Re: [vps2] [cpx] - neat quota related story

[Steve Yates <steve@xxxxxxxxxxx>]

On Fri, 01 Apr 2005 18:45:03 +0200
ADNET Ghislain <gadnet@xxxxxxxxxx> wrote:

>   Say i have 50 mailboxes of 5Mo =  250Mo, this is the virtual quota. I 
> want also to limit the overall quota to 100 Mo. This way he can allocate 
> mailboxes for 250Mo but they cannot fill up to more than 100Mo in total.
> 
>   So account quota   X+Y+T+E  =< XX admin quota  but  account CONTENT 
> x+y+t+e =< YY virtual admin quota.
> 
>   I think this can be done with group quota i think.

	One would think, but it doesn't appear group quotas work like
that.  In reality the challenge to this is that all quota-enforced files
would have to be owned by the "domain's group."  For example log files,
web content, etc.  "user:www" owned files would not count towards the
group quota.

	Simply being a member of a group doesn't make files written by a
user subject to the group's quota...the quota only affects files owned
by the group.  So there are many files owned by the user that aren't
necessarily owned by the shared group, for example all the user
preferences and settings.  Those aren't counted in a group quota total,
and any files owned by say systemuser:domaingroup aren't counted against
a domain admin's quota.

	I think what would have to happen is that end users are created
as members of a "domaingroup" instead of each to their own group.  Then
if that's the user's default group I believe any new files would
naturally belong to username:domaingroup (?).  This is how we had been
doing things pre-CPX.  The only reason I can think of not to is the
potential for one end user to read another end user's files if the group
has read permissions.  That end user would have to have SSH or FTP
access however.

 - Steve Yates
 - ITS, Inc.
 - Old Pooh bears never die. They just don't "Bother!"


======================================================================
This is <cpx@xxxxxxxxxxxxx>      <http://www.groupmail.org/lists/cpx/>
Before posting a question, please search the archives (see above URL).