How do I stop OVM from giving RW rights to anyone on the LAN?

Posted by Niouke@reddit | linuxadmin | View on Reddit | 16 comments

My context is a home filesharing server, and I would like to stop my family from deleting important stuff by error, and ideally to stop them from accessing some files.

My question is for both NFS or SMB access, my goal is have a couple login/pass combos with different RW rights for different shares. From my understanding a lot rides on UID's, but It is a hassle to setup custom groups and users with weird IDs on the clients with no real security gains. Likewise making a IP whitelist is simple but doesn't protect me from accidental deleting.

Is it possible to prompt the windows/linux clients with a login/pass request before accessing anything?

[-]

rb_vs@reddit

Suggesting LDAP or Kerberos for a home family share is massive overkill. You don't need a domain controller to stop accidental deletions.

The simplest way to handle this in OMV is to separate share permissions from filesystem permissions (ACLs).

1) SMB/NFS level: set the family share to read only for their specific user accounts. This forces a password prompt on Windows/Linux if they try to write/delete.

2) Filesystem level: use the sticky bit on your important folders. Just like the /tmp directory in Linux, the sticky bit allows users to write files but prevents them from deleting or renaming files they didn't create.

3) The recycle bin trick: in OMV’s SMB settings, enable the recycle bin for that share. If they do delete something by error, it isn't purged from the disk, it just moves to a hidden .recycle folder that only you have access to.

This solves your accidental deletion problem without you having to manage UIDs across every client or setting up an enterprise auth server.

[-]

Fun-Currency-5711@reddit

Probably an overkill but wouldn’t ldap work?

[-]

altodor@reddit

I was actually going to suggest Kerberos. One of the auth methods NFS and SMB both share support for is Kerberos. If LDAP is overkill Kerberos is double extra overkill, but it sure is what solves the problem.

[-]