I am building an SFTP server where I have to give users access to individual dirs on different drives.

I can't use symlinks because that allows them access to everything and cause navigation confusion.

I cant use cp -r because it takes too long and uses too much space.

I cant use cp -al because it won't link across the different devices. It works great if there is only one device though.

Currently I am using "mount --bind" to mount the dirs from the different drives to the user's homedir on the ftp. I made a script that removes old mounts that are no longer required and reinstates mounts after a reboot, without involving fstab.

It seems like a sloppy solution though, and eventually I will have hundreds if not thousands of mounts. Is there a better way to do it or is this acceptable? I Is there is a limit to the number of mount --bind you can have running at once?


How about using ACLs (Access Control Lists) in this case? All the modern filesystems do support ACLs and with them you can grant access to individual directories/files more granularly than with traditional Unix permissions.

For starters, try man setfacl. It has several examples listed.

| improve this answer | |
  • The permissions are fine for the sftp users that access their home directory (without the use of acl). I was asking if the method i'm using to make the mount points persistent (without fstab) is production safe and if i should be concerned about a maximum number of limits with mount --bind for thousands of mount points. Thanks. – user1068118 Mar 19 '12 at 14:27
  • 1
    The solution given by Janne Pikkarainen is a better one because it will scale out better. – Mircea Vutcovici Mar 19 '12 at 14:42

The other answer seems to be the solution to another problem (permissions set to directories that are already there). Your problem sounds like mine though... you have home directories where / is the ftp home rather than the real file system, and you want some parts of the real file system to be in multiple ftp homes.

I had a similar thing... it was a nightmare. It had a few thousand mounts I think. The script was buggy, so it needed tinkering when it stopped working. That wouldn't be such a problem, but unmounting thousands of mounts and remounting takes like 15 minutes. So I redid it with unionfs. Now it uses around 260.

It was done with several 4 disk USB boxes (which we call "the poor man's DAS"). Another problem was the disks would randomly disconnect and need remounting. This meant all the associated mounts needed to be redone too. Unionfs automatically rejoins them into the mount when this happens, so that solved the problem. And I haven't had to bug fix the scripts since I switched it to unionfs. If I ever do a similar thing again with USB disks, I will likely use unionfs combined to an empty directory tree even if it is just one disk, so I can rely on it reconnecting.

In my case, all files were read only, and there were many disks mounted together in many ftp homes, and there were only a 3 different types of users that see different directories, and the disks were the same data set separated by different file types and date in the same directory structure. So I basically only mounted 3 things to each ftp home.

The unionfs mount looks like this:

sudo unionfs-fuse /data/some/local/directory=ro:/mnt/disk1=ro:/mnt/disk2=ro:/mnt/disk3=ro:[...] /mnt/alldisks -o allow_other
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.