Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have a 4TB external hard drive connected to an Linux server.

The fstab permissions on this drive are set so that only one particular non-root user has access to it:

/dev/disk/by-uuid/CEE0476DE0388DA9/ /mnt/USBexternal ntfs-3g defaults,auto,uid=51343,gid=50432,umask=077 0 0

From a remote location, this user has been successful at doing rsync backups to this external hard drive.

However, the external drive doesn't stay mounted as reliably as an internal hard drive does. Every couple of days I'm having to login as root do this command:

mount -a

I would like to give this user the ability to mount this drive, but when the non-root user does mount -a, it tells them they do not have permission to do this:

nonrootuser@server:~$ mount -a
mount: only root can do that

When the non-root user tries to mount this drive specifically, it tells them it is already mounted (even though it isn't):

nonrootuser@server:~$ mount /mnt/USBexternal/
mount: according to mtab, /dev/sdb1 is already mounted on /mnt/USBexternal

As mentioned, the drive is not actually mounted, but (because of the output above) if the non-root user tries to unmount the drive, it says their request disagrees with fstab:

nonrootuser@server:~$ umount /mnt/USBexternal/
umount: /mnt/USBexternal/ mount disagrees with the fstab

How can I permit this user the ability to mount this drive, without giving them any other administrative powers?

share|improve this question
1  
check setfacl. You can give permissions to the user to only the level for which they need. –  Ramesh Mar 5 at 17:35
1  
Can you show us what the fstab entry looks like? –  Mark Plotnick Mar 5 at 18:00
1  
It's unusual for a filesystem to become unmounted while still having an entry in mtab. One reason this can happen is if the kernel detects an inconsistency and unmounts it itself. Can you check for any errors for this fs or drive in /var/log/syslog and /var/log/messages? –  Mark Plotnick Mar 5 at 20:20
1  
That entry from collectd might just mean that the filesystem wasn't mounted when it checked. See if there are log entries that have the string kernel or ntfs-3g or fuse in them and look like errors. One possibility is that the drive is going offline, so there may be some chatter about usb disconnections. –  Mark Plotnick Mar 6 at 15:57
1  
There also ought to be a command to run the equivalent of an fsck on the ntfs filesystem (do this only when it's not mounted); hopefully someone else reading this can recommend something. –  Mark Plotnick Mar 6 at 16:01

2 Answers 2

up vote 2 down vote accepted

You can setup an entry in the /etc/sudoers file for this user to be able to use the mount command. Add something like the following to the end of the /etc/sudoers file:

username ALL=NOPASSWD: /usr/bin/mount, /sbin/mount.ntfs-3g, /usr/bin/umount

Be sure that the exact path to each executable is correct for your system. For example, your mount command might be in /bin instead of /usr/bin.

Adding the mount.ntfs-3g part is important to provide that access for the user. I can see in your mount command that you are using a ntfs-3g filesystem type.

You could, instead, create a shell script to handle the mounting/unmounting and place that in your sudoers file. For example:

create /usr/local/bin/mount-ntfs-drive script:

#!/bin/bash
device_path="/dev/disk/by-uuid/CEE0476DE0388DA9/"
mount_point="/mnt/USBexternal"
if [ "$1" = "-u" ] ; then
  # do unmount
  /bin/umount $mount_point
else
  # do mount
  /bin/mount $device_path $mount_point
fi

edit /etc/sudoers file:

username ALL=NOPASSWD: /usr/local/bin/mount-ntfs-drive

Be sure to do chmod +x /usr/local/bin/mount-ntfs-drive. Also, when your user runs the file, they will need to use the fully qualified path for it to work. It might work from their path but not sure.

sudo /usr/local/bin/mount-ntfs-drive

share|improve this answer
    
Thanks for specific details on achieving this. I suspect that limiting this user's mount-ability to one specific mount-point is too difficult to achieve, but would like to know your thoughts. You see, to me it seems like what you're suggesting would also give the user the ability (if malicious) to mount and umount things outside the scope of this specific external drive. What are your thoughts? –  Lonniebiz Mar 6 at 15:22
    
I added this line to the /etc/sudoers file: actualusername ALL=NOPASSWD: /bin/mount, /sbin/mount.ntfs-3g, /bin/umount but, even after a reboot, the user cannot mount -a. –  Lonniebiz Mar 6 at 15:58
1  
you could create a shell script that will do the mounting and unmounting and place that in your sudoers file. I'll update my answer with the details. –  cmevoli Mar 6 at 16:14
    
That did indeed work, when I was typing "mount -a" for this non-root user, I should have been typing "sudo mount -a" Thanks again for your help. –  Lonniebiz Mar 6 at 20:47

You could write a script which checks whether the connection is broken and does the necessary clean-up in that case. This script could be executed every 30 minutes as root by cron.

Maybe is disappears from /proc/mounts when the kernel detects that the device has gone. If not then the script could simply try to create a file on the mounted volume.

That would avoid the problem situation you described.

A different approach is to not use the user feature of fstab but use sudo instead so that the user can run a script with superuser privilege which does both the clean-up (if necessary) and the mount.

share|improve this answer
    
0,15,30,45 * * * * date >> /mnt/USBexternal/mountStamps.txt ### I tried this cron writing to the drive every 15 minutes, but this didn't fix the issue. –  Lonniebiz Mar 5 at 17:48
1  
@Lonniebiz "Every 15 minutes" can be written as */15, too. This was not intended to prevent losing the connection to the device (which should not happen BTW) but to detect the connection loss. –  Hauke Laging Mar 5 at 17:52
    
Instead of scheduling a cron, it would be ideal if I could permit the user to ensure the drive is mounted before they attempt their backup. Actually, they are initiating this backup via cron on their remote machine (I left that part out to simplify the question). It would be nice if they could add one line to the top of their backup script that would ensure this remote external drive was indeed mounted. –  Lonniebiz Mar 5 at 17:58
1  
@Lonniebiz That is a really strange argument as (1) fstab is usually world-readable, (2) so is /proc/mounts (and /proc/partitions), and (3) lsusb can be executed by ordinary users (/sys is readable for them, too). (4) The only thing ordinary users usually cannot read is /etc/sudoers... –  Hauke Laging Mar 5 at 18:33
1  
@Lonniebiz It seems you don't know how sudo works. Given that it is not only a solution for this case but also in general a tool of great importance you really should have a look at man sudoers. –  Hauke Laging Mar 5 at 19:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.