Linux: How to optimally configure data partition on multi user system (including LDAP users)?

Question

How to set up a linux computer such that every user having either a local or a LDAP account can use the same data partition.

I would need the following behaviour:

Every user can
1. create a folder / files
2. delete only files / folders created by himself
3. read / execute all files from all users

In the case of users with local accounts I was doing this:

sudo mkdir /media/data 
sudo bash -c 'echo /dev/sdb1 /media/data ext4 defaults 0 0 >> /etc/fstab' 
sudo mount -a 
sudo chown :users /media/data
sudo chmod g+rw /media/data

which corresponds to

# create a folder to mount data partition
# create fstab entry to mount data partition (/dev/sdb1) into that folder
# mount folder
# assign group 'users' to parent folder
# give group read write permissions

The only thing left was to manually add every local user to the group users:

sudo adduser myUser users

Now we added LDAP to the machine. Does anyone know how to keep the desired behaviour but without having to manually assign every LDAP user (too many) to the group users?

Answer 1

You can use pam_group to add users to the users group on demand (dynamically). (Although it's outside the scope of your question, if you were to couple this with pam_mkhome to create new users' home directories you could have the system almost self-managing.)

The PAM subsystem (Pluggable Authentication Modules) is responsible for authentication and authorisation. It's wonderfully extensible (and consequently somewhat complex) even to the point of being able to run a shell script to validate someone's login. In this situation we are simply going to add the user group users to every login session.

You haven't specified which Linux distribution you're using, so I'm going to give a worked example for Debian. I assume you'll be able to map this to your scenario.

1. Open a root shell and leave it open until you know this works.

   Breaking PAM can prevent anyone or anything logging in or even running su/sudo. You may need this root shell to back out a broken change.

2. Configure pam_group by adding this rule to /etc/security/group.conf

   # All services, all ttys, all users, any time
   *; *; *; Al; users
   

3. Configure the PAM "auth" stack to use pam_group. Edit the file /etc/pam.d/common-auth and add this line at the end of the file. On Debian I added it after the block for pam-auth-update

   auth  optional  pam_group.so
   

4. Test a login (local or LDAP), and check that id shows you have users in your group list.

   If you do not, then look at the end of /var/log/auth.log to see what error message was reported from PAM.

Answer 2

Since you do not want to use groups, the only option with regular Linux file permissions is to make it writable by others (all users):

chown root:root /media/data
chmod u=rwx,g=rwx,o=rwxt /media/data

This applies the same permissions as for the /tmp directory and satisfies 1) and 2).

3) is up to the users, but satisfied with an umask set to 022, which is the default on most Linux distros.

Answer 3

You are describing the default behavior of /var/tmp.