QNAP Systems Ts 253 User Guide

181 
 
Windows ACL Samba 13 (NTFS 
permissions) 
Windows File 
Explorer 
Both FTP, AFP, File 
Station, Samba 
Please see the 
application note 
(https://www.qnap.
com/i/en/trade_tea
ch/con_show.php?o
p=showone&cid=6) 
for more details. 
Windows File 
Explorer 
 
Advanced Folder Permissions 
Use Advanced Folder Permissions to directly configure subfolder permissions on the NAS. 
There is no depth limitation for subfolder permission, but it is highly recommended to only 
change permissions on the first or...

182 
 
 
 
 
Quota 
 
To efficiently allocate storage space, you can specify a quota value (in megabytes or 
gigabytes) that applies to all users and disk volumes. QTS prevents users from uploading 
data to the NAS when the feature is enabled and the quota is reached.  
 
 
After the quota is specified and applied, the screen displays a list of all local and domain users 
and the corresponding storage details (quota size, used space, and available space). You can 
perform the following actions: 
Modify...

183 
 
 
Domain Security 
 
The NAS supports user authentication by local access right management, Microsoft Active Directory 
(Windows Server 2008/2012), and Lightweight Directory Access Protocol (LDAP) directory.  
 
 
By joining the NAS to an Active Directory or a LDAP directory, the AD or LDAP users can access the 
NAS using their own accounts without extra user account setup on the NAS.  
No domain security: Only the local users can access the NAS. 
Active Directory authentication (domain...

184 
 
 
 
 
Joining NAS to Active Directory (Windows Server 2003/2008/2012) 
 
Active Directory is a directory used in Windows environments to centrally store, share, and 
manage a networks information and resources. It is a hierarchical data center which 
centrally holds information for users, user groups, and the computers for secure access 
management. The NAS supports Active Directory (AD.) By joining the NAS to the Active 
Directory, all the user accounts of the AD server will be automatically...

185 
 
controller time as it must be consistent with the time of the AD server. The maximum 
time disparity tolerated is 5 minutes. 
2. Go to “Control Panel” > “Network & File Services”. Click” Network & Virtual Switch” and 
go to “Interfaces”. Click “DNS Server” and set the IP of the primary DNS server as the IP 
of the Active Directory server that contains the DNS service. The primary DNS server 
field must be the IP of the DNS server that is used for your Active Directory. If you use 
an external DNS...

186 
 
4. In Local Security Setting select Send LM & NTLMv2 – use NTLMv2 session security if 
negotiated from the list. Then click OK. 
 
Verifying the settings 
To verify that the NAS has successfully joined the Active Directory, go to Privilege Settings 
> Users and User Groups. A list of users and user groups will be shown on the Domain 
Users and Domain Groups lists respectively. If you have created new users or user 
groups in the domain, you can click the Refresh button to add users and user group...

187 
 
 
 
 
Connecting NAS to an LDAP Directory 
 
LDAP (Lightweight Directory Access Protocol) is a directory that can store the information of 
every user and group in a centralized server. Administrators can use LDAP to manage users 
in the LDAP directory and allow them to connect to multiple NAS with the same login details. 
This feature is intended for use by administrators and users who have knowledge of Linux 
servers, LDAP servers, and Samba. A running LDAP server is required when using this...

188 
 
4. Click Apply to save the settings. Upon successful configuration, the NAS will be able to 
connect to the LDAP server. 
5. Configure LDAP authentication options. 
o If Microsoft Networking has been enabled (Network Services > Win/Mac/NFS > 
Microsoft Networking) when applying the LDAP settings, specify the users who can 
access the NAS via Microsoft Networking (Samba.) 
Local users only: Only local NAS users can access the NAS via Microsoft Networking. 
LDAP users only: Only LDAP users can...

189 
 
webmin-ldap-useradmin - LDAP user administration module for Webmin. 
 
B. Samba schema 
To import the a Samba schema to the LDAP server, please refer to the documentation or 
FAQ of the LDAP server. A samba.schema file is required and can be found in the directory 
examples/LDAP in the Samba source distribution. Example for open-ldap in the Linux server 
where the LDAP server is running (it can be different depending on the Linux distribution):  
 
Copy the samba schema: 
zcat...

190 
 
 
 
 
Domain Controller 
 
The Turbo NAS can now act as a domain controller for Windows. IT administrators can easily configure 
the Turbo NAS as the centerpiece of domain directory services for their organization to store user 
account information, manage user authentication and enforce security for a Windows domain. 
 
 
Note: This function is only applicable to some models.  
 
Domain Controller 
 
Three domain controller modes are available for the Turbo NAS: 
Domain Controller: Only a...