Group Permissions not working in ToS 5?

[StephenNaylor]

I've just installed ToS 5 on a New NAS and I cannot get group permissions to work when mapping a drive to the Nas from a Windows 11 machine.
I am able to successfully map a drive if the NAS user has been given direct Read / Write permissions on the shared Folder.

I have 4 Drives configured in Raid 5 which have have moved from a failed F4-220 to a new F5-422
I have Initialisied the F5-422 after and then installed TOS 5.0.176
I then updated to 5.1.24 and now to 5.1.33

The behaviour I am reporting is the same in 5.12.24 where I first found it and 5.1.33.

My existing shared folders from the F4-220 still exist but none of my users and groups still exist
I create a new group, i.e. Mygroup
I give MyGroup Read/Write access to my shared folder, i.e. Photos This sits on "configuring" when I click apply and never seems to complete.
I create a new user: Bob
I add Bob to MyGroup.

By my understanding I should now be able to map a windows drive to Photos on my NAS by using Bob's username and password to connect. I get a permission error when I do this.

I then go back into the user settings for Bob and give the user (rather than the group) Read / Write on my Photos folder and I can then map to Photos. Before I make this change Bob was set to Deny on Photos.

Am I missing something in by group / folder / user setup or is this a bug ?

[StephenNaylor]

I should add that when I am using the group permissions that when I try to map to the share that I enter my NAS hostname and try to browse the NAS for folders to map to. I can see a list of all the shared folders on the NAS but if I click on any of them (other than public) then I get a permissions error.

[StephenNaylor]

I'm wondering if this might be being caused by the "All Users" group. I am not using this so it is set by default to "Deny" every user any access on all folders as per its default.

I am not able to remove my users from this group which does make sense but I would not expect this groups permissions to take precedence over the other group I have set up.

If that is the way it works then It would mean I would have to give the all users group the permission to read / write the folders I want to give some users access to. This would have the side effect of giving access to users that I don't want to have access to the group. I would then need to use another group to deny access to deny access again to the users that I don't want to have access.

Is anyone able to confirm is if this is how groups are supposed to be used in this version of the OS?

[StephenNaylor]

I think I might understand part of the issue with my system a bit better now. I found this statement..

"The TOS system starts with the following default groups:
admin: All members of this group are administrators, and so they have administrator permissions. This group cannot be deleted.
allusers: All users who are not administrators are members of this group. This group cannot be deleted."

This is from here: https://help.terra-master.com/TOS/view/ ... user_group

On my system my first user, i.e. my admin was added to both the Administrators and the All Users group.

[StephenNaylor]

I've just been looking at the properties of some of the sub-folders underneath my shared folders. Some of these are owned by my new admin user that was set up when I installed ToS 5.0.

A lot of the sub-folders are owned by "mail" and "synch". These are not users that show in the users table in ToS and are not users that I set up on ToS 4 or 5.

If these users are not real users then I assume this will be causing all sorts of permission issues.

Does anyone know how to update the ownership of all the sub-folders from within ToS?

[TMroy]

I've just been looking at the properties of some of the sub-folders underneath my shared folders. Some of these are owned by my new admin user that was set up when I installed ToS 5.0.

A lot of the sub-folders are owned by "mail" and "synch". These are not users that show in the users table in ToS and are not users that I set up on ToS 4 or 5.

If these users are not real users then I assume this will be causing all sorts of permission issues.

Does anyone know how to update the ownership of all the sub-folders from within ToS?

Go to Control panel > shared folder, edit the shared folder, and check "Replace the permissions for all subdirectories with the permissions of this folder", then click Apple.

[StephenNaylor]

Thanks. I'll give that a go but my experience with trying to set user permissions on this OS is not good. The screen just sits on "Configuring" and then either says it has failed, says it has succeeded (but if I refresh nothing has changed) or it sits there so long that the web logon expires.

Whilst I wait I have some follow-up questions on this....

If I haven't set up a "mail" or "sync" user then how have they got ownership of my folders?

Are these users supposed to be on my system, i.e. are they created by ToS ? I'm guessing that they are some sort of service /function account created by the OS but it would be good to understand this for security reasons.

if a "mail" or "sync" users do exist on ToS 5.1 then why am I not seeing them in the users list in the OS? Should I be able to see them under "Users".

If these are legacy users from before I reset my ToS 4 and re-intialised on ToS 5.0 and upgraded to ToS 5.1 then it implies that when I re-initialised the system to version 5.0 that something went wrong with updating the ownership of all the existing files on the volume. I am assuming that when the system is re-initialised that all existing file and folder permissions would have to start off being reset so that they are owned by the admin user that is created when installing the OS. My logic here is that this has to happen because the admin is the only user that exists at that point.

Alternately if "mail" and "sync" are ToS 5.0 / 5.1 users then I still don't understand any scenario where it would be valid to give them ownership of my data.

Just to summarise this thread so far. I think I have the following permission issues after my ToS 4 to 5.1 move at this point...

1. My default admin user has been added to the All Users Group. ("All Users" should not include admins).
2. I suspect there is an issue around a flag that you now put on Shared Folders to indicate that they are managed by "User Group". Either that flag did not exist in ToS 4 or if it did exist in Tos 4 it has been lost / reset when my data has come across from ToS 4. End result is that folders that I used to manage by User Group are ignoring User Group permissions and only using User Permissions.
3. Ownership of files and folders that have come across from ToS 4 are wrong.
4. There seem to be users setup on my system which I cannot see in ToS so I cannot manage them or see what access they have to my files.


I'm currently moving all my data off my F5-422 so that I can start fresh on a clean 5.1 install (assuming I don't just buy a different make of NAS!). I'm posting these observations in case they help you debug the OS or in case they can help anyone else with their own diagnostics as lots of people are reporting permissions type issues on these forums.

[TMroy]

TOS system updating does not modify your folder/file property including permissions. But the superuser can access all folders or files.

To give you an idea, assuming there are 1 million files and folders on your hard disk, it is estimated that it will take hours to replace the permissions of these files and folders.

[StephenNaylor]

You said that system updating "does not modify your folder/file property including permissions". That make sense for an update. Going from version 5.1.24 to version 5.1.33 does not destroy your users / user groups....

.....but as I remember it, re-initialising your system does destroy your existing users and groups so that response seems to be missing the main point where I think permissions could go wrong.

To give an example scenario to try to understand this better.

On ToS 4:
My user: OldNasUser on ToS 4 created a folder, "MyOldFolder"
R/W permissions on that folder are set by a group, "MyRWGroup"
"OldNasUser" has access has r/w rights on "MyOldFolder" through "MyRWGroup".
"MyRWGroup" is the only group which has access to that folder.

When I reset (initialise) the NAS and install ToS 5.0 my understanding is that:

My data: "MyOldFolder" is still there
My User: "OldNasUser" is gone.
My group, "MyRWGroup" is gone.
The files in MyOldFolder are now owned by a non-existent (In ToS 5) user and there are no users / groups in the system that have any permission on these files.

There are a million files in MyOldFolder. With regards to the permissions on those files what happens next and how long does it take?

My thinking is that the OS would have to set new permissions on all 1 Million files which as you say would take hours. If so, then after starting ToS 5 for the first time that should be happening either before I can log on or in the background.

I don't recall anything like that happening.

.. and none of this explains why "mail" and "sync" users have ownership of my data in ToS 5.1.

Happy to be corrected if i've misunderstood any of the above. Are you able to help me understand what is going on here a bit better?