30
votes
Accepted
Difference between 0.0.0.0/0 and ::/0 in access control lists
0.0.0.0/0 is the IPv4 everything - all possible IPv4 addresses.
::/0 is the IPv6 equivalent of that.
You can, for example, allow IPv4 and disallow IPv6 or vice versa.
@kasperd mentions:
It should ...
- 802
28
votes
What does Apache's "Require all granted" really do?
I know it is an old post but I think that I can help more with a functional example that I always use!
In apache 2.2 would be like:
<Location />
Order deny, allow
allow from ...
23
votes
Accepted
HAProxy ACL multiple OR conditions
The test you appear to be wanting to impose is this:
A && !(B || C)
...but that is not logically equivalent to what you've written, which is essentially this...
(A && !B) || (A &...
- 21.6k
22
votes
linux/setfacl - Set all current/future files/directories in parent directory to 775 with specified owner/group
To go with your accepted answer ...
You can combine those commands together as:
sudo setfacl -Rm d:g:groupnamehere:rwx,g:groupnamehere:rwx /base/path/members/
- 509
16
votes
How do I match a wildcard host in ACL lists in HAproxy?
I feel that hdr_sub is better for your needs. I was using hdr_end for a while but it runs into the following problem:
requests with port 80 usually get the port stripped so the host header looks like ...
- 161
15
votes
How do I match a wildcard host in ACL lists in HAproxy?
There are cases where you need to be explicit about this, such as handling redirects for wildcard SSL with multiple levels of subdomains.
Matching end (hdr_end or -m end) or substring (hdr_sub or -m ...
- 1,449
14
votes
Accepted
How are Windows MachineKey Container File Name's Derived?
To solve your problem of finding which certificate goes with which key file for the purpose of modifying file system ACLs on the private key files, use this:
PS C:\Users\Ryan> $Cert = Get-Item ...
- 54.8k
13
votes
How can I make an internet facing TFTP server secure?
You would make TFTP access over the internet secure the same way you'd make access to anything over the internet secure. By going through a VPN.
Cisco's IP phones can be set up to use a VPN, and ...
- 53.2k
13
votes
Accepted
Apache2: allow/disallow access to a directory by time on day
You can deny access to certain directories depending on the time by placing the following code in your .htaccess file in the directory you want to control:
RewriteCond %{TIME_HOUR} ^(13|14|15)$
...
- 9,526
11
votes
Accepted
Replace permission entries on all child objects using icacls
Want to reset NTFS permissions from the command line? Use this syntax:
icacls "c:\users\jshipp\*" /q /c /t /reset
This is the same as using the GUI command:
Win7: Replace all child object ...
- 478
10
votes
How can I make an internet facing TFTP server secure?
Then you can't do it. You've rejected another protocol that permits authenticating the requestor (hcsteve's answer) and you've rejected a VPN which would have allowed TFTP to be tunneled through an ...
- 77.9k
10
votes
Accepted
what does the "ip" mean in ACLs?
Think looks like an ACL from a Cisco router or switch. Let's break it down:
deny vs. permit is the action to take when the rest of the rule matches. In this case you want to block or drop the packets ...
- 5,497
8
votes
Accepted
Amazon S3 permissions don't specify public access however public can read objects
S3 has three ways to control access:
IAM
Bucket Policy
ACLs
I suspect you have a bucket policy that provides public access.
A bucket policy like this, which you haven't mentioned, would provide ...
- 29.3k
8
votes
Working around an AWS network ACL rule limit
Here’s a left-field idea.. you could “null-route” the 50 blocked IPs, by adding an “broken” route to the VPC route table for each IP.
This wouldn’t prevent the traffic from the IPs hitting your ...
7
votes
How set ZFS ACL permissions on CentOS 6
As of ZFS on Linux version 0.6.3, ACLs are now supported.
To enable them, you must set the acltype dataset property to the value posixacl, e.g.:
zfs set acltype=posixacl tank/home
If you haven't ...
- 2,996
7
votes
Accepted
Replace User within Active Directory File Server Share
You can script this with icacls or set-acl.
As an aside, this is why you use security groups in ACLs and not individual users.
- 100k
7
votes
Accepted
Block specific URL in HAProxy / url-encoding
As it happens, HAProxy has a converter to decode the field, making sure that your ACL will always match a given string.
url_dec
Takes an url-encoded string provided as input and returns the
...
- 8,940
7
votes
Difference between 0.0.0.0/0 and ::/0 in access control lists
0.0.0.0/0 is IPv4 and ::/0 is the default route address for IPv6 covering all addresses.
- 1,948
6
votes
icacls granting access to all users on windows 7
Only these two answers worked for me:
In an Administrator Command Prompt:
C:\Windows\System32>takeown /r /d y /f f:\backup
C:\Windows\System32>icacls f:\backup /t /grant Everyone:(OI)(CI)F
(...
- 222
6
votes
No acl on nfs mount in linux?
The ACL are used and active over NFS. Use the command nfs4_getfacl to show the ACL on an NFSv4 mount:
$ nfs4_getfacl /tmp/test
A::OWNER@:rwatTnNcCy
A::alice@nfsdomain.org:rxtncy
A::bob@nfsdomain.org:...
- 724
6
votes
Accepted
Can't delete Active Directory object
Your problem is the explicitly defined Deny delete permission in the "root" (properly called "grandparent") OU, and removing it should solve your problems. It's kind of hard to follow the exact OU ...
- 53.2k
6
votes
How are Windows MachineKey Container File Name's Derived?
Ryan Ries provided only partial solution, because it won't work on CNG keys. The following code will retrieve container name (hence, file name too) for CNG keys:
$signature = @"
[DllImport("Crypt32....
- 6,319
6
votes
Haproxy: reject traffic by user agent from file
This question is old, but in case someone else runs into this problem:
Your problem comes from the fact that tcp-request content runs before HAProxy has had time to receive/read any layer 7 data.
...
- 408
6
votes
Why do netcat scans for UDP ports always succeed?
UDP is a "connectionless" protocol. If you send a packet and you don't get a rejection (via ICMP), regardless of whether you get a reply or not, it's considered successful. Something quite ...
- 12.6k
6
votes
Accepted
How to set up AWS Network Access Control List for SSH to private subnet
The first thing is to define what some of the terms mean.
NACLS - Network Access Control Lists, are a state-less packet filter applied at the subnet level. The 'state-less' aspect is important to ...
- 1,614
6
votes
Samba, Windows ACLs and unwanted executable bit
From the Samba manual:
Consequently, there is no use for any of the three Unix executable
bits that are present on a file in a Samba disk share. DOS files,
however, have their own attributes ...
- 43.3k
5
votes
How to map Windows ACL to Linux ones on a CIFS share?
How to set up a CIFS Multiuser Mount
CIFS is a session-based protocol. This means that the session runs with the privileges of the user who logged on for the CIFS session. Therefore, the normal way ...
- 171
5
votes
Accepted
Grant account write access to specific attributes on Active Directory User object
While @sysdmin1138 answer was correct it's worth mentioning that changing the scope is not the only reason why things are missing from the view. There are things that invisible by default.
Some ...
- 3,703
5
votes
Accepted
How to block external access to the DNS service running on a Cisco router?
!Deny DNS from Public
ip access-list extended ACL-IN_FROM-WAN
remark allow OpenDNS lookups
permit udp 208.67.222.222 0.0.0.0 any eq domain
permit tcp 208.67.220.220 0.0.0.0 any eq domain
...
- 66
5
votes
Varnish ACLs Behind Load Balancer Based on Client's IP
This can be done using std.ip, assuming ClientIP header is already set in vcl_recv(). For example:
vcl 4.0;
import std;
acl admin_net {
"10.10.1.160/27";
}
sub vcl_deliver {
if (std.ip(req.http....
- 125
Only top scored, non community-wiki answers of a minimum length are eligible