Questions tagged [access-control-list]

An access-list is a list of rules, usually held on network devices such as switches, routers or firewalls, that matches network traffic. The specific term 'access-list' is used in the context of Cisco devices, although the concept of an 'access list' is more generic.

Filter by
Sorted by
Tagged with
0 votes
1 answer
63 views

How to chown a directory on a mounted samba share?

I have a linux client mounting a samba share with the following fstab entry: //<serverip>/<nameofshare> /home/user -o nofail,x-systemd.device-timeout=15s,vers=3.11,user=<sambauser>,...
0 votes
3 answers
2k views

Configuring Squid proxy server

I have installed squid on a mac mini and would like to configure it to be used as a proxy Any ideas where i would start, especially setting up the ACLs, am using webmin as the GUI tool for ...
0 votes
1 answer
104 views

how to block outgoing traffic in ec2 without blocking ssh

I have an EC2 with has public subnet and traffic is flowing through internet gateway. Now, i have an requirement like I have to block all outgoing traffic in EC2. I have tried to restrict the traffic ...
3 votes
2 answers
2k views

Centralised Password Management Software [closed]

Currently, the company I work for has nothing in the way of password management - everything is in a big excel spreadsheet that everyone has access to. Obviously this has a whole rash of issues ...
0 votes
0 answers
677 views

Samba Windows ACL not working

I want to configure Samba to manage Windows ACL and manage them from Windows via the security tab. The Samba server is standalone and not part of an AD tree; i already followed various offical and ...
0 votes
1 answer
34 views

Permission error when setting global-acls in dovecot

Dovecot's ACL plugin instructions indicate that for global acl's, we're supposed to create an acl file in /etc/dovecot/. and to include the access control list items in it. So I've created /etc/...
-1 votes
2 answers
7k views

How to Permit/Deny Traffic based on Domain Name (FQDN) rather than ip address in AZURE? [closed]

I can add inbound/outbound rules in azure network security group for IP address , but how can i make that for domain name (URL) ?
0 votes
0 answers
36 views

Default ACL to backup another user's home directory

I have written a script to backup our servers. It runs as the "backup" user on multiple Oracle Linux 7/8/9 systems and has to backup other users homes directories, among other things, using ...
0 votes
0 answers
56 views

OpenLDAP peername.ip ACL not working for subnets

I have the following ACL stored in my /etc/openldap/slapd.conf file: access to dn.regex="^([^,]+,)?ou=(groups|addressbook),dc=ldap$" by dn.exact="cn=directory,ou=users,dc=ldap&...
0 votes
0 answers
59 views

ACL permissions on Chroot directory

I have the Named service in a Chroot environment, I need a user to be able to modify the live files of the path /var/named/chroot/etc and I do not want to give full permissions with sudo, I have used ...
20 votes
3 answers
90k views

Change owner recursively with Powershell?

I'm trying to use Powershell to change owner of a folder, recursively. I'm basically using this code: $acct1 = New-Object System.Security.Principal.NTAccount('DOMAIN\Enterprise Admins') $...
0 votes
1 answer
2k views

nginx, only allow certain IPs to access a URL prefix

In nginx, how can I restrict access to a certain URL prefix by IP address. i.e. “only these IPs are allowed to access $URL?”. I have a location … { directive, but it looks like the nginx allow & ...
0 votes
1 answer
4k views

HAProxy - Multiple sites, multiple acl's

We are busy with setting up HAProxy. Almost everything is working, except setting it up without multiple sites with different acl's. What we want: Using HAProxy with multiple sites, all on the same ...
38 votes
11 answers
180k views

How to take ownership of files from the command line?

Every so often I run into a file that I need to take ownership of. I normally use cacls for changing ntfs permissions, but it doesn't seem to do ownership. Under *nix I would run something like ...
0 votes
0 answers
139 views

How to restrict ssh access only to users within multiple groups?

I would like to know how to allow ssh access to users who are in multiple groups.  For example, in general, if the user is part of the group shell then they may access a number of servers.  However, I ...
3 votes
2 answers
2k views

how to disable/remove nfs4 acl, and back to original linux access control?

I have add nfs4 acl for a directory in nfs client, but can not use "chown/chgrp" after add nfs4 acl, now I want to give up nfs4 acl, and back to original linux simple access control, how to ?...
1 vote
1 answer
84 views

Why does `getfacl` output for basic permissions differ from `ls -al`?

I have a directory that shows r-x group permissions in ls -al output: mburr@burrvm-mint20:~$ ls -ald /media/mburr drwxr-x---+ 2 root root 4.0K Oct 6 17:11 /media/mburr The ls -al output also shows ...
0 votes
1 answer
16 views

Aruba Access list redundant entries

I am using Aruba switches, and the configuration that I have been given to review has redundant entries in the ACL per below: 14 permit tcp 10.255.252.0/255.255.255.0 any eq ssh 15 permit tcp 10.255....
0 votes
2 answers
102 views

Avoid Windows folder listing with ACL

Is it possible through ACL to prevent a local user account to "dir" the windows folder ? I tried with "Advanced security settings", but cannot change a thing...
2 votes
1 answer
479 views

Default owner and setting sticky bit by default

I have a RHEL 5.5 server and want to set up some specific security for a directory: Please note that I am not asking how to do this one time... that has already been done. I want all new directories ...
0 votes
0 answers
87 views

Samba Linux server MacOS client ACLs

I'm trying to enable ACLs for a Linux Server using a MacOS client. My configuration is as follows: [global] vfs objects = acl_xattr map acl inherit = yes store dos attributes = ...
2 votes
1 answer
53 views

squid: Unable to allow 10.10.11.0/24 but 10.10.11.0/23 works

Im unable to make a working acl with CIDR over `/23` (squid 5.7 on Debian) For example i got this config (working): acl servers src 10.10.11.0/23 http_access allow servers ... http_access deny all ...
0 votes
0 answers
143 views

How to drop arp requests trying to resolve a particular IP address at a logical switch port?

I am using l2gateway port to attach a physical L2 segment to a logical network. But both the logical network and the physical segment has one common IP, say 10.0.0.1. I want to prevent the traffic ...
1 vote
1 answer
2k views

Windows - Set permission on folder only without recursing subobjects (slow for large directory trees)

There are many times when I wish to set a permission on a folder only, but all the programs i've tried will recurse through all sub files and folders during the process. As this is slow, is there any ...
0 votes
0 answers
92 views

Linux Debian ACL, is default mask overriden by something in FTP?

I have an Linux Debain 10 server running an web project. The project (parent) folder is as follows: ls -la: drwxrwxr--+ 7 some_user some_group 4096 Jul 21 11:01 . getfacl: # file: . # owner: ...
2 votes
1 answer
126 views

Restrict User Access to Mailbox based upon Location

We need to restrict user access to certain mailboxes (Outlook/MAPI) based upon the user's location within our site. All mailboxes exist within the same on-premise Exchange server - all mailbox access ...
2 votes
2 answers
931 views

NFSv4 ACLs on gpfs

I try to use NFSv4 over gpfs, but I'm get the following errors: # nfs4_getfacl file Operation to request attribute not supported. # nfs4_setfacl -e file Operation to request attribute not supported. ...
1 vote
2 answers
1k views

Force all files & subdirs that BY ANY MEANS come to be in/under a directory to inherit all permissions and group

I know this question may appear to be a duplicate, because many people have asked related questions about permission inheritance. However, none of the answers I've found address the full scope of what ...
0 votes
1 answer
190 views

If the default nfs4 ACL 'deny access' why do default ACLs frequently contain A::EVERYONE@:rxtncy?

Is there an alias for deny that I could use? So far I have not had any luck removing the EVERYONE@ ACE. Maybe that a bad idea. You tell me. I was just able to nfs4_editfacl and change the A::EVERYONE@...
0 votes
1 answer
129 views

NT Security Descriptor

In active directory an object have several permissions on many objects. how to view permissions of particular object? i am asking like for eg user Kavin have read permissions on some folder, full ...
0 votes
0 answers
35 views

If there is no local user does my ACL need to have an OWNER@ ACE?

I'm setting up nfs4 ACLs on directories for users that are not local Linux users. I can use chown 23524356:474688 dir and that works. But what does the OWNER@ ACE represent? Is it an alias to user ...
1 vote
1 answer
211 views

How does one set ownership of a directory using nfs4_setfacl?

Or put another way, when I see @OWNER in a nfs4 ACL does this @OWNER refer to a local Unix/Linux user? I need to make an AD user (without a corresponding local account) the owner of a directory on a ...
135 votes
3 answers
363k views

What does Apache's "Require all granted" really do?

I've just update my Apache server to Apache/2.4.6 which is running under Ubuntu 13.04. I used to have a vhost file that had the following: <Directory "/home/john/development/foobar/web"> ...
6 votes
2 answers
1k views

How NTFS folder access is checked in a Active Directory domain?

I understand that both NTFS folders and AD objects use security descriptors and DACL’s to check user/process access MS Learn - How access check works However, how does the access check resolves ACE’s ...
0 votes
1 answer
214 views

Unable to set ACL for user and groups in rootless containers

i'm running a Debian container in rootless mode and can't set an acl for groups and users besides my own group and user (at least it seems so). I started a bash in a container ( runc --root /var/slurm/...
5 votes
5 answers
44k views

Remove a user from ACL completely using PowerShell

I wish to remove a user from folder permissions using PowerShell. I have found plenty of examples on how to remove the user permissions but I actually want to remove the user entirely. The equivalent ...
1 vote
2 answers
562 views

Netcat successfully sends UDP packet despite all UDP traffic being blocked via Network ACL

I've created an AWS instance in the default VPC and I've blocked all UDP traffic in the Network ACLs. Here's how my outbound rules look: Rule number Type Protocol Port range Destination Allow/Deny ...
0 votes
0 answers
91 views

Restrict Apache forward proxy to a remote url set

Is there a robust way to restrict Apache forward proxy to a set of remote URLs? Now I can see the only solution with multiple identical <Proxy "..."> blocks as: <Proxy "http://...
8 votes
2 answers
4k views

Exim4 - temporarily freeze outgoing emails from specific user

I need to temporarily freeze outgoing emails from specific sender with exim4. The sender logs in with remote SMTP (i.e. over TCP/IP). What I want to do is to freeze (but not deny) all his emails so I ...
2 votes
2 answers
737 views

ACL settings works when using ssh but not with scp command

I have setup an Arch Linux machine with a user 'archie' with a primary group 'users' as: useradd -m -g users archie Whenever archie creates a file in his ~/shared directory I want the group users to ...
-1 votes
1 answer
3k views

acl url_regex on squid3 is not working using an online tested regular expression

I was asked to block Facebook access from 8:00am to 3:00pm for almost all users but they are bypassing the current defined rules to access the social network anyway. This is consuming a lot of our low ...
0 votes
1 answer
202 views

Make folder writable by multiple users via ACL

Is it possible to set the rights of a folder and all its files in such a way that multiple defined users can add, modify and remove files within? I was hoping to be able to do that via ACLs and I got ...
2 votes
0 answers
78 views

How to make an ACI for users that are `roleOccupant` in an `organizationalRole`?

In OpenLDAP I had an access rule using users that are roleOccupants in a specific organizationalRole like this (the example is just a fragment): olcAccess: to * by group/organizationalRole/...
0 votes
0 answers
359 views

Why do all users still have full access in my samba server after i have set limited permissions?

I have a debian 11 server running samba and is hosting a share of a drive that's mounted in fstab. I have added "acl" to the fstab and installed acl in the samba config. To be clear: my end ...
0 votes
1 answer
395 views

Apache2 how to limit a subdirectory to local network only

I have an Apache2 (2.4.41) server running on Ubuntu 20.04 that serves a couple of Flask web apps differentiated by sub-directory to the internet over HTTPS and a No-IP DDNS (https://mysite.noip.com/...
0 votes
3 answers
748 views

Is mail rejected by Exim's !verify = header_syntax ACL item, with RFC 2047-encoded From/To headers, legitimate?

A recent Exim upgrade added this to the default acl_smtp_data ACL: .ifndef NO_CHECK_DATA_VERIFY_HEADER_SYNTAX deny !acl = acl_local_deny_exceptions !verify = header_syntax message = header ...
0 votes
1 answer
121 views

Set timeout in Apache ACL

for a page in an Apache webserver under ACL, is there a way to force apache to prompt again for credentials after a fixed timeout? For example, user tries to access the url, he fills the credentials ...
1 vote
0 answers
173 views

Automating NFSv3 File/Folder permissions in Windows

I'm a Windows/MSSQL DBA who is inheriting a quirky system through no fault of my own, and had a quick question. Background I have an Azure NFSv3 volume that is being exported to a Windows Server 2019 ...
0 votes
1 answer
552 views

Squid Proxy always 403

I have been trying to setup Squid proxy for a good 2 hours now, I dont want any authorizations or any blacklists. I just want all requests to get accepted. I have already tried http_access allow all, ...
4 votes
4 answers
3k views

Backup data while keeping POSIX ACLs and permissions

I'm looking for a practical way to backup data from a server and keep all ACLs and permissions. I've looked at tar, but according to Google tar doesn't keep ACLs . I know rsync can keep ACLs and ...

1
2 3 4 5
16