DSM 6.2 How can I hide Shared Folders from unauthorised users?

[DeltaGolf]

I can't work this out, so its either blinding obvious or not possible...

I have ten shared folders and six users. Three users haver permission to read & write folders A, B, C, D and E but not the other folders. The other three users can read and write only to F, G, H, I and J.

But when User One accesses the server (via SMB, on a Mac) she's given a list of shares to select from which includes all the folders she's not allowed access to. (Not to mention the confusion of 'home' and 'web'.)

Can I set things up so a user is only presented with folders they have permission to access?

 

[tekguru]

I had / have the. same problem, it seems to me that shares / folders are always visible to all users and when they click on the folder do they fail to access them. You can of course choose to hide the share but that is then hidden to everyone.

 

[fredbert]

Have you tried enabling 'Hide sub-folders and files from users without permissions'? It's a setting available for each Shared Folder and accessed via Control Panel.

There's also a setting 'Hide this shared folder in "My Network Places"'.

Since I'm using a Mac I've not much idea what that second one does but the first seems to remove visibility of shared folders that my standard user has no permissions.

 

[tekguru]

Yep I'm using both of those, but it seems that if you open the 'network' overview either via smb on the Mac of network explorer on the PC the shares themselves are always visible even the ones a user does not have any permission to access.

'Hide sub-folders and files from users without permissions' does indeed hide data within the share.

'Hide this shared folder in "My Network Places"' seems nor to work on a Mac

 

[DeltaGolf]

Have you tried enabling 'Hide sub-folders and files from users without permissions'? It's a setting available for each Shared Folder and accessed via Control Panel.

Mmmm, I might try that shortly. If I create an 'overall' folder called "The File Server" and placed all my shared folders inside that, then the above works? If so users need to browse to smb://MySynoNAS/The File Server where they should see only folders thy have permission to view.

Thinking out loud, I'll try it later unless you all say you tried and it don't work!

 

[Seaprobe]

'Hide sub-folders and files from users without permissions' does indeed hide data within the share.

'Hide this shared folder in "My Network Places"' seems nor to work on a Mac

On my Catalina iMac it does work, as long as I connect and browse with my non-admin account. The tricky thing with the Mac is that it helpfully keeps track of network credentials in the keychain, but its logic for choosing one or the other -- even just to browse -- is rather opaque.

One suggestion is to delete any Mac keychain entries for your NAS other than your normal NAS user (and Time Machine if you have that set up with its own NAS user).

 

[fredbert]

its logic for choosing one or the other -- even just to browse -- is rather opaque.

Someone's feeling very generous today. I'd only keep my normal credentials in key chain, if I were to do that, cos I never know what it decides to use.

But for me using the hiding from unauthorised users setting does stop them from being displayed. I didn't consider if it would be effective for NAS admin users, only standard users. Whether by Finder sidebar (to select the NAS) or Finder's Connect to Server I only get offered the shares that my user account has access.

 

[DeltaGolf]

'Hide sub-folders and files from users without permissions' does indeed hide data within the share.

'Hide this shared folder in "My Network Places"' seems nor to work on a Mac

I think I might be agreeing with @Seaprobe. "Hide this shared folder in "My Network Places" does hide the folders on a Mac (10.15.5 Catalina). It hides them from all users, including those who have permission to access them. (Here I'm talking about accessing shared folders via the Mac's "Connect To Server..." using SMB.) My reading of the instructions was that that was just a PC thing.

Whether by Finder sidebar (to select the NAS) or Finder's Connect to Server I only get offered the shares that my user account has access.

You'll need to share your setting with me then! I've set myself up as a 'normal' user. I have given myself permission to access only one shared folder. I'm not a member of any groups allowing further permissions. But when I login I get the full list of shared folders...

 

[fredbert]

Maybe in File Station check each Shared Folder's permissions and see if there's an Everyone rule. Here you can also use the Permissions Inspector to work out what a user is allowed.

 

[DeltaGolf]

Maybe in File Station check each Shared Folder's permissions and see if there's an Everyone rule. Here you can also use the Permissions Inspector to work out what a user is allowed.

No, doesn't appear to be that!

I'm starting to wonder about the difference between a Shared Folder and a folder which is shared.

To start I've set up a bunch of Shared Folder, recreating the way I had a macOS Server working. It all seems to want to work the same way. A user gets access to a Shared Folder but maybe not all of them. In this scenario I can't prevent unauthorised users from seeing a list of all the Shared Folders on my NAS. Even after following hints 'n' tips kindly provided here.

Then I thought I could put all the folders I want to share in one big Shared Folder and set it to "hide sub-folders and files from users without permissions" but that was a cunning plan because I can't see how to easily set permissions for sub-folders.

Seems to me some folk are saying I can do what I want and others are seeing the same as me.

 

[fredbert]

Not sure what to suggest then. Maybe you're right and I gave up (and no longer look too hard at this).

======
You could use just one Shared Folder and then have a folder per user in that?

As my admin user, I also have created a 'file archive' Shared Folder where all my standard users have read access. At the top-level of this I then created a folder per standard user, assigned ownership to the user, added Full Control privilege to that user, and Everyone has custom privilege of just 'Read' traverse folders/execute files. I think that last bit was needed to enable something to work. Within here I also placed a 'Video Station' folder for their own personal VS library.

At the top level of 'file archive' there's a 'Shared' folder that all users can access.

When I use AFP/SMB to mount this share all I then see is 'my folder' and Shared.

 

[Imcon]

We would like to have this option as well! To hide shared forlder from users without the permission.

 

[bmcmullan]

I know this is a very old post, but the thread comes up in search engine results which sent me here.

So for the benefit of others who may trod this path: THE SOLUTION (for SMB, on v7 OS), go to File Services --> SMB, and there enable Hide shared folder from users without permission

 

[fredbert]

That was suggested earlier in the thread.

https://www.synoforum.com/threads/h...lders-from-unauthorised-users.3140/post-14480

But...

https://www.synoforum.com/threads/h...lders-from-unauthorised-users.3140/post-14508

Has it changed in DSM 7? This thread started on DSM 6.

 

[Gerard]

That was suggested earlier in the thread.

https://www.synoforum.com/threads/how-can-i-hide-shared-folders-from-unauthorised-users.3140/post-14480&ref=v0lKv

But...

https://www.synoforum.com/threads/how-can-i-hide-shared-folders-from-unauthorised-users.3140/post-14508&ref=v0lKv

Has it changed in DSM 7? This thread started on DSM 6.

Both of these links are dead can you please remove so as not to clutter the topic with dead links? Bmcmullen’s post is simple enough for future readers

 

[fredbert]

Fixed the links: the ‘&ref=v0lkv’ bit caused the problem.

This fix was already proposed but there was still an issue with visibility. That’s why I responded pointing back to the points in the thread where this setting was not the 100% fix that we would expect.

 

[Gerard]

Fixed them: the ‘&ref=v0lkv’ bit caused the problem.

These links are still not relative and is not the solution to the problem, these have already been discussed in this thread.

What @bmcmullan posted is in addition to checking the about there is also a setting in file services smb, which is exactly the solution to this thread. I too came across this setting about 6 months ago which accomplished what is being discussed here and had nothing to do with the shared folder settings.

 

[fredbert]

To avoid confusion for people that google to here I’ve marked the thread as related to DSM 6.2, which is what was being discussed in 2020.

I see that in DSM 7 there is the new SMB option to hide shared folders from users without permission, which was not available in DMS 6.2. Back then it was only settings in each shared folder, which Mac Finder seemed to interpret as hiding the shared folder if the user had no access permission… Or was that due to the Network Places setting?

 

[Gerard]

To avoid confusion for people that google to here I’ve marked the thread as related to DSM 6.2, which is what was being discussed in 2020.

This makes more sense. But I'd imagine people searching for the same resolution now a days would need to look into File Services SMB. I've checked the 6.2 documentation and like you said the SMB option doesn't appear to be there. But the solution for those on 6.2 looking to accomplish this should upgrade to DSM 7 to resolve, and those new from a google search looking to solve this problem in DSM 7, should see @bmcmullan 's post.