Multithreaded Solaris/Illumos SMB server with NFS4 ACL and Windows SID

Notice: Page may contain affiliate links for which we may earn a small commission through services like Amazon Affiliates or Skimlinks.

gea

Well-Known Member
Dec 31, 2010
3,184
1,200
113
DE
ZFS
Solaris Unix is the origin of ZFS and still offers the best integration into the OS with the lowest resource needs for ZFS. While on Linux ZFS is just another filesystem among many others, Sun developped OpenSolaris together and ontop of ZFS as the primary filesystem (Oracle Solaris 11.4 and Illumos/OI/OmniOS are descendents) with many advanced features like Drace, Service Management or Container based VMs. All of these features and ideas found their way into BSD or Linux without the deep integration of NFS or SMB into ZFS. Especially the multithreaded SMB server that is part of Solaris based systems is the most common reason to use this Unix.

SMB and ACL
The most important use case of storage is SMB, the file sharing protocol from MicroSoft that introduced superiour fine granular ACL permissions with inheritance into their ntfs filesystem and SMB shares. While traditional Linux/Unix permissions or Posix ACL only offer simple read/write/execute based on a user id like 101, ntfs ACL added additional permissions to create/extend files or folders, modify or read attributes or take ownersip based on a unique id like S-1-5-21-3623811015-3361044348-30300820-1013

NFS4 permissions
The kernelbased Solaris/Illumos SMB server is the only one that fully integrates NFS4 ACL (a superset of Windows ntfs ACL, Posix ACL and simple Unix permissions) with Windows SID (owner/user reference) as a ZFS attribute despite the Unix ZFS filesystem that normally only accepts Unix uid/gid as a user/owner reference. Main adventage is that you can move/restore a ZFS filesystem with all Windows permissions intact. When you use SAMBA instead that relies only on Unix uid/gid, you must use complicated id mappings to assign a Unix uid to a Windows SID that differ from server to server.


SMB groups
The kernelbased Solaris/Illumos SMB server is the only one that offers additional local SMB groups. Unlike Unix groups Windows alike SMB groups allow groups in groups in ACL settings. The group id is a Windows SID just like a user id.

Windows previous versions
The kernelbased Solaris/Illumos SMB server is the only one with a strict relation of a ZFS filesystem and a share. This is important when you want to use ZFS snaps as Windows "Previous Versions". As ZFS snaps are assigned to a filesystem, it can be quite confusing when you use SAMBA instead. As SAMBA only sees datafolders and knows nothing about ZFS, you must carefully configure and organize your shares to have this working especially with nested ZFS filesystems while on Solaris "previous Versions" just works without any settings.

Setup
In general the Solaris/Illumos SMB server is much simpler to configure and setup than SAMBA that is an option on Solaris too. No smb.conf with server settings, just set smbshare of a ZFS filesystem to on. SMB server behaviours can be set or shown with the admin tool smbadm, smbadm - man pages section 1M: System Administration Commands or are ZFS properties like aclmode, aclinherit or are NFS4 file or share ACL in general.

Multithreaded
While the singlethreaded SAMBA wants best singlecore CPU performance, the kernelbased SMB server is more optimized for multicore CPUs and mmany parallel requests.

Cons
The kernelbased SMB server has less options than SAMBA and it supports Windows AD member mode only (out of the box).
 
Last edited:

gea

Well-Known Member
Dec 31, 2010
3,184
1,200
113
DE
There are many new SMB server features and fixes - not least because of needed recent security concerns and bugs.
If you want to know whats going on with the free Illumos kernelbased SMB server, check


You can switch to "open tickets" to list only open issues.
 

gea

Well-Known Member
Dec 31, 2010
3,184
1,200
113
DE
Many Linux/Unix NAS systems are based on the SMB server SAMBA. To configure SAMBA you must edit the text file smb.conf,

You can use SAMBA on Solaris but mostly you use the much easier Solaris included SMB server.
Main differences to SAMBA based SMB sharing that you should know when you switch from SAMBA

- A SMB share (and ZFS snaps as previous versions) is a strict property of a ZFS filesystem.
The Solaris SMB server is part of the OS and ZFS and always knows ZFS properties and snap locations /filesystem/.zfs/snapshot
To SMB share a filesystem: zfs set sharesmb=on pool/filesystem (thats all, no additional settings)
SAMBA can share any (regular) folder. You must care about ZFS related settings like ZFS snap locations or nested ZFS properties.

- Local SMB groups (SAMBA only knows Unix groups not SMB groups with unique SID references that can contain other SMB groups)
- Fine granular NFS4 ACL (Windows ntfs alike with ACL inheritance on folders) instead simple Posix ACL with only read/write/execute
- SMB configuration is done via the admin tool smbadm

- Passwordless anonymous guest access requires that you
create a user guest, enable anonymous login via 'smbadm enable-user guest' and allow guest access when you share a filesystem via zfs set.

- SMB Share properties are either stored in ZFS (ACL, owner, SID, aclinherit, aclmode) or defined when you share a filesystem
via zfs set share command SMB Share Properties - Managing SMB File Sharing and Windows Interoperability in Oracle Solaris 11.2
(Share commands in newest Solaris 11.4 are a little different to OmniOS)

or via sharemanager, illumos: manual page: sharemgr.8

more,
 
Last edited: