An access-list is a list of rules, usually held on network devices such as switches, routers or firewalls, that matches network traffic. The specific term 'access-list' is used in the context of Cisco devices, although the concept of an 'access list' is more generic.

learn more… | top users | synonyms (3)

0
votes
0answers
3 views

LDAP ACLs with filters

I am trying to write LDAP ACL filters that would suspend authentication for domains that have a custom attribute set to some value. I created a custom object with an extra NAME attribute domainStatus ...
0
votes
1answer
69 views
+100

Group directory challenge

Have a challenging question for you. Have a linux box. Need to create directory where users would be able to create files, but remove/modify only files created by them. Simple enough to have sticky ...
2
votes
1answer
22 views

Locking directory structure

As the title suggests, I'm trying to lock the directory structure for a folder-hierarchy. Multiple (W7) users access shared projects on a (QNAP) SMB NAS (ACL & Auth against AD). When new ...
0
votes
1answer
47 views

Read only permissions on some Linux logs

I would like to limit a certain user (let's call it logger) to be able to only read some (not all) logfile (web, php framework, radius,etc).I am not sure how to do it the "best" way. So far I have a ...
1
vote
1answer
22 views

sFTP users permissions to overwrite/edit over root owned files

This is related to Give SFTP users and Apache write permissions on same folders So, I am using ACLs to give write permissions over /var/www. It works perfectly when developer login users upload new ...
0
votes
1answer
10 views

How to block or forward packets with custom and dynamic rules

I would like to block or forward TCP requests from clients to WAN according to source and destination ip addresses. The problem is that this ip couples are stored in a mysql database and they can ...
0
votes
0answers
45 views

ACL Rule to Open UDP Ports

I have the current rules in an attempt to open port 5060 and 10000-20000 for my VoIP provider. We are on a Cisco 1921 router. This ACL is applied to the WAN port on the router facing the ISP. Nmap ...
1
vote
0answers
20 views

ACL for openldap a group to move one specific DN b/w different organizational units (OU)

I can't seem to get this right. I have a bunch of users in a group, cn=noc,ou=groups,dc=company,dc=com, who should be able to move a list between ou=internalLists,ou=mail,ou=service,dc=company,dc=com ...
-2
votes
3answers
56 views

How to prevent passwd change even from root?

I've read that in order to prevent a user from change his own password, one must type: passwd -n 10000 $user But how do I prevent root user from changing $user's password as well? Background: I'm ...
0
votes
1answer
36 views

How do I create files in directory owned by user in same group without sudo?

I have created a user to own website files (drupal) and added that user to www-data, so essentially all files are drupaluser:www-data. I want to go in and put the site in to git but I get permission ...
0
votes
0answers
25 views

Application-role based access with nginx?

What are some different ways to configure nginx to allow static file access based on application-defined roles that a user belongs to? (Not local system user groups or roles, just roles defined at the ...
1
vote
0answers
42 views

Can't delete files from a directory with ACL permissions

I'm getting stuck on acl for delete permissions. My ssh default user is ddn and apache user www-data. I set the following setfacl commands like this: setfacl -m u:www-data:rwx,u:ddn:rwx ...
0
votes
0answers
18 views

Saving a cookie value in a stick table to later allow requests in HAProxy

I have an HAproxy with two URL-based routes: /route1 and /route2 (both under the same domain). These are the purposes of each one: /route1 contains the main website where you log in and get a cookie ...
1
vote
2answers
36 views

How to limit external access to mail server?

I use Mdaemon mail server. It can be accessed from internal network and from internet (using mail client and web interface). The problem is I need to limit which users can access their mails from ...
0
votes
0answers
50 views

How to manage permissions on shared filesystem in Linux and export it on Windows?

It is a bit complex scenario so I will try to make this a simple as possible for you. ENVIRONMENT I have a shared filesystem on Linux which I export on Windows using Samba4 and users which belong to ...
1
vote
0answers
54 views

WatchGuard Authentication equivalent with Cisco ASA X series

I am in the process of implementing Cisco ASA 5512-X devices with FirePOWER to replace WatchGuard firewalls. The WatchGuard devices in use are currently wrapping access to various services with a ...
0
votes
1answer
39 views

Hiding my Azure VM from Public [closed]

I have an active on production azure cloud service with couple of web roles running an ASP .NET MVC application, each role has few VMs. I recently added a Linux machine running a redis server to ...
0
votes
0answers
27 views

What Linux binaries should not be executable by Apache/PHP?

Trying to beef up security security on a shared hosting server after some recent attacks and noticed, while playing around with some of the malicious scripts, like Filesman, that many of these scripts ...
-4
votes
2answers
64 views

Cisco 2801 - ACL example to prevent certain users in same subnet from accessing certain devices [closed]

May be a simple answer, but does anyone have an example of an ACL that would prevent certain users (preferably based on MAC address, so that I can not have to deal with static DHCP addressing) from ...
0
votes
1answer
20 views

icacls: overwrite existing ACL with a DENY ACE

Icacls with /grant:r will replace any previously granted explicit permissions with new ones specified. But there is no :r switch for /deny. So if one wants to completely replace an existing ACL with ...
2
votes
1answer
37 views

How to test non-smtp ACLs in exim

Exim provides the option to test your ACLs via CLI using exim -bh. However, this method opens an SMTP connection and you can only test SMTP ACLs. I wish to debug and test the acl_not_smtp ACL - is ...
4
votes
0answers
47 views

Setting up IPv6 ACLs on 3com 5500g to block Router Advertisment messages

Is there a way to set up IPv6 ACLs on 3com 5500g switch to block RA traffic on access ports? I couldn't find settings for setting up any IPv6 ACL. Acording to guides, there should be ipv6 specific ...
0
votes
0answers
82 views

Bind9 Zone with own dns forwarder

Installed bind9 on my server to forward 1 domain to another DNS server Client -> Vps bind9 server -> www.facebook.com must be resolved by dns 8.8.8.8 (GoogleDNS). All other websites must be resolved ...
1
vote
0answers
36 views

NFSv4 ACLs on gpfs

I try to use NFSv4 over gpfs, but I'm get the following errors: # nfs4_getfacl file Operation to request attribute not supported. # nfs4_setfacl -e file Operation to request attribute not supported. ...
1
vote
0answers
120 views

PHP temp uploaded files are not deleted on IIS due to 'Access Denied' for IUSR

When uploading a file by a HTML form to a PHP script, the uploaded file will remain in upload_tmp_dir, even when the request ended and this file was not removed explicitly by the PHP code. Expected ...
2
votes
0answers
292 views

Haproxy: reject traffic by user agent from file

I am trying to reject connections from specific user agents (by matching a substring of the user-agent header) using an haproxy ACL with -f option to read from a file. However it is not working, it ...
1
vote
1answer
101 views

CentOS 7 acl not working for apache

I want to access a user's directory from a cgi script. I set the acl on the directory successfully but the script still gets "Permission denied" when trying to access that directory. I su'd to ...
-2
votes
1answer
88 views

Exim4 ACL - Cannot set a global ratelimit

This is the first time I post on this forum, but since I have found a few leads on my problem I am hoping that I will find a solution. I think what I want to do is very simple. I have a web server ...
1
vote
2answers
111 views

ACL permissions failing in ubuntu

Problem I need to give read/write access to a system group called "mongodb" on a USB key that's been formatted as ext4. It seems that the command worked, but when I try to have the system user write ...
1
vote
2answers
367 views

Proxying TCP by hostname

I've got multiple game servers TCP ports on my single host machine. The goal is to have users be able to connect to server1.domain.net and have their directed based on that subdomain. My first ...
2
votes
2answers
349 views

How are Windows MachineKey Container File Name's Derived?

In the C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys directory there's an enumeration of Key Containers. The naming convention is <uniqueGUID>_<staticGUID> and I presume the ...
1
vote
2answers
150 views

Active Directory user rights

I'm currently working on a ASP MVC Website solution that I retrieved from a predecessor, and I had to create an active directory machine to support the login implementation using it. Upon a user's ...
0
votes
1answer
35 views

Samba: per-user ip restriction

We have a Samba server with LDAP authentication running. User privileges are controlled by UNIX groups and ACL and everything works just nicely. In the future we will allow users to connect via VPN ...
1
vote
1answer
55 views

ACL settings not being inherited properly when creating sub directory

I am trying to extend ACLs across sub directories that are being created under a parent but for some reason one of my groups is being switched to #effective r-x and the mask is being changed. Any ...
3
votes
0answers
45 views

Recommended Permissions for Virtual Service Accounts on Windows 7+

I'm trying to have an NSIS Installer install a custom service as part of an installation. It would be nice to run the service with one of those typical 'NT Service\xyz' style virtual service accounts ...
0
votes
0answers
115 views

Allow some destination ip/hostnames to bypass acl in squid

We have setup squid for an office environment. We are blocking many multimedia file types like mp3, mp4 etc to prevent bandwidth misuse. Now we have setup media streaming server on our gateway server ...
1
vote
1answer
297 views

Apache2: Allow directory indexing, but restrict file access by type

I need to configure my Apache2 server (version 2.2.22) such that I allow auto-indexing of the WWW root folder and its sub-directories, but restrict access (i.e. restrict download) to just a set of ...
1
vote
1answer
31 views

Is “dc=nomain” a in LDAP ACLs?

I'm trying to set up my first LDAP server. I can't get clients to authenticate using it even though everything seems to be working. i suspect the ACLs might be the problem since i can't see the ACLs ...
0
votes
0answers
36 views

RNDC is not reloading my ACL list in Bind, how can I make it reload without losing Cache?

I have two ACL's, one expired, and one authorized. When I make a change to the ACL and try: rndc reload and rndc reconfig I do not see that the ACL was refreshed. Any ideas?
0
votes
1answer
146 views

SpamAssassin filtering by Exim 4 with virtual user preferences

I would like to configure spam filtering with exim's built-in spam filter support in acl_check_data config section. The piping, exim header modification (to store result) works well. As well as ...
0
votes
1answer
130 views

squid3 blocking access to particular IP not working

I have installed a squid3 on debian and using it as a proxy server. after some time I want to block the particular user using IP address. So I have defined this rule in my squid.conf file but it is ...
0
votes
0answers
46 views

Deny access from from/to subnet

We are running a VPC on Amazon. Our main network is 192.168.0.0/16 We have a subnet at 192.168.1.0/24 Two subnets which are entrypoints for our VPNs at 192.168.2.0/24 and 192.168.3.0/24 And more ...
0
votes
0answers
146 views

Allow ELB healthcheck against nginx but block proxied connections

I have a daemon process that polls a page to monitor system status, as long as everything is happy magic_check.html will exist. As soon as something goes down the file is deleted. I have the AWS ELB ...
0
votes
1answer
2k views

freenas windows acls folder permissions

We have FreeNAS-9.2.1.3-RELEASE-x64 providing a samba share to IIS (hosted by 2012 R2, if that's relevant) ssasan01# smbd --version Version 4.1.6 The freenas server is joined to an AD provided by ...
1
vote
0answers
70 views

Recalculate Windows inherited ACLs for hardlinks

How do I get Windows to recalculate the inherited permissions of a file? A tool (Mercurial) created multiple NTFS hardlinks to the same file from different directories. I can see them using fsutil ...
0
votes
1answer
49 views

Completely block access to Cisco

There is Cisco Catalyst 3850 (WS-C3850-48T-E) which is managed only via management port. There are several VLANs on the switch. Also the switch works as a DHCP server. SNMP & SSH are already ...
-2
votes
1answer
63 views

Removing all ACLs from Directories and Subdirectories in FreeBSD

how do I remove all ACLS in a folder and subfolder and all their content. Really I just want to stop using ACLs. Currently im using setfacl -b NAME But this is per ACL basis. Is there a ...
1
vote
2answers
402 views

Struggling with Haproxy 1.5 ACLs using regular expressions and URL Parameters

I am using Haproxy 1.5.3 setup with ssl on the frontend and also sending ssl to the backend servers. the mode is http and using acls to determine stickyness. My test requests are as follows: wget ...
0
votes
1answer
144 views

Exim4: Deny outgoing emails with specific destination domains to being sent to the smarthost

I try to deny outgoing emails with specific destination domains to being sent to the smarthost but unsuccessfully. I'm on a debian "squeeze" configured to use a smarthost. vi ...
2
votes
0answers
109 views

Windows security: default owner configurable?

The "How owners are assigned and set" Technet article is stating: By default, a new object's owner is the security principal identified as the default owner in the access token attached to the ...