Moodle 2.0 and mapped network drives

[CyberNerd]

Hi All.

I'm setting up a moodle 2.0 server for sept 2011 and have some questions about how best to use the filesystem repository so that Moodle can use our mapped network drives.

 

Our Moodle 2.0 will be on an RHEL6 machine that is in a DMZ. The drives are on an FC SAN.

Our shared mapped network drive is on an internal RHEL5.5 machine, the drives are also provided from a FC SAN (on a different LUN than the new Moodle webserver).

The samba shares on the fileserver provide a 'staff' folder which is confidential and one folder for each yeargroup. The yeargroup directories are writable by staff, but not by students.

 

The goal is to get the yeargroup directories as repositories for Moodle, so that staff can just use the mapped drives to upload files.

 

I have several options, but not sure which to do.

 

Ideally I (think) I should rebuild the internal samba server using a clustered filesystem (GFS2) then map the LUN onto the webserver and the samba server simultaneously, but this could this then expose the confidential staff folder to the webserver if it was compromised? Also a lot more effort.

 

I could make the webserver a samba server, and do away with the internal fileserver. Again a security issue? easier to do as I can just remap the LUN without changing the filesystem.

 

I could open the firewall and map the student drives via NFS (or SMB) seems simple enough in theory, what would happen when the fileserver reboots? Which would be better NFS/SMB? the filesystem only needs to be read only.

 

Whats your thoughts on my best options? any other ideas?

[pete]

Would a scheduled one-way sync from fileserver storage > webserver storage fill all your requirements? Have you / do you want to use the storage required to do that?

 

From a security perspective, I'd initiate rsync over ssh from the fileserver on the internal lan to the webserver in the DMZ. That way compromising the webserver gets you nothing internally.

However it really depends how much storage you're prepared to spend to do that.

[CyberNerd]

Hadn't thought of that. Agree it would be the most secure method. Not too keen on doubling up on storage, I like the idea of having everything in one place. Teachers might get frustrated over sync time. hmm maybe I could get samba to initiate a sync when a file is saved.....

[pete]

Had another thought. Look at incron to watch for file changes and then do something.

 

inotify - get your file system supervised

Linux.com :: Scheduling jobs based on filesystem activity with incron

[nathanfriend]

An NFS share sounds like the best option.

[james_yale]

A NFS or SMB mounted share is definitely the way to do this, duplicating the storage seems unnecessary. The problem I suspect you will run into is permissions on the mounted share, whether you've copied the data across or not. Since you will be accessing the data via the web server the permissions applied will be those of the web server, not the user logged into Moodle (in this case). This will make it difficult to enforce access permissions on the data you're trying to keep private between different sets of users.

 

In Moodle 1.9 there is a module called smbwebclient which creates a SMB connection using the credentials of the logged in Moodle user, getting round this problem but as far as I know nothing like that exists for Moodle 2 yet.

[pete]

In Moodle 1.9 there is a module called smbwebclient which creates a SMB connection using the credentials of the logged in Moodle user, getting round this problem but as far as I know nothing like that exists for Moodle 2 yet.

 

IIRC the PFY here has fixed the 1.9 module to work with Moodle 2. And I think he did/was going to submit a patch.