Debian – Fuse, how to set the user that owns the directory

autofsdebiansshfs

I'm having some permissions issues on a Fuse mounted directory and I'm a bit confused about how to set the owner. I have a media directory on a server that apache uses to create and serve some user generated files (it's a Django user media directory). On this server everything from the directory to the files is owned by www-data which is correct. On a secondary server which is a clone of the first one I use Fuse to mount the directory with autofs but everything is owned by the user of this server, not by www-data which is problematic since apache can't write there. In my auto.sshfs I use this:

mountpoint   -fstype=fuse,rw,nodev,nonempty,allow_other,reconnect,uid=1000,gid=1000,max_read=65536,compression=yes,auto_cache,no_check_root,kernel_cache :sshfs\#server1@server1:/home/server1/user_media

I use uid and gid of the remote user. I've read that idmap would allow both sides to read write but may be I should use uid of www-data. Anyway on the second server the files should belong to www-data just like on the first server but I'm not sure how to do that and I can't really fool around with the production servers. Any light is welcome!

EDIT:
I changed the user uid and gid to apache and indeed the new files / directories are created by this user now but what is even stranger is that if I log as apache and go to the directory and try to create files / directories I get a permission denied. Anybody knows what is going on?

Best Answer

I had the same problem. In my case, encrypted data container at /home/.mysql was owned by root:root. It was mounted with mysql uid and gid, so technically, owner of mounted directory was mysql user, but behind it was encrypted container owned by root. That's why encfs complained about permission denied.

Related Solutions

Linux File Permissions – Best Way to Handle Apache 2’s www-data User in /var/www

Attempting to expand on @Zoredache's answer, as I give this a go myself:

Create a new group (www-pub) and add the users to that group

groupadd www-pub

usermod -a -G www-pub usera ## must use -a to append to existing groups

usermod -a -G www-pub userb

groups usera ## display groups for user
Change the ownership of everything under /var/www to root:www-pub

chown -R root:www-pub /var/www ## -R for recursive
Change the permissions of all the folders to 2775

chmod 2775 /var/www ## 2=set group id, 7=rwx for owner (root), 7=rwx for group (www-pub), 5=rx for world (including apache www-data user)

Set group ID (SETGID) bit (2) causes the group (www-pub) to be copied to all new files/folders created in that folder. Other options are SETUID (4) to copy the user id, and STICKY (1) which I think lets only the owner delete files.

There's a -R recursive option, but that won't discriminate between files and folders, so you have to use find, like so:

find /var/www -type d -exec chmod 2775 {} +
Change all the files to 0664

find /var/www -type f -exec chmod 0664 {} +
Change the umask for your users to 0002

The umask controls the default file creation permissions, 0002 means files will have 664 and directories 775. Setting this (by editing the umask line at the bottom of /etc/profile in my case) means files created by one user will be writable by other users in the www-group without needing to chmod them.

Test all this by creating a file and directory and verifying the owner, group and permissions with ls -l.

Note: You'll need to logout/in for changes to your groups to take effect!

Linux – Why doesn’t SSHFS let me look into a mounted directory

I've found the answer myself. The problem was that I didn't use the option allow_other.

sshfs -o allow_other -o kernel_cache -o auto_cache -o reconnect \
  -o compression=no -o cache_timeout=600 -o ServerAliveInterval=15 \
  xxx@yyy.yyy.yyy.yyy:/mnt/content /home/xxx/path_to/content

To use this option you have to set the option user_allow_other in /etc/fuse.conf. When I did this I had another problem. The file /etc/fuse.conf haven't had read permissions for other users on my Ubuntu box. So I've changed that too and now I can access the directory with any user.

Best Answer

Related Solutions

Linux File Permissions – Best Way to Handle Apache 2’s www-data User in /var/www

Linux – Why doesn’t SSHFS let me look into a mounted directory

Related Topic