3

I have a 4TB external hard drive connected to an Linux server.

The fstab permissions on this drive are set so that only one particular non-root user has access to it:

/dev/disk/by-uuid/CEE0476DE0388DA9/ /mnt/USBexternal ntfs-3g defaults,auto,uid=51343,gid=50432,umask=077 0 0

From a remote location, this user has been successful at doing rsync backups to this external hard drive.

However, the external drive doesn't stay mounted as reliably as an internal hard drive does. Every couple of days I'm having to login as root do this command:

mount -a

I would like to give this user the ability to mount this drive, but when the non-root user does mount -a, it tells them they do not have permission to do this:

nonrootuser@server:~$ mount -a mount: only root can do that

When the non-root user tries to mount this drive specifically, it tells them it is already mounted (even though it isn't):

nonrootuser@server:~$ mount /mnt/USBexternal/ mount: according to mtab, /dev/sdb1 is already mounted on /mnt/USBexternal

As mentioned, the drive is not actually mounted, but (because of the output above) if the non-root user tries to unmount the drive, it says their request disagrees with fstab:

nonrootuser@server:~$ umount /mnt/USBexternal/ umount: /mnt/USBexternal/ mount disagrees with the fstab

How can I permit this user the ability to mount this drive, without giving them any other administrative powers?

Improve this question
9
  • 1
    check setfacl. You can give permissions to the user to only the level for which they need. Commented Mar 5, 2014 at 17:35
  • 1
    Can you show us what the fstab entry looks like? Commented Mar 5, 2014 at 18:00
  • 1
    It's unusual for a filesystem to become unmounted while still having an entry in mtab. One reason this can happen is if the kernel detects an inconsistency and unmounts it itself. Can you check for any errors for this fs or drive in /var/log/syslog and /var/log/messages? Commented Mar 5, 2014 at 20:20
  • 1
    That entry from collectd might just mean that the filesystem wasn't mounted when it checked. See if there are log entries that have the string kernel or ntfs-3g or fuse in them and look like errors. One possibility is that the drive is going offline, so there may be some chatter about usb disconnections. Commented Mar 6, 2014 at 15:57
  • 1
    There also ought to be a command to run the equivalent of an fsck on the ntfs filesystem (do this only when it's not mounted); hopefully someone else reading this can recommend something. Commented Mar 6, 2014 at 16:01

2 Answers 2

Reset to default
3

You can setup an entry in the /etc/sudoers file for this user to be able to use the mount command. Add something like the following to the end of the /etc/sudoers file:

username ALL=NOPASSWD: /usr/bin/mount, /sbin/mount.ntfs-3g, /usr/bin/umount

Be sure that the exact path to each executable is correct for your system. For example, your mount command might be in /bin instead of /usr/bin.

Adding the mount.ntfs-3g part is important to provide that access for the user. I can see in your mount command that you are using a ntfs-3g filesystem type.

You could, instead, create a shell script to handle the mounting/unmounting and place that in your sudoers file. For example:

create /usr/local/bin/mount-ntfs-drive script:

#!/bin/bash device_path="/dev/disk/by-uuid/CEE0476DE0388DA9/" mount_point="/mnt/USBexternal" if [ "$1" = "-u" ] ; then # do unmount /bin/umount $mount_point else # do mount /bin/mount $device_path $mount_point fi

edit /etc/sudoers file:

username ALL=NOPASSWD: /usr/local/bin/mount-ntfs-drive

Be sure to do chmod +x /usr/local/bin/mount-ntfs-drive. Also, when your user runs the file, they will need to use the fully qualified path for it to work. It might work from their path but not sure.

sudo /usr/local/bin/mount-ntfs-drive

Improve this answer
4
  • Thanks for specific details on achieving this. I suspect that limiting this user's mount-ability to one specific mount-point is too difficult to achieve, but would like to know your thoughts. You see, to me it seems like what you're suggesting would also give the user the ability (if malicious) to mount and umount things outside the scope of this specific external drive. What are your thoughts? Commented Mar 6, 2014 at 15:22
  • I added this line to the /etc/sudoers file: actualusername ALL=NOPASSWD: /bin/mount, /sbin/mount.ntfs-3g, /bin/umount but, even after a reboot, the user cannot mount -a. Commented Mar 6, 2014 at 15:58
  • 1
    you could create a shell script that will do the mounting and unmounting and place that in your sudoers file. I'll update my answer with the details. Commented Mar 6, 2014 at 16:14
  • That did indeed work, when I was typing "mount -a" for this non-root user, I should have been typing "sudo mount -a" Thanks again for your help. Commented Mar 6, 2014 at 20:47
3

You could write a script which checks whether the connection is broken and does the necessary clean-up in that case. This script could be executed every 30 minutes as root by cron.

Maybe is disappears from /proc/mounts when the kernel detects that the device has gone. If not then the script could simply try to create a file on the mounted volume.

That would avoid the problem situation you described.

A different approach is to not use the user feature of fstab but use sudo instead so that the user can run a script with superuser privilege which does both the clean-up (if necessary) and the mount.

Improve this answer
10
  • 0,15,30,45 * * * * date >> /mnt/USBexternal/mountStamps.txt ### I tried this cron writing to the drive every 15 minutes, but this didn't fix the issue. Commented Mar 5, 2014 at 17:48
  • 1
    @Lonniebiz "Every 15 minutes" can be written as */15, too. This was not intended to prevent losing the connection to the device (which should not happen BTW) but to detect the connection loss. Commented Mar 5, 2014 at 17:52
  • Instead of scheduling a cron, it would be ideal if I could permit the user to ensure the drive is mounted before they attempt their backup. Actually, they are initiating this backup via cron on their remote machine (I left that part out to simplify the question). It would be nice if they could add one line to the top of their backup script that would ensure this remote external drive was indeed mounted. Commented Mar 5, 2014 at 17:58
  • 1
    @Lonniebiz That is a really strange argument as (1) fstab is usually world-readable, (2) so is /proc/mounts (and /proc/partitions), and (3) lsusb can be executed by ordinary users (/sys is readable for them, too). (4) The only thing ordinary users usually cannot read is /etc/sudoers... Commented Mar 5, 2014 at 18:33
  • 1
    @Lonniebiz It seems you don't know how sudo works. Given that it is not only a solution for this case but also in general a tool of great importance you really should have a look at man sudoers. Commented Mar 5, 2014 at 19:00

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.