Red Hat

Hello,

I've inherited an NFS setup that allows external servers to write to an NFS share on a Centos box. Here is an example line from /etc/exports (there are four entries that only are different based on server IP adress).

/exports/foobar 10.3.14.15/255.255.255.255(rw,insecure,async,all_squash,anonuid=296,anongid=296)

(296="anonid" for both user and group)

Here's the entry from "exportfs -v":
/exports/foobar

10.3.14.15/255.255.255.255(rw,async,wdelay,insecure,root_squash,all_squash,no_subtree_check,anonuid=296,anongid =296)

The files and directories on that share are all owned by anonid:anonid.

I've had a request to make a local user (I'll call it "bobsmith") to the NFS server which will have full access to everything under "/exports/foobar/" (in order to perform cronned and manual clean-up tasks on the data).

I admit I am not very versed with NFS, but I'm good with Unix/Linux and usual permission assignment. I am just wary of changing permissions on the local directories and files to make this access possible to "bobsmith" for fear that it will affect or be affected by the changes done to data by remote access.

Any advice on this? Perhaps something simple I am missing in my knowledge?

Thanks!

Why not add bobsmith to the group ownership of the directory?

As mark suggested adding the user bobsmith to anongid group will do what you want. But, if anongid is owner of other directories as well and if you don't want bobsmith to have a peek on those other directories, you could probably implement ACL locally. Note, that you may need to remount the filesystem with acl option if it's not already enabled in /etc/fstab.

Code:

setfacl -m d:u:bobsmith:rwx /export/foobar

Sorry I took so long to get back to this. You hit the nail on the head, and my fault for not adding that to the original post. There is one directory underneath the export that the bobsmith user should not have access to for this cleanup.

Thanks, I'll look deeper at setfacl!

In this case, you can do an explicit deny on the folder:

Code:

setfacl -m u:bobsmith:--- /export/foobar/secret_folder