Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

for some projects, i need to share confidental files between our local staff and some external partners. the number of humans from the external partners is not yet determined (and might changed during the lifecycle of the project)

the local staff should be able to access the data via ssh/sftp and samba/CIFS, the remote partners will have to do with sftp-access.

all files must be readable&writeable by selected participants, and they must only be readable/writeable by these.

additionally, some files need to be rw-accessible only by local staff (not by our partners).

the system consists of a fileserver (XFS), which exports disk-space for the project via NFS3/4 to a public "login"-server (ssh) and via samba to the local workstations.

my original plan was:

  • have only a single user-account ("ext-foo") for the external partners, that solely allows key-based authentication; thus i can easily grant/revoke users access to the data without having to create accounts for them

  • restrict access for this single account via scponly (and if need be, via a chroot jail)

  • the remote partners only see a sub-directory of the actual project-directories

  • the remote partners should only be able to upload/access files in the project-directory

  • for the local staff, access should be granted via group-membership.

  • all shared data should belong to the same group, and the group should have rwX permissions on all shared data.

i tried using ACLs for enforcing the group-membership of each file/directory in the project-directory:

$ sudo setfacl -d -m group:foo:rwx /projects/foo
$ sudo setfacl -m group:foo:rwx /projects/foo

$ getfacl /projects/foo
# file: /projects/foo
# owner: root
# group: foo
# flags: -s-

$ find /projects/foo -exec ls -ld \{\} \;
drwxrws--- 3 root    foo  12 ... /projects/foo
drwxrws--- 3 foo-ext foo  19 ... /projects/foo/ext-foo
drwx------ 2 foo-ext foo  10 ... /projects/foo/ext-foo/.ssh/
drw------- 1 foo-ext foo 397 ... /projects/foo/ext-foo/.ssh/authorized_keys

$ getent passwd ext-foo
ext-foo:x:5000:100:external project user,,,:/projects/foo/ext-foo;/usr/bin/scponly

the local users who access the data via smb/CIFS will simply be presented with a samba-share that forces the group to foo:

# samba config snippet
   writable = yes
   browseable = yes
   path = /projects/foo
   public = yes
   force directory mode = 0770
   force create mode = 0660
   valid users = @foo
   force group = foo
   directory mask = 1770
   create mask = 0660
   security mask = 0770
   directory security mask = 0770

now the problem is, that wehn i try to ssh into the the machine, key-authentication is refused because the HOME-directory of foo-ext is writeable by the group foo, which ssh considers a security risk. i agree that in most cases it is a security risk, but how am i to give read/write permissions to both internal users and the single ssh-user with key-authentication?

share|improve this question

migrated from Sep 25 '13 at 4:49

This question came from our site for computer enthusiasts and power users.

Don't do this at all. Give everyone a separate user account. – Michael Hampton Sep 25 '13 at 13:26
@MichaelHampton care to explain? – umläute Sep 26 '13 at 8:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.