1

I have a multifunction printer that has a SMB-capable scanning unit. I want to have the printer send scans to an SMB share on my iMac running macOS High Sierra (10.13).

I do not want to store my main user account's credentials on the device (embedded software and its security issues...), so I created a dedicated, restricted user account just for that purpose. This account is used to upload the scans to a shared folder. This results in the following permissions:

/Users/Shared/Scans $ ls -al
total 216
drwxrwxr-x+  4 jstarek      wheel    136 16 Dez 16:41 .
drwxrwxrwt  10 root         wheel    340 16 Dez 16:15 ..
-rw-r--r--@  1 jstarek      wheel   6148 16 Dez 16:34 .DS_Store
-rw-------   1 scanaccount  wheel  99403 16 Dez 16:41 SCAN_000275.pdf

I would like to have the permissions on those incoming files to include r for the wheel group. This is easy to do on Linux file systems using ACLs, and I guess one could alter the umask, too... but I'm looking for a targeted way to effectively change the umask for just this directory.

Since the sender is a embedded server in the printer, I can not change anything in the configuration of the sending side.

Improve this question
5
  • Did you make any modifications to the permissions of /User/Shared? – Allan Dec 17 '18 at 0:20
  • None that I know of. – jstarek Dec 17 '18 at 10:10
  • Did you log in to your Mac with the scan account before trying to log in from the printer with it? – Allan Dec 17 '18 at 12:37
  • No, I didn't. I see its home directory has been created, though. – jstarek Dec 17 '18 at 15:01
  • Try logging in with the standard account first, then using a different computer (Mac Windows, Linux, doesn't matter) connect and xfer files to the SMB share. See what your results are. – Allan Dec 17 '18 at 15:14
1

Well, macos support acl's too.

http://ahaack.net/technology/OS-X-Access-Control-Lists-ACL.html

https://www.techrepublic.com/blog/apple-in-the-enterprise/introduction-to-os-x-access-control-lists-acls/

1) I'm not understanding this list too well. Why does SCAN_000275.pdf show up owned by scanaccount? The user seems to be jstarek. I'd expect ., .DS_STORE, and SCAN_000275.pdf all to be owned by the same user.

/Users/Shared/Scans $ ls -al
total 216
drwxrwxr-x+  4 jstarek      wheel    136 16 Dez 16:41 .
drwxrwxrwt  10 root         wheel    340 16 Dez 16:15 ..
-rw-r--r--@  1 jstarek      wheel   6148 16 Dez 16:34 .DS_Store
-rw-------   1 scanaccount  wheel  99403 16 Dez 16:41 SCAN_000275.pdf

2) Shouldn't you be able to configure SMB to give permissions to let the user access the share? Isn't this what is done via system preferences via share?

I'd thought this would have worked.

enter image description here

3) My understanding is that group wheel is some privileged group. I wouldn't expect that on a normal user. I wouldn't be giving wheel any more privileges. I wouldn't be putting group wheel on an id when you are concerned about security. Is this an admin user? Why?

What is the wheel group? The wheel group is a group which limits the number of people who are able to su to root. This usually consists of a group named “wheel” and a set of users that are permitted to use the utility 'su' in order to change to root.Jul 19, 2007 The wheel Group | UNIX Administratosphere https://administratosphere.wordpress.com/2007/07/19/the-wheel-group/

Interesting project.

Robert

Improve this answer
2
  • Thanks for the pointer to ACLs, I'll try it out this evening. To address your questions above: 1) my main user account is jstarek, and since I did not want to store its credentials in the printer's embedded SMB server, I created scanaccount as a non-privileged user. The printer is now using that account to transfer the files. 2) I can't really configure SMB to do what's needed since one end is an embedded system and on the other, MacOS doesn't seem to let me do what's needed. 3) I'm in wheel since I work extensively with *nix command line tools and it's easier that way. – jstarek Dec 17 '18 at 10:10
  • You can edit the smb files directly. Therw are some gotchas. discussions.apple.com/thread/2737319 also see support.apple.com/en-us/HT208209 also see support.apple.com/en-us/TS3144 I heard that apple re-wrote smb, so I don't know if they preserved file controlled settings. – historystamp Dec 17 '18 at 19:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .