Networks

Ask something
Question Locked

NTFS permissions to lock down a text file?

0 helpful
14 replies

by tech_lady 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Here's the situation: A user (accounting clerk) on our network using accounting software creates a payroll ACH report that writes as a .txt file to a folder on our network. This file is then copied/drug to an online secure banking repository for processing by another user (the clerk's supervisor). Currently an "Accounting" group in AD, Administrators, and System have FC permissions on the folder and inheritance is enabled.

The problem is that auditors have an issue with the created files being editable by users (even the user who created it)and want it locked down after creation. We need to apply permissions that will allow the user (via an action in the software) to create and write the file to the folder, but then NOT be able to edit it once it is created. The file will need to be able to be read by the bank after dropping it at their repository. Currently, the creating user shows as the owner of the files.

If you need to know... We are running Windows Server 2003 and all workstations are Windows XP Professional.

Can anyone help me with this permissions issue?

THANKS.

14 replies

by markp24

Hi,

would it be possible to create a vbs script or batch file to run XCACLS and change the file to Read only for all when the application that creates it exits?
or change the folder permissions to special permissions and allow Create and read, but deny change and delete.
ill post more once i think this out a bit more

by cmiller5400

Those auditors know how to make us go bald.

I'm sure that it can be accomplished somehow using the NTFS permissions, but be warned, deny permissions take precedence, even for Administrators.

I'd start by looking closely at the advanced permissions set. I'd bet there is a combination that will accomplish what you need. Below is a link to a good article explaining permissions.

http://articles.techrepublic.com.com/5100-10878_11-6084446.html

by mafergus

If it's only one user, set the application to run as a unique user so it is able to access the file and the user wouldn't need rights to location at all.

by master_key

I think the shared folder permission need to be checked, becuase you can allow the creator only to have full access, or r/w/change, thus other users will face that.

If you have active directory on the server, right click on that folder or this specific file and grant permissions to other users. hope it could help :)

by tech_lady

Thanks for the ideas. We only run payroll every 2 weeks, so I created a folder (as a test) with the user running the file-creating software having only the following NTFS permissions which I thought would work: (Allowed these; denied none)
Traverse folder/Execute File
List Folder/Read data
Read Attributes
Read Extended Attributes
Create files/Write data
Read permissions

So, I had the user try to process the payroll and let the software write the file to this test folder, but she gets a pop-up error that says "File not created" or something to that effect. When you navigate to the folder the file is actually there, but contains 0 kb.

I like the idea of running the software as another user, but the software interacts with a network database and numerous data files, so I'm not sure how well that would work.

I need this figured out. It seems like it should be simple, but it is definitely not. Is there some way I can let the software write the files to a folder with Full Control, then trigger a script or something that will copy the file to a different folder with locked-down permissions and then delete the original?

I guess I'm grasping at straws... Thanks for help.

by seanferd

Can't you set permissions on that folder so that this user can move the file to the folder, but no other access rights are granted to the folder?

If users need access to that folder otherwise, I'd consider a new, locked-down folder to which to move only these text files. Deny everything, allow Create Folders/Write Data. This should allow the user to dump the file in, but not access the folder to access a file to edit it.

by markp24

Hi,

I would like to try the "run as" option, Is there a staging/ test setup your can try this on to ensure it doesn't cause unforeseen issues?

I also like the last post for tamper proofing the file.

by tobif

Typically any program, which collects data for a report will create the file (when it is opened in the program), and then, row by row, it will append rows to the file, but since it's not allowed to make changes to the file, we're stuck.

by tobif

Instead of fiddling with file system, permissions and so on, I have another idea to deal with the same problem:

Let a script in the system use PGP or GNUPG to sign the file! The digital signature can be put in a separate file or the signed text can be embedded within text delimiters, depending on what you need.

Now, anybody can verify the file hasn't been tampered with.

by tech_lady

I love the idea, but I don't know how to do it. If you can provide steps so I can intelligently sell this to the accounting department and the auditors, I'm game!

by tobif

Oh. It was ages since I was playing with these things. So I can't really walk you through. But I can give some general ideas and do a bit of selling...

GENERAL
You'd typically have the script run by a system process, and this would be the only account allowed to access the private key, which is needed to create the the digital signature. Oh, have the procedure timestamp the data before the everything is signed. On the one hand, that will give some encryption "salt", so that even if two months would have exactly the same payments (down to the letter), you'll have different time stamps, and different digital signatures for these two files.

Anybody with access to the public half of the signer's keyring can verify the signature.

COMPARISON PGP - GNUPG
This is the dangerous part. I played with these things several years ago. So chances are someone can give an update.

PGP: commercial package. Very easy to use GUI for verification. (Can easily be integrated into your users desktop to secure files, exchange encrypted emails etc.
For the server script, you'll need to download a CLI add-on.

GNUPG: Open source, partially compatible with PGP. Very stron CLI, so the script part should be easy. GUI a bit less developed. (but this may have changed) Due to license issues, it supports less algorithms than PGP.
---
Again, fellows, please comment on current status for these packages.

EDITed the title, for visibility

by tobif

Here's an abridged security email I received from Microsoft on Aug 12.
And, if you feed your PGP with the following aand with the public key of Microsoft, you'll find that the message has been tampered with

And, as I mentioned, a signature may also be in a separate file, as far as I know.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

********************************************************************
Title: Microsoft Security Bulletin Minor Revisions
Issued: August 11, 2010
********************************************************************

Summary
=======
The following bulletins have undergone a minor revision increment.
///HUGE SCISSORS HAVE WORKED HERE :) ///
For legal Information, see:
http://www.microsoft.com/info/legalinfo/default.mspx

This newsletter was sent by:
Microsoft Corporation
1 Microsoft Way
Redmond, Washington, USA
98052

-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.9.0 (Build 397)
Charset: utf-8

wsFVAwUBTGM2+/SWSWlRYp1gAQibkA//TSaHnYtIrIi+uKjfXD11m7J/FbV31yEm
ZZ2TUtXK6VXZ05eozgsL/O0H9k96gYVXbco1V06R81zwY2w8sZUTmrxnywKK3i5b
ubJcPV4UaRyytZn7LsV4mg1hDO0gpOd7edkpEloVqUM6RfSkB/SpBj0GYvss6vD0
v5YSeaeNGjrNTiggXo3WSuZq7Tfe6jFIrWvNKyq2E0HsHlLi7UVk9708Rz6fbugo
4P6vEkmOoX1GGEf4a0rGGisWmMnfDAnIxQI5sEl3E5MXw9ZIXQdOoAEfvZyCkfdr
q7gwlTnXOIT7BKdBTtpr30lmiDPRrzGKyF+93eE6EDN7cU0Rs2KgzJqkuB9cSv+/
ChV2y2BKPr3pyJDUY5sclp/cw7EgYRAbxqA9I9nQbXMOvq94VRiETvSi1FJSRQoO
tanRl2Vy2eAGOgwNnYtf1xuGZxkBNackIxON2Mm5Kfd7SDiXX+Bzo4tHg/qTq0sc
CJam/fbeykFFu+c3zWkojd4acfD+AuLdaiU1NFaNgE7jNvsobupPa+ssdY66RhRu
zlCJX/HmKgCw+GFysn/5K9hGjIyu7gSDIg3LArsUBpYxiyZihfTqX3yMGr+8O3T6
8uSgtbID0vqq+ItS/Qkr9mOu5xbbZcZ/m8FFJOoYycuIs9GPAkoBvZFM1apV32MG
c3345FjfeBg=
=tPfu
-----END PGP SIGNATURE-----

This discussion is closed to new replies.