Tag Info

Hot answers tagged

22

Assuming all your Domain Controllers are Windows Server 2003 or later you can do this with native Active Directory's dynamic objects functionality without any scripting. Let's say that a user account, "Bob", needs to be in the "Accounting" group for 24 hours. Create a "Bob in Accounting 24 Hours" group and specify an entry-TTL for 24 hours (the duration ...


17

There's two parts to this question: when to add a new FILEGROUP, and when to add a new FILE in a filegroup. First let's talk theory: Mark's right about the primary reason being performance. The secondary reason is disaster recovery. With SQL Server 2005 and newer, you can do filegroup restores. When disaster strikes, you can restore just your primary ...


17

When adding a user to a new group, the user must log out and log back in for it to take affect. While a reboot will accomplish that, it should not be required.


15

I was looking for a solution, came across this post, and then later found one! I'd thought I'd actually offer a solution so others can benefit. Logging in and out is so 1995. Taken from: https://arkaitzj.wordpress.com/2010/03/08/linux-add-user-to-a-group-without-logout/ So if you needed to get permissions for the cdrom group you just added your user to: ...


14

Michael's answer was the closest, but I wanted to be sure, so I installed a fresh copy of Ubuntu Server 8.04.2 (Hardy Heron) in a virtual machine to get the official group list. The installation was a basic one with no specific server roles selected. These are the first groups, assigned by default, to the first user: $USERNAME (e.g. wayne) (primary group ...


14

The basic rule of thumb is to separate files onto different volumes to avoid contention, however the anmount of performance gain you get varies wildly by I/O subsystem and workload. For instance, multiple files on a single physical spindle is going to suck as far as performance goes, but the same arrangement with the volume being on a SAN LUN with several ...


14

"System preferences" -> "Accounts" -> "+" (as if you were adding new account) -> Under "New account" select "Group" -> Type in group name -> "Create group"


13

Besides AuthLDAPSubGroupDepth, that is available only in apache 2.4, it is possible, when using Microsoft AD LDAP, to do authorization using nested groups by using LDAP_MATCHING_RULE_IN_CHAIN matching rule. This is much faster than searching subgroups on the client, because it is done on the DC server with less queries over network. Require ldap-filter ...


13

FreeIPA is probably what you're looking for. It's to Linux what Active Directory is to Windows. (It can also talk to AD if you have a heterogeneous environment, but shouldn't be used to manage Windows machines directly. Use AD for that.) Red Hat's documentation (they call it Identity Management) is very thorough and easy to follow, and should be mostly ...


11

Gimme the codes! powers, activate! $Groups = Get-ADGroup -Properties * -Filter * -SearchBase "OU=Groups,DC=corp,DC=ourcompany,DC=Com" Foreach($G In $Groups) { Write-Host $G.Name Write-Host "-------------" $G.Members } The point being, just take your time and break it out into steps. I know that it's fun to try to get everything and the ...


10

This is how this works: When you login via FTP/SSH and upload files, they are created with your permissions. Probably your webroot is world writable (0777), that is insecure - every user in system can write something there. PHP runs with different user privileges (They are specified in PHP-FPM config, not nginx config), and as directory is world writable, ...


10

You need to set AuthLDAPSubGroupDepth to make this work. The integer you provide here specifies the maximum sub-group nesting depth that will be evaluated before the user search is discontinued. Add this to your config: AuthLDAPSubGroupDepth 1 More Info: here and here.


8

When you added yourself to the group, did you log out of your workstation and log back in? Security Group membership is a component of the access token granted to your user ID at logon and changing group membership requires a log out and log in order to get a new access token that reflects the new membership.


8

It wouldn't be recommended to alter the permissions in IIS. You can control Activesync on a user by user basis in the properties of the user account in ADUC. Select the Exchange Features tab and disable the User Intitiated Synchronization feature.


8

This can be done through PowerShell $DNOfManager=dsquery user -o dn -name "Testing Tester" $GroupList=dsquery group DC=ad,dc=example,dc=local -limit 600 Foreach ($group in $grouplist) { set-adgroup -Identity $Group -ManagedBy $DNOfManager add-adpermission -Identity $Group -user $DNOfManager -AccessRights ReadProperty, WriteProperty -Properties ...


8

Your understanding is dead on. You could potentially maintain a number of different default address lists based on a user's access level (only letting them have a given group in their list if they're authorized), but that's incredibly ugly and would be nearly impossible to maintain. One way to get rid of the expandability would be to use Dynamic ...


8

You can't delete the 'NT Authority\Authenticated Users' (SID S-1-5-11) group. You also cannot view this group in AD Users and Computers, which would explain why you can't see it using that tool. It's not a "real" security group the way that "DOMAIN\Domain Admins" is, for instance. The membership of "Authenticated Users" is dynamically generated and ...


7

I'd almost certainly suggest using /usr/local. Globally accessible user scripts can be placed in /usr/local/bin. Small amounts of associated data could also go into bin. Or you may wish to separate out the data into /usr/local/var or /usr/local/share. By doing this you'll be quite sure that anyone FHS familar will be able to locate them pretty quickly ...


7

Adding a user to a group does not effect currently logged in users. In the case of a daemon, you need to restart it for new groups to be applied. Furthermore, restarting the daemon using an option in the daemon itself will not work as that will inherit the current environment. The easiest way to get it to work is to fully stop the daemon and start it ...


7

pulegium's answer is generally preferred, but if you want a command-line way: sudo dseditgroup -o create mysql (note that creating a group named mysql is probably a bad idea -- there's already a group named _mysql, with mysql as an alias.)


7

find /home -not -group test or find /home ! -group test The exclamation inverts the match. From man find: ! expr True if expr is false. This character will also usually need -not expr Same as ! expr, but not POSIX compliant. If you want the group it does belong to in the output: find /home ! -group test -printf "%p:%g\n" ./lots/573:root ...


7

You don't. There has to be a trust between the computer and the domain (aka joining the computer to the domain) to be able to authenticate domain users locally. Now for something practical: You have two options 1) create a local user with the same username and password as the domain user, and add that local user to the local group. 2) Join the machine ...


7

The domain admins group, and the AD builtin\Adminstrators group (not the local admin group on clients) effectively grant users in them the same rights, however there are some subtle differences: builtin\administrators is a domain local group, where as domain admins is a global group Domain admins are a memeber of builtin\administrators Domain admins are a ...


7

Easiest way to do it would be to set the directory's group to the group you want, and then set the sticky group bit on the directory with chmod g+s.


7

That's good enough if you have a reasonable password policy. If people can have a password of 1, that's probably going to be a problem. You've rate limited brute forcing the password to 1 password every 2 minutes. At that rate guessing a 7 character, all numbers password would take 19 years of straight hacking on average... and that's a pretty crappy ...


7

Ummm, seems Active Directory would be exactly what you need. Assuming you already own licenses for Windows Server, the cost will be a whopping $0. Update After hearing you describe your needs further, what you really need is a filesystem permissions auditing and management system, not really user and group management. It's quite unlikely that you'll find ...


7

This isn't possible. When you log on, you receive a token reflecting your group membership, among other things. The only way to refresh this token is to log in.


7

What you are seeing is normal and expected behaviour. The x bit is required on a directory to enter it, search through it, or execute a program in it. As you are trying to cd into the directory then without the x bit being set you can't. When you set the permissions to 744, your user world who is the owner of the directory then has full control and as you ...


7

Assuming the jumpbox is a linux box, iptables can usefully be used on the OUTPUT chain to restrict which group members can connect to which servers. Something like iptables -A OUTPUT --gid-owner project1 -p tcp --dport 22 -d ip.of.project1.com -j ACCEPT iptables -A OUTPUT --gid-owner project1 -j REJECT iptables -A OUTPUT --gid-owner project2 -p tcp --dport ...


7

There is no standard requiring any interoperability meaning of this groups. Traditionally the adm group is used to give a user access to some sort of system log files. See e.g. ls -l /var/log. The sys group normally intended to give a user some kind of administration rights. E.g. archlinux use this group for cups administration. Other distributions behave ...



Only top voted, non community-wiki answers of a minimum length are eligible