Mount pools as a network drive

With the drive, SecureFiles Drive, pools appear as directories, with their folders and files below. It is mounted over WebDAV, which Windows, macOS and Linux speak out of the box. You need no VPN and no extra software. Files can be read, added, renamed, moved and deleted there, with the same rights and scans as in the portal.

What the drive shows

• Every pool you own or belong to, as a directory. The top level only lists the pools, and files belong inside a pool.
• Folders and files according to the rights in the pool and on the folder. What is not visible in the portal does not appear here either.
• Only scanned or explicitly released files. Your own files that are still being scanned are visible only to you. A file you just added can be opened right away up to 8 MB, a larger one after the scan.

These do not appear on the drive:

• end-to-end encrypted pools, because the server only holds ciphertext there,
• pools that require a second factor, because an app password is only one factor,
• files a viewer may only see as a stamped view,
• expired or blocked pools.

Guests have no drive. A pool with guests appears to the owner and to members with an account like any other pool, as long as it is not encrypted.

If two pools or two files on one level carry the same name, the second entry gets a short suffix in brackets.

Adding and changing

• Adding: a file goes into the pool as with an upload in the portal and is scanned. If a name already exists in the folder, a new version is created.
• Folders can be created, renamed and moved from the editor role upward. Pools themselves are only created in the portal.
• Deleting moves the file to the recycle bin of the pool.
• Renaming to a new extension only works if the extension would also be allowed on upload.
• The limits of the pool, the rule and the quota apply as in the portal.
• If someone opens a file for editing, it is locked for others until it is closed again.

Helper files from Finder, Explorer and Office such as ._Name, .DS_Store, Thumbs.db, desktop.ini or ~$Name stay with the program and do not end up in the pool.

Create an app password

Programs like Explorer do not sign in the way a browser does. So they get a separate password that only applies to the drive.

1. Open Drive in SecureFiles.
2. Choose New password and enter a Label, such as the name of the device.
3. Under Validity, choose Unlimited, 30 days, 90 days or 1 year. Under Access, choose Read and write or Read only. Under Pools, you can limit the password to individual pools. Without a selection it applies to all your pools.
4. Copy the password. It is shown only once.

Create one password per program or device. If a device goes missing, revoking its password is enough. A user can hold at most 20 app passwords at a time. If the tenant requires a second factor, a password can only be created from a sign-in with a second factor.

An app password never grants more rights than the user has. Anyone who leaves a pool or loses a right on a folder sees that on the drive with the next request.

Mount the drive

The address and user name are on the Drive page under Mount the drive. The user name is your own email address, and the app password serves as the password.

• Windows: open This PC in Explorer and choose Map network drive, pick a drive letter, enter the address in the Folder field and tick Connect using different credentials.
• macOS: in Finder, choose Go, Connect to Server and enter the address.
• Linux: open the address in the file manager with davs:// instead of https://, or mount it with a tool such as rclone.

Windows: connect with a drive letter

On Windows the drive belongs on a letter, such as Z:. It is connected correctly when it appears with this letter under This PC.

The entry Add a network location and the link Connect to a Web site mount the drive without a letter. Files can then be seen and copied, but Microsoft Edge and Google Chrome will not open them from that path: only the empty program appears. In that case, disconnect the drive and connect it again through Map network drive with a letter.

It is quicker with a command at the command prompt. The Drive page in the portal shows it with your address and user name, ready to copy. Windows then asks for the app password without showing it.

Windows names the mounted drive DavWWWRoot. Right-click and choose Rename to give it a name of your own.

Linux and tools: rclone

rclone speaks WebDAV and mounts the drive without a file manager too. The address is on the Drive page.

rclone config create securefiles webdav url=<address> vendor=other user=<user name>
rclone config password securefiles pass <app password>
rclone mount securefiles: ~/SecureFiles --vfs-cache-mode writes

For scheduled syncs, a Read only password limited to the one pool is often enough.

If something does not work

Error 0x800700DF, file larger than 50 MB (Windows). The Windows WebClient limits transfers to 50 MB by default. The limit sits in the Windows service, not in the pool. Raise it at a command prompt with administrator rights, here to the maximum of about 4 GB:

reg add HKLM\SYSTEM\CurrentControlSet\Services\WebClient\Parameters /v FileSizeLimitInBytes /t REG_DWORD /d 4294967295 /f
net stop webclient
net start webclient

Larger files go through the portal with no change. The limits of the rule and the pool still apply.

Windows will not connect. The WebClient service must be running. Check it in services.msc and set the startup type to Automatic so the drive survives a restart.

Error 0x80070780 when copying. The target is the top level, which only holds pools. Copy the file into a pool.

The drive is empty. The password only applies to pools the drive does not show, such as expired ones. The Drive page points this out for such a password. Create a new password for another pool.

Windows does not ask for the new password. If an old password was stored, disconnect the drive with net use Z: /delete and connect it again.

Very large folders. Windows also limits the amount of file details per folder, by default roughly 1,000 files. Subfolders help. The limit is called FileAttributesLimitInBytes and sits in the same place in the registry.

It is slow. A drive over the internet transfers each file when it is opened. It keeps no copies for offline use. It is not meant for programs that keep a database on the drive.

Security

• The app password consists of 256 bits of randomness. Only its SHA-256 value is stored.
• The connection runs exclusively over HTTPS.
• Every download through the drive is in the pool log, just like a download in the portal.
• The drive slows down repeated failed sign-ins per address and user name. A device that only repeats an old password does not lock out the whole office.

Unlike a download in the portal, files on the drive pass through the drive service. It fetches downloads from storage and passes uploads on to it. Only when replacing an existing file does it hold the content briefly until it has arrived in full.

Back to the SecureFiles overview.