2

This is for FreeNas-9.1.1, I am using active directory which appears to be connecting ok, since the following list users/groups from that server with no problems

wbinfo -u
wbinfo -g

I can also join to ads with an authorized user

net ads join -U myusername

I can also connect to a server when that user is set as the owner of the share. However when i look at users under Account -> User -> View Users none are listed. More problematically, when I try to add members to a group, only the local users are shown. I am thinking there may be a problem with the AD list being saved to the internal FreeNAS directory, but I am not sure how to troubleshoot this. I need group level permissions because the way it is configured now, only the owner has permission to read/write any shared files. Any advice would be much appreciated.

  • Why would you be trying to use the local user/group management on the freenas host if you are a member of a domain? Put users in groups in the Active Directory, then reference the AD groups in your share and filesystem permissions. – Zoredache Oct 8 '13 at 19:25
  • I have no local users, I am trying to use AD users/groups which are not syncing. If there is a way to make groups on AD and place users in them, and then have that show up in the FreeNAS GUI that would work too, I'm just not sure how to do that. – Dave Oct 9 '13 at 13:12
1

please be aware that local groups and Active directory groups are different.
Local groups/users only make sense if you don't have a directory in your organization.

In my scenarios, I manage ALL the groups in Active Directory, that is, user creation, group creation and group membership (who is a member), as the organization users exist in there.

To setup/modify permission for the volume on FreeNas, go to Volumes -> /mnt/desiredvolume -> Change Permissions.

You will have to select the owner and the group as usual, just make sure they are your active directory user and group and grant the read/write permissions for both of them.

Also make sure you are providing permissions type="Windows" instead of Unix ones. if you are to update existing permissions, also tick the "set permissions recursively"

Hope it helps.

1

Alternative management from Windows:

You could also manage them the other way round, from your Windows machines:

  1. Install RSAT (remote server administration tools) for your client Windows operating system and use it to create/change users, groups and group memberships
  2. Create a new share on the FreeNAS machine with full permissions for one of your domain administrator accounts (if you cannot do that, your AD sync might not be working correctly).
  3. Log in on a client with this admin account, open the new share, right-click in Explorer and open the Permissions & Security tab. You should now be able to set your permissions for your existing AD groups.

Advantages of this approach:

  • You can do it without granting access to the whole FreeNAS GUI, separately for each share. This way, you can separate hardware administration (FreeNAS GUI) and domain administration (Windows).
  • It is transparent to the user, your FreeNAS system looks and acts the same way as a Windows Server file server.
  • It works even if FreeNAS cannot list/display the users/groups or let you administer them. All you need is a mapping between root and domain admins, a mapping between generic users and a mapping between generic groups (at least this is how it is done on Solaris, I assume FreeNAS does it similarly).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.