The goal: I've got a server sharing files via AFP. On the server, these files have ACLs. When I mount this share with a client, I'd like for the files that appear on the client to retain the original ACLS, as they are on the server -- but instead, the files on the client do not get ACLs.

On the client, I've tried mounting from the command line with afp_mount, but that doesn't appear to give many more options.

The back story: Why would I want to do this? Won't the client and the server have different users anyway? Well, here's the slightly more complex picture...

I've got a computer, let's call it the "office server", that has a whole bunch of users/groups. It shares a whole bunch of files with complicated ACLs for those users/groups. Then I've got several other computers, let's call them "workstations", that connect to the office server to access files. Ok so that part is simple and common. Then, I've got another computer, let's call it the "backup server" that is responsible for making daily and weekly rsync snapshots of the share points on the office server. All of this works. No problem. The files on the backup server even get backed up with the full ACLs on the office server, despite the fact that the backup server doesn't have any of the users/groups referenced in the ACLs. All is well.

But here's what I'm trying to do: When the workstations connect to a share point on the office server, I'd like for them to be able to access the backup files, on a read-only basis. This way, our staff can say "oh shoot, I just messed-up/deleted that file on the office server, now I'll go into the backups and restore it". The users/groups/ACLs on the office server are complex and change relatively often, so I don't want to try duplicating this scheme across two machines. I figure if I can get the office server to locally mount the backup files from the backup server, then on the office server I can symlink this mounted share into the served share for workstations to see. It would be kind of like a share within a share. It's so close to working, but I just can't get the office server to inherit the same ACLs as they are while on the backup server.

Any ideas?

  • If you're in need to often change your ACLs you may want to rethink your concept. In my personal experience there is no need to do this once it's properly set up. One usually only adds or removes people from groups. - You may have an ACL inherited that overrides another one unintentionally. Better separate to multiple share points than cutting on the read prig with an ACL. - If you want to have your backups read only, add an ACL there overriding write and delete and inheriting that to subfolders. – MacLemon Sep 29 '12 at 19:45

You must log in to answer this question.

Browse other questions tagged .