BrickStor Web Drive

BrickStor Web Drive provides browser-based file access to BrickStor SP datasets. Functionally similar to SMB or NFS, Web Drive is an additional sharing method for accounts that need to interact with files without configuring a desktop file-sharing client.

Web Drive can be enabled in Hub as a dataset sharing option. It does not replace SMB, NFS, or S3 access, and it does not change the dataset’s existing permissions, data protection, or Active Defense configuration.

About

Web Drive runs as a separate webdrived service. The service hosts the Web Drive application and brokers file operations between the browser session and BrickStor SP.

Web Drive uses the BrickStor SP S3 service as its internal data path. Hub presents Web Drive as dataset sharing, but the dataset is made available to Web Drive through an S3 bucket mapping. This is why the Web Drive share name must be a valid S3 bucket name and why webdrived must be able to reach the BrickStor SP S3 endpoint.

When an account signs in to Web Drive, webdrived authenticates the account with Active Directory credentials and obtains temporary credentials for the session. File and folder operations are performed as that signed-in account. BrickStor SP continues to enforce dataset ACLs, share permissions, and any applicable ABAC markings, so each account can see and modify only the data it is authorized to access.

Datasets shared through Web Drive remain protected by Active Defense. Web Drive access is evaluated as part of the dataset’s existing security and protection model; enabling Web Drive does not bypass behavior analytics, incident detection, or configured dataset protections.

Enable Web Drive for a dataset

Enable Web Drive on a dataset from the dataset sharing options in Hub. The Web Drive share name becomes the S3 bucket name used by the underlying service, so the name must follow S3 bucket naming rules.

Valid Web Drive share names:

  • Are between 3 and 63 characters long.

  • Start and end with a lowercase letter or number.

  • Contain only lowercase letters, numbers, dots (.), or dashes (-).

  • Do not contain consecutive dots (..), dot-dash (.-), or dash-dot (-.) sequences.

  • Do not resemble an IPv4 address, such as 192.0.2.10.

Because Web Drive uses Active Directory for authentication, verify that the system is joined to Active Directory before publishing access. Also confirm that the Web Drive service is reachable from the required client networks; by default, the service listens on TCP port 8267.

In production, do not expose the Web Drive service port directly to the internet. Publish Web Drive through a reverse proxy.

To enable Web Drive for a dataset in Hub, follow the steps below:

  1. Navigate to the Datasets page.

  2. Create a new dataset or select an existing dataset to modify.

  3. In the dataset sharing options, enable Web Drive.

  4. Review the dataset configuration and save the changes.

  5. Confirm that the intended Active Directory users have the required dataset permissions.

Access Web Drive from a web browser at the Web Drive service address, such as https://<brickstor-hostname>:8267, unless a reverse proxy publishes a different URL. The dataset page in Hub also provides a Web Drive URL in the dataset’s Web Drive section; click that URL to open the dataset share directly.

Reverse proxy configuration

For production deployments, publish Web Drive through a reverse proxy instead of exposing the service port directly. A reverse proxy provides a stable browser URL, terminates traffic with a trusted SSL certificate, and limits direct access to the Web Drive service port to the proxy and any required internal management paths.

         Internet users
                |
             TCP 443
                |
                v
+-------------------------------+
|          DMZ network          |
|         Reverse proxy         |
+-------------------------------+
                |
            TCP 8267
                |
                v
+-------------------------------+
|         Data network          |
|      BrickStor / Web Drive    |
+-------------------------------+

Configure the reverse proxy to pass the original client source IP address to Web Drive by using X-Forwarded-For or X-Real-IP; Web Drive checks X-Forwarded-For first. Also pass the User-Agent header so UB events and ABAC evaluation can capture the originating client information. These headers are optional, but without them, data access events appear to originate from the reverse proxy instead of the actual client.

Web Drive also enforces Content Security Policy (CSP) and Cross-Site Request Forgery (CSRF) protections. When Web Drive is published behind a reverse proxy, preserve the public host and scheme so CSRF origin validation matches the browser address. Pass Host and X-Forwarded-Proto to Web Drive.

If CSP customization is required at the reverse proxy, replace the upstream Content-Security-Policy header instead of appending a second policy. Keep the policy restricted to the Web Drive origin unless a specific integration requires another trusted origin.

NGINX configuration example:

location / {
    proxy_pass https://brickstor.domain.local:8267;
    proxy_ssl_verify on;
    proxy_ssl_verify_depth 2;
    proxy_ssl_trusted_certificate /etc/nginx/ssl/brickstor-ca.crt;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header User-Agent $http_user_agent;

    # Optional CSP override when a local policy exception is required.
    # proxy_hide_header Content-Security-Policy;
    # add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; frame-ancestors 'none'; object-src 'none'; script-src 'self'; style-src 'self'; img-src 'self' data: blob: https://www.gravatar.com; font-src 'self' data:; connect-src 'self'; form-action 'self'; manifest-src 'self'; media-src 'self' blob:; worker-src 'self' blob:" always;
}

HAProxy configuration example:

frontend webdrive_https
    bind :443 ssl crt /etc/haproxy/certs/webdrive.pem ssl-min-ver TLSv1.2 alpn h2,http/1.1
    mode http
    option httplog
    option forwardfor
    http-request set-header Host %[req.hdr(Host)]
    http-request set-header User-Agent %[req.hdr(User-Agent)]
    http-request set-header X-Forwarded-Proto https

    # Optional CSP override when a local policy exception is required.
    # http-response del-header Content-Security-Policy
    # http-response set-header Content-Security-Policy "default-src 'self'; base-uri 'self'; frame-ancestors 'none'; object-src 'none'; script-src 'self'; style-src 'self'; img-src 'self' data: blob: https://www.gravatar.com; font-src 'self' data:; connect-src 'self'; form-action 'self'; manifest-src 'self'; media-src 'self' blob:; worker-src 'self' blob:"

    default_backend webdrive_backend

backend webdrive_backend
    mode http
    server webdrive brickstor.domain.local:8267 ssl verify required ca-file /etc/haproxy/ssl/brickstor-ca.crt check

HA deployments

For HA configurations, deploy Web Drive on a separate, central Linux system rather than on either HA node. The Web Drive host should remain available independently from node failover and should provide a stable browser endpoint, typically through the reverse proxy described above.

Configure Web Drive to reach BrickStor SP through the HA resource group address or hostname. The resource group address follows the active owner of the protected datasets, so Web Drive continues to connect to the node currently serving the resource group.

Do not configure Web Drive to connect directly to an individual HA node management address or hostname. A node-specific target can interrupt access after failover, even when the resource group is online on the partner node.

SSL validation for S3 access

Web Drive connects to the BrickStor SP S3 service over HTTPS and requires a trusted S3 server certificate. On BrickStorOS, the S3 service certificate is trusted by default. On Linux deployments, trust must be configured manually by using a CA certificate or pinned service certificate, or validation must be explicitly disabled.

The Web Drive service configuration is stored at /etc/racktop/webdrived/webdrived.conf. Configure the BrickStor endpoint and certificate validation settings in the BrickStor section.

[BrickStor]
BaseEndpoint = "https://brickstor.domain.local:8266"
CAFile = "/etc/ssl/certs/brickstor-ca.crt"

CAFile can point to a CA certificate that validates the S3 service certificate, or to the S3 service certificate itself for direct certificate pinning.

TLS validation can be disabled with TLSNoVerify, but use this only for temporary testing or troubleshooting.

[BrickStor]
BaseEndpoint = "https://brickstor.domain.local:8266"
TLSNoVerify = true

Restart webdrived after changing the configuration.