Tag Info

Hot answers tagged

17

subinacl is a Windows sysadmin's power tool for doing everything to do with ownership and ACLs. You can change the ownership to anyone other than just you (you can't do this with the GUI). subinacl /file test.txt /setowner=domain\foo This lets you set the permission to any user you like, without having to be an administrator (as I believe takeown.exe ...


16

You're looking for "TAKEOWN.EXE", which was first in Windows Server 2003 as a standard component, and I believe a resource-kit item prior. See: http://technet.microsoft.com/en-us/library/cc738152(WS.10).aspx


13

It would not be convenient for you if chmod() didn't have this behaviour. It would be highly inconvenient, because things that people traditionally expect to work on Unixes would break. This behaviour serves you well, did you but know it. It's a shame that IEEE 1003.1e never became a standard and was withdrawn in 1998. In practice, fourteen years on, it's ...


12

If you're talking about a disk that doesn't contain a Windows installation, just use the "TAKEOWN" and "ICACLS" utilities: TAKEOWN /f "X:\" /r /d y ICACLS "X:\" /reset /T Then you can reset the ACLs to whatever you want. If it's a disk with a Windows 2000, XP, or Server 2003 operating system installed (don't know about Vista on this one) you could try ...


11

You would make TFTP access over the internet secure the same way you'd make access to anything over the internet secure. By going through a VPN. Cisco's IP phones can be set up to use a VPN, and someone even put together a handy doc around common issues with this setup that you might want to take a look at.


10

My approach is to not use file/directory level file permissions; use file share level permissions, and set the whole server filesystem data drive to Everyone Full Control (which becomes moot). Over the years (10+), I have found that NTFS permissions are more complex and leads to more errors. If the permissions are set wrong, or the inheritance gets broken, ...


10

You may be encountering Access Based Enumeration. Basically, if your user account does not have read permission on a directory, it is hidden from view. As already mentioned, this is because you removed the users explicitly defined access and replaced it with a group, and the affected users logon tokens do not include the new group they are a member of. A ...


9

apt-get install star man star star -acl -whatever -other -options -you -need Star is tar with support for extended POSIX headers, that is, the ability to store some extra data about a file in the tar file. The -acl option gets the ACLs; you need it for both archive creation and extraction.


9

Then you can't do it. You've rejected another protocol that permits authenticating the requestor (hcsteve's answer) and you've rejected a VPN which would have allowed TFTP to be tunneled through an authenticated service (Hopeless N00b.*'s answer), so you're stuck with stock TFTP. RFC 1350 makes it fairly clear, in section 1, that authentication is not an ...


9

If you need to restrict these users' access on this system, they cannot be administrators. Nothing that you've listed (RDP access, control over their applications) requires them to be full-blown administrators of the system. Assign just the permissions needed.


8

Here is Microsoft's statement regarding Universal Groups. Especially the bolded part pertains to you: Universal groups can be used anywhere in the same Windows forest. They are only available in a Native-mode enterprise. Universal groups may be an easier approach for some administrators because there are no intrinsic limitations on their use. Users ...


8

The Unix default permissions for a newly created file are 0666. The Unix default permissions for a newly created directory are 0777. If you do not want the default base permissions set an appropriate umask value. The only thing you can't easily do with umask is create a file which is by default executable (which, by simple common sense, is something you ...


8

This sounds like the default mount behavior is not allowing ACLs on the filesystem. getfacl will report the normal filesystem permissions without error, but setfacl is unable to operate because the filesystem is mounted without the ACL option. You can add this in /etc/fstab or by modifying your filesystem options. Assuming you have the /home filesystem ...


8

You want to use the Delegate Permissions option in Active Directory Users and Computers. You can apply the delegation to whatever OU you want, including the domain root. This will allow you to delegate whatever attribute-level permissions you want to whatever users/groups you define. These permissions apply like any other and respect inheritance.


8

Use getfacl to get the default permissions from the directory and then pipe the result into setfacl to apply it. Something like this should work: getfacl -d <directory> | setfacl -R --set-file=- <directory>


7

c:\windows\system32\icacls c:\folder /grant "domain\user":(OI)(CI)M c:\windows\system32\icacls c:\folder /grant "everyone":(OI)(CI)M c:\windows\system32\icacls c:\folder /grant "Authenticated Users":(OI)(CI)M Open command window and type c:\windows\system32\icacls /?


7

The . at the end of the permissions is probably not relevant here. It indicates ACLs and/or SElinux attributes apply. See this question for more details. If the user ss cannot delete this directory it is probably because he does not have write permission on the parent dir of this backup dir. Add write permission for user ss to the parent directory of the ...


7

Most certainly you can do this natively in windows Server 2008. Have a read here: http://blog.stealthpuppy.com/windows/access-based-enumeration-in-windows-server


7

Well it's not really a flaw. This rule for handling permissions when moving files has been in place since at least beta 2 of NT3.1 (though obviously not inheritance as that was only added with Windows 2000). It's about as well known as any feature of Windows can be. I have a lot of sympathy for your view, as there can be few of us that haven't been burned by ...


7

Have a look in Group Policy for the setting "System objects: Default owner for objects created by members of the Administrators group". It's located under: Computer Configuration Windows Settings Security Settings Local Policies Security Options When this setting is enabled members of the "Administrators" group will have objects they create set ...


7

You can script this with icacls or set-acl. As an aside, this is why you use security groups in ACLs and not individual users.


6

That approach isn't bad. As a rule never use individual users to add permissions- use a group. Groups can however be used across resources. Eg HR might have RW access to files while MANAGERS might have R. You can also set up Access Based Enumeration. Take a look at the following webcast: TechNet Webcast: Windows Server 2003 Administration Series (Part 4 ...


6

My approach is to not use file/directory level file permissions; use file share level permissions, and set the whole server filesystem data drive to Everyone Full Control (which becomes moot). Over the years (10+), I have found that NTFS permissions are more complex and leads to more errors. If the permissions are set wrong, or the inheritance gets broken, ...


6

In addition to installing the packages and hving a kernel that supports it you must mount the filesystem with the acl option. ACLs are supported in most of the popular filesystems like ext3, ext2, jfs, and reiser. Here are a couple links that may help you get started. man acl, setfacl, getfacl Using ACLs with Fedora Core POSIX Access Control Lists on ...


6

It's allowing all IP traffic from the 165.138.236.0/24 subnet to the 165.139.2.0/24 subnet. It's probably being used as a match list on a VPN tunnel or to prevent NAT on tunneled traffic. The number, 110, is just an arbitrary number to identify the access list. "Permit" indicates that it will permit the traffic (as opposed to deny). "IP" indicates to match ...


6

It sounds like you need Access-based enumeration, which is a fancy way of saying "if you don't have access to it, you can't see it". See here.


6

If you don't want to install another program, you can backup the ACLs separately: getfacl -R somedir > acls.txt This dumps all the ACLs from somedir into the file acls.txt. To restore, use: setfacl -R --set-file=acls.txt somedir


6

If you pass -A, it will try its hardest.


6

In ADUC, the Delegation of Control wizard will allow you to do this, using a custom task for delegation. Pick just the fields you want them to have Write access to.


6

Try adding ',acl' after noatime. Then reboot or just invoke mount -o remount /.



Only top voted, non community-wiki answers of a minimum length are eligible