Skip to main content

Questions tagged [access-control-list]

An access-list is a list of rules, usually held on network devices such as switches, routers or firewalls, that matches network traffic. The specific term 'access-list' is used in the context of Cisco devices, although the concept of an 'access list' is more generic.

Filter by
Sorted by
Tagged with
0 votes
0 answers
6 views

How to Secure Database Credentials in a Windows Desktop App Without a Service Layer: Preventing Unauthorized Access to DBMS?

Given is a Windows desktop application (written in Java) that communicates directly with a DBMS (SQL). There is no service layer between the desktop application and the DBMS. How can one secure the ...
Joigo's user avatar
  • 1
0 votes
0 answers
7 views

sonic os acl for ip of vlan interface

I'm trying to apply simple acl rules to IP address vlan100, but it always responds to ping. "VLAN100_ACL": { "policy_desc": "VLAN100 Ingress ACL", "type": &...
lexxai's user avatar
  • 14
0 votes
0 answers
62 views

Linux ACL of a shared folder for specific group

I need to make a shared folder: I have separated my work between several users on the same computer and need them to access the same folder without restriction. They all belong to a "work" ...
user3450564's user avatar
1 vote
2 answers
731 views

IP Whitelisting in (AKS) Kubernetes / ingress-nginx

Hello anyone who reads this, I'm looking for a way to restrict access to a publically exposed service (type LoadBalancer) at 234.234.234.234:1234 to a specific trusted IP at 123.123.123.123. The way ...
0xlivingbeef's user avatar
1 vote
4 answers
290 views

NFS and ACLs in a Kerberos context on Rocky Linux 8.9

We're running a Rocky Linux 8.9 (so, essentially RHEL 8.9) shop and I've been tasked with investigating ACLs on filesystems mounted via NFS. We're using FreeIPA/IdM as well. I've set up a test machine,...
bolind's user avatar
  • 221
1 vote
0 answers
57 views

Windows: not moving permissions when moving files on the same volume

For a service we are setting up, one of our Linux servers has a CIFS mount to one of our central storage servers, using a specific service account dedicated for this purpose. The remote directory is ...
Ale's user avatar
  • 1,753
0 votes
1 answer
282 views

How to chown a directory on a mounted samba share?

I have a linux client mounting a samba share with the following fstab entry: //<serverip>/<nameofshare> /home/user -o nofail,x-systemd.device-timeout=15s,vers=3.11,user=<sambauser>,...
ift-436t's user avatar
0 votes
1 answer
91 views

Permission error when setting global-acls in dovecot

Dovecot's ACL plugin instructions indicate that for global acl's, we're supposed to create an acl file in /etc/dovecot/. and to include the access control list items in it. So I've created /etc/...
oucil's user avatar
  • 598
0 votes
1 answer
284 views

how to block outgoing traffic in ec2 without blocking ssh

I have an EC2 with has public subnet and traffic is flowing through internet gateway. Now, i have an requirement like I have to block all outgoing traffic in EC2. I have tried to restrict the traffic ...
Ravi Teja RVN's user avatar
0 votes
0 answers
69 views

Default ACL to backup another user's home directory

I have written a script to backup our servers. It runs as the "backup" user on multiple Oracle Linux 7/8/9 systems and has to backup other users homes directories, among other things, using ...
Edzilla's user avatar
  • 11
0 votes
1 answer
83 views

OpenLDAP peername.ip ACL not working for subnets

I have the following ACL stored in my /etc/openldap/slapd.conf file: access to dn.regex="^([^,]+,)?ou=(groups|addressbook),dc=ldap$" by dn.exact="cn=directory,ou=users,dc=ldap&...
Matthew Knill's user avatar
0 votes
0 answers
90 views

ACL permissions on Chroot directory

I have the Named service in a Chroot environment, I need a user to be able to modify the live files of the path /var/named/chroot/etc and I do not want to give full permissions with sudo, I have used ...
fah81's user avatar
  • 1
1 vote
1 answer
8k views

nginx, only allow certain IPs to access a URL prefix

In nginx, how can I restrict access to a certain URL prefix by IP address. i.e. “only these IPs are allowed to access $URL?”. I have a location … { directive, but it looks like the nginx allow & ...
Amandasaurus's user avatar
  • 32.6k
0 votes
0 answers
370 views

How to restrict ssh access only to users within multiple groups?

I would like to know how to allow ssh access to users who are in multiple groups.  For example, in general, if the user is part of the group shell then they may access a number of servers.  However, I ...
AGI-Chandler's user avatar
0 votes
1 answer
24 views

Aruba Access list redundant entries

I am using Aruba switches, and the configuration that I have been given to review has redundant entries in the ACL per below: 14 permit tcp 10.255.252.0/255.255.255.0 any eq ssh 15 permit tcp 10.255....
shneidr518's user avatar
0 votes
2 answers
156 views

Avoid Windows folder listing with ACL

Is it possible through ACL to prevent a local user account to "dir" the windows folder ? I tried with "Advanced security settings", but cannot change a thing...
Stef's user avatar
  • 622
1 vote
1 answer
136 views

Why does `getfacl` output for basic permissions differ from `ls -al`?

I have a directory that shows r-x group permissions in ls -al output: mburr@burrvm-mint20:~$ ls -ald /media/mburr drwxr-x---+ 2 root root 4.0K Oct 6 17:11 /media/mburr The ls -al output also shows ...
Michael Burr's user avatar
0 votes
0 answers
125 views

Samba Linux server MacOS client ACLs

I'm trying to enable ACLs for a Linux Server using a MacOS client. My configuration is as follows: [global] vfs objects = acl_xattr map acl inherit = yes store dos attributes = ...
Vic Nightfall's user avatar
2 votes
1 answer
55 views

squid: Unable to allow 10.10.11.0/24 but 10.10.11.0/23 works

Im unable to make a working acl with CIDR over `/23` (squid 5.7 on Debian) For example i got this config (working): acl servers src 10.10.11.0/23 http_access allow servers ... http_access deny all ...
mylan's user avatar
  • 61
0 votes
0 answers
184 views

How to drop arp requests trying to resolve a particular IP address at a logical switch port?

I am using l2gateway port to attach a physical L2 segment to a logical network. But both the logical network and the physical segment has one common IP, say 10.0.0.1. I want to prevent the traffic ...
Amogh M K's user avatar
0 votes
0 answers
925 views

Samba Windows ACL not working

I want to configure Samba to manage Windows ACL and manage them from Windows via the security tab. The Samba server is standalone and not part of an AD tree; i already followed various offical and ...
Plokko's user avatar
  • 101
0 votes
0 answers
100 views

Linux Debian ACL, is default mask overriden by something in FTP?

I have an Linux Debain 10 server running an web project. The project (parent) folder is as follows: ls -la: drwxrwxr--+ 7 some_user some_group 4096 Jul 21 11:01 . getfacl: # file: . # owner: ...
Jiří Žák's user avatar
2 votes
1 answer
198 views

Restrict User Access to Mailbox based upon Location

We need to restrict user access to certain mailboxes (Outlook/MAPI) based upon the user's location within our site. All mailboxes exist within the same on-premise Exchange server - all mailbox access ...
SK5910's user avatar
  • 21
0 votes
1 answer
178 views

NT Security Descriptor

In active directory an object have several permissions on many objects. how to view permissions of particular object? i am asking like for eg user Kavin have read permissions on some folder, full ...
Sandy Santhosh's user avatar
0 votes
1 answer
230 views

If the default nfs4 ACL 'deny access' why do default ACLs frequently contain A::EVERYONE@:rxtncy?

Is there an alias for deny that I could use? So far I have not had any luck removing the EVERYONE@ ACE. Maybe that a bad idea. You tell me. I was just able to nfs4_editfacl and change the A::EVERYONE@...
mr.zog's user avatar
  • 960
1 vote
1 answer
309 views

How does one set ownership of a directory using nfs4_setfacl?

Or put another way, when I see @OWNER in a nfs4 ACL does this @OWNER refer to a local Unix/Linux user? I need to make an AD user (without a corresponding local account) the owner of a directory on a ...
mr.zog's user avatar
  • 960
6 votes
2 answers
1k views

How NTFS folder access is checked in a Active Directory domain?

I understand that both NTFS folders and AD objects use security descriptors and DACL’s to check user/process access MS Learn - How access check works However, how does the access check resolves ACE’s ...
Grasshopper's user avatar
0 votes
1 answer
236 views

Unable to set ACL for user and groups in rootless containers

i'm running a Debian container in rootless mode and can't set an acl for groups and users besides my own group and user (at least it seems so). I started a bash in a container ( runc --root /var/slurm/...
csmj's user avatar
  • 11
0 votes
0 answers
99 views

Restrict Apache forward proxy to a remote url set

Is there a robust way to restrict Apache forward proxy to a set of remote URLs? Now I can see the only solution with multiple identical <Proxy "..."> blocks as: <Proxy "http://...
Veniamin's user avatar
  • 863
1 vote
2 answers
739 views

Netcat successfully sends UDP packet despite all UDP traffic being blocked via Network ACL

I've created an AWS instance in the default VPC and I've blocked all UDP traffic in the Network ACLs. Here's how my outbound rules look: Rule number Type Protocol Port range Destination Allow/Deny ...
dodov's user avatar
  • 151
2 votes
0 answers
100 views

How to make an ACI for users that are `roleOccupant` in an `organizationalRole`?

In OpenLDAP I had an access rule using users that are roleOccupants in a specific organizationalRole like this (the example is just a fragment): olcAccess: to * by group/organizationalRole/...
U. Windl's user avatar
  • 391
0 votes
0 answers
451 views

Why do all users still have full access in my samba server after i have set limited permissions?

I have a debian 11 server running samba and is hosting a share of a drive that's mounted in fstab. I have added "acl" to the fstab and installed acl in the samba config. To be clear: my end ...
Moth's user avatar
  • 1
0 votes
1 answer
490 views

Apache2 how to limit a subdirectory to local network only

I have an Apache2 (2.4.41) server running on Ubuntu 20.04 that serves a couple of Flask web apps differentiated by sub-directory to the internet over HTTPS and a No-IP DDNS (https://mysite.noip.com/...
James Watson's user avatar
0 votes
1 answer
158 views

Set timeout in Apache ACL

for a page in an Apache webserver under ACL, is there a way to force apache to prompt again for credentials after a fixed timeout? For example, user tries to access the url, he fills the credentials ...
solonely's user avatar
1 vote
0 answers
206 views

Automating NFSv3 File/Folder permissions in Windows

I'm a Windows/MSSQL DBA who is inheriting a quirky system through no fault of my own, and had a quick question. Background I have an Azure NFSv3 volume that is being exported to a Windows Server 2019 ...
Vocoder's user avatar
  • 111
0 votes
0 answers
165 views

Adding a group to a folder structure "basing" on another existing group's rights

thanks for reading this wall of text anyways. My scenario: i have a mega-folder called Projects. Every subfolder is a different project. So, for example, i have Projects\N123456 - New Coca Cola. Now, ...
Claudio Ghirardi's user avatar
0 votes
1 answer
731 views

Squid Proxy always 403

I have been trying to setup Squid proxy for a good 2 hours now, I dont want any authorizations or any blacklists. I just want all requests to get accepted. I have already tried http_access allow all, ...
1FriendlyDoge's user avatar
1 vote
0 answers
60 views

How are Linux ACLs different for files versus sockets

With umask 0022, using default ACL entries default:user::rwx, default:group::rwx, default:mask::rwx and default:other::rwx for a directory, files created with touch (e.g.) have a mask of rw, and ...
Larry's user avatar
  • 11
-3 votes
1 answer
254 views

Want to try to block a particular ip address

Network Diagram: Subnet-coloured Network Diagram: I have the following subnets below. I want to let traffics from the green subnet to go everywhere but the blue subnet should not be able to get ...
Cerolina's user avatar
0 votes
1 answer
47 views

On linux, what are the recommended extension for access control lists ACL?

I have read many HowTo's, e-books, internet pages, etc, about the use of ACLs in programs like iptables, squid, etc. on linux In the examples, they use the following file extensions: file.lst file.acl ...
acgbox's user avatar
  • 398
1 vote
1 answer
1k views

HAProxy deny HTTP request on path_beg not matching

I have a HAProxy node in front of a Keycloak node. I want to only expose the API needed to serve the users (not the Admin panel) I have the following on my haproxy.cfg frontend block frontend haproxy-...
desertSniper87's user avatar
3 votes
1 answer
1k views

rsync "Operation not supported" errors for ACL on ZFS

While migrating our file server to a ZFS file system with rsync -avxHAXS ... I get errors like: rsync: [generator] set_acl: sys_acl_set_file(path/to/file, ACL_TYPE_ACCESS): Operation not supported (95)...
Roger Dueck's user avatar
0 votes
1 answer
87 views

NGINX Conf Feedback Request: Limiting specific API endpoints to $remote_addr(s);

I was using this as a source of information to draw on: https://www.nginx.com/blog/deploying-nginx-plus-as-an-api-gateway-part-2-protecting-backend-services/#access-control My server is running a ...
Austin Foss's user avatar
0 votes
1 answer
425 views

OpenLDAP ACLs not cooperating

I had a simple ACL in place on my server that was working fine. I've decided to set up SSSD to authenticate user logins via LDAP, so I need to give more access to the SSSD bind account. In the process ...
miken32's user avatar
  • 974
1 vote
0 answers
843 views

setfacl operation not supported ubuntu wsl

i want to set acl certain file in /var/www/html/index.htm inside Ubuntu WSL 20.04 (win 10) using : $ sudo setfacl -m u:wira:rwx sshd_config setfacl: sshd_config: Operation not supported after ...
Lezir Opav's user avatar
1 vote
1 answer
126 views

Docker Squid not enforcing time acl in configuration

I have a squid running in docker, which is not enforcing the time ACLs that are defined in the configuration. I'me using https://hub.docker.com/r/ubuntu/squid running on arm This is my configuration ...
BANJOSA's user avatar
  • 398
1 vote
1 answer
901 views

Can SSSD authenticate via LDAP with anonymous binding either forbidden in ACLs and with 'olcRequires: authc' enforced?

I manage a LAN with a list of users accessing their NFS-shared homes while being auhtenticated via NIS/YP (CentOS/Fedora-based clients and servers). I'm in the painful process of migrating out of NIS/...
Francesco's user avatar
0 votes
1 answer
258 views

I have load balancer configured on Haproxy. Can load balancer redirect traffic from port 1 backend to port 2 backend if port 1 is busy this moment

In ha-proxy I separated my traffic to two frontend ports and created two backends. Port-1 traffic is directed both backend and port 2 traffic is directed two backend-2. I want to create a smart load ...
Fox Chasin's user avatar
1 vote
2 answers
2k views

How to allow user to run only specific binaries

I'm adding user logviewer with /sbin/nologin/ and to my system. My custom service is running eg. sudo -u logviewer less --follow-name /var/log/messages. But still there are ways to run other command ...
Iluvatar's user avatar
  • 121
0 votes
1 answer
669 views

Routing different subnets on a switch

My setup: I have a layer 2 managed 7-port Ethernet switch (KSZ9897). The switch features dot1Q (VLAN) and dot1X (ACL). ACL is advertised to be able to filter on layer 3 (IP) and 4 (TCP/UDP). Is it ...
Lunde's user avatar
  • 31

1
2 3 4 5
16