99
The access control configuration changed in 2.4, and old configurations aren't compatible without some changes. See here.
If your old config was Allow from all (no IP addresses blocked from accessing the service), then Require all granted is the new functional equivilent.
28
0.0.0.0/0 is the IPv4 everything - all possible IPv4 addresses.
::/0 is the IPv6 equivalent of that.
You can, for example, allow IPv4 and disallow IPv6 or vice versa.
@kasperd mentions:
It should be noted that depending on implementation ::/0 can mean either all IPv6 addresses or all IPv4 and IPv6 addresses. That's because IPv4 addresses can be mapped ...
22
I know it is an old post but I think that I can help more with a functional example that I always use!
In apache 2.2 would be like:
<Location />
Order deny, allow
allow from all
</Location>
<Location /adm>
Order deny, allow
deny from all
allow from myniceip
</Location>
<...
19
To go with your accepted answer ...
You can combine those commands together as:
sudo setfacl -Rm d:g:groupnamehere:rwx,g:groupnamehere:rwx /base/path/members/
17
Take ownership and full rights of folder and everything inside:
takeown /F somedir /A /R
icacls somedir /grant:r User:F /T
Make sure to start the Command Prompt as Administrator!
I had to start a Command Prompt as Administrator, it worked for me in Windows 8.1. With Windows 8.1 awkwardness, I had to search for "command", right click on the Command Prompt ...
17
The test you appear to be wanting to impose is this:
A && !(B || C)
...but that is not logically equivalent to what you've written, which is essentially this...
(A && !B) || (A && !C)
The logical equivalent of A && !(B || C) without using parentheses for precedence is actually this:
A && !B && !C
So what ...
15
I feel that hdr_sub is better for your needs. I was using hdr_end for a while but it runs into the following problem:
requests with port 80 usually get the port stripped so the host header looks like "example.com", but if you were requesting on a port explicitly, like example.com:8080, the header will have the port, and hdr_end will fail the check for "...
13
You would make TFTP access over the internet secure the same way you'd make access to anything over the internet secure. By going through a VPN.
Cisco's IP phones can be set up to use a VPN, and someone even put together a handy doc around common issues with this setup that you might want to take a look at.
13
To solve your problem of finding which certificate goes with which key file for the purpose of modifying file system ACLs on the private key files, use this:
PS C:\Users\Ryan> $Cert = Get-Item Cert:\LocalMachine\My\2F6CB7D56BAA752BCCC0829DD829C0E2662FA1C6
PS C:\Users\Ryan> $Cert.PrivateKey.CspKeyContainerInfo.UniqueKeyContainerName
...
13
You can deny access to certain directories depending on the time by placing the following code in your .htaccess file in the directory you want to control:
RewriteCond %{TIME_HOUR} ^(13|14|15)$
RewriteRule ^.*$ - [F,L]
The hours are based on 24 hours in a day (0-23) and each hour you wish to deny access should be seperated with a “|”.
In the above example,...
12
There are cases where you need to be explicit about this, such as handling redirects for wildcard SSL with multiple levels of subdomains.
Matching end (hdr_end or -m end) or substring (hdr_sub or -m sub) can have unintended side-effects of matching more than you expect. In many cases this may not really matter, since you don't have traffic for those ...
11
Want to reset NTFS permissions from the command line? Use this syntax:
icacls "c:\users\jshipp\*" /q /c /t /reset
This is the same as using the GUI command:
Win7: Replace all child object permissions with inheritable permissions from this object
WinXP: Replace permission entries on all child objects with entries shown here that apply to child objects
...
10
The Unix default permissions for a newly created file are 0666.
The Unix default permissions for a newly created directory are 0777.
If you do not want the default base permissions set an appropriate umask value.
The only thing you can't easily do with umask is create a file which is by default executable (which, by simple common sense, is something you ...
10
Then you can't do it. You've rejected another protocol that permits authenticating the requestor (hcsteve's answer) and you've rejected a VPN which would have allowed TFTP to be tunneled through an authenticated service (Hopeless N00b.*'s answer), so you're stuck with stock TFTP.
RFC 1350 makes it fairly clear, in section 1, that authentication is not an ...
10
Think looks like an ACL from a Cisco router or switch. Let's break it down:
deny vs. permit is the action to take when the rest of the rule matches. In this case you want to block or drop the packets that match.
ip means all IP packets. This includes TCP, UDP, GRE, IPsec... However, it does not include e.g. IS-IS packets as they do not use IP.
10.0.0.0 0....
9
If you need to restrict these users' access on this system, they cannot be administrators.
Nothing that you've listed (RDP access, control over their applications) requires them to be full-blown administrators of the system. Assign just the permissions needed.
8
I know this is a really old post, but there is a way built into Windows 7 and newer (may be in Windows Vista, but I am not sure). Run the following from an escalated command prompt in the folder that you want reset. /t tells icacls to perform the operation recursively.
icacls .\* /setowner %UserDomain%\%UserName% /t
icacls .\* /reset /t
The first command ...
8
This ldif worked for me, with previous command
dn: olcDatabase{1}hdb,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange
by dn="cn=admin,dc=somesite,dc=com" write
by dn="uid=anotheruser,ou=Users,dc=somesite,dc=com" write
by anonymous auth
by self write
by * none
...
8
Here is Microsoft's statement regarding Universal Groups. Especially the bolded part pertains to you:
Universal groups can be used anywhere in the same Windows
forest. They are only available in a Native-mode enterprise. Universal
groups may be an easier approach for some administrators because there
are no intrinsic limitations on their use. Users ...
8
S3 has three ways to control access:
IAM
Bucket Policy
ACLs
I suspect you have a bucket policy that provides public access.
A bucket policy like this, which you haven't mentioned, would provide public access.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AddPerm",
"Effect": "Allow",
"Principal": "*",
...
8
Here’s a left-field idea.. you could “null-route” the 50 blocked IPs, by adding an “broken” route to the VPC route table for each IP.
This wouldn’t prevent the traffic from the IPs hitting your infrastructure (only the NACLs and the SGs will prevent that), but it’ll prevent the return traffic from every making it “back home”..
7
You can script this with icacls or set-acl.
As an aside, this is why you use security groups in ACLs and not individual users.
7
As it happens, HAProxy has a converter to decode the field, making sure that your ACL will always match a given string.
url_dec
Takes an url-encoded string provided as input and returns the
decoded version as output. The input and the output are of type
string.
You'd use it like this.
frontend example
acl restricted_page path_beg,url_dec -i /...
7
0.0.0.0/0 is IPv4 and ::/0 is the default route address for IPv6 covering all addresses.
6
Only these two answers worked for me:
In an Administrator Command Prompt:
C:\Windows\System32>takeown /r /d y /f f:\backup
C:\Windows\System32>icacls f:\backup /t /grant Everyone:(OI)(CI)F
(OI) is for future files and (CI) for future folders.
6
Publicly-routable IP addresses don't get rewritten when they pass through the NAT instance.
You'll need to leave the entire public Internet address space as permissible on the private subnet in the network ACLs. If the private subnet lacks an Internet gateway and its default route points to the NAT instance, public Internet addresses will only arrive ...
6
Your problem is the explicitly defined Deny delete permission in the "root" (properly called "grandparent") OU, and removing it should solve your problems. It's kind of hard to follow the exact OU structures and which permissions are explicit and which are inherited from your description (a picture is worth a thousands words), but it sounds like, to me:
...
6
Ryan Ries provided only partial solution, because it won't work on CNG keys. The following code will retrieve container name (hence, file name too) for CNG keys:
$signature = @"
[DllImport("Crypt32.dll", SetLastError = true, CharSet = CharSet.Auto)]
public static extern bool CertGetCertificateContextProperty(
IntPtr pCertContext,
uint dwPropId,
...
6
UDP is a "connectionless" protocol. If you send a packet and you don't get a rejection (via ICMP), it's considered successful. This is regardless of whether or not anything replies. I failure to receive on the remote end could be considered a problem with a high layer of comunication, e.g. DNS, but it's not a failure as far as UDP is concerned.
Contrast ...
5
--skip-base Skip files that only have the base ACL entries (owner, group, others).
--recursive List the ACLs of all files and directories recursively.
getfacl --recursive --skip-base .
Only top voted, non community-wiki answers of a minimum length are eligible
