I'm looking to move from POSIX ACLs with NIS to NFSv4 ACLs, and would appreciate some guidance to help avoid failure. Funny enough, the chatbots were fairly useless when faced this real-world scenario. and I have failed to find relevant publishments or any (stared) git repos for projects around it.
We have ~2PB of data, a few million files, and around 50 users. The environment is currently split across six NFS exports. Each night, a script applies in each export different POSIX permissions to individual files for individual users.
The script also distinguishes between executable and non-executable files (using the file command) and only grants execute permissions to files that are actually executable.
Moving forward, I'd like to replace this with an inheritance-based NFSv4 ACL model using RO/RW/Full groups per export. Later, the plan is to move to AD and nest the per-export groups into role-based groups (e.g., Developers, Designers, Sales, etc.).
A few real-world questions:
- Do people simply set inheritance and leave it alone, or do you periodically enforce/reapply ACLs since inheritance only affects newly created files?
- Do you keep, remove, or modify the default OWNER@, GROUP@, and EVERYONE@ entries?
- Is there a practical reason to manage execute permissions separately?
- The main reason we currently do it seems to be cosmetic: preventing non-executable files from showing up in green when using ls --color.
- Would you simply grant execute permissions through inheritance to everything and stop worrying about it? (I suggested separate bin directories for executable content, but that idea didn't get much support).
Any comments on the overall approach, lessons learned, sample real ACL/commands you are using, or any gotchas before starting this migration would be greatly appreciated.
p.s another taught I have as a windows engineer, is just to NTFS it all and use user-mapping... but I'm worried I'll be escorted out of the building (and that it's not very vendor-agnostic).
Thanks.
