Questions tagged [access-control-list]

An access-list is a list of rules, usually held on network devices such as switches, routers or firewalls, that matches network traffic. The specific term 'access-list' is used in the context of Cisco devices, although the concept of an 'access list' is more generic.

Filter by
Sorted by
Tagged with
1
vote
1answer
26 views

LDAP - Grant user write permission to group / organizationalUnit

I tried to grant cn=admin,ou=Administrators,dc=example,dc=com full write access to ou=People,dc=example,dc=com so that this admin can create (and of course read) new entries under ou=People and also ...
0
votes
0answers
5 views

DLP: How to restrict user from downloading data through Putty, SSH, SCP, Sqoop etc from Hadoop cluster

We need to enforce some controls to restrict users the capability of downloading data from hadoop via a variety of channels below (least but not all): Putty/SSH SCP Sqoop 1/2 Spark 1/2 Hue/Impala Hue/...
0
votes
1answer
115 views

Manage permissions on docker openLDAP

I want to change some permissions of my openLDAP instance running on Docker (https://github.com/osixia/docker-openldap). Forbid anonymous login (forbid even read-only) Give any user who is not an ...
1
vote
1answer
27 views

UNIX ACL Permissions Different when file is copied from Windows Explorer compared to unix cp command

Please share your inputs on the following scenario. Unix Path 1. Permissions for /source/dir1/test.txt are -rw-rw----+ Scenarios Case 1: When this file is copied from Windows Explorer to the ...
1
vote
1answer
85 views

Shared folder on Linux

how do I create a truly shared folder on a Linux server? I want for the members of a project team to be able to read and write every file as if they were their own, regardless of whether they copied ...
0
votes
0answers
14 views

NFS4 idmap with IBM GPFS storage and AD

I am trying to connect a Linux machine to a new IBM GPFS-based storage via NFS4. The Linux machine uses an LDAP server and the IBM storage uses another ActiveDirectory. For now, we are in a test net, ...
1
vote
0answers
24 views

AccessControlEntry (ACL/ACE) in Active Directory with LDIF

Can I add AccessControlEntry (ACL/ACE) in Active Directory with LDIF Files and ldapadd? With OpenLDAP / Oracle Directory it seems to be possible. I've tried: ## delegate Control / add ACI dn: OU=...
0
votes
0answers
18 views

Exim: restricting certain users from sending to other domains

I've found a few close answers, but not 100% sure. I use Exim on a Linux server and I have a list of local users (users with logins to that linux system - just to be completely clear) that I want to ...
1
vote
1answer
45 views

Why can't user X write to directory despite having default:user:X:rwx ACL on the directory?

As I understand it, this all looks good: iammedemo owns the directory, but iammme has default:user:iamme:rwx, so if anything, iamme should effectively be just as privileged as iammedemo, and be able ...
0
votes
0answers
42 views

Using SID+ACL with NFS and Winbind (NOT SSSD) from a Linux file server

I've inherited a domain using a Samba 4 active directory on Ubuntu 14.04 and having a heterogeneous client environment of Windows/Ubuntu 18 clients. I have tried setting up clients using sssd, ...
0
votes
1answer
28 views

exim acl_not_smtp ignored for local submissions

In the default exim4 install on Debian with split configuration files I have created a custom file at /etc/exim4/conf.d/acl/33_conf with the following content: acl_not_smtp: defer log_message = ...
0
votes
1answer
22 views

Rate Limit Apache 2 Access Control?

I'm not doing anything fancy. I'm just using Apache2 access control to password protect a directory. I thought it would be smart if Apache would limit how frequently users can attempt to ...
1
vote
1answer
66 views

Acess windows files with SeBackupPrivilege and SeRestorePrivilege

I have a full drive to move to another partition. The problem is that the design was poorly funded and now, we have to deal with lots and lots of different users accessing via SMB and applying their ...
1
vote
2answers
35 views

Modify new user home directory permissions with powershell

I am needing assistance with a script. What I am trying to accomplish is when new users are created in ADUC and their profile path(home folder) is created, it gives the users "Full Control". I am ...
0
votes
1answer
44 views

Windows server: inheritance not applied after folder move

I read a lot about strange and unexpected behavior about acl inheritance when folders are moved inside the same volume. I have a problem similar to this one: microsoft-move-file-acl-problem In my ...
0
votes
1answer
35 views

Set security descriptor for windows server process

I would like to add a new DACL entry to the security-descriptor of windows service process. sc sdset allows to set permissions on the service for actions like start/stop/pause, but I want to set ...
2
votes
1answer
54 views

How to make a service (or the system process) impersonate the *elevated* variant of a user account?

In my network, there is a Windows 2008 R2 server with network name Dax. On that server, I have (among others, of course): a hard disk drive, mounted as E:\ a folder E:\odo an SMB share \\Dax\odo ...
1
vote
0answers
200 views

Configure Consul cluster with ACL enabled

Hello everyone and thanks for reading. I'm quite new to Consul. I've reading the documentation and practicing for a while, thus I've been able to properly configure consul in a few nodes. Now I want ...
0
votes
0answers
55 views

chmod permissions in an ACL folder

I set up a folder managed by ACL, meant to let specific "manager" users have total control over files in it. File access seems ok (e.g. a manager user can delete a file owned by any other user) but ...
1
vote
1answer
68 views

Windows - Set permission on folder only without recursing subobjects (slow for large directory trees)

There are many times when I wish to set a permission on a folder only, but all the programs i've tried will recurse through all sub files and folders during the process. As this is slow, is there any ...
0
votes
0answers
14 views

ACL failure after directory setup

I'm trying to setup ACL for a specific directory but man!! this is getting too complicated, not sure what is going on here. User zeus is trying to access set_folder in /opt/omari/DCTIXE/, which ...
2
votes
0answers
29 views

OpenLDAP : allow non-rootdn admin to set password of other users

I can't figure out howto configure a proper ACL in OpenLDAP 2.4 (old slapd.conf approach) which allows a non-rootdn admin to change other users passwords. I have a simple LDAP structure: dc=vsp ...
1
vote
0answers
22 views

Is delegating a granular “Modify permission” on a group possible?

A certain user "x" has below permissions on a group "g"; -> Read/Write all the properties on group. -> Delete the group. Need to add "modify permissions" on the group "g" for user "x" ; but the only ...
11
votes
3answers
501 views

Working around an AWS network ACL rule limit

At a maximum, a VPC network ACL can have 40 rules applied. I have a list of over 50 IP addresses that I need to explicitly block access to in our systems, over any port and any protocol. This is an ...
2
votes
1answer
63 views

why does anonymous user could access userPassword attribute of OpenLDAP?

Here is my ACL, openldap is v2.4.4. acl.ldif dn: olcDatabase={0}config,cn=config changetype: modify add: olcAccess olcAccess: to attrs=userPassword by dn="cn=Manager,dc=ad,dc=pthl,dc=hk" write by ...
1
vote
1answer
78 views

What are the requirements of ROBOCOPY /SEC?

I just noticed some strange behavior using ROBOCOPY /SEC that I can't explain... We require a {TEMPLATE} folder holding +50 subfolders with custom access rights to be copied for each new project. For ...
2
votes
0answers
40 views

Understanding Windows share deny permissions

I am developing some reporting for a series of Windows shares and I am not clear on the implementation details regarding permissions with deny types. While trying to calculate the resulting effective ...
0
votes
1answer
340 views

Assign group permissions on folders using Powershell via CSV

we are working on a new Permission Concept. We created different Security Groups,depending on the Department. For example: Finance_List, Finance_Read, Finance_ReadWrite Controlling_List, ...
0
votes
0answers
40 views

Windows Folder Redirection, setting permissions with windows ACL

I'm relatively new to Windows server management. I'm trying to setup folder redirection with GPO. The file server that's getting redirected is in a LXD fedora container. for the most part I've been ...
1
vote
0answers
62 views

setfacl setting unwanted group execute

I'm pretty sure I'm just doing something wrong, but I can't figure it out... I have some directories I set up with the following: sudo setfacl -dR -m u::rwX,g::rwX,o::rX,u:ubuntu:rwX,u:www-data:rwX,...
0
votes
0answers
20 views

Unable to protect shared folders

I have a folder called ‘scanned’ that is shared. Share permissions full access for everyone. Folder security is full access for everyone. I created user folders under scanned. Each sub folder has ...
1
vote
1answer
78 views

How can I enforce persistent ACLs on startup for /dev/video* devices?

I have a USB webcam on /dev/video0 that I'm trying to access before a user logs in (to be precise, I have an Azure IoT Edge container running on an Ubuntu 18.04 instance that needs to run in headless ...
0
votes
1answer
95 views

How do I properly order NTFS ACL using icacls?

I have a directory structure 4 subdirectories deep: [Department] -> [Job #] -> [Docs] -> [EMail] At the [Docs] level I have 4 groups inherited from root and one group (st_JobDocs) explicit. All ...
2
votes
0answers
114 views

Export/Import Registry ACLs

Is it possible to export/import Windows registry ACLs? How might one go about doing so? A normal registry export does not include the ACLs. (I'm referring to the permissions that can be set on ...
0
votes
2answers
117 views

Classic ASP website access on IIS version 10.0.17763.1

I created a local "testsite" in IIS version 10.0.17763.1 When I tested settings: Authentication - success Authorization - cannot verify access path, with error message: "The server is configured ...
1
vote
0answers
47 views

Regulate OpenVPN users' access to specific websites

More specifically, I push the route for 5 websites to the clients via the server config. However, I would like to block CLIENTS's access to one of these websites on an ad-hoc basis. In order to ...
0
votes
0answers
101 views

Haproxy - How to only accept requests for known URL parameters

I'm using HAProxy 1.8.17 as endpoint for https connections. Now I would like to accept requests only if the URL parameters are valid (i.e. all specified parameters are known and have valid values). ...
2
votes
0answers
45 views

Folder ACLs lockdown. Unable to take ownership

this should be a trivial issue, except this time it isn't. I have a folder on a non-boot drive in a Windows Server 2008 R2 machine which is completely stuck. Using the domain administrator account, ...
0
votes
1answer
255 views

getcifsacl does not work with CIFS mount versions 2 or 3

When I mount CIFS share with vers=1.0 I can perform getcifsacl sucessfully. # mount -t cifs //example.com/Users/milo /mnt/cifs -o vers=1.0 # getcifsacl /mnt/cifs/file.png REVISION:0x1 CONTROL:0x8504 ...
1
vote
1answer
218 views

Windows file permissions - Admin permissions don't seem to work as expected / access denied

I have just inherited a server and I have an issue accessing some folders. I usually get this solved "in the end", usually by forcing a takeown command and then starting from scratch - but, it's ...
0
votes
1answer
93 views

The dynamic ports are constantly changing, How do set them in the firewall? [closed]

I'd like to block unused ports on my server so I monitor the ports with CurrPorts and I understand some processes like lsass.exe have some dynamic ports e.g 49158,49976,... These ports might change ...
2
votes
0answers
26 views

Restricting user access to a subset of binaries

I checked rbash and chroot jail, which doesn't have permission to read /var/log. Scenario: ssh user should only able to cd to a directory and do less for files. eg: ssh user@server.com cd /var/...
-1
votes
2answers
74 views

How to enumerate permissions of users in active directory? [closed]

I am learning AD pentesting and I am looking for a way to enumerate the user's permissions. Note:- Here through permissions I am talking about those permissions which are found in the security tab. ...
0
votes
0answers
105 views

URL redirection and ACL conditions in Haproxy

I would like to check and compare the maxconn and conn_cur in haproxy. If the conn_cur value greater than maxconn, the url needs to be redirected. URL redirection is working, but the maxconn & ...
0
votes
0answers
483 views

Exact ACL permissions to this same data but for different group

I am preparing data migration from trusted domain to trustee domain. Data will be copy but no users or groups are to be migrated so I can't rely on SID history. Permissions need to be "translated". ...
0
votes
0answers
41 views

OpenLDAP ACL for group not working

I have an install of OpenLDAP which I have recently moved to be configured by olc. I'm setting up the ACL's but am having a trouble with setting admin access. I have the following rules I am using: ...
0
votes
1answer
92 views

Large Varnish VCL does not load

I'm using Varnish ACLs for blocking unwanted clients by IP and as the blocklist/ACL has grown the compile time of the VCL has increased a lot. The other day I added another 25K IPs to block and ...
0
votes
1answer
59 views

How do I exclude return traffic from my ACL?

I have this network topology. What I try to achieve is: Deny access from Network 172.28.224.0 to Network 172.28.226.208. But the other way around it should work. 172.28.226.208 should be allowed to ...
0
votes
1answer
19 views

How can I disallow access to a specific ip within a LAN?

My Network topology looks like this: PC1------- PC2-------Switch--------Router-PT PC3-------2960-24 PC4------- What I try to accomplish is: No PC is allowed to ping PC3, but PC3 is allowed to ping ...
-1
votes
1answer
73 views

How can I make an ACL list work within a LAN? [closed]

I added an ACL list to Router A and permission is working fine if the packet comes from another LAN. The problem is, when a Packet is sent within the LAN that is connected to Router A, the packet is ...