Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a server fileserver. Fileserver has an NFS export active that is called share.

I have three users that need ssh/sftp access to share through a remote computer fileaccess: user1,user2, and user3.

How would I set it up such that by logging into fileaccess the following permissions would be active, without modifying the file permissions on fileserver?

user1: read, write, execute
user2: read, (execute?)
user3: read, (execute?)

I would like user2 and user3 to be able to browse the folder but not modify its contents at all, while user1 would be able to do whatever they wanted to it.

I have tried mounting share on fileaccess in /mnt/ and then symlinking to everyone's home directory but I can't seem to give user2 and user3 read-only access without also removing user1's permissions as well.

share|improve this question

can you use acl? you can man setfacl for details. this allows you to specify what each user or group can access which directory/file with what permission.

if that command does not exist you can install it from repos. unless your file system is really old, acl should be supported. you might have to specify acl support in mounting however in some cases.

share|improve this answer

Assuming you can chroot the users then you could mount the share multiple times, once in each user's chroot. For the read-only users mount the share with -o ro. If it is impossible to mount the same share multiple times you should be able to use bind mounts but with the caveat discussed at

share|improve this answer
up vote 0 down vote accepted

I ended up making /mnt/read/ and /mnt/write/ and making multiple mounts to the folders I wanted under them, with read and write having appropriate permissions.

I'm not sure about how efficient it is but it is not a very high-load share so I think it works fairly well.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.