Centrally manage your file servers and SMB shares: delegate resource ownership, grant access down to a single file, move data on schedule and stay aware of every file operation.
Overview
DIRIO is a file resource management system for corporate networks: a central console, agents on file servers, Samba with a purpose-built VFS module, and clients for workstations. Administrators manage servers, shares and permissions from one console, while resource owners manage access to "their" folders without filing IT tickets. Every grant is confirmed by a person, every operation is logged.
All featuresThe management console shows file servers, SMB shares, sessions and open files in real time, auto-refreshing every 10 seconds. Samba profiles are applied centrally: a common [global] section plus shares as drop-ins, validated with testparm and backed up before every application.
The administrator assigns an owner and deputies to each resource — from then on the owner manages access from the DIRIO client: they see the effective access (rules plus actual users with acceptance statuses), grant and revoke permissions, and hand ownership over to another employee. When an owner leaves, ownership is transferred in a couple of clicks.
Access can be granted to any folder or a single file inside a share — the DIRIO VFS module builds a virtual tree based on the grant policy: invisible paths never appear in directory listings, and direct access to them returns "no such file". Users see exactly what they are allowed to see.
A migration job can be scheduled for a specific time: 15 minutes before the start the resource switches to read-only, clients get notified, mounts automatically flip to read-only and back after completion. Data flows directly from source to target — the target server's agent performs the copy.
Creation, modification, deletion, rename — owners see operations on their resources in the client ("Action audit"), administrators see all shares in the console. No listing noise: only meaningful events. Every action is recorded, and the log retention depth is configurable; administrator actions live in a separate console audit journal.
Every resource — accessible shares and owned resources — is delivered to workstations by the DIRIO client. Mounted folders automatically get desktop shortcuts, the tray hosts a quick menu: one-click mounting, a jump to "My resources" (ownership), refresh from the server. Access-grant and scheduled-migration notifications arrive in the client notification center with an unread badge and are duplicated by email.
An agent's first run on a server is always in observe mode: DIRIO only inventories Samba and shows what it intends to manage. The modes observe → co-manage → full are enabled step by step, and the Drift indicator highlights any deviation from the desired state — no production surprises.
Features
A control plane for file infrastructure: servers, shares, SMB sessions, open files and events — auto-refreshed every 10 seconds.
New
Every share gets an owner and deputies: delegated access management without IT tickets, ownership transfer in two clicks.
Learn moreGrants on any folder or a single file inside a share. The VFS module hides everything that is not allowed: invisible paths return ENOENT.
How it worksNew
Users confirm access with "Accept" or decline it. Owners see statuses: accepted / declined / pending.
Client notification center with an unread badge, pop-ups and email duplication (SMTP is configured in the console).
New
On-schedule data migration with a read-only window: sources include Linux over SSH (rsync), SMB network folders and Windows via WinRM.
ScreenshotNew
Real file operations — create, modify, delete, rename — without listing noise. Every action is recorded, and the log retention depth is configurable.
ScreenshotNew
A "DIRIO permissions" context menu in Nautilus (GNOME) and Dolphin (KDE) — grant access right from the file browser.
Agents register with the server, send heartbeats and apply the desired state. The Drift indicator exposes deviations.
The single delivery point for resources: a tray GUI and a CLI, automatic desktop shortcuts, access and migration notifications, silent re-mount after outages.
ScreenshotIntegrations
LDAP sources: single sign-on for administrators, roles bound to directory nodes (OUs/groups) and dynamic collections.
SPNEGO for clients and sec=krb5i mounts — share access via domain tickets, no stored passwords.
Export of access events and administrator actions: Syslog RFC 5424 (UDP/TCP/TLS) and HTTP webhook — KUMA, MaxPatrol, Splunk.
dirio-fm-gnome and dirio-fm-kde packages: a "DIRIO permissions" context menu in GNOME and KDE.
Architecture
The central server (control plane) manages agents on file servers and a Samba container with a purpose-built VFS module. Workstation clients mount shares via Kerberos and talk to the console over HTTPS.
An existing Samba server connects through the agent — no container, no reinstall.
The control plane: web console and HTTPS API, PostgreSQL, RBAC roles, LDAP directory, migration scheduler and audit journals.
A systemd service on the file server: registers with the console, sends heartbeats, inventories Samba and applies the desired state.
Turnkey Samba in a container: smbd, the vfs_dirio VFS module (C) and a dirio-authz service authorizing sessions over a Unix socket.
An agent's first run is always in observe mode. Then co-manage (managed shares alongside manual ones) and full. The Drift indicator reveals deviations from the desired state in advance.
A ready-made script migrates a live SUFR installation to DIRIO: database, OS user, systemd units and paths. It is idempotent and can be run repeatedly.
Security
event export: Syslog RFC 5424 (UDP/TCP/TLS) and HTTP webhook — KUMA, MaxPatrol, Splunk.
of console and API traffic over HTTPS. Clients use Kerberos SPNEGO; mounts use sec=krb5i.
default grants: fail-closed VFS plus an explicit "Accept" confirmation from the user.
An agent's first run on a file server is always in observe mode: DIRIO changes nothing until you switch the server to co-manage or full.
Roles with a permission matrix, binding to directory nodes (OUs/groups) and dynamic filter collections.
The VFS hides forbidden paths from readdir, and direct access returns ENOENT — the share structure is never revealed.
VFS sessions are authorized by dirio-authz over a Unix socket: if the service is unreachable, access is denied.
Migration source passwords are encrypted (Fernet) and never appear in job logs.
Every action is recorded: user file operations and administrator actions; log retention depth is configurable.
Syslog RFC 5424 (UDP/TCP/TLS) and HTTP webhook: KUMA, MaxPatrol, Splunk.
Screenshots
Shortcuts to mounted folders on the desktop, the client window with mount points, and the tray menu: resources, "My resources" (ownership), refresh from the server. The notification badge covers access grants and migrations.
Who created, renamed or deleted what and when — per share, with color-coded operations. Log retention depth is configurable.
Status and mode of every server, agent version, Drift indicator — Linux hosts and the DIRIO Samba container in one table.
Managed shares with type, server and path. Row actions: owners, permissions, migration.
Scheduled runs, dry-run, ACL transfer and rate limits. Sources: SSH/rsync, SMB, WinRM.
A permission matrix across categories: from console access to share and migration management. Roles bind to LDAP.
Sign-ins, access rule changes, owner assignments and migration jobs — every administrator action is on the record.
Servers, online agents, shares and Drift — plus control plane health: CPU, RAM, disk and load.
DIRIO is a corporate file resource management system: a central console (control plane), agents on file servers, Samba with a purpose-built VFS module, and workstation clients. It replaces scattered smb.conf files and IT tickets with a transparent process: every resource has an owner, every grant has a confirmation, every operation has a log entry.
The console administrator assigns an owner and deputies to a resource — assignees receive a notification. The owner then uses the DIRIO client ("My resources" tab) to see the effective access: rules plus actual users with their acceptance statuses. They edit rules, grant access to any folder or a single file, and can hand ownership to another employee while staying a deputy. Every change lands in the console audit journal.
The user gets a notification in the client and by email with a choice: "Accept" (confirm access) or "Decline" (the grant is deactivated). Access is active immediately, and the owner sees its status. A decline applies to the whole resource and survives rule edits; re-granting asks for confirmation again.
Yes. The DIRIO VFS module builds a virtual tree from the grant policy: rules can point to any path inside a share. Invisible names are hidden from directory listings (readdir), and direct access to a forbidden path returns "no such file" (ENOENT) — the user never learns that someone else's data exists.
A job can be started manually or on schedule. 15 minutes before the start the resource switches to read-only: clients are notified, the resource icon shows a lock, and mounts automatically flip to read-only — and back after completion. The target server's agent performs the copy, so data flows directly from source to target. Supported sources: Linux over SSH (rsync), SMB network folders and Windows via WinRM with a temporary share; dry-run, ACL/xattr transfer and rate limits are available.
Server and agents ship as deb packages (Astra Linux, Debian, Ubuntu) and rpm (RED OS, RHEL); the console deploys to Docker. Clients are Linux: a CLI, a tray GUI (PyQt5) and Nautilus/Dolphin integration; Astra's fly file browser is supported. User directories: MS AD, FreeIPA, ALD Pro; client authentication uses Kerberos (SPNEGO) with sec=krb5i mounts. Windows packages are on the way.
Yes. The dirio-agent-linux agent installs on an existing server without any container: it inventories Samba and, in co-manage/full modes, manages shares through central profiles. Every application is preceded by an smb.conf backup and a testparm check, and the first run is always in observe mode. There is also a script for migrating a live SUFR installation to DIRIO (database, OS user, systemd, paths).
The console and API run over HTTPS only; administrators sign in via LDAP (AD, FreeIPA, ALD Pro) with an RBAC permission matrix. VFS sessions are authorized by the dirio-authz service over a Unix socket in fail-closed mode: no answer, no access. Migration source passwords are encrypted (Fernet). Journals cover file operations and administrator actions — retention depth is configurable, and events are exported to SIEM.
Next steps
We will show DIRIO on a demo stand — the console, delegated ownership, migrations and audit — or discuss a pilot on your own file servers, starting in observe mode with zero production changes.
An online tour of the console and clients on our demo stand, with answers to your architecture and security questions.
Write to info@dirio.ruWe will connect your file servers in observe mode and show the real picture: shares, sessions, Drift.
Discuss a pilotOr directly: info@dirio.ru · +7 995 437-14-87
