Disable Admin access to share

Question

My company has just purchased and installed one of these units to serve as a backup location for ShadowProtect. Our IT service provider have informed us that their policy is: "to configure onsite backup repositories with only a single, unique user having write access, in order to minimise the risk as much as possible." This has us in a bit of a quandry as we are unable to deselect the administrator group from having access to a share.

Is it possible to remove the administrator group from a share so that a single user only has access? I did find this post but it's a couple of years old now.

I was unable to select the unit from the above list:
ReadyNAS RR2304
Firmware Ver 6.9.2

Sandshark · Answer

What are you trying to prevent?&nbsp; As long as the admin account is only ever used via HTTPS for administering the NAS, I don't see where there is much risk.

mdgm-ntgr · Answer

The admin account/group should only be used for administrative purposes, so it has full access
&nbsp;
In any case any admin could still go into the web admin interface and change any settings even if their permissions for accessing shares were restricted so there's not much point to doing so.

Gonadman2 · Answer

You are correct - but any user that is assigned administrative priveleges automatically gains access to the share. Locking the share down to a single user is a smart thing to do.

So again, is there any way to remove the admin group from share access? It wasn't an issue with our previous QNAP device.

Gonadman2 · Answer

As this unit is managed by multiple users, there is the possibility that someone can create a new user under the administrator group, then use those newly created credentials to access the share on the network. If their local PC becomes compromised (crypto or other malicious attack), then they have direct access to the backup shares. If it were possible to remove the administrator group from having network access to the share this scenario could never be allowed to happen.&nbsp;&nbsp;Obviously we can 'manage' this situation through administrative control, but I'd prefer to lock our backups down to a single user and prevent anything like this from ever happening.

StephenB · Answer

Gonadman2 wrote:
As this unit is managed by multiple users, there is the possibility that someone can create a new user under the administrator group, then use those newly created credentials to access the share on the network.

I understand why you want this, but anyone who could do that already can get full access to the entire NAS data volume without creating that new user.&nbsp; For instance, they can

mount the full data volume with SMB using admin credentials
just change the network access and file access settings on the share, via the NAS admin UI
create a backup job to copy the share somewhere else
enable ssh, and give themselves root access
...

&nbsp;
The only way to really accomplish your goal is to also create specific controls on what each admin can/can't do - which would be a good feature for the NAS, but isn't there right now.
&nbsp;
FWIW, it is possible to go in with ssh and modify the ACL for the share (or perhaps specific subfolders in the share - which might be stickier).&nbsp; Though it doesn't really prevent the threat, for the reasons noted above.
&nbsp;

Forum Discussion

Disable Admin access to share

8 Replies

Related Content

Disable external Access

Cannot access Orbi Admin login screen

Router working, can't access admin page

Admin Passwort

unable to access router admin page due to https

NETGEAR Academy

ProSupport for Business