Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have decided to repurpose an old grey box computer to be a combination NAS/home media server, headless torrent server, and minecraft server. I am using this both as a practical piece of equipment and as a learning experience with Ubuntu and Linux.

I am having trouble determining the "best practices" for setting up such a server in a secure manner. I have read that it is recommended that each different service or task on a server be given a different user, in order to keep things separated from each other. Is this true?

I would like this computer to offer the following services:

  • Samba and/or NFS (I will be connecting with Mac and Windows clients; should I use only Samba, or both?)
  • transmission-daemon with watched folders
  • The minecraft server

In the future, I may add:

  • Plex media server
  • Subsonic

What would be the proper layout of users and permissions to ensure that, for example, the directory where all my media files live is accessible to all while also keeping each service separated by user account?

Thank you in advance!

share|improve this question

1 Answer 1

I have read that it is recommended that each different service or task on a server be given a different user, in order to keep things separated from each other. Is this true?

Ideally you'll want to do this but it also depends on your setup. Will you have guests over that might want to access a folder on your server? If so you can either share that folder through samba and give it 775 permissions, or you can create a "guest" user and give the folder 770 permissions and have you guests login as "guest" with a preset password.

Samba and/or NFS (I will be connecting with Mac and Windows clients; should I use only Samba, or both?)

If you have Windows computers in the mix you'll have to use Samba, but it's typically slower than NFS. I haven't had good experience with NFS on OSX but both are easy to setup but i'd start with Samba since it works with Windows, and OSX. You can experiment with the NFS if you don't like Samba. However with NFS you'll probably have problems with your UID not matching with your username on the server.

/etc/samba/smb.conf is the file you'll want to edit to share files via samba.

with NFS you'll want to take a look into the /etc/exports file.

What would be the proper layout of users and permissions to ensure that, for example, the directory where all my media files live is accessible to all while also keeping each service separated by user account?

I would create a group (like "users") and when you create new users if you want them to have access to something like the "media" folder make sure they are in the "users" group and make sure the "media" folder is in the "users" group and that the "users" group has access to the "media" folder.

The way i do it on my server which runs a lot of similar programs is like so:

All media is in /opt/media and /opt/media belongs to the "users" group. I then have a few accounts for me and my roommates that are all in the users group. The file permissions for /opt/media are drwsrws--- "s" means that when my roommate "bob" drops a file in /opt/media it automatically belows to the group(users) that the parent dir belongs to. So now the file that "bob" created is owned by "bob" and in the "users" group. This is typically the setup you want when a log of different people are using a shared directory.

What you want to do is a little complex and might change based on how many users are accessing the server and how your network is setup. However hopefully what the above will put you on the right path.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.