Hello wizards,
I followed the documentation on adding Private SMB Datasets and Shares, but have run into two instances of janky behavior. It works, but smells fishy, or maybe in this case, eely, so I’m afraid to start loading it up with data until I understand what’s happening.
Running TrueNAS ElectricEel-24.10.1
1) Private directories are not shown on the datasets pane, but are when editing User Directories and Permissions
I’ve ran through the document and created home directories for 4 users, and it works as expected over the network, with each user having access to their own private directory. However, the directory folders do not appear on the datasets pane on Truenas:
but they do appear when you view the directories and permissions when editting a User (Credentials - Users - Edit):
I noticed this when trying to add an additional encrypted dataset under the user directory, for users to store more sensitive files, but since I couldn’t access the directories from the datasets pane, I was prevented from doing this. Further testing led me to issue #2.
2) Truenas will automatically create datasets under the private dataset for any user who clicks on the dataset, even if they don’t have access
I I created a test user (ttester) that I didn’t set up with a home directory. However, I noticed that the behavior from the windows file explorer behaved exactly the same as the user accounts that I had configured with a home directory. The test had access to it’s own private directory without an issue, and the other users didn’t have access to the test account’s private directory.
Turns out, TrueNAS was automatically creating a private directory for the test account, or rather in this case, a dataset, which is viewable in the Datasets pane:
This is both desired and undesired behavior:
- Desired, because now I can see the dataset and add nested encrypted datasets to the private dataset
- Undesired, because I don’t want random users to be able to create their own private datasets without permission, and it’s also not behaving like the documented private shares do.
But easy fix, just change who’s allowed to traverse the private dataset from everyone@ to the family group all four users are a part of:
(Note: just learned that I should change owner@ and group@ to truenas-admin and truenas-admin, will do that)
And it appears to work, the test user (ttester) doesn’t have access to the private share anymore… However, even though ttester can’t access the share, Truenas will still create a private dataset for it whenever I click on the shared directory in the windows explorer; access denied notification appears, but ttester dataset is still created. I’m not sure how to prevent this from occurring at this point.
One guess I have is that this is a bug related to the “export Recycle Bin” option, as Truenas automatically creates this subdirectory in every users private folder. I turned this option on as suggested by the documentation.
Another interesting note, the behavior of a multi-user time machine share is like ttester, and not like that of the users configured with home directories. The multi-user time machine share automatically creates private dataset for the user when the user clicks on the share in the Windows File Explorer:
This makes me wonder if the ttester behavior is actually the correct and intended behavior for private shares.
Any thoughts about why this behavior is occurring would be greatly appreciated! I know I must be making a configuration error somewhere, but am not sure where.
Some other info about the configuration:
The “shares” parent dataset was created with the generic preset. Both the private and shared_storage datasets nested under it were created with the SMB preset (these are the actual shared datasets). The shared_storage works as expected this way, but please tell me if I made a mistake and should’ve configured the “shares” dataset as SMB as well. I borrowed this structure from the documentation.