Questions tagged [access-control-list]

An access-list is a list of rules, usually held on network devices such as switches, routers or firewalls, that matches network traffic. The specific term 'access-list' is used in the context of Cisco devices, although the concept of an 'access list' is more generic.

Filter by
Sorted by
Tagged with
0 votes
1 answer
52 views

How to chown a directory on a mounted samba share?

I have a linux client mounting a samba share with the following fstab entry: //<serverip>/<nameofshare> /home/user -o nofail,x-systemd.device-timeout=15s,vers=3.11,user=<sambauser>,...
ift-436t's user avatar
0 votes
1 answer
32 views

Permission error when setting global-acls in dovecot

Dovecot's ACL plugin instructions indicate that for global acl's, we're supposed to create an acl file in /etc/dovecot/. and to include the access control list items in it. So I've created /etc/...
oucil's user avatar
  • 599
0 votes
1 answer
87 views

how to block outgoing traffic in ec2 without blocking ssh

I have an EC2 with has public subnet and traffic is flowing through internet gateway. Now, i have an requirement like I have to block all outgoing traffic in EC2. I have tried to restrict the traffic ...
Ravi Teja RVN's user avatar
0 votes
0 answers
32 views

Default ACL to backup another user's home directory

I have written a script to backup our servers. It runs as the "backup" user on multiple Oracle Linux 7/8/9 systems and has to backup other users homes directories, among other things, using ...
Edzilla's user avatar
  • 11
0 votes
0 answers
55 views

OpenLDAP peername.ip ACL not working for subnets

I have the following ACL stored in my /etc/openldap/slapd.conf file: access to dn.regex="^([^,]+,)?ou=(groups|addressbook),dc=ldap$" by dn.exact="cn=directory,ou=users,dc=ldap&...
Matthew Knill's user avatar
0 votes
0 answers
54 views

ACL permissions on Chroot directory

I have the Named service in a Chroot environment, I need a user to be able to modify the live files of the path /var/named/chroot/etc and I do not want to give full permissions with sudo, I have used ...
fah81's user avatar
  • 1
0 votes
1 answer
1k views

nginx, only allow certain IPs to access a URL prefix

In nginx, how can I restrict access to a certain URL prefix by IP address. i.e. “only these IPs are allowed to access $URL?”. I have a location … { directive, but it looks like the nginx allow & ...
Amandasaurus's user avatar
  • 32.2k
0 votes
0 answers
118 views

How to restrict ssh access only to users within multiple groups?

I would like to know how to allow ssh access to users who are in multiple groups.  For example, in general, if the user is part of the group shell then they may access a number of servers.  However, I ...
AGI-Chandler's user avatar
0 votes
1 answer
16 views

Aruba Access list redundant entries

I am using Aruba switches, and the configuration that I have been given to review has redundant entries in the ACL per below: 14 permit tcp 10.255.252.0/255.255.255.0 any eq ssh 15 permit tcp 10.255....
shneidr518's user avatar
0 votes
2 answers
100 views

Avoid Windows folder listing with ACL

Is it possible through ACL to prevent a local user account to "dir" the windows folder ? I tried with "Advanced security settings", but cannot change a thing...
Stef's user avatar
  • 592
1 vote
1 answer
81 views

Why does `getfacl` output for basic permissions differ from `ls -al`?

I have a directory that shows r-x group permissions in ls -al output: mburr@burrvm-mint20:~$ ls -ald /media/mburr drwxr-x---+ 2 root root 4.0K Oct 6 17:11 /media/mburr The ls -al output also shows ...
Michael Burr's user avatar
0 votes
0 answers
85 views

Samba Linux server MacOS client ACLs

I'm trying to enable ACLs for a Linux Server using a MacOS client. My configuration is as follows: [global] vfs objects = acl_xattr map acl inherit = yes store dos attributes = ...
Vic Nightfall's user avatar
2 votes
1 answer
53 views

squid: Unable to allow 10.10.11.0/24 but 10.10.11.0/23 works

Im unable to make a working acl with CIDR over `/23` (squid 5.7 on Debian) For example i got this config (working): acl servers src 10.10.11.0/23 http_access allow servers ... http_access deny all ...
mylan's user avatar
  • 51
0 votes
0 answers
143 views

How to drop arp requests trying to resolve a particular IP address at a logical switch port?

I am using l2gateway port to attach a physical L2 segment to a logical network. But both the logical network and the physical segment has one common IP, say 10.0.0.1. I want to prevent the traffic ...
Amogh M K's user avatar
0 votes
0 answers
654 views

Samba Windows ACL not working

I want to configure Samba to manage Windows ACL and manage them from Windows via the security tab. The Samba server is standalone and not part of an AD tree; i already followed various offical and ...
Plokko's user avatar
  • 101
0 votes
0 answers
88 views

Linux Debian ACL, is default mask overriden by something in FTP?

I have an Linux Debain 10 server running an web project. The project (parent) folder is as follows: ls -la: drwxrwxr--+ 7 some_user some_group 4096 Jul 21 11:01 . getfacl: # file: . # owner: ...
Jiří Žák's user avatar
2 votes
1 answer
118 views

Restrict User Access to Mailbox based upon Location

We need to restrict user access to certain mailboxes (Outlook/MAPI) based upon the user's location within our site. All mailboxes exist within the same on-premise Exchange server - all mailbox access ...
SK5910's user avatar
  • 21
0 votes
1 answer
127 views

NT Security Descriptor

In active directory an object have several permissions on many objects. how to view permissions of particular object? i am asking like for eg user Kavin have read permissions on some folder, full ...
Sandy Santhosh's user avatar
0 votes
0 answers
33 views

If there is no local user does my ACL need to have an OWNER@ ACE?

I'm setting up nfs4 ACLs on directories for users that are not local Linux users. I can use chown 23524356:474688 dir and that works. But what does the OWNER@ ACE represent? Is it an alias to user ...
mr.zog's user avatar
  • 931
0 votes
1 answer
181 views

If the default nfs4 ACL 'deny access' why do default ACLs frequently contain A::EVERYONE@:rxtncy?

Is there an alias for deny that I could use? So far I have not had any luck removing the EVERYONE@ ACE. Maybe that a bad idea. You tell me. I was just able to nfs4_editfacl and change the A::EVERYONE@...
mr.zog's user avatar
  • 931
1 vote
1 answer
200 views

How does one set ownership of a directory using nfs4_setfacl?

Or put another way, when I see @OWNER in a nfs4 ACL does this @OWNER refer to a local Unix/Linux user? I need to make an AD user (without a corresponding local account) the owner of a directory on a ...
mr.zog's user avatar
  • 931
6 votes
2 answers
1k views

How NTFS folder access is checked in a Active Directory domain?

I understand that both NTFS folders and AD objects use security descriptors and DACL’s to check user/process access MS Learn - How access check works However, how does the access check resolves ACE’s ...
Grasshopper's user avatar
0 votes
1 answer
208 views

Unable to set ACL for user and groups in rootless containers

i'm running a Debian container in rootless mode and can't set an acl for groups and users besides my own group and user (at least it seems so). I started a bash in a container ( runc --root /var/slurm/...
csmj's user avatar
  • 11
0 votes
0 answers
91 views

Restrict Apache forward proxy to a remote url set

Is there a robust way to restrict Apache forward proxy to a set of remote URLs? Now I can see the only solution with multiple identical <Proxy "..."> blocks as: <Proxy "http://...
Veniamin's user avatar
  • 863
1 vote
2 answers
551 views

Netcat successfully sends UDP packet despite all UDP traffic being blocked via Network ACL

I've created an AWS instance in the default VPC and I've blocked all UDP traffic in the Network ACLs. Here's how my outbound rules look: Rule number Type Protocol Port range Destination Allow/Deny ...
dodov's user avatar
  • 151
2 votes
0 answers
74 views

How to make an ACI for users that are `roleOccupant` in an `organizationalRole`?

In OpenLDAP I had an access rule using users that are roleOccupants in a specific organizationalRole like this (the example is just a fragment): olcAccess: to * by group/organizationalRole/...
U. Windl's user avatar
  • 383
0 votes
0 answers
349 views

Why do all users still have full access in my samba server after i have set limited permissions?

I have a debian 11 server running samba and is hosting a share of a drive that's mounted in fstab. I have added "acl" to the fstab and installed acl in the samba config. To be clear: my end ...
Moth's user avatar
  • 1
0 votes
1 answer
387 views

Apache2 how to limit a subdirectory to local network only

I have an Apache2 (2.4.41) server running on Ubuntu 20.04 that serves a couple of Flask web apps differentiated by sub-directory to the internet over HTTPS and a No-IP DDNS (https://mysite.noip.com/...
James Watson's user avatar
0 votes
1 answer
118 views

Set timeout in Apache ACL

for a page in an Apache webserver under ACL, is there a way to force apache to prompt again for credentials after a fixed timeout? For example, user tries to access the url, he fills the credentials ...
solonely's user avatar
1 vote
0 answers
170 views

Automating NFSv3 File/Folder permissions in Windows

I'm a Windows/MSSQL DBA who is inheriting a quirky system through no fault of my own, and had a quick question. Background I have an Azure NFSv3 volume that is being exported to a Windows Server 2019 ...
Vocoder's user avatar
  • 111
0 votes
0 answers
144 views

Adding a group to a folder structure "basing" on another existing group's rights

thanks for reading this wall of text anyways. My scenario: i have a mega-folder called Projects. Every subfolder is a different project. So, for example, i have Projects\N123456 - New Coca Cola. Now, ...
Claudio Ghirardi's user avatar
0 votes
1 answer
533 views

Squid Proxy always 403

I have been trying to setup Squid proxy for a good 2 hours now, I dont want any authorizations or any blacklists. I just want all requests to get accepted. I have already tried http_access allow all, ...
1FriendlyDoge's user avatar
1 vote
0 answers
53 views

How are Linux ACLs different for files versus sockets

With umask 0022, using default ACL entries default:user::rwx, default:group::rwx, default:mask::rwx and default:other::rwx for a directory, files created with touch (e.g.) have a mask of rw, and ...
Larry's user avatar
  • 11
-3 votes
1 answer
211 views

Want to try to block a particular ip address

Network Diagram: Subnet-coloured Network Diagram: I have the following subnets below. I want to let traffics from the green subnet to go everywhere but the blue subnet should not be able to get ...
Cerolina's user avatar
0 votes
1 answer
47 views

On linux, what are the recommended extension for access control lists ACL?

I have read many HowTo's, e-books, internet pages, etc, about the use of ACLs in programs like iptables, squid, etc. on linux In the examples, they use the following file extensions: file.lst file.acl ...
acgbox's user avatar
  • 398
1 vote
1 answer
1k views

HAProxy deny HTTP request on path_beg not matching

I have a HAProxy node in front of a Keycloak node. I want to only expose the API needed to serve the users (not the Admin panel) I have the following on my haproxy.cfg frontend block frontend haproxy-...
desertSniper87's user avatar
2 votes
1 answer
1k views

rsync "Operation not supported" errors for ACL on ZFS

While migrating our file server to a ZFS file system with rsync -avxHAXS ... I get errors like: rsync: [generator] set_acl: sys_acl_set_file(path/to/file, ACL_TYPE_ACCESS): Operation not supported (95)...
Roger Dueck's user avatar
0 votes
1 answer
74 views

NGINX Conf Feedback Request: Limiting specific API endpoints to $remote_addr(s);

I was using this as a source of information to draw on: https://www.nginx.com/blog/deploying-nginx-plus-as-an-api-gateway-part-2-protecting-backend-services/#access-control My server is running a ...
Austin Foss's user avatar
0 votes
1 answer
322 views

OpenLDAP ACLs not cooperating

I had a simple ACL in place on my server that was working fine. I've decided to set up SSSD to authenticate user logins via LDAP, so I need to give more access to the SSSD bind account. In the process ...
miken32's user avatar
  • 964
1 vote
0 answers
666 views

setfacl operation not supported ubuntu wsl

i want to set acl certain file in /var/www/html/index.htm inside Ubuntu WSL 20.04 (win 10) using : $ sudo setfacl -m u:wira:rwx sshd_config setfacl: sshd_config: Operation not supported after ...
Lezir Opav's user avatar
1 vote
1 answer
123 views

Docker Squid not enforcing time acl in configuration

I have a squid running in docker, which is not enforcing the time ACLs that are defined in the configuration. I'me using https://hub.docker.com/r/ubuntu/squid running on arm This is my configuration ...
BANJOSA's user avatar
  • 398
1 vote
1 answer
762 views

Can SSSD authenticate via LDAP with anonymous binding either forbidden in ACLs and with 'olcRequires: authc' enforced?

I manage a LAN with a list of users accessing their NFS-shared homes while being auhtenticated via NIS/YP (CentOS/Fedora-based clients and servers). I'm in the painful process of migrating out of NIS/...
Francesco's user avatar
0 votes
1 answer
237 views

I have load balancer configured on Haproxy. Can load balancer redirect traffic from port 1 backend to port 2 backend if port 1 is busy this moment

In ha-proxy I separated my traffic to two frontend ports and created two backends. Port-1 traffic is directed both backend and port 2 traffic is directed two backend-2. I want to create a smart load ...
Fox Chasin's user avatar
1 vote
2 answers
1k views

How to allow user to run only specific binaries

I'm adding user logviewer with /sbin/nologin/ and to my system. My custom service is running eg. sudo -u logviewer less --follow-name /var/log/messages. But still there are ways to run other command ...
Iluvatar's user avatar
  • 121
0 votes
1 answer
566 views

Routing different subnets on a switch

My setup: I have a layer 2 managed 7-port Ethernet switch (KSZ9897). The switch features dot1Q (VLAN) and dot1X (ACL). ACL is advertised to be able to filter on layer 3 (IP) and 4 (TCP/UDP). Is it ...
Lunde's user avatar
  • 31
1 vote
1 answer
1k views

Filtering traffic between ports on an ethernet switch

I would like to know if there is a standard way of limiting traffic between ports on a managed Ethernet switch? I have a 7-port Ethernet switch (microchip - KSZ9897), which is a layer 2 switch, but ...
Lunde's user avatar
  • 31
1 vote
1 answer
1k views

certbot creates a challenge owned by root:root and permissions 640 and apache can't access it - custom ACLs applied on parent directory

On my server I have special permissions that I set on my public_html folder. First the sticky bit chmod g+s /home/domain.com/public_html Also default group permissions. setfacl -m 'default:group::rwX'...
Mikey A. Leonetti's user avatar
2 votes
1 answer
2k views

Mosquitto ACL default all users read to a topic

I am trying to create a default access for all users unless specified in the ACL file. I have allow_anonymous set to false. However, if a user is in the password file, I want that user to be able to ...
Blaine Sherman's user avatar
2 votes
2 answers
728 views

ACL settings works when using ssh but not with scp command

I have setup an Arch Linux machine with a user 'archie' with a primary group 'users' as: useradd -m -g users archie Whenever archie creates a file in his ~/shared directory I want the group users to ...
Jörgen's user avatar
  • 121
3 votes
2 answers
2k views

how to disable/remove nfs4 acl, and back to original linux access control?

I have add nfs4 acl for a directory in nfs client, but can not use "chown/chgrp" after add nfs4 acl, now I want to give up nfs4 acl, and back to original linux simple access control, how to ?...
Levin's user avatar
  • 141

1
2 3 4 5
16