Is there any way to have users set their own share passwords that doesn't involve them sitting at a computer that is logged in as root on the web interface? I don't really want to share my screen with a random remote (vpn) user and turn over control of my browser to them. And, I don't want to choose/set/know their password myself.

You cant, you either would have to assign them a user/pass and they would have to input those into their windows crediential manager or they would require you to set up the SMB user to match their windows credentials.

You would be better off hosting a service in which does what you need like Nextcloud/Seafile of any number of the self-hosted document services if that's what youre doing. SMB to random users is a horrible idea and a security nightmare.

Edited April 15Apr 15 by MowMdown

These are not random users. They are coworkers. We use unraid as our small company's main fileshare. We have a bunch of different shares, all marked as private. I configure access for those that need it to each of the shares. The unraid instance is inside our office vlan and is reached by people in the office on the network, and by several people who remotely VPN in to the office network.

I give the users the same username as they use on their windows desktops and encourage them to use the same password so that they have easier share access. I do this for people in the office by having them come to my desk. I create the account and then change their password, but have them type it in. I shouldn't know what their password is, and I don't want to know what their password is. It is very poor security practice for someone to know someone else's password, let alone having process where they are required to share it. For the remote folks I've typically set a long randomly generated password and then told the user what it is - they have windows remember it and I'm probably not going to remember their 16-character random string of numbers letters and symbols. It's still stupid to have to do that though.

I guess unraid isn't a good fit for "small office, lots of users using it as a fileshare". It's pretty good as a virtualization host and not bad once set up as a fileshare. But "...would have to assign them a user/pass..." is so far against best practices that it really bugs me every time it happens.

I'd love some kind of self-service thing where I could hand a coworker a link that takes them to a limited "password reset" page. I also for a short while had a home-rolled script that would do the right thing when accessed over ssh, but it was based on undocumented internals of unraid that have changed at least a couple of times in the last 5 years.

Every time I trip over some rough edge like this it makes me want to go explore other options.

It is my understanding that MS's Active Directory (AD) will essentially do all of this. It is a business solution intended to control and administer SMB access. What Unraid is set up for is peer-to-peer type access where security is not the primary goal as all the intended users accessing the server are 'trusted'. What the Share User logins and passwords are intended for is to keep out any person who might end up on the LAN who is not a member of that trusted group out.

22 minutes ago, Frank1940 said:

MS's Active Directory (AD) will essentially do all of this

While this is true, we don't have any windows servers. And, unraid is much better at running KVM linux VMs, which we a bunch of, and now and then, some docker containers.

I do agree with you that unraid is not a perfect fit for "small office business server" applications, it would be MUCH better with a few small quality-of-life changes, like the ability for users to change their own passwords.

You can make a feature request for that: https://product.unraid.net/b/unraid-os-feature-requests

This allows other users to upvote and comment, helping LT to prioritize new features.

17 hours ago, Foozle said:

These are not random users. They are coworkers. We use unraid as our small company's main fileshare. We have a bunch of different shares, all marked as private. I configure access for those that need it to each of the shares. The unraid instance is inside our office vlan and is reached by people in the office on the network, and by several people who remotely VPN in to the office network.

I give the users the same username as they use on their windows desktops and encourage them to use the same password so that they have easier share access. I do this for people in the office by having them come to my desk. I create the account and then change their password, but have them type it in. I shouldn't know what their password is, and I don't want to know what their password is. It is very poor security practice for someone to know someone else's password, let alone having process where they are required to share it. For the remote folks I've typically set a long randomly generated password and then told the user what it is - they have windows remember it and I'm probably not going to remember their 16-character random string of numbers letters and symbols. It's still stupid to have to do that though.

I guess unraid isn't a good fit for "small office, lots of users using it as a fileshare". It's pretty good as a virtualization host and not bad once set up as a fileshare. But "...would have to assign them a user/pass..." is so far against best practices that it really bugs me every time it happens.

I'd love some kind of self-service thing where I could hand a coworker a link that takes them to a limited "password reset" page. I also for a short while had a home-rolled script that would do the right thing when accessed over ssh, but it was based on undocumented internals of unraid that have changed at least a couple of times in the last 5 years.

Every time I trip over some rough edge like this it makes me want to go explore other options.

Like I said. You would want to setup a docker container file sharing service (ie Nextcloud/Filerun) which will do what you want. Unraid itself (nor really any other NAS type OS) by itself is suitable. Im not sure why that option is off the table. Unraid is more than capable of running these services, I myself use them and they work.