Questions tagged [access-control-list]
An access-list is a list of rules, usually held on network devices such as switches, routers or firewalls, that matches network traffic. The specific term 'access-list' is used in the context of Cisco devices, although the concept of an 'access list' is more generic.
778
questions
0
votes
1
answer
52
views
How to chown a directory on a mounted samba share?
I have a linux client mounting a samba share with the following fstab entry:
//<serverip>/<nameofshare> /home/user -o nofail,x-systemd.device-timeout=15s,vers=3.11,user=<sambauser>,...
0
votes
1
answer
32
views
Permission error when setting global-acls in dovecot
Dovecot's ACL plugin instructions indicate that for global acl's, we're supposed to create an acl file in /etc/dovecot/. and to include the access control list items in it. So I've created /etc/...
0
votes
1
answer
87
views
how to block outgoing traffic in ec2 without blocking ssh
I have an EC2 with has public subnet and traffic is flowing through internet gateway.
Now, i have an requirement like I have to block all outgoing traffic in EC2.
I have tried to restrict the traffic ...
0
votes
0
answers
32
views
Default ACL to backup another user's home directory
I have written a script to backup our servers.
It runs as the "backup" user on multiple Oracle Linux 7/8/9 systems and has to backup other users homes directories, among other things, using ...
0
votes
0
answers
55
views
OpenLDAP peername.ip ACL not working for subnets
I have the following ACL stored in my /etc/openldap/slapd.conf file:
access to dn.regex="^([^,]+,)?ou=(groups|addressbook),dc=ldap$"
by dn.exact="cn=directory,ou=users,dc=ldap&...
0
votes
0
answers
54
views
ACL permissions on Chroot directory
I have the Named service in a Chroot environment, I need a user to be able to modify the live files of the path /var/named/chroot/etc and I do not want to give full permissions with sudo, I have used ...
0
votes
1
answer
1k
views
nginx, only allow certain IPs to access a URL prefix
In nginx, how can I restrict access to a certain URL prefix by IP address. i.e. “only these IPs are allowed to access $URL?”.
I have a location … { directive, but it looks like the nginx allow & ...
0
votes
0
answers
118
views
How to restrict ssh access only to users within multiple groups?
I would like to know how to allow ssh access to users who are in multiple groups. For example, in general, if the user is part of the group shell then they may access a number of servers. However, I ...
0
votes
1
answer
16
views
Aruba Access list redundant entries
I am using Aruba switches, and the configuration that I have been given to review has redundant entries in the ACL per below:
14 permit tcp 10.255.252.0/255.255.255.0 any eq ssh
15 permit tcp 10.255....
0
votes
2
answers
100
views
Avoid Windows folder listing with ACL
Is it possible through ACL to prevent a local user account to "dir" the windows folder ?
I tried with "Advanced security settings", but cannot change a thing...
1
vote
1
answer
81
views
Why does `getfacl` output for basic permissions differ from `ls -al`?
I have a directory that shows r-x group permissions in ls -al output:
mburr@burrvm-mint20:~$ ls -ald /media/mburr
drwxr-x---+ 2 root root 4.0K Oct 6 17:11 /media/mburr
The ls -al output also shows ...
0
votes
0
answers
85
views
Samba Linux server MacOS client ACLs
I'm trying to enable ACLs for a Linux Server using a MacOS client.
My configuration is as follows:
[global]
vfs objects = acl_xattr
map acl inherit = yes
store dos attributes = ...
2
votes
1
answer
53
views
squid: Unable to allow 10.10.11.0/24 but 10.10.11.0/23 works
Im unable to make a working acl with CIDR over `/23` (squid 5.7 on Debian)
For example i got this config (working):
acl servers src 10.10.11.0/23
http_access allow servers
...
http_access deny all
...
0
votes
0
answers
143
views
How to drop arp requests trying to resolve a particular IP address at a logical switch port?
I am using l2gateway port to attach a physical L2 segment to a logical network. But both the logical network and the physical segment has one common IP, say 10.0.0.1. I want to prevent the traffic ...
0
votes
0
answers
654
views
Samba Windows ACL not working
I want to configure Samba to manage Windows ACL and manage them from Windows via the security tab.
The Samba server is standalone and not part of an AD tree; i already followed various offical and ...
0
votes
0
answers
88
views
Linux Debian ACL, is default mask overriden by something in FTP?
I have an Linux Debain 10 server running an web project.
The project (parent) folder is as follows:
ls -la:
drwxrwxr--+ 7 some_user some_group 4096 Jul 21 11:01 .
getfacl:
# file: .
# owner: ...
2
votes
1
answer
118
views
Restrict User Access to Mailbox based upon Location
We need to restrict user access to certain mailboxes (Outlook/MAPI) based upon the user's location within our site. All mailboxes exist within the same on-premise Exchange server - all mailbox access ...
0
votes
1
answer
127
views
NT Security Descriptor
In active directory an object have several permissions on many objects.
how to view permissions of particular object?
i am asking like for eg user Kavin have read permissions on some folder, full ...
0
votes
0
answers
33
views
If there is no local user does my ACL need to have an OWNER@ ACE?
I'm setting up nfs4 ACLs on directories for users that are not local Linux users. I can use chown 23524356:474688 dir and that works. But what does the OWNER@ ACE represent? Is it an alias to user ...
0
votes
1
answer
181
views
If the default nfs4 ACL 'deny access' why do default ACLs frequently contain A::EVERYONE@:rxtncy?
Is there an alias for deny that I could use? So far I have not had any luck removing the EVERYONE@ ACE. Maybe that a bad idea. You tell me.
I was just able to nfs4_editfacl and change the A::EVERYONE@...
1
vote
1
answer
200
views
How does one set ownership of a directory using nfs4_setfacl?
Or put another way, when I see @OWNER in a nfs4 ACL does this @OWNER refer to a local Unix/Linux user?
I need to make an AD user (without a corresponding local account) the owner of a directory on a ...
6
votes
2
answers
1k
views
How NTFS folder access is checked in a Active Directory domain?
I understand that both NTFS folders and AD objects use security descriptors and DACL’s to check user/process access
MS Learn - How access check works
However, how does the access check resolves ACE’s ...
0
votes
1
answer
208
views
Unable to set ACL for user and groups in rootless containers
i'm running a Debian container in rootless mode and can't set an acl for groups and users besides my own group and user (at least it seems so). I started a bash in a container ( runc --root /var/slurm/...
0
votes
0
answers
91
views
Restrict Apache forward proxy to a remote url set
Is there a robust way to restrict Apache forward proxy to a set of remote URLs?
Now I can see the only solution with multiple identical <Proxy "..."> blocks as:
<Proxy "http://...
1
vote
2
answers
551
views
Netcat successfully sends UDP packet despite all UDP traffic being blocked via Network ACL
I've created an AWS instance in the default VPC and I've blocked all UDP traffic in the Network ACLs. Here's how my outbound rules look:
Rule number
Type
Protocol
Port range
Destination
Allow/Deny
...
2
votes
0
answers
74
views
How to make an ACI for users that are `roleOccupant` in an `organizationalRole`?
In OpenLDAP I had an access rule using users that are roleOccupants in a specific organizationalRole like this (the example is just a fragment):
olcAccess: to * by group/organizationalRole/...
0
votes
0
answers
349
views
Why do all users still have full access in my samba server after i have set limited permissions?
I have a debian 11 server running samba and is hosting a share of a drive that's mounted in fstab. I have added "acl" to the fstab and installed acl in the samba config.
To be clear: my end ...
0
votes
1
answer
387
views
Apache2 how to limit a subdirectory to local network only
I have an Apache2 (2.4.41) server running on Ubuntu 20.04 that serves a couple of Flask web apps differentiated by sub-directory to the internet over HTTPS and a No-IP DDNS (https://mysite.noip.com/...
0
votes
1
answer
118
views
Set timeout in Apache ACL
for a page in an Apache webserver under ACL, is there a way to force apache to prompt again for credentials after a fixed timeout?
For example, user tries to access the url, he fills the credentials ...
1
vote
0
answers
170
views
Automating NFSv3 File/Folder permissions in Windows
I'm a Windows/MSSQL DBA who is inheriting a quirky system through no fault of my own, and had a quick question.
Background
I have an Azure NFSv3 volume that is being exported to a Windows Server 2019 ...
0
votes
0
answers
144
views
Adding a group to a folder structure "basing" on another existing group's rights
thanks for reading this wall of text anyways.
My scenario:
i have a mega-folder called Projects. Every subfolder is a different project. So, for example, i have Projects\N123456 - New Coca Cola.
Now, ...
0
votes
1
answer
533
views
Squid Proxy always 403
I have been trying to setup Squid proxy for a good 2 hours now, I dont want any authorizations or any blacklists. I just want all requests to get accepted. I have already tried http_access allow all, ...
1
vote
0
answers
53
views
How are Linux ACLs different for files versus sockets
With umask 0022, using default ACL entries default:user::rwx, default:group::rwx, default:mask::rwx and default:other::rwx for a directory, files created with touch (e.g.) have a mask of rw, and ...
-3
votes
1
answer
211
views
Want to try to block a particular ip address
Network Diagram:
Subnet-coloured Network Diagram:
I have the following subnets below. I want to let traffics from the green subnet to go everywhere but the blue subnet should not be able to get ...
0
votes
1
answer
47
views
On linux, what are the recommended extension for access control lists ACL?
I have read many HowTo's, e-books, internet pages, etc, about the use of ACLs in programs like iptables, squid, etc. on linux
In the examples, they use the following file extensions:
file.lst
file.acl
...
1
vote
1
answer
1k
views
HAProxy deny HTTP request on path_beg not matching
I have a HAProxy node in front of a Keycloak node. I want to only expose the API needed to serve the users (not the Admin panel) I have the following on my haproxy.cfg
frontend block
frontend haproxy-...
2
votes
1
answer
1k
views
rsync "Operation not supported" errors for ACL on ZFS
While migrating our file server to a ZFS file system with rsync -avxHAXS ... I get errors like:
rsync: [generator] set_acl: sys_acl_set_file(path/to/file, ACL_TYPE_ACCESS): Operation not supported (95)...
0
votes
1
answer
74
views
NGINX Conf Feedback Request: Limiting specific API endpoints to $remote_addr(s);
I was using this as a source of information to draw on: https://www.nginx.com/blog/deploying-nginx-plus-as-an-api-gateway-part-2-protecting-backend-services/#access-control
My server is running a ...
0
votes
1
answer
322
views
OpenLDAP ACLs not cooperating
I had a simple ACL in place on my server that was working fine. I've decided to set up SSSD to authenticate user logins via LDAP, so I need to give more access to the SSSD bind account. In the process ...
1
vote
0
answers
666
views
setfacl operation not supported ubuntu wsl
i want to set acl certain file in /var/www/html/index.htm inside Ubuntu WSL 20.04 (win 10) using :
$ sudo setfacl -m u:wira:rwx sshd_config
setfacl: sshd_config: Operation not supported
after ...
1
vote
1
answer
123
views
Docker Squid not enforcing time acl in configuration
I have a squid running in docker, which is not enforcing the time ACLs that are defined in the configuration. I'me using https://hub.docker.com/r/ubuntu/squid running on arm
This is my configuration ...
1
vote
1
answer
762
views
Can SSSD authenticate via LDAP with anonymous binding either forbidden in ACLs and with 'olcRequires: authc' enforced?
I manage a LAN with a list of users accessing their NFS-shared homes while being auhtenticated via NIS/YP (CentOS/Fedora-based clients and servers).
I'm in the painful process of migrating out of NIS/...
0
votes
1
answer
237
views
I have load balancer configured on Haproxy. Can load balancer redirect traffic from port 1 backend to port 2 backend if port 1 is busy this moment
In ha-proxy I separated my traffic to two frontend ports and created two backends. Port-1 traffic is directed both backend and port 2 traffic is directed two backend-2. I want to create a smart load ...
1
vote
2
answers
1k
views
How to allow user to run only specific binaries
I'm adding user logviewer with /sbin/nologin/ and to my system.
My custom service is running eg. sudo -u logviewer less --follow-name /var/log/messages.
But still there are ways to run other command ...
0
votes
1
answer
566
views
Routing different subnets on a switch
My setup:
I have a layer 2 managed 7-port Ethernet switch (KSZ9897). The switch features dot1Q (VLAN) and dot1X (ACL). ACL is advertised to be able to filter on layer 3 (IP) and 4 (TCP/UDP).
Is it ...
1
vote
1
answer
1k
views
Filtering traffic between ports on an ethernet switch
I would like to know if there is a standard way of limiting traffic between ports on a managed Ethernet switch? I have a 7-port Ethernet switch (microchip - KSZ9897), which is a layer 2 switch, but ...
1
vote
1
answer
1k
views
certbot creates a challenge owned by root:root and permissions 640 and apache can't access it - custom ACLs applied on parent directory
On my server I have special permissions that I set on my public_html folder.
First the sticky bit
chmod g+s /home/domain.com/public_html
Also default group permissions.
setfacl -m 'default:group::rwX'...
2
votes
1
answer
2k
views
Mosquitto ACL default all users read to a topic
I am trying to create a default access for all users unless specified in the ACL file.
I have allow_anonymous set to false. However, if a user is in the password file, I want that user to be able to ...
2
votes
2
answers
728
views
ACL settings works when using ssh but not with scp command
I have setup an Arch Linux machine with a user 'archie' with a primary group 'users' as:
useradd -m -g users archie
Whenever archie creates a file in his ~/shared directory I want the group users to ...
3
votes
2
answers
2k
views
how to disable/remove nfs4 acl, and back to original linux access control?
I have add nfs4 acl for a directory in nfs client, but can not use "chown/chgrp" after add nfs4 acl, now I want to give up nfs4 acl, and back to original linux simple access control, how to ?...