2

The problem that I'm facing is that I have an NFS NAS that I use to store and export a home directory, media files like music, movies, etc.

The critical things are backed up, so spare the comments about "If you can't afford to lose it back it up rule of 3-2-1." Got it. But that's not happening for little ol' me and 7TB of data, so I backup what I need to.

So here's the thing, I like being able to export those directories to other computers so that I can read, and sometimes write, but I recently rm -rf . /'d a bunch of stuff on my laptop and thankfully at the time they weren't mounted. I also realized, and tested recently, that doing something like that with the way I had NFS mounted, would have resulted in wiping everything out remotely, as well. (again spare me the lessons about rm, I got it I just have some really old bad habits to get rid of)

The ways that you can secure it are obvious. Only use the anon user, or export as ro, or mount as ro on the client computer. I don't like the latter option because it gives control to an attacker should they gain access to my network.

I need a way to satisfy the following conditions:

  1. Directories can be mounted by the client system, but are not normally writable, but are readable.
  2. At a later point, the user decides that they need to edit something and they do something to make that possible from the client computer.*

* meaning that I don't want to SSH in unless I absolutely have to

The only thing that seems to work functionally the way I'm thinking is to use no_root_squash and mount the filesystem ro on the client system, then -o remount,rw when I need to change something, but like I said earlier I feel that has serious security implications.

0

IIUC, you want to normally be disabled from deleting or writing to the media files, but occasionally want to add a file, whether or not over the NFS link.

For that purpose, why putz with mount options? Why not set the media directories to mode 555? As owner, use chmod u+w dirname && cp filename dirname/; chmod u-w dirname to update the directory as needed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.