I’ve used Nextcloud for file hosting, calendar and contacts services, since its very first release. However, I recently had to downgrade my large servers, and found myself lacking resources for running a hungry service like that.
To have an “offsite” backup of my documents, and to be able to view them on a phone. The documents are read-only on the server, and the synchronization is one way, local to server.
Create a dedicated user for file hosting
ssh access, we need to restrict things as much as
Thankfully, OpenSSH has an easy way of achieving this, by forcing an
sftp only mode on a user, and confining it to a directory.
Which means we need a dedicated user on the server for the file store.
useradd -m syncuser
Create a new root directory:
/etc/sshd_config the following:
Match User syncuser ForceCommand internal-sftp ChrootDirectory /chroot
This will disable
ssh login for
syncuser, and restrict
sftp to the directory
Mount file storage directory
We can keep our files directly under
/chroot, however it’s likely we
don’t have that much space in the root partition, especially if we
followed the standard OpenBSD installation.
To solve this, we can create a sync directory under our user’s home,
and mount it to
nfs. As an extra, mounting it with
-ro will make the share, and thus our
sftp server, read-only.
mkdir /home/syncuser/sync mkdir /chroot/sync rcctl enable portmap nfsd mountd echo "/home/syncuser/sync -network=127.0.0.1 -mask=255.255.255.255 -ro" \ > /etc/exports rcctl start portmap nfsd mountd mount localhost:/home/syncuser/sync/ /chroot/sync
Synchronization of our files from the local to the server can be done
rsync. However, since we don’t have regular
need a workaround.
The solution is to send the files using another user (for example
privuser) with regular
ssh access, while running
rsync on the
rsync --rsync-path 'doas -u syncuser /usr/local/bin/rsync' \ -ar --delete \ /home/localuser/sync/ \ <privuser>@<server>:/home/syncuser/sync/
The above requires a rule in
permit nopass privuser as syncuser cmd /usr/local/bin/rsync
As mentioned before, this is just a one-way sync. For two-way sync,
unison may do the job.
View on phone
To view and open the files on a smartphone, we need an application
that can access
sftp. The Android file manager that I use, “Material
Files”, already has this capability.
The gain from all this, is that we can now access the
through the restricted
syncuser, without needing access to
privuser on the phone.