Hot answers tagged

4

It sounds like you have a good strategy with how you described it with out the Deny permission. If you setup an allow full access for Administrators and for the Accounting Group, anyone outside of that would already not have access to that folder. Generally Microsoft says to stay away from Deny permissions, since if one user is a member of an allowed group, ...


4

I may be wrong, but I believe that sudoers also restricts parameters that can be passed to a command/script, not just the command itself. If you try to run your .sh without the parameter it will likely work e.g. sudo /bin/bash /var/www/my_bash_script.sh So, to tell sudoers to allow that script to be run with any parameters (by apache), you would need ...


2

Your combination of software is a bit unusual these days (i.e. pretty standard 10-20 years ago). I'm guessing what you are doing is using fetchmail to connect to a POP server, and then it passes the mail to procmail to deliver the mail into local directories. This approach has become unusual in part because there's not many servers now that support POP ...


2

Any user can execute ifconfig. The problem is that usually you want ifconfig to be executed with root permissions, so that you can temporarily change your system configuration. Changing the group of the binary (and having to play with setuid) is not the way to do this. Execute visudo and add the line %if ALL=(ALL) /sbin/ifconfig to the end of the file. ...


2

I agree with Nixphoe. Don't use Deny permissions. Use Allow permissions. Create a security group for all users that should have access, add the users to that group, and add the security group to the ACL of the folder in question.


2

Try sudo 'echo "127.0.0.1 db-local.internal" >> /etc/hosts' The way you written it, you will try to append the output of sudo to /etc/hosts before the sudo becomes active.


1

you are in single user mode so you don't specify users make sure your root filesystem is mounted in read/write mount -o remount,rw / then passwd


1

I cannot find the source back, but using setgid to solve this issue for bare git repositories, which I assume is your case, is deprecated, and can cause issues in some cases. Git can take care of all this via the core.sharedRepository flag. I had the same issue and solved it as follows: Assuming repogroup is your group, and you have cd to the repo ...


1

The biggest risk of abuse (IMO) this right has is that it can be used to impersonate a DCPROMO. It appears to be possible to use this permission to pull back hashed values of the password, which is just a short step away from all kinds of attacks. There's a really good example that demonstrates some misuse of the Replicating Directory Changes permission ...


1

This set owner of folder or file to group Everyone - works on windows 7 and above: icacls "full path of file with file extension" /setowner "Everyone" /T /C


1

I got the same problem on Windows 2008 R2, I was trying to set ownership to Administrators, so after getting the same error, I check the users on the domain, and found out that Administrators is NOT a username or group for the domain, but for the PC/SERVER, so, what I did is instead of ICACLS name /setowner <computername>\adminuser simply did ...


1

While the idea sounds good, the way you are formulating it, indicates that you have to less knowledge to implement your ideas on a production level. What you ask for, is a Linux crash course about basic user/group facts and additional mechanisms such as SELinux. Imho I think you should get someone for the job to be done. Update: 1.) Organize ...


1

You'll probably have to do it in two sweeps. First, to take ownership - icacls.exe /setowner <username> /t /c /q Second, to reset the ACL's back to the inherited defaults - icacls.exe /reset /t /c /q


1

You're likely running to issues with the AdminSDHolder process. Each Active Directory domain has an object called AdminSDHolder, which resides in the System container of the domain. The AdminSDHolder object has a unique Access Control List (ACL), which is used to control the permissions of security principals that are members of built-in privileged ...


1

Everybody uses the same user log ins for their machine (WorkUser1) - so I cannot simply add the WorkUser1 account as having shared/owner access This is your problem which you must fix first: If you use a workgroup, you create user accounts with the same usernames and password combinations like on your local PCs and optionally create groups where those ...


1

Or you simply assign a fixed port in the reserved port range and grant your application the rights to bind to that port. sudo setcap 'cap_net_bind_service=+ep' /usr/local/bin/application



Only top voted, non community-wiki answers of a minimum length are eligible