Advise about setting up a permissons on Lion server for a small office.

Question

What is the common wisdom and advise about setting up permissions optimally for a small office using OS X Lion Server as a file server?  I thought I had this solved by setting the ACL permissions so that all users and appropriate groups can read and write all files on the server.  This works great until a new file is created.  Then it appears that the POSIX umask kicks in and takes priority over the ACL permissions.  I need to allow group write permissions on all new files.  My options seem to be:
Make everyone an admin - not great for obvious security reasons
Change the umask for the whole machine - also security problems, though perhaps fewer than the everyone-an-admin route above
Write a folder action applescript to add group write permission on all new files.  This works fine if you have a static number of folders  With new folders it has the problem: How do new folders created by non-admin users get this folder action automatically applied to them - some cronjob to hunt down the new folders; an applesscrpt folder action that adds a folder action to all new folders (sounds recursively complicated)?
Have a cron job regularly do something like  `chmod -R 664` on all files.  This will break during those between the cracks times between when someone creates a new file and when the cronjob runs - not ideal.
Seems like this should be easier which makes me think I'm missing something obvious.
Any help great appreciated.  Thank you in advance!

Answer 1

Good-heart's advice is certainly your first step, but if you've already done that and still have the problem you've described, you might have the 10.7.3 ACL bug, particularly if your users and groups are in an OD or AD rather than being local accounts on the server. The problem is that ACL's for directory accounts are incorrectly ignored, resulting in POSIX permissions coming into play.
I've descibed my workaround for this here;
https://discussions.apple.com/message/18037703
I haven't yet tried the other trick I've read about, which is to ensure your Share's data directories are at least one level down on the volume - there is a post here on the Communities that mentions this;
https://discussions.apple.com/message/18028746
I seem to remember that this helped with an earlier version of AFP, if using external firewire or usb storage.
Let us know if you find a fix, it seems a number of people have problems with this.
Regards,
Ian