An access-list is a list of rules, usually held on network devices such as switches, routers or firewalls, that matches network traffic. The specific term 'access-list' is used in the context of Cisco devices, although the concept of an 'access list' is more generic.

learn more… | top users | synonyms (3)

1
vote
0answers
10 views

ACL for openldap a group to move one specific DN b/w different organizational units (OU)

I can't seem to get this right. I have a bunch of users in a group, cn=noc,ou=groups,dc=company,dc=com, who should be able to move a list between ou=internalLists,ou=mail,ou=service,dc=company,dc=com ...
-2
votes
3answers
51 views

How to prevent passwd change even from root?

I've read that in order to prevent a user from change his own password, one must type: passwd -n 10000 $user But how do I prevent root user from changing $user's password as well? Background: I'm ...
0
votes
1answer
28 views

How do I create files in directory owned by user in same group without sudo?

I have created a user to own website files (drupal) and added that user to www-data, so essentially all files are drupaluser:www-data. I want to go in and put the site in to git but I get permission ...
0
votes
0answers
22 views

Application-role based access with nginx?

What are some different ways to configure nginx to allow static file access based on application-defined roles that a user belongs to? (Not local system user groups or roles, just roles defined at the ...
0
votes
0answers
31 views

Can't delete files from a directory with ACL permissions

I'm getting stuck on acl for delete permissions. My ssh default user is ddn and apache user www-data. I set the following setfacl commands like this: setfacl -m u:www-data:rwx,u:ddn:rwx ...
0
votes
0answers
11 views

Saving a cookie value in a stick table to later allow requests in HAProxy

I have an HAproxy with two URL-based routes: /route1 and /route2 (both under the same domain). These are the purposes of each one: /route1 contains the main website where you log in and get a cookie ...
1
vote
2answers
31 views

How to limit external access to mail server?

I use Mdaemon mail server. It can be accessed from internal network and from internet (using mail client and web interface). The problem is I need to limit which users can access their mails from ...
0
votes
0answers
40 views

How to manage permissions on shared filesystem in Linux and export it on Windows?

It is a bit complex scenario so I will try to make this a simple as possible for you. ENVIRONMENT I have a shared filesystem on Linux which I export on Windows using Samba4 and users which belong to ...
-3
votes
0answers
25 views

Basic User Isolation in CentOS 6

I have been tasked with setting up a shared hosting server for our intranet for different departments. What is the best way to isolate users, while still allowing them to see all files in their ...
1
vote
0answers
44 views

WatchGuard Authentication equivalent with Cisco ASA X series

I am in the process of implementing Cisco ASA 5512-X devices with FirePOWER to replace WatchGuard firewalls. The WatchGuard devices in use are currently wrapping access to various services with a ...
0
votes
1answer
34 views

Hiding my Azure VM from Public [closed]

I have an active on production azure cloud service with couple of web roles running an ASP .NET MVC application, each role has few VMs. I recently added a Linux machine running a redis server to ...
0
votes
0answers
23 views

What Linux binaries should not be executable by Apache/PHP?

Trying to beef up security security on a shared hosting server after some recent attacks and noticed, while playing around with some of the malicious scripts, like Filesman, that many of these scripts ...
-4
votes
2answers
56 views

Cisco 2801 - ACL example to prevent certain users in same subnet from accessing certain devices [closed]

May be a simple answer, but does anyone have an example of an ACL that would prevent certain users (preferably based on MAC address, so that I can not have to deal with static DHCP addressing) from ...
0
votes
1answer
16 views

icacls: overwrite existing ACL with a DENY ACE

Icacls with /grant:r will replace any previously granted explicit permissions with new ones specified. But there is no :r switch for /deny. So if one wants to completely replace an existing ACL with ...
2
votes
1answer
32 views

How to test non-smtp ACLs in exim

Exim provides the option to test your ACLs via CLI using exim -bh. However, this method opens an SMTP connection and you can only test SMTP ACLs. I wish to debug and test the acl_not_smtp ACL - is ...
4
votes
0answers
39 views

Setting up IPv6 ACLs on 3com 5500g to block Router Advertisment messages

Is there a way to set up IPv6 ACLs on 3com 5500g switch to block RA traffic on access ports? I couldn't find settings for setting up any IPv6 ACL. Acording to guides, there should be ipv6 specific ...
0
votes
0answers
74 views

Bind9 Zone with own dns forwarder

Installed bind9 on my server to forward 1 domain to another DNS server Client -> Vps bind9 server -> www.facebook.com must be resolved by dns 8.8.8.8 (GoogleDNS). All other websites must be resolved ...
1
vote
0answers
26 views

NFSv4 ACLs on gpfs

I try to use NFSv4 over gpfs, but I'm get the following errors: # nfs4_getfacl file Operation to request attribute not supported. # nfs4_setfacl -e file Operation to request attribute not supported. ...
1
vote
0answers
94 views

PHP temp uploaded files are not deleted on IIS due to 'Access Denied' for IUSR

When uploading a file by a HTML form to a PHP script, the uploaded file will remain in upload_tmp_dir, even when the request ended and this file was not removed explicitly by the PHP code. Expected ...
1
vote
0answers
186 views

Haproxy: reject traffic by user agent from file

I am trying to reject connections from specific user agents (by matching a substring of the user-agent header) using an haproxy ACL with -f option to read from a file. However it is not working, it ...
1
vote
1answer
78 views

CentOS 7 acl not working for apache

I want to access a user's directory from a cgi script. I set the acl on the directory successfully but the script still gets "Permission denied" when trying to access that directory. I su'd to ...
-2
votes
1answer
72 views

Exim4 ACL - Cannot set a global ratelimit

This is the first time I post on this forum, but since I have found a few leads on my problem I am hoping that I will find a solution. I think what I want to do is very simple. I have a web server ...
1
vote
2answers
91 views

ACL permissions failing in ubuntu

Problem I need to give read/write access to a system group called "mongodb" on a USB key that's been formatted as ext4. It seems that the command worked, but when I try to have the system user write ...
1
vote
2answers
262 views

Proxying TCP by hostname

I've got multiple game servers TCP ports on my single host machine. The goal is to have users be able to connect to server1.domain.net and have their directed based on that subdomain. My first ...
2
votes
2answers
281 views

How are Windows MachineKey Container File Name's Derived?

In the C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys directory there's an enumeration of Key Containers. The naming convention is <uniqueGUID>_<staticGUID> and I presume the ...
1
vote
2answers
140 views

Active Directory user rights

I'm currently working on a ASP MVC Website solution that I retrieved from a predecessor, and I had to create an active directory machine to support the login implementation using it. Upon a user's ...
0
votes
1answer
35 views

Samba: per-user ip restriction

We have a Samba server with LDAP authentication running. User privileges are controlled by UNIX groups and ACL and everything works just nicely. In the future we will allow users to connect via VPN ...
0
votes
0answers
46 views

ACL settings not being inherited properly when creating sub directory

I am trying to extend ACLs across sub directories that are being created under a parent but for some reason one of my groups is being switched to #effective r-x and the mask is being changed. Any ...
3
votes
0answers
39 views

Recommended Permissions for Virtual Service Accounts on Windows 7+

I'm trying to have an NSIS Installer install a custom service as part of an installation. It would be nice to run the service with one of those typical 'NT Service\xyz' style virtual service accounts ...
0
votes
0answers
114 views

Allow some destination ip/hostnames to bypass acl in squid

We have setup squid for an office environment. We are blocking many multimedia file types like mp3, mp4 etc to prevent bandwidth misuse. Now we have setup media streaming server on our gateway server ...
1
vote
1answer
246 views

Apache2: Allow directory indexing, but restrict file access by type

I need to configure my Apache2 server (version 2.2.22) such that I allow auto-indexing of the WWW root folder and its sub-directories, but restrict access (i.e. restrict download) to just a set of ...
1
vote
1answer
28 views

Is “dc=nomain” a in LDAP ACLs?

I'm trying to set up my first LDAP server. I can't get clients to authenticate using it even though everything seems to be working. i suspect the ACLs might be the problem since i can't see the ACLs ...
0
votes
0answers
33 views

RNDC is not reloading my ACL list in Bind, how can I make it reload without losing Cache?

I have two ACL's, one expired, and one authorized. When I make a change to the ACL and try: rndc reload and rndc reconfig I do not see that the ACL was refreshed. Any ideas?
0
votes
1answer
130 views

SpamAssassin filtering by Exim 4 with virtual user preferences

I would like to configure spam filtering with exim's built-in spam filter support in acl_check_data config section. The piping, exim header modification (to store result) works well. As well as ...
0
votes
1answer
117 views

squid3 blocking access to particular IP not working

I have installed a squid3 on debian and using it as a proxy server. after some time I want to block the particular user using IP address. So I have defined this rule in my squid.conf file but it is ...
0
votes
0answers
43 views

Deny access from from/to subnet

We are running a VPC on Amazon. Our main network is 192.168.0.0/16 We have a subnet at 192.168.1.0/24 Two subnets which are entrypoints for our VPNs at 192.168.2.0/24 and 192.168.3.0/24 And more ...
0
votes
0answers
131 views

Allow ELB healthcheck against nginx but block proxied connections

I have a daemon process that polls a page to monitor system status, as long as everything is happy magic_check.html will exist. As soon as something goes down the file is deleted. I have the AWS ELB ...
0
votes
1answer
2k views

freenas windows acls folder permissions

We have FreeNAS-9.2.1.3-RELEASE-x64 providing a samba share to IIS (hosted by 2012 R2, if that's relevant) ssasan01# smbd --version Version 4.1.6 The freenas server is joined to an AD provided by ...
1
vote
0answers
61 views

Recalculate Windows inherited ACLs for hardlinks

How do I get Windows to recalculate the inherited permissions of a file? A tool (Mercurial) created multiple NTFS hardlinks to the same file from different directories. I can see them using fsutil ...
0
votes
1answer
49 views

Completely block access to Cisco

There is Cisco Catalyst 3850 (WS-C3850-48T-E) which is managed only via management port. There are several VLANs on the switch. Also the switch works as a DHCP server. SNMP & SSH are already ...
-2
votes
1answer
61 views

Removing all ACLs from Directories and Subdirectories in FreeBSD

how do I remove all ACLS in a folder and subfolder and all their content. Really I just want to stop using ACLs. Currently im using setfacl -b NAME But this is per ACL basis. Is there a ...
1
vote
2answers
370 views

Struggling with Haproxy 1.5 ACLs using regular expressions and URL Parameters

I am using Haproxy 1.5.3 setup with ssl on the frontend and also sending ssl to the backend servers. the mode is http and using acls to determine stickyness. My test requests are as follows: wget ...
0
votes
1answer
143 views

Exim4: Deny outgoing emails with specific destination domains to being sent to the smarthost

I try to deny outgoing emails with specific destination domains to being sent to the smarthost but unsuccessfully. I'm on a debian "squeeze" configured to use a smarthost. vi ...
2
votes
0answers
105 views

Windows security: default owner configurable?

The "How owners are assigned and set" Technet article is stating: By default, a new object's owner is the security principal identified as the default owner in the access token attached to the ...
0
votes
0answers
57 views

Partition does not mount with ACL option

Debian 7.5 : Installing package acl I've edited /etc/fstab and added the acl option to / I've remunted the partition to avoid reboot by doing sudo mount -o remount,acl / Problem : The mount command ...
1
vote
1answer
939 views

Can't delete Active Directory object

I've been trying to solve this mystery for a couple of days but I think I've reached a dead end. We have delegated user creation and administration to a group. This permissions are applied to a ...
3
votes
0answers
238 views

Cannot set ACL on ACL-enabled EXT4 partition

I am trying to enable xattrs and acls on a Debian machine. I've (re)mounted the partition in question with user_xattr and acl. (/dev/md3 is the partition in question) root@fs01:/# mount | grep ...
0
votes
2answers
510 views

How to disable ACLs on ZFS in FreeNAS?

I inherited a FreeNAS installation that I recently upgraded to version 9. I have some ZFS mounts that are mounted like this: data1/data on /mnt/data1/data (zfs, NFS exported, local, nfsv4acls) ...
0
votes
1answer
974 views

Cisco ASA: port forwarding to different IP depending on client IP/subnet outside

I have Cisco ASA 8.2(5) and would like to configure port forwarding. Cisco ASA has 2 interfaces: outside with IP 192.168.57.2 inside with IP 192.168.1.1 I have two subnets reachable through ...
0
votes
2answers
62 views

set ACL for BackupUser

I want to backup a whole bunch of folders from different users remotely. Therefore I created a special user that is able to log into the machine and (should) have the right to read all the files via a ...