As what user is an sshfs mounted folder being accessed?

Question

I'm trying to do a network backup of a drive. There are two machines in this process.

PC1:

• Distant machine with 2 hards sda and sdb
• sdb is the drive which needs backing up
• two users exist, root and user

PC2:

• machine I'm on
• working as user Alan, can go root when needed

I do the following on PC2:

sshfs root@PC1:/dev ~/Desktop/netdisk/

Mounts fine. I have sdb available in ~/Destkop/netdisk/. Next step:

sudo dd if=~/Destkop/netdisk/sdb | gzip -c > ~/Destkop/ddbackup/image.gz

Yields an error:

dd: opening `netdisk/sdb': Permission denied

When i check the permissions of sdb:

brw-rw---- 1 root    disk    0, 0 Jan  3 10:47 sdb

Since i ssh-ed to PC1 as root@PC1 doesn't that mean that I have root access to files mounted as sshfs?

From this example it seems it doesn't, is there a concept here that I'm missing?

Answer 1

The remote files are accessed as the remote user that you logged in as, i.e. root. There's no other way, really.

The error you're getting is due to permissions on the local side. It's an oddity in FUSE, which SSHFS is based on. By default, only the user who did the mounting can access a FUSE filesystem. Even root cannot access it. Preventing the root user from access isn't a security restriction, since root can su(1)/setuid(2) down to the user who mounted the filesystem, it's a limitation of FUSE's internal architecture. Since you did the mounting as a non-root user, also access the filesystem as that non-root user. Running dd under sudo isn't buying you anything here anyway, so just run

dd if=~/Destkop/netdisk/sdb | gzip -c > ~/Destkop/ddbackup/image.gz

which (useless use of dd) simplifies down to

dd if=~/Destkop/netdisk/sdb | gzip -c > ~/Destkop/ddbackup/image.gz

which useless use of cat simplifies down to

gzip <~/Destkop/netdisk/sdb >~/Destkop/ddbackup/image.gz

If sdb is a block device and not a regular file on the remote side, it can't work through a remote filesystem (if the device entry was a device entry, it would be the local device, which is undesirable). Use ssh to access it:

ssh root@PC1 cat /dev/sdb | gzip >~/Destkop/ddbackup/image.gz

In any case, you'd save bandwidth by doing the compression on the remote side:

ssh root@PC1 'gzip </dev/sdb' >~/Destkop/ddbackup/image.gz

Answer 2

sshfs cannot handle block devices. It will treat everything as a file. You would need to get creative with ssh, dd, and command line redirection like so:

PC2 -> PC1:

dd of=/home/Alan/Desktop/image.iso < ssh root@PC1 "dd if=/dev/sdb"

or from PC1 -> PC2:

dd if=/dev/sdb | ssh root@PC2"dd of=/home/Alan/Desktop/image.iso"

Answer 3

You can use the mount option allow_other to allow you to access this device as any user. If you use this option, bear in mind that the Linux kernel has an unresolved security bug that affects FUSE.

sshfs -o allow_other root@PC1:/dev ~/Desktop/netdisk/

Ensure you also set user_allow_other in /etc/fuse.conf as well.

See this answer on serverfault.com for further detail.