samba - Jul 2023 - Migration of files with Windows ACL's to Samba server

On Thu, Jul 20, 2023 at 7:08?AM Borut Rozman via samba
<samba at lists.samba.org> wrote:
>
> Hi there,
>
> It might that this question was already answered but I can't really
> find any proper documentation for this.
>
> I am in a process of migrating about 70T of files from our Win2016
> storage server to a Samba (2:4.17.9+dfsg-0+deb12u3) server. Whilst
> doing this I want to preserve all the ACL's which were set on Windows
> shares.
>
> Is there any related documentation around this topic how to approach
> this so the permissions are preserved.
>
> We used this command to copy the data from one to another share:
>
> robocopy <Source> <Destination> /MIR /DCOPY:T /MT:3 /XJ /R:1
/W:3 /NDL
> /NP /LOG+:logfile.txt
>
Assuming that you have Samba set up to properly store the Windows ACLs
with your choice of VFS module, your robocopy command just needs a few
extra flags. I usually do something like:

robocopy /mir /copy:datso /dcopy:dat /r:0 /ndl /mt <src> <dest>

The /copy:datso flag copies (d)ata, (a)ttributes, (t)imestamps,
(s)ecurity, and (o)wnership, which should capture everything you need.
On /dcopy, this copies data, attributes, and timestamps associated
with the directory. This should cover everything. If you still have
issues with permissions not being properly copied, you can use /sec
and /secfix to try to force robocopy to do the job. In my dayjob, my
team has used this method to migrate several hundred terrabytes of
data from Windows file servers to a couple of different Linux/Samba
platforms with very good success.

-Nick

Hi Nick,
Sorry for the late reply, been busy 
with some other issues, and this was not such a priority

Basically I have 

        vfs objects = acl_xattr
        inherit acls = yes
        inherit permissions = yes
        map acl inherit = yes


in my samba global config and shares are normal shares:

[testg] 
        comment = privuser testing share for ACL testing purposes
        path = /storage/testg
        browseable = yes
        read only = no
        inherit acls = yes
        inherit permissions = yes
        map archive = no

But when I want as this user - privuser to change any
permissions/acls/anything on any file in that share it gives me: Unable
to save permission changes to file, The request is not supported.

So looks like I am missing something?

Regards
Borut

On Thu, 2023-07-20 at 07:50 -0400, Nick Couchman wrote:
> On Thu, Jul 20, 2023 at 7:08?AM Borut Rozman via samba
> <samba at lists.samba.org> wrote:
> > 
> > Hi there,
> > 
> > It might that this question was already answered but I can't
really
> > find any proper documentation for this.
> > 
> > I am in a process of migrating about 70T of files from our Win2016
> > storage server to a Samba (2:4.17.9+dfsg-0+deb12u3) server. Whilst
> > doing this I want to preserve all the ACL's which were set on
> > Windows
> > shares.
> > 
> > Is there any related documentation around this topic how to
> > approach
> > this so the permissions are preserved.
> > 
> > We used this command to copy the data from one to another share:
> > 
> > robocopy <Source> <Destination> /MIR /DCOPY:T /MT:3 /XJ
/R:1 /W:3
> > /NDL
> > /NP /LOG+:logfile.txt
> > 
> 
> Assuming that you have Samba set up to properly store the Windows
> ACLs
> with your choice of VFS module, your robocopy command just needs a
> few
> extra flags. I usually do something like:
> 
> robocopy /mir /copy:datso /dcopy:dat /r:0 /ndl /mt <src> <dest>
> 
> The /copy:datso flag copies (d)ata, (a)ttributes, (t)imestamps,
> (s)ecurity, and (o)wnership, which should capture everything you
> need.
> On /dcopy, this copies data, attributes, and timestamps associated
> with the directory. This should cover everything. If you still have
> issues with permissions not being properly copied, you can use /sec
> and /secfix to try to force robocopy to do the job. In my dayjob, my
> team has used this method to migrate several hundred terrabytes of
> data from Windows file servers to a couple of different Linux/Samba
> platforms with very good success.
> 
> -Nick