Bottom line: Define who may open the private data and who may maintain it before selecting a share preset. Test two distinct user identities and the intended administrator, and keep folder visibility separate from access to its contents.
\nThe TrueNAS private SMB guide requires both dataset and share ACL permissions to allow or prevent access to a private dataset share. It distinguishes the filesystem ACL from the share ACL, which controls what a user can see or access through Windows File Explorer. For private datasets nested under a shared parent, it directs restricting share ACLs and notes that other dataset names may remain visible while access to their contents is blocked. The guide requires an appropriate SMB user or directory membership and says root and built-in accounts cannot access SMB shares.
\nThis article addresses the versioned private-share permission decision, not a guarantee that a selected preset has met a particular confidentiality policy. Folder-name visibility, file access and administrative maintenance must be accepted according to the owner’s separate requirements.
\nThe following steps are DSE recommendations based on the cited source.
\nDSE recommends an access matrix with separate rows for the private user, another ordinary user and the approved maintenance administrator. Define allowed read, change and maintenance operations in plain language. Do not use the same cached client session as evidence for all three identities.
\nReview both permission layers against that matrix. Keep the parent dataset and each nested private dataset explicit in the path diagram. Avoid making a broad parent permission change merely to resolve a single share-creation error without reviewing the other directories beneath it.
\nUse a proposed disposable dataset with harmless files for the first trial. Have the owner decide whether displaying another folder’s name violates the requirement even if its contents cannot be opened. Record that requirement before interpreting the client view.
\nPreserve the initial ACLs and approved administration path. If an extra group is needed, describe its intended membership and rights rather than granting broad access to make the test pass. Keep the privacy decision and maintenance exception visible to the data owner.
\nProposed verification: establish separate authenticated sessions for the intended user and excluded user, then test the named file operations and any required folder visibility. Record the effective identity and requested path with each result. Check the maintenance administrator separately without treating that privileged result as an ordinary user test.
\nCompare the observed results with both ACL exports and the access matrix. Investigate an unexpected permission at the exact dataset and share before changing inherited access broadly. Retain redacted evidence and remove the disposable data through the agreed cleanup procedure after the owner accepts the bounded test.
\nSource review completed October 29, 2026. Recheck the official documentation and deployment-specific applicability before a production change.
\n", "content_text": "Bottom line: Define who may open the private data and who may maintain it before selecting a share preset. Test two distinct user identities and the intended administrator, and keep folder visibility separate from access to its contents.\nSource fact: what the authority says\nThe TrueNAS private SMB guide requires both dataset and share ACL permissions to allow or prevent access to a private dataset share. It distinguishes the filesystem ACL from the share ACL, which controls what a user can see or access through Windows File Explorer. For private datasets nested under a shared parent, it directs restricting share ACLs and notes that other dataset names may remain visible while access to their contents is blocked. The guide requires an appropriate SMB user or directory membership and says root and built-in accounts cannot access SMB shares.\nWhat the source does not establish\nThis article addresses the versioned private-share permission decision, not a guarantee that a selected preset has met a particular confidentiality policy. Folder-name visibility, file access and administrative maintenance must be accepted according to the owner’s separate requirements.\nApplicability questions\n\nWhich dataset, share path and parent dataset are actually involved?\nWhich identity owns the private data, and which administrator needs maintenance access?\nShould another user see the folder name, open its contents, or neither?\nWhat effective dataset and share permissions apply to each test identity?\n\nDSE recommendation: controlled next steps\nThe following steps are DSE recommendations based on the cited source.\nDSE recommends an access matrix with separate rows for the private user, another ordinary user and the approved maintenance administrator. Define allowed read, change and maintenance operations in plain language. Do not use the same cached client session as evidence for all three identities.\nReview both permission layers against that matrix. Keep the parent dataset and each nested private dataset explicit in the path diagram. Avoid making a broad parent permission change merely to resolve a single share-creation error without reviewing the other directories beneath it.\nUse a proposed disposable dataset with harmless files for the first trial. Have the owner decide whether displaying another folder’s name violates the requirement even if its contents cannot be opened. Record that requirement before interpreting the client view.\nPreserve the initial ACLs and approved administration path. If an extra group is needed, describe its intended membership and rights rather than granting broad access to make the test pass. Keep the privacy decision and maintenance exception visible to the data owner.\nVerification and evidence\nProposed verification: establish separate authenticated sessions for the intended user and excluded user, then test the named file operations and any required folder visibility. Record the effective identity and requested path with each result. Check the maintenance administrator separately without treating that privileged result as an ordinary user test.\nCompare the observed results with both ACL exports and the access matrix. Investigate an unexpected permission at the exact dataset and share before changing inherited access broadly. Retain redacted evidence and remove the disposable data through the agreed cleanup procedure after the owner accepts the bounded test.\nOfficial references\n\nTrueNAS — Setting Up SMB Private Dataset Shares — official product documentation; confirm the installed release and configuration.\n\nSource review completed October 29, 2026. Recheck the official documentation and deployment-specific applicability before a production change.", "content_markdown": "Bottom line: Define who may open the private data and who may maintain it before selecting a share preset. Test two distinct user identities and the intended administrator, and keep folder visibility separate from access to its contents.\n\n## Source fact: what the authority says\n\nThe [TrueNAS private SMB guide](https://www.truenas.com/docs/scale/25.10/scaletutorials/shares/smb/smbprivatedatasetshare/) requires both dataset and share ACL permissions to allow or prevent access to a private dataset share. It distinguishes the filesystem ACL from the share ACL, which controls what a user can see or access through Windows File Explorer. For private datasets nested under a shared parent, it directs restricting share ACLs and notes that other dataset names may remain visible while access to their contents is blocked. The guide requires an appropriate SMB user or directory membership and says root and built-in accounts cannot access SMB shares.\n\n## What the source does not establish\n\nThis article addresses the versioned private-share permission decision, not a guarantee that a selected preset has met a particular confidentiality policy. Folder-name visibility, file access and administrative maintenance must be accepted according to the owner’s separate requirements.\n\n## Applicability questions\n\n- Which dataset, share path and parent dataset are actually involved?\n\n- Which identity owns the private data, and which administrator needs maintenance access?\n\n- Should another user see the folder name, open its contents, or neither?\n\n- What effective dataset and share permissions apply to each test identity?\n\n## DSE recommendation: controlled next steps\n\nThe following steps are DSE recommendations based on the cited source.\n\nDSE recommends an access matrix with separate rows for the private user, another ordinary user and the approved maintenance administrator. Define allowed read, change and maintenance operations in plain language. Do not use the same cached client session as evidence for all three identities.\n\nReview both permission layers against that matrix. Keep the parent dataset and each nested private dataset explicit in the path diagram. Avoid making a broad parent permission change merely to resolve a single share-creation error without reviewing the other directories beneath it.\n\nUse a proposed disposable dataset with harmless files for the first trial. Have the owner decide whether displaying another folder’s name violates the requirement even if its contents cannot be opened. Record that requirement before interpreting the client view.\n\nPreserve the initial ACLs and approved administration path. If an extra group is needed, describe its intended membership and rights rather than granting broad access to make the test pass. Keep the privacy decision and maintenance exception visible to the data owner.\n\n## Verification and evidence\n\nProposed verification: establish separate authenticated sessions for the intended user and excluded user, then test the named file operations and any required folder visibility. Record the effective identity and requested path with each result. Check the maintenance administrator separately without treating that privileged result as an ordinary user test.\n\nCompare the observed results with both ACL exports and the access matrix. Investigate an unexpected permission at the exact dataset and share before changing inherited access broadly. Retain redacted evidence and remove the disposable data through the agreed cleanup procedure after the owner accepts the bounded test.\n\n## Official references\n\n- [TrueNAS — Setting Up SMB Private Dataset Shares](https://www.truenas.com/docs/scale/25.10/scaletutorials/shares/smb/smbprivatedatasetshare/) — official product documentation; confirm the installed release and configuration.\n\nSource review completed October 29, 2026. Recheck the official documentation and deployment-specific applicability before a production change." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/review-truenas-private-smb-datasets-with-two-separate-users/", "url": "https://update.dsesecurity.com/updates/review-truenas-private-smb-datasets-with-two-separate-users/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-29" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/review-truenas-private-smb-datasets-with-two-separate-users/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Review TrueNAS private SMB datasets with two separate users", "item": "https://update.dsesecurity.com/updates/review-truenas-private-smb-datasets-with-two-separate-users/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/review-truenas-private-smb-datasets-with-two-separate-users/#article", "identifier": "https://update.dsesecurity.com/updates/review-truenas-private-smb-datasets-with-two-separate-users/", "url": "https://update.dsesecurity.com/updates/review-truenas-private-smb-datasets-with-two-separate-users/", "headline": "Review TrueNAS private SMB datasets with two separate users", "description": "Check dataset permissions and share permissions together before accepting a private-folder design on TrueNAS 25.10.", "abstract": "Check dataset permissions and share permissions together before accepting a private-folder design on TrueNAS 25.10.", "articleBody": "Bottom line: Define who may open the private data and who may maintain it before selecting a share preset. Test two distinct user identities and the intended administrator, and keep folder visibility separate from access to its contents.\nSource fact: what the authority says\nThe TrueNAS private SMB guide requires both dataset and share ACL permissions to allow or prevent access to a private dataset share. It distinguishes the filesystem ACL from the share ACL, which controls what a user can see or access through Windows File Explorer. For private datasets nested under a shared parent, it directs restricting share ACLs and notes that other dataset names may remain visible while access to their contents is blocked. The guide requires an appropriate SMB user or directory membership and says root and built-in accounts cannot access SMB shares.\nWhat the source does not establish\nThis article addresses the versioned private-share permission decision, not a guarantee that a selected preset has met a particular confidentiality policy. Folder-name visibility, file access and administrative maintenance must be accepted according to the owner’s separate requirements.\nApplicability questions\n\nWhich dataset, share path and parent dataset are actually involved?\nWhich identity owns the private data, and which administrator needs maintenance access?\nShould another user see the folder name, open its contents, or neither?\nWhat effective dataset and share permissions apply to each test identity?\n\nDSE recommendation: controlled next steps\nThe following steps are DSE recommendations based on the cited source.\nDSE recommends an access matrix with separate rows for the private user, another ordinary user and the approved maintenance administrator. Define allowed read, change and maintenance operations in plain language. Do not use the same cached client session as evidence for all three identities.\nReview both permission layers against that matrix. Keep the parent dataset and each nested private dataset explicit in the path diagram. Avoid making a broad parent permission change merely to resolve a single share-creation error without reviewing the other directories beneath it.\nUse a proposed disposable dataset with harmless files for the first trial. Have the owner decide whether displaying another folder’s name violates the requirement even if its contents cannot be opened. Record that requirement before interpreting the client view.\nPreserve the initial ACLs and approved administration path. If an extra group is needed, describe its intended membership and rights rather than granting broad access to make the test pass. Keep the privacy decision and maintenance exception visible to the data owner.\nVerification and evidence\nProposed verification: establish separate authenticated sessions for the intended user and excluded user, then test the named file operations and any required folder visibility. Record the effective identity and requested path with each result. Check the maintenance administrator separately without treating that privileged result as an ordinary user test.\nCompare the observed results with both ACL exports and the access matrix. Investigate an unexpected permission at the exact dataset and share before changing inherited access broadly. Retain redacted evidence and remove the disposable data through the agreed cleanup procedure after the owner accepts the bounded test.\nOfficial references\n\nTrueNAS — Setting Up SMB Private Dataset Shares — official product documentation; confirm the installed release and configuration.\n\nSource review completed October 29, 2026. Recheck the official documentation and deployment-specific applicability before a production change.", "datePublished": "2026-10-29T17:41:09+00:00", "dateModified": "2026-10-29T17:41:38+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/review-truenas-private-smb-datasets-with-two-separate-users/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/review-truenas-private-smb-datasets-with-two-separate-users/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Review TrueNAS private SMB datasets with two separate users" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Advisory priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 544, "timeRequired": "PT3M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "TrueNAS — Setting Up SMB Private Dataset Shares", "url": "https://www.truenas.com/docs/scale/25.10/scaletutorials/shares/smb/smbprivatedatasetshare/" } } ] } }