Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I would like to define local ACL's to be used over a remotely mounted filesystem. The filesystem is mounted via autofs and sshfs FUSE.

The idea is that we could setup a jailed user on a jump server with access to read files on other servers in the environment and use standard commands without alot of exposure and certainly without granting ssh access.
Problem is sshfs will always run as the same user so files within the path on the remote system would be exposed regardless of the user that they were exposed for.

I've explored coding the security check right into sshfs but before I go down that road I'd like to see if any other package can add ACL support to an otherwise read only filesystem.

Edit: @peterph How would you set your ACL's for the NFS share when the remote filesystem is read only?

sshfs was really easy to take apart, so I added the ACL check right into sshfs itself a few days after writing this. Users get jailed on login via OpenSSH and jailkit, and access the read only sshfs automount as a non-privileged user from there. Every dir/file stat or read generates a syslog event. Been working like a charm and the users have no rights off of the one jailed box.

share|improve this question
3  
bindfs doesn't support ACLs. rofs is unmaintained and I don't think it supports what you want anyway. I'd go for a simpler approach: let each user mount an sshfs filesystem for himself, and give each user a separate SFTP-only account on the server. It's easier to keep simple setups secure than Rube Goldberg contraptions. –  Gilles Apr 30 '12 at 1:31

1 Answer 1

Is there a reason for not using NFS with ACL support? You could either tunnel it through SSH/VPN, or use NFSv4 which supports encryption on its own.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.