Score:0

Ubuntu Server-Premissions hell-Is there a way to make a demond see a dir configured in a way w/ perms which it is not or is there a other work around?

ru flag

I have a personal server which I use for various things but one of the main things is for files and file sharing. There are services that required certain permissions for a directory however I want to use the same directory across these services because it's simple and elegant and would not confuse people and disregardless I want have access to the same files. I could nest them inside but that is not elegant and would be confusing or upload to this dir only etc... I drop SFTP for FTPS with VSFTPD despite being less secure due to having a directory to upload to instead of the root is ultra confusing for most, and depending on the client it may not respect start dir in the conf sftp start file etc...

Example, I have a public section. It uses VSFTPD (FTPS service) for others to upload when login to a special user. It has an web interface for others to publicly see and share the files. Simply the /var/www dir is a symlink to the main dir which is the share. It has an Samba share point at it simply because I want to easily share like a file. It has anon viewing with FTPS or atleast it should but when I go to enable that and change prems on that to get it to work it breaks something else and there is no easy workaround it's a hard requirement despite on paper it should work and wouldn't break anything like security due to having different perms for different users VSFTPD refuses anon users to connect if it's not hard set to something. I do not have a freedom to override it in a config file. This isn't as bad as the other options.

Example 2, I have personally directory that contains sensitive personal data which uses SFTP depending on the user I use to connect it's either read-only or has write permissions. Now if I use the SFTP than samba has to be read only and if I make samba have write permissions then it breaks SFTP.

And so on... I have 5 things that are quesi broken due to me not being able to figure it out.

My original idea was to create for example .../public_share/Real then have .../public_share/Servicex than either symlink or hardlink servicex To Real. The problem is with this approach with the GNU utils ontop of Linux it's literally impossible. I read to use "crown -H" command well that doesn't exist in GNU utils unlike in BSD untils or the untils on the macintosh os. On apple systems you can create hard links to dir along if it doesn't create an circlear path. I am quite surprise that this doesn't exist in Linux assuming someone is using GNU ontop. It's the first time seeing another UNIX like system being better.

So my only other idea which I do not know how to go about doing is there a way to trick to make it appear to a demond that a directory has perms configure in one way but in reality it is configure another way?

Or any other workaround which I didn't think about which would be simple for the end user and is on the server end?

Score:2
cn flag

I want to use the same directory across these services".

That is what the "group" is for. Use the same group, set permissions for the group for a much as you want it for (directory, services, ftp login) can use that directory.


You can alter permissions, besides using chmod, also through ACL.

POSIX Access Control Lists (ACLs) are more fine-grained access rights for files and directories. An ACL consists of entries specifying access permissions on an associated object. ACLs can be configured per user, per group or via the effective rights mask.

These permissions apply to an individual user or a group, and use the same as rwx found in regular permissions.


Example 2, I have personally directory that contains sensitive personal data which uses SFTP depending on the user I use to connect it's either read-only or has write permissions. Now if I use the SFTP than samba has to be read only and if I make samba have write permissions then it breaks SFTP.

Read weird to me. But I would assume you can avoid this using bindfs.

On apple systems you can create hard links to dir along if it doesn't create an circular path. I am quite surprise that this doesn't exist in Linux assuming someone is using GNU ontop. I

I am not surprised and no... MacOS, by allowing that, crippled core utilities and in my opinion it was a stupid move. You also need to use 3rd party scripts to fix parts of what that caused (ln is broken, and you can not undo a hard link from command line).

What you should be using is bindfs. MacOS should have added support for that a decade ago. It works in all modern Linux, Unix, and BSD (Catalina was the 1st MacOS iirc).

bindfs

Mount a directory to another location and alter permission bits.

bindfs is a FUSE filesystem for mounting a directory to another location, similarly to mount --bind. The permissions inside the mountpoint can be altered using various rules.

See the link for more but from what you posted it seems to me to be an answer to all your issues.

MathCubes avatar
ru flag
I didn't knew about bindfs. But no, some of these services the group needs to be root or their own etc... Annoying as fucking hell because I own the the system, I get for security etc... but there should be an override but it's like hard coded into their own source code.
MathCubes avatar
ru flag
I do use ACL though eiciel which is what I use. I use gnome on my server and have a gui. I am weird like that. You said it read odd, I never been known to have the best writing skills.
MathCubes avatar
ru flag
Thanks @Rinzwind, I never knew you was still active on here.
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.