New answers tagged

0

$ cd /usr/lcoal/mysql/ $ ls -l $ sudo -R chown mysql:mysql data/ data/ is a directory under /usr/local/mysql/ which contains all the database. Now do mysql -u user -p password. You can access your database


1

You're likely running to issues with the AdminSDHolder process. Each Active Directory domain has an object called AdminSDHolder, which resides in the System container of the domain. The AdminSDHolder object has a unique Access Control List (ACL), which is used to control the permissions of security principals that are members of built-in privileged ...


0

No expert, but what you describe sounds like a USN rollback. Problem is that your DC is a development machine, so figuring out what went wrong at what time that causes regular USN rollbacks is cumbersome. You could start by reading this article and see if something applies to your environment and then take action from there.


2

Any user can execute ifconfig. The problem is that usually you want ifconfig to be executed with root permissions, so that you can temporarily change your system configuration. Changing the group of the binary (and having to play with setuid) is not the way to do this. Execute visudo and add the line %if ALL=(ALL) /sbin/ifconfig to the end of the file. ...


0

The easiest thing that springs into my mind is to create a different user for each customer: customer1, customer2, etc. and enable per-user directories in the Apache config: Include conf/extra/httpd-userdir.conf Then you can create each customer's site in their /home/customerx/public_html directory. After that, you simple give them FTP access to their ...


0

The most reasonable answer I got so far is that Windows does not have modification date attribute for directories. There is only a creation date. This issue can be really confusing when trying to change the directory's modification date with e.g. java.io.File#setLastModified method. Both under Linux and Windows this API works on local directories with ...


1

Or you simply assign a fixed port in the reserved port range and grant your application the rights to bind to that port. sudo setcap 'cap_net_bind_service=+ep' /usr/local/bin/application


0

If you have Selinux (not sure about AppArmor), you can most likely achieve this: Make sure that only the context of that specific application can listen to that port and then make sure that only your desired user can start that application.


2

Your combination of software is a bit unusual these days (i.e. pretty standard 10-20 years ago). I'm guessing what you are doing is using fetchmail to connect to a POP server, and then it passes the mail to procmail to deliver the mail into local directories. This approach has become unusual in part because there's not many servers now that support POP ...


4

I may be wrong, but I believe that sudoers also restricts parameters that can be passed to a command/script, not just the command itself. If you try to run your .sh without the parameter it will likely work e.g. sudo /bin/bash /var/www/my_bash_script.sh So, to tell sudoers to allow that script to be run with any parameters (by apache), you would need ...


0

You can use the following settings Cmnd_Alias SVNUP = /root/webhooks/svn_update.sh apache ALL=(ALL) NOPASSWD: SVNUP Create simple test script # cat test.sh #!/bin/bash set -u echo "Param1: $1" Make simple tests $ id alex uid=506(alex) gid=506(alex) groups=506(alex) $ cat /root/webhooks/test.sh cat: /root/webhooks/test.sh: Permission denied $ sudo ...


1

Everybody uses the same user log ins for their machine (WorkUser1) - so I cannot simply add the WorkUser1 account as having shared/owner access This is your problem which you must fix first: If you use a workgroup, you create user accounts with the same usernames and password combinations like on your local PCs and optionally create groups where those ...


0

You do this by having Active Directory. If you've got 30 computers and users, I'd say that's above the threshold where you'd want to, or be able to, manage them independently in any kind of effective way. Rob-d's solution will work, but only if you don't want any kind of accountability for those confidential files.


0

Create a new user on the server and give that user the access and not 'everybody' then pass around the credentials like currency EDIT - actually just for giggles goto start run //serverip/c$


0

Give this a try, you can have the issue even running as root, is not related to wich user you use. sudo /sbin/sysctl -p


0

Inheritance is enabled by default. You would approach a situation like that as following: Open the folder's Security Settings. Add the user to the list. By default Allow is checked for Read, List Folder Contents and Read & Execute. Click OK and close the window. Open the Security Settings for file C. The user should already be listed as the file ...


0

I stumbled across this one, too, and the proposed solution didn't work, since the database specific privileges wouldn't be moved as well. what I did: UPDATE mysql.user SET Host='%' WHERE Host='localhost' AND User='username'; UPDATE mysql.db SET Host='%' WHERE Host='localhost' AND User='username'; FLUSH PRIVILEGES;


0

Regarding the GPO issue, you say that Authenticated users are set to Read on all GPOs, have they also been given the Apply permission? both will need to set before the GPO applies. Make sure the users / computers are in the OU where you link the GPO or that you link the GPO to the domain level. SYSVOL is important for GPOS, it is where the Group Policy ...


0

As a matter of fact "Replicating Directory Changes" permission does not grant DCPROMO rights nor it is possible to use this permission to pull back hashed values of user's password. In order to gain access to user's password hashes it is necessary to grant "Replicate Directory Changes All". For more information see ...


0

1st of all, make the configuration easier to read and forget the upstream stuff. I am working for a longer time with uWSGI. I oftern had problems with the socket stuff (specially on python projects), but with PHP and uWSGI I get with sockets, suprisingly well. If you REALLY persist to make use of uWSGI you need 2 things! 1st a config.ini where all uWSGI ...


0

Turns out it works if I run the command and specify the location exactly: sudo /usr/local/bin/composer self-update


0

I was able to fix the problem myself. I rebooted the server. Then I restarted Nginx and uWSGI with sudo service nginx restart sudo service uwsgi restart Nginx restarted without a problem. However, uWSGI returned this error: /etc/init.d/uwsgi: line 73: /usr/share/uwsgi/init/do_command: No such file or directory I tried to switch to the directory. ...


0

It turns out I had to give permissions with chown -R on the directories in which I was saving files.


0

I think you need to review the permissions over files and directory. You can try to set www-data as owner of files and directory.


0

If it is a permissions issue, it may be that the permissions are too lenient. I know that Sendmail will refuse to accept certain configuration files if they are writable; I would not be surprised to find the same is true of Apache. Check that Apache's user does not have permission to write the .conf file.


0

It looks like uWSGI service is listening on a Unix socket w/different absolute path (due to chdir() call). You can use lsof | grep "/path/to/socket" to find an absolute path of a Unix socket being listened on. I guess it is /path/to/chdir/path/to/socket.


0

A stupid question: do you have a hardlink to /etc/apache2/conf-available/serve-cgi-bin.conf in the directory /etc/apache2/conf-enabled ? Edit: In order to create a link, what you do is, in a command prompt, change to the /etc/apache2/conf-enabled directory, and type ln /etc/apache2/conf-available/serve-cgi-bin.conf serve-cgi-bin.conf You may have to sudo ...


0

EDIT: this actually didn't work (yet). The mounted share now shows with the correct UID/GID, but that user cannot access the files or directories. I'm getting an input/output error. This isn't ideal, but technically works. I reconfigured NFS Sharing on the shared folder in Server2012 to allow anon access with specified UID/GID. The share is only ...


1

I got the same problem on Windows 2008 R2, I was trying to set ownership to Administrators, so after getting the same error, I check the users on the domain, and found out that Administrators is NOT a username or group for the domain, but for the PC/SERVER, so, what I did is instead of ICACLS name /setowner <computername>\adminuser simply did ...


0

To allow lighttpd to execute files, enable the SELinux bool http_execmem. Then change the file type to allow lighttpd to be executed: chcon system_u:object_r:httpd_exec_t:s0 [file]. Keep that change persistent in the kernel by using semanage fcontext -a -t httpd_exec_t [file].


0

this feels like an selinux issue with the files related to passwd. If something has changed the passwd files when selinux was not active it can have the wrong labels and selinux will deny access to the file. (You can probably confirm if selinux is on by examining the kickstart file) Follow the instructions from here to boot into rescue mode. After you gain ...


1

you are in single user mode so you don't specify users make sure your root filesystem is mounted in read/write mount -o remount,rw / then passwd


2

Try sudo 'echo "127.0.0.1 db-local.internal" >> /etc/hosts' The way you written it, you will try to append the output of sudo to /etc/hosts before the sudo becomes active.


1

I cannot find the source back, but using setgid to solve this issue for bare git repositories, which I assume is your case, is deprecated, and can cause issues in some cases. Git can take care of all this via the core.sharedRepository flag. I had the same issue and solved it as follows: Assuming repogroup is your group, and you have cd to the repo ...


1

The biggest risk of abuse (IMO) this right has is that it can be used to impersonate a DCPROMO. It appears to be possible to use this permission to pull back hashed values of the password, which is just a short step away from all kinds of attacks. There's a really good example that demonstrates some misuse of the Replicating Directory Changes permission ...


1

This set owner of folder or file to group Everyone - works on windows 7 and above: icacls "full path of file with file extension" /setowner "Everyone" /T /C


0

I meet the same Question like yours. and i try to do below you should know the 'role' of http execute. Just like your 'apache' create your ssh key sudo -u apache ssh-keygen -t rsa and the path of the key will be show in the cmd screen. go to the path and cat id_rsa.pub, copy your key and post to the github or gitlab finally, because your server dont know ...


2

I agree with Nixphoe. Don't use Deny permissions. Use Allow permissions. Create a security group for all users that should have access, add the users to that group, and add the security group to the ACL of the folder in question.


4

It sounds like you have a good strategy with how you described it with out the Deny permission. If you setup an allow full access for Administrators and for the Accounting Group, anyone outside of that would already not have access to that folder. Generally Microsoft says to stay away from Deny permissions, since if one user is a member of an allowed group, ...


0

When I run this it appears to be pulling the server name and printer names but is erroring on running the command -- \[print server name][printer name] Invoke-Command : Cannot evaluate parameter 'ConnectionUri' because its argument is specified as a script block and ther e is no input. A script block cannot be evaluated without input. At ...


0

After ignoring this problem for a week, it now suddenly works... I don't know what has caused it, but it works... I have tried the suggestion from this blog, but modified it to include AW as rights. Then I tested it again, this time only with my older deny rules (overwriting the new ones completely), that also worked. Finally I used the very first settings ...


1

You'll probably have to do it in two sweeps. First, to take ownership - icacls.exe /setowner <username> /t /c /q Second, to reset the ACL's back to the inherited defaults - icacls.exe /reset /t /c /q


1

While the idea sounds good, the way you are formulating it, indicates that you have to less knowledge to implement your ideas on a production level. What you ask for, is a Linux crash course about basic user/group facts and additional mechanisms such as SELinux. Imho I think you should get someone for the job to be done. Update: 1.) Organize ...


0

As the comment said, selinux and auditd, also psacct to see processes run by users, also possibly even puppet or something to enforce configuration. If unauthorized changes are made then puppet would change configuration back to the official good state.


1

There is no such user as www-date and it should be www-data. Secondly, there are a few directory/file ownership and permissions you need to set, for joomla to work. You can have a look at a how-to here: https://help.ubuntu.com/community/Joomla Here are the relevant part for you: Next the files need to be moved and the ownership changed cd .. sudo ...



Top 50 recent answers are included