1

I have a Linux (Ubuntu 16.04) server that roughly 30 users login to with shell access. There are different groups setup which manages their access to folders within /opt/working/shared/.

/opt/working/shared is backed up daily to /opt/backup/working/shared, an NFS mounted share from a NAS. These get backed up with the same permissions as the original files, yet the users don't get access to /opt/backup. This keeps users from browsing the share, but allows restoring with the original permissions.

I've been asked to provide these users read-only access to the backup area. I'm wondering what the best way to approach this might be?

If I allow them access to /opt/backup as it stands, they will have write access to any file they have write access to in /opt/working/shared, but removing write access to these files will overwrite the original permissions and adding complexity to a restore.

Is there a nice way to perhaps provide read-only access to the backup directories for non sudo'd users, whilst still adhering to original group permissions? This would keep the original permission structure and not allow users to see other peoples files, yet stop users from overwriting their own backups. I feel there's a better way to manage this rather than amending the permissions but I may be wrong.

Improve this question
0

1 Answer 1

Reset to default
2

A minimal and trivial solution would be to mount the same NFS share a second time:

  • with the "ro" mount option to force read-only operations
  • on a location that your users can access

That way you don't have to change anything in how your existing backups are made, no complicated tricks with permissions etc.

Improve this answer
3
  • Thanks, that's actually a fantastic idea! I'll leave this question up a bit longer for other potential suggestions but I think that's exactly what I want to do.
    – jblz
    Apr 23, 2019 at 12:45
  • An alternative can be a read-only bind mount. Effectively the same effect as HBruijn suggested, but without second NFS export entry and mount.
    – kofemann
    Apr 26, 2019 at 20:30
  • Unfortunately HBruijn's approach poses an issue. When I create /opt/backup_ro, set 777 perms to test then mount, mounting overwrites the permissions of backup_ro disallowing user access. I'm then unable to adjust the permissions as root /opt/backup_ro due to it being a 'Read only filesystem'. Is there a way round this? Perhaps only allowing root user to have rw? I've spent the past 45 minutes googling this but can't seem to find out what to do.
    – jblz
    Apr 29, 2019 at 10:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .