up vote 4 down vote favorite
share [g+] share [fb]

OK folks, I don't think this is possible, but:

Got a client who needs to allow domain users to read files in a directory.

The catch is, he does NOT want them to BROWSE the directory.

basically, they know a filename and a location, so they can open it directly. ( assume they will be pasting the entire path\filename into the file / open dialog.

Is there any way to do this?

Additionally, they should not be able to see directory structure although this might be OK.

My feeling is to put all these files behind an application front-end, give permissions to the (web) app, and remove all direct domain user access to the files. Utilize app security.

Other method suggestions are welcome. I do not have full details of the application arch, but since it is all file based, I feel that a front-end needs to be written to handle this. ( Note that I'm an application guy, not an admin. I only play an admin on tv..... I do know enough admin stuff to be extraordinarily dangerous, so no need to be TOO simplistic )

link|improve this question
Lots of good answers here. Thank you all so far. I've been busy over the weekend and will be looking into the answers given more over the next couple of days. – Bob Housedorf Dec 5 '11 at 1:15
Something more to add to this. As currently requested by the client, he wants EVERYONE to have read permission for all files. He just does not want them to be able to browse and see ALL the file names. – Bob Housedorf Dec 5 '11 at 1:24
Yes, this is bad as if the "filename" gets out to other customers, they have access. I'm marking the ABE answer correct as that will allow me to create groups for each of his clients, adding permissions as needed for the group/files, and add users to the group. Even if they guess a filename, they still won't be able to open it. As a bonus with ABE, they won't even be able to see the other file names. Not very scaleable, but this will do very nicely for now. – Bob Housedorf Dec 5 '11 at 1:32
feedback

3 Answers

up vote 4 down vote accepted

This should be fairly easy. Enable ABE (access based enumeration) on the share and make sure that you set the NTFS permissions correctly on the files and folders within the share.

http://technet.microsoft.com/en-us/library/dd772681(WS.10).aspx

Alternately, the Bypass traverse checking user right grants the Everyone group (by default) the ability to taverse folders that they don't have NTFS permissions on in order to get to files that they do have NTFS permissions on. Here's what to do:

  1. Grant the Everyone group Change and Read permissions on the Share.

  2. Set the appropriate NTFS permissions on the folders and files within the share.

A user may then access the files directly via

\\servername\sharename\foldername\filename

As long as you have the Share and NTFS permissions set correctly the users will be able to access the appropriate files without being able to browse the contents of the share.

link|improve this answer
1  
bump +1 for direct answer, even if I disagree with it ;-) – Avery Payne Dec 2 '11 at 4:01
Thanks much. We may not agree but I respect your position just the same. – joeqwerty Dec 2 '11 at 4:08
feedback
up vote 4 down vote

The problem with your setup (assuming I understand it correctly as "have all files in a single directory") is that a clever client can guess the filenames of other people, and gain access to their data, so it doesn't matter that they can't browse, it only matters that they can pick up any file by name, and that means other client's files.

In other words, obscurity does not imply security, only that it is out of sight, out of mind. Someone with a little imagination will come along and see right through that.

I'd re-think the approach, and possibly isolate each client to a subdirectory that only they have permissions to. You would then be able to isolate the client to that location only by sharing the client's specific directory level upwards...and they could browse all they want, because there is nothing else to see. When they connect/log in, they only get access rights to "their directory"...it won't matter that there are other directories because they don't get access to them (lacking the correct privileges).

link|improve this answer
I wholeheartedly concur. – Driftpeasant Dec 2 '11 at 3:17
I disagree. My assumption is that the OP will have the appropriate NTFS permission set on the contents of the directory so users will not be able to access files that they don't have explicit NTFS permissions on. I don't see this as security by obscurity. This scenario is exactly why ABE was created. The pointy haired boss' desire to hide the contents probably has nothing to do with security and everything to do with confidentiallity. Of course I'm assuming that the OP means that he needs to grant specific users access to specific files and not grant Domain Users access to all files. – joeqwerty Dec 2 '11 at 3:24
The problem is that it's not entirely clear why it is being done. You could set ACLs on a per-file basis, but that still doesn't stop the directory browse situation, only the data access. If it's a function of "hide our other clients from the client making the connection" then you're better served by segregating the data. Otherwise, it's plain goofy at best and smart clients will see it for what it is. If it's a function of "give data to the correct client" then it still doesn't make sense to lump data into a giant bucket, just give every client their directory and control it that way. – Avery Payne Dec 2 '11 at 3:31
I'm going to make the client have subdirs for each customer, with random folder naming, and still have an AD Group for each client. Even if they guess, they won't get into the files. – Bob Housedorf Dec 5 '11 at 1:11
One of the items that I didn't mention, because I have not yet dragged the reason out of the client, is that apparently he has a bunch of "data" files. He wants to give out filenames, but not let them browse for files which they have not paid for. It sounds like a case of a terrible architecture, but I don't yet know the full story. I'll add more comments as I know more. – Bob Housedorf Dec 5 '11 at 1:19
feedback
up vote -2 down vote

Sharing a specific directory (and no higher) in Windows is as simple as right-clicking the folder you want, clicking "Share", and adding users.

When they want to access it, they will use the UNC path \\server.domain.local\name_of_shared_folder

That's it!*

*Please make sure DNS is set up correctly. Double-check the firewall too.

link|improve this answer
2  
This does not actually answer the question. – MikeyB Dec 2 '11 at 3:25
Yeah, definitely not. Did you bother to read the entire question? – MDMarra Dec 2 '11 at 3:45
I guess I missed something. Should I retire this answer? – JoelESalas Dec 2 '11 at 7:58
Actually, I could create a share at the appropriate depth, and then restrict the browse ability in ntfs. This is a solution that I had not even thought of, so it's actually not that far off base Joel. Please do leave it. It's forcing me to think out of the box somewhat. With this answer, I don't have to fool with traversing rights, and not allowing users to see branches of a tree. – Bob Housedorf Dec 5 '11 at 1:14
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.