An access-list is a list of rules, usually held on network devices such as switches, routers or firewalls, that matches network traffic. The specific term 'access-list' is used in the context of Cisco devices, although the concept of an 'access list' is more generic.

learn more… | top users | synonyms (3)

0
votes
0answers
7 views

Setting attributes are not allowed by user while user_xattr mount option is present

/dev/mapper/vg-home on /home type ext4 (rw,relatime,user_xattr,barrier=1,data=ordered) When I try to set attributes with chattr +a +i etc on a file as a user I get back: chattr: Operation not ...
0
votes
0answers
12 views

Mutual Authentication - Allow from IP range without client certificate

Is it possible to set SSLVerifyClient: Require but, also allow IP range for users who do not have the client cert? Possibly to use: Order deny,allow Deny from all Allow from xxx.xxx.xxx.xxx ...
-1
votes
1answer
30 views

apache 2.2 order deny allow not working

this is driving me nuts. In a web server running httpd-2.2.15-45.el6.centos.x86_64 any type of does not seem to be honored. Example: <VirtualHost 192.168.10.10:80> ServerName ...
2
votes
1answer
40 views

ACL permissions not inherited

I have a Ubuntu 14.04 server with an EXT4 partition. I want to change what permissions new files and folders get when they are created in /home/myuser. I set some options with setfacl, and getfacl ...
0
votes
1answer
35 views

LDAP group access controls

I'm trying to set up our LDAP server so that members of the pwmadmins group can change people's passwords for them. To be more specific, we have PWM for Tomcat set up and are trying to let pwmadmins ...
1
vote
0answers
87 views

LDAP build script failing on openLDAP-2.4.31 ( ldapmodify -Y EXTERNAL -H ldapi:/// )

ORIGINAL QUESTION: I want to set the password to the backend admin so that I can change the LDAP ACL to what I need... needless to say I don't want my config posted all over the place, plus the .ldif ...
0
votes
0answers
76 views

Webmin: restricting DNS zones visible to a user per view not working?

I'm setting up my own webmin installation to manage a BIND9 DNS authoritative server hosting a few zones. The zones are separated into 2 views: internal and public. There are different groups of ...
0
votes
0answers
37 views

Samba4 creates unnecessary acl permissions on new folder

I am using samba4 ad dc on ubunut 14.04. When User user1 in Group group1 is creating a new folder in the directory \ADS\sysvol\ads.dns\newFolder, then the folder has the following ACL: $getfacl ...
0
votes
0answers
9 views

Maintain ability to set/unset group write permission with ACL

If I have a folder owned by root:www-data with rwxr-s--- permissions and set ACLs so that user john can modify files, the permissions of the folder are changed to rwxrws---+. Even though I assumed the ...
0
votes
1answer
61 views

Apache virtual host allow NOT overriding server allow

I am running Apache 2.4 and according to the documentation I found on the apache website (http://httpd.apache.org/docs/current/sections.html), under the section "How the sections are merged" it says ...
0
votes
0answers
33 views

File permissions for shared hosting environment

I am trying to set-up a shared hosting environment where users are given SFTP access to one or multiple folders. Consider the following scenario: /var/www/ holds several directories that represent ...
1
vote
1answer
34 views

How to control access to folders to a Windows VPN client session?

I have setup a Windows service role VPN all right. Next step is limit access of the VPN session user account. Some folders should be denied from client viewing (e.g.: system folders, program files, ...
0
votes
1answer
36 views

Port Forwarding with Cisco SR520 IOS

I've been tasked with setting up port forwarding for access to remote desktop on a server. I'm having trouble making it work. Server IP 192.168.1.20, port 3389 The router is a Cisco SR520. It is ...
1
vote
1answer
22 views

ACL - Subtree Admin should be able to modify password as well as the users themselves

dn: olcDatabase={1}hdb,cn=config objectclass: olcDatabaseConfig objectclass: olcHdbConfig olcaccess: {0}to dn.subtree="ou=subtree,dc=domain,dc=tld" by self write by dn="cn=subadmin,dc=domain,dc=tld" ...
0
votes
1answer
19 views

Make folder writable by multiple users via ACL

Is it possible to set the rights of a folder and all its files in such a way that multiple defined users can add, modify and remove files within? I was hoping to be able to do that via ACLs and I got ...
1
vote
3answers
37 views

Recursively removing write permissions in Windows?

Old Windows 2003 box holding shared folders that's being decommissioned. There's a folder being shared, inside this folder is one folder per user. Each folder has that user added to the security with ...
1
vote
1answer
28 views

How to specify GNU screen ACL as part of its command line?

What I'm trying to do is spawn a detached screen session, but as part of the command line that creates it - also modify the ACL list. So right now I have screen -dmS MySession "SomeProgram" ...
0
votes
1answer
18 views

ACL (openldap2.4) for subtree won't work for specific group

Here's a sample ldif of my implemented ACL: dn: olcDatabase={-1}frontend,cn=config objectclass: olcDatabaseConfig objectclass: olcFrontendConfig olcaccess: {0}to ...
1
vote
0answers
51 views

Setfacl: Removing ACL make my file executable

I'm making a script to add and remove ACL for third party unix account. Adding ACL works like a charm. Removing works but make a file created by sub-users executable. See: ~/test$ mkdir directory ...
0
votes
2answers
49 views

Set server ACL folders 755 and files 644 permissions

In /var/www, I want all folders (recursively) to have the permissions of 755. I want all files to have the permission of 644. I want all new files and folders to take on these permissions as well. ...
3
votes
0answers
266 views

Can't read ACL on NFS4 share, Solaris 10 client, CentOS 7 server

First off, please excuse me if my question isn't well formed, this is my first post on serverfault :) I have successfully deployed LDAP and Kerberos authentication in a mixed Linux/Windows/Solaris ...
1
vote
1answer
33 views

When does the operator operand after the source address get used in an Access Control Entry

During my Cisco networking class I noticed something that confused me pertaining to extended access lists. In the Cisco NetAcademy curriculum it lists this example of the syntax for an extended ...
0
votes
1answer
52 views

Mercurial ACL extension: allow all users on all branches except one branch which is only for specific users

I want to use the ACL extension in order to allow only the QA team to make pushes and commits to the stable branch, while putting no restriction on other branches. However, I don't see how to do that ...
1
vote
1answer
62 views

Do Explicit Deny ACLs apply to a Domain Administrator account?

I've had a need come in a client with a two way trust (source company doesn't want us to have full admin rights, so we're having lots of permissions issues). We effectively need Domain Admin rights ...
0
votes
0answers
24 views

Solaris 10 inherit group write on ACL

I'm trying to get group write permissions to be inherited in Solaris 10. It isn't working. I've set aclinherit and aclmode to passthrough using zfs set. Unfortunately, a group@:w...:deny rule is ...
1
vote
1answer
38 views

What are ACEs called for system vs. domain users and groups?

What terminology is used for system ACEs (local accounts / groups), and what terminology is used for domain ACEs (domain accounts / groups)?
3
votes
1answer
91 views

How can one configure exim still to reject invalid recipients after an earlier ACL returned “discard”?

For the reasons set out in my earlier question Originating (non-critical) emails from a "less-trusted" host, it unfortunately seems that we must run an SMTP server for the sole purpose of accepting ...
-1
votes
2answers
145 views

Centos 6.5 /var/www/html/ User permissions

I have a dedicated server but only root can access my hosting directory. All other users get permission denied when I try access the directory with another user. I have created a new user, added the ...
0
votes
1answer
237 views

Pfsense Squid external ACL with a php script

I want to use a PHP script to allow or deny Squid proxy request ina pfsense installation, so I'm using this configuration for external ACL: external_acl_type mysqlAuth %SRC /usr/local/bin/php -f ...
0
votes
1answer
311 views

How to properly insert a set of olcAccess attributes to the configuration of an OpenLDAP database?

I need to add a bunch of ACLs for my database but am having hard time writing proper LDIF for it. Unfortunately, ldapmodify is not very helpful with its useless error message: modifying entry ...
1
vote
2answers
33 views

Add single permissions entry on the folder

On windows 2008 file server, I have huge folder, where some of subfolders do not inherit ACL from the parent object. I would like to add single permissions entry (full control for local administrators ...
0
votes
1answer
19 views

Monitor file access with ACL enabled

I would like to check that user 'robert' has read access to a file but is not enabled neither write it nor execute it. Since acl are enabled, there is more than one way to do it. I would like to ...
0
votes
0answers
26 views

Who can change ACL?

I'm using ACL to control access to individual roots of webs for different instances of Apache and different groups of admins. I've got a Unix group admins-web22 for admins of a particular website and ...
0
votes
0answers
62 views

LDAP ACLs with filters

I am trying to write LDAP ACL filters that would suspend authentication for domains that have a custom attribute set to some value. I created a custom object with an extra NAME attribute domainStatus ...
2
votes
6answers
249 views

Group directory challenge

Have a challenging question for you. Have a linux box. Need to create directory where users would be able to create files, but remove/modify only files created by them. Simple enough to have sticky ...
2
votes
1answer
97 views

Locking directory structure

As the title suggests, I'm trying to lock the directory structure for a folder-hierarchy. Multiple (W7) users access shared projects on a (QNAP) SMB NAS (ACL & Auth against AD). When new ...
0
votes
1answer
109 views

Read only permissions on some Linux logs

I would like to limit a certain user (let's call it logger) to be able to only read some (not all) logfile (web, php framework, radius,etc).I am not sure how to do it the "best" way. So far I have a ...
1
vote
1answer
103 views

sFTP users permissions to overwrite/edit over root owned files

This is related to Give SFTP users and Apache write permissions on same folders So, I am using ACLs to give write permissions over /var/www. It works perfectly when developer login users upload new ...
0
votes
1answer
17 views

How to block or forward packets with custom and dynamic rules

I would like to block or forward TCP requests from clients to WAN according to source and destination ip addresses. The problem is that this ip couples are stored in a mysql database and they can ...
0
votes
1answer
271 views

ACL Rule to Open UDP Ports

I have the current rules in an attempt to open port 5060 and 10000-20000 for my VoIP provider. We are on a Cisco 1921 router. This ACL is applied to the WAN port on the router facing the ISP. Nmap ...
1
vote
0answers
44 views

ACL for openldap a group to move one specific DN b/w different organizational units (OU)

I can't seem to get this right. I have a bunch of users in a group, cn=noc,ou=groups,dc=company,dc=com, who should be able to move a list between ou=internalLists,ou=mail,ou=service,dc=company,dc=com ...
-2
votes
3answers
76 views

How to prevent passwd change even from root?

I've read that in order to prevent a user from change his own password, one must type: passwd -n 10000 $user But how do I prevent root user from changing $user's password as well? Background: I'm ...
0
votes
1answer
65 views

How do I create files in directory owned by user in same group without sudo?

I have created a user to own website files (drupal) and added that user to www-data, so essentially all files are drupaluser:www-data. I want to go in and put the site in to git but I get permission ...
0
votes
0answers
63 views

Application-role based access with nginx?

What are some different ways to configure nginx to allow static file access based on application-defined roles that a user belongs to? (Not local system user groups or roles, just roles defined at the ...
1
vote
0answers
113 views

Can't delete files from a directory with ACL permissions

I'm getting stuck on acl for delete permissions. My ssh default user is ddn and apache user www-data. I set the following setfacl commands like this: setfacl -m u:www-data:rwx,u:ddn:rwx ...
0
votes
0answers
51 views

Saving a cookie value in a stick table to later allow requests in HAProxy

I have an HAproxy with two URL-based routes: /route1 and /route2 (both under the same domain). These are the purposes of each one: /route1 contains the main website where you log in and get a cookie ...
1
vote
2answers
68 views

How to limit external access to mail server?

I use Mdaemon mail server. It can be accessed from internal network and from internet (using mail client and web interface). The problem is I need to limit which users can access their mails from ...
0
votes
0answers
101 views

How to manage permissions on shared filesystem in Linux and export it on Windows?

It is a bit complex scenario so I will try to make this a simple as possible for you. ENVIRONMENT I have a shared filesystem on Linux which I export on Windows using Samba4 and users which belong to ...
1
vote
1answer
133 views

WatchGuard Authentication equivalent with Cisco ASA X series

I am in the process of implementing Cisco ASA 5512-X devices with FirePOWER to replace WatchGuard firewalls. The WatchGuard devices in use are currently wrapping access to various services with a ...
0
votes
1answer
55 views

Hiding my Azure VM from Public [closed]

I have an active on production azure cloud service with couple of web roles running an ASP .NET MVC application, each role has few VMs. I recently added a Linux machine running a redis server to ...