Source
r/truenas•
coldspudd

Truenas to replace windows file server

SCALE

In the upcoming months we are needing to upgrade our windows file server. I currently have a another server with Truenas as a syncthing destination for warm spare recovery. Now I have read through and watched several different videos on setup up Truenas in a windows environment. And I’m a little confused at this point. I want to be able to reproduce the AD file permissions and user access on a Truenas server without making 315 user accounts. Not to mention we have Group Policy automatically mapping certain network drives for users. I’m hoping the Truenas community can help direct me to the info I need. Thanks.

Posted Sep 10, 2023, 2:37 PM UTC

17
furay20•

Ok? So join it to the domain, copy over the metadata using robocopy, etc.

1
gavindi•

As long as you've created your shares (with ACL) and hooked Truenas into AD, you should be peachy. :)

1
aanerud•

This. I am doing it myself in various locations.

1
IAmDotorg•

One key thing if you're replacing a Windows-based server with any Unix-derived one -- Linux's ACL support is lagging quite a bit, so if you're using anything more than the absolute most basic ACLs, you need to be on a system that supports NFSv4 ACLs, not just POSIX. That means, relative to TrueNAS, you have to be on Core, not Scale. Core supports NFSv4, both at the ZFS level and in Samba, so you can reproduce anything in your current ACL sets. (NFSv4 is derived from the NTFS ACL mechanisms, so it's a superset.)

If, for some reason in a commercial environment, you want to lump VMs and/or containers onto your fileserver (why?), which is the only benefit to Scale over Core, just do what most people do and run Core in Proxmox, and use Proxmox to handle the hypervisor management. Then you get (better) VM support, can install anything you want for managing containers, and are running FreeBSD not Linux, so you have NFSv4. Best of every world.

You can join Core to AD, so you'll have all your users, SID-based ACL definitions, AD groups, etc...

https://www.truenas.com/docs/core/coretutorials/directoryservices/activedirectory/#:~:text=The%20Active%20Directory%20%28AD%29%20service%20shares%20resources%20in,in%20local%20ACLs%20are%20accessible%20after%20joining%20AD.

1
coldspuddOP•

Thanks for the explanation. I will definitely look into that.

1
Anticept•

They have it wrong, truenas scale has nfsv4 support.

1
Anticept•

This is not an issue on TrueNAS scale. It has full NFSv4 support on ZFS.

https://www.truenas.com/docs/references/aclprimer/

1
IAmDotorg•

Huh, intresting. Both OpenZFS and the Linux kernel both have open (not closed) work items tracking getting NFSv4 support into Linux.

Both of those groups would probably like to know how they got it working when it requires support in both.

1
Anticept•

ACLs are mapped in extended attributes, and there are tools for managing those on the host OS in every major distro for some time. Samba supports this as well.

Also, the samba website has a lot of ancient, very outdated information on it, some of it hasn't changed since the new millennium so it's not a good resource for looking up what CURRENT capabilities are.

The main issue that you will run into is that if you try to use NFSv4 ACLs on the linux host... they're not necessarily going to be obeyed. But if it's a fileserver exposed via CIFS, it works just fine.

1
IAmDotorg•

Ah that makes more sense -- its hacked on. That does mean you lose the security settings at the filesystem level for other things accessing them that aren't enforcing them.

I switched off Unraid because their security was implemented purely at the sharing level, meaning there was effectively none in the case of a compromise. (Admittedly they were worse, because they require eveything to be 777 and owned by a single uid/gid, which is insane.)

I suppose that's a trade-off, but in an enterprise environment (which OP was implying they were in), I wouldn't make that trade off, when there are proper tools.

1
djsensui•

Not to hijack the post. I’ve done this previously (moving windows file server to truenas). One of the issues i’ve encountered is the cases. Ex. When my folders is all in capitals , it will show as small in the share. We have our own naming convention so i cannot recreate it one is to one.

1
coldspuddOP•

Good insight there. I’ll keep that in mind when we go to test later.

1
Anticept•

There is a setting on datasets to make them case insensitive.

1
Anticept•

This is a strange behavior and not what I experienced. Something odd is going on with your system.

1
Anticept•

Using truenas scale in an on prem AD environment.

A few things to be cautious about. It's very easy to get the ad connector stuck in a weird state when you make any changes to certain configurations. Make sure you disable the active directory connection when you update the system or change configuration settings to vdevs or major networking changes (especially anything dealing with bridges, those will require a reboot). Reenable after you have finished.

Permissions on datasets or adding or removing datasets and most other settings doesn't break the ad connector.

Be aware that the traverse property is handled differently in linux. If you want to make sure that people can traverse parent directories that they don't have read permissions on, give their group, or everyone, the traverse permission on the share, which will set a couple flags. THIS WILL BE THE MOST PAINFUL PART OF ADOPTING TRUENAS IF YOU HAVE COMPLEX ACLs WHEN MIGRATING FROM WINDOWS.

1