An access-list is a list of rules, usually held on network devices such as switches, routers or firewalls, that matches network traffic. The specific term 'access-list' is used in the context of Cisco devices, although the concept of an 'access list' is more generic.

learn more… | top users | synonyms (3)

2
votes
1answer
33 views

ACL permissions not inherited

I have a Ubuntu 14.04 server with an EXT4 partition. I want to change what permissions new files and folders get when they are created in /home/myuser. I set some options with setfacl, and getfacl ...
0
votes
1answer
21 views

LDAP group access controls

I'm trying to set up our LDAP server so that members of the pwmadmins group can change people's passwords for them. To be more specific, we have PWM for Tomcat set up and are trying to let pwmadmins ...
1
vote
0answers
67 views

LDAP build script failing on openLDAP-2.4.31 ( ldapmodify -Y EXTERNAL -H ldapi:/// )

I want to set the password to the backend admin so that I can change the LDAP ACL to what I need... needless to say I don't want my config posted all over the place, plus the .ldif files are correct. ...
0
votes
0answers
66 views

Webmin: restricting DNS zones visible to a user per view not working?

I'm setting up my own webmin installation to manage a BIND9 DNS authoritative server hosting a few zones. The zones are separated into 2 views: internal and public. There are different groups of ...
0
votes
0answers
27 views

Samba4 creates unnecessary acl permissions on new folder

I am using samba4 ad dc on ubunut 14.04. When User user1 in Group group1 is creating a new folder in the directory \ADS\sysvol\ads.dns\newFolder, then the folder has the following ACL: $getfacl ...
0
votes
0answers
7 views

Maintain ability to set/unset group write permission with ACL

If I have a folder owned by root:www-data with rwxr-s--- permissions and set ACLs so that user john can modify files, the permissions of the folder are changed to rwxrws---+. Even though I assumed the ...
0
votes
1answer
44 views

Apache virtual host allow NOT overriding server allow

I am running Apache 2.4 and according to the documentation I found on the apache website (http://httpd.apache.org/docs/current/sections.html), under the section "How the sections are merged" it says ...
0
votes
0answers
32 views

File permissions for shared hosting environment

I am trying to set-up a shared hosting environment where users are given SFTP access to one or multiple folders. Consider the following scenario: /var/www/ holds several directories that represent ...
1
vote
1answer
31 views

How to control access to folders to a Windows VPN client session?

I have setup a Windows service role VPN all right. Next step is limit access of the VPN session user account. Some folders should be denied from client viewing (e.g.: system folders, program files, ...
0
votes
1answer
24 views

Port Forwarding with Cisco SR520 IOS

I've been tasked with setting up port forwarding for access to remote desktop on a server. I'm having trouble making it work. Server IP 192.168.1.20, port 3389 The router is a Cisco SR520. It is ...
1
vote
1answer
19 views

ACL - Subtree Admin should be able to modify password as well as the users themselves

dn: olcDatabase={1}hdb,cn=config objectclass: olcDatabaseConfig objectclass: olcHdbConfig olcaccess: {0}to dn.subtree="ou=subtree,dc=domain,dc=tld" by self write by dn="cn=subadmin,dc=domain,dc=tld" ...
0
votes
1answer
19 views

Make folder writable by multiple users via ACL

Is it possible to set the rights of a folder and all its files in such a way that multiple defined users can add, modify and remove files within? I was hoping to be able to do that via ACLs and I got ...
1
vote
3answers
32 views

Recursively removing write permissions in Windows?

Old Windows 2003 box holding shared folders that's being decommissioned. There's a folder being shared, inside this folder is one folder per user. Each folder has that user added to the security with ...
1
vote
1answer
27 views

How to specify GNU screen ACL as part of its command line?

What I'm trying to do is spawn a detached screen session, but as part of the command line that creates it - also modify the ACL list. So right now I have screen -dmS MySession "SomeProgram" ...
0
votes
1answer
15 views

ACL (openldap2.4) for subtree won't work for specific group

Here's a sample ldif of my implemented ACL: dn: olcDatabase={-1}frontend,cn=config objectclass: olcDatabaseConfig objectclass: olcFrontendConfig olcaccess: {0}to ...
1
vote
0answers
38 views

Setfacl: Removing ACL make my file executable

I'm making a script to add and remove ACL for third party unix account. Adding ACL works like a charm. Removing works but make a file created by sub-users executable. See: ~/test$ mkdir directory ...
0
votes
2answers
41 views

Set server ACL folders 755 and files 644 permissions

In /var/www, I want all folders (recursively) to have the permissions of 755. I want all files to have the permission of 644. I want all new files and folders to take on these permissions as well. ...
2
votes
0answers
199 views

Can't read ACL on NFS4 share, Solaris 10 client, CentOS 7 server

First off, please excuse me if my question isn't well formed, this is my first post on serverfault :) I have successfully deployed LDAP and Kerberos authentication in a mixed Linux/Windows/Solaris ...
1
vote
1answer
31 views

When does the operator operand after the source address get used in an Access Control Entry

During my Cisco networking class I noticed something that confused me pertaining to extended access lists. In the Cisco NetAcademy curriculum it lists this example of the syntax for an extended ...
0
votes
1answer
41 views

Mercurial ACL extension: allow all users on all branches except one branch which is only for specific users

I want to use the ACL extension in order to allow only the QA team to make pushes and commits to the stable branch, while putting no restriction on other branches. However, I don't see how to do that ...
1
vote
1answer
54 views

Do Explicit Deny ACLs apply to a Domain Administrator account?

I've had a need come in a client with a two way trust (source company doesn't want us to have full admin rights, so we're having lots of permissions issues). We effectively need Domain Admin rights ...
0
votes
0answers
21 views

Solaris 10 inherit group write on ACL

I'm trying to get group write permissions to be inherited in Solaris 10. It isn't working. I've set aclinherit and aclmode to passthrough using zfs set. Unfortunately, a group@:w...:deny rule is ...
1
vote
1answer
33 views

What are ACEs called for system vs. domain users and groups?

What terminology is used for system ACEs (local accounts / groups), and what terminology is used for domain ACEs (domain accounts / groups)?
3
votes
1answer
82 views

How can one configure exim still to reject invalid recipients after an earlier ACL returned “discard”?

For the reasons set out in my earlier question Originating (non-critical) emails from a "less-trusted" host, it unfortunately seems that we must run an SMTP server for the sole purpose of accepting ...
-1
votes
2answers
111 views

Centos 6.5 /var/www/html/ User permissions

I have a dedicated server but only root can access my hosting directory. All other users get permission denied when I try access the directory with another user. I have created a new user, added the ...
0
votes
1answer
196 views

Pfsense Squid external ACL with a php script

I want to use a PHP script to allow or deny Squid proxy request ina pfsense installation, so I'm using this configuration for external ACL: external_acl_type mysqlAuth %SRC /usr/local/bin/php -f ...
0
votes
1answer
207 views

How to properly insert a set of olcAccess attributes to the configuration of an OpenLDAP database?

I need to add a bunch of ACLs for my database but am having hard time writing proper LDIF for it. Unfortunately, ldapmodify is not very helpful with its useless error message: modifying entry ...
1
vote
2answers
31 views

Add single permissions entry on the folder

On windows 2008 file server, I have huge folder, where some of subfolders do not inherit ACL from the parent object. I would like to add single permissions entry (full control for local administrators ...
0
votes
1answer
19 views

Monitor file access with ACL enabled

I would like to check that user 'robert' has read access to a file but is not enabled neither write it nor execute it. Since acl are enabled, there is more than one way to do it. I would like to ...
0
votes
0answers
26 views

Who can change ACL?

I'm using ACL to control access to individual roots of webs for different instances of Apache and different groups of admins. I've got a Unix group admins-web22 for admins of a particular website and ...
0
votes
0answers
56 views

LDAP ACLs with filters

I am trying to write LDAP ACL filters that would suspend authentication for domains that have a custom attribute set to some value. I created a custom object with an extra NAME attribute domainStatus ...
2
votes
6answers
248 views

Group directory challenge

Have a challenging question for you. Have a linux box. Need to create directory where users would be able to create files, but remove/modify only files created by them. Simple enough to have sticky ...
2
votes
1answer
83 views

Locking directory structure

As the title suggests, I'm trying to lock the directory structure for a folder-hierarchy. Multiple (W7) users access shared projects on a (QNAP) SMB NAS (ACL & Auth against AD). When new ...
0
votes
1answer
93 views

Read only permissions on some Linux logs

I would like to limit a certain user (let's call it logger) to be able to only read some (not all) logfile (web, php framework, radius,etc).I am not sure how to do it the "best" way. So far I have a ...
1
vote
1answer
89 views

sFTP users permissions to overwrite/edit over root owned files

This is related to Give SFTP users and Apache write permissions on same folders So, I am using ACLs to give write permissions over /var/www. It works perfectly when developer login users upload new ...
0
votes
1answer
17 views

How to block or forward packets with custom and dynamic rules

I would like to block or forward TCP requests from clients to WAN according to source and destination ip addresses. The problem is that this ip couples are stored in a mysql database and they can ...
0
votes
1answer
227 views

ACL Rule to Open UDP Ports

I have the current rules in an attempt to open port 5060 and 10000-20000 for my VoIP provider. We are on a Cisco 1921 router. This ACL is applied to the WAN port on the router facing the ISP. Nmap ...
1
vote
0answers
40 views

ACL for openldap a group to move one specific DN b/w different organizational units (OU)

I can't seem to get this right. I have a bunch of users in a group, cn=noc,ou=groups,dc=company,dc=com, who should be able to move a list between ou=internalLists,ou=mail,ou=service,dc=company,dc=com ...
-2
votes
3answers
71 views

How to prevent passwd change even from root?

I've read that in order to prevent a user from change his own password, one must type: passwd -n 10000 $user But how do I prevent root user from changing $user's password as well? Background: I'm ...
0
votes
1answer
59 views

How do I create files in directory owned by user in same group without sudo?

I have created a user to own website files (drupal) and added that user to www-data, so essentially all files are drupaluser:www-data. I want to go in and put the site in to git but I get permission ...
0
votes
0answers
60 views

Application-role based access with nginx?

What are some different ways to configure nginx to allow static file access based on application-defined roles that a user belongs to? (Not local system user groups or roles, just roles defined at the ...
1
vote
0answers
89 views

Can't delete files from a directory with ACL permissions

I'm getting stuck on acl for delete permissions. My ssh default user is ddn and apache user www-data. I set the following setfacl commands like this: setfacl -m u:www-data:rwx,u:ddn:rwx ...
0
votes
0answers
45 views

Saving a cookie value in a stick table to later allow requests in HAProxy

I have an HAproxy with two URL-based routes: /route1 and /route2 (both under the same domain). These are the purposes of each one: /route1 contains the main website where you log in and get a cookie ...
1
vote
2answers
55 views

How to limit external access to mail server?

I use Mdaemon mail server. It can be accessed from internal network and from internet (using mail client and web interface). The problem is I need to limit which users can access their mails from ...
0
votes
0answers
89 views

How to manage permissions on shared filesystem in Linux and export it on Windows?

It is a bit complex scenario so I will try to make this a simple as possible for you. ENVIRONMENT I have a shared filesystem on Linux which I export on Windows using Samba4 and users which belong to ...
1
vote
0answers
111 views

WatchGuard Authentication equivalent with Cisco ASA X series

I am in the process of implementing Cisco ASA 5512-X devices with FirePOWER to replace WatchGuard firewalls. The WatchGuard devices in use are currently wrapping access to various services with a ...
0
votes
1answer
52 views

Hiding my Azure VM from Public [closed]

I have an active on production azure cloud service with couple of web roles running an ASP .NET MVC application, each role has few VMs. I recently added a Linux machine running a redis server to ...
0
votes
0answers
42 views

What Linux binaries should not be executable by Apache/PHP?

Trying to beef up security security on a shared hosting server after some recent attacks and noticed, while playing around with some of the malicious scripts, like Filesman, that many of these scripts ...
-4
votes
2answers
89 views

Cisco 2801 - ACL example to prevent certain users in same subnet from accessing certain devices [closed]

May be a simple answer, but does anyone have an example of an ACL that would prevent certain users (preferably based on MAC address, so that I can not have to deal with static DHCP addressing) from ...
0
votes
1answer
38 views

icacls: overwrite existing ACL with a DENY ACE

Icacls with /grant:r will replace any previously granted explicit permissions with new ones specified. But there is no :r switch for /deny. So if one wants to completely replace an existing ACL with ...