Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[savas]

First of all, sorry if this has already been answered, I couldn't find a proper explanation, so if there is one, please just link me to it. Also I fully read the tips/help on the side.

I'm trying to figure out what best way to set up my users and groups and for that I want to know how exactly this users and group permission works.

Does group permissions do the work for me and configures all the users in the group to match the group permissions or is the group permissions controlling the access of all the users and basically overrides whatever was set?

If I only allow a group to read a folder, (not have write access), but then i give the user write access within the same group, which permission does it follow? Or vise versa with other combinations..

What is "Deny Access"? I assumed everything was denied access until I gave it access specifically? How does this work?

Thanks.

[priitv8]

User's permissions take precedence over group permissions.
See slide 5-6 on page 80

[savas]

Permission Precedence
● If UID matches, user permissions
apply
● Otherwise, if GID matches,
group permissions apply
● If neither match, other
permissions apply

And what about Deny Access?

[priitv8]

And what about Deny Access?

Purely deductively - Deny Access ought to have highest precedence. Upon closer inspection however, my earlier quote won't help you much, because the filesystem ownerships seem not to be tied to Network Share access rights at all. Seems so, that the authorisation to network share objects is built on a higher level, than Linux filesystem.

[killinjoe]

ok. i'm in a somewhat different predicament here.

I created e "friends" users group with a "read only" access to some folders on my DNS-325.

trouble is, they have a read/write access when accessing  the shares via the web File Server online app (didn't check the FTP because I can't right now)...

what the h*** ?

I check the settings, but everything is as it should be.

please help.

[killinjoe]

up.

[priitv8]

Are you sure this Web-FS is the right tool to give in the hands of guests?
Wouldn't WebDAV be more appropriate?

[killinjoe]

you're totally right. but I can't figure out how to bar access to it to my guests.

I do want to make this app for-my-eyes only.

do you know how ?

[priitv8]

I do want to make this app for-my-eyes only.
do you know how ?

Well, not exactly. But I have solved it simply: I just don't allow anyone else to log in to Web-Admin interface of my NAS.
All my guests use file sharing one way or another. I've opted for AFP, SMB and WebDAV.
The latter runs over normal HTTPS so should pass anywhere HTTPS is allowed to.

[killinjoe]

please forgive my exceptionnal thickness, but how do you forbid access to the web-admin interface ?

[priitv8]

please forgive my exceptionnal thickness, but how do you forbid access to the web-admin interface ?

Pardon my pun
You're right, you can't.

[killinjoe]

right. 

so... back to square one.

I guess the only way is to go in as root and erase the bloody malfunctionning app !

It's a major design flaw. I don't understand why D-Link hasn't acted upon it yet. Basically, all my guests can access anything, and do whatever they fancy with it...

[priitv8]

I guess the only way is to go in as root and erase the bloody malfunctionning app !

If you already can go in as root, you might simply change file owners & rights directly in EXT3 filesystem. This works.

[killinjoe]

I can't right now since I did not change anything on the NAS so far. But I know how and will if required, as soon as I get a tiny speck of leisure... Would have liked it to work out-of-the box, though. I don't want to end up having to finetune all the sharing settings one by one.

anyhow, I think this is my only shot at basic security, so ...

thanks.