Issue with multi-user NAS setup

Question

I want to build a NAS server with multiple users. To test this I created 2 users, pi and pi2. The external drive is mounted in /media/pi. Here is the ls -al output:

drwxrwx--x 4 pi nasusers 4096 NAS

The user pi can make files and folders with no problem. However, if pi2 tries to do this this is the error that I get

mkdir: cannot create directory Permission denied

Both users are members of the nasusers group. Also the test directories and files made with the pi user belong to pi:pi. Shouldn't it be pi:nasusers? Is there any way to make it so that both users can have full access to the NAS drive?

Answer 1

/media/pi is an inappropriate mount point, and is normally used to automount media inserted by a user, which sets permissions.

A server would normally mount a shared directory in /mnt or /www and set access permissions appropriately.

Answer 2

This seems to be a classical unix rights problem. Let's have a look on it. To avoid confusion I set user of /media/NAS to root and then check where is the problem:

pi@raspberry ~$ sudo chown root /media/NAS
pi@raspberry ~$ mkdir /media/NAS/folder-pi   # works
pi@raspberry ~$ su -l pi2                    # login as pi2

pi2@raspberry ~$ mkdir /media/NAS/folder-pi2   # works
pi2@raspberry ~$ mkdir /media/NAS/folder-pi/folder-pi2
mkdir: cannot create directory ‘/media/NAS/folder-pi/folder-pi2’: Permission denied

pi2@raspberrypi:~ $ ls -la /media/NAS/
total 16
drwxrwx--x 4 root nasusers 4096 Mar 29 10:13 .
drwxr-xr-x 3 root root     4096 Mar 29 08:38 ..
drwxr-xr-x 2 pi   pi       4096 Mar 29 10:12 folder-pi
drwxr-xr-x 2 pi2  pi2      4096 Mar 29 10:13 folder-pi2
pi2@raspberrypi:~ $

Here we can see what has happend. Both users are in group nasusers so each can create folders in /media/NAS/. But the created folders get the user and group rights from the user, so pi2 cannot access folder from pi. /media/NAS/folder-pi is not in group nasusers. Also the group rights on the new folders are only read and execute r-x. We have to make sure that the group is inherited from the parent folder. For this we have the sticky bit. Also we have to make that the group gets rwx rights by default. For this is the umask. For it`s meaning look at the internet. Lets do it:

pi2@raspberry ~$ rmdir /media/NAS/folder-pi2
pi2@raspberry ~$ logout
pi@raspberry ~$ rmdir /media/NAS/folder-pi

pi@raspberry ~$ sudo chmod g+s /media/NAS/   # set sticky bit
pi@raspberry ~$ ls -ld /media/NAS/           # it`s set on the group
drwxrws--x 2 root nasusers 4096 Mar 29 10:40 /media/NAS/

pi@raspberry ~$ umask 002   # set umask and check

pi@raspberry ~$ mkdir /media/NAS/folder-pi
pi@raspberry ~$ echo "hello world" >/media/NAS/folder-pi/file.pi
pi@raspberry ~$ su -l pi2

pi2@raspberry ~$ mkdir /media/NAS/folder-pi/folder-pi2
pi2@raspberry ~$ cat /media/NAS/folder-pi/file.pi
hello world
pi2@raspberry ~$ ls -la /media/NAS/folder-pi/
total 16
drwxrwsr-x 3 pi   nasusers 4096 Mar 29 10:59 .
drwxrws--x 3 root nasusers 4096 Mar 29 10:58 ..
-rw-rw-r-- 1 pi   nasusers   12 Mar 29 10:59 file.pi
drwxrwsr-x 2 pi2  nasusers 4096 Mar 29 10:59 folder-pi2
pi2@raspberrypi:~ $

Now it's everything as it should be. For persistent settings of the umask you will find some information in ~/.profile:

# the default umask is set in /etc/profile; for setting the umask
# for ssh logins, install and configure the libpam-umask package.
# umask 022

Setting the default umask has a little disadvantage. It`s global and works also on the filesystem of your pi, so you should have a little look at your group rights there.

And yes, as @Milliways answers you should use /mnt/ instead of /media/.