Question about ACL permissions

Question

I have a situation and i wounder how to set up the permissions to make it work.
I have a folder (the share point) with ~200 subfolders,(called -1000,-2000, -3000, etc etc) In these folders there are tons of pictures.
I want a group(picturesRW) to be able to Read all files/folders, change name on the files (but not on the folders) and also add new files, but not delete(files or folders) Also not to move folders in to other folders (if that is possible).
Then i want another group to be able to just read everything, but thats the easy part.
Hoping there is someone that knows how to set this up. Have tried with allowing "Write attributes" but they still cant rename files..
Cheers!

Answer 1

Hi
A good place to start in my opinion in understanding ACLs is Gerrit de Witt's excellent series of posts:
http://discussions.apple.com/thread.jspa?messageID=1535247
If you have not already done so download the Admin Manuals:
http://manuals.info.apple.com/en/UserManagement_Adminv10.4.pdf
http://images.apple.com/server/macosx/docs/UserManagementv10.5.mnl.pdf
Bear in mind that on 10.4 Server you have to enable ACLs on a volume, followed by a restart otherwise the ACLs don't take and all that is working is the standard POSIX permissions. 10.5 Server has ACLs enabled by default. If you don't want them you have use terminal to disable them. You can't have ACLs without standard POSIX. Both permissions models apply and are accumulative. You can use standard POSIX permissions without ACLs. Be careful when using both models to define an access policy as a deny using both models can easily lock you out of the server. Use WGM when applying permissions. Don't be tempted to do it using the Finder. Defining permissions using terminal - in my opinion - is better but it is not to everyone's taste. ACLs should take precedence over standard POSIX permissions.
Hope this helps, Tony