1

One of the users on our Ubuntu server has given us an external hard drive as a means of increasing the amount of storage space for their account.

They'd like us to auto-mount this external hard drive in their own /home/user folder to a location such at /home/user/usbDrive

Additionally, they want to be sure that no other users on the system can access this external hard drive.

Typically, on systems where there are not multiple users, I've been mounting external hard drives to locations like /media/usbDrive and I've never really taken the time to see if such mounts are available for other users (being that there weren't any other users).

I know how to add entries to the fstab table so that mounts are mounted automatically, but what I'm really asking for guidance on is these concerns:

  1. Where's the best place to mount an external hard drive that will be used only by one user in a multi-user environment?

  2. If I mount this external hard drive somewhere in their own /home/user folder, will they automatically be the only user (besides root) who can access it? Or, are additional permission-modifications needed in order to ensure this.

  3. I'm worried that if I mount to /home/user/usbDrive, that if the mount ever fails, large amounts of data will instead fill up the internal hard drive (at that mount location) instead of going to the external hard drive (as intended). Is this a valid concern?

migrated from serverfault.com Nov 22 '13 at 19:39

This question came from our site for system and network administrators.

  • external hard drive as a means of increasing the amount of storage space for their account - Really? My answer to this would be no, you can't plug your cheap USB drive into my server. Surely you have some supported method to expand your storage space as needed. Permitting users to attach USB drives your server simply is not scaleable. If you are still USB2 your bandwidth for USB is very limited. – Zoredache Nov 22 '13 at 19:27
  • 2
    I'd avoid mounting filesystems on directories you, the sysadmin, can't control. What if the user decides to rename /home/user/usbDrive? The system will fail to boot. I'd mount it on a root-owned directory, say /l/userdrive, and create a single directory in it, /l/userdrive/user, owned by the user and mode 700. All the user's files will go in, or under, /l/userdrive/user. You can symlink to this from /home/user/usbDrive for the user's convenience. – Mark Plotnick Nov 22 '13 at 19:46
  • 1
    I would tell them no. It's a server after all. – slm Nov 22 '13 at 22:28
  • I understand the concerns mentioned, but the objective remains. @Mark Plotnick: thank you for offering a solution that addresses the obvious security concerns. Any additional advise is welcome. – Lonniebiz Nov 25 '13 at 23:13
  • I would imagine the USB drive would be msdos formatted, is that correct? – RobertL Oct 31 '15 at 5:54
1

I would recommend using autofs to mount the drive (https://wiki.archlinux.org/index.php/Autofs) in a standard location (eg. not their home-dir). Default for autofs is /run/media/$username/$media-title.

udev to restrict permissions (https://wiki.archlinux.org/index.php/Udev) and a symlink to allow the user access to the drive from their home-dir.

An excerpt from the arch wiki for configuring autofs:

/etc/autofs/auto.master

/media/misc     /etc/autofs/auto.misc     --timeout=5
/media/net      /etc/autofs/auto.net      --timeout=60

.

/etc/autofs/auto.misc

#kernel   -ro                                        ftp.kernel.org:/pub/linux
#boot     -fstype=ext2                               :/dev/hda1
usbstick  -fstype=auto,async,nodev,nosuid,umask=000  :/dev/sdb1
cdrom     -fstype=iso9660,ro                         :/dev/cdrom
#floppy   -fstype=auto                               :/dev/fd0

You can decide if you like the idea of autofs, the reason I'd suggest it here is: in case the device isn't plugged in when you boot the machine (fstab is referenced at boot, but then not again unless you run mount -a manually as root). Also, autofs will temporarily create the directory it mounts on if it doesn't exist, which will be useful for my final point.

udev is used to modify hardware device settings/permissions and more

/udev/rules.d/99-sdb1.rules

KERNEL="sdb1", OWNER="user1", GROUP="user1", MODE="0700"

This would prevent anyone but user1 from reading or writing sdb1.

I would suggest a symlink in the user's home directory to the autofs directory because the directory wouldn't exist if the disk isn't mounted. This would mean attempting to write to that directory would fail, rather then silently fill the hard drive.

There's a bit of setup for this, so use this answer as a starting point rather than comprehensive, however it should solve all of your concerns.

1

If I mount this external hard drive somewhere in their own /home/user folder, will they automatically be the only user (besides root) who can access it? Or, are additional permission-modifications needed in order to ensure this?

The ability to access a folder inside /home/user is unrelated to mounting and depends on the permissions which are set for other users on /home/user:

  • drwxr-xr-x: /home/user/usbDrive will be accessible by everyone.
  • drwxr--r--: other users will be able to see /home/user/usbDrive (ls /home/user/ will list usbDrive), but will not be able to access any content within it.
  • drwx--x--x: other users will not be able to see /home/user/usbDrive, but will be able to access it if they know its name (cd /home/user/usbDrive will work).
  • drwx------: other users will be denied all access to /home/user/usbDrive

Note that once the drive is mounted, the permission inside /home/user/usbDrive will depend on mount options, not on the original permissions the /home/user/usbDrive directory had.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.