30 votes
Accepted

Difference between 0.0.0.0/0 and ::/0 in access control lists

0.0.0.0/0 is the IPv4 everything - all possible IPv4 addresses. ::/0 is the IPv6 equivalent of that. You can, for example, allow IPv4 and disallow IPv6 or vice versa. @kasperd mentions: It should ...
bocian85's user avatar
  • 822
28 votes

What does Apache's "Require all granted" really do?

In Apache 2.2 would be like: <Location /> Order deny, allow allow from all </Location> <Location /adm> Order deny, allow deny from all allow from myniceip </...
Luciano Andress Martini's user avatar
27 votes
Accepted

HAProxy ACL multiple OR conditions

The test you appear to be wanting to impose is this: A && !(B || C) ...but that is not logically equivalent to what you've written, which is essentially this... (A && !B) || (A &...
Michael - sqlbot's user avatar
26 votes

linux/setfacl - Set all current/future files/directories in parent directory to 775 with specified owner/group

To go with your accepted answer ... You can combine those commands together as: sudo setfacl -Rm d:g:groupnamehere:rwx,g:groupnamehere:rwx /base/path/members/
Joshua's user avatar
  • 549
18 votes

How do I match a wildcard host in ACL lists in HAproxy?

There are cases where you need to be explicit about this, such as handling redirects for wildcard SSL with multiple levels of subdomains. Matching end (hdr_end or -m end) or substring (hdr_sub or -m ...
gregmac's user avatar
  • 1,599
18 votes

How do I match a wildcard host in ACL lists in HAproxy?

I feel that hdr_sub is better for your needs. I was using hdr_end for a while but it runs into the following problem: requests with port 80 usually get the port stripped so the host header looks like ...
Rj Wilson's user avatar
  • 181
13 votes
Accepted

Apache2: allow/disallow access to a directory by time on day

You can deny access to certain directories depending on the time by placing the following code in your .htaccess file in the directory you want to control: RewriteCond %{TIME_HOUR} ^(13|14|15)$ ...
Anthony Fornito's user avatar
10 votes
Accepted

what does the "ip" mean in ACLs?

Think looks like an ACL from a Cisco router or switch. Let's break it down: deny vs. permit is the action to take when the rest of the rule matches. In this case you want to block or drop the packets ...
Tommiie's user avatar
  • 5,627
8 votes
Accepted

Block specific URL in HAProxy / url-encoding

As it happens, HAProxy has a converter to decode the field, making sure that your ACL will always match a given string. url_dec Takes an url-encoded string provided as input and returns the ...
GregL's user avatar
  • 9,390
8 votes

Why do netcat scans for UDP ports always succeed?

UDP is a "connectionless" protocol. If you send a packet and you don't get a rejection (via ICMP), regardless of whether you get a reply or not, it's considered successful. Something quite ...
84104's user avatar
  • 12.9k
8 votes
Accepted

Amazon S3 permissions don't specify public access however public can read objects

S3 has three ways to control access: IAM Bucket Policy ACLs I suspect you have a bucket policy that provides public access. A bucket policy like this, which you haven't mentioned, would provide ...
Tim's user avatar
  • 31.9k
8 votes

Working around an AWS network ACL rule limit

Here’s a left-field idea.. you could “null-route” the 50 blocked IPs, by adding an “broken” route to the VPC route table for each IP. This wouldn’t prevent the traffic from the IPs hitting your ...
Funky Penguin's user avatar
7 votes

Haproxy: reject traffic by user agent from file

This question is old, but in case someone else runs into this problem: Your problem comes from the fact that tcp-request content runs before HAProxy has had time to receive/read any layer 7 data. ...
liquidity's user avatar
  • 418
7 votes

How set ZFS ACL permissions on CentOS 6

As of ZFS on Linux version 0.6.3, ACLs are now supported. To enable them, you must set the acltype dataset property to the value posixacl, e.g.: zfs set acltype=posixacl tank/home If you haven't ...
asciiphil's user avatar
  • 3,096
7 votes

Difference between 0.0.0.0/0 and ::/0 in access control lists

0.0.0.0/0 is IPv4 and ::/0 is the default route address for IPv6 covering all addresses.
deagh's user avatar
  • 2,019
6 votes

icacls granting access to all users on windows 7

Only these two answers worked for me: In an Administrator Command Prompt: C:\Windows\System32>takeown /r /d y /f f:\backup C:\Windows\System32>icacls f:\backup /t /grant Everyone:(OI)(CI)F (...
Cees Timmerman's user avatar
6 votes

How to map Windows ACL to Linux ones on a CIFS share?

How to set up a CIFS Multiuser Mount CIFS is a session-based protocol. This means that the session runs with the privileges of the user who logged on for the CIFS session. Therefore, the normal way ...
ManuelAtWork's user avatar
6 votes

How to properly insert a set of olcAccess attributes to the configuration of an OpenLDAP database?

Another, much easier, answer is to use the ldapvi command to edit the olcAccess entries: ldapvi -h ldapi:// -Y EXTERNAL -b cn=config It dumps all of cn=config into VIM, lets you edit it at your ...
TexasDex's user avatar
6 votes
Accepted

How to set up AWS Network Access Control List for SSH to private subnet

The first thing is to define what some of the terms mean. NACLS - Network Access Control Lists, are a state-less packet filter applied at the subnet level. The 'state-less' aspect is important to ...
Alex Moore's user avatar
  • 1,704
6 votes

Samba, Windows ACLs and unwanted executable bit

From the Samba manual: Consequently, there is no use for any of the three Unix executable bits that are present on a file in a Samba disk share. DOS files, however, have their own attributes ...
shodanshok's user avatar
  • 47.9k
6 votes
Accepted

How NTFS folder access is checked in a Active Directory domain?

During logon/authentication/authorization check, the security group memberships are added to the Privilege Access Certificate (PAC) part of the Kerberos token. This includes nested groups. When a ...
Greg Askew's user avatar
  • 35.9k
6 votes

How NTFS folder access is checked in a Active Directory domain?

Let's start from the link you provided (emphasis mine) : The system compares the trustee in each ACE to the trustees identified in the thread's access token. An access token contains security ...
Swisstone's user avatar
  • 6,750
5 votes

Varnish ACLs Behind Load Balancer Based on Client's IP

This can be done using std.ip, assuming ClientIP header is already set in vcl_recv(). For example: vcl 4.0; import std; acl admin_net { "10.10.1.160/27"; } sub vcl_deliver { if (std.ip(req.http....
Andrei's user avatar
  • 124
5 votes
Accepted

Grant account write access to specific attributes on Active Directory User object

While @sysdmin1138 answer was correct it's worth mentioning that changing the scope is not the only reason why things are missing from the view. There are things that invisible by default. Some ...
MadBoy's user avatar
  • 3,725
5 votes

SysWOW64 access denied (Windows Server 2012 Standard)

Erm... You can't delete active files like this. You called a 64 bit powershell instance to delete a module for the 64bit shell. Powershell preloads modules (but doesn't necessarily install them) ...
Colyn1337's user avatar
  • 2,397
5 votes
Accepted

Why do netcat scans for UDP ports always succeed?

nc may not be the best tool for testing port status. Have you tried nmap? It's actually a port scanner. I checked a file server on my home network and 127.0.0.1, both report that UDP port 40000 is ...
Ryan Babchishin's user avatar
5 votes
Accepted

How does URL reservation actually work in Windows, particularly the ACLs?

Each URL access control list (ACL) reserves a portion of the HTTP URL namespace for a particular group of users. The reservation gives those users the right to create services that listen on that ...
Simon Biber's user avatar
4 votes

How can I add ACL permissions for IIS APPPOOL\* accounts via Powershell?

As of IIS 10/Windows 10/Server 2016, the WebAdministration module is deprecated and we're expected to use the new IISAdministration Powershell module instead. Here's how to get the application pool ...
Chris Doherty's user avatar
4 votes
Accepted

How to specify GNU screen ACL as part of its command line?

Put the ACLs in a seperate screenrc and load that with -c: e.g.: /opt/multi-screen-rc multiuser on acladd user1 acladd user2 Then run like this: screen -c /opt/multi-screen-rc -dmS MySession /usr/...
fuero's user avatar
  • 9,609
4 votes
Accepted

Read permission denied to user with ACL group permission to read

The answer lies in that the user group must have listing, or execute, permissions on every folder leading up to the folder containing the file. In other words the solution was the following: $ sudo ...
Rovanion's user avatar
  • 609

Only top scored, non community-wiki answers of a minimum length are eligible