5

I am in charge of a small nfs network and I would like to set the machines to perform different mounts depending on which user logs in. Is this possible?

For example, if user A logs in I want them to see /home/users only and if user B logs in I want them to see /home/users and /home/penguins.

I know I could do this using group permissions but for added security I would be interested if /home/penguins can simply not be mounted at all of user A logs in.

5 Answers 5

2

Have a look at libpam-mount. It basically performs mounting tasks for a user session (while automount mounts when a mount point folder is stat'd).

From the project page:

This module is aimed at environments with central file servers that a user wishes to mount on login and unmount on logout, such as (semi-)diskless stations where many users can logon and where statically mounting the entire /home from a server is a security risk, or listing all possible volumes in /etc/fstab is not feasible.

Normally I would suggest to use autofs with mount tables loaded from LDAP, or in your case the somewhat rusty NIS. But, as it is important to you to not mount things for specific multiple users instead of relying on permissions, autofs is not for you (although it most likely is possible).

Also, I would like to point out, that just not mounting exports is hardly a security measure.

1

Your question is not very well defined, because the notion of logging in isn't very clearly defined. A user may start and stop processes at any time (e.g. from cron). Multiple users may be logged on at the same time - which mounts should be in effect in that case?

I suspect what you really want is for processes running as different users to see different filesystem mounts, even when those processes are running at the same time.

Linux can do this with bindfs.

  1. mount all file systems somewhere (user-independently), without granting access to the users in question
  2. use bindfs to remount them where users will access them (user-dependently)
0

You don't need automount. Just set up the relevant lines in fstab, allowing the mounts in question to be mounted by users (the user option in fstab). Then, edit each user's ~/.profile to add the mount command there. That way, each time the user logs in, the correct drive will be mounted.

If you want to use automount, you can set it up so that the mounts are mounted in each user's home directory. Then, when the user logs in and accesses her $HOME, autofs will mount the drives, or partitions or whatever it is you are mounting.

7
  • How can you read ~/.profile when /home/username is not mounted... Also what if "small nfs network" means 30 to 100 users?
    – Tuim
    Jan 23, 2013 at 11:25
  • The question said home/users. If home/username is not mounted, the user can't log in anyway. Perhaps, as you suggest, autofs will fix that and mount ~/ on demand but I have not tried that. As for setting it up for 100 users, that is trivial, that's what scripting is for.
    – terdon
    Jan 23, 2013 at 11:32
  • @terdon Would this actually prevent user A from mounting /home/penguins? This is what I would like the result to be.
    – Simd
    Jan 23, 2013 at 13:21
  • @felipa, no it wouldn't. It would just cause penguins to not be mounted automatically. Sorry.
    – terdon
    Jan 23, 2013 at 13:38
  • This has a chicken and egg problem: ~/.profile does not exist when ~ is not mounted. Also, processes may need files in ~ while the user is not logged in. Mar 23, 2016 at 11:57
0

Look into using automount from autofs http://www.autofs.org/

A simple way to set this up on Ubuntu is like so:

apt-get install nfs-common autofs

add /home /etc/auto.home to /etc/auto.master
add * nfsserver:/share/& to /etc/auto.home

12
  • How can you use automount to mount on a per user basis?
    – Simd
    Jan 23, 2013 at 11:12
  • I have updated my answer.
    – Tuim
    Jan 23, 2013 at 11:30
  • Sorry to be dim but how do you specify the per user part? I want user A to be prevented from mounting /home/penguins.
    – Simd
    Jan 23, 2013 at 13:20
  • autofs does this automatically for you. You could also add joe fileserver.example.com:/export/home/joe for a user named Joe but using the wildcard and & allows for easy integration of new users.
    – Tuim
    Jan 23, 2013 at 13:22
  • Oh maybe I didn't explain something properly. All the users can log in to all the machines (using YP). I want the mount to be different depending on who logs in.
    – Simd
    Jan 23, 2013 at 15:54
-1

It seems rather simple if one uses the manual "mount" command inside each user's .profile. This lets the individually focused mount be activated when that specific user logs in with his/her ID and password.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .