0

Use case

I'm the only user. I have an ubuntu NAS with fulldisk encryption, and I'm trying to back up my own Windows machines to that. I want to have a USB stick that I can boot from to clone the Windows drives to the NAS, but I don't want the whole backup share to be readable by anyone who may come across that USB stick with the share credentials on it. Can you think of a better solution?

What I was thinking could work

I've been searching but unable to find what I need, everything I have found is about simply enabling write access to a share, which is not what I want to do.

I would like to create a samba share on my ubuntu machine where users have only write permissions. I would like them to be able to create files but not be able to read them, nor list folders inside the share.

This is for the purpose of backup. I want to have a bootable usb drive that I can boot from that will take disk images of the drives in that machine and save to the samba share, but I don't want that usb to have access to all the images.

I'm happy if it just fails if a file already exists, I will ensure the filenames do not conflict by using drive UUIDs/time.

7
  • 1
    See also superuser.com/questions/646442/…
    – Nick ODell
    Jul 5, 2018 at 7:10
  • Most of the answers are showing that this isn't possible as described, the only solution that looked worthwhile was the serverfault one which suggests using the student/teacher ownership paradigm.
    – slm
    Jul 5, 2018 at 7:43
  • 1
    You could configure ssh to allow you to connect to the NAS, using a public key. It should be possible to configure it to only allow you to deliver files. Jul 5, 2018 at 13:43
  • @ctrl-alt-delor Thanks, that does sound like a good way to achieve what I want. Do you have any advice or a link on how to achieve that with ssh? I know how to set up ssh access with a key but not how to configure it to only allow delivering files without shell access or access to other folders.
    – localhost
    Jul 5, 2018 at 23:01

2 Answers 2

1

I've done something similar, only difference was that one user could write-only without reading (or even listing directory), another user could only read.

/etc/samba/smb.conf

[write-only]
  comment = Write-only access without read
  path = /smbshare
  hosts allow = 172.17.10.10
  hosts deny = 0.0.0.0/0
  read only = no
  write list = smbwrite
  force user = smbwrite
  force group = smbread
  create mask = 0350
  directory mask = 0350
  force create mode = 0350
  force directory mode = 0350

Initial access rights on server side:

chmod -R 350 /smbshare
chown -R smbwrite:smbread /smbshare

Only drawback is that if you know the exact file name, you can list it.

The following part is for a reference:

[read-only]
  comment = Read-only access
  path = /smbshare
  read only = yes
  hosts allow = 172.17.10.20
  hosts deny = 0.0.0.0/0
  read list = @smbread

/etc/fstab entries on both clients:

smbwrite (172.17.10.10), local user "foo":

//172.17.10.1/write-only      /mnt/write      cifs    user=smbwrite,pass=s3kr1t,uid=foo,vers=3.0 0 0

smbread (172.17.10.20), local user "bar":

//172.17.10.1/read-only /mnt/read cifs user=smbread,pass=s3kr1t,uid=bar,vers=3.0 0 0
1
  • Perfect! I'm actually not able to read the file even if I know the exact file name with this setup. If you try to modify or write a file with an existing name it just errors out, but I can touch the file to update its time, and also delete it if I know its name. Weird but almost exactly what I wanted. Thanks a lot!
    – localhost
    Oct 31, 2019 at 10:54
1

Mount points only support disabling write (readonly), but not disabling read. However you may can do most of it with file permissions. It will not be possible to stop a user from reading her own files, but you can stop her from reading other peoples files.

You will need:

  • Sticky bit, to stop users from removing each others files.
  • Turn off the read bits of the directory to stop others from reading
  • Set a default permission, to turn off the read bits of files to stop others from reading them.

How to

  chmod +t "«the directory»"
  setfacl -m "u::wx,g::wx,o:-" "«the directory»"
  setfacl -m "d:u::-,d:g::-,d:o:-" "«the directory»"

Warnings

This will not be easily used by users, consider giving some extra permissions. Or one directory per user.

I also don't think that this is the way to do backups. Set up a cron job to do backups every day. You may be using backups for revision control, consider using a revision control system. Sub-version (svn), is a good one for must users, and most file types. Mercurial is also good for programmers, and can be used for other file-types, but I would not recommend it for any non-mergeable files (such as MS-Office).

1
  • Thanks for the answer, although it's not exactly what I want for my situation. I'm the only user. I have an ubuntu NAS with fulldisk encryption, and I'm trying to back up my own Windows machines to that. I want to have a USB stick that I can boot from to clone the Windows drives to the NAS, but I don't want the whole backup share to be readable by anyone who may come across that USB stick with the share credentials on it. Can you think of a better solution?
    – localhost
    Jul 5, 2018 at 12:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .