Logical break in harddisk handling

[Oceanwatcher]

Here is another one for the usability people:

I am trying to move the other people in the house over to Kubuntu from WindowsXP. But I must say I meet som blocks on the way...

After installing Kubuntu in a dual boot setup, I added my wife as a user on her computer. I did not add her to sudo group or any admin groups as she is not going to do any system maintenance.

But why can she not mount the other partitions without a password? This does not make sense. She can connect a USB memory stick. No questions asked. But the partitions that are physically on her own harddisk?

I can understand if it is a harddisk on another computer, on a network etc. But on her own computer? Someone must not have been thinking too much. On my own laptop, I can connect a USB harddisk without getting any questions. Same with my USB memory stick. But I too get a question about password when I try to acess other partitions on my own laptop...

I do understand that there has to be done a mounting and that you can set up automounting by editing some text files. But that should not be necessary! On my wifes computer, I actually have no idea how to give her access to her own harddisk as she is not member of the sudo group, her password is rejected! This ties neatly into the misunderstood functions in Windows Vista that MS put in to make it more safe. It became so complicated that people bypassed it making Vista less secure instead of more secure...

No administrator password should be needed to open local partitions. If someone think they are needed, then you need admin passwords for ALL local storage. USB attached devices as well. There has to be concistency.

If a partition should be unavailable to a user, it is the duty of the admin to exlude the disk from that users reach. Network storage is a different discussion.

[flarson]

Re: Logical break in harddisk handling

I disagree with you Oceanwatcher. Unix has been a multiuser system from day one. As such it has mechanisms to protect one user from another. The fact that numerous Windows users are beginning to see the value in linux does not mean that it should be changed to meet their expectations. Linux is still more commonly used as a multiuser system and those protections are needed. Someone was thinking very well, because you can make it work the way you want for a single user while the people who created it can still use it for their purposes.

I have described numerous times how to mount and NTFS or vfat filesystem so that the user will have access to it. If you want to have it not be mounted by default you can use the user option in fstab.

[Oceanwatcher]

Re: Logical break in harddisk handling

Are you disagreeing that there is a logical break here? I find that hard to believe...

I can see that you might disagree with my solution, but the problem remains - either all local storage devices, not matter if they are on USB or not, should need a password. Or none of them.

I think Kubuntu and Ubuntu (and probably other distros as well) has taken the chicken way out - no passwords on the devices that are most "in your face" instead of really defending their point of view. Or could it be that they just forgot that you need the harddisks/partitions inside your computer too?

People that know how to install a bunch of distros on one system know how to hack a text file to prevent a drive from mounting :-)

[dibl]

Re: Logical break in harddisk handling

Is the partition that you want your user/wife to access just an open bucket of files, or does it have some directory structure to it? I think the typical Unix-like approach is to give users access to directories, not devices, although the advent of USB stuff has kind of put a twist on that practice.

If you (the administrator) can make a directory on that partition, and then set the permissions as read-write for everyone in the "user" group, she should be able to access it after logging in with her user name and password.

I dunno if this answers the question or not ..... :P

[flarson]

Re: Logical break in harddisk handling

I don't think there was a question dibl. I do disagree that there is a logical break. The USB devices are personal devices and it makes sense to mount them for the current user when they insert them, even on a multiuser machine. The same is not true of hard disks. The real point I want to make is that linux is the way it is for a reason and that reason is not outmoded or gone. The remarks here are only from the view point of a user who want Linux to be free windows. Linux is much more than that.

[Oceanwatcher]

Re: Logical break in harddisk handling

[quote=mando_hacker ]
The remarks here are only from the view point of a user who want Linux to be free windows./quote]

Not quite. But I get your point.

We all have to agree that the world is changing. This does not mean that good practices get outdated. But it can mean that new needs come in and that there should be a middle way. This is what I mean when I say that the users that know how to do the hacking also know how to modify the needed textfiles so a disk don't mount.

I think we all agree that we want the computer to be as safe as possible. What happened in Windows when the user got boxed in because programs were not written the right way and too many obstacles were put into the system? They all ended up running as administrator because at the end, it is all about getting the job done. So what seemed nice in a lab, did not work out in the real world because Joe Plummer is not a computer geek. He just want to do his job and it is not possible to try to explain CLI to him.

I have a lot of people around me here that are not computer literate (right expression?). I could install Kubuntu, tell them it is an upgraded version of Windows and they would happily agree until they hit a block. I am trying to switch some of them over to a better OS, more secure OS and an OS that I think eventually will have more value for them, but it can be frustrating sometimes.

That is why I love the people in this forum that help me get the logic behind some of the things I find. Thank you for taking the time to read my rants. And don't be too upset if the words do not fit totally. My first language is not English, and I am slowly learning a new language (Portuguese), so I get things messed up a bit sometimes.

With my wifes computer (and all the other dual boot systems I will be setting up) I need the ntfs partitions to automount regardless of what securitylevel the user has. And there should be no reason for that user to have sudo rights. And this time I can put it as a question: Anyone got a link?

[dibl]

Re: Logical break in harddisk handling

I need the ntfs partitions to automount regardless of what securitylevel the user has. And there should be no reason for that user to have sudo rights. And this time I can put it as a question: Anyone got a link?

Your English is excellent -- I wish I could write/speak a second language that well!

I'm done with philosophizing on how things "should" be -- that is always a dangerous word to toss about, and there's nothing more foolish, IMHO, than arguing online.

So, if you (the one with sudo privileges) open Dolphin using Alt-F2 "kdesudo dolphin" with no quote marks, browse to the NTFS partition, you should be able to right-click on it, choose "Properties", and then "Permissions" and change the read/write permissions to the "User" Group, which will allow any logged in user to do whatever he or she wishes on it. Note the little "Apply to sub-folders and files" box and check it.

I personally haven't done this maneuver any time lately -- if Dolphin doesn't seem to want to cooperate, I used to use Krusader to do such things -- install it with apt-get, and then note that "super" krusader goes in the "System" directory while "user" krusader goes somewhere else -- utilities, probably. You'll need to use "Super" for changing permissions on devices or partitions.

Good luck with it!

[Oceanwatcher]

Re: Logical break in harddisk handling

Thank you dibl for the tip. And thank you for the compliment :-)

As long as a debate do not get out of hand and people start calling each other names, I think it is ok to discuss things. Accepted thruths needs to be challenged now and then and sometimes it is good to take a second look in a new context.

But enough for now. I have a solution that I can live with!

[flarson]

Re: Logical break in harddisk handling

Assuming you want the Windows partition (/dev/sda1) mounted at /Windows and rw to every users this will work.
sudo mkdir /Windows
sudo chmod 777 /Windows

Then is /etc/fstab add a line like this.
/dev/sda1 /Windows ntfs defaults

It will be mounted at boot and anyone who has an account on the computer will have read/write and execute access to it.

[Oceanwatcher]

Re: Logical break in harddisk handling

Are there any advantages in mounting it under /media as they do now?

[Oceanwatcher]

Re: Logical break in harddisk handling

If you (the administrator) can make a directory on that partition, and then set the permissions as read-write for everyone in the "user" group, she should be able to access it after logging in with her user name and password.

I should have learned by now that all kinds of scenarios are popping up. A new system came up today where I actually need to do exactly what you are saying here.

There are a set of folders on a disk that should be "automounted". But different folders for different users. There are only two users on this PC, but the rest of the folders on this disk should be hidden from each user. Is this possible? And yes, it is an NTFS disk. Can it be as simple as to go in and set rights on the folder to the group of these user? And then specifically exlude the user from the root of the folder (or the other way around...). I will try to play around with a couple of settings.

[flarson]

Re: Logical break in harddisk handling

I don't think there is a simple answer to this. There are some things you should keep in mind. Anyone who has sudo on the machine can read every file on the machine. NTFS file premission are not the same as linux file permissions. I am not sure of what the ramifications of tha will be for this scenario, and it is possible that ntfs-3g is making any differences moot, but then again maybe not.

[Oceanwatcher]

Re: Logical break in harddisk handling

On this particular pc, the two users do not need sudo privileges (I hope...), but the folders each of them need should appear in Dolphin as an icon. Mybe it is best I log on and add the icons there for them..?

This means they will have rights to access the content of a folder that is on a harddisk that they can not mount. What will happen? Do they need sudo rights to mount the harddisk to get to the folder they have the rights to? I would love to be able to show the disk as mounted, but only containing the folders they have rights to.

Regarding rights in NTFS - I have used this a number of times in Windows: Remove all users from the root folder and subfolders. Then grant rights to the folders they need to access. This way they will not even see the folders they do not have access to.

[flarson]

Re: Logical break in harddisk handling

I think that even in the previous situation the disk should be mounted at boot, and people just open it when they want to use it. In this case that is doubly true, and then you can do what you suggest. It might also be wise to create a link in their $HOME to their Windows Directory to make it easier for them to access the correct folder.

[Oceanwatcher]

Re: Logical break in harddisk handling

I think that even in the previous situation the disk should be mounted at boot, and people just open it when they want to use it.

Ok. But.. What rights do you use when mounting it? If I set it to full rights for both, then both will have access to everything. I was thinking about adding the folders each of them need to their own group (the one with their name). But this only work if the rights upwards are restricted.

It might also be wise to create a link in their $HOME to their Windows Directory to make it easier for them to access the correct folder.

Did not think of that, but you are of course right. Better to do that from the beginning :-)