Solved

Restrict windows fileshare by IP or hostname

Posted on 2013-01-10
6
1,699 Views
Last Modified: 2013-01-16
We have a Windows 2008 file server that has some shares on it and access to these shares is controlled by NTFS permissions. However there is one share that has a special requirement that it should not be accessible remotely . We have used 2008 GPO preferences to map the drive based on source IP's and groups so when users who have access to this share connect remotely via Citrix they do not get this share mapped but they are still able to click on a link or UNC into the share. Is there any way to restrict this share itself to internal IP or hostname of their computer only?

Eg:

Dir: c:\shared_folder shared as Share1
allowed hosts: IP address, IP range or Computer name &
allowed users: DOMAIN\SecurityGroup

Access should be allowed if both conditions are met. I am not sure if this is possible. Thanks for your help
0
Comment
Question by:nassr101
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
6 Comments
 
LVL 9

Expert Comment

by:djsharma
ID: 38766308
0
 

Author Comment

by:nassr101
ID: 38766360
Thanks for replying. I am not sure if restricted groups is the solution. I do not need to control or modify access to groups on the server. I need to restrict access to a share based on where the user is connecting from.

Internal LAN IP = allow access
Remote access IP = deny access

Not sure if this is possible at all.
0
 
LVL 25

Expert Comment

by:Coralon
ID: 38769400
Is that server used for anything else from the Citrix environment?

If it is not, you could put in a dummy host entry to prevent it from being easily 'found'.  

Another option might be tinkering with IPSec.. but that's more than I have ever done.

Another option that springs to mind.. maybe add that particular server to the untrusted sites zone?

Coralon
0
Online Training Solution

Drastically shorten your training time with WalkMe's advanced online training solution that Guides your trainees to action. Forget about retraining and skyrocket knowledge retention rates.

 
LVL 12

Accepted Solution

by:
TomRScott earned 500 total points
ID: 38769529
Start with hiding the share by appending "$" to the share name. And changing the share name at the same time is recommended.

That will stop the GUI "clicking" for all but administrators. BUT, those that know or can guess the share name can still map the drive using a command line.

This may be a start. However, it is really security through obscurity and obviously not the ultimate solution.

Depending on the bandwidth requirements of this and the other shares and resources available on the server you could use Hyper-V and create a guest server for the cost of another OS, dedicating one or more CPU cores and some RAM from the now virtual host server.  That done, you could then dedicate the guest server to that one share (and others like it to follow) and block all remote traffic to it from the remote zones at the Citrix host.

The latter does cost an OS ($) and some resources but is a more vanilla configuration.

 - Tom
0
 

Author Comment

by:nassr101
ID: 38769588
Thanks Tom, it is certainly a good work around. I will leave the question open for a couple of days to see if someone else can suggest something else. Cheers.
0
 
LVL 77

Expert Comment

by:Rob Williams
ID: 38769965
The only possibility to restrict by IP would be to block/allow the file and print service ports by specific IP or subnet when accessing remotely by VPN or other means, however where you are using Citrix/RDP they are the same LAN so that rules that possibility out.

The only other option would be if a 3rd party add-on exists that monitors IP's and controls connections, but I personally have never seen one that would do that.  Usually access is controlled by user name and associated NTFS/security permissions on the file/folder.
0

Featured Post

Is Your AD Toolbox Looking More Like a Toybox?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I had a question today where the user wanted to know how to delete an SSL Certificate, so I thought that I would quickly add this How to! Article for your reference. WHY WOULD YOU WANT TO DELETE A CERTIFICATE? 1. If an incorrect certificate was …
This article provides a convenient collection of links to Microsoft provided Security Patches for operating systems that have reached their End of Life support cycle. Included operating systems covered by this article are Windows XP,  Windows Server…
This tutorial will give a short introduction and overview of Backup Exec 2012 and how to navigate and perform basic functions. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as conne…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
Suggested Courses

622 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question