An acl, or Access Control List, is part of a security technology which employs a list of object access permissions for each user who can access that object. The term is used in several common implementations ranging from the Microsoft Windows NTFS filesystem to Cisco Internet firewall device rules.

learn more… | top users | synonyms

4
votes
1answer
7k views

Inherit or set permissions for all new files under a specific path

I would like the Linux filing system to set a specific group when new files and directories are created by different users under a specific directory. I know I can use chmod to change existing files ...
1
vote
2answers
131 views

Controlling traffic on a small subnet

I have a small network with a business-class cable modem. I have a *.192/29 block assigned to the internal side of the modem. The first usable IP, .193, is assigned to the cable modem interface. I ...
0
votes
2answers
1k views

Cisco Route-Map Multiple ACL Match (Logical AND)

I'm having difficulty to configure a route-map with multiple matches in AND operation. The issue is, both match criteria are against ACL, but different ACL. What I want to do is route-map TEST ...
0
votes
1answer
1k views

Linux ACL behaviour: settings the mask changes 'ls' output, but not actual permissions

It might be the time of night, but this is puzzling me. Picture the following. [root@node1 acltest]# getfacl foo/ # file: foo # owner: root # group: testuser user::rwx group::r-x other::--- ...
4
votes
2answers
5k views

How to allow some (non-admin) users to edit address/phone properties for all AD users?

I need to allow HR people to edit some attributes for all Active Directory users (phone numbers, address, and similar contact informations), without giving them full administrative rights. They will ...
4
votes
1answer
780 views

Rate/Bandwidth limiting with haproxy, what are the options?

I have tried reading up on different methods of limiting (rate/bw) with haproxy, but seems the only working implementation I find is per /32 ip based limit. Is it possible to do rate limiting based on ...
1
vote
1answer
500 views

Add Port Forward to ASA5505 with IPSEC Tunnel

I have an ASA 5505 on 8.2 in the field already working. It has two interfaces, LAN/inside and WAN/outside. There is an L2 site-to-site IPSec tunnel configured from the outside interface of the local ...
4
votes
2answers
2k views

Why does chmod(1) on the group affect the ACL mask?

I am trying to understand this Unix behavior (which I happen to be testing on Ubuntu 11.10): $ touch foo $ setfacl -m u:nobody:rwx foo $ getfacl foo # file: foo # owner: michael # group: michael ...
1
vote
1answer
1k views

Windows Server : role of SYSTEM and CREATOR OWNER users?

I'm working on a SBS2003 server, and I'm about to clean up on folder permissions. I notice that quite a few folders have the users SYSTEM and CREATOR OWNER set. Now, I've found descriptions of the ...
1
vote
0answers
189 views

Can I make an ACL in squid for transparent connections?

I have a squid proxy that transparently intercepts connections from an internal network, and is explicit for connections from another network. I want to use authentication for the external network, ...
5
votes
3answers
5k views

Can I override my umask using ACLs to make all files created in a given directory world readable?

Assume that my umask is 0077. I have a directory, foo, that I want to have special permissions applied to it. All files I create in foo should be world readable, and all directories should be world ...
0
votes
1answer
1k views

store users and groups permission (ACL) to LDAP

I'm trying to store ACL permissions to LDAP. I have permission for users and for groups (user belongs to many groups). Here is structure i create: ou=Groups cn=Admin [posixGroup] ...
3
votes
2answers
4k views

haproxy acl - accept only from specific IPs

I've got haproxy and need to provide smtp to servers which does not have direct connection. Here is portion of my config: listen smtp 10.12.23.10:3025 mode tcp server smtp ...
2
votes
1answer
404 views

Samba SGID directories and delegation of privileges

What I basically want to do, is to be able to set SGID (setgid) on certain directories from Windows on Samba shares. Reminder: Files and directories created within directory with SGID set inherit the ...
0
votes
1answer
686 views

How do I configure Squid Proxy located at a different location to route internet traffic?

I have a Linux box (Ubuntu 9.10) at a different location. I installed squid proxy and tried using that IP and port (opened 3128 at that location) in Firefox. I can't get it to work. My current ...
2
votes
1answer
2k views

Impossible to modify or add information after conversion of slapd.conf to cn=config with fresh install of OpenLdap

I start with a fresh installation of openldap 2.4.28 on debian. They are some problem with the debian package, and with gnuTLS, so i compile a version with opennSSL library. It's hard to understand ...
1
vote
1answer
36 views

Apache's configuration: sharing same “Deny From” between multiple virtualhosts

I'd like to be able to share same "Deny From" from one VirtualHost to another in Apache's httpd configuration, is there a way to do it?
2
votes
2answers
791 views

Permission, apache user and www folder in Linux

The httpd process runs with apache user/group credential, while /var/www/html folder is owned by root user/group. What's the best practice to manage permissions on public html folder? Leave them as ...
0
votes
1answer
127 views

Cisco 12.4 ACL with DHCP-obtained address

I figured this would be an easy one, but I've had a good amount of trouble finding this answer myself. I have a Cisco router that I'm setting up to have my Internet connection on one interface ...
0
votes
1answer
527 views

AuthzSVNAccessFile for git-http-backend?

I want to host some git-Repositories. Is it possible to setup them like SVN-Repos with a central ACL-File? (Have a look at AuthzSVNAccessFile-Directive for example) Thanks, Philipp
3
votes
1answer
811 views

ZFS - use pure ACLs to force group write permissions to be inherited

I am migrating a directory structure from a UFS filesystem to ZFS. In the old location I had POSIX ACLs set to force all new files/directories within the structure to be created with group write ...
6
votes
2answers
5k views

icacls granting access to all users on windows 7

I'm trying to give full access (read, write) to a specific folder to all users on Windows 7. The problem is that I don't know how to do that using icacls.
7
votes
3answers
3k views

A network share folder is invisible to users

I have a network share folder that I was recently cleaning up permissions to. I took off the four individual names from the access permissions to the folder, and added a new security group (Universal) ...
1
vote
2answers
230 views

JBoss basic access

I have JBoss 5 deployed on Solaris 10 - the servers connection has unrestricted high ports (>1023) open to the internet. I can access the box via ssh & FTP from a second server on the same subnet ...
0
votes
1answer
383 views

Revoke directory access for a particular user in Solaris

I have a need to allow directory access to a particular user on my file system. I want this user to be unable to access any other directory in my file system (initially anyway. It may need access to ...
0
votes
1answer
1k views

Specifying multiple acl conditions on one acl line of squid.conf

In squid I need to combine acl conditions in one line: e.g. acl allowed_conn src 10.40.50.5 && dstdomain intranet.loc acl allowed_conn src 10.40.50.6 && dstdomain anothersite.net I ...
5
votes
1answer
1k views

Does anyone know where a good resource for NFS4 ACLs can be found?

I am attempting to utilize NFS4 ACL's in an environment already utilizing POSIX ACL's. I've found a handful of sites on the internet that explain some technical details about NFS4 ACL's and how ...
1
vote
2answers
432 views

What is the relationship (if any) between UAC and ACLs on Windows platforms?

What is the relationship between UAC and ACLs on Windows platforms? Are these two separate security schemes? Or is one a superset of the other? Intuitively I would expect them to be related but I've ...
1
vote
2answers
306 views

Debian/kFreeBSD using ACLs on ZFS

How can I use ACLs on a ZFS filesystem under Debian/kFreeBSD? uname -a GNU/kFreeBSD foo1 8.2-1-amd64 #0 Thu Oct 27 20:48:27 UTC 2011 x86_64 amd64 Intel(R) Xeon(R) CPU X3220 @ 2.40GHz GNU/kFreeBSD ...
0
votes
1answer
2k views

How does Cisco IOS ACL established flag work

You can permit outgoing packets, but then you need to permit the responses. One way is to permit any packet that is a followup to an established connection. access-list ??? permit tcp any any ...
5
votes
1answer
7k views

Setfacl: Operation not supported [duplicate]

Possible Duplicate: setfacl: x.txt: Operation not supported I am trying to do: setfacl -m d:u:apache:rw /etc/asterisk/additional/ but getting: setfacl: /etc/asterisk/additional/: ...
1
vote
1answer
117 views

Delegating Windows permissions to different groups of administrators [closed]

We have some Windows servers. They are running all sorts of services, DNS, SQL Server, IIS, Oracle, etc. We want to setup a few AD groups, say DBA, WebAdmin and SAPAdmin. Then, we want to delegate ...
1
vote
1answer
301 views

Best way to control access?

I have a few servers that serve different purposes (and thus different users use each) that authenticate to an LDAP server (I do not have permission to modify content on the LDAP server). What is an ...
1
vote
1answer
311 views

Cannot apply ACL | setfacl: /home/username: no space left on the device

I'm not able to set ACL on file/directories. Below is the data copied from my terminal. -bash-4.1$ setfacl -m u:asagar:x TestACL setfacl: TestACL: No space left on device -bash-4.1$ df -ahi ...
0
votes
2answers
5k views

LDAP ACLs with ldapmodify & .ldif file grand user access only

I want to change the settings my new LDAP server let only users of the server read entries and not anonymous. Currently my olcAccess looks like this: olcAccess: {0} to ...
1
vote
0answers
318 views

NFSv4 ACLS vs NFSv3 KRB5 - problems - alternatives?

So NFSv4 acls don't ignore the umask as far as I can tell. And nfsv3 with kerberos has its own host of problems (with autofs - race conditions with pam). So if we want to use an nfs like system with ...
1
vote
4answers
11k views

How to block SKYPE when it's using port 80 & 443?

How to block SKYPE when it's using port 80 & 443 in a network. ( better if I can do it by using ISA 2006 and without disabling web) I know if users can't install skype they wont be able to use it. ...
0
votes
1answer
369 views

Migrate SIDs on file ACLs between systems

Actually, what I've done is install windows 7 on my old XP machine, and since I went x64 and used to have x32, there was no upgrade path. I used the User State Migration Tool (USMT) to move a lot of ...
1
vote
1answer
802 views

Filtering traffic into a Vlan in a Switched Network

I am designing a topology with one Core Switch and around 6 Edge Switches with around 10 Vlans managed through the VTP Server running on Core Switch. Inter Vlan routing is also enabled on the core ...
1
vote
2answers
2k views

HAProxy seems to be load balancing instead of following ACL rules

I'm seeing some really odd behavior with HAProxy. I have the following setup below designed to allow example.com/wiki to go to one server and example.com/ go to another. The trouble is that it seems ...
0
votes
1answer
152 views

Help with setting up access rights for an FTP server on Ubuntu Server?

I'm looking for an FTP solution that will allow me to: Setup a group that has R/W access to 2 folders in the file system (/var/www/1 and /var/www/2) Create users that inherit the rules from that ...
2
votes
1answer
222 views

How to enumerate shared folders with ACLs?

Does anybody know how to get the list of locally shared folders with ACLs and export the list to a file?
3
votes
1answer
114 views

Are private user groups beneficial with POSIX ACLs?

It has been a custom in Linux/Unix world that each user gets assigned a default group with the same name and the user is the only member of that group. The original justification was to allow ...
2
votes
4answers
926 views

how to every file/directory in a tree to have the same owner, group, perms, acls?

playing with a scilinux 6.1 box. fs is ext4 with acls enabled. If I have a directory, say /pub, that I want everything in it to always, without exception have a predefined owner, predefined group, ...
1
vote
0answers
279 views

Periodically completely lose access to a file (cannot take ownership) in Win 2k8 R2

Running Win 2k8 R2 SP1 64 bit as a web server box with IIS 7/.NET 4. Periodically, I completely lose access to the membership database in one of my sites (ASPNETDB) which causes a "Network Service ...
6
votes
3answers
4k views

How can I add ACL permissions for IIS APPPOOL\* accounts via Powershell?

I want to be able to set the IIS account for new websites to have modify permissions. I have the following script: function Set-ModifyPermission ($directory, $username, $domain = 'IIS APPPOOL') { ...
2
votes
2answers
296 views

Clean up MySQL privileges

Is it possible to delete users/privileges who exist but don't have access to a database (excluding users with global privileges) Also I notice a number of "database-specific privileges" that no ...
0
votes
2answers
193 views

Cisco Router ACL - permit one user to access all ports outgoing and incoming

The Cisco router ACL was configured by someone else. So what i want to do is i would like to give one user to access all ports incoming and outgoing. when i tried like this #access-list 101 permit ...
2
votes
1answer
446 views

Enable ACL for eCryptFS mounted home directory

I am running Ubuntu 11.04 with the "encrypt home directory" feature. This uses eCryptFS to encrypt and mount my home directory. Now I need to enable ACL for this mount but since it's not configured ...
2
votes
1answer
537 views

Non-working ACL configuration

I want both my users 'tobias' and 'www-data' to be able to read and write to a specific directory. To that end I have chowned it to tobias:www-data, added tobias to the www-data group and added ...