2

A network shared folder KAISHA contains a bunch of folders

  • Accounting
  • IT
  • Management
  • etc...

The shared folder is hosted by a Linux / Samba4 machine, that serves Active Directory as well.
Clients are Windows 7+.
All of that works fine.

However, only accounting people have access to Accounting, only IT people have access to IT etc...

But, everyone sees all the below folders when connecting to KAISHA, even though they may not have an access inside.
It would be better to see only the folders to which one has access.

Question: is there a setting in Active Directory / Folder sharing / Folder permissions to only show a folder to people having at least Read access to it?

  • You may be able to grant "Traverse Folder" on "KAISHA" but not "List Folder". This should make it so they can't see the directories, though they likely won't be able to see their own directory either (they must know the name to get to it). – ssnobody Jun 29 '15 at 22:06
  • This is called Access-based Enumeration, by the way. – Daniel B Jan 1 '16 at 16:51
  • 1
    @Ringo . . . You say only accounting people have access to Accounting, only IT people have access to IT etc... based on these words, there will NEVER be an instance where some one person will need access to more than one directory beneath this KAISHA share. If that is the case, then you can have these people's mapped drives map to the applicable departmental subfolder rather than the share. If there are cases where that's cross departmental for some, then that may not work. Not sure how you're mapping the drives on the Windows PCs like login script, group policy preferences, etc. – Pimp Juice IT Jan 3 '16 at 6:09
2
+150

Add to the smb.conf file the following.

To hide inaccessible files/folders :

hide unreadable = yes

To hide non-writable files/folders :

hide unwriteable files = yes

Restart Samba for this to take effect.

  • Using this but how do we have Samba update the list of files when we change permissions to a folder or add users to a group so they now have access to a folder. Anyway to do this without restarting samba? – Amala Feb 15 '17 at 18:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.