Tag Info

New answers tagged

1

In case someone has a similar problem, this is what I did. I hope it's the correct approach but I am not sure. The + in the permissions drwxrwxr-x+ indicates that there is an access control list in effect on the directory. I changed the permissions recursively for ACL as per below as well as included execution permission for the user. setfacl -Rm ...


-1

Enter top Then watch the httpd process. On the very left in the USER column it should say something like 'nobody' or 'www-userdata' or similar. Remember it. Then change to your home directory e.g. /home/myuser/public_html. Run cd /home/myuser/ Run chown -R nobody:nobody public_html (replace nobody:nobody if different user runs apache process) ...


0

ldapmodify is lying to you about the validity of your file. If you take the LDIF file you created and run ldapmodify -v -n -f <path/to/file.ldif> The output looks like this: add olcAccess: {1}to dn.subtree="ou=Users,dc=domain,dc=lan" attrs=sambaLMPassword,sambaNTPassword by self write by dn=sambaAdmin,dc=domain,dc=lan write by anonymous auth ...


0

This is my answer to use PHP scripts as squid external acl in pfsense: ln -s /usr/local/bin/php /usr/pbi/squid-amd64/local/bin/php ln -s /usr/local/lib/php /usr/pbi/squid-amd64/local/lib/php ln -s /usr/local/etc/php.ini /usr/pbi/squid-amd64/local/etc/php.ini


0

How about this approach: Keep original uploaded files in a separate directory, per user. This covers governance and delete permissions. In $share, everything is a link to the original files, and owner/admin ACLs are in place. In the end, every item in $share is a link back. Anything that isn't a link gets moved to the (uploader) owner's folder.


0

Hmm... how about chrooting to /special_folders_root/special_folder/./ to avoid problems with root-owned chrooted directories? See vsftpd's documentation (for example) for explanation about extraneous dot in the path. Unsure, if following will be useful, but: We have samba share with subdirs. Network MFUs putting the scanned documents inside specific subdirs ...


0

It's not possible in GUI, but should be with icacls, see Command-Line Reference. There, you can see how /grant works: Grants specified user access rights. Permissions replace previously granted explicit permissions. Without :r, permissions are added to any previously granted explicit permissions. As switch /t makes the command recursively, ...


0

You could use SetACL if you're not comfortable with PowerShell (as BigHomie and HopelessN00b have suggested). You should read the full documentation and test your command on a dummy location, but the syntax you'd use would be something like: setacl -on <PATH> -ot file -actn ace -ace "n:Administrators;p:full;i:so,sc;m:grant;w:dacl" -rec cont_obj ...


1

Use inotify or other watching mechanism of your choice to find and locate new files in the upload directory and move them into a new directory, for which the initial user has no permissions.


0

SELinux might be one way to solve it - associate unique type with all users that will have this "reduced ability". Set SELinux policy to allow file creation in this directory for those user types but not modification etc. In theory - should work. See Gentoo SELinux Tutorial, in particular pice about: allow auditd_t <type>:file { <permission> }; ...


-1

you can do this with SELinux, you can disallow "stat" on a file to certain types of users which should eliminate directory listing as well. Untested though.


0

The full scope of this problem is unclear as we do not know what's the usecase. However using SELinux labels one get achieve what you ask for. SELinux gives you some fine-grained controls over who does what and where. If number of users is "limited" and "known" - having specific contexts/labels associated with each one of them is not a big issue, then it is ...


0

One simple solution appears to be this. Consider the administrative user to be admin, and that our special directory is to be /tmp/special. mkdir /tmp/special chmod 1777 /tmp/special chown admin:admin /tmp/special ls -ld /tmp/special drwxrwxrwt 2 admin admin 4096 Apr 3 21:34 /tmp/special Any user can create/edit/delete their own files in /tmp/special. ...


0

Bindfs is one possible solution. I named my power admin user nradmin and here is the example: mkdir /uploads chmod 1777 /uploads mkdir /home/nradmin/manage-uploads bindfs -u nradmin -p ud+rwx /uploads /home/nradmin/manage-uploads Every file and directory in the mounted target is owned by nradmin. The -p ud+rwx makes every directory to be with permissions ...


0

Because you are NATing from G0/0 to G0/1 you cannot use an access-list to allow traffic. NAT acts as a firewall so you need to use a Port-Address Translation rule. For the single port, that would look like this: ip nat inside source static udp x.x.x.x 5060 interface g0/0 5060 The port range is a bit more tricky, as IOS doesn't usually deal with port ...


0

I'm not aware of a plugin that can already do this. 30 seconds on google didn't yield anything either. There's a category of plugins for similar purposes on Nagios Exchange, but nothing that matches exactly what you need. You'll probably have to write it yourself. A simple bash script to look at the output of getfacl /path/to/my_file and/or stat ...


1

I'd be inclined to solve with with sudo rather than with ACLs. (There's no explicit mention of NFS in the question so I'm going to assume that root_squash isn't an issue.) Start with your directory having permissions 1777 (sticky plus all read/write) as you suggested. Create this script with a filename such as /usr/local/bin/rmd. Amend the definition of ...



Top 50 recent answers are included