--- schema_version: "1" id: a47d850e75de18ef0b69bc0528c6e2ebac905b5c02336e7cfbda4573273a1889 title: "Step 4: Safe list Input and Output locations" collection: tableau version: current locale: en-gb portal_url: https://docs.salesforce.com/tableau/current/en-gb/server/prep_conductor_configure_network_shares.md canonical_url: https://help.tableau.com/current/server/en-gb/prep_conductor_configure_network_shares.htm source_site: help.tableau.com content_type: documentation content_hash: c6940c409ee38b9e4f2fa2b668dfb2c12d7566823cf2787c66f9c7ad3db515bd description: Safe list network input and output locations for Tableau Prep flows. --- [Skip to main content](#main-content) # Step 4: Safe list Input and Output locations This topic describes the rules that apply to this feature and how to safe list the directories on your network. Flow input and output connections may need to connect to databases or files in the directories on your network. You must safe list the directories you want to allow access to. Input and Output connections will only be allowed to connect to data in the safe listed locations. By default, no connections are allowed. **Note**: You can still publish the flows and any data that is embedded in the flow file (tflx) to Tableau Server, but the flow will fail to run if the directories aren't included in your organisation's safe list. ## How to safe list input and output locations The following rules apply and must be considered when configuring this setting: - The directory paths should be accessible by Tableau Server. These paths are verified during server startup and at flow run time and are **not** verified at the time of publishing the flow to Tableau Server. - If the flow reads from or writes to a .hyper file on a network share, add the path to the directory containing the file to the native\_api.allowed\_paths allowlist. For more information, see [tsm configuration set Options](https://help.tableau.com/current/server/en-gb/cli_configuration-set_tsm.htm#nativeapiallowedpaths). - Network directory paths have to be absolute and cannot contain wildcards or other path traversing symbols. For example, `\\myhost\myShare\*` **or** `\\myhost\myShare*` are invalid paths and would result in all the paths as disallowed. The correct way to safelist any folder under _myShare_ would be `\\myhost\myShare` **or** `\\myhost\\myShare\`. **Note:** The `\\myhost\myShare` configuration will not allow `\\myhost\myShare1`. In order to safe list both of these folders safe list them as \\\\myhost\\myShare; \\\\myhost\\myShare1. - **Windows:** - The value can be either `*`, (for example, `tsm configuration set -k maestro.input.allowed_paths -v "*"`) to allow any network directory or a specified list of network directory paths, delimited by a semicolon (**;**). If you specify a list of directory paths, be sure to specify particular directories rather than the root of the file share. - If the path contains spaces or special characters you will have to either use single or double quotes. Whether you use single or double quotes depends on the shell that you are using. - No local directory paths are allowed even when the value is set to `*`. - To save flow output to a network share, you must first [configure a Run As user](https://help.tableau.com/current/server/en-gb/runas_acct.htm) service account on Tableau Server. You cannot save flows to a network share using the default system account. Then configure the target directory on the network share for Full Control permissions for the Run As user account you created. Depending on how your organisation manages nested folder permissions, you may need to grant additional permissions in the folder hierarchy, with a minimum of Read, Write, Execute, Delete and List Folder permission, to allow the Run As user account access to the target folder. - **Linux:** - The value can be either `*`, (for example, `tsm configuration set -k maestro.input.allowed_paths -v "*"`) meaning that any path, including local (with the exception of some system paths configured using “native\_api.internal\_disallowed\_paths”), or a list of paths, delimited by a semicolon (**;**). - You must be using a kernel version equal to or later than 4.7. Safe listing to or from a network share is not supported on kernel versions earlier than 4.7. On earlier versions, when the output is written to a network share, hyper fails to output files, resulting in flows failing at runtime. When reading input files from a network share on earlier versions, flow executions fail. To check the kernel version, in the Linux terminal, type the command `uname -r`. This will display the full version of the kernel you are running on the Linux machine. Note that for Red Hat Enterprise Linux, kernel version 4.7 and later is only available with Red Hat Enterprise Linux version 8. - To save flow output to a network share, the local Linux account that has access to Tableau Server resources must be given Full Control permissions to the target directory on the network share. If a path is both on the flows allowed list and internal\_disallowed list, internal\_disallowed takes precedence. The mount points for both input and output paths used by flows must to be configured using the `native_api.unc_mountpoints` configuration key. For example: `tsm configuration set -k native_api.unc_mountpoints -v 'mountpoints'` For information about configuring this, see this Tableau Knowledge Base article: [Tableau Server on Linux - How to Connect to a Windows Shared Directory](https://kb.tableau.com/articles/howto/tableau-server-on-linux-how-to-connect-to-a-windows-shared-directory?lang=en-gb). Use the following commands to create a list of allowed network directory paths: **For input connections:** `tsm configuration set -k maestro.input.allowed_paths -v your_networkdirectory_path_1;your_networkdirectory_path_2` `tsm pending-changes apply` **For output connections:** `tsm configuration set -k maestro.output.allowed_paths -v your_networkdirectory_path_1;your_networkdirectory_path_2` `tsm pending-changes apply` > [!IMPORTANT] > > Important: > These commands overwrite existing information and replace it with the new information you provided. If you want to add a new location to an existing list, you must provide a list of all the existing locations and the new one you want to add. Use the following commands to see the current list of input and output locations: > > `tsm configuration get -k maestro.input.allowed_paths tsm configuration get -k maestro.output.allowed_paths` ## Next step [Step 5: Optional Server Configurations](https://help.tableau.com/current/server/en-gb/prep_conductor_config_server_optional.htm) ### Who can do this On Windows, members of the local computer Administrators group can run _tsm_ commands. On Linux, members of the **tsmadmin** group can run _tsm_commands. The **tsmadmin** group can be configured using the _tsm.authorized.groups_ setting.