An access-list is a list of rules, usually held on network devices such as switches, routers or firewalls, that matches network traffic. The specific term 'access-list' is used in the context of Cisco devices, although the concept of an 'access list' is more generic.

learn more… | top users | synonyms (3)

2
votes
0answers
21 views

Can't read ACL on NFS4 share, Solaris 10 client, CentOS 7 server

First off, please excuse me if my question isn't well formed, this is my first post on serverfault :) I have successfully deployed LDAP and Kerberos authentication in a mixed Linux/Windows/Solaris ...
1
vote
1answer
28 views

When does the operator operand after the source address get used in an Access Control Entry

During my Cisco networking class I noticed something that confused me pertaining to extended access lists. In the Cisco NetAcademy curriculum it lists this example of the syntax for an extended ...
0
votes
1answer
13 views

Mercurial ACL extension: allow all users on all branches except one branch which is only for specific users

I want to use the ACL extension in order to allow only the QA team to make pushes and commits to the stable branch, while putting no restriction on other branches. However, I don't see how to do that ...
-2
votes
0answers
29 views

Cisco serie 4400 internet configuration with low performance

The issue: I have been trying to set up the network on a cisco router. It is working, however it is very slow. The configuration: Gi0/0/1 is connected to internet (ip 100.38.214.2, gateway is ...
1
vote
1answer
33 views

Do Explicit Deny ACLs apply to a Domain Administrator account?

I've had a need come in a client with a two way trust (source company doesn't want us to have full admin rights, so we're having lots of permissions issues). We effectively need Domain Admin rights ...
0
votes
0answers
12 views

Solaris 10 inherit group write on ACL

I'm trying to get group write permissions to be inherited in Solaris 10. It isn't working. I've set aclinherit and aclmode to passthrough using zfs set. Unfortunately, a group@:w...:deny rule is ...
1
vote
1answer
29 views

What are ACEs called for system vs. domain users and groups?

What terminology is used for system ACEs (local accounts / groups), and what terminology is used for domain ACEs (domain accounts / groups)?
3
votes
1answer
41 views

How can one configure exim still to reject invalid recipients after an earlier ACL returned “discard”?

For the reasons set out in my earlier question Originating (non-critical) emails from a "less-trusted" host, it unfortunately seems that we must run an SMTP server for the sole purpose of accepting ...
-1
votes
2answers
49 views

Centos 6.5 /var/www/html/ User permissions

I have a dedicated server but only root can access my hosting directory. All other users get permission denied when I try access the directory with another user. I have created a new user, added the ...
0
votes
1answer
88 views

Pfsense Squid external ACL with a php script

I want to use a PHP script to allow or deny Squid proxy request ina pfsense installation, so I'm using this configuration for external ACL: external_acl_type mysqlAuth %SRC /usr/local/bin/php -f ...
0
votes
1answer
73 views

How to properly insert a set of olcAccess attributes to the configuration of an OpenLDAP database?

I need to add a bunch of ACLs for my database but am having hard time writing proper LDIF for it. Unfortunately, ldapmodify is not very helpful with its useless error message: modifying entry ...
1
vote
2answers
24 views

Add single permissions entry on the folder

On windows 2008 file server, I have huge folder, where some of subfolders do not inherit ACL from the parent object. I would like to add single permissions entry (full control for local administrators ...
0
votes
1answer
15 views

Monitor file access with ACL enabled

I would like to check that user 'robert' has read access to a file but is not enabled neither write it nor execute it. Since acl are enabled, there is more than one way to do it. I would like to ...
0
votes
0answers
24 views

Who can change ACL?

I'm using ACL to control access to individual roots of webs for different instances of Apache and different groups of admins. I've got a Unix group admins-web22 for admins of a particular website and ...
0
votes
0answers
28 views

LDAP ACLs with filters

I am trying to write LDAP ACL filters that would suspend authentication for domains that have a custom attribute set to some value. I created a custom object with an extra NAME attribute domainStatus ...
2
votes
6answers
244 views

Group directory challenge

Have a challenging question for you. Have a linux box. Need to create directory where users would be able to create files, but remove/modify only files created by them. Simple enough to have sticky ...
2
votes
1answer
40 views

Locking directory structure

As the title suggests, I'm trying to lock the directory structure for a folder-hierarchy. Multiple (W7) users access shared projects on a (QNAP) SMB NAS (ACL & Auth against AD). When new ...
0
votes
1answer
61 views

Read only permissions on some Linux logs

I would like to limit a certain user (let's call it logger) to be able to only read some (not all) logfile (web, php framework, radius,etc).I am not sure how to do it the "best" way. So far I have a ...
1
vote
1answer
41 views

sFTP users permissions to overwrite/edit over root owned files

This is related to Give SFTP users and Apache write permissions on same folders So, I am using ACLs to give write permissions over /var/www. It works perfectly when developer login users upload new ...
0
votes
1answer
12 views

How to block or forward packets with custom and dynamic rules

I would like to block or forward TCP requests from clients to WAN according to source and destination ip addresses. The problem is that this ip couples are stored in a mysql database and they can ...
0
votes
1answer
85 views

ACL Rule to Open UDP Ports

I have the current rules in an attempt to open port 5060 and 10000-20000 for my VoIP provider. We are on a Cisco 1921 router. This ACL is applied to the WAN port on the router facing the ISP. Nmap ...
1
vote
0answers
28 views

ACL for openldap a group to move one specific DN b/w different organizational units (OU)

I can't seem to get this right. I have a bunch of users in a group, cn=noc,ou=groups,dc=company,dc=com, who should be able to move a list between ou=internalLists,ou=mail,ou=service,dc=company,dc=com ...
-2
votes
3answers
58 views

How to prevent passwd change even from root?

I've read that in order to prevent a user from change his own password, one must type: passwd -n 10000 $user But how do I prevent root user from changing $user's password as well? Background: I'm ...
0
votes
1answer
45 views

How do I create files in directory owned by user in same group without sudo?

I have created a user to own website files (drupal) and added that user to www-data, so essentially all files are drupaluser:www-data. I want to go in and put the site in to git but I get permission ...
0
votes
0answers
38 views

Application-role based access with nginx?

What are some different ways to configure nginx to allow static file access based on application-defined roles that a user belongs to? (Not local system user groups or roles, just roles defined at the ...
1
vote
0answers
51 views

Can't delete files from a directory with ACL permissions

I'm getting stuck on acl for delete permissions. My ssh default user is ddn and apache user www-data. I set the following setfacl commands like this: setfacl -m u:www-data:rwx,u:ddn:rwx ...
0
votes
0answers
30 views

Saving a cookie value in a stick table to later allow requests in HAProxy

I have an HAproxy with two URL-based routes: /route1 and /route2 (both under the same domain). These are the purposes of each one: /route1 contains the main website where you log in and get a cookie ...
1
vote
2answers
41 views

How to limit external access to mail server?

I use Mdaemon mail server. It can be accessed from internal network and from internet (using mail client and web interface). The problem is I need to limit which users can access their mails from ...
0
votes
0answers
61 views

How to manage permissions on shared filesystem in Linux and export it on Windows?

It is a bit complex scenario so I will try to make this a simple as possible for you. ENVIRONMENT I have a shared filesystem on Linux which I export on Windows using Samba4 and users which belong to ...
1
vote
0answers
77 views

WatchGuard Authentication equivalent with Cisco ASA X series

I am in the process of implementing Cisco ASA 5512-X devices with FirePOWER to replace WatchGuard firewalls. The WatchGuard devices in use are currently wrapping access to various services with a ...
0
votes
1answer
42 views

Hiding my Azure VM from Public [closed]

I have an active on production azure cloud service with couple of web roles running an ASP .NET MVC application, each role has few VMs. I recently added a Linux machine running a redis server to ...
0
votes
0answers
35 views

What Linux binaries should not be executable by Apache/PHP?

Trying to beef up security security on a shared hosting server after some recent attacks and noticed, while playing around with some of the malicious scripts, like Filesman, that many of these scripts ...
-4
votes
2answers
74 views

Cisco 2801 - ACL example to prevent certain users in same subnet from accessing certain devices [closed]

May be a simple answer, but does anyone have an example of an ACL that would prevent certain users (preferably based on MAC address, so that I can not have to deal with static DHCP addressing) from ...
0
votes
1answer
30 views

icacls: overwrite existing ACL with a DENY ACE

Icacls with /grant:r will replace any previously granted explicit permissions with new ones specified. But there is no :r switch for /deny. So if one wants to completely replace an existing ACL with ...
2
votes
1answer
77 views

How to test non-smtp ACLs in exim

Exim provides the option to test your ACLs via CLI using exim -bh. However, this method opens an SMTP connection and you can only test SMTP ACLs. I wish to debug and test the acl_not_smtp ACL - is ...
4
votes
0answers
51 views

Setting up IPv6 ACLs on 3com 5500g to block Router Advertisment messages

Is there a way to set up IPv6 ACLs on 3com 5500g switch to block RA traffic on access ports? I couldn't find settings for setting up any IPv6 ACL. Acording to guides, there should be ipv6 specific ...
0
votes
0answers
90 views

Bind9 Zone with own dns forwarder

Installed bind9 on my server to forward 1 domain to another DNS server Client -> Vps bind9 server -> www.facebook.com must be resolved by dns 8.8.8.8 (GoogleDNS). All other websites must be resolved ...
1
vote
0answers
42 views

NFSv4 ACLs on gpfs

I try to use NFSv4 over gpfs, but I'm get the following errors: # nfs4_getfacl file Operation to request attribute not supported. # nfs4_setfacl -e file Operation to request attribute not supported. ...
1
vote
0answers
148 views

PHP temp uploaded files are not deleted on IIS due to 'Access Denied' for IUSR

When uploading a file by a HTML form to a PHP script, the uploaded file will remain in upload_tmp_dir, even when the request ended and this file was not removed explicitly by the PHP code. Expected ...
3
votes
0answers
414 views

Haproxy: reject traffic by user agent from file

I am trying to reject connections from specific user agents (by matching a substring of the user-agent header) using an haproxy ACL with -f option to read from a file. However it is not working, it ...
1
vote
1answer
122 views

CentOS 7 acl not working for apache

I want to access a user's directory from a cgi script. I set the acl on the directory successfully but the script still gets "Permission denied" when trying to access that directory. I su'd to ...
-2
votes
1answer
135 views

Exim4 ACL - Cannot set a global ratelimit

This is the first time I post on this forum, but since I have found a few leads on my problem I am hoping that I will find a solution. I think what I want to do is very simple. I have a web server ...
1
vote
2answers
139 views

ACL permissions failing in ubuntu

Problem I need to give read/write access to a system group called "mongodb" on a USB key that's been formatted as ext4. It seems that the command worked, but when I try to have the system user write ...
1
vote
2answers
590 views

Proxying TCP by hostname

I've got multiple game servers TCP ports on my single host machine. The goal is to have users be able to connect to server1.domain.net and have their directed based on that subdomain. My first ...
2
votes
2answers
506 views

How are Windows MachineKey Container File Name's Derived?

In the C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys directory there's an enumeration of Key Containers. The naming convention is <uniqueGUID>_<staticGUID> and I presume the ...
1
vote
2answers
155 views

Active Directory user rights

I'm currently working on a ASP MVC Website solution that I retrieved from a predecessor, and I had to create an active directory machine to support the login implementation using it. Upon a user's ...
0
votes
1answer
38 views

Samba: per-user ip restriction

We have a Samba server with LDAP authentication running. User privileges are controlled by UNIX groups and ACL and everything works just nicely. In the future we will allow users to connect via VPN ...
1
vote
1answer
60 views

ACL settings not being inherited properly when creating sub directory

I am trying to extend ACLs across sub directories that are being created under a parent but for some reason one of my groups is being switched to #effective r-x and the mask is being changed. Any ...
3
votes
0answers
70 views

Recommended Permissions for Virtual Service Accounts on Windows 7+

I'm trying to have an NSIS Installer install a custom service as part of an installation. It would be nice to run the service with one of those typical 'NT Service\xyz' style virtual service accounts ...
0
votes
0answers
122 views

Allow some destination ip/hostnames to bypass acl in squid

We have setup squid for an office environment. We are blocking many multimedia file types like mp3, mp4 etc to prevent bandwidth misuse. Now we have setup media streaming server on our gateway server ...