30
votes
Accepted
Difference between 0.0.0.0/0 and ::/0 in access control lists
0.0.0.0/0 is the IPv4 everything - all possible IPv4 addresses.
::/0 is the IPv6 equivalent of that.
You can, for example, allow IPv4 and disallow IPv6 or vice versa.
@kasperd mentions:
It should ...
- 822
28
votes
What does Apache's "Require all granted" really do?
In Apache 2.2 would be like:
<Location />
Order deny, allow
allow from all
</Location>
<Location /adm>
Order deny, allow
deny from all
allow from myniceip
</...
27
votes
Accepted
HAProxy ACL multiple OR conditions
The test you appear to be wanting to impose is this:
A && !(B || C)
...but that is not logically equivalent to what you've written, which is essentially this...
(A && !B) || (A &...
- 22.7k
26
votes
linux/setfacl - Set all current/future files/directories in parent directory to 775 with specified owner/group
To go with your accepted answer ...
You can combine those commands together as:
sudo setfacl -Rm d:g:groupnamehere:rwx,g:groupnamehere:rwx /base/path/members/
- 549
18
votes
How do I match a wildcard host in ACL lists in HAproxy?
There are cases where you need to be explicit about this, such as handling redirects for wildcard SSL with multiple levels of subdomains.
Matching end (hdr_end or -m end) or substring (hdr_sub or -m ...
- 1,599
18
votes
How do I match a wildcard host in ACL lists in HAproxy?
I feel that hdr_sub is better for your needs. I was using hdr_end for a while but it runs into the following problem:
requests with port 80 usually get the port stripped so the host header looks like ...
- 181
13
votes
Accepted
Apache2: allow/disallow access to a directory by time on day
You can deny access to certain directories depending on the time by placing the following code in your .htaccess file in the directory you want to control:
RewriteCond %{TIME_HOUR} ^(13|14|15)$
...
- 9,556
10
votes
Accepted
what does the "ip" mean in ACLs?
Think looks like an ACL from a Cisco router or switch. Let's break it down:
deny vs. permit is the action to take when the rest of the rule matches. In this case you want to block or drop the packets ...
- 5,627
8
votes
Accepted
Block specific URL in HAProxy / url-encoding
As it happens, HAProxy has a converter to decode the field, making sure that your ACL will always match a given string.
url_dec
Takes an url-encoded string provided as input and returns the
...
- 9,390
8
votes
Why do netcat scans for UDP ports always succeed?
UDP is a "connectionless" protocol. If you send a packet and you don't get a rejection (via ICMP), regardless of whether you get a reply or not, it's considered successful. Something quite ...
- 12.9k
8
votes
Accepted
Amazon S3 permissions don't specify public access however public can read objects
S3 has three ways to control access:
IAM
Bucket Policy
ACLs
I suspect you have a bucket policy that provides public access.
A bucket policy like this, which you haven't mentioned, would provide ...
- 31.9k
8
votes
Working around an AWS network ACL rule limit
Here’s a left-field idea.. you could “null-route” the 50 blocked IPs, by adding an “broken” route to the VPC route table for each IP.
This wouldn’t prevent the traffic from the IPs hitting your ...
7
votes
Haproxy: reject traffic by user agent from file
This question is old, but in case someone else runs into this problem:
Your problem comes from the fact that tcp-request content runs before HAProxy has had time to receive/read any layer 7 data.
...
- 418
7
votes
How set ZFS ACL permissions on CentOS 6
As of ZFS on Linux version 0.6.3, ACLs are now supported.
To enable them, you must set the acltype dataset property to the value posixacl, e.g.:
zfs set acltype=posixacl tank/home
If you haven't ...
- 3,096
7
votes
Difference between 0.0.0.0/0 and ::/0 in access control lists
0.0.0.0/0 is IPv4 and ::/0 is the default route address for IPv6 covering all addresses.
- 2,019
6
votes
icacls granting access to all users on windows 7
Only these two answers worked for me:
In an Administrator Command Prompt:
C:\Windows\System32>takeown /r /d y /f f:\backup
C:\Windows\System32>icacls f:\backup /t /grant Everyone:(OI)(CI)F
(...
- 222
6
votes
How to map Windows ACL to Linux ones on a CIFS share?
How to set up a CIFS Multiuser Mount
CIFS is a session-based protocol. This means that the session runs with the privileges of the user who logged on for the CIFS session. Therefore, the normal way ...
- 191
6
votes
How to properly insert a set of olcAccess attributes to the configuration of an OpenLDAP database?
Another, much easier, answer is to use the ldapvi command to edit the olcAccess entries:
ldapvi -h ldapi:// -Y EXTERNAL -b cn=config
It dumps all of cn=config into VIM, lets you edit it at your ...
- 86
6
votes
Accepted
How to set up AWS Network Access Control List for SSH to private subnet
The first thing is to define what some of the terms mean.
NACLS - Network Access Control Lists, are a state-less packet filter applied at the subnet level. The 'state-less' aspect is important to ...
- 1,704
6
votes
Samba, Windows ACLs and unwanted executable bit
From the Samba manual:
Consequently, there is no use for any of the three Unix executable
bits that are present on a file in a Samba disk share. DOS files,
however, have their own attributes ...
- 47.9k
6
votes
Accepted
How NTFS folder access is checked in a Active Directory domain?
During logon/authentication/authorization check, the security group memberships are added to the Privilege Access Certificate (PAC) part of the Kerberos token. This includes nested groups.
When a ...
- 35.9k
6
votes
How NTFS folder access is checked in a Active Directory domain?
Let's start from the link you provided (emphasis mine) :
The system compares the trustee in each ACE to the trustees identified in the thread's access token. An access token contains security ...
- 6,750
5
votes
Varnish ACLs Behind Load Balancer Based on Client's IP
This can be done using std.ip, assuming ClientIP header is already set in vcl_recv(). For example:
vcl 4.0;
import std;
acl admin_net {
"10.10.1.160/27";
}
sub vcl_deliver {
if (std.ip(req.http....
- 124
5
votes
Accepted
Grant account write access to specific attributes on Active Directory User object
While @sysdmin1138 answer was correct it's worth mentioning that changing the scope is not the only reason why things are missing from the view. There are things that invisible by default.
Some ...
- 3,725
5
votes
SysWOW64 access denied (Windows Server 2012 Standard)
Erm... You can't delete active files like this. You called a 64 bit powershell instance to delete a module for the 64bit shell. Powershell preloads modules (but doesn't necessarily install them) ...
- 2,397
5
votes
Accepted
Why do netcat scans for UDP ports always succeed?
nc may not be the best tool for testing port status. Have you tried nmap? It's actually a port scanner. I checked a file server on my home network and 127.0.0.1, both report that UDP port 40000 is ...
- 6,270
5
votes
Accepted
How does URL reservation actually work in Windows, particularly the ACLs?
Each URL access control list (ACL) reserves a portion of the HTTP URL namespace for a particular group of users. The reservation gives those users the right to create services that listen on that ...
- 165
4
votes
How can I add ACL permissions for IIS APPPOOL\* accounts via Powershell?
As of IIS 10/Windows 10/Server 2016, the WebAdministration module is deprecated and we're expected to use the new IISAdministration Powershell module instead. Here's how to get the application pool ...
- 211
4
votes
Accepted
How to specify GNU screen ACL as part of its command line?
Put the ACLs in a seperate screenrc and load that with -c:
e.g.: /opt/multi-screen-rc
multiuser on
acladd user1
acladd user2
Then run like this:
screen -c /opt/multi-screen-rc -dmS MySession /usr/...
- 9,609
4
votes
Accepted
Read permission denied to user with ACL group permission to read
The answer lies in that the user group must have listing, or execute, permissions on every folder leading up to the folder containing the file.
In other words the solution was the following:
$ sudo ...
- 609
Only top scored, non community-wiki answers of a minimum length are eligible