Create samba share with only write and no read permissions

Question

Use case

I'm the only user. I have an ubuntu NAS with fulldisk encryption, and I'm trying to back up my own Windows machines to that. I want to have a USB stick that I can boot from to clone the Windows drives to the NAS, but I don't want the whole backup share to be readable by anyone who may come across that USB stick with the share credentials on it. Can you think of a better solution?

What I was thinking could work

I've been searching but unable to find what I need, everything I have found is about simply enabling write access to a share, which is not what I want to do.

I would like to create a samba share on my ubuntu machine where users have only write permissions. I would like them to be able to create files but not be able to read them, nor list folders inside the share.

This is for the purpose of backup. I want to have a bootable usb drive that I can boot from that will take disk images of the drives in that machine and save to the samba share, but I don't want that usb to have access to all the images.

I'm happy if it just fails if a file already exists, I will ensure the filenames do not conflict by using drive UUIDs/time.

Answer 1

Mount points only support disabling write (readonly), but not disabling read. However you may can do most of it with file permissions. It will not be possible to stop a user from reading her own files, but you can stop her from reading other peoples files.

You will need:

• Sticky bit, to stop users from removing each others files.
• Turn off the read bits of the directory to stop others from reading
• Set a default permission, to turn off the read bits of files to stop others from reading them.

How to

  chmod +t "«the directory»"
  setfacl -m "u::wx,g::wx,o:-" "«the directory»"
  setfacl -m "d:u::-,d:g::-,d:o:-" "«the directory»"

Warnings

This will not be easily used by users, consider giving some extra permissions. Or one directory per user.

I also don't think that this is the way to do backups. Set up a cron job to do backups every day. You may be using backups for revision control, consider using a revision control system. Sub-version (svn), is a good one for must users, and most file types. Mercurial is also good for programmers, and can be used for other file-types, but I would not recommend it for any non-mergeable files (such as MS-Office).

Answer 2

I've done something similar, only difference was that one user could write-only without reading (or even listing directory), another user could only read.

/etc/samba/smb.conf

[write-only]
  comment = Write-only access without read
  path = /smbshare
  hosts allow = 172.17.10.10
  hosts deny = 0.0.0.0/0
  read only = no
  write list = smbwrite
  force user = smbwrite
  force group = smbread
  create mask = 0350
  directory mask = 0350
  force create mode = 0350
  force directory mode = 0350

Initial access rights on server side:

chmod -R 350 /smbshare
chown -R smbwrite:smbread /smbshare

Only drawback is that if you know the exact file name, you can list it.

The following part is for a reference:

[read-only]
  comment = Read-only access
  path = /smbshare
  read only = yes
  hosts allow = 172.17.10.20
  hosts deny = 0.0.0.0/0
  read list = @smbread

/etc/fstab entries on both clients:

smbwrite (172.17.10.10), local user "foo":

//172.17.10.1/write-only      /mnt/write      cifs    user=smbwrite,pass=s3kr1t,uid=foo,vers=3.0 0 0

smbread (172.17.10.20), local user "bar":

//172.17.10.1/read-only /mnt/read cifs user=smbread,pass=s3kr1t,uid=bar,vers=3.0 0 0