0

Our company has a need to share data with some partners we have and while discussing how to best implement this we decided we would make guest user accounts on our Linux (ubuntu) fileserver where our data folders are mounted from a NAS via NFS wher then our partners could login via SSH and read or write data depending what we permit for each of our partners.

Until now users on our network have simply mounted the folders they need, either via NFS, SMB or AFP and everything is RW permitted. But now we need more complex permissions.

The files on our fileserver are now mounted via NFS and for complex permission to work i believe we need to have matching UID's and GID's for them to work (ie. uid's and gui's need to match on NAS and the fileserver) but we are afraid this is too complex, since we would have to match UID's and GID's on several (10+) systems and we fear we will break many already working setups we have while doing this (autofs mounts for example might break completely on several of our server where /home directories auto automounted from NAS).

So the question is, can anyone recommend a different setup how this would be more easily accomplished?

Improve this question
1

1 Answer 1

Reset to default
0

Once you give ssh access, you practically open doors for anything and everything a non-root user can do on the network, within the user/group permission of course.

Not sure how this is related to nfs. Since you are not giving nfs access directly, you can restrict nfs access to the ssh account and machine you setup locally.

Unless my understanding is that you are allowing partner machines in your LAN. Not sure that's prudent.

Without understanding the whole picture, it's hard to give specific advice. You may try hiring a consultant for this.

Improve this answer
2
  • Access for the quest accounts on the filesever will be limited just to the shared data and we are not really worried about ssh anyway. The problem is specific on how can we best set permission for the (currently) nfs mounted data folders (which tehre are MANY). The shares dont have to be NFS, if permissions are easier to set on SMB, we can do that, we just dont have enough experience in this to know whats the best solution.
    – Nanoni
    Apr 7, 2018 at 6:36
  • Another idea we had, after my OP, was to create a new VM and there we can setup just the few quest accounts we need with matching UID & GID with the NAS, then NFS share permission would go by whats defiend for those UID's & GID's on our NAS right? What do you think about this?
    – Nanoni
    Apr 7, 2018 at 6:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .