Disabling public shares?

[SPF]

Hello all. I'm trying to understand Sharing. It seems to be "all or nothing", in that you can disable the users' ability to share anything, or else you have to let them be able to publicly share everything. Is this correct?

There are some users who I would prefer to disable their abilities both to create public shares (which are world accessible w/o having an account) and "External Guests" where the user can give non-users a password to access the share. But I would like to retain their ability to share with other internal users. Is this possible?


p.s. also, is there a log file which records any shares that are created and removed?

[Bill Brock]

When setting up a share you configure for internal, external and/or public. You then tell it who can access the share and what their role is(none, view, manage).

[mmorse]

Bug 19047 - restrict public shares

[SPF]

Originally Posted by Bill Brock

When setting up a share you configure for internal, external and/or public. You then tell it who can access the share and what their role is(none, view, manage).

What I meant was that the administrator can't stop users from making global shares unless he revokes their ability to share anything.

So your users can make their own web content, share any kind of files on the Internet, etc. Thats probably fine with many, but not everyone has a business reason to allow this.

MMorse - thank you for the link. Do you know if there is a log that tracks when shares are created and deleted? Otherwise, how would you even know what your users are sharing to the Internet?

[bmdesmet]

I had a similar concern with wishing to disable public folders. I choose user education and to simply audit the shares with a cronjob. Below is the basic script I am using. Yes, it is crude and quite brute force (I would happily take suggestions for improvements).


#!/bin/bash
#run as user zimbra

for NAME in `zmprov gaa example.com`;
do

zmmailbox -z -m $NAME gaf|sed '1,2d'|awk '{$1=""; $2=""; $3=""; $4=""; print }'|sed 's/^[ \t]*//'|grep -v @ | while read FOLDER;
do

RESULT=`zmmailbox -z -m $NAME gfg "$FOLDER" |grep public|sed 's/^[ \t]*//'`
if [ "$RESULT" != "" ]; then
echo -e "$NAME\t$FOLDER\t$RESULT"
fi

done

done


If you wished to remove the public shares, you could simply use
zmmailbox -z -m $NAME mfg "$FOLDER" public none
along with the echo line. Note that the wiki account has some public folders by default, and I don't know what would break if you removed those shares.

This takes about 90 minutes to run on a sever with a pair of dual core opterons and four gigs of ram hosting about 100 users with a total of about 4000 folders. The majority of the time spent by the script is the spinning up of java for each of the zm* commands. I bet I could probably make it faster by using zmprov in interactive mode with expect.