Cloud Storage Gateway:Use Windows access control to enable access-based enumeration

Prerequisites

Before you begin, ensure that you have:

• An SMB share with the Windows access control feature enabled. For more information, see Enable Windows access control.

• A Windows-based ECS instance in the same VPC as the CSG instance. For more information, see Create an ECS instance.

• The following domain users created on the domain controller: Administrator, user1, and user2.

Background information

In the Windows file system, files and folders are visible to all users by default, even to users who do not have access permissions. After you enable ABE, the shared directory mounted on the client displays only the folders that each user has permission to access, while the shared directory itself remains visible.

ABE is suitable for the following scenarios:

• Protect sensitive directories: Hide folders that contain sensitive information, such as customer data and projects under development, to prevent unauthorized users from viewing directory names.

• Simplify directory structures: In large shared directories, display only folders that are relevant to the user to reduce clutter.

In this example, the ECS instance runs Windows Server 2012 R2 Datacenter Edition.

Add user permissions

Grant domain users read and write permissions to the SMB share in the CSG console. Existing share permissions are not affected when you add new users.

1. Log on to the Cloud Storage Gateway console.

2. Select the region where your file gateway is located. On the Gateway List page, find and click the target file gateway.

3. Click the Shares tab. In the Actions column of the target SMB share, click Settings.

4. In the SMB Share Settings dialog box, add Administrator, user1, and user2 to the Read/write Users list.

5. Click Confirm.

Mount the shared folder and configure folder permissions

Mount the SMB share on the Windows ECS instance, then configure NTFS folder permissions so that each user can access only their designated folder.

1. Log on to the Windows ECS instance.

2. Open Computer and click Map network drive.

3. Select a drive letter, enter the mount target of the CSG instance in the Folder box, and then click Finish.

   You can view the mount target on the Shares tab of the target gateway in the CSG console.

4. In the Windows Security dialog box, enter the Administrator username and password, and then click OK.

   Use the username format <AD domain name>\Administrator, where <AD domain name> is your Active Directory (AD) domain name.

5. In the mounted shared folder, create two folders: user1 and user2.

6. Right-click the user1 folder, click Properties, and then select the Security tab.

7. Set permissions on the user1 folder so that only Administrator and user1 have access:

   1. Click Advanced. On the Permissions tab, click Disable Inheritance, remove permissions for Everyone and Domain Users, and then click Apply and OK.

   2. Click Edit. In the permissions dialog box, click Add, enter user1, and then click Check Names.

   3. In the Windows Security dialog box, enter the username and password for user1, and then click OK.

      Use the username format <AD domain name>\user1.

8. Repeat the previous step for the user2 folder, granting access only to Administrator and user2.

Verify Windows access control

1. In This PC, right-click the mounted shared folder and click Disconnect.

2. After the page refreshes, repeat steps 2 and 3 in Mount the shared folder and configure folder permissions to remount the shared folder.

3. Connect to the shared folder as user1, user2, and Administrator in sequence and verify the results:

   • user1 can view only the user1 folder.

   • user2 can view only the user2 folder.

   • Administrator can view both the user1 and user2 folders.

You have now enabled access-based enumeration for the shared folder by using the Windows access control feature of Cloud Storage Gateway.