macOS Mojave with server 5.7.1file sharing Group permissions problem :-(

hi

i have macOS Mojave with server 5.7.1 on Mac pro(Late 2013).

I'm running an updated server for the latest version.

To my question I did not find an answer through Google ...


I do several tests before moving the server to work.

The test on the server is performed from several computers, mainly from operating system 10.12.


I set up 3 users (A + B + C) and 2 groups (E + F) to check permissions Unfortunately permissions do not work properly.

And there seems to be a problem with the ACL and the permissions do not pass automatically.

The entrance was examined in two situations: AFP + SMB.


for example:

When User A logs on to the server and builds a folder / file, checking permissions on the file from the server is saved to User A and not to the Group Name (Group E).

Group: wheel - Permission: read only

All: everyone - permission: read only.


When user B enters the server and builds a folder / file, checking permissions on the file from the server is saved to user name B and not to the group name (group E).

Group: wheel - Permission: read only

All: everyone - permission: read only.



Arrange permissions through: System Prepernces / File Sharing and manual permissions changes: Apple Premissions to Enclosed Items.

Everything works out ... until the next user change.


I would be happy for help an experienced server user


Best regards

Benny

MacBook Air, macOS Sierra (10.12.6), Macintosh Plus,PB 400Hhz black, PB 867, iMac G3, OSX Server5

Posted on Oct 8, 2018 9:18 AM

Reply
Question marked as Top-ranking reply

Posted on Jan 15, 2019 7:35 PM

Hey guys I found this related information from high sierra server that helped me and it appears to work for keeping inherited permissions.


Firstly enable ACL permissions for SMB shares with the following command.



Sharing modification via terminal to engage ACLs



sudo defaults write /Library/Preferences/SystemConfiguration/com.apple.smb.server AclsEnabled -bool YES


Then set up inheritance permissions on the parent holder with the following command. This should recursively go through your share and apply the relevant permissions.



sudo chmod -R +a "group:REPLACE_WITH_YOURGROUP_NAME:allow readattr,writeattr,readextattr,writeextattr,readsecurity,list,search,add_file,add_subdirectory,delete_child,file_inherit,directory_inherit" REPLACE_WITH_PATH_TO_PARENT_SHARED_FOLDER

118 replies

Feb 11, 2019 5:42 PM in response to jcgomez95

We use the command to configure the SHARE (a.k.a. shared folder) so that everything inside that share will always inherit the permissions you set for that share.


If we did not do this, a user (Susan) could create a folder inside the share that another user (Tom) could not open. But because we did this, all users can access all files and folders, regardless of who created it.

Mar 26, 2019 7:09 AM in response to Benny2g

I agree with the comments in this forum.. We are a school district that has been running a mac server for years and now the new mac sever 5.7.1 is worthless.. Don't see software update caching and ACL is gone. I don't understand what apple is thinking? Now we have to use 3rd party software to manage ACL that was working just fine before. I have been a mac guy since the Apple lle and I am sorely disappointed...

Mar 26, 2019 7:23 AM in response to hineswhim

Just noticed a rather obscure menu - if you right-click on a share name in the Sharing control panel, you can apply permissions to enclosed items. I don't know if this applies ACL and inheritance or not. does it? could this be the hidden option we've been searching for since 10.14 was released?? or is it the same as get-info a folder and apply to enclosed items (which does not apply inheritance).


Oh, hineswhim, I believe "content caching" = software update caching, plus iTunes media caching.


May 23, 2019 11:02 AM in response to ddssgg

Well selecting the permissions I went through all permissions so that all were green.


I also propogated them, I did try the explicit in one of my attempts but wasn't sure what it was doing to be honest.


I have found later today that creating a new folder, copying over existing folders and propagating again, it then does allow new folders to be made inside existing folders and works.


I'll be testing further tomorrow

May 23, 2019 12:31 PM in response to carlsb

I have had the exact same problem, running 10.14 on two different Mac mini's sharing a folder living on an external SSD via SMB. If a remote user creates a folder or copies and pastes an existing folder in the shared folder, they are unable to delete it.


Yesterday, after updating to 10.14.5, smb sharing seems to go haywire. Remote user machine finder would freeze when trying to copy and paste files. At one point the mini sharing the folder was unable to turn off file sharing and sharing preferences became inaccessible.


I also spent several hours on the phone with Apple support with no solution for the inability of users to delete folders.



May 25, 2019 11:10 AM in response to tarteauxpommes

I am not the OD expert at my work, but this sounds like an issue I faced recently. I made the mistake of upgrading a 10.10 server running OD to 10.13 without doing the intermediate step of upgrading to 10.11 first.


If you do this, there is a hack (that I won't tell you about) that will allow you to get most of the settings from the original Server setup to carry over from 10.10. to 10.12+. But, just never do this when OD is involved.


The senior tech and I spent hours trying to fix the OD users as authentication would work for some users and not others. Ultimately, we started from scratch. There were seven users and straightforward file permissions. If there is one hard lesson I have learned over the years, it's that rebuilding a server from a fresh install always yields a better result than hammering on an issue with no known fix.


In serverville, it's also recommended to have a fresh install anyway. Yes, I know that upgrades and migrations often work just fine (I have done literally thousands), but if the setup is mission critical, then isn't it worth it?


Also, I would advise against using an Apple ID for an administrator account. I have seen too many iCloud/local user glitches that turned ugly. My guess is that this Apple ID login-as-local user was created for people were too confused by having both an Apple ID AND a local user account AND were prone to forgetting their passwords. It's a layer of complexity you don't need.


Lastly, not being able to delete folders in Sharing is something I have seen a few places too. I remember that some restarts, turning off and on services, and generally fiddling allowed me to finally remove those folders. (Another reason why deploying a new Apple file server in 2019 is NOT a good idea. Removing a folder from a file share is a fundamental process that should work consistently.)


Good luck.

Oct 14, 2018 12:12 PM in response to MrHoffman

Hi MrHoffman

Thanks for the reply.


unfortunately transfer to NAS is not an option.

Since there are Promise storage units, which were purchased with quite a bit of money that were not considered in upgrading the system.

Unfortunately my experience with NAS units from a number of companies was difficult and disappointing.


Question: Is ACL supported in moving the service to their system?

Maybe there are terminal commands for a fix I can run?


Thanks for the pdf file.


More ideas?


Best regards

Benny

Dec 5, 2018 8:21 AM in response to Sad_MAC_user

I also run a small design company and are in the same position.


What Apple is doing with their so called ‘os upgrades’ simply doesn’t make sense.


It’s basically telling us that ‘Mac computers should only be used by sole traders running one-man offices’


If you have more than one staff, there’s no way to operate your business in a Mac environment with the latest OS.


I miss the time when I was a student, and Apple catered for the enterprise market. I looked forward to one day having my office where I would run it on xserve, Xsan and Mac OS server.


Sadly, somewhere along the way, profit margins of selling smart phones became too great for Apple.


Apple

got so distracted by smart phones that they forgot, first and foremost, Apple is a computer business. It’s sad but they have lost their way and this haven’t made any progress on the computer front (especially for pro users).


Apple, please don’t lose sight of the importance of your computer business- It is the core that your business laid it’s foudstikns upon. Your founder intended to make great computers for the masses.


One day, when we all move on from smart phones, you don’t want to regret having lost the market on premium computers. Your Pro and Enterprise customers are waiting for you to do the right thing by them and their loyalty.x

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

macOS Mojave with server 5.7.1file sharing Group permissions problem :-(

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.