---
title: "Manage access rights in file storage at the file system level"
sidebar_label: "Manage access rights at the file system level"
sidebar_position: 3
description: "How to manage access rights to files and folders in file storage at the file system level"
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import MountStorageToCloudServer from '@site/i18n/en/docusaurus-plugin-content-docs/current/_partials/file-storage/mount-storage-to-cloud-server.mdx'

# Manage access rights in file storage at the file system level

:::info

This instruction describes how to configure access rights to file storage for a cloud server with a Linux-based OS.

:::

In file storage with the NFSv4 protocol, you can manage access rights to files and folders at the file system level.

## Principle of operation \{#principle-of-operation}

Files and folders in file storage with the NFSv4 protocol support standard access control as in Unix systems. Read, write, and execute access is implemented via Identity Mapping (IDM) — access rights are checked based on the user ID and group ID.

A user group is a set of users with the same access rights. Groups are divided into two types:

* primary group (Primary Group) — the group that the operating system assigns to a user;
* secondary group (Secondary Group) — one or more groups to which a user also belongs.

Each user can be added to a maximum of 16 groups: in one primary group and 15 secondary groups.

By default, only the `root` user has read, write, and execute permissions. Other users only have read permissions. As `root`, you can [configure folder and file access rights for users](#configure-permissions-for-user) and for [user groups](#configure-permissions-for-group).

## Access rights format \{#permission-formats}

Example of access rights:

```bash
drwxrwxrwx 3 root root   21 Jun 13 14:00 .
drwxr-xr-x 4 root root 4096 Jun 13 13:44 ..
drwxr-xr-x 2 root root    6 Jun 13 14:00 directory
-rw-rw-r-- 1 first first  0 Jun 13 09:45 file.txt
```

Where:

* first character:
  * `d` — directory flag;
  * `-` — file flag;
* triplets of characters like `rwx`:
  * the first triplet of characters like `rwx` — user permissions;
  * the second triplet of characters like `rwx` — group permissions;
  * the third triplet of characters like `rwx` — permissions for everyone else who is not a user or not part of the group;
  * `r` — read permission (read);
  * `w` — write permission (write);
  * `x` — execute permission (execute);
* the first column with names — names of users who are the owners of the folder or file;
* the second column with names — names of groups that are the owners of the folder or file;
* the last column — names of files or directories.

## Configure access rights for a user \{#configure-permissions-for-user}

:::info

This instruction describes configuring user access rights for file storage with the NFSv4 protocol.

:::

The `root` user can create users and grant them folder permissions. If you create a user, create a folder, and assign the user as the folder owner, then only that user will have full read, write, and execute permissions on files in that folder.

1. [Mount the file storage](#mount-file-storage-for-user-permissions).

2. [Create a user](#create-user).

3. [Set the user as the folder owner](#set-user-as-owner).

4. [Check user permissions](#check-user-permissions).

### 1. Mount the file storage to a server \{#mount-file-storage-for-user-permissions}

1. [Connect to a cloud server](/cloud-servers/manage/connect-to-server.mdx) or [dedicated server](/dedicated/manage/connect-to-server.mdx).

2. Install the package for working with the NFS protocol:

   ```bash
   sudo apt install nfs-common
   ```

3. Create a folder to mount the storage:

   ```bash
   sudo mkdir -p /mnt/nfs
   ```

4. Mount the file storage:

   ```bash
   sudo mount -vt nfs "<filestorage_ip_address>:/shares/share-<mountpoint_uuid>" /mnt/nfs
   ```

   Specify:

   * `<filestorage_ip_address>` — IP address of the file storage. You can view it in the [control panel](https://my.selectel.ru/vpc/default/file-storage/): from the top menu, click **Products** → **File Storage** → storage page → **Settings** tab → **IP**;
   * `<mountpoint_uuid>` — ID of the mount point. You can view it in the [control panel](https://my.selectel.ru/vpc/default/file-storage/): from the top menu, click **File Storage** → storage page → **Connection** block → **GNU/Linux**.

### 2. Create a user \{#create-user}

1. Create a user:

   ```bash
   sudo useradd <user_name> -u <user_id>
   ```

   Specify:

   * `<user_name>` — username;
   * optional: `<user_id>` — user ID, for example, `1000`.

   The user will be automatically added to the primary group (Primary Group) with the same name as the user.

2. Verify that the user has been created:

   ```bash
   grep <user_name> /etc/passwd
   ```

   Specify `<user_name>` — username.

   Example response:

   ```bash
   firstuser:x:1000:1000::/home/firstuser:/bin/sh
   ```

   Where:

   * `firstuser` — username;
   * the first value `1000` — user ID;
   * the second value `1000` — user primary group ID;
   * `/home/firstuser` — user home folder.

### 3. Set the user as the folder owner \{#set-user-as-owner}

1. Create a folder for the user:

   ```bash
   sudo mkdir -p /mnt/nfs/<directory_name>
   ```

   Specify `<directory_name>` — folder name.

2. Set the user as the folder owner:

   ```bash
   chown <user_name>:<group_name> <directory_name>
   ```

   Specify:

   * `<user_name>` — username;
   * `<group_name>` — name of the user primary group (matches the username);
   * `<directory_name>` — folder name.

### 4. Check user permissions \{#check-user-permissions}

1. Navigate to the created folder:

   ```bash
   cd /mnt/nfs/<directory_name>
   ```

   Specify `<directory_name>` — folder name.

2. Verify that the user is the folder owner:

   ```bash
   ls -al
   ```

   Example response:

   ```bash
   drwxr-xr-x 2 firstuser firstuser 22 Jun 14 15:15 .
   drwxrwxrwx 3 root     root       37 Jun 14 15:14 ..
   ```

   Here, user `firstuser` and primary group `firstuser` have read, write, and execute permissions for files in the folder. More about the [access rights format](#permission-formats).

3. Switch to the created user:

   ```bash
   su <user_name>
   ```

   Specify `<user_name>` — username.

4. Create a file as the user:

   ```bash
   touch file.txt
   ```

5. Verify that the user has access rights to the file:

   ```bash
   ls -al
   ```

   Example response:

   ```bash
   drwxr-xr-x 2 firstuser firstuser 22 Jun 14 15:15 .
   drwxrwxrwx 3 root     root       37 Jun 14 15:14 ..
   -rw-rw-r-- 1 firstuser firstuser  0 Jun 14 15:15 file.txt
   ```

   Here, user `firstuser` and primary group `firstuser` have read and write permissions for the `file.txt` file. User `firstuser` is the owner of this file. All other users only have read permissions for this file. More about the [access rights format](#permission-formats).

## Configure access rights for a group \{#configure-permissions-for-group}

:::info

If you created file storage before August 9, 2024, to enable the option for differentiating access rights for secondary groups, [create a ticket](https://my.selectel.ru/tickets/create/). After enabling the option, you will need to unmount and mount it again. This instruction describes how to configure group access rights to file storage with the NFSv4 protocol.

:::

The `root` user can create secondary user groups (Secondary Groups) and grant groups permissions for folders. All users in the group will have the same access rights. Any user from the group will be able to create files, as well as modify files that another user in the group created.

1. [Mount the file storage](#mount-file-storage-for-group-permissions).

2. [Create a secondary user group](#create-group).

3. [Set the secondary user group as the folder owner](#set-group-as-owner).

4. [Check the secondary user group permissions](#check-group-permissions).

### 1. Mount the file storage to a server \{#mount-file-storage-for-group-permissions}

1. [Connect to a cloud server](/cloud-servers/manage/connect-to-server.mdx) or [dedicated server](/dedicated/manage/connect-to-server.mdx).

2. Install the package for working with the NFS protocol:

   ```bash
   sudo apt install nfs-common
   ```

3. Create a folder to mount the storage:

   ```bash
   sudo mkdir -p /mnt/nfs
   ```

4. Mount the file storage:

   ```bash
   sudo mount -vt nfs "<filestorage_ip_address>:/shares/share-<mountpoint_uuid>" /mnt/nfs
   ```

   Specify:

   * `<filestorage_ip_address>` — IP address of the file storage. You can view it in the [control panel](https://my.selectel.ru/vpc/default/file-storage/): from the top menu, click **Products** → **File Storage** → storage page → **Settings** tab → **IP**;
   * `<mountpoint_uuid>` — ID of the mount point. You can view it in the [control panel](https://my.selectel.ru/vpc/default/file-storage/): from the top menu, click **File Storage** → storage page → **Connection** block → **GNU/Linux**.

### 2. Create a secondary user group \{#create-group}

1. Create a secondary group (Secondary Group):

   ```bash
   sudo groupadd <group_name> -u <group_id>
   ```

   Specify:

   * `<group_name>` — name of the secondary user group;
   * optional: `<group_id>` — ID of the secondary user group, for example, `2000`.

2. Add users to the secondary group:

   ```bash
   sudo gpasswd -a <user_name_1> <group_name>
   sudo gpasswd -a <user_name_2> <group_name>
   ```

   Specify:

   * `<user_name_1>` and `<user_name_2>` — usernames;
   * `<group_name>` — name of the secondary user group.

   Example response:

   ```bash
   Adding user firstuser to group users
   Adding user seconduser to group users
   ```

   Here `firstuser` and `seconduser` — usernames. Now, in addition to their primary group, both users are added to the created secondary group.

3. Verify that the users have been added to the group:

   ```bash
   grep <group_name> /etc/group
   ```

   Specify `<group_name>` — the name of the secondary user group.

   Example response:

   ```bash
   users:x:2002:firstuser,seconduser
   ```

   Where:

   * `users` — name of the secondary user group;
   * `2002` — ID of the secondary user group;
   * `firstuser`, `seconduser` — usernames.

### 3. Set the secondary user group as the folder owner \{#set-group-as-owner}

1. Create a folder for the secondary user group:

   ```bash
   sudo mkdir -p /mnt/nfs/<directory_name>
   ```

   Specify `<directory_name>` — folder name.

2. Set the user group as the folder owner:

   ```bash
   chown nobody:<group_name> <directory_name>
   ```

   Specify:

   * `<group_name>` — name of the secondary user group;
   * `<directory_name>` — folder name.

3. Set the read, write, and execute permissions on files in the folder as the user group that owns the folder (apply setgid):

   ```bash
   chmod g+srwx <directory_name>
   ```

   Specify `<directory_name>` — folder name.

4. Deny write and execute access to files for other users not in the secondary group:

   ```bash
   chmod 474 <directory_name>
   ```

   Specify `<directory_name>` — folder name.

### 4. Check the secondary user group permissions \{#check-group-permissions}

1. Verify that the secondary user group is the folder owner:

   ```bash
   ls -al
   ```

   Example response:

   ```bash
   drwxr-xr-x 3 root   root  4096 Jun 14 16:10 .
   drwxr-xr-x 3 root   root  4096 Jun 14 16:07 ..
   dr--rwsr-- 2 nobody users 4096 Jun 14 16:10 directory
   ```

   Here, the secondary user group `users` has read, write, and execute permissions for files in the `directory` folder. All other users have read-only permissions for files in this folder. More about the [access rights format](#permission-formats).

2. Switch to a user added to the secondary group:

   ```bash
   su <user_name_1>
   ```

   Specify `<user_name_1>` — first username.

3. Navigate to the created folder:

   ```bash
   cd /mnt/nfs/<directory_name>
   ```

   Specify `<directory_name>` — folder name.

4. Create a file as the user:

   ```bash
   touch file1.txt
   ```

5. Verify that the user has access rights to the file:

   ```bash
   ls -al
   ```

   Example response:

   ```bash
   dr--rwsr-- 2 nobody    users 4096 Jun 14 16:13 .
   drwxr-xr-x 3 root      root  4096 Jun 14 16:10 ..
   -rw-rw-r-- 1 firstuser users    0 Jun 14 16:13 file1.txt
   ```

   Here, user `firstuser` and secondary group `users` have read and write permissions for the `file1.txt` file. User `firstuser` is the owner of this file. All other users only have read permissions for this file. More about the [access rights format](#permission-formats).

6. Verify that a second user from the secondary group can create files in the folder and modify files created by the first user. To do this, switch to the second user added to the group:

   ```bash
   su <user_name_2>
   ```

   Specify `<user_name_2>` — second username.

7. Modify the file created by the first user:

   ```bash
   echo 'anytext' > file1.txt
   ```

8. Create a file as the second user:

   ```bash
   touch file2.txt
   ```

9. Verify that the user has access rights to the file:

   ```bash
   ls -al
   ```

   Example response:

   ```bash
   dr--rwsr-- 2 nobody     users 4096 Jun 14 16:19 .
   drwxr-xr-x 3 root       root  4096 Jun 14 16:10 ..
   -rw-rw-r-- 1 firstuser  users    4 Jun 14 16:19 file1.txt
   -rw-rw-r-- 1 seconduser users    0 Jun 14 16:19 file2.txt
   ```

   Here, user `seconduser` and the secondary group users have read and write permissions for files `file1.txt` and `file2.txt`. User `firstuser` is the owner of the first file, and `seconduser` — of the second one. All other users only have read permissions for this file. More about the [access rights format](#permission-formats).

<Formbricks />