Multi-user permissions setup

Question

I've been trying to figure out a good permissions scheme for my multi-user file server. I currently have about 5 users, each storing files in their home directory. These files are also being accessed by various applications on the machine, such as a web server running ownCloud, and the BitTorrent Sync application. These applications each run under their own user account. I'm looking for a permissions scheme to achieve the following:

-No user should be able to access another user's home directory (except possibly me, as the admin)

-The application user accounts should have full access to all of the user accounts (we'll assume that user access isolation is implemented properly within the applications themselves, or else this would violate rule 1)

-Files created by the application user accounts should still be accessible by the user under whose home directory they were created

Right now, the best I've been able to come up with is to add all of the applications to the www group, and then create the user home directories as :www 770, but this really doesn't seem like a good solution. Another idea I had was to use the user-specific groups (i.e. the groups with the same name as the users), and then create the home directory as : 770, and then add the application username to each user's group separately. Also, there's the possibility of using sticky-bits, but I'm not really sure how those work. I should probably specify this is a FreeNAS server, as I understand sticky-bits work a bit differently on BSD vs Linux.

Any thoughts? As a native Windows user, this is one of those things that I could have done in 5 minutes with ACL's, but c'est la vie...

Answer 1

Giving e.g. a web server (or any outside accessible server) full access (read, write and execute) to a user's files is not a good idea from a security point of view. As a rule, you should restrict that to read access for files and read/execute for directories. In fact the default on FreeBSD is to give others read access to a users file. This would make your life a lot easier but goes against your first point.

An even better solution is to run the web server in a jail and make a cron job (running as root) that uses e.g. rsync to mirror the users web-accessible files to a directory in the jail.

For things like bittorrent I would also make a single directory where the bittorrent client can read and write stuff. Set that directory to a torrents group that has read/write access and make all your users members of that group.

Edit:

If you're mounting inside the jail with nullfs setting the group rights of the directory to read/write sounds like a good option. The jail should provide isolation.

I've used a combination of nullfs and unionfs to make files available but to put modifications somewhere else. So you could put incoming stuff from the torrent in a uploads directory without touching the stuff in the files directory.