[Samba] Share Permissions vs. Security

[Rowland penny]

On 06/02/2021 02:56, Marco Shmerykowsky via samba wrote:
>
>
>
> On 2/5/2021 10:23 AM, Stephen Atkins wrote:
>> On 2/4/2021 3:15 PM, Marco Shmerykowsky via samba wrote:
>>> Under "Setting up a Share Using Windows ACL's" in the
>>> Sambawiki it states "You should only need to makes changes
>>> to the Security Tab" and that the "Share Permissions
>>> Tab should be set to Everyone:Full-Control,Change,Read.
>>>
>>> On my previous setup I had set the "Share Permissions"
>>> to the MS Security Group that was allowed access to
>>> the share.  Everything seemed to work.
>>>
>>> Can someone explain the difference between the two
>>> settings?
>>>
>>
>> This is something I've been curious about also.  Really wish Windows 
>> security settings where as easy as Linux was.
>>
>
> From what I've read today, I'm gathering that the
> Security Tab allows for more nuanced settings with
> respect to the permissions.  Further it provides
> "local" and "network" based settings/restictions
>
> I guess a tangential question is whether there is a technical
> reason for why the Sambawiki recommends setting the share
> permissions to "Everyone:Full-Control,Change,Read"
>
> It would seem if 1) you restricted a share to a single
> security group, 2) there was never an intent to create
> a "sub-share" and 3) there is effectively no "local"
> access, then setting the "Share Permission"
> would seem equally acceptable.
>
The answer is quite simple, if a user changes the share tab, they then 
start posting to this list because they cannot change the permissions on 
the security tab.

You may be technically correct, but for ease of use, we will stick to 
telling everyone to basically ignore the share tab.

Rowland