User needs dedicated external hard drive mounted to their home folder

Question

One of the users on our Ubuntu server has given us an external hard drive as a means of increasing the amount of storage space for their account.

They'd like us to auto-mount this external hard drive in their own /home/user folder to a location such at /home/user/usbDrive

Additionally, they want to be sure that no other users on the system can access this external hard drive.

Typically, on systems where there are not multiple users, I've been mounting external hard drives to locations like /media/usbDrive and I've never really taken the time to see if such mounts are available for other users (being that there weren't any other users).

I know how to add entries to the fstab table so that mounts are mounted automatically, but what I'm really asking for guidance on is these concerns:

1. Where's the best place to mount an external hard drive that will be used only by one user in a multi-user environment?

2. If I mount this external hard drive somewhere in their own /home/user folder, will they automatically be the only user (besides root) who can access it? Or, are additional permission-modifications needed in order to ensure this.

3. I'm worried that if I mount to /home/user/usbDrive, that if the mount ever fails, large amounts of data will instead fill up the internal hard drive (at that mount location) instead of going to the external hard drive (as intended). Is this a valid concern?

Answer 1

I would recommend using autofs to mount the drive (https://wiki.archlinux.org/index.php/Autofs) in a standard location (eg. not their home-dir). Default for autofs is /run/media/$username/$media-title.

udev to restrict permissions (https://wiki.archlinux.org/index.php/Udev) and a symlink to allow the user access to the drive from their home-dir.

An excerpt from the arch wiki for configuring autofs:

/etc/autofs/auto.master

/media/misc     /etc/autofs/auto.misc     --timeout=5
/media/net      /etc/autofs/auto.net      --timeout=60

.

/etc/autofs/auto.misc

#kernel   -ro                                        ftp.kernel.org:/pub/linux
#boot     -fstype=ext2                               :/dev/hda1
usbstick  -fstype=auto,async,nodev,nosuid,umask=000  :/dev/sdb1
cdrom     -fstype=iso9660,ro                         :/dev/cdrom
#floppy   -fstype=auto                               :/dev/fd0

You can decide if you like the idea of autofs, the reason I'd suggest it here is: in case the device isn't plugged in when you boot the machine (fstab is referenced at boot, but then not again unless you run mount -a manually as root). Also, autofs will temporarily create the directory it mounts on if it doesn't exist, which will be useful for my final point.

udev is used to modify hardware device settings/permissions and more

/udev/rules.d/99-sdb1.rules

KERNEL="sdb1", OWNER="user1", GROUP="user1", MODE="0700"

This would prevent anyone but user1 from reading or writing sdb1.

I would suggest a symlink in the user's home directory to the autofs directory because the directory wouldn't exist if the disk isn't mounted. This would mean attempting to write to that directory would fail, rather then silently fill the hard drive.

There's a bit of setup for this, so use this answer as a starting point rather than comprehensive, however it should solve all of your concerns.

Answer 2

If I mount this external hard drive somewhere in their own /home/user folder, will they automatically be the only user (besides root) who can access it? Or, are additional permission-modifications needed in order to ensure this?

The ability to access a folder inside /home/user is unrelated to mounting and depends on the permissions which are set for other users on /home/user:

• drwxr-xr-x: /home/user/usbDrive will be accessible by everyone.
• drwxr--r--: other users will be able to see /home/user/usbDrive (ls /home/user/ will list usbDrive), but will not be able to access any content within it.
• drwx--x--x: other users will not be able to see /home/user/usbDrive, but will be able to access it if they know its name (cd /home/user/usbDrive will work).
• drwx------: other users will be denied all access to /home/user/usbDrive

Note that once the drive is mounted, the permission inside /home/user/usbDrive will depend on mount options, not on the original permissions the /home/user/usbDrive directory had.