Hiding SMB shares from users with no permissions.

[PabloUserT38]

Is it possible to hide SMB share in Windows Explorer from showing to users of a Windows domain that have no permissions to enter the folders?

It's not terrible if it's not possible, but it would be nice.

 

[anodos]

Yes, but it needs to be done through the share (not filesystem) ACL and you need to use the "Access-Based Share Enumeration" checkbox.

 

[PabloUserT38]

Thanks Anodos. I can find the "Access-Based Share Enumeration" checkbox but it's "greyed out". Do I have to check it during the creation of the share and isn't possible to do it after?

 

[anodos]

Thanks Anodos. I can find the "Access-Based Share Enumeration" checkbox but it's "greyed out". Do I have to check it during the creation of the share and isn't possible to do it after?

No. It just means you need to change "purpose" to "no presets", which will unlock all the share options.

 

[PabloUserT38]

Duh! Of course. Too little sleep...

I checked it, but I still see the shares listed on Windows for every user. Maybe it needs some time to settle?

 

[anodos]

Duh! Of course. Too little sleep...

I checked it, but I still see the shares listed on Windows for every user. Maybe it needs some time to settle?

There are two different types of permissions on an SMB share:
Filesystem Permissions: these are your ZFS ACLs that you can see with getfacl / setfacl, and apply to all processes on server. On Windows these are NTFS ACLs.
Share Permissions: these are ACLs that are on your share itself. They are stored within samba's share_info.tdb file. I haven't looked at how these are stored on Windows, but they are share-specific.

The reason why there are two different types of permissions is that, historically, not all filesystems have supported permissions, and if you are exposing a filesystem over the network, you must somehow control access to it.

"Access Based Share Enumeration" uses the Share permissions. These are modifiable via the "three-dot" menu next to your SMB share.

 

[truefriend-cz]

I set

Yes, but it needs to be done through the share (not filesystem) ACL and you need to use the "Access-Based Share Enumeration" checkbox.

I am set "Access-Based Share Enumeration" to enable but Shares to other users stayed.
Do you can write step-by-step how i can settings for this? From default config after created two users and create datasets:
1. /tank/dataset-1/video/
2. /tank/dataset-1/video/avi/

 

[profwalken]

I have the same request, to hide shared folders on Windows 10 PC, from those who have no rights to go in.
All my shares are set SMB on TN13.
Did you get the expected result?

I did the setting change on SMB to enable the "Access-Based Share Enumeration" checkbox, but with no change on windows 10 pro machines.

 

[impestrator]

Hello everyone,
after switching from Truenas Core to Scale about 2 weeks ago, I have to revisit this topic. During the migration, I lost the SMB permissions for some shares. Among other things, I have a share with several subfolders. User A is allowed to see and access all subfolders, User B is only allowed to see user folders to which he also has read permissions.

I have read some threads here, so I tried:
- I have set

Code:

hide unreadable

= yes in smb.conf for the corresponding share.
- I have activated

Code:

Share Access Based Share Enumeration

within Truenas.

Nothing helps. Every time I set the NTFS permission according to my requirements, User B still sees the subfolders in the share, but cannot browse within because he does not havethe read permission. But he even should not see that folder!

I have read that this should be set in the share permissions. But within Truenas I can only set permissions on a share, not on the subfolders,

Help appriciate :-D
Regards
Martin

 

[homer27081990]

See here.

 

[impestrator]

Hi Homer,

thanks for link, but I could not find a solution to hide just subfolders within a share for users without read access. Could you help?

Regards

 

[homer27081990]

Hi Homer,

thanks for link, but I could not find a solution to hide just subfolders within a share for users without read access. Could you help?

Regards

I am sorry I did not elaborate, I was pretty tired at the time, to be honest. I think I now found it (but you would have to try, I have CORE TN).

 

[Congles]

Did you ever get this working?

I'm having the same problems at the moment.