Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [access-control-list]

An access-list is a list of rules, usually held on network devices such as switches, routers or firewalls, that matches network traffic. The specific term 'access-list' is used in the context of Cisco devices, although the concept of an 'access list' is more generic.

0
votes
0answers
18 views

getcifsacl does not work with CIFS mount versions 2 or 3

When I mount CIFS share with vers=1.0 I can perform getcifsacl sucessfully. # mount -t cifs //example.com/Users/milo /mnt/cifs -o vers=1.0 # getcifsacl /mnt/cifs/file.png REVISION:0x1 CONTROL:0x8504 ...
1
vote
1answer
37 views

Windows file permissions - Admin permissions don't seem to work as expected / access denied

I have just inherited a server and I have an issue accessing some folders. I usually get this solved "in the end", usually by forcing a takeown command and then starting from scratch - but, it's ...
-1
votes
0answers
7 views

How to do a debung ip policy for a specific source? [on hold]

I would like to do a debug to see which PBR my PC is matching and the action that is being taking. With the debung ip policy I can see the action that is being taking for the next hope,but I would ...
0
votes
1answer
59 views

The dynamic ports are constantly changing, How do set them in the firewall? [closed]

I'd like to block unused ports on my server so I monitor the ports with CurrPorts and I understand some processes like lsass.exe have some dynamic ports e.g 49158,49976,... These ports might change ...
2
votes
0answers
20 views

Restricting user access to a subset of binaries

I checked rbash and chroot jail, which doesn't have permission to read /var/log. Scenario: ssh user should only able to cd to a directory and do less for files. eg: ssh user@server.com cd /var/...
-1
votes
2answers
53 views

How to enumerate permissions of users in active directory? [closed]

I am learning AD pentesting and I am looking for a way to enumerate the user's permissions. Note:- Here through permissions I am talking about those permissions which are found in the security tab. ...
0
votes
0answers
32 views

URL redirection and ACL conditions in Haproxy

I would like to check and compare the maxconn and conn_cur in haproxy. If the conn_cur value greater than maxconn, the url needs to be redirected. URL redirection is working, but the maxconn & ...
0
votes
0answers
479 views

Exact ACL permissions to this same data but for different group

I am preparing data migration from trusted domain to trustee domain. Data will be copy but no users or groups are to be migrated so I can't rely on SID history. Permissions need to be "translated". ...
0
votes
0answers
33 views

OpenLDAP ACL for group not working

I have an install of OpenLDAP which I have recently moved to be configured by olc. I'm setting up the ACL's but am having a trouble with setting admin access. I have the following rules I am using: ...
0
votes
1answer
43 views

Large Varnish VCL does not load

I'm using Varnish ACLs for blocking unwanted clients by IP and as the blocklist/ACL has grown the compile time of the VCL has increased a lot. The other day I added another 25K IPs to block and ...
1
vote
1answer
25 views

How do I exclude return traffic from my ACL?

I have this network topology. What I try to achieve is: Deny access from Network 172.28.224.0 to Network 172.28.226.208. But the other way around it should work. 172.28.226.208 should be allowed to ...
0
votes
1answer
17 views

How can I disallow access to a specific ip within a LAN?

My Network topology looks like this: PC1------- PC2-------Switch--------Router-PT PC3-------2960-24 PC4------- What I try to accomplish is: No PC is allowed to ping PC3, but PC3 is allowed to ping ...
-1
votes
1answer
48 views

How can I make an ACL list work within a LAN? [closed]

I added an ACL list to Router A and permission is working fine if the packet comes from another LAN. The problem is, when a Packet is sent within the LAN that is connected to Router A, the packet is ...
-1
votes
2answers
34 views

Possible for domain policy to prevent local Administrator from modifying file permissions?

I have been handed a new Server 2012 that is a member of the company domain. I am in the local server Administrators group. I do not have a domain account. When I opened up the permissions properties ...
3
votes
1answer
127 views

Trying to deploy Symfony on Ubuntu 18.04 LTS - setfacl not working?

Disclaimer: I already asked this on StackOverflow but it's kind of urgent and I'm getting no responses and I figure ServerFault might be the better place to post this anyways. If I get an answer on ...
0
votes
0answers
28 views

Configuring site folders in IIS for minimum privilege

In attempting to create web sites on a different drive I ran into some permission related issues and I can't seem to find any actual guidance on how to do the following tasks in IIS: Where does IIS ...
1
vote
1answer
40 views

OPENLDAP 2.4 , allow anonymous access only to get User Publickey

I'm trying to do the following : I have openldap 2.4.45 server (test) which contains users, groups like this : o=Example(dc=example,dc=com) ou=users uid=alice uid=bob PublicKey="...." ...
1
vote
2answers
288 views

Samba, Windows ACLs and unwanted executable bit

I setup Samba with ACL support on an Ubuntu 18.04 LTS server and I'm facing the following situation. Here's the smb.conf content: [global] # naming workgroup = WORKGROUP server string = %h ...
1
vote
0answers
19 views

EC2 - Windows Server - Not openning 41890 port

I have a client' EC2 Instance with Windows Server 2016 Datacenter OS, IIS 10.0 running an ASP Classic Web Site and an Elastic IP associated. Everything ok until there. The set up of the web server ...
0
votes
0answers
116 views

How to add ACL on OpenLDAP

I want to add an ACL for a sub organization on my OpenLDAP. This is their ACL documentation: https://www.openldap.org/doc/admin24/access-control.html I am using ldapmodify to update the ldap db on a ...
0
votes
0answers
22 views

Inheriting Permissions for New Files

I'm having trouble getting inherited permissions to work on an ext4 filesystem. In fstab I added the acl attribute, and when I try the following I expect the new files to get rwxrwx--- permissions, ...
0
votes
2answers
38 views

How to set up AWS Network Access Control List for SSH to private subnet

I'm doing a course on AWS. What I'm trying to do is set up a VPC with two Linux servers. I've set up the VPC with two subnets. I have put one server in each. The idea is that one subnet is public the ...
1
vote
0answers
13 views

Unix ACLs - After Applying, normal permissions are wrong [duplicate]

I have a problem when using ACLs I have one file -rw-r----- 1 syslog adm 0 Sep 5 17:53 postfix_exporter_input.log The permissions 0640 are correct and they need to stay like this. Now I want to ...
0
votes
2answers
223 views

Set Owner by Folder Name Recursivly Powershell

I have a persmissions problem, on our Fileserver, where the NTFS Owner was not copied correctly, these are Citrix UPM Profiles, I found a script, for this but it does not work recursivly: $Path = ...
0
votes
0answers
19 views

ASA same-security level (or now) and access lists

On ASA I got two interfaces with same security LAN, and LAN2. I want only specific traffic to pass from LAN to LAN2. Let say that I want to pass 10.0.0.0/12 but block 172.16/12. How to achive this? ...
0
votes
0answers
66 views

On Linux how can I allow subordinate subuid/subgids of a system user access to one of their folders?

For sandboxing purposes the subuid/subgid mechanism on Linux was developed and users can be allocated additional extra uids and gids for private sandboxing use. Is it possible to set access controls ...
1
vote
0answers
194 views

HAProxy ACL Not Working

I'm building a load balancer using HAProxy. I want to have a frontend with multiple backend, divided using path. For example: 172.20.20.10/tomcat1 using backend tomcat1 172.20.20.10/tomcat2 using ...
0
votes
2answers
172 views

Set ACL in OpenLDAP so that user can find its own entry from filtered subtree

I have a user directory in an openldap server under the base DN ou=users,dc=mydomain. The user entries are uid=user1,ou=users,dc=mydomain My current ACLs are: {5}to * by self write by dn="cn=admin,...
0
votes
0answers
234 views

How do I do time-based ACLs in Squid 3?

The relevant part of my squid.conf is this: acl youtube_domains dstdomain .youtube.com .googlevideo.com .ytimg.com # G* services authentication domain acl gLogin dstdomain accounts.youtube.com # ...
0
votes
0answers
32 views

AWS Web ACL rules and SNS Notifications

Is there any way that I can exclude SNS Notifications from ACL blocking rules? I have ACL on my DEV environment configured to block access for all users having different IPs that I specified. I have ...
0
votes
1answer
30 views

Windows Services Vulnerable to Tampering Mitigation

I am testing some software with Microsoft's Attack Surface Analyzer. I took a baseline and after installation scan of the software I am testing. When I create a report it shows that a certain service ...
0
votes
0answers
62 views

How to restrict outbound ssh username credential to current user only

Is there a method to disallow a user from changing their outbound ssh credentials? I.e. restrict ssh -l username ip.address or ssh username@ip.address Further clarification. Only allow the username ...
0
votes
2answers
156 views

Assign folders privilidges for App Pool Identity (CLI Only)

I have a site running on IIS 10 in the default app pool. I need to give permissions for it to read to a folder tree in a (Windows) docker container. How, using the CLI only, can I determine what ...
1
vote
0answers
26 views

Samba4 creates files as executable when parent directory has any default POSIX ACL

I have a Samba 4.5.12 file server running on Debian Stretch with a file share configured as follows: [test] path = /srv/test read only = no Inside that share there's a directory: /srv/test/...
0
votes
1answer
81 views

MongoDB Collection Level Access Control not working

I have to restrict few MongoDB users to specific collections with some specific action permissions(only Update collection). As per the docs it's possible. localhost:tmp username$ mongo MongoDB shell ...
0
votes
1answer
62 views

Linux; On the fly access control for flows

In a Linux host environment: Is there a way to check once per new flow (source ip, source port, dest ip, dest port)-tuple, or similar, if a flow is allowed to be established. The deny/allow should ...
1
vote
0answers
66 views

Include all hosts of a zone in ACL

I'm running bind9 as DNS server, and have one zone set up to allow dynamic updates (think of my private DynDNS). IP ranges of those "dynamic hosts" cannot be foreseen, let alone specific IPs. But I ...
0
votes
1answer
760 views

Haproxy ACL rule for a particular domain

In my Haproxy config I have few ACL rule set. My haproxy.config looks like, frontend incoming bind *:80 acl grow_mydomain hdr(host) grow.mydoamin.com use_backend grow_mydomain if ...
-1
votes
2answers
81 views

What prevents someone to use CACLS to modify any file? [closed]

I recently discovered the CACLS command, that allows someone to edit the ACL of a file. I saw it in a CTF write-up (hacking challenge) to get the root flag supposedly restricted to the Administrator: ...
0
votes
0answers
23 views

Squid Proxy blocking on wireless devices

I have setup a site proxy that is forced across the site and this works flawlessly for the wired PC's on the subnet 10.1.1.0/24 and blocks via NTLM authentication (SSO). The problem lies with the ...
1
vote
2answers
265 views

openldap group membership ACL

When I run a search eg. ldapsearch -h XX.XX.XX.XX -b 'dc=mycompany,dc=com' -D 'uid=lama,ou=people,mycompany,dc=com' -w YYYY I would like to see my groups membership and not to be allowed to see ...
0
votes
1answer
69 views

Force proxy for non domain computers

So I have had extremely bad results with bridged firewalls so have decided to create a standalone proxy, the pc's on the domain get the proxy by default and their internet access is then filtered. All ...
0
votes
0answers
26 views

Windows: replace one user's ACL by another user

I sometime need to migrate a workgroup computer to a domain computer, while preserving every settings for the user(s). Among other things I have to modify the ACLs into C:\Users\xxxx\: every ACL ...
0
votes
1answer
63 views

OpenLDAP: ACLs using sockname and DN?

In OpenLDAP (2.4.45, on FreeBSD), I'm trying to constrain the access of a DN to an attribute, by giving a DN access only when the connection is made via a socket; but without success. What I'm trying ...
0
votes
1answer
82 views

Let users see a folder in a Windows File Share, but not enter it

This has probably been asked elsewhere, but I can't find a question that meets the exact criterion we have. We have a Windows Server 2016 Standard system which runs fileshares. Inside one of the ...
0
votes
0answers
352 views

Is it possible to manage synology ACLs on the client machine?

We currently have a central server that hosts some shared folders, to be exported via NFS and/or samba within our facilities. In addition to regular posix file permissions, we use posix ACLs. Our new ...
0
votes
0answers
85 views

HAProxy read ACLs from database / webservice

Is there a way checking access permissions based on a url parameter (or any other readable data) and a database (or webservice) that knows if the parameter is valid? The usecase is the following: ...
0
votes
2answers
222 views

Permissions not inheriting to files and folders in Linux mint

We are using Linux mint with ext4 file system mounted with acl option, I want to set a folder such that anything created within it directories or files inherit default permissions and group = 775, I ...
1
vote
1answer
218 views

AWS Network ACLs Breaking SSH Connectivity

I'm trying to set up Network ACLs as a second security layer for production instances. It seems that every time I associate a non-default Network ACL to my private subnet it breaks all SSH ...
0
votes
0answers
20 views

How to relay domain-based from a set of servers in postfix?

How to combine a relay with client restrictions in Postfix? Situation: external World ---> server ---+---> Default target <--+ (known) | or ...