How to hide subfolder from specific user

[Timidfriendly]

I would like to hide a few subfolders from specific user.

• I have a share folder called 'Web'.
• The Usergroup called 'web-only' has full-access to this folder only. All other shares are hidden from this Usergroup.
• Within this folder there is a subfolder called 'Projects'.
• I want to hide this folder from a specific user called 'MrWeb' (he is a member of the Usergroup 'web-only').

How do i do this?

I have tried using the QNAP > Access Right Management > Share Folders > Folder permissions(button) and checking the checkbox called 'Deny Access', for this user, but the folder remains visible to him.
The folder is not accessable to the user because if he tries to enter it he gets the following message:

Code: Select all

        Server said: /Web/projects: No such file or directory
        Error -125: remote chdir failed

But i'd rather not have the file visible at all to him. Is there a way i can achieve this and hide it from him completely?

[trejder]

I have the same need. After a quick search through this forum I found this post:

viewtopic.php?t=51819

Seems that "Advanced Folder Permissions (aka. ACL support)" should be the answer to your needs. However, I haven't tested it yet (applying and configuring ACL takes some time).

[pwilson]

I have the same need. After a quick search through this forum I found this post: Block access to subfolder within shared folder?

Seems that "Advanced Folder Permissions (aka. ACL support)" should be the answer to your needs. However, I haven't tested it yet (applying and configuring ACL takes some time).

QNAP offers a Tutorial: Advanced Folder Permissions on QNAP NAS

I hope this document will help.

As for the hiding part, there are a number of ways of "hiding" shares.

If you want to hide the share from Windows generally, simply name the share "Project$" rather than "Project". This will hide it from all Windows machines. (It can still be mapped for "authorized" users, but it will be invisible to all).

If you want more information on Hiding under Samba check out:

Chapter 8. Advanced Disk Shares

This chapter excerpt is available by clicking on the HyperLink I provided. (I own a hardcopy of this book). This document is freely available on Samba.Org, so I believe providing this URL here is compliant with the Forum Rules here.

Good luck.

Patrick.

[Timidfriendly]

Thx for all your help. I took the time to go through all the links posted, but unfortunately had no success. The QNAP documentation nowhere describes how to hide certain subfolders. It only shares how to block access which is what i already have.

I don't just want to hide files and folders from windows, but from all systems and especially those with FTP access.
As far as I have understood, Advanced Folder Permissions has to do with the windows enviroment and not the qnap system level.

The Samba book was heavy reading and didn't explain where to add the suggested code. I am very thankful for all your advice, but was hoping for a QNAP-userfriendly solution that didn't require an indepth knowledge of Microsoft Networking Host Access Control or the Unix command line.

This is much more complicated than i anticipated

[schumaku]

There is no way to explicitly _hide_ a folder to some users. Hidding files or folders is - in M$ terms - a "global" thing. Similar on the Linux side.

s far as I have understood, Advanced Folder Permissions has to do with the windows enviroment and not the qnap system level.

Nope. There are POSIX ACL set in place on the file system. Still, "hide" does not exsit in any ACL world - just roughly access or no access. So the ACL in pkace apply to acccess from Microsot Networking, ftp, or afp - so by no way something SAMBA-only.

Wr're operating sume NAS with restricted access for the ftp users - well, as thee are no ftp-users, these are users using ftp - but tis is done on a shae level. Shares, where the ftp-users have no access are not shown to them at all...

Can't tell you without some testing, if the same i possible by applying restrictive ACL to some subfoldder structures or not.

[tmt]

Actually, many versions of Windows do support Access-based Enumeration, but I don't believe this is true of the QNAP.

[schumaku]

Not there yet wiht testing on the NAS, suspect some hide options allow even more granularity in SAMBA - however, tis is SAMBA-only, not "general" Linux, or the ftp server. Potentially, similar controls exist for proftpd?

From http://www.samba.org/samba/docs/man/man ... onf.5.html :

hide dot files (S)
This is a boolean parameter that controls whether files starting with a dot appear as hidden files.

Default: hide dot files = yes

hide special files (S)
This parameter prevents clients from seeing special files such as sockets, devices and fifo's in directory listings.

Default: hide special files = no

hide unreadable (S)
This parameter prevents clients from seeing the existance of files that cannot be read. Defaults to off.

Default: hide unreadable = no

hide unwriteable files (S)
This parameter prevents clients from seeing the existance of files that cannot be written to. Defaults to off. Note that unwriteable directories are shown as usual.

Default: hide unwriteable files = no

One example, where QNAP (well, it defaults to that in SAMBA ) is already using is to hide the homes share, which is required with the Home Folder option to map the //NAS/homes/[usename] folder to the //NAS7homes on a per-user base. However, when accessing the (/share) root by ftp, the /homes share is visible again.

[Timidfriendly]

Ok, so if i have understood correctly you have Users accessing through FTP and have managed to hide folders from them. This is great.This is what I have for the main share folder, but i also want this for the subfolders.

Is this possible. If so how?

[schumaku]

Is this possible. If so how?

The suspect answer would be in the HideNoAccess config diective for proftpd:

http://www.proftpd.org/docs/directives/ ... ccess.html

However, we don't have the full control on the ftp config ... something to add for QNAP I thinnk

[Timidfriendly]

@schumaku: This looks very promising.
- Where in the QNAP system do I have to apply this rules? What is the path and file name?
- I am a terminal noob, but I can get around and change file contents only I need some pointers as the syntax looks like pretty specific.
Could you possibly give me an example how I should apply the 'IgnoreHidden in conjunction with HideNoAccess.' to the folder 'Projects' in the parent share called 'Web'?

[schumaku]

We can't...

However, we don't have the full control on the ftp config ... something to add for QNAP I thinnk

[Timidfriendly]

ok Thanks for all your help anyway. Was very educational

[karl800]

Try this guys,

Regards too NTFS you will need enable ACL on the QNAP Shares.

For Access Based Enumeration
I figured this out and posted it on my site too http://www.stokepcsupport.co.uk/tips-an ... workaround


First things first, if not already got this, you will need download putty from http://www.chiark.greenend.org.uk/~sgta ... nload.html
once downloaded an run, you will just need select ssh and enter your Qnap name normaly the \\storagename without the \\
you will then be prompted with login

Enter admin then your password which you use to manage your Qnap

Now enter the following:

cd /etc
vi smb.conf

Now you will see a list of lines of configs. I added a new line just after “Display Charset = yes”

To add a new line you need to type the following

*i press return
hide unreadable = yes
press Return
press esc
:w

Now that file should be edited and you can close putty down.
If you browse to your \\storagename\departments\ you will notice the access denied folders will be hidden and the only ones you will see are the ones you have access.

I hope this helps you guys.