I work on an HPC and often I have to share files with other users. The most approachable solution is to have an external cloud storage and recline back and forth. However there’s some projects that are quite heavy (several TB) and that is unfeasible. We do not have a shared group. The following is the only solution I found which is not to just set al permissions to 777, and I still don’t like it.
Create a directory and set ACL to give access to the selected users. This works fine if the users create new files in there, but it does not work if they copy from somewhere else as default umask is 022. Thus the only appropriate solution is to change default umask to 002, which however affects file creation system wide. The alternative is to change permissions every time you copy something, but you all know very well that is not going to happen.
Does it really have to be such a pain in the ass?
I’m no sysadmin, I just run my homelab. Let me get this straight… You want to bypass system level access level restrictions with some form of control but not go through your company’s standard method of doing so because of bureaucracy?
If that’s the case: why not put something in front Like opencloud for example?
I mean, maybe OC is not what you need, but conceptually… would a middleman solution work for you? If so, you could go with a thousand different alternatives depending on your needs.
A cloud solution is indeed an option, however not a very palatable one. The main problem with a cloud solution would be pricing. From what I can see, you can get 1TB for about 10€/month. We’d need substantially more than that. The cost is feasible and not excessive, but frankly it’s a bit of a joke to have to use someone else’s server when we have our own.
You want to bypass system level access level restrictions with some form of control but not go through your company’s standard method of doing so because of bureaucracy?
Yes. Not a company but public research, which means asking for a group change may lead to several people in the capital discussing on whether that is appropriate or not. I’d like this to be a joke, but it is not. We’d surely get access eventually if we do that, but that would lead to the unfortunate side: if we work in that way every new person who has to get in has to wait all that paperwork.
I think he meant self-hosting Opencloud
Yes. That’s what I recommended. Self-host whatever middleman software. Opencloud, WebDAV, S3, FTP, anything he puts in the middle can accomplish what he wants.
I see! Well, I currently do not have another server that has so much storage that we could use for thi purpose. Maybe in the future and that will solve a bunch of problems, this is only one of them.
We do have a storage server, but that is local only and backup only: not going to open it to the internet.
It is indeed a solution. What is absurd to me is to have to consider such a solution that requires two servers.
You don’t need additional storage. It’s one program you need to set up.
It is not something I can setup on that server, I would need a separate server to set up something of that kind.
If it’s a compliance problem, I get it. From a practical standpoint, FTP or WebDAV don’t require installing anything.
I recommended Self-hosting whatever middleman software. Opencloud, WebDAV, S3, FTP, anything you put in the middle can accomplish what you want.
Here’s someone that solved this by monitoring the directory using inotifywait, but based on the restrictions you already mentioned I’m assuming you can’t install packages or set up root daemons, correct?
https://bbs.archlinux.org/viewtopic.php?id=280937
Edit: CallMeAI beat me with this exact same answer by 15 minutes.
I’m in a similar position as you. Our lab has a partition on HPC but i need a way to quasi-administrate other lab members without truly having root access. What I found works is to have a shared bashrc script (which also contains useful common aliases and env variables) and get all your users to source it (in their own bashrc files). Set the umask within the shared bashrc file. Set certain folders to read only (for common references, e.g. genomes) if you don’t want people messing with shares resources. However, I’ve found that it’s only worth trying to admin shared resources and large datasets, otherwise let everyone junk their home folder with their own analyses. If the home folder is size limited, create a user’s folder in the scratch partition and let people store their junk there however they want. Just routinely check that nobody is abusing your storage quota.
EDIT: absolutely under no circumstances give people write access to raw shared data on hpc. I guarantee some idiot will edit it and mess it up for everyone. If people need to rename files they can learn how to symlink them.
Thanks, this is a great idea! I can see you have been doing this for a long time and you’re talking from experience. Regarding shared data: I use this more as a way to give raw data to other people and collect results from them. I use it mostly as a temporary directory used to transfer data, anything significant will get copied over to my share and backed up.
I can see how you could be worried about storage quota, luckily I don’t have that many people to worry about. But it is funny you mention it as I could really see someone stashing a few conda environments in there just because they finished their inside quota…
If you’re not that worried about storage then you can just make copies if necessary, then you don’t really have to worry about permissions (apart from read, which is typically default for the same group). But yea if there’s any chance more than 1 person might work off the same copy of data on HPC, make it read only for the peace of mind. Regarding conda envs, yea I have a few common read only conda environments so that scripts can be used by multiple users without the hassle of ensuring everyone has the same env. Quite useful.
The shared environment thing seems like a very cool idea! I’ll try to set it up.
deleted by creator
I have a similar need and I am curious whether my current solution is any good:
The data of interest is on a server which can only be accessed with ssh inside the institution. I’ve setup a read-only nfs share to a server which has a webserver (https enabled). There, I set up a temporary webdav share to the read-only nfs mount point and protected with htpasswd, hence external institution members do not have accounts at our institution.
As soon as the transfer is complete I remove all the shares (nfs, webdav).
This is a good idea and something I may setup once we setup our own compute server. However at that point wouldn’t a synced directory be a better fit for the purpose? Such as you define a directory on the external server to be used to share data and every user syncs it to their own share on the main server to get all the shared data through rsync or unison.
Just throwing it out there, I’m not sure if that fits your use case.
