Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.
30 votes
Accepted

Difference between 0.0.0.0/0 and ::/0 in access control lists

0.0.0.0/0 is the IPv4 everything - all possible IPv4 addresses. ::/0 is the IPv6 equivalent of that. You can, for example, allow IPv4 and disallow IPv6 or vice versa. @kasperd mentions: It should ...
user avatar
  • 802
28 votes

What does Apache's "Require all granted" really do?

I know it is an old post but I think that I can help more with a functional example that I always use! In apache 2.2 would be like: <Location /> Order deny, allow allow from ...
user avatar
23 votes
Accepted

HAProxy ACL multiple OR conditions

The test you appear to be wanting to impose is this: A && !(B || C) ...but that is not logically equivalent to what you've written, which is essentially this... (A && !B) || (A &...
user avatar
22 votes

linux/setfacl - Set all current/future files/directories in parent directory to 775 with specified owner/group

To go with your accepted answer ... You can combine those commands together as: sudo setfacl -Rm d:g:groupnamehere:rwx,g:groupnamehere:rwx /base/path/members/
user avatar
  • 509
16 votes

How do I match a wildcard host in ACL lists in HAproxy?

I feel that hdr_sub is better for your needs. I was using hdr_end for a while but it runs into the following problem: requests with port 80 usually get the port stripped so the host header looks like ...
user avatar
  • 161
15 votes

How do I match a wildcard host in ACL lists in HAproxy?

There are cases where you need to be explicit about this, such as handling redirects for wildcard SSL with multiple levels of subdomains. Matching end (hdr_end or -m end) or substring (hdr_sub or -m ...
user avatar
  • 1,449
14 votes
Accepted

How are Windows MachineKey Container File Name's Derived?

To solve your problem of finding which certificate goes with which key file for the purpose of modifying file system ACLs on the private key files, use this: PS C:\Users\Ryan> $Cert = Get-Item ...
user avatar
  • 54.8k
13 votes

How can I make an internet facing TFTP server secure?

You would make TFTP access over the internet secure the same way you'd make access to anything over the internet secure. By going through a VPN. Cisco's IP phones can be set up to use a VPN, and ...
user avatar
  • 53.2k
13 votes
Accepted

Apache2: allow/disallow access to a directory by time on day

You can deny access to certain directories depending on the time by placing the following code in your .htaccess file in the directory you want to control: RewriteCond %{TIME_HOUR} ^(13|14|15)$ ...
user avatar
11 votes
Accepted

Replace permission entries on all child objects using icacls

Want to reset NTFS permissions from the command line? Use this syntax: icacls "c:\users\jshipp\*" /q /c /t /reset This is the same as using the GUI command: Win7: Replace all child object ...
user avatar
  • 478
10 votes

How can I make an internet facing TFTP server secure?

Then you can't do it. You've rejected another protocol that permits authenticating the requestor (hcsteve's answer) and you've rejected a VPN which would have allowed TFTP to be tunneled through an ...
user avatar
  • 77.9k
10 votes
Accepted

what does the "ip" mean in ACLs?

Think looks like an ACL from a Cisco router or switch. Let's break it down: deny vs. permit is the action to take when the rest of the rule matches. In this case you want to block or drop the packets ...
user avatar
  • 5,497
8 votes
Accepted

Amazon S3 permissions don't specify public access however public can read objects

S3 has three ways to control access: IAM Bucket Policy ACLs I suspect you have a bucket policy that provides public access. A bucket policy like this, which you haven't mentioned, would provide ...
user avatar
  • 29.3k
8 votes

Working around an AWS network ACL rule limit

Here’s a left-field idea.. you could “null-route” the 50 blocked IPs, by adding an “broken” route to the VPC route table for each IP. This wouldn’t prevent the traffic from the IPs hitting your ...
user avatar
7 votes

How set ZFS ACL permissions on CentOS 6

As of ZFS on Linux version 0.6.3, ACLs are now supported. To enable them, you must set the acltype dataset property to the value posixacl, e.g.: zfs set acltype=posixacl tank/home If you haven't ...
user avatar
  • 2,996
7 votes
Accepted

Replace User within Active Directory File Server Share

You can script this with icacls or set-acl. As an aside, this is why you use security groups in ACLs and not individual users.
user avatar
  • 100k
7 votes
Accepted

Block specific URL in HAProxy / url-encoding

As it happens, HAProxy has a converter to decode the field, making sure that your ACL will always match a given string. url_dec Takes an url-encoded string provided as input and returns the ...
user avatar
  • 8,940
7 votes

Difference between 0.0.0.0/0 and ::/0 in access control lists

0.0.0.0/0 is IPv4 and ::/0 is the default route address for IPv6 covering all addresses.
user avatar
  • 1,948
6 votes

icacls granting access to all users on windows 7

Only these two answers worked for me: In an Administrator Command Prompt: C:\Windows\System32>takeown /r /d y /f f:\backup C:\Windows\System32>icacls f:\backup /t /grant Everyone:(OI)(CI)F (...
user avatar
6 votes

No acl on nfs mount in linux?

The ACL are used and active over NFS. Use the command nfs4_getfacl to show the ACL on an NFSv4 mount: $ nfs4_getfacl /tmp/test A::OWNER@:rwatTnNcCy A::alice@nfsdomain.org:rxtncy A::bob@nfsdomain.org:...
user avatar
6 votes
Accepted

Can't delete Active Directory object

Your problem is the explicitly defined Deny delete permission in the "root" (properly called "grandparent") OU, and removing it should solve your problems. It's kind of hard to follow the exact OU ...
user avatar
  • 53.2k
6 votes

How are Windows MachineKey Container File Name's Derived?

Ryan Ries provided only partial solution, because it won't work on CNG keys. The following code will retrieve container name (hence, file name too) for CNG keys: $signature = @" [DllImport("Crypt32....
user avatar
  • 6,319
6 votes

Haproxy: reject traffic by user agent from file

This question is old, but in case someone else runs into this problem: Your problem comes from the fact that tcp-request content runs before HAProxy has had time to receive/read any layer 7 data. ...
user avatar
  • 408
6 votes

Why do netcat scans for UDP ports always succeed?

UDP is a "connectionless" protocol. If you send a packet and you don't get a rejection (via ICMP), regardless of whether you get a reply or not, it's considered successful. Something quite ...
user avatar
  • 12.6k
6 votes
Accepted

How to set up AWS Network Access Control List for SSH to private subnet

The first thing is to define what some of the terms mean. NACLS - Network Access Control Lists, are a state-less packet filter applied at the subnet level. The 'state-less' aspect is important to ...
user avatar
  • 1,614
6 votes

Samba, Windows ACLs and unwanted executable bit

From the Samba manual: Consequently, there is no use for any of the three Unix executable bits that are present on a file in a Samba disk share. DOS files, however, have their own attributes ...
user avatar
  • 43.3k
5 votes

How to map Windows ACL to Linux ones on a CIFS share?

How to set up a CIFS Multiuser Mount CIFS is a session-based protocol. This means that the session runs with the privileges of the user who logged on for the CIFS session. Therefore, the normal way ...
user avatar
5 votes
Accepted

Grant account write access to specific attributes on Active Directory User object

While @sysdmin1138 answer was correct it's worth mentioning that changing the scope is not the only reason why things are missing from the view. There are things that invisible by default. Some ...
user avatar
  • 3,703
5 votes
Accepted

How to block external access to the DNS service running on a Cisco router?

!Deny DNS from Public ip access-list extended ACL-IN_FROM-WAN remark allow OpenDNS lookups permit udp 208.67.222.222 0.0.0.0 any eq domain permit tcp 208.67.220.220 0.0.0.0 any eq domain ...
user avatar
5 votes

Varnish ACLs Behind Load Balancer Based on Client's IP

This can be done using std.ip, assuming ClientIP header is already set in vcl_recv(). For example: vcl 4.0; import std; acl admin_net { "10.10.1.160/27"; } sub vcl_deliver { if (std.ip(req.http....
user avatar
  • 125

Only top scored, non community-wiki answers of a minimum length are eligible