An acl, or Access Control List, is part of a security technology which employs a list of object access permissions for each user who can access that object. The term is used in several common implementations ranging from the Microsoft Windows NTFS filesystem to Cisco Internet firewall device rules.

learn more… | top users | synonyms

1
vote
1answer
44 views

Can't delete Active Directory object

I've been trying to solve this mystery for a couple of days but I think I've reached a dead end. We have delegated user creation and administration to a group. This permissions are applied to a ...
3
votes
0answers
23 views

Cannot set ACL on ACL-enabled EXT4 partition

I am trying to enable xattrs and acls on a Debian machine. I've (re)mounted the partition in question with user_xattr and acl. (/dev/md3 is the partition in question) root@fs01:/# mount | grep ...
0
votes
1answer
27 views

How to disable ACLs on ZFS in FreeNAS?

I inherited a FreeNAS installation that I recently upgraded to version 9. I have some ZFS mounts that are mounted like this: data1/data on /mnt/data1/data (zfs, NFS exported, local, nfsv4acls) ...
0
votes
2answers
52 views

set ACL for BackupUser

I want to backup a whole bunch of folders from different users remotely. Therefore I created a special user that is able to log into the machine and (should) have the right to read all the files via a ...
0
votes
0answers
79 views

Cisco ASA + FreeRadius: Downloadable ACL configuration

VPN users that are using FreeRadius are having access to all VLANs. VPN users using local authentication have local ACLs applied to their access. I need to know what configuration change I need to ...
1
vote
1answer
59 views

Replace User within Active Directory File Server Share

I have a file server role utilizing an Active Directory Domain on Windows Server 2012 and I'm attempting to replace one User Object with another User Object across all existing file server share ACLs. ...
0
votes
1answer
27 views

copy files to remote server, maintain remote acls

Currently I am using rsync to copy files from local machine to remote. local does not have ACLs while remote does have ACLs. I would like the files that are rsynced across to maintain the ACL's that ...
2
votes
1answer
30 views

Is it possible for the Guest user to lose “Everyone” membership?

It seems that the "Guest" user under certain circumstances is logged in without the membership in the "Everyone" Built-in group on Windows Server 2003. I would like to know in more detail why and when ...
0
votes
2answers
51 views

Varnish ACLs Behind Load Balancer Based on Client's IP

In the following setup: Client -> LB -> Varnish I would like to configure Varnish acls to take certain action based on the Client's IP. The LB sends the client's IP in a variable called ...
1
vote
0answers
20 views

squid apply rules to a some users

Good day: I have a squid 2.7 stable9 installation that works. It is connected to LDAP and the users can authenticate perfectly. I have different rules for instance to block a few websites during ...
0
votes
1answer
32 views

How do I allow users to add/modify files in a directory but not change the directory - Linux

How can I modify a directory so that it is owned by a group and users in that group can add and delete files and create sub directories but are unable to change the permissions on the parent ...
1
vote
0answers
43 views

How can I add ACL entry comments on a Cisco 3750?

I'm trying to find the best way to add comments into my access-lists. For the moment, the only maneer I found is the following one: switch#conf t switch(config)#ip access-list extended VLAN-TEST3 ...
6
votes
1answer
86 views

Best practice for printer ACLs

I have a question about shared printers, and how to best limit access to them. I have a printer shared from our print server (\\server01\printer01) and I locked it down to just the security groups ...
4
votes
4answers
663 views

How can I make an internet facing TFTP server secure?

I have many Cisco IP phones that operate in the following manner (oversimplified): Negotiate with DHCP for IP, DNS, TFTP, etc. Look for SEPXXXXXXXXXXXX.cnf.xml configuration file on TFTP server ...
0
votes
1answer
150 views

QNAP: ACL does not work over NFS

Having difficulties making Linux ACL (getfacl/setfacl) work with NFS shares. We are using Ubuntu clients and QNAP storage as server. At the moment only root user on Ubuntu has read/write access. ...
0
votes
1answer
39 views

Block specific URI with Query String in Varnish

Can someone help to block an URL which has querystrings as part of it in Varnish ? For eg: /abcd.php? Blocking /abcd.php works good yet with ? I'm able to access the page Thanks, Raj
0
votes
0answers
48 views

CygWin SSH server and “StrictModes” via Windows ACL

I have successfully set up the SSH server in a CygWin installation on Win2k3. It works properly through both password authentication and public/private keys. However, once I set 'StrictModes' in ...
1
vote
0answers
81 views

Sharing a folder through NFSv4 and Samba on Ubuntu

I encountered problem with configure samba server above nfsv4. I have 2 servers with Ubuntu 12.04 on both of them. First server serve as NFSv4 storage, for VDI and user shares. File system is ext4. ...
2
votes
1answer
148 views

Powershell: Piping input to Set-Acl

have a messed up folder with inconsistent ACLs which I need to uniform. I hoped to accomplish this with powershell. So I'm trying to search for all files missing the required group and applying the ...
0
votes
0answers
18 views

Program / Service to Allow Multiple Users to use a Single Shared Account

I've found it very common for teams to share a single username / password for online services, such as domain registrars. Clearly, giving multiple people access to a single account by passing around ...
0
votes
1answer
72 views

How do I chmod ACLs to groups with spaces in the name on Mac OS X?

I'm trying to add an ACL for the group "Domain Users", but since it has spaces in the group name it isn't parsed correctly by chmod: $ chmod -R +a 'DOMAIN\Domain Users allow ...
1
vote
1answer
147 views

What does squid proxy do when negating acl proxy_auth_regex in rule?

The NTLM auth helper only tags users as authorized if they are member of a AD group. The Kerberos auth helper tags a user as authorized, if he was able to log in, the group check can't be done by the ...
0
votes
0answers
24 views

windows 2003 Terminal server, “users” item removed from ACL of “HKLM\SOFTWARE\Classes”

After having installed a software on my Windows 2003 terminal server, no user has been able to launch applications anymore. When they log to the server via remote desktop, each icon they click ...
1
vote
1answer
253 views

Logrotate: Postrotate setfacl failed with no such file or directory error

I set some extended ACL entries for /var/log/squid3/ and /var/log/squid3/access.log. sudo setfacl -m u:jetty:r-x,g:adm:r-x /var/log/squid3 sudo setfacl -m u:jetty:r--,g:adm:r-- ...
1
vote
1answer
30 views

How can I remove the ACL of PIX firewall?

I'm just trying to how PIX works. Anyway how can I remove the ACL from my GNS3's PIX? PIX-SECU(config)# show access-list access-list cached ACL log flows: total 0, denied 0 (deny-flow-max 4096) ...
2
votes
0answers
41 views

find nouser equivalent for POSIX ACLs

On a Linux system it is possible to find files that are owned by a uid that does not have a user name assigned with "find -nouser". I have been looking for an equivalent that will search the POSIX ...
-2
votes
1answer
26 views

Can I conclusively determine that a remote web server is denying access by blocking my IP address? [closed]

Let's say a web server administrator has configured his web server to deny traffic from my IP address or address range and throws an http 403 forbidden when I hit the site. (In this scenario I am ...
1
vote
1answer
79 views

Can I add a local linux user to a supplementary active directory group?

The Linux box in question is a CentOS 6.5 machine that is bound to active directory. I can change a local user's primary group to an active directory group. But i can't add the active directory group ...
1
vote
1answer
18 views

Is it possible to add description to cisco ACL?

I would like to add a description to cisco ACL. Something like: Permit all traffic from the R&D depatment to the lab. or Deny traffic from HA to R&D. Is it possible?
3
votes
1answer
130 views

Squid 3.2 - Proper configuration for random outbound IP with a single user authentication?

I'm attempting to use AclRandom for Squid 3.2 and I think I'm a bit confused on the proper method for this. Here is my configuration: http_port 3128 auth_param basic program ...
0
votes
1answer
182 views

Exim ACL to limit sender to send mail only to localdomain

I'm currently using exim, and i need to limit a mail address to send mails only to local domain and deny mail to outgoing domains. I think it could be like this : deny local_parts = ...
2
votes
2answers
173 views

With Azure, can I create a VLAN and put all my worker roles and VM's in there?

Is it possible to create a sort of VLAN or private azure LAN thingy .. where I can put any new Workers or VM's in that VLAN? one of the reasons is because I was hoping to create a SQL server on a VM ...
4
votes
1answer
113 views

What exactly is included in the Windows “Everything” security identifier (e.g. does it include computer accounts like DOMAIN\MACHINE$)?

This is a generalization of a question I initially had asked about computer accounts. I asked: When one sets Windows permissions for "Everyone", do these permissions apply to computer accounts ...
1
vote
1answer
86 views

OpenLDAP - ACL “set” notation not matching properly

I've got to set up an externally-anonymous accessible LDAP directory on an Ubuntu 12.04 Server, and I want to keep authentication and internal data in a different subtree. Example of the LDAP layout ...
0
votes
1answer
77 views

Cisco IOS, restrict IP addresses per ethernet port #

I am configuring a Cisco 881, and am interested in restricting individual ports on the LAN (FastEthernet 0-3). I would like to be able to limit the IP addresses that someone can use based on which ...
0
votes
0answers
19 views

NFSv4 ACL with directory create perm, but can not read/write files under the directory

Next is what I need to do: Two users admin-x as directory administrator, user-m as the data producer, user 1: admin-x user 2: user-m In the directory named '/share' which with nfsv4 acls set on it, ...
0
votes
0answers
45 views

Samba file mask calculation on ACL - missing r

I would like to ask a detail how samba deals with permission on ACL on servers. I did dig very hard and deep but no luck with this one. I have set ACL support over this think and again, regardles of ...
10
votes
1answer
123 views

Can I “merge” two groups using SID history?

I have two AD groups which were erroneously created while there should instead have been only one group; they contain the exact same users. However, these groups have been assigned various permissions ...
-2
votes
1answer
166 views

File base permissions are 666, why and is this a configurable value? [closed]

It is specified in various documentation on the net that linux/unix file base permissions are 666 with regards to how umask manipulates. This is also relevant with regards to the fact that default ...
1
vote
1answer
88 views

setfacl for all users

Is it possible to set the permission for all users or all groups that are present in the acl? Namely, I would like a command that applies permissions uniformly for all members of an entity type, ...
0
votes
0answers
42 views

Set ACL to allow owner to delete files in share

I have a main shares folder which has the following structure: Share->User Folder->Files I want the users to be able to add files to other users folder, but only the fodler owner to be able to ...
0
votes
0answers
284 views

subinacl.exe does not seem to work for “trustedinstaller” — what is the SID to use instead?

I am looking at re-setting the owner of a big pile of files after changing the owner of the Windows directory and all its subdirectories and files (in a backup made by "cloning" a drive -- if I don't ...
0
votes
1answer
85 views

Files / Folders Permissions & User / Groups Privileges in a chrooted environment (simple scenario big head-ache)

I know permissions and privileges how-tos can be found anywhere by googling, and trust me, I've done it and thoroughly read every bit of information I could find on the subject. Either I'm not clever ...
3
votes
1answer
206 views

NFS v4 ACL inheritance problems - “i” flag set but not wanted

What I am trying to is add an NFS v4 ACL that allows a directories, child and grandchild, great grandchild etc directories and files to inherit a delete ('D') flag under linux. The underlying file ...
2
votes
1answer
80 views

Public dovecot namespace visible only to some users

I have a dovecot IMAP server (version 2.1.7) with Maildirs and a virtual user setup (e.g. all accounts are mapped to the same system user). I’d like to create a public namespace shared between users A ...
0
votes
0answers
147 views

No acl on nfs mount in RHEL6?

I have several RHEL6 machines. One is exporting an nfs mount to the rest. I have ACL's set on the server (set using setfacl -m), but none of the clients are seeing any of them. Here is my export on ...
7
votes
2answers
1k views

Is there a performance impact of direct AD universal groups assignment?

I'm implementing a tool which secures certain shared resources within AD forest (mostly file shares). By some criteria a list of users from different domains is generated, those users are added to a ...
0
votes
1answer
159 views

OpenLdap ACL Admin Group rights

Hi I have been trying to achieve Admin and operator level ACL to no avail. So far I've got access to attrs=userPassword,shadowLastChange by self write by anonymous auth by ...
3
votes
1answer
2k views

How to correctly ldapmodify replace olcAccess lines?

This is a part from olcDatabase={1}hdb.ldif olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="cn=admin,dc=somesite,dc=com" write by * none olcAccess: ...
0
votes
0answers
28 views

In openldap, how to grant write access to automountMap to a user additional to rootDn?

The need is to define/create a user/account other than rootDn to have all rights on Dn:automountMapName=auto_environments,dc=company,dc=com to add/delete of mount entries. I'm a newbie to openldap ...