Best Practice: File Server File and Permission Structure

[Leegaert]

Hi,

I've been searching for this all night, so far no luck with google. If this should be a duplicate thread, maybe I've use the wrong keywords, in that case, my apologies.

A couple of months ago, I set up a Ubuntu 12.04 Server. I'm using it mainly as file server. Besides that I have my downloads running on it and a Plex Media Server.
In the beginning it was all fairly simple and I just set up a file structure as I saw while browsing for Samba examples.

I'm using 6 separate 2TB hard drives, each mounted to a mountpoint in /srv.
/srv/movies-a
/srv/movies-b
/srv/download-a
/srv/download-b
/srv/documents
/srv/backup

I used these paths for Samba, NFS and locally (transmission & plex). In the mean time, in my opinion, with permissions and all it's becoming a mess. Since I want to add SFTP as well, I started looking for best practices for a decent structure. I bumped into ACL, which I'll be looking into but I'm still wondering what the "best way" is to structure the file system.
Is it possible/advised to mount these drives to different mountpoints for each protocol? Should I work with symbolic links?
I have some experience with Linux but I'm still no expert in managing the file system.

Any help is very much appreciated!
If there are any questions, I'll try to answer them as well/quickly as possible!

[TheFu]

Forget ACLs. You can almost certainly do everything necessary through normal userid and groupid controls.

I'm more worried about your backups, honestly. That is a bunch of data to be lost if even 1 drive failed.

So ... start with a tutorial on UNIX userids and groups and file permissions. If you can explain the userids, perhaps we can help **AFTER** you've come up to speed with permissions. https://www.dartmouth.edu/~rc/help/faq/permissions.html There are many others. Ubuntu has one too.

Spend 30 minutes in a temp directory creating files and directories with different permissions to see how they work or don't work. Nothing can replace this "training".

[Leegaert]

Hi TheFu,

Thanks for your reply!

I understand your worries regarding the backup but it's a deliberate choice. I don't care about most of the content, I only care about the server config and the documents partially.
That aside, I do have some experience with userids, groups and file permissions. I know my way around the chmod and chown commands.

At the moment, I've got five users in use. Three of them were originally meant solely for Samba (mine, my girlfriend's and one for mediaplayer), I've added these to a group to be used in the samba config, this group is owner of everything I want to share. I've got a separate user which owns all the shared files, which I use to connect through SSH, which executes the torrent client daemon and which is also used to executed a post torrent completion script. Next to that there's the plex, which I've added to the "samba group".

I've configured NFS to only use the /srv/movies-a and /srv/movies-b, there I changed the permissions to 775, all other /srv permissions are set to 770. For the Samba shares, any other restrictions are set in the Samba config file.

I hope I explained it well enough, if you'd have any other questions, please let me know

[TheFu]

Samba permissions are completely unrelated to local/nfs permissions, so let's forget those for now.

Are all the local and NFS users in the same group? Just force the sticky bit at the group level on all directories to force the group you need. I would use my own userid, not a "separate user" to own everything. Running a chown/chmod -R script from cron every 30 minutes should correct any issues.

Why does the media player own anything?

I'd torrent to a different "temp" directory, then move the files over later. That can be automated.
I'd only allow plex to access the media files - not samba or nfs. Easier to manage that way.
For the documents ... normal user/group permissions should work - use the chmod g+ws to maintain the group you want.

So - after all that is done, setup samba to use the existing UNIX group for the documents and backup areas.

I hope that makes sense. If not, then we are probably not sharing enough details each way.

[Leegaert]

Samba permissions are completely unrelated to local/nfs permissions, so let's forget those for now.

I think we got off on the wrong foot I'll try to explain better.

Users: user1 / user2 / mp / myadminuser
Group: sambashare

Once Ubuntu Server was installed, first thing I did was configuring Samba. I wanted three users (for example user1, user2 and mp). If I'm not mistaken, to give those users access to the file system through Samba, they still need local access as well? That's why I added them to a group sambashare. I then changed owner and group to respectively myadminuser:sambashare with 770 permission. Further access restriction, for the samba users, are set in the samba config.

For example:
drwxrwx--- 2 myadminuser sambashare 4096 Nov 19 20:13 documents

After Samba was set up, I started adding transmission, NFS, Plex... All based on my first "idea". Now I'm experiencing some issues specifying different permission for each protocol per user/group.

Are all the local and NFS users in the same group?

I don't have any users for NFS, I just gave "everyone" access to the directories I wanted to share.
The only restriction is that only certain (local) IP's have access to the NFS share.

For example:
drwxrwxr-x 2 myadminuser sambashare 4096 Nov 19 20:13 documents

Just force the sticky bit at the group level on all directories to force the group you need.

What do you mean by this? If I'm not mistaken, the sticky bit is used to deny other users then owner and group the rights to delete or rename files?
(Source: http://help.ubuntu.com/community/Fil...ons#Sticky_Bit)

I would use my own userid, not a "separate user" to own everything.

I used a separate user because I use that user to run my transmission daemon as well. It's a user to administrate my server. The other user is solely used to access Samba.
Is that a bad thing?

Running a chown/chmod -R script from cron every 30 minutes should correct any issues.

What would i need that script for? For the torrents?

Why does the media player own anything?

The mediaplayer doesn't own anything. That user is restricted to read only operations in the Samba config. I use it to gain access to the Samba shares on my mede8er.

I'd torrent to a different "temp" directory, then move the files over later. That can be automated.

I already have that in place, but might be for a different reason... Why exactly would you do that?

I'd only allow plex to access the media files - not samba or nfs. Easier to manage that way.

This was my question, how do I accomplish this? I want to be able to assign user/group permissions for everything separately.

For the documents ... normal user/group permissions should work - use the chmod g+ws to maintain the group you want.

I didn't know about the s option, if I read correctly that is for auto inherited permissions?

So - after all that is done, setup samba to use the existing UNIX group for the documents and backup areas.

What existing group? The sambashare group I made with the three users?

I hope that makes sense. If not, then we are probably not sharing enough details each way.

It does make sense, but as you can see I could use some more details
I hope I didn't exaggerate, I feel like I've been typing an hour at this reply...


Thanks for all the help and tips thus far!!

[TheFu]

Sorry - I should have said the set-group-ID or set-user-ID flags, not "sticky". My mistake.

I'm having trouble following your groups, users - we need to be using the exact names and groups to prevent confusion. I should have asked for the output from

find /srv -maxdepth 2 -ls

in the first reply. Also need the lines from the /etc/group file with any groups you plan to use.

Need the facts.
If you can clearly specify which users need what sort of access to which directories, that will be helpful too - table - not text, please. Also, please use "code" tags so the alignment is correct.

Samba access is not related to the local file ownership. I think that is part of the confusion. samba runs as root. It doesn't care what the local permissions are.
https://www.samba.org/samba/docs/using_samba/ch09.html explains Samba permissions. Note how nothing around the user/group on the file system is included?

[Leegaert]

Hi,

I will provide you with the structure once I get home, I cannot access my server a.t.m. Right now, I only have one group in use, I think that's part of the problem.
I'll make the table with the accesses as well.

I'm still confused about the Samba bit. Quote from that link (which I read while I was setting up Samba as well):

When client users access a Samba share, they have to pass two levels of restriction. Unix permissions on files and directories apply as usual, and configuration parameters specified in the Samba configuration file apply as well. In other words, a client must first pass Samba's security mechanisms (e.g., authenticating with a valid username and password, passing the check for the valid users parameter and the read only parameter, etc.), as well as the normal Unix file and directory permissions of its Unix-side user, before it can gain read/write access to a share.

Doesn't this mean that the users that I use in Samba need to have the local permissions as well?

I'll get back to you with the other facts you asked for.

[TheFu]

True ... but there is a workaround for samba - the "force user" or "force group" options in the smb.conf. We don't really have those in local file/dir permissions (except through a mount-bind), so local access needs to be working first. May not be necessary - I can't tell yet.

I'm trying to stick with 1 question at a time. Too many concurrent questions confuses me.

[LHammonds]

Once you get your permissions figured out, you should create a script file that sets those permissions and schedule it to run in crontab on a regular basis. If you need to tweak permission settings later on, just edit the permission script. Running a script on a schedule will help ensure the permissions remain how you expect them to be regardless of how/when/who copies/moves files around.

Example fixperms.sh:

#!/bin/bash
LogFile="/var/log/fixperms.log"
Owner="johndoe"
Group="xmen"
echo "`date +%Y-%m-%d_%H:%M:%S` Script start." >> ${LogFile}
echo "Resetting file ownership on all samba files..."
chown -R ${Owner}:${Group} /srv/samba/share/
echo "Resetting directory permissions..."
find /srv/samba/share/ -type d -exec chmod 0755 {} \;
echo "Resetting file permissions..."
find /srv/samba/share/ -type f -exec chmod 0644 {} \;
chmod 0444 /srv/samba/share/readonlyfile.txt
echo "`date +%Y-%m-%d_%H:%M:%S` Script completed." >> ${LogFile}

LHammonds

[Leegaert]

Hi again, sorry for overwhelming you

Okay so this is the output from the command:

131216    4 drwxr-xr-x  11 root     root         4096 Jan  4 20:03 /srv
     2    4 drwxrwx---   3 myadminuser    smbsh        4096 Dec 22 15:27 /srv/backup
    11   16 drwx------   2 root     root        16384 Dec 20 20:07 /srv/backup/lost+found
     5    8 drwxrwx---   1 myadminuser    smbsh        8192 Dec 11 21:14 /srv/windows-data
  9461   32 drwxrwx---   1 myadminuser    smbsh       32768 Dec 10 17:37 /srv/windows-data/Downloads
    37    0 drwxrwx---   1 myadminuser    smbsh           0 Apr  6  2013 /srv/windows-data/$RECYCLE.BIN
  8352    8 drwxrwx---   1 myadminuser    smbsh        8192 Nov 16 15:00 /srv/windows-data/Desktop
  9441    4 drwxrwx---   1 myadminuser    smbsh        4096 Nov 26 20:44 /srv/windows-data/Documents
  9459    4 drwxrwx---   1 myadminuser    smbsh        4096 Sep 13  2013 /srv/windows-data/Music
  9458    4 drwxrwx---   1 myadminuser    smbsh        4096 Sep 13  2013 /srv/windows-data/Pictures
107755    0 drwxrwx---   1 myadminuser    smbsh           0 Oct  1 22:19 /srv/windows-data/Projects
  9781    4 drwxrwx---   1 myadminuser    smbsh        4096 Jun 12  2013 /srv/windows-data/Shared
    35    4 drwxrwx---   1 myadminuser    smbsh        4096 Dec 10 16:46 /srv/windows-data/System\ Volume\ Information
  9460    4 drwxrwx---   1 myadminuser    smbsh        4096 Oct 10 22:20 /srv/windows-data/Videos
     5    4 drwxrwx---   1 myadminuser    smbsh        4096 Dec 11 21:14 /srv/windows-portable
    37    0 drwxrwx---   1 myadminuser    smbsh           0 Apr  6  2013 /srv/windows-portable/$RECYCLE.BIN
  2830    0 drwxrwx---   1 myadminuser    smbsh           0 Nov  6 21:28 /srv/windows-portable/General
  2902    0 drwxrwx---   1 myadminuser    smbsh           0 Dec 22  2012 /srv/windows-portable/Internet
    94    4 drwxrwx---   1 myadminuser    smbsh        4096 Aug 26  2013 /srv/windows-portable/Media
  2785    4 drwxrwx---   1 myadminuser    smbsh        4096 Dec 22  2012 /srv/windows-portable/Scripts
  2809    4 drwxrwx---   1 myadminuser    smbsh        4096 Dec 22  2012 /srv/windows-portable/Shortcuts
    35    0 drwxrwx---   1 myadminuser    smbsh           0 Dec 10 16:46 /srv/windows-portable/System\ Volume\ Information
     2    4 drwxrwx---   9 myadminuser    smbsh        4096 Mar  8 10:22 /srv/documents
3891201    4 drwxrwx---   2 myadminuser    smbsh        4096 Jan  4 22:35 /srv/documents/user1
85499905    4 drwxrwx---   9 myadminuser    smbsh        4096 Mar  6 20:28 /srv/documents/user2
35962881    4 drwxrwxr-x  58 myadminuser    smbsh        4096 Feb 23 17:49 /srv/documents/pictures
    13    4 -rwxrw----   1 myadminuser    smbsh          96 Mar  8 10:22 /srv/documents/View.xml
117850113    4 drwxrwx---  14 myadminuser    smbsh        4096 Mar 15 00:44 /srv/documents/series
100515841    4 drwxrwx---   4 myadminuser    smbsh        4096 Jan  4 23:07 /srv/documents/documents
    11   16 drwx------   2 root     root        16384 Dec 20 20:05 /srv/documents/lost+found
16670721    4 drwxrwx---  13 myadminuser    smbsh        4096 Mar 16 14:40 /srv/documents/music
     2    4 drwxrwxr-x   4 myadminuser    smbsh        4096 Jan 29 22:29 /srv/movies-a
92536833    4 drwxrwxr-x  28 myadminuser    smbsh        4096 Mar  8 19:52 /srv/movies-a/Movies
119799809    4 drwx------   2 root     root         4096 Dec  1 10:07 /srv/movies-a/lost+found
     5   16 drwxrwx---   1 myadminuser    smbsh       16384 Dec 11 21:15 /srv/windows-os
 71646    0 drwxrwx---   1 myadminuser    smbsh           0 Feb 27  2013 /srv/windows-os/MSOCache
 73349    0 drwxrwx---   1 myadminuser    smbsh           0 Apr  6  2013 /srv/windows-os/$Recycle.Bin
 59891    0 drwxrwx---   1 myadminuser    smbsh           0 Dec 22  2012 /srv/windows-os/AMD
 58901    4 drwxrwx---   1 myadminuser    smbsh        4096 Apr  7  2013 /srv/windows-os/Boot
 58952  376 -rwxrwx---   1 myadminuser    smbsh      383786 Nov 21  2010 /srv/windows-os/bootmgr
 58963    8 -rwxrwx---   1 myadminuser    smbsh        8192 Apr  7  2013 /srv/windows-os/BOOTSECT.BAK
139532    0 lrwxrwxrwx   2 myadminuser    smbsh          60 Jul 14  2009 /srv/windows-os/Documents\ and\ Settings -> /srv/windows-os/Users
 63786    4 drwxrwx---   1 myadminuser    smbsh        4096 Apr 28  2013 /srv/windows-os/drivers
  3660    4 drwxrwx---   1 myadminuser    smbsh        4096 Nov 24 01:10 /srv/windows-os/fastboot
 58976 6290776 -rwxrwx---   1 myadminuser    smbsh    6441754624 Dec 12 21:37 /srv/windows-os/hiberfil.sys
 58983 8387704 -rwxrwx---   1 myadminuser    smbsh    8589008896 Dec 12 21:37 /srv/windows-os/pagefile.sys
 73351    0 drwxrwx---   1 myadminuser    smbsh           0 Jul 14  2009 /srv/windows-os/PerfLogs
 73354   12 drwxrwx---   1 myadminuser    smbsh       12288 Dec 11 20:53 /srv/windows-os/Program\ Files
 85774   20 drwxrwx---   1 myadminuser    smbsh       20480 Dec 11 20:53 /srv/windows-os/Program\ Files\ (x86)
112287    8 drwxrwx---   1 myadminuser    smbsh        8192 Dec 11 20:52 /srv/windows-os/ProgramData
 22087    0 drwxrwx---   1 myadminuser    smbsh           0 Apr  6  2013 /srv/windows-os/Recovery
 15974   16 drwxrwx---   1 myadminuser    smbsh       16384 Dec 11 22:39 /srv/windows-os/System\ Volume\ Information
119943    4 drwxrwx---   1 myadminuser    smbsh        4096 Dec 11 20:51 /srv/windows-os/Users
120384   24 drwxrwx---   1 myadminuser    smbsh       24576 Dec 11 20:34 /srv/windows-os/Windows
     2    4 drwxrwx---  15 myadminuser    smbsh        4096 Mar  8 16:29 /srv/download-a
79953921    4 drwxrwx---   2 myadminuser    smbsh        4096 Mar 19 01:06 /srv/download-a/series_mp4
106168321    4 drwxrwx---   2 myadminuser    smbsh        4096 Mar 19 03:07 /srv/download-a/.downloading
107216897    4 drwxrwx---   7 myadminuser    smbsh        4096 Dec  1 00:41 /srv/download-a/transmission
120324097    4 drwxrwx---   7 myadminuser    smbsh        4096 Mar 12 09:42 /srv/download-a/series_season
70254593    4 drwxrwx---   9 myadminuser    smbsh        4096 Dec  1 00:43 /srv/download-a/music
    11   16 drwx------   2 root     root        16384 Dec 20 20:00 /srv/download-a/lost+found
13893633    4 drwxrwx---   2 myadminuser    smbsh        4096 Feb  9 18:00 /srv/download-a/other
116391937    4 drwxrwx---   4 myadminuser    smbsh        4096 Mar 12 00:23 /srv/download-a/movies
81264641    4 drwxrwx---   4 myadminuser    smbsh        4096 Feb  9 17:59 /srv/download-a/.downloaded
65011713    4 drwxrwx---   5 myadminuser    smbsh        4096 Jan  5 01:32 /srv/download-a/sickbeard
41680897    4 drwxrwx---   4 myadminuser    smbsh        4096 Feb  7 22:23 /srv/download-a/flexget
7077889   20 drwxrwx---   2 myadminuser    smbsh       20480 Mar 19 03:07 /srv/download-a/series
57933825    4 drwxrwx---   2 myadminuser    smbsh        4096 Jan  5 00:14 /srv/download-a/.watching
     5   16 drwxrwxr-x   1 myadminuser    smbsh       16384 Mar 11 19:58 /srv/movies-b
  1874    4 drwxrwxr-x   1 myadminuser    smbsh        4096 Mar  8 17:23 /srv/movies-b/ACTION
    42    4 drwxrwxr-x   1 myadminuser    smbsh        4096 Mar  8 17:25 /srv/movies-b/ANIMATION
  1902    4 drwxrwxr-x   1 myadminuser    smbsh        4096 Jan  4 23:23 /srv/movies-b/COMEDY
  1873    4 drwxrwxr-x   1 myadminuser    smbsh        4096 Mar 11 19:58 /srv/movies-b/COMICS
  1877    4 drwxrwxr-x   1 myadminuser    smbsh        4096 Jan  4 23:23 /srv/movies-b/CRIME
  1869    4 drwxrwxr-x   1 myadminuser    smbsh        4096 Mar  8 17:28 /srv/movies-b/DRAMA
    52    4 drwxrwxr-x   1 myadminuser    smbsh        4096 Mar  8 17:29 /srv/movies-b/EASTERN
  1867    4 drwxrwxr-x   1 myadminuser    smbsh        4096 Jan  4 23:23 /srv/movies-b/HISTORY
  1657    4 drwxrwxr-x   1 myadminuser    smbsh        4096 Mar  8 17:34 /srv/movies-b/QUENTIN\ TARANTINO
  1868    4 drwxrwxr-x   1 myadminuser    smbsh        4096 Mar  8 17:34 /srv/movies-b/SCI-FI
  1875    4 drwxrwxr-x   1 myadminuser    smbsh        4096 Mar  8 17:41 /srv/movies-b/SPORT
  1870    4 drwxrwxr-x   1 myadminuser    smbsh        4096 Mar  8 17:43 /srv/movies-b/THRILLER
    65    1 -rwxrwxr-x   1 myadminuser    smbsh          96 Mar 11 19:58 /srv/movies-b/View.xml
  1936    4 drwxrwxr-x   1 myadminuser    smbsh        4096 Jan  4 23:23 /srv/movies-b/WAR
  1663    4 drwxrwxr-x   1 myadminuser    smbsh        4096 Mar  8 18:14 /srv/movies-b/WESTERN
     2    4 drwxrwx---   3 myadminuser    smbsh        4096 Mar  4 18:26 /srv/download-b
    11   16 drwx------   2 root     root        16384 Dec 15 22:52 /srv/download-b/lost+found

So I feel like this output deserves some explication

First of all, the (ex) Windows partitions, I converted this desktop from Windows 7 workstation to a Ubuntu Home/File Server. In case I'd ever need one of my old files, I mounted the old partitions and made them available through samba.
Second of all, my movies and my downloads require most space so I took two drives for each of them. For movies I have a drive for seen movies that I'd like to keep and a drive for unseen movies. For downloads I have one drive to be used as short term storage (e.g. single episode torrents) and one for long term storage (e.g. my own uploads). The backup scripts are not yet in place so that one is empty for now. Finally, for the last mountpoint, the name "documents" is not perfectly chosen but this is meant to be a collection of all other things I'd like to share. Eventually each sub directory should be a Samba share. I hope that's clear?

Then the command with "all my users and groups".

smbsh:x:2000:user1,user2,plex
debian-transmission:x:118:myadminuser,user1

Regarding the groups, I'm open for new ideas...

Now what I want...

User
Directory
Local
Samba
NFS
SFTP

myadminuser
/srv
rwx
N/A
N/A
N/A

user1
/srv
N/A
rwx
N/A
rw-

user2
/srv/movies-a
N/A
r-x
N/A
N/A


/srv/movies-b
N/A
r-x
N/A
N/A


/srv/documents/series
N/A
r-x
N/A
N/A


/srv/documents/pictures
N/A
rwx
N/A
N/A


/srv/documents/user1
N/A
rwx
N/A
N/A


/srv/documents/music
N/A
r-x
N/A
N/A


/srv/documents/documents
N/A
rwx
N/A
N/A

mediaplayer
/srv/movies-a
N/A
r-x
r-x
N/A


/srv/movies-b
N/A
r-x
r-x
N/A


/srv/documents/series
N/A
r-x
r-x
N/A


/srv/documents/pictures
N/A
r-x
r-x
N/A


/srv/documents/music
N/A
r-x
r-x
N/A

plex
/srv/movies-a
r-x
N/A
N/A
N/A


/srv/movies-b
r-x
N/A
N/A
N/A


/srv/documents/series
r-x
N/A
N/A
N/A


/srv/documents/pictures
r-x
N/A
N/A
N/A


/srv/documents/music
r-x
N/A
N/A
N/A

transmission
/srv/download-a/.downloading
rw-
N/A
N/A
N/A


/srv/download-a/.downloaded
rw-
N/A
N/A
N/A

So, in short, I have the local admin user which I use solely to administer the server through SSH. Then I have my regular user for file access through Samba and SFTP (a.t.m. only meant for me). Then there is my girlfriend who only should have limited access to certain shares and to other she can have full access. Then there is the plex user who only needs to have read and execute permissions locally (I think). I also have my mede8er for which I want a separate user witch read and execute permissions to all the media files (except for downloads ofc.) through both Samba as NFS. And at last I'd like transmission to run as a separate user with read and write access to the folders it writes to.
If possible I'd like the whole thing to be future proof, if I'd ever want to add access through SCP (not likely) then (for example) I'd like to be able to specify the permissions per user.

I hope I'm not asking too much? If you'd have any more questions, please do not hesitate to ask me