Hello !
Getting a bit annoyed with permission issues with samba and sshfs. If someone could give me some input on how to find an other more elegant and secure way to share a folder path owned by root, I would really appreciate it !
Context
- The following folder path is owned by root (docker volume):
/var/lib/docker/volumes/syncthing_data/_data/folder
- The child folders are owned by the user server
/var/lib/docker/volumes/syncthing_data/_data/folder
- The user server is in the
sudoersfile - Server is in the docker groupe
fuse.confhas theuser_allow_otheruncommented
Mount point with sshfs
sudo sshfs server@10.0.0.100:/var/lib/docker/volumes/syncthing_data/_data/folder /home/user/folder -o allow_other
Permission denied
Things I tried
- Adding other options like
gid 0,27,1000uid 0,27,1000default_permissions... - Finding my way through stackoverflow, unix.stackexchange...
Solution I found
- Making a bind mount from the root owned path to a new path owned by server
sudo mount --bind /var/lib/docker/volumes/syncthing_data/_data/folder /home/server/folder
- Mount point with sshfs
sshfs server@10.0.0.100:/home/server/folder /home/user/folder
Question
While the above solution works, It overcomplicates my setup and adds an unecessary mount point to my laptop and fstab.
Isn't there a more elegant solution to work directly with the user server (which has root access) to mount the folder with sshfs directly even if the folder path is owned by root?
I mean the user has root access so something like:
sshfs server@10.0.0.100:/home/server/folder /home/user/folder -o allow_other should work even if the first part of the path is owned by root.
Changing owner/permission of the path recursively is out of question !
Thank you for your insights !
The easiest setup I tried so far is to simply put your docker container's volume on an external path, e.g.
/mnt/hdd1/some-directory, instead of putting it in the standard docker location (/var/lib/docker/volume). You'll have full control over ACL on those custom paths.Heyyy !
Thank you, that's actually a good workaround ! Haven't though about it !
In case you're interested @Successful_Try543@feddit.de pointed to the right direction with sshfs.
Adding the following line in sudoers file after @includedir /etc/sudoers.d:
server ALL = NOPASSWD: /usr/lib/openssh/sftp-serverThis works, even tough I'm not sure if this is actually good security practice :/.
I will keep in mind your solution if I find out that this workaround is bad practice. What's your opinion on this?
Thank you !
So the workaround is running the SFTP process as root?
Why not run the SFTP server as a docker container as well (e.g. with https://hub.docker.com/r/atmoz/sftp/ )? You can mount the same volume in the SFTP container, and have it listen on some random port. Just make sure to configure the SFTP container to use the same uid:gid as the one used in the syncthing container to avoid file permission issues.
The solutions you've proposed definitely are more elegant and I'd prefer either of these over my quick and dirty solution.
The question is: How frequently is this needed? If its on a regular basis, then the workaround using bind or selecting a different storage path are preferable. If it's needed even more frequently, setting up the Docker SFTP container is an acceptable extra work.
In that case, perhaps replacing
-o sftp_server="/usr/bin/sudo /usr/lib/openssh/sftp-server"with-o sftp_server="/usr/bin/sudo -u <syncthing_user> /usr/lib/openssh/sftp-server"is a good compromise?Yes, the permissions of <syncthing_user> should be sufficient. I was not aware, that OP might not really need root access.
Hey thank you for the nice tip ! This looks actually promising and exactly what I needed !
Going with this route, which seems way more secure. Fiddling with sudoers permissions seems a bad idea in the first place !
Thank you very much 👋