3

I've been trying to figure out a good permissions scheme for my multi-user file server. I currently have about 5 users, each storing files in their home directory. These files are also being accessed by various applications on the machine, such as a web server running ownCloud, and the BitTorrent Sync application. These applications each run under their own user account. I'm looking for a permissions scheme to achieve the following:

-No user should be able to access another user's home directory (except possibly me, as the admin)

-The application user accounts should have full access to all of the user accounts (we'll assume that user access isolation is implemented properly within the applications themselves, or else this would violate rule 1)

-Files created by the application user accounts should still be accessible by the user under whose home directory they were created

Right now, the best I've been able to come up with is to add all of the applications to the www group, and then create the user home directories as :www 770, but this really doesn't seem like a good solution. Another idea I had was to use the user-specific groups (i.e. the groups with the same name as the users), and then create the home directory as : 770, and then add the application username to each user's group separately. Also, there's the possibility of using sticky-bits, but I'm not really sure how those work. I should probably specify this is a FreeNAS server, as I understand sticky-bits work a bit differently on BSD vs Linux.

Any thoughts? As a native Windows user, this is one of those things that I could have done in 5 minutes with ACL's, but c'est la vie...

  • Since you want to use ACLs, have you considered using POSIX ACLs? man setfacl – Roger Pate Mar 28 '16 at 18:00
  • It's not so much that I want to use ACL's, it's that I'm more familiar with Windows systems, and that's how I'd have done it on a Windows system. However, I'm more interested in implementing best practices, and When in Rome... If ACL's are the right way to tackle this problem, then I'll look into them, but I get the feeling that ACL's might get tricky considering that I'm also mounting these directories inside of BSD jails, and I'm not sure if the jail mounts retain ACL's or not. – qwertymodo Mar 30 '16 at 0:20
0

Giving e.g. a web server (or any outside accessible server) full access (read, write and execute) to a user's files is not a good idea from a security point of view. As a rule, you should restrict that to read access for files and read/execute for directories. In fact the default on FreeBSD is to give others read access to a users file. This would make your life a lot easier but goes against your first point.

An even better solution is to run the web server in a jail and make a cron job (running as root) that uses e.g. rsync to mirror the users web-accessible files to a directory in the jail.

For things like bittorrent I would also make a single directory where the bittorrent client can read and write stuff. Set that directory to a torrents group that has read/write access and make all your users members of that group.

Edit:

If you're mounting inside the jail with nullfs setting the group rights of the directory to read/write sounds like a good option. The jail should provide isolation.

I've used a combination of nullfs and unionfs to make files available but to put modifications somewhere else. So you could put incoming stuff from the torrent in a uploads directory without touching the stuff in the files directory.

  • I don't really need execute, but read+write is a must, the entire point is to be able to upload files and then work with them. The web server is inside a jail, and the user's home directories are being mounted inside the jail (well, actually each user has a "files" directory /home/user/files that I'm using as their mounted root inside of the jails). Using a single directory for BitTorrent Sync isn't an option. It's basically like Dropbox, each user has their own files getting synced, and those files should go into the user's own directory within their home directory. – qwertymodo Mar 30 '16 at 20:54
  • maybe a nullfs/unionfs combo? see edited answer. – Roland Smith Mar 30 '16 at 21:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.