Questions tagged [access-control-list]
An access-list is a list of rules, usually held on network devices such as switches, routers or firewalls, that matches network traffic. The specific term 'access-list' is used in the context of Cisco devices, although the concept of an 'access list' is more generic.
769
questions
0
votes
0
answers
15
views
If there is no local user does my ACL need to have an OWNER@ ACE?
I'm setting up nfs4 ACLs on directories for users that are not local Linux users. I can use chown 23524356:474688 dir and that works. But what does the OWNER@ ACE represent? Is it an alias to user ...
- 911
0
votes
0
answers
22
views
If the default nfs4 ACL 'deny access' why do default ACLs frequently contain A::EVERYONE@:rxtncy?
Is there an alias for deny that I could use? So far I have not had any luck removing the EVERYONE@ ACE. Maybe that a bad idea. You tell me.
I was just able to nfs4_editfacl and change the A::EVERYONE@...
- 911
1
vote
1
answer
49
views
How does one set ownership of a directory using nfs4_setfacl?
Or put another way, when I see @OWNER in a nfs4 ACL does this @OWNER refer to a local Unix/Linux user?
I need to make an AD user (without a corresponding local account) the owner of a directory on a ...
- 911
6
votes
2
answers
1k
views
How NTFS folder access is checked in a Active Directory domain?
I understand that both NTFS folders and AD objects use security descriptors and DACL’s to check user/process access
MS Learn - How access check works
However, how does the access check resolves ACE’s ...
- 163
0
votes
1
answer
55
views
Unable to set ACL for user and groups in rootless containers
i'm running a Debian container in rootless mode and can't set an acl for groups and users besides my own group and user (at least it seems so). I started a bash in a container ( runc --root /var/slurm/...
- 11
0
votes
0
answers
59
views
Restrict Apache forward proxy to a remote url set
Is there a robust way to restrict Apache forward proxy to a set of remote URLs?
Now I can see the only solution with multiple identical <Proxy "..."> blocks as:
<Proxy "http://...
- 853
1
vote
2
answers
96
views
Netcat successfully sends UDP packet despite all UDP traffic being blocked via Network ACL
I've created an AWS instance in the default VPC and I've blocked all UDP traffic in the Network ACLs. Here's how my outbound rules look:
Rule number
Type
Protocol
Port range
Destination
Allow/Deny
...
- 131
0
votes
0
answers
36
views
Setting ACL on OpenLDAP server
I did setup OpenLDAP server, but I need to implement ACL. I'm not linux admin and I'm not even sure if what I'm trying to achieve is possible.
I have 3 groups. These has users which are posixAccount ...
- 3
2
votes
0
answers
15
views
How to make an ACI for users that are `roleOccupant` in an `organizationalRole`?
In OpenLDAP I had an access rule using users that are roleOccupants in a specific organizationalRole like this (the example is just a fragment):
olcAccess: to * by group/organizationalRole/...
- 366
0
votes
0
answers
66
views
Understanding default permissions in 389-DS
Importing an LDIF from an OpenLDAP server and examining the ACIs found, I don't really understand how default permissions are established:
I only found these two ACIs (LDIF unfolded):
dn: oid=1.3.6.1....
- 366
0
votes
0
answers
127
views
Why do all users still have full access in my samba server after i have set limited permissions?
I have a debian 11 server running samba and is hosting a share of a drive that's mounted in fstab. I have added "acl" to the fstab and installed acl in the samba config.
To be clear: my end ...
- 1
0
votes
1
answer
77
views
Apache2 how to limit a subdirectory to local network only
I have an Apache2 (2.4.41) server running on Ubuntu 20.04 that serves a couple of Flask web apps differentiated by sub-directory to the internet over HTTPS and a No-IP DDNS (https://mysite.noip.com/...
0
votes
0
answers
69
views
Adding Multiple IP addresses in Source field in ACL of EC2 while configuring inbound rule
Why can't we add multiple IP addresses to deny access from them in the source field in NACL of EC2 while configuring inbound rule ?
What is the solution in this case in order to block a list of IP ...
0
votes
1
answer
56
views
Set timeout in Apache ACL
for a page in an Apache webserver under ACL, is there a way to force apache to prompt again for credentials after a fixed timeout?
For example, user tries to access the url, he fills the credentials ...
- 11
1
vote
0
answers
110
views
Automating NFSv3 File/Folder permissions in Windows
I'm a Windows/MSSQL DBA who is inheriting a quirky system through no fault of my own, and had a quick question.
Background
I have an Azure NFSv3 volume that is being exported to a Windows Server 2019 ...
- 111
0
votes
0
answers
91
views
ACL (Access Control List) not working in RHEL 9
I'm creating some ACLs in my RHEL 9 laboratory under learning purposes. But I faced the following problem.
As user1 I've created a file named "aclfile" under /tmp and created an ACL so ...
0
votes
0
answers
97
views
Adding a group to a folder structure "basing" on another existing group's rights
thanks for reading this wall of text anyways.
My scenario:
i have a mega-folder called Projects. Every subfolder is a different project. So, for example, i have Projects\N123456 - New Coca Cola.
Now, ...
0
votes
0
answers
51
views
Assign an AD Group Read only Permission to Multiple User Home Drive Folders using CSV list
I'm trying to put together a script to perform the following task:
First to add an AD Security Group named "ADMigration" and assign it (Read access) to a large list of User Home Drives (...
- 1
0
votes
0
answers
231
views
Giving execute permission on folder with ACL makes files executable, too
I have a folder, owned by the "website user" foo, that will host a site:
$ sudo mkdir foo
$ sudo chown -R foo:foo
$ sudo chmod -R u=rwX,g=rX,o= foo
$ sudo chmod -R g+s foo
$ ls -la
drwxr-s--...
- 161
0
votes
1
answer
168
views
Squid Proxy always 403
I have been trying to setup Squid proxy for a good 2 hours now, I dont want any authorizations or any blacklists. I just want all requests to get accepted. I have already tried http_access allow all, ...
1
vote
0
answers
37
views
How are Linux ACLs different for files versus sockets
With umask 0022, using default ACL entries default:user::rwx, default:group::rwx, default:mask::rwx and default:other::rwx for a directory, files created with touch (e.g.) have a mask of rw, and ...
- 11
-3
votes
1
answer
102
views
Want to try to block a particular ip address
Network Diagram:
Subnet-coloured Network Diagram:
I have the following subnets below. I want to let traffics from the green subnet to go everywhere but the blue subnet should not be able to get ...
- 13
0
votes
1
answer
42
views
On linux, what are the recommended extension for access control lists ACL?
I have read many HowTo's, e-books, internet pages, etc, about the use of ACLs in programs like iptables, squid, etc. on linux
In the examples, they use the following file extensions:
file.lst
file.acl
...
- 366
1
vote
1
answer
387
views
HAProxy deny HTTP request on path_beg not matching
I have a HAProxy node in front of a Keycloak node. I want to only expose the API needed to serve the users (not the Admin panel) I have the following on my haproxy.cfg
frontend block
frontend haproxy-...
- 113
1
vote
1
answer
409
views
rsync "Operation not supported" errors for ACL on ZFS
While migrating our file server to a ZFS file system with rsync -avxHAXS ... I get errors like:
rsync: [generator] set_acl: sys_acl_set_file(path/to/file, ACL_TYPE_ACCESS): Operation not supported (95)...
- 121
0
votes
1
answer
29
views
NGINX Conf Feedback Request: Limiting specific API endpoints to $remote_addr(s);
I was using this as a source of information to draw on: https://www.nginx.com/blog/deploying-nginx-plus-as-an-api-gateway-part-2-protecting-backend-services/#access-control
My server is running a ...
0
votes
0
answers
237
views
Can someone explain this ACLs and umask over NFSv3 behaviour?
I have ACLs on a dir exported by NFSv3:
$ getfacl t1
# file: t1
# owner: root
# group: some_group
# flags: -s-
user::rwx
group::rwx
other::---
default:user::rwx
default:group::rwx
default:mask::rwx
...
- 305
0
votes
1
answer
157
views
OpenLDAP ACLs not cooperating
I had a simple ACL in place on my server that was working fine. I've decided to set up SSSD to authenticate user logins via LDAP, so I need to give more access to the SSSD bind account. In the process ...
- 912
1
vote
0
answers
349
views
setfacl operation not supported ubuntu wsl
i want to set acl certain file in /var/www/html/index.htm inside Ubuntu WSL 20.04 (win 10) using :
$ sudo setfacl -m u:wira:rwx sshd_config
setfacl: sshd_config: Operation not supported
after ...
- 111
1
vote
1
answer
89
views
Docker Squid not enforcing time acl in configuration
I have a squid running in docker, which is not enforcing the time ACLs that are defined in the configuration. I'me using https://hub.docker.com/r/ubuntu/squid running on arm
This is my configuration ...
- 350
0
votes
0
answers
18
views
CORS with Auth module in Apache2
I am triying to set up a data server that restrict the access to the public but allows access from a host or domain, but at the same time I need to enable CORS, this is what I tried in my virtualhost ...
0
votes
0
answers
39
views
IP-based auth server to use with Nginx Subrequest auth
I am planning to implement Nginx Subrequest Authentication as described on https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-subrequest-authentication/ to enforce an IP-based ...
1
vote
1
answer
395
views
Can SSSD authenticate via LDAP with anonymous binding either forbidden in ACLs and with 'olcRequires: authc' enforced?
I manage a LAN with a list of users accessing their NFS-shared homes while being auhtenticated via NIS/YP (CentOS/Fedora-based clients and servers).
I'm in the painful process of migrating out of NIS/...
- 45
0
votes
1
answer
188
views
I have load balancer configured on Haproxy. Can load balancer redirect traffic from port 1 backend to port 2 backend if port 1 is busy this moment
In ha-proxy I separated my traffic to two frontend ports and created two backends. Port-1 traffic is directed both backend and port 2 traffic is directed two backend-2. I want to create a smart load ...
1
vote
2
answers
923
views
How to allow user to run only specific binaries
I'm adding user logviewer with /sbin/nologin/ and to my system.
My custom service is running eg. sudo -u logviewer less --follow-name /var/log/messages.
But still there are ways to run other command ...
- 121
0
votes
1
answer
139
views
Routing different subnets on a switch
My setup:
I have a layer 2 managed 7-port Ethernet switch (KSZ9897). The switch features dot1Q (VLAN) and dot1X (ACL). ACL is advertised to be able to filter on layer 3 (IP) and 4 (TCP/UDP).
Is it ...
- 31
1
vote
1
answer
475
views
Filtering traffic between ports on an ethernet switch
I would like to know if there is a standard way of limiting traffic between ports on a managed Ethernet switch? I have a 7-port Ethernet switch (microchip - KSZ9897), which is a layer 2 switch, but ...
- 31
1
vote
1
answer
595
views
certbot creates a challenge owned by root:root and permissions 640 and apache can't access it - custom ACLs applied on parent directory
On my server I have special permissions that I set on my public_html folder.
First the sticky bit
chmod g+s /home/domain.com/public_html
Also default group permissions.
setfacl -m 'default:group::rwX'...
2
votes
1
answer
1k
views
Mosquitto ACL default all users read to a topic
I am trying to create a default access for all users unless specified in the ACL file.
I have allow_anonymous set to false. However, if a user is in the password file, I want that user to be able to ...
1
vote
2
answers
467
views
ACL settings works when using ssh but not with scp command
I have setup an Arch Linux machine with a user 'archie' with a primary group 'users' as:
useradd -m -g users archie
Whenever archie creates a file in his ~/shared directory I want the group users to ...
- 111
1
vote
1
answer
1k
views
how to disable/remove nfs4 acl, and back to original linux access control?
I have add nfs4 acl for a directory in nfs client, but can not use "chown/chgrp" after add nfs4 acl, now I want to give up nfs4 acl, and back to original linux simple access control, how to ?...
- 121
0
votes
0
answers
940
views
Access denied to folder even though Domain Admins have Full Control
I'm setting up a testing environment for permissions and I'm trying to understand what's going on here.
I have a Windows Server 2016 where my admin account used for testing is both a member of the ...
- 113
1
vote
1
answer
32
views
VLAN Inner Talking
I kinda forgot about CISCO in general, it had been quite a while since I last touched packet tracer. Now I'm on the PRE-deployment phase of a network at work. Long story short.
-I made 2 VLAN on CISCO ...
- 11
0
votes
1
answer
75
views
What is best practice for managing login / sudo accounts on multiple systems, with multiple users, on a ship?
I want to preface this by saying I'm not a sysadmin by trade, I've fallen into the jack-of-all-IT-trades in a team of instrumentation engineers.
My organisation has traditionally used the same ...
- 11
1
vote
1
answer
524
views
Active Directory: pinpoint cause for access denied when modifying objects
I need a general way to determine the cause of access denied errors when modifying/moving/etc. objects in AD. I know that I can view "effective permissions" but not sure which permission ...
- 31
0
votes
2
answers
1k
views
bulk removing direct access to a folder via PowerShell ACL
On a number of the servers where I work the share folder permissions have become cluttered with direct permissions for some of our techs due to them needing to take ownership. I have figured out how ...
- 1
-2
votes
1
answer
131
views
You don't currently have permission to access this folder. Windows 10 User Authentication Error Dialog Box [closed]
I recently was given Admin rights on my machine at work.
Unfortunately, when I am going through the directory structure I kept getting this message box:
If I hit continue, I need to change the ...
0
votes
1
answer
314
views
copying many folders with not inherited permissions
So we have this folder with hundreds of user folders (not sure what they are used for but there is mostly Desktop, Documents and Favorites). We need to back them up to another disk, but the problem is ...
- 117
1
vote
1
answer
2k
views
How to set ACL recursively using setfacl for files/dir added after executing setfacl
my directory hierarchy looks like this
/tmp/
dir/
subdir/
file
so i try command (found on a similar issue linux/setfacl - Set all current/future files/directories in parent ...
- 11
0
votes
1
answer
180
views
Is there an equivalent to rsync --archive --files-from= on Windows?
I would like to copy selected paths from source to destination directory including all metadata and ACLs. Is it possible using Windows CLI?
robocopy src dst /E /COPY:DATSO /SECFIX /TIMFIX /sl /TS /FP ...
