ Unix (NFS), highlight the entry for the share, and click its “Edit” button. In the example shown in Figure 10.2b, the configuration screen is open for the nfs_share1 share.

Figure 10.2b: NFS Share Settings

_images/nfs2.png

Table 10.2a summarizes the available configuration options in this screen. Some settings are only available by clicking the “Advanced Mode” button.

Table 10.2a: NFS Share Options

Setting Value Description
Path browse button the path that clients will use when mounting the share; click “Add extra path” to select multiple paths
Comment string used to set the share name; if left empty, share name will be the list of selected “Path”s
Authorized networks string only available in “Advanced Mode”; space delimited list of allowed network addresses in the form 1.2.3.0/24 where the number after the slash is a CIDR mask
Authorized IP addresses or hosts string only available in “Advanced Mode”; space delimited list of allowed IP addresses or hostnames
All directories checkbox if checked, the client can mount any subdirectory within the “Path”
Read only checkbox prohibits writing to the share
Quiet checkbox only available in “Advanced Mode”; inhibits some syslog diagnostics which can be useful to avoid some annoying error messages; see exports(5) for examples
Maproot User drop-down menu only available in “Advanced Mode”; if a user is selected, the root user is limited to that user’s permissions
Maproot Group drop-down menu only available in “Advanced Mode”; if a group is selected, the root user will also be limited to that group’s permissions
Mapall User drop-down menu only available in “Advanced Mode”; the specified user’s permissions are used by all clients
Mapall Group drop-down menu only available in “Advanced Mode”; the specified group’s permission are used by all clients
Security selection only available in “Advanced Mode” and only appears if “Enable NFSv4” is checked in Services ‣ NFS; choices are sys or the following Kerberos options: krb5 (authentication only), krb5i (authentication and integrity), or krb5p (authentication and privacy); if multiple security mechanisms are added to the “Selected” column using the arrows, use the “Up” or “Down” buttons to list in order of preference

When creating the NFS share, keep the following points in mind:

  1. The “Maproot” and “Mapall” options are exclusive, meaning you can only use one or the other–the GUI will not let you use both. The “Mapall” options supersede the “Maproot” options. If you only wish to restrict the root user’s permissions, set the “Maproot” option. If you wish to restrict the permissions of all users, set the “Mapall” options.
  2. Each volume or dataset is considered to be its own filesystem and NFS is not able to cross filesystem boundaries.
  3. The network or host must be unique per share and per filesystem or directory.
  4. The “All directories” option can only be used once per share per filesystem.

To better understand these restrictions, consider the following scenario where there are:

  • 2 networks named 10.0.0.0/8 and 20.0.0.0/8
  • a ZFS volume named volume1 with 2 datasets named dataset1 and dataset2
  • dataset1 has a directory named directory1

Because of restriction #3, you will receive an error if you try to create one NFS share as follows:

  • “Authorized networks” set to 10.0.0.0/8 20.0.0.0/8
  • “Path” set to /mnt/volume1/dataset1 and /mnt/volume1/dataset1/directory1

Instead, you should select a “Path” of /mnt/volume1/dataset1 and check the “All directories” box.

However, you could restrict that directory to one of the networks by creating two shares as follows.

First NFS share:

  • “Authorized networks” set to 10.0.0.0/8
  • “Path” set to /mnt/volume1/dataset1

Second NFS share:

  • “Authorized networks” set to 20.0.0.0/8
  • “Path” set to /mnt/volume1/dataset1/directory1

Note that this requires the creation of two shares as it can not be accomplished in one share.

10.2.1. Example Configuration

By default the “Mapall” options show as N/A. This means that when a user connects to the NFS share, they connect with the permissions associated with their user account. This is a security risk if a user is able to connect as root as they will have complete access to the share.

A better scenario is to do the following:

  1. Specify the built-in nobody account to be used for NFS access.
  2. In the “Change Permissions” screen of the volume/dataset that is being shared, change the owner and group to nobody and set the permissions according to your specifications.
  3. Select nobody in the “Mapall User” and “Mapall Group” drop-down menus for the share in Sharing ‣ Unix (NFS) Shares.

With this configuration, it does not matter which user account connects to the NFS share, as it will be mapped to the nobody user account and will only have the permissions that you specified on the volume/dataset. For example, even if the root user is able to connect, it will not gain root access to the share.

10.2.2. Connecting to the Share

In the following examples, an NFS share on a FreeNAS® system with the IP address of 192.168.2.2 has been configured as follows:

  1. A ZFS volume named /mnt/data has its permissions set to the nobody user account and the nobody group.
  2. A NFS share has been created with the following attributes:
    • “Path”: /mnt/data
    • “Authorized Network”: 192.168.2.0/24
    • “MapAll User” and “MapAll Group” are both set to nobody
    • the “All Directories” checkbox has been checked

10.2.2.1. From BSD or Linux

To make this share accessible on a BSD or a Linux system, run the following command as the superuser (or with sudo) from the client system. Repeat on each client that needs access to the NFS share:

mount -t nfs 192.168.2.2:/mnt/data /mnt

The mount command uses the following options:

  • -t nfs: specifies the type of share.
  • 192.168.2.2: replace with the IP address of the FreeNAS® system
  • /mnt/data: replace with the name of the NFS share
  • /mnt: a mount point on the client system. This must be an existing, empty directory. The data in the NFS share will be made available to the client in this directory.

The mount command should return to the command prompt without any error messages, indicating that the share was successfully mounted.

Note

if this command fails on a Linux system, make sure that the nfs-utils package is installed.

Once mounted, this configuration allows users on the client system to copy files to and from /mnt (the mount point) and all files will be owned by nobody:nobody. Any changes to /mnt will be saved to the FreeNAS® system’s /mnt/data volume.

Should you wish to make any changes to the NFS share’s settings or wish to make the share inaccessible, first unmount the share on the client as the superuser:

umount /mnt

10.2.2.2. From Microsoft

Windows systems can connect to NFS shares using Services for NFS (refer to the documentation for your version of Windows for instructions on how to find, activate, and use this service) or a third-party NFS client.

Nekodrive provides an open source graphical NFS client. To use this client, you will need to install the following on the Windows system:

  • 7zip to extract the Nekodrive download files
  • NFSClient and NFSLibrary from the Nekodrive download page; once downloaded, extract these files using 7zip
  • .NET Framework 4.0

Once everything is installed, run the NFSClient executable to start the GUI client. In the example shown in Figure 10.2c, the user has connected to the example /mnt/data share of the FreeNAS® system at 192.168.2.2.

Note

Nekodrive does not support Explorer drive mapping via NFS. If you need this functionality, try this utility instead.

Figure 10.2c: Using the Nekodrive NFSClient from Windows 7 Home Edition

_images/nfs5.jpg

10.2.2.3. From Mac OS X

To mount the NFS volume from a Mac OS X client, click on Go ‣ Connect to Server. In the “Server Address” field, input nfs:// followed by the IP address of the FreeNAS® system and the name of the volume/dataset being shared by NFS. The example shown in Figure 10.2d continues with our example of 192.168.2.2:/mnt/data.

Once connected, Finder will automatically open. The IP address of the FreeNAS® system will be displayed in the SHARED section in the left frame and the contents of the share will be displayed in the right frame. In the example shown in Figure 10.2e, /mnt/data has one folder named images. The user can now copy files to and from the share.

Figure 10.2d: Mounting the NFS Share from Mac OS X

_images/nfs3.png

Figure 10.2e: Viewing the NFS Share in Finder

_images/nfs4.png

10.2.3. Troubleshooting NFS

Some NFS clients do not support the NLM (Network Lock Manager) protocol used by NFS. You will know that this is the case if the client receives an error that all or part of the file may be locked when a file transfer is attempted. To resolve this error, add the option -o nolock when running the mount command on the client in order to allow write access to the NFS share.

If you receive an error about a “time out giving up” when trying to mount the share from a Linux system, make sure that the portmapper service is running on the Linux client and start it if it is not. If portmapper is running and you still receive timeouts, force it to use TCP by including -o tcp in your mount command.

If you receive an error “RPC: Program not registered”, upgrade to the latest version of FreeNAS® and restart the NFS service after the upgrade in order to clear the NFS cache.

If your clients are receiving “reverse DNS” errors, add an entry for the IP address of the FreeNAS® system in the “Host name database” field of Network ‣ Global Configuration.

If the client receives timeout errors when trying to mount the share, add the IP address and hostname of the client to the “Host name data base” field of Network ‣ Global Configuration.

Some older versions of NFS clients default to UDP instead of TCP and do not auto-negotiate for TCP. By default, FreeNAS® uses TCP. To support UDP connections, go to Services ‣ NFS and check the box “Serve UDP NFS clients”.

10.3. WebDAV Shares

Beginning with FreeNAS® 9.3, WebDAV shares can be created so that authenticated users can browse the contents of the specified volume, dataset, or directory from a web browser.

Configuring WebDAV shares is a two step process. First, create the WebDAV share(s) to specify which data can be accessed. Then, configure the WebDAV service by specifying the port, authentication type, and authentication password. Once the configuration is complete, the share can be accessed using a URL in the format:

protocol://IP_address:port_number/share_name

where:

  • protocol: is either http or https, depending upon the “Protocol” configured in Services ‣ WebDAV.
  • IP address: is the IP address or hostname of the FreeNAS® system. Take care when configuring a public IP address to ensure that the network’s firewall only allows access to authorized systems.
  • port_number: is configured in Services ‣ WebDAV. If the FreeNAS® system is to be accessed using a public IP address, consider changing the default port number and ensure that the network’s firewall only allows access to authorized systems.
  • share_name: is configured in Sharing ‣ WebDAV Shares.

Inputting the URL into a web browser will bring up an authentication pop-up message. Input a username of webdav and the password configured in Services ‣ WebDAV.

Warning

at this time, only the webdav user is supported. For this reason, it is important to set a good password for this account and to only give the password to users which should have access to the WebDAV share.

To create a WebDAV share, click Sharing ‣ WebDAV Shares ‣ Add WebDAV Share which will open the screen shown in Figure 10.3a.

Figure 10.3a: Adding a WebDAV Share

_images/webdav.png

Table 10.3a summarizes the available options.

Table 10.3a: WebDAV Share Options

Setting Value Description
Share Path Name string input a name for the share
Comment string optional
Path browse button browse to the volume/dataset to share
Read Only checkbox if checked, users cannot write to the share
Change User & Group Ownership checkbox if checked, automatically sets the share’s contents to the webdav user and group

Once you click “OK”, a pop-up will ask if you would like to enable the service. Once the service starts, review the settings in Services ‣ WebDAV as they are used to determine which URL is used to access the WebDAV share and whether or not authentication is required to access the share. These settings are described in WebDAV.

10.4. Windows (CIFS) Shares

FreeNAS® uses Samba to share volumes using Microsoft’s CIFS protocol. CIFS is built into the Windows and Mac OS X operating systems and most Linux and BSD systems pre-install the Samba client in order to provide support for CIFS. If your distro did not, install the Samba client using your distro’s software repository.

The CIFS protocol supports many different types of configuration scenarios, ranging from the very simple to quite complex. The complexity of your scenario depends upon the types and versions of the client operating systems that will connect to the share, whether or not the network has a Windows server, and whether or not Active Directory is running in the Windows network. Depending upon your authentication requirements, you may need to create or import users and groups.

This chapter starts by summarizing the available configuration options. It will then demonstrate some common configuration scenarios as well as offer some troubleshooting tips. It is recommended to first read through this entire chapter before creating any CIFS shares so that you have a good idea of the best configuration scenario to meet your network’s needs.

Figure 10.4a shows the configuration screen that appears when you click Sharing ‣ Windows (CIFS Shares) ‣ Add Windows (CIFS) Share.

Figure 10.4a: Adding a CIFS Share

_images/cifs2.png

Table 10.4a summarizes the options when creating a CIFS share. Some settings are only available when you click the “Advanced Mode” button. For simple sharing scenarios, you will not need any “Advanced Mode” options. For more complex sharing scenarios, only change an “Advanced Mode” option if you understand the function of that option. smb.conf(5) provides more details for each configurable option.

Table 10.4a: Options for a CIFS Share

Setting Value Description
Path browse button select volume/dataset/directory to share
Use as home share checkbox check this box if the share is meant to hold user home directories; only one share can be the homes share
Name string mandatory; name of share
Comment string only available in “Advanced Mode”; optional description
Apply Default Permissions checkbox sets the ACLs to allow read/write for owner/group and read-only for others; should only be unchecked when creating a share on a system that already has custom ACLs set
Export Read Only checkbox only available in “Advanced Mode”; prohibits write access to the share
Browsable to Network Clients checkbox only available in “Advanced Mode”; when checked, users see the contents of /homes (including other users’ home directories) and when unchecked, users see only their own home directory
Export Recycle Bin checkbox only available in “Advanced Mode”; deleted files are instead moved to a hidden .recycle directory in the root folder of the share
Show Hidden Files checkbox only available in “Advanced Mode”; if enabled, will display filenames that begin with a dot (Unix hidden files)
Allow Guest Access checkbox if checked, no password is required to connect to the share and all users share the permissions of the guest user defined in the CIFS service
Only Allow Guest Access checkbox only available in “Advanced Mode”; requires “Allow guest access” to also be checked; forces guest access for all connections
Hosts Allow string only available in “Advanced Mode”; comma, space, or tab delimited list of allowed hostnames or IP addresses;
Hosts Deny string only available in “Advanced Mode”; comma, space, or tab delimited list of denied hostnames or IP addresses; allowed hosts take precedence so can use ALL in this field and specify allowed hosts in “Hosts Allow”
VFS Objects selection only available in “Advanced Mode” and adds virtual file system modules to enhance functionality; Table 10.4b summarizes the available modules
Periodic Snapshot Task drop-down menu used to configure home directory shadow copies on a per-share basis; select the pre-configured periodic snapshot task to use for the share’s shadow copies
Auxiliary Parameters string only available in “Advanced Mode”; additional smb4.conf parameters not covered by other option fields

Note the following regarding some of the “Advanced Mode” settings:

  • Hostname lookups add some time to accessing the CIFS share. If you only use IP addresses, uncheck the “Hostnames lookups” box in Services ‣ CIFS.
  • Be careful about unchecking the “Browsable to Network Clients” box. When this box is checked (the default), other users will see the names of every share that exists using Windows Explorer, but they will receive a permissions denied error message if they try to access someone else’s share. If this box is unchecked, even the owner of the share won’t see it or be able to create a drive mapping for the share in Windows Explorer. However, they can still access the share from the command line. Unchecking this option provides limited security and is not a substitute for proper permissions and password control.
  • If you wish some files on a shared volume to be hidden and inaccessible to users, put a veto files= line in the “Auxiliary Parameters” field. The syntax for the “veto files” option and some examples can be found here.

To configure support for OS/2 clients, add this line to “Auxiliary Parameters”:

lanman auth = yes

To configure lanman authentication for pre-NT authentication, add these lines instead:

client lanman auth = yes
 client plaintext auth = yes

Table 10.4b provides an overview of the available VFS modules. Be sure to research each module before adding or deleting it from the “Selected” column of the “VFS Objects” field for the share. Some modules will need additional configuration after they are added. Refer to Stackable VFS modules and the vfs_* man pages for more details.

Table 10.4b: Available VFS Modules

Value Description
acl_tdb stores NTFS ACLs in a tdb file in order to enable full mapping of Windows ACLs
acl_xattr stores NTFS ACLs in Extended Attributes (EAs) in order to enable the full mapping of Windows ACLs
aio_fork enables async I/O
aio_posix enables asynchronous I/O on systems running POSIX kernels
aio_pthread implements async I/O in Samba vfs using a pthread pool instead of the internal Posix AIO interface
audit logs share access, connects/disconnects, directory opens/creates/removes, and file opens/closes/renames/unlinks/chmods to syslog
cacheprime primes the kernel file data cache
cap translates filenames to and from the CAP encoding format, commonly used in Japanese language environments
catia creates filenames that use characters that are illegal in CIFS filenames
commit tracks the amount of data written to a file and synchronizes it to disk when a specified amount accumulates
crossrename allows server side rename operations even if source and target are on different physical devices
default_quota stores the default quotas that are reported to a windows client in the quota record of a user
dfs_samba4 distributed file system for providing an alternative name space, load balancing, and automatic failover
dirsort sorts directory entries alphabetically before sending them to the client
expand_msdfs enables support for Microsoft Distributed File System (DFS)
extd_audit sends “audit” logs to both syslog and the Samba log files
fake_acls stores file ownership and ACLs as extended attributes
fake_perms allows roaming profile files and directories to be set as read-only
full_audit records selected client operations to the system log
linux_xfs_sgid used to work around an old Linux XFS bug
media_harmony allows Avid editorial workstations to share a network drive
netatalk eases the co-existence of CIFS and AFP shares
notify_fam implements file change notifications from IRIX and some BSD systems to Windows clients
posix_eadb provides Extended Attributes (EAs) support so they can be used on filesystems which do not provide native support for EAs
preopen useful for video streaming applications that want to read one file per frame
readahead useful for Windows Vista clients reading data using Windows Explorer
readonly marks a share as read-only for all clients connecting within the configured time period
recycle moves deleted files to the recycle directory instead of deleting them
scannedonly ensures that only files that have been scanned for viruses are visible and accessible
shadow_copy allows Microsoft shadow copy clients to browse shadow copies on Windows shares
shadow_copy2 a more recent implementation of “shadow_copy” with some additonal features
shadow_copy_test shadow copy testing
skel_opaque implements dummy versions of all VFS modules (useful to VFS module developers)
skel_transparent implements dummy passthrough functions of all VFS modules (useful to VFS module developers)
smb_traffic_analyzer logs Samba read and write operations through a socket to a helper application
streams_depot experimental module to store alternate data streams in a central directory
streams_xattr enables storing of NTFS alternate data streams in the file system
syncops ensures metadata operations are performed synchronously
time_audit logs system calls that take longer than the number of defined milliseconds
xattr_tdb stores Extended Attributes (EAs) in a tdb file so they can be used on filesystems which do not provide support for EAs