An acl, or Access Control List, is part of a security technology which employs a list of object access permissions for each user who can access that object. The term is used in several common implementations ranging from the Microsoft Windows NTFS filesystem to Cisco Internet firewall device rules.

learn more… | top users | synonyms

23
votes
10answers
74k views

How to take ownership of files from the command line?

Every so often I run into a file that I need to take ownership of. I normally use cacls for changing ntfs permissions, but it doesn't seem to do ownership. Under *nix I would run something like ...
20
votes
7answers
18k views

How to workaround the NTFS Move/Copy design flaw?

As anyone that has dealt with file server permissions is aware, NTFS has an interesting design feature/flaw known as the Move/Copy problem. As explained in this MS KB article, the permissions for a ...
10
votes
8answers
4k views

Is this a recommended/valid approach for file server permissions?

File servers are a fact of life in IT and I'm curious if there are any generally accepted practices (I hesitate to use the word "best" here) for how you create groups and apply permissions for ...
10
votes
1answer
181 views

Can I “merge” two groups using SID history?

I have two AD groups which were erroneously created while there should instead have been only one group; they contain the exact same users. However, these groups have been assigned various permissions ...
8
votes
3answers
1k views

What good Active Directory + Exchange competition is there?

Based on this question regarding enhanced permission support in filesystems, what is the best permissions + directory and mail stack to compare against Active Directory on NTFS with Exchange? I'm ...
8
votes
1answer
3k views

setfacl to reset file to default permissions?

I have a directory with the following default ACLs: default:user:phptutor:rwx However, none of the files/directories in that directory have that default permission (because it was added after they ...
8
votes
3answers
9k views

Can Samba support full Windows-ACLs?

I've set up a Samba 3 host with AD integration and an ACL enabled filesystem. Using a windows client I can set users and groups permissions. Up to now, Samba just maps to POSIX ACL's rwx permissions, ...
8
votes
7answers
5k views

Why does cp not respect ACLs?

A common way to set up a directory for file sharing within a group, is: $ mkdir foo $ chgrp felles foo $ chmod g+ws foo $ setfacl -m group:felles:rwx foo $ setfacl -dm group:felles:rwx foo This ...
7
votes
3answers
3k views

A network share folder is invisible to users

I have a network share folder that I was recently cleaning up permissions to. I took off the four individual names from the access permissions to the folder, and added a new security group (Universal) ...
7
votes
2answers
2k views

Is there a performance impact of direct AD universal groups assignment?

I'm implementing a tool which secures certain shared resources within AD forest (mostly file shares). By some criteria a list of users from different domains is generated, those users are added to a ...
7
votes
1answer
6k views

setfacl: x.txt: Operation not supported

What I did and what it did: > getfacl x.txt # file: x.txt # owner: cwhii # group: cwhii user::rw- group::r-- other::r-- > groups cwhii adm dialout cdrom plugdev lpadmin admin sambashare > ...
6
votes
5answers
10k views

Resetting NTFS Permissions Disk Wide

Someone messed up majorly in setting permissions on an NTFS drive and I'm looking at a way to reset all permissions to default. The OS will be reinstalled but I'm trying to salvage data from their ...
6
votes
3answers
4k views

How can I add ACL permissions for IIS APPPOOL\* accounts via Powershell?

I want to be able to set the IIS account for new websites to have modify permissions. I have the following script: function Set-ModifyPermission ($directory, $username, $domain = 'IIS APPPOOL') { ...
6
votes
3answers
6k views

linux/setfacl - Set all current/future files/directories in parent directory to 775 with specified owner/group

I have a directory called "members" and under it there are folders/files. How can I recursively set all the current folders/files and any future ones created there to by default have 775 permissions ...
6
votes
2answers
1k views

Extended ACLs Not Always Being Inherited

I have an application that generates report files in /opt/reports with files owned root:root at 0600. In an attempt to allow an external system to automagically process these reports I created a new ...
6
votes
1answer
130 views

Best practice for printer ACLs

I have a question about shared printers, and how to best limit access to them. I have a printer shared from our print server (\\server01\printer01) and I locked it down to just the security groups ...
6
votes
1answer
2k views

Applying ACLs to a Dovecot public namespace

I would like to provide access to some mailing lists via a set of public, read-only mailboxes in Dovecot. I have a public namespace define in my dovecot (dovecot-2.0.9) configuration that looks like ...
5
votes
3answers
525 views

What is the ZFS ACL limit?

Does anyone know how many user ACL's ZFS can handle? With other words: for how many users can I set ACL's like this one for the same directory? setfacl -m user:test1:rwxpDdaARWcCos:fd----:allow ...
5
votes
3answers
1k views

sudo or acl or setuid/setgid?

for a reason I do not really understand, everyone wants sudo for all and everything. At work we even have as many entries as there are way to read a logfile (head/tail/cat/more, ...). I think, sudo ...
5
votes
2answers
5k views

icacls granting access to all users on windows 7

I'm trying to give full access (read, write) to a specific folder to all users on Windows 7. The problem is that I don't know how to do that using icacls.
5
votes
2answers
951 views

Improved ACL editor for Windows file permissions

I have recently been doing a lot of updates to our network drive permissions... such as consolidating direct user permissions into group permissions. The built-in ACL editor (Advanced Security ...
5
votes
1answer
7k views

Setfacl: Operation not supported [duplicate]

Possible Duplicate: setfacl: x.txt: Operation not supported I am trying to do: setfacl -m d:u:apache:rw /etc/asterisk/additional/ but getting: setfacl: /etc/asterisk/additional/: ...
5
votes
3answers
5k views

Can I override my umask using ACLs to make all files created in a given directory world readable?

Assume that my umask is 0077. I have a directory, foo, that I want to have special permissions applied to it. All files I create in foo should be world readable, and all directories should be world ...
5
votes
3answers
12k views

How to set Linux Default ACLs differently for directories and files

I have some ACLs defined on a directory as so: # owner: root # group: root user::rwx group::r-- mask::r-x other::r-- default:user::r-- default:group::r-- default:mask::r-x default:other::r-- I ...
5
votes
2answers
3k views

Give only Read only rights for Desktop, My document..etc via GPO

I want to accomplish the following task: A user must not have rights to save in his/her Desktop, My Documents, My Music, My video, My picture, etc. I have already prevent & hide all drives via ...
5
votes
3answers
4k views

How do I copy ACLs on Mac OS X?

Most unix derivates can copy ACLs from one file to another with: getfacl filename1 | setfacl -f - filename2 Unfortunately Mac OS X does not have the getfacl and setfacl commands, as they have ...
5
votes
1answer
727 views

NFSv4 - ACLs not working

I've setup an NFSv4 server (Debian) and client (Ubuntu/Mythbuntu). It seems that uid username mapping is working nicely out-of-the-box (I get correct usernames on ls -l if the usernames match between ...
5
votes
1answer
1k views

Does anyone know where a good resource for NFS4 ACLs can be found?

I am attempting to utilize NFS4 ACL's in an environment already utilizing POSIX ACL's. I've found a handful of sites on the internet that explain some technical details about NFS4 ACL's and how ...
4
votes
4answers
1k views

How can I make an internet facing TFTP server secure?

I have many Cisco IP phones that operate in the following manner (oversimplified): Negotiate with DHCP for IP, DNS, TFTP, etc. Look for SEPXXXXXXXXXXXX.cnf.xml configuration file on TFTP server ...
4
votes
2answers
5k views

How to allow some (non-admin) users to edit address/phone properties for all AD users?

I need to allow HR people to edit some attributes for all Active Directory users (phone numbers, address, and similar contact informations), without giving them full administrative rights. They will ...
4
votes
2answers
2k views

Why does chmod(1) on the group affect the ACL mask?

I am trying to understand this Unix behavior (which I happen to be testing on Ubuntu 11.10): $ touch foo $ setfacl -m u:nobody:rwx foo $ getfacl foo # file: foo # owner: michael # group: michael ...
4
votes
2answers
5k views

file ownership for new files with administrator - why is it giving ownership to the group administrators?

I am logged in as administrator and I right click on a folder and then go to properties, then the security tab, then advanced, then the owner tab. I am not on a domain. I see that the folder has a ...
4
votes
1answer
7k views

Inherit or set permissions for all new files under a specific path

I would like the Linux filing system to set a specific group when new files and directories are created by different users under a specific directory. I know I can use chmod to change existing files ...
4
votes
3answers
3k views

How to block a Countries IP range with a Cisco ASA?

To be more specific I have a request from a client to block China's IP range. I know how to do this. I would use the IPs from https://www.countryipblocks.net/e_country_data/CN_netmask.txt and make a ...
4
votes
2answers
1k views

Is it possible to list all permissions where I don't have access

I'm looking for a way to recursively go through my entire file share ( fairly large 3TB of files ) and list out all files/folders that I don't have access to. Due to a migration and some errors on ...
4
votes
1answer
620 views

Firewall ACL management tool

Is there any Firewall ACL management tool which can generate set of ACLs for all my network, including switches, checkpoint, cisco routers, windows, linux etc? I think such tool would make sense as ...
4
votes
1answer
2k views

Permission Hierarchy possible in OpenSolaris + ZFS + ACLs?

I've been doing some research into OpenSolaris and ZFS for use in a NAS. Thus far I have created the following: /tank/projects /tank/storage /tank/developer /tank/sandbox The ...
4
votes
1answer
203 views

What exactly is included in the Windows “Everything” security identifier (e.g. does it include computer accounts like DOMAIN\MACHINE$)?

This is a generalization of a question I initially had asked about computer accounts. I asked: When one sets Windows permissions for "Everyone", do these permissions apply to computer accounts ...
4
votes
1answer
4k views

How to correctly ldapmodify replace olcAccess lines?

This is a part from olcDatabase={1}hdb.ldif olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="cn=admin,dc=somesite,dc=com" write by * none olcAccess: ...
4
votes
1answer
488 views

Disabling/Enabling Modules Parameter RHEL

I'm working with kernel module parameters, and I've found myself a bit confused. In particular, I'm attempting to enable posix ACL support for XFS file systems. This requires the XFS module to be ...
4
votes
3answers
559 views

Why is ACL not working correctly with this setup?

I am running Arch Linux on my laptop as a development machine, and I need to grant the users group RW privileges to the folder: /srv/http and all files and folders under it. I made sure that ACL is ...
4
votes
1answer
2k views

Share Point ACL on OSX Lion Server - Posix group always takes over ACLs

Trying to configure a share point on a Lion Server machine. The directory is created by the local server admin (serveradmin) and has rwxr-x--- given to it. The serveradmin user belongs to the local ...
4
votes
1answer
732 views

Rate/Bandwidth limiting with haproxy, what are the options?

I have tried reading up on different methods of limiting (rate/bw) with haproxy, but seems the only working implementation I find is per /32 ip based limit. Is it possible to do rate limiting based on ...
3
votes
3answers
2k views

Backup data while keeping POSIX ACLs and permissions

I'm looking for a practical way to backup data from a server and keep all ACLs and permissions. I've looked at tar, but according to Google tar doesn't keep ACLs . I know rsync can keep ACLs and ...
3
votes
6answers
5k views

Cisco Firewall vs Cisco Router ACLs

What are the advantages of getting a dedicated firewall instead of, or in addition to, using ACLs and ip inspection on a router? I realize this might depend on the version of the router, are certain ...
3
votes
2answers
2k views

How can I check access of a Group/User in AD before I delete it?

I'm cleaning up an inherited domain that is not well documented. How can I check that a particular group or user has no ACEs across the AD? Things like searching DACL/SACL for AD objects and file ...
3
votes
2answers
106 views

Access rights escalation requiring multiple sysadmin authorisation

I was just wondering if there is a way to give a user root access escalation on a *nix system, kind of like sudo, but which requires more than one sysadmin authorisation. I am thinking of something ...
3
votes
2answers
279 views

What filesystem comes closest to matching NTFS for support of ACLs, and highly-granular permissioning?

It seems that most other filesystems handle the basic *nix permissions (ugo±rwx), with maybe an addition here or there. Or can be "made" to handle ACLs through the use of other tools on top of ...
3
votes
1answer
113 views

Are private user groups beneficial with POSIX ACLs?

It has been a custom in Linux/Unix world that each user gets assigned a default group with the same name and the user is the only member of that group. The original justification was to allow ...
3
votes
2answers
3k views

Fixing “This access control list is not in canonical form” errors from the command line

On several of our developer workstations, we've been getting the dreaded "This access control list is not in canonical form and therefore cannot be modified." error when we try and set permissions on ...