How do I share a single directory with different permissions for each client?

[redundantly]

<div class="bbWrapper">I've got this directory:<br /> <br /> <code style="background-color: #dee3e7; padding: .2px; margin: .1em; display: inline-block;"> <kbd>/mnt/tank/nvr/recordings</kbd></code><br /> <br /> And I need to share it with two separate clients via NFS with different permissions:<br /> <ul> <li data-xf-list-type="ul">192.168.2.101 with write access</li> <li data-xf-list-type="ul">192.168.2.212 with read-only access</li> </ul>The first box needs write access to the data. The second box should only have read access.<br /> <br /> If I try to set this up with two different shares pointed at the same directory I get the following error:<br /> <br /> <code style="background-color: #dee3e7; padding: .2px; margin: .1em; display: inline-block;"> <kbd>The network 0.0.0.0/0 is already being shared and cannot be used twice for the same filesystem</kbd></code><br /> <br /> I've seen other threads where this is called out as a bad practice and the way to do this is use separate datasets, but this isn't possible in this scenario since I need two different clients to access the exact same data with different permissions.<br /> <br /> How do I accomplish this with FreeNAS?</div>

 

[SweetAndLow]

<div class="bbWrapper">The question is more about NFS than it is about freenas. You should probably just use permissions for this, that is what they are designed for.<br /> <br /> Sent from my Nexus 5X using Tapatalk</div>

 

[redundantly]

<div class="bbWrapper">No, this is an issue with FreeNAS. If I could just edit /etc/exports directly and it not be replaced by other edits in the GUI or a reboot I'd be able to work it out.<br /> <br /> The limiting factor here is how FreeNAS operates, or how I'm attempting to configure it. I'm hoping I'm missing something and it's possible to do what I need with FreeNAS.</div>

 

[SweetAndLow]

<div class="bbWrapper"><blockquote data-attributes="member: 67216" data-quote="redundantly" data-source="post: 340205" class="bbCodeBlock bbCodeBlock--expandable bbCodeBlock--quote js-expandWatch"> <div class="bbCodeBlock-title"> <a href="/community/goto/post?id=340205" class="bbCodeBlock-sourceJump" rel="nofollow" data-xf-click="attribution" data-content-selector="#post-340205">redundantly said:</a> </div> <div class="bbCodeBlock-content"> <div class="bbCodeBlock-expandContent js-expandContent "> No, this is an issue with FreeNAS. If I could just edit /etc/exports directly and it not be replaced by other edits in the GUI or a reboot I'd be able to work it out.<br /> <br /> The limiting factor here is how FreeNAS operates, or how I'm attempting to configure it. I'm hoping I'm missing something and it's possible to do what I need with FreeNAS. </div> <div class="bbCodeBlock-expandLink js-expandLink"><a role="button" tabindex="0">Click to expand...</a></div> </div> </blockquote>I think you are confused with how this works. You can just mount using read only client options or read/write.<br /> <br /> Or you setup permissions correctly on the server to do what you want.<br /> <br /> Sent from my Nexus 5X using Tapatalk</div>

 

[Ericloewe]

<div class="bbWrapper">IP-based authentication is not good practice. Just use proper permissions and log in.</div>

 

[oni.kage]

<div class="bbWrapper"><blockquote data-attributes="member: 37321" data-quote="Ericloewe" data-source="post: 340495" class="bbCodeBlock bbCodeBlock--expandable bbCodeBlock--quote js-expandWatch"> <div class="bbCodeBlock-title"> <a href="/community/goto/post?id=340495" class="bbCodeBlock-sourceJump" rel="nofollow" data-xf-click="attribution" data-content-selector="#post-340495">Ericloewe said:</a> </div> <div class="bbCodeBlock-content"> <div class="bbCodeBlock-expandContent js-expandContent "> IP-based authentication is not good practice. Just use proper permissions and log in. </div> <div class="bbCodeBlock-expandLink js-expandLink"><a role="button" tabindex="0">Click to expand...</a></div> </div> </blockquote><br /> What? IP-based authentication is literally how NFS works. Following the security model of least-privilege, it's completely reasonable to export a share to some hosts as RW and other hosts as RO. Why would I give write access to a host that doesn't need it? The issue also applies to maproot. Why would I export something to my entire network with maproot enabled when only one or two hosts needs it? That would be terrible practice. Permissions are not always a feasible solution without getting into very ugly extended ACLs. For example, if I have a backup server that has to read every file on my NAS to copy it to a backup repository. It would be a nightmare to do that with ACLs, which is why I would create a duplicate share, only for the backup server, that has maproot enabled.<br /> <br /> This is a serious shortcoming/bug of FreeNAS and I'm amazed that it hasn't been fixed already.</div>

 

[Ericloewe]

<div class="bbWrapper"><blockquote data-attributes="member: 83439" data-quote="oni.kage" data-source="post: 449488" class="bbCodeBlock bbCodeBlock--expandable bbCodeBlock--quote js-expandWatch"> <div class="bbCodeBlock-title"> <a href="/community/goto/post?id=449488" class="bbCodeBlock-sourceJump" rel="nofollow" data-xf-click="attribution" data-content-selector="#post-449488">oni.kage said:</a> </div> <div class="bbCodeBlock-content"> <div class="bbCodeBlock-expandContent js-expandContent "> IP-based authentication is literally how NFS works </div> <div class="bbCodeBlock-expandLink js-expandLink"><a role="button" tabindex="0">Click to expand...</a></div> </div> </blockquote>And it is not good practice, much like transmitting your passwords in plaintext is not. Except that the first case keeps doing it all the time.</div>

 

[oni.kage]

<div class="bbWrapper"><blockquote data-attributes="member: 37321" data-quote="Ericloewe" data-source="post: 449489" class="bbCodeBlock bbCodeBlock--expandable bbCodeBlock--quote js-expandWatch"> <div class="bbCodeBlock-title"> <a href="/community/goto/post?id=449489" class="bbCodeBlock-sourceJump" rel="nofollow" data-xf-click="attribution" data-content-selector="#post-449489">Ericloewe said:</a> </div> <div class="bbCodeBlock-content"> <div class="bbCodeBlock-expandContent js-expandContent "> And it is not good practice, much like transmitting your passwords in plaintext is not. Except that the first case keeps doing it all the time. </div> <div class="bbCodeBlock-expandLink js-expandLink"><a role="button" tabindex="0">Click to expand...</a></div> </div> </blockquote><br /> NFS has never been very secure, but controlling what hosts have RW and maproot access is still better than running everything wide open. I don't understand why you're defending a shortcoming of FreeNAS when every other NAS software on the market can do what we are asking for.<br /> <br /> I'm realizing now that I made a mistake my building my new box on FreeNAS. I was expecting a polished product and I am seeing that this is not the case. I've already started preparations to wipe this system and go back to ZFS on Linux. And to think, I almost bought an iXsystems box at work recently for a heavy NFS environment. I am so glad I didn't make that mistake.</div>