An acl, or Access Control List, is part of a security technology which employs a list of object access permissions for each user who can access that object. The term is used in several common implementations ranging from the Microsoft Windows NTFS filesystem to Cisco Internet firewall device rules.

learn more… | top users | synonyms

1
vote
1answer
26 views

CentOS 7 acl not working for apache

I want to access a user's directory from a cgi script. I set the acl on the directory successfully but the script still gets "Permission denied" when trying to access that directory. I su'd to ...
-2
votes
1answer
22 views

Exim4 ACL - Cannot set a global ratelimit

This is the first time I post on this forum, but since I have found a few leads on my problem I am hoping that I will find a solution. I think what I want to do is very simple. I have a web server ...
1
vote
2answers
21 views

ACL permissions failing in ubuntu

Problem I need to give read/write access to a system group called "mongodb" on a USB key that's been formatted as ext4. It seems that the command worked, but when I try to have the system user write ...
0
votes
2answers
51 views

Proxying TCP by hostname

I've got multiple game servers TCP ports on my single host machine. The goal is to have users be able to connect to server1.domain.net and have their directed based on that subdomain. My first ...
0
votes
1answer
18 views

Samba: per-user ip restriction

We have a Samba server with LDAP authentication running. User privileges are controlled by UNIX groups and ACL and everything works just nicely. In the future we will allow users to connect via VPN ...
2
votes
2answers
127 views

How are Windows MachineKey Container File Name's Derived?

In the C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys directory there's an enumeration of Key Containers. The naming convention is <uniqueGUID>_<staticGUID> and I presume the ...
1
vote
2answers
50 views

Active Directory user rights

I'm currently working on a ASP MVC Website solution that I retrieved from a predecessor, and I had to create an active directory machine to support the login implementation using it. Upon a user's ...
20
votes
7answers
17k views

How to workaround the NTFS Move/Copy design flaw?

As anyone that has dealt with file server permissions is aware, NTFS has an interesting design feature/flaw known as the Move/Copy problem. As explained in this MS KB article, the permissions for a ...
0
votes
0answers
15 views

ACL settings not being inherited properly when creating sub directory

I am trying to extend ACLs across sub directories that are being created under a parent but for some reason one of my groups is being switched to #effective r-x and the mask is being changed. Any ...
0
votes
2answers
798 views

Squid access logging only specific ACLs?

In squid, is it possible to enable access logging only on a specific ACL? If so, how? We have done quite a few searches and were unable to find the proper conf syntax :(
3
votes
0answers
16 views

Recommended Permissions for Virtual Service Accounts on Windows 7+

I'm trying to have an NSIS Installer install a custom service as part of an installation. It would be nice to run the service with one of those typical 'NT Service\xyz' style virtual service accounts ...
0
votes
0answers
43 views

Allow some destination ip/hostnames to bypass acl in squid

We have setup squid for an office environment. We are blocking many multimedia file types like mp3, mp4 etc to prevent bandwidth misuse. Now we have setup media streaming server on our gateway server ...
1
vote
1answer
104 views

Apache2: Allow directory indexing, but restrict file access by type

I need to configure my Apache2 server (version 2.2.22) such that I allow auto-indexing of the WWW root folder and its sub-directories, but restrict access (i.e. restrict download) to just a set of ...
1
vote
1answer
23 views

Is “dc=nomain” a in LDAP ACLs?

I'm trying to set up my first LDAP server. I can't get clients to authenticate using it even though everything seems to be working. i suspect the ACLs might be the problem since i can't see the ACLs ...
4
votes
3answers
3k views

How to block a Countries IP range with a Cisco ASA?

To be more specific I have a request from a client to block China's IP range. I know how to do this. I would use the IPs from https://www.countryipblocks.net/e_country_data/CN_netmask.txt and make a ...
0
votes
2answers
2k views

How to compare/diff ACLs on two directory trees?

I have two directory trees that are supposedly copies of each other. I need to compare not the contents of files but the permissions on them. Is there a tool that will compare two dir trees but ...
0
votes
0answers
14 views

RNDC is not reloading my ACL list in Bind, how can I make it reload without losing Cache?

I have two ACL's, one expired, and one authorized. When I make a change to the ACL and try: rndc reload and rndc reconfig I do not see that the ACL was refreshed. Any ideas?
0
votes
1answer
76 views

SpamAssassin filtering by Exim 4 with virtual user preferences

I would like to configure spam filtering with exim's built-in spam filter support in acl_check_data config section. The piping, exim header modification (to store result) works well. As well as ...
0
votes
1answer
50 views

squid3 blocking access to particular IP not working

I have installed a squid3 on debian and using it as a proxy server. after some time I want to block the particular user using IP address. So I have defined this rule in my squid.conf file but it is ...
0
votes
0answers
34 views

Deny access from from/to subnet

We are running a VPC on Amazon. Our main network is 192.168.0.0/16 We have a subnet at 192.168.1.0/24 Two subnets which are entrypoints for our VPNs at 192.168.2.0/24 and 192.168.3.0/24 And more ...
0
votes
0answers
70 views

Allow ELB healthcheck against nginx but block proxied connections

I have a daemon process that polls a page to monitor system status, as long as everything is happy magic_check.html will exist. As soon as something goes down the file is deleted. I have the AWS ELB ...
5
votes
3answers
12k views

How to set Linux Default ACLs differently for directories and files

I have some ACLs defined on a directory as so: # owner: root # group: root user::rwx group::r-- mask::r-x other::r-- default:user::r-- default:group::r-- default:mask::r-x default:other::r-- I ...
0
votes
0answers
622 views

freenas windows acls folder permissions

We have FreeNAS-9.2.1.3-RELEASE-x64 providing a samba share to IIS (hosted by 2012 R2, if that's relevant) ssasan01# smbd --version Version 4.1.6 The freenas server is joined to an AD provided by ...
1
vote
0answers
40 views

Recalculate Windows inherited ACLs for hardlinks

How do I get Windows to recalculate the inherited permissions of a file? A tool (Mercurial) created multiple NTFS hardlinks to the same file from different directories. I can see them using fsutil ...
0
votes
1answer
44 views

Completely block access to Cisco

There is Cisco Catalyst 3850 (WS-C3850-48T-E) which is managed only via management port. There are several VLANs on the switch. Also the switch works as a DHCP server. SNMP & SSH are already ...
1
vote
2answers
261 views

Struggling with Haproxy 1.5 ACLs using regular expressions and URL Parameters

I am using Haproxy 1.5.3 setup with ssl on the frontend and also sending ssl to the backend servers. the mode is http and using acls to determine stickyness. My test requests are as follows: wget ...
-2
votes
1answer
36 views

Removing all ACLs from Directories and Subdirectories in FreeBSD

how do I remove all ACLS in a folder and subfolder and all their content. Really I just want to stop using ACLs. Currently im using setfacl -b NAME But this is per ACL basis. Is there a ...
0
votes
1answer
108 views

Exim4: Deny outgoing emails with specific destination domains to being sent to the smarthost

I try to deny outgoing emails with specific destination domains to being sent to the smarthost but unsuccessfully. I'm on a debian "squeeze" configured to use a smarthost. vi ...
23
votes
10answers
72k views

How to take ownership of files from the command line?

Every so often I run into a file that I need to take ownership of. I normally use cacls for changing ntfs permissions, but it doesn't seem to do ownership. Under *nix I would run something like ...
2
votes
0answers
93 views

Windows security: default owner configurable?

The "How owners are assigned and set" Technet article is stating: By default, a new object's owner is the security principal identified as the default owner in the access token attached to the ...
0
votes
0answers
41 views

Partition does not mount with ACL option

Debian 7.5 : Installing package acl I've edited /etc/fstab and added the acl option to / I've remunted the partition to avoid reboot by doing sudo mount -o remount,acl / Problem : The mount command ...
1
vote
1answer
488 views

Can't delete Active Directory object

I've been trying to solve this mystery for a couple of days but I think I've reached a dead end. We have delegated user creation and administration to a group. This permissions are applied to a ...
8
votes
7answers
5k views

Why does cp not respect ACLs?

A common way to set up a directory for file sharing within a group, is: $ mkdir foo $ chgrp felles foo $ chmod g+ws foo $ setfacl -m group:felles:rwx foo $ setfacl -dm group:felles:rwx foo This ...
2
votes
2answers
5k views

Grant account write access to specific attributes on Active Directory User object

I am trying to allow an account to update very specific attributes on all User objects. I am setting this security on the "User" object. When I add the account on the security tab, go to advanced, ...
3
votes
0answers
138 views

Cannot set ACL on ACL-enabled EXT4 partition

I am trying to enable xattrs and acls on a Debian machine. I've (re)mounted the partition in question with user_xattr and acl. (/dev/md3 is the partition in question) root@fs01:/# mount | grep ...
0
votes
1answer
224 views

How to disable ACLs on ZFS in FreeNAS?

I inherited a FreeNAS installation that I recently upgraded to version 9. I have some ZFS mounts that are mounted like this: data1/data on /mnt/data1/data (zfs, NFS exported, local, nfsv4acls) ...
0
votes
2answers
58 views

set ACL for BackupUser

I want to backup a whole bunch of folders from different users remotely. Therefore I created a special user that is able to log into the machine and (should) have the right to read all the files via a ...
0
votes
0answers
303 views

Cisco ASA + FreeRadius: Downloadable ACL configuration

VPN users that are using FreeRadius are having access to all VLANs. VPN users using local authentication have local ACLs applied to their access. I need to know what configuration change I need to ...
1
vote
1answer
67 views

Replace User within Active Directory File Server Share

I have a file server role utilizing an Active Directory Domain on Windows Server 2012 and I'm attempting to replace one User Object with another User Object across all existing file server share ACLs. ...
2
votes
1answer
33 views

Is it possible for the Guest user to lose “Everyone” membership?

It seems that the "Guest" user under certain circumstances is logged in without the membership in the "Everyone" Built-in group on Windows Server 2003. I would like to know in more detail why and when ...
0
votes
1answer
57 views

copy files to remote server, maintain remote acls

Currently I am using rsync to copy files from local machine to remote. local does not have ACLs while remote does have ACLs. I would like the files that are rsynced across to maintain the ACL's that ...
2
votes
2answers
2k views

Remove invalid SIDs from filesystem ACLs in Windows

Is there an automated way to traverse a filesystem and remove any ACL entries that reference invalid SIDs in any version of Windows with NTFS?
0
votes
2answers
173 views

Varnish ACLs Behind Load Balancer Based on Client's IP

In the following setup: Client -> LB -> Varnish I would like to configure Varnish acls to take certain action based on the Client's IP. The LB sends the client's IP in a variable called ...
1
vote
0answers
36 views

squid apply rules to a some users

Good day: I have a squid 2.7 stable9 installation that works. It is connected to LDAP and the users can authenticate perfectly. I have different rules for instance to block a few websites during ...
0
votes
1answer
1k views

HAProxy - Perform multiple rewrites based on conditions

I am trying to rewrite a URI as well as a host header based on some conditions. Here is an example of what I'm trying to accomplish: I request http://sub1.example.com/test/files/other if ...
0
votes
1answer
89 views

How do I allow users to add/modify files in a directory but not change the directory - Linux

How can I modify a directory so that it is owned by a group and users in that group can add and delete files and create sub directories but are unable to change the permissions on the parent ...
6
votes
1answer
126 views

Best practice for printer ACLs

I have a question about shared printers, and how to best limit access to them. I have a printer shared from our print server (\\server01\printer01) and I locked it down to just the security groups ...
1
vote
0answers
96 views

How can I add ACL entry comments on a Cisco 3750?

I'm trying to find the best way to add comments into my access-lists. For the moment, the only maneer I found is the following one: switch#conf t switch(config)#ip access-list extended VLAN-TEST3 ...
6
votes
2answers
1k views

Extended ACLs Not Always Being Inherited

I have an application that generates report files in /opt/reports with files owned root:root at 0600. In an attempt to allow an external system to automagically process these reports I created a new ...
4
votes
4answers
1k views

How can I make an internet facing TFTP server secure?

I have many Cisco IP phones that operate in the following manner (oversimplified): Negotiate with DHCP for IP, DNS, TFTP, etc. Look for SEPXXXXXXXXXXXX.cnf.xml configuration file on TFTP server ...