Users and permissions for a small home server

Hello community,
I have been using Linux on the desktop for many years now, but unfortunately my knowledge about servers is very limited, almost non-existent. Therefore my question is most probably equally well fitting here and into the newbie corner.
I'm trying to set up a little home server which should be in charge of following tasks:
- CUPS print server in the local network
- access to shared files through NFS in the local network
- backup (again over NFS)
- an Owncloud server
- maybe a mail server in the long run (NSA, paranoia, etc. )
For now I have set up the print server, the NFS server and was working on the Owncloud installation, when Owncloud gave me some errors with users and permissions. So I was led to the idea of rethinking the users and permissions on server. So far there is only the root user who may do everything. This seems like a quite unsafe configuration. I'd like to make it safer. First, the printer, the backup and the locally shared files should be accessible from the local network only. SSH access should also be accessible locally only. The Owncloud file folder should be accessible from the internet, but of course only for the Owncloud users registered to the Owncloud server.
What is the best way to set up users and permissions for such a set up?
Thanks for any hints,
PhotonX

Hi, i think it depends who are you serving for, if you are just serving for a small office or home server or a big organization. The following quick thinking just came to me:
I think cups set automatically a system  user of its own, and runs as it, so no trouble there. Cups also has the option to set users and it uses the system users as default, i think it depends in in how many printers/users your have in your server.Users that can manage cups are in the lp group. 
For nfs every user should have their home, samba is also a good option if you have  windows computer in your network and it integrates better with graphical file  managers like nautilus in the clients side, but it is a hassle to configure.
You should run the web server (owncloud ) as it own user, maybe you can manage to set something up for owncloud in the filesystem, but owncloud uses a database, and the users for owncloud are stored in there, and they are not system users.
You can configure ssh for local use only enabling the corresponding subnets in your /etc/sshd.conf and optionally but recommended you can set a firewall and permissions. You can use iptables but i prefer ufw for simple setup.
I think you should read the wiki:
https://wiki.archlinux.org/index.php/users_and_groups
and the other respective topics in the wiki.
Also as an advice i know that arch linux is a great distribution, but you have to do more work to mantain a stable server. I would recommend debian or another more conservative distro, but of course it is your choice.
Last edited by hydrosIII (2014-11-06 06:26:45)

Similar Messages

  • In weblogic server when I Setting Up a User and Tablespace for the Server M

    In weblogic server when I Setting Up a User and Tablespace for the Server Migration Leasing Table in Sql Plus I got an error. ORA-00972: identifier is too long

    Refer: How to: Grant User Access to a Report Server (Report Manager), but this gives a step-by-step procedure for
    adding users who are a part of the Domain. In your case you are trying to add users who are not a part of the domain, meaning, you are trying to create users only specific to Reporting Services, am I right?
    But Reporting Services either relies on AD to authenticate the users, or you can create a custom-authentication extension to authenticate the users.
    In your case, you might need use a custom security extension, and use that to create/delete/modify users. Check the Forms authentication Sample here:
    http://msftrsprodsamples.codeplex.com/wikipage?title=SS2008%21Security%20Extension%20Sample&referringTitle=Home
    Other references:
    Implementing a Security Extension
    How to: Configure Custom or Forms Authentication in Reporting Services
    Hope this helps
    Chaitanya( Twitter |
    Blogs )
    Any documentation bug? Tell us about it at
    Connect. Please feel free to add any community comments in any of the MSDN/technet articles.
    This posting is provided "AS IS" with no warranties, and confers no rights.
    The next CTP for SQL Server Code Name "Denali" is coming soon.
    Sign up now to be notified of the next CTP release.

  • Looking for a tutorial/design-pattern for Manage User and Permissions.

    Hello,
    I wonder if anyone knows a good tutorial/blog with reference to security - howto Manage Users and Permissions.
    In my application I have GROUPS and each group has access to different RECORDS and CASES.
    Example:
    Groups: Alfa, Beta, Gamma
    Record: R1, R2, R3...
    Case: C100, C200, C300
    Group Alfa can view: R1, R2 and C300
    Group Beta can view: R1, R3, C200, C100, C300,
    Group Gamma can view: R3
    My question is this: what should be the best way (design-pattern?) to force a policy to securing the Records/Cases?
    What should every case/record implemented to verify that a user (part of a group) has the right to access the entity.
    Thank You!

    Sorry if this one is too basic for you but as I do not know your level of experience try:
    http://www.adobe.com/devnet/dreamweaver/articles/first_dynamic_site_pt3_print.html
    HTH
    There are also many other tutorials on:
    http://www.adobe.com/devnet/dreamweaver/application_development.html

  • Dunning form F150- Telefon/fax/mail printing for 1 user and not for other

    Hello expert,
    This is regarding the printing of the dunning form using F150. 
    At first, using company code and account clerk (BUSAB), we retrieve the user id.  The program uses FM BAPI_USER_GET_DETAIL to get the address details of this user id.  The user name, telephone and fax adn email are printed in the dunning form (1st reminder, 2nd reminder and so on).  The problem here is , the address details are printed on the form for one user and not for the other user who is processing.  Any idea regarding this.  Do I need to give any user setting parameter in SU01 or is there any authoriztaion issue which is blocking this.  Awaiting reply,
    Cheers,
    Bala

    I'm having the same problem with Exchange 2003, I can get it to work with Entourage and on my iPhone, but it keeps rejecting my password on Mail.app. If I keep entering the password it starts to update with server, but it won't save the password. IMAP is on for my account which is how it works on iPhone.
    I'm starting to think it has something to do with Keychain Access or Mail.app and not so much Exchange Server. If anyone has found a solution please let me know,
    Thanks

  • SharePoint 2013 - Site Settings - Users and permissions - "Access Request and invitations" link missing

    I am site collection administrator and have configured the outgoing email in Central administration but "Access Request and invitations" link  is missing, pl advice any additional configurations for this link to show up
    I was though able to configure access requests by going to Site Settings->Users and permission and on the ribbon selected "Access Request Settings"
    What is the difference in either of the approaches?
    Thanks
    Abhishek

    Hi there,
    I noticed this post, and didnt really find an appropriate solution to your issue. I noticed the same issue when dealing with Access Requests. First of all to make sure that the Request feature is enabled, you need to access 
    Site Settings -> Site Permissions -> Access Request Settings -> Make sure the
    'Allow access requests' option is enabled.
    The Allow access screen just allows you to enable the feature and also to specify a email address that notifications are sent to. Whereas the 'Access Requests and Invitations' section provides a screen to manage Access Requests and request history.
    I noticed then that the Access Requests and Invitations link under 'User and Permissions' didnt actually appear until someone actually requests to join the site. It seems that this is needed to display the screen. Once actioned once, the option stays there.
    Hope it helps

  • PS Script to find the list of users and the groups in a Workgroup server

    Hi There, could you please explain on how to get a complete list of local users and local groups in a "Workgroup" server to which they belong to using Powershell. I'm able to get the users list but couldn't find any help in finding
    the script to find to which localgroup the user belong to. Anticipating your response. Also let me know the cmdlet for Win2k3 servers to find the same.

    Here's some code from David Pham (don't remember wher I fund this code):
    Trap {"Error: $_"; Break;}
    Function EnumLocalGroup($LocalGroup)
    $Group = [ADSI]"WinNT://$strComputer/$LocalGroup,group"
    "Group: $LocalGroup"
    # Invoke the Members method and convert to an array of member objects.
    $Members= @($Group.psbase.Invoke("Members"))
    ForEach ($Member In $Members)
    $Name = $Member.GetType().InvokeMember("Name", 'GetProperty', $Null, $Member, $Null)
    $Name
    # Specify the computer.
    $strComputer = gc env:computername
    "Computer: $strComputer"
    $computer = [adsi]"WinNT://$strComputer"
    $objCount = ($computer.psbase.children | measure-object).count
    $i=0
    foreach($adsiObj in $computer.psbase.children)
    switch -regex($adsiObj.psbase.SchemaClassName)
    "group"
    { $group = $adsiObj.name
    EnumLocalGroup $group }
    } #end switch
    $i++
    } #end foreach

  • Mail for Exchange / Small Business Server

    It appears that Nokia has overlooked a part of the market with its Mail for Exchange application. Apparently, M4E has difficulty communicating with Exchange if it is part of Small Business Server and a self signed certificate is used.
    It would be a good idea if someone at Nokia reads this and cares to put it on a list of 'things we could do - to keep customers happy". Small Business Sever is Microsoft's Server product for up to 75 clients. That is a nice world wide market of small businesses that are known to adept quickly, unlike larger organizations.
    This lack of "sweating the details" has caused me personally probably 20-30 hours, and judging from the the number of entries other people have also wasted lots of time.
    In addition to the time wasted, we are now forced to purchased a commercial server certificate.
    More details on the M4E/SBS issue can be found here: http://blogs.technet.com/sbs/archive/2006/12/07/us​ing-a-nokia-device-to-sync-with-small-business-ser​...

    Has this been corrected in 1.5.0? the realser notes state
    "Support for Microsoft Small Business Server"
    John32

  • API to share users and responsibility for a discoverer report

    Hi Everyone,
    Is there any API exists to share users and responsibility for a discoverer report from the database?
    Thanks
    Pramil

    Hi,
    You can use the Discoverer EUL command line for Java interface (EULAPI). This is a java utility then runs on the Apps server so you can use it with a shell script. For example,
    eulapi –connect <connect string> -grant_privilege –workbook_access rodw.myworkbook –apps_responsibility Financials
    See the documentation at http://download.oracle.com/docs/html/B13919_03/ref.htm#sthref120
    Alternatively, you could create your own API that added new records to the EUL5_ACCESS_PRIVS table. However, this is not a supported approach and you need to understand the structure of the EUL tables to do this.
    Rod West

  • I have iTunes installed on a laptop that I use for work, but it's owned by my employer.  A new policy my have them deleting iTunes from the machine.  If that happens, will I lose all my music?  I am an iCloud user and pay for iTunes match.

    I have iTunes installed on a laptop that I use for work, but it's owned by my employer.  A new policy my have them deleting iTunes from the machine. If that happens, will I lose all my music?  I am an iCloud user and pay for iTunes match.

    If they just delete iTunes, the music files should still be there. I suggest making a backup of them though. Locate your iTunes folder (The one that contains your library file) and just copy the whole thing to your Documents folder or wherever you like (Just not in the same directory of the original folder otherwise the computer will get confused and could confuse your iTunes library). Then you will have a backup of all your music, plus if you purchased it from iTunes, you will still have it linked to your Apple ID so you can re-download them to any computer with iTunes on it when you feel like it.

  • User and Password for JMS-Adapter

    Hi all,
    when configuring JMS-Adapter e.g. for IBM MQSeries i do not find field where to specify the user and password for the MQ. We configure e.g. a receiver communication channel.
    In 2.0 JMS-Adapter we can put user and password like this
    JMS.QueueConnectionFactoryImpl.user=YTEST
    JMS.QueueConnectionFactoryImpl.password=<!%YTEST%!>
    in the property file. We can also hide the passwort with
    the mechanism of password token.
    How can this be done in JMS 3.0 Adpater? Is it possible?
    Thanks,
    Ly-Na Phu

    Oh, sorry. Now i see the field for user and passwort.
    Thanks,
    Ly-Na Phu

  • Sharing and Permissions for Admin Users Home Folder

    Staff user group deleted from Admin User home folder.  User groups listed are the user as read/write, admin as read and everyone as read.  If you create a new Admin user the group "staff" is listed instead of "admin"????  How do i get it back to how it was?  It also seems to be effecting stored passwords in my keychain and other apps.

    Hi, i think it depends who are you serving for, if you are just serving for a small office or home server or a big organization. The following quick thinking just came to me:
    I think cups set automatically a system  user of its own, and runs as it, so no trouble there. Cups also has the option to set users and it uses the system users as default, i think it depends in in how many printers/users your have in your server.Users that can manage cups are in the lp group. 
    For nfs every user should have their home, samba is also a good option if you have  windows computer in your network and it integrates better with graphical file  managers like nautilus in the clients side, but it is a hassle to configure.
    You should run the web server (owncloud ) as it own user, maybe you can manage to set something up for owncloud in the filesystem, but owncloud uses a database, and the users for owncloud are stored in there, and they are not system users.
    You can configure ssh for local use only enabling the corresponding subnets in your /etc/sshd.conf and optionally but recommended you can set a firewall and permissions. You can use iptables but i prefer ufw for simple setup.
    I think you should read the wiki:
    https://wiki.archlinux.org/index.php/users_and_groups
    and the other respective topics in the wiki.
    Also as an advice i know that arch linux is a great distribution, but you have to do more work to mantain a stable server. I would recommend debian or another more conservative distro, but of course it is your choice.
    Last edited by hydrosIII (2014-11-06 06:26:45)

  • Active Directory Authentication and permissions for user group in APEX 4.0

    Hello,
    I am new to oracle APEX and I have searched the forum for active directory authentication for a user group and I am really confused about all the different threads. Can anyone please provide me the steps to follow; in order to implement AD authentication for a user group in Oracle APEX 4.0.
    These are the threads which i was looking at to get an idea like how AD authentication works but its really confusing for me.
    Help with Authentication (APEX_LDAP.AUTHENTICATE)
    Re: LDAP Authentication Via Groups
    Thanks,
    Tony

    You need to give it more than 30 minutes before bumping your own post. This is not an official support channel, so you need to be patient and wait for people to read, think and respond.

  • How do we fetch the top-level users and groups for a particular resource

    Hi Experts,
    I need to fetch the top level users and groups (permissions) for a particular resource, Currently i am able to fetch the effective users list.
    Thanks.

    To elaborate...
    Here we need the users and groups who have direct access to the resource. We dont want to resolve groups.
    Please help us with the apis to use in our java code to fetch the users and groups.

  • Considering Arch For My New Home Server

    My wife and I both use Arch full time on our desktop and two laptops, and we enjoy it a lot. Right now our current home server also runs Arch and works very reliably. In fact I don't think I ever had a problem with it. The server we use has some major hardware on it that would probably make it better off as a standard desktop and not a server (it has a great video card, for example) so I decided to buy or build a new server to replace it. (The current server is over four years old). The server will be responsible for SSH, Unison, DNS, and Samba.
    I have decided to have three hard drives. One will be dedicated to the root and swap partitions. The other two will be dedicated to /home and will be on a software RAID1. The reason for this is because redundancy on the OS is not important to me (a Clonezilla image that I'll have stored will quickly restore the OS if I ever need to recover it) but redundancy on the data is really important since it will house all of our media (over 500GB worth). I have an offsite backup too so that's not an issue either. Also notable is the fact that the server will not have any GUI at all. Just the kernel and whatever is required to facilitate what it serves.
    Anyway, here is where I'm wondering if Arch is still a good choice. My current server uses Arch and works 100% reliably, but is also not on any form of RAID either. Considering how often Arch changes, I fear that maybe an update would come along that would break the RAID, and that's the last thing I want to have happen. How reliable is Arch on a server from a RAID standpoint? I am also considering Debian, however, Debian packages rarely match the versions of our computers (especially Unison) so I don't think Debian serving an almost primarily Arch Linux household would work well.
    Last edited by jlacroix (2011-02-25 17:33:08)

    jdarnold wrote:It's a perfect choice and very much the way I have my server set up.
    That's well and good until 12 months later when you decide you want to install new package X, which depends on lib A, which means lib A has to be updated, but packages Y, Z, R, T,W,Q and V all need to be updated because they also depend on lib A and you end up with a big borked box.
    Yes, experience has learnt me that
    There's always ArchServer (Full Disclosure: I'm the project coordinator )
    Last edited by fukawi2 (2011-03-18 13:05:53)

  • What is default user and password for Single Sign On

    When I try to run a test.rdf report (that comes for demonstration purpose). A page appears which asks form SSO user and password.<br>
    I tried all user IDs and password that I have used so for during installation. But none works. Please give me hint about it.

    Hi,
    If you would like to turn off the SSO for Reports, you can edit the Reports server's .conf file. For some reason, Oracle enabled SSO by default for Reports.
    You can access this file through OEM, or you can hand-edit it. It is located at ORACLE_HOME\reports\conf\<rep_server_name>.conf. (Make a back-up first just in case).
    Scroll down about a third of the file until you locate the <security>. . .</security> section.
    Delete this section, save the file (and run dcmctl updateconfig if you hand-edited the file), and restart the OC4J_BI_Forms instance.
    You will no longer get the SSO sign-in page when you run a report.
    HTH,
    Jim

Maybe you are looking for