Questions tagged [access-control-list]

An access-list is a list of rules, usually held on network devices such as switches, routers or firewalls, that matches network traffic. The specific term 'access-list' is used in the context of Cisco devices, although the concept of an 'access list' is more generic.

Filter by
Sorted by
Tagged with
0
votes
0answers
20 views

HAProxy errorfiles: Can I use php files? Or a remote location?

I'm currently migrating our nginx loadbalancer to haproxy and in nginx when we get the HTTP response codes of 500, 502, & 504, nginx points to a maintenance page that is written in php and on a ...
0
votes
0answers
23 views

Unified quick access permission check tool [closed]

Is there a tool for Linux to check the ultimate access permission between different subjects and objects? I mean, for SMACK there is chsmack command, but if MAC is used together with ACL's, it is not ...
2
votes
1answer
43 views

Prevent user to overwrite files and directories

Help me to learn if this scenario is doable using Linux. I want to secure the access to a system path called "/mnt/data". System users retrictions: 'daemon_user': read/write access. 'read_user': ...
0
votes
0answers
27 views

S3 “folder-per-client” permissions strategy

I was originally planning on an S3 bucket per client, with bucket policies restricting access to that bucket to a single IP (the clients' single-tenant server). However, most S3 compatible service ...
1
vote
1answer
82 views

AWS WAFV2: ACL Rule for allowing access to specific URI Path

I have some web acl managed rules in AWS ELB that are blocking webhooks from Pusher api. They don't provide an IP list that I could include in a white list. I'm trying to create my own rule to allow ...
0
votes
0answers
74 views

Cisco ACL to block external DNS queries [RESOLVED]

One of the routers that I administer is getting bombarded with external DNS queries from the internet. This is a network border router which has a DNS server configured. There is an interface facing ...
2
votes
1answer
46 views

How to permit the chown use to a regular user, but only on its home directory?

I'm trying to allow regular user A to execute chown command to a list of user B,C,D having as object any files located into its home directory. In other words, I would try to limit the chown "root ...
0
votes
1answer
19 views

Cisco IOS ACL to permit inbound

I am struggling to get to grips with the ACL on the 2800 series cisco router. Briefly My topology is R1 > Sw1 > [Server 1, server 2, pc 1] R1 creates a PPPoE connection, that I'm using right now. ...
1
vote
1answer
331 views

Access to SMB shares denied after update to FreeNAS 11.3

My previous setup (FreeNAS 11.2) had working SMB shares with Windows 10. After an update to FreeNAS 11.3 SMB shares partially stopped working. I'd be more than thankful, if anyone could help me ...
0
votes
0answers
30 views

what are functional accounts in active directory?

I am aware that functional accounts are accounts used to perform automated account management functions. are they like service accounts which are used to by applications or processes?
0
votes
0answers
47 views

Routing policy (control list?) needed for an old Cisco Router

I have a ~15yr old little Cisco 831 connecting a site with multiple networks to the internet. I need to block incoming port-80 (www) and port-443 (ssl) access to one of the internal IP addresses from ...
0
votes
0answers
45 views

openldap unix/samba user backend add acl to grant admin ldap properties to administrator user

Hi y have openldap on ubuntu 16.04 like unix/samba(NT) user backend and admin ldap user defined like cn=admin,dc=grupo,dc=local acl defined is that olcAccess: {0}to attrs=userPassword,...
0
votes
0answers
17 views

Networking security with ACLs and Security Groups

I'm learning AWS currently and building up highly secure VPCs the subnets within them. My question is simple: how can anyone (or thing) theoretically manage to "get past" both/either an ACL and/or ...
0
votes
0answers
6 views

Impossible to change ACL in ldap with root dn

I need to change the ACL in my slapd configuration (olc based) but I always get error 50, even if I'm using the rootdn $ldapmodify -x -D "cn=<here>,dc=<some>,dc=<thing>" -W -H ldap:/...
0
votes
0answers
10 views

How to specify pattern for share folder using ACL vfile

My 90-acl.conf file looks like: plugin { #acl = vfile:/etc/dovecot/global-acls:cache_secs=300 #acl = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext acl = vfile } # To let users LIST mailboxes ...
0
votes
1answer
15 views

Horde webmail not recognizing Dovecot ACLs

I'm trying to set up one mailbox to be shared with another one using steps described here but for some reason I do not see that option in my mailbox (logged as an admin) even I have set ACL as a true ...
1
vote
1answer
52 views

Can't write on Samba4 share using Zentyal 6.1 server, after upgrading from 5, read only is allowed

I can't write on all my clients (Windows 7 and Windows 10) in all my samba shares, even if the users are accepted on domain, and the permissions was maintained. The shares are on a NAS, ISCSI ...
0
votes
0answers
39 views

HaProxy IP-based ACL not working

I've got an HaProxy front end (version 1.7.5-2) which works fine apart from it's not blocking access to specific IP addresses contained in the X-Forward-for header via an ACL. Other ACL's within it ...
1
vote
0answers
17 views

How do you configure access lists to restrict inbound ports while allowing all outbound traffic on a Cisco 2911 router with NAT?

First caveat: I did not design this network. Most of my recent networking experience is with ASAs; configuring NAT & ACLs there is pretty easy and straightforward. In this case, the engineer who ...
1
vote
0answers
41 views

PosixACL and NFS

Background first, as always. I administer two HPC systems. Both are running the same OS, in the case CentOS 7. They both mount an NFS share that is provided by a server, which has a number of other ...
0
votes
0answers
23 views

POSIX ACLs on Linux: How to prevent users from taking away permissions?

I need to accomplish seemingly easy task. Using POSIX ACLs I need to configure access to a directory tree, where users can share files. While doing that I want to ensure that unprivileged users are ...
0
votes
1answer
17 views

How to use setfacl for only files in a directory leaving sub-directories' acl unchanged?

I've been looking for ages but unable to find specific response to my need. I want all the files in one of my directories to have acl set to rw for owner and group but the sub-directories in it should ...
0
votes
1answer
50 views

Openvpn unable to write to file, but is able to append

I have a weird problem with OpenVPN: In my config, OpenVPN authenticates users based on a laravel console application. Laravel site is served using Nginx running as www-data. The storage/logs ...
0
votes
0answers
52 views

Remove parameters from URL haproxy 1.5 when connecting to backend - Using reqrep to strip URL paramters

I have a service that runs on port 10000, which should be fronted by haproxy. I'm changing the urls, but the structure looks like this: localhost:10000/testbutton/?test=test However, we have ...
0
votes
0answers
26 views

Multiple ACEs (Same group name) in ACL have different SIDs, Why?

so I came across this today and was wondering why this occurs. DOM\Group1 S-1-5-21-19228943-1347772516-176895030-41916 DOM\Group1 S-1-5-21-693241485-1621911664-1232828436-6437 DOM\Group1 S-1-5-21-...
0
votes
0answers
27 views

How to replace PHP's open_basedir with IIS AppPool permissions?

For years I use the IIS Application Pool Identity to restrict access of PHP (as a FastCGI module) to certain website's folders, and for years I can't understand — why everything is accessible to the ...
0
votes
0answers
16 views

Haproxy path_reg compare number?

The paths are like this: https://example.com/10001/5235723gdh.jpg https://example.com/10007/836789370md.jpg We want to extract the number and compare. I tried with acl image1 path_reg \/[0-...
0
votes
0answers
16 views

Squid - grouping multiple ACLs together

By default we block all internet access and allow access on a per-host and per-destination basis. The environment is highly restricted. In order to simplify our squid rules we're looking to see if ...
0
votes
2answers
77 views

Is mail rejected by Exim's !verify = header_syntax ACL item, with RFC 2047-encoded From/To headers, legitimate?

A recent Exim upgrade added this to the default acl_smtp_data ACL: .ifndef NO_CHECK_DATA_VERIFY_HEADER_SYNTAX deny !acl = acl_local_deny_exceptions !verify = header_syntax message = header ...
0
votes
1answer
125 views

ACL conditional zone in Bind9

I'm trying to apply "restrictmoderate.youtube.com" only for kids and let the others access the standard "youtube.com", using Bind9. # cat named.conf include "/etc/bind/named.conf.options"; include "/...
0
votes
0answers
28 views

Apache: Access control

As a newbie, I find the Apache documentation a bit confusing, too much specification and too little recipes / practical examples to achieve a certain goal. Forum posts are usually referring to older ...
0
votes
0answers
52 views

File system ACLs cannot be set for samba shared folder which is a cifs mount

I have followed the samba Tutorial to set up a domain connected samba server for domain users. The folder that I would like to share is itself mounted from another server using a cifs mount using the ...
0
votes
0answers
13 views

ACL on Samba AD DC Working with User Identification Numbers but not Usernames

This might be a question with an obvious answer that I just haven't seen because I'm pretty new to this sort of thing, but here it goes... I just performed an upgrade on an Ubuntu Samba DC going ...
1
vote
1answer
134 views

HAProxy - Need to add a URL parameter to ACL to differentiate between services with the same URL, but on different ports

I have several services that run on different ports, each of which use the same URI paths. For example: New York Housing Service 127.0.0.1:8080/homes 127.0.0.1:8080/prices Las Vegas Housing Service ...
0
votes
1answer
207 views

HAProxy ACL to multiple backend ports not working

I'm trying to set up haproxy to navigate between the multiple applications running on the same server. If my understanding is correct, I should be able to use ACL rules in the frontend to switch ...
0
votes
2answers
28 views

How to re-apply original inherited permissions to files created while being administrator?

I hope someone can answer this once and for all, this is driving me mad for months now. Platform: Windows Server, any version. This problem doesn't happen on a workstation. Problem: In a folder, ...
1
vote
0answers
21 views

Difference between manage and write in Openldap acl

I'm currently studying openldap ACL. In this documentation, at chapter 8.3.3. The access to grant there is a manage keyword that does gives more rights than the write keyword. Do you know what is ...
6
votes
1answer
54 views

In what ways can access token update be triggered for administrator accounts on workstations?

This scenario emerged when changing the domain group membership that bestows membership in BUILTIN\Administrators. In particular, the group membership for the administrator did not update on the ...
1
vote
1answer
29 views

Timeout connecting to port in EC2 instance, probably ACL issue but can't figure it out

I'm having a lot of trouble connecting to an application running on my newly created EC2 instance from its public IP address. I'm able to log into the server via rdp, however. Once there, I can ...
0
votes
1answer
51 views

Is it possible to restrict WMI logins to specific hosts/IP addresses?

Context: Enterprise IT environment 3000+ Virtual Machines running various editions of Windows Server (the client) Vendor specific application which uses WMI to query the Windows Servers for ...
0
votes
0answers
19 views

Default ACL mask and SGID

Here it goes: I have a shared folder in a server that supports a git repository. All team users must have read-write permissions to the files, but it is also neccesary that every new file or folder ...
0
votes
1answer
43 views

SSH into multiple servers based on Domain HOST ACL

What I’m trying to achieve here is using 1 Entry point for all of my servers using a private network. 1 server with Public IP access and then pointed multiple domains on it, after that use ACL to ...
0
votes
2answers
58 views

Active directory control delegation without user account deletion

In a Windows 2008r2 domain and forest functional level, I'm trying to delegate users account administration and 'password reset / force change' to a specific group of users in my active directory, BUT ...
3
votes
1answer
46 views

Windows backup operators and network access

I have a windows server 2019 hosting a shared folder I need to backup. My backup server is a linux machine and I always PULL the backups instead of PUSH. I created a "backup_user" on my windows ...
1
vote
1answer
121 views

NGINX Allow access to static assets and index.php

We've got an old code base which dumps everything in the public document root, so are wanting to whitelist what files can be accessed. This is effectively our current config server { root /home/...
0
votes
0answers
28 views

OpenLDAP ACL forbid write attribute even on create

I would like to deny ldap managers to define a default password when they create accounts for new users. I have a set of ACL which don't allow them to edit passwords. But those ACL seems to be ...
1
vote
1answer
35 views

Why Explorer ask me take control of the folder?

I'm logged as domain admin on Windows Server 2016 (server member of my domain). I create a second NTFS partition (e:) and I remove access to the local users group (I dont want non-domain admin access ...
0
votes
1answer
37 views

Beyond private-keys or passwords, why disable other=read/exec/write access file permissions for “system” (separate from user/application) files?

Summary In Unix, Linux, or BSD systems: Besides private-key or password files, user-private content, or any custom-application-specific reasons (like serving a database of private information for ...
0
votes
1answer
68 views

Check and Change owner recursively with Powershell?

I know that I have seen how to change the owner but I was wondering if there was a way to check it first and only set it if it needs changed? The current command I have to change it is: dir -r c:\...
0
votes
1answer
93 views

Users access on Resources, Resource Group, Subscription in Azure How to get through the Powershell

I have Subscription where lots of Resources and Resource group created, i want to list all user access and what type for access level user has like Owner contributor rider through the Powershell

1
2 3 4 5
15