Ssh – UID/GID with sshfs of Linux FUSE

If you're using sudo then you're likely using root's credentials to mount, which I do not believe is what you want. I wouldn't probably do what you're asking, wrt. mounting to /mnt as user1 and acessing as user2. It's going to get complicated with groups & user permissions. If you truly want to mount a directory to /mnt to share then you really should be mounting it via the system level for all using autofs.

Automounting

There are 3 methods that I'm aware of for automounting a mount such as this.

• autosshfs – Per user SSHFS automount using user’s SSH config and keys.
• autofs - provide access to file systems on demand
• afuse is an automounting file system implemented in user-space using FUSE.

The question was answered in a linux mailing list; I post a translated answer here for completeness.

Solution

The solution is not to used both the options default_permissions and allow_other (which I didn't try in my original experiments).

Explanation

The problem seems to be quite simple. When you give the option default_permissions in fusermount then fuse's permission control of the fuse mount is handled by the kernel and not by fuse. This means that the REMOTE_USER's uid/gid aren't mapped to the LOCAL_USER (sshfs.c IDMAP_NONE). It works the same way as a simple nfs fs without mapping.

So, it makes sense to prohibit the access, if the uid/gid numbers don't match.

If you have the option allow_other then this dir is writable only by the local user with uid 699, if it exists.

From fuse's man:

'default_permissions'

   By default FUSE doesn't check file access permissions, the
   filesystem is free to implement its access policy or leave it to
   the underlying file access mechanism (e.g. in case of network
   filesystems).  This option enables permission checking, restricting
   access based on file mode.  It is usually useful together with the
   'allow_other' mount option.

'allow_other'

   This option overrides the security measure restricting file access
   to the user mounting the filesystem.  This option is by default only
   allowed to root, but this restriction can be removed with a
   (userspace) configuration option.