Hot answers tagged

20

subinacl is a Windows sysadmin's power tool for doing everything to do with ownership and ACLs. You can change the ownership to anyone other than just you (you can't do this with the GUI). subinacl /file test.txt /setowner=domain\foo This lets you set the permission to any user you like, without having to be an administrator (as I believe takeown.exe ...


20

You're looking for "TAKEOWN.EXE", which was first in Windows Server 2003 as a standard component, and I believe a resource-kit item prior. See: http://technet.microsoft.com/en-us/library/cc738152(WS.10).aspx


16

It would not be convenient for you if chmod() didn't have this behaviour. It would be highly inconvenient, because things that people traditionally expect to work on Unixes would break. This behaviour serves you well, did you but know it. It's a shame that IEEE 1003.1e never became a standard and was withdrawn in 1998. In practice, fourteen years on, it's ...


16

I actually found something that so far does what I asked for, sharing here so anyone who runs into this issue can try out this solution: sudo setfacl -Rdm g:groupnamehere:rwx /base/path/members/ sudo setfacl -Rm g:groupnamehere:rwx /base/path/members/ R is recursive, which means everything under that directory will have the rule applied to it. d is ...


15

If you're talking about a disk that doesn't contain a Windows installation, just use the "TAKEOWN" and "ICACLS" utilities: TAKEOWN /f "X:\" /r /d y ICACLS "X:\" /reset /T Then you can reset the ACLs to whatever you want. If it's a disk with a Windows 2000, XP, or Server 2003 operating system installed (don't know about Vista on this one) you could try re-...


13

This sounds like the default mount behavior is not allowing ACLs on the filesystem. getfacl will report the normal filesystem permissions without error, but setfacl is unable to operate because the filesystem is mounted without the ACL option. You can add this in /etc/fstab or by modifying your filesystem options. Assuming you have the /home filesystem ...


12

c:\windows\system32\icacls c:\folder /grant "domain\user":(OI)(CI)M c:\windows\system32\icacls c:\folder /grant "everyone":(OI)(CI)M c:\windows\system32\icacls c:\folder /grant "Authenticated Users":(OI)(CI)M Open command window and type c:\windows\system32\icacls /?


12

You would make TFTP access over the internet secure the same way you'd make access to anything over the internet secure. By going through a VPN. Cisco's IP phones can be set up to use a VPN, and someone even put together a handy doc around common issues with this setup that you might want to take a look at.


11

My approach is to not use file/directory level file permissions; use file share level permissions, and set the whole server filesystem data drive to Everyone Full Control (which becomes moot). Over the years (10+), I have found that NTFS permissions are more complex and leads to more errors. If the permissions are set wrong, or the inheritance gets broken, ...


11

Use getfacl to get the default permissions from the directory and then pipe the result into setfacl to apply it. Something like this should work: getfacl -d <directory> | setfacl -R --set-file=- <directory>


10

Take ownership and full rights of folder and everything inside: takeown /F somedir /A /R icacls somedir /grant:r User:F /T I had to start a command prompt as administrator, but it worked for me in Windows 8.1. With Windows 8.1 awkwardness, I had to search for "command", right click on the command prompt icon, in order to see the "run as Administrator" ...


10

If cp creates the destination file, it replicates the permissions of the source file, except for the bits that are set in the umask. This is standard behavior (see e.g. step 3.b in the Single Unix v3 (POSIX 2001) specification. Why was cp designed this way? Because there are many cases where this behavior is desirable, for example preserving a file's ...


10

You may be encountering Access Based Enumeration. Basically, if your user account does not have read permission on a directory, it is hidden from view. As already mentioned, this is because you removed the users explicitly defined access and replaced it with a group, and the affected users logon tokens do not include the new group they are a member of. A ...


9

Well it's not really a flaw. This rule for handling permissions when moving files has been in place since at least beta 2 of NT3.1 (though obviously not inheritance as that was only added with Windows 2000). It's about as well known as any feature of Windows can be. I have a lot of sympathy for your view, as there can be few of us that haven't been burned by ...


9

apt-get install star man star star -acl -whatever -other -options -you -need Star is tar with support for extended POSIX headers, that is, the ability to store some extra data about a file in the tar file. The -acl option gets the ACLs; you need it for both archive creation and extraction.


9

First of all, use Set-Acl like this, as the directory path is the first positional argument: Set-Acl $directory $acl Second, you should create the user object with only one argument: $user = New-Object System.Security.Principal.NTAccount("$domain\\$username") UPDATE: Seems that it won't accept the "IIS APPPOOL\AppPoolName" as an NTAccount identifier. ...


9

If you need to restrict these users' access on this system, they cannot be administrators. Nothing that you've listed (RDP access, control over their applications) requires them to be full-blown administrators of the system. Assign just the permissions needed.


9

The Unix default permissions for a newly created file are 0666. The Unix default permissions for a newly created directory are 0777. If you do not want the default base permissions set an appropriate umask value. The only thing you can't easily do with umask is create a file which is by default executable (which, by simple common sense, is something you ...


9

Then you can't do it. You've rejected another protocol that permits authenticating the requestor (hcsteve's answer) and you've rejected a VPN which would have allowed TFTP to be tunneled through an authenticated service (Hopeless N00b.*'s answer), so you're stuck with stock TFTP. RFC 1350 makes it fairly clear, in section 1, that authentication is not an ...


8

Have a look in Group Policy for the setting "System objects: Default owner for objects created by members of the Administrators group". It's located under: Computer Configuration Windows Settings Security Settings Local Policies Security Options When this setting is enabled members of the "Administrators" group will have objects they create set ...


8

If you don't want to install another program, you can backup the ACLs separately: getfacl -R somedir > acls.txt This dumps all the ACLs from somedir into the file acls.txt. To restore, use: setfacl -R --set-file=acls.txt somedir


8

Yes, acl's can do this. Ensure your filesystem is mounted with acl. To check this, type mount. You sould see 'acl' listed among other permissions, e.g.: /dev/sda1 on / type ext4 (rw,errors=remount-ro,acl) If it's not mounted with acl, open up /etc/fstab, and add 'acl' to the list of options: # /etc/fstab: static file system information. # # <file ...


8

You want to use the Delegate Permissions option in Active Directory Users and Computers. You can apply the delegation to whatever OU you want, including the domain root. This will allow you to delegate whatever attribute-level permissions you want to whatever users/groups you define. These permissions apply like any other and respect inheritance.


8

The . at the end of the permissions is probably not relevant here. It indicates ACLs and/or SElinux attributes apply. See this question for more details. If the user ss cannot delete this directory it is probably because he does not have write permission on the parent dir of this backup dir. Add write permission for user ss to the parent directory of the ...


8

Here is Microsoft's statement regarding Universal Groups. Especially the bolded part pertains to you: Universal groups can be used anywhere in the same Windows forest. They are only available in a Native-mode enterprise. Universal groups may be an easier approach for some administrators because there are no intrinsic limitations on their use. Users ...


7

That approach isn't bad. As a rule never use individual users to add permissions- use a group. Groups can however be used across resources. Eg HR might have RW access to files while MANAGERS might have R. You can also set up Access Based Enumeration. Take a look at the following webcast: TechNet Webcast: Windows Server 2003 Administration Series (Part 4 ...


7

Most certainly you can do this natively in windows Server 2008. Have a read here: http://blog.stealthpuppy.com/windows/access-based-enumeration-in-windows-server


7

Try something along the lines of: access to attrs=userPassword by self write by anonymous auth by users none access to * by * read (Note that for security reasons you DON'T want everyone able to read the UserPassword attribute -- that would allow people to skim your shadow/encrypted passwords & run a crack program against them ...


7

Try adding ',acl' after noatime. Then reboot or just invoke mount -o remount /.


7

In ADUC, the Delegation of Control wizard will allow you to do this, using a custom task for delegation. Pick just the fields you want them to have Write access to.



Only top voted, non community-wiki answers of a minimum length are eligible