3

I have a server running Ubuntu 12.04 which I use, among other things, as a place to store and back up a lot of data. To keep the scope of the question narrow as possible, let's consider only photos. I find it convenient to keep the photos in a directory structure such as

Photos\2005.06.30 - Bens Birthday
       ... (about 200 folders or so)
      \2015.03 - Vacation

The point is, that I do not intend to alter in any significant way this folder structure and there's already quite an amount of folders there too.

Initially, from the /var/www directory I set up a symlink to the directory with the photos and used htaccess to restrict access to specific users registered on this server. Anyone who knew a username/password pair could go to http://hostname/Photos, type in the user-pass and see a list of directories and files to click through.

Now that I want to share some of these photos, I turned to applications such as owncloud and pydio. They have a really nice interface with thumbnails 'n'all, they let you download an entire directory as a zip-archive and all would be great, however...

Both when using plain old browsing, and when using owncloud or pydio, you get access to anything that the user www-data has access to. Without owncloud or pydio if I want to grant someone access to only a specific subdirectory in Photos I must code a separate rule in the config of apache for that directory. Otherwise I get a situation where someone can either see everything, or nothing at all.

Unfortunately, owncloud and pydio have the same problem. For example, pydio has the concept of shared workspaces, so I create a shared workspace consisting of the Photos directory. Unfortunately, you can only share this workspace as a whole. What I cannot do, is select individual directories in Photos and specify "this will be accessible to everyone, this just to my parents, this here, this there" and so on. So again, I'm stuck with the need to create a separate workspace for every group of photos. It gets worse, because I might have a directory like Photos\Photos from Egypt\ which I'm willing to share, and then within it a directory like Photos\Photos from Egypt\Hot porn with wife\ which should be accessible just to me and my wife. If I create individual workplaces for every subdirectory, the directory structure is lost.

I imagine, this is due to the backwards nature of owncloud and pydio with respect to what I'm trying to achieve. While these apps offer a cloud service for several users, where everyone has his own private space, I'm trying to selectively share some of my data with a certain group of users. I'm not aiming to offer them cloud storage services.

An ideal solution for me would be one, where I could set the ownership of the files and folders to certain users and groups and have a web-based service mimicking an SFTP client that would respect these ownerships. So someone could log on as userjoe from group notmanyrights and browse the Photos directory only getting access to, say, those subdirectories where the access rights are 755, but not, say, 750.

Quite important for me is the ability to download entire directories in one click and have thumbnail view of the photos in a subdirectory.

  • Have you considered setting up an sftp server and giving everyone their own login? Then they can use their Windows File Explorer to go there, watch the thumbnails etc. in their used environment etc. You on the other hand can manipulate what they can see by the regular unix user:group settings as you described. – Angelo Fuchs Jun 3 '15 at 13:03
  • 1
    @AngeloFuchs An sftp server is already running, and giving everyone an account is exactly what I intend to do, but it appears, that windows does not support browsing sftp natively. Typing sftp://myserver/ in explorer on my windows machine just automatically fires up WinSCP without any thumbnails or the like. Also users on mobile devices are sidelined. It would be nice if I could implement a web-based sftp client on my server, that may partially solve the problem. – LLlAMnYP Jun 3 '15 at 13:18
  • 1
    Okay, so you want a simple WebDAV. Unfortunately I don't know any. (Having used Alfresco, which is not very simple - but would do what you want) – Angelo Fuchs Jun 3 '15 at 13:25
  • Alfresco does get me curious. Surely it can't be that much harder than owncloud and ajaxplorer... Thanks for the tip. – LLlAMnYP Jun 3 '15 at 13:33
  • 1
    I'm not thrilled about it, but it's one of the options on the table. The other option is cp -rs source/ dest/ to recreate my desired folder structure with every "file" being a symlink and then copy this structure to every user profile in pydio(ajaxplorer), deleting those links, that the users should not see. I'm sure, I'll run into bugs and abandon this option too though :-) As soon as I settle on something, I will write up an answer though. – LLlAMnYP Jun 3 '15 at 13:41
2

I think I found a solution which is relatively simple to maintain. I was afraid of running into bugs and having to resort to the suggested-in-comments Alfresco, but the first very quick test shows wonderful results.

Considering the number of users will be quite small and only I should be doing the administration, this will work for me.

  1. Install Pydio.

  2. run cp -rs /my/path/to/Photos/ ~/symlinks/. This will recreate the entire tree structure of the Photos directory, except instead of files there will be symlinks. So now I can copy this structure to /var/www/pydio/data/personal/username/ for every user and delete those symlinks that link to the photos the user should not see.

  3. Maintain a recent version of the structure with symlinks is a one-line command, as new photos are added, I can manually add the relevant subfolders to the users' directories being as selective as necessary.

  4. This is in part even better than unix user:group format, as it works as a full access control list.

  5. Group permissions, rather than individual user permissions are possible by taking a similar approach with shared workspaces in Pydio.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.