Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [access-control]

The tag has no usage guidance.

0
votes
0answers
15 views

Restrict user to specific directories only for scp and not ssh

How can i restrict specific user when using secure copy protocol to access only specific directories without restricting him with ssh? Need to do so for a project i'm working on, and i done have any ...
0
votes
1answer
21 views

NT_STATUS_ACCESS_DENIED listing \* when moving home directories to another location

I have a server and just finished building my raids. One of the partitions is supposed to house my home folders which I then want to share with my windows computers through samba. Before I begin ...
0
votes
1answer
84 views

su: cannot open session: Permission denied

I'm getting "access denied" attempting to login as root on the console and via ssh (Yes, I know root ssh access should be disabled - I've just inherited this box). I can login as non-root user who has ...
0
votes
0answers
19 views

Restricting user access to command with specific flags

Is there a way to restrict a user's access so that they can still execute a command, but only with a particular flag? For example, if I want to allow users to be able to read all files, they should ...
7
votes
2answers
999 views

Restarting systemd service only as a specific user?

I created some systemd services which basically works: location: /etc/systemd/system/multi-user.target.wants/publicapi.service content: [Unit] Description=public api startup script [Service] ...
1
vote
0answers
17 views

Can I limit a process's access to specified files and stdout only without root?

I want to setup a server for students to upload C code. The server compiles C code, run the binary and shows output to students. Now I am having security concern. Students can upload any code, but I ...
2
votes
1answer
46 views

Keep access to a file after sudo

user1 runs sudo -u user2 SomeCommand. I want SomeCommand to be able to access the files of user1 (or just a specific directory or even a single file, if that's easier), without giving access to user2 (...
2
votes
1answer
272 views

Restrict local port access to a specific user

I'm trying to restrict access to a particular port for a particular user on my Debian. Let's say user's id is 1000 and port I would like to block is 5000. I tried using iptables with the following ...
0
votes
1answer
37 views

Who have previously accessed a shared file?

I just discovered a mistake in the permissions setting of our system. It's kind of serious because it allows normal users to access something they shouldn't see. Currently the mistake has been fixed, ...
0
votes
0answers
73 views

Allow www-data to read files from NFS share

I have a virtual machine in a larger Linux network (with unified UIDS/GIDS) that has mounted an NFS share from a fileserver. I want to run a small nodejs server application on that machine. For ...
1
vote
1answer
65 views

Can a linux user access to a file in this case?

This is a theoretical question. I'm using a linux system with two users: root and nonRoot. I'm debugging an application as nonRoot, that uses a file placed in the following path: /home/nonRootFolder/...
0
votes
1answer
121 views

monit, http access with four different credentials types, one using PAM

monit 5.25.2 These are our credential settings: set httpd port 2812 allow localhost allow guest:guest read-only allow @wheel allow cleartext /opt/monit/htpasswd Rationale: localhost to enable ...
0
votes
2answers
39 views

How to have access to script variables and environmental variables inside a sudo/EOF clause in a script…BASH

PROBLEM: I am struggling with this cp always giving errors because the variables not there... Here is my code: if [ ! -z "$USER1" ] then sudo -u "$USER1" bash <<'EOF' sleep 5 ...
1
vote
1answer
1k views

How do I chmod or chown a file so that anybody in the world can access it? [duplicate]

.I have a font file which I created using a python script from Github. The owner and group are root. I don't actually know what this means... I can guess what owner means, and I can guess that a group ...
2
votes
1answer
54 views

Isolate/prevent files from being accessed by untrusted processes

Goal To defend against malware (or even compromised open source libraries) that would scan the filesystem and exfiltrate data. Question I have a certain path in my filesystem that I want only a ...
1
vote
1answer
70 views

How to deny other people to see my running details after “top” command and press key “c”

In my school, we share one server to run programs. Using top we can see the situation of the server, if press key c, we even can see the command details, somehow including my lab data information. ...
0
votes
1answer
175 views

Give program access to only directories below cwd

Say I run a program like so: cd foo && program x y z How can I give program access to only the directories in foo and below? Pretend my fs looks like: $HOME/ foo/ bar/ baz/ if I run ...
1
vote
0answers
60 views

How does one grant access to directories with SELinux's sandbox utility?

I'm trying to run Tor Browser Bundle within an SELinux sandbox. I tried to do the following, after looking at man sandbox: $ sandbox -X -H sehome -T tmp -I /run/user/1000/dbus-1/* \ -t ...
1
vote
2answers
57 views

Why can't I connect to mysql via the browser but via the terminal with php?

I would like to display a MySQL table in the browser with PHP and created the file demo-db.php <!DOCTYPE html> <html> <body> <?php $servername = "localhost"; $username = "...
2
votes
1answer
2k views

How to create a symbolic link from one user directory to anothers?

I have 3 users: admin with sudo, and two normal users - user1 and user2. user2 is under user1 group. There is a folder fold1 as /home/user1/fold1 which is under the group user1 with read and write ...
1
vote
1answer
3k views

Permission denied on files in a directory on a CIFS-mounted Windows share in Linux

I can successfully mount a windows share over the network from my Raspberry/Jessie with both, mount.cifs and fstab entrye then mount -a. E.g. sudo mount.cifs //HPSERVER/linux-bup/ /home/maxg/...
0
votes
0answers
109 views

(AppArmor) Does allowing a confined program to execute another binary unconfined ruin security?

I have recently tried to get to know SELinux and AppArmor and then decided to use AppArmor for its simplicity. I started writing some profiles using aa-genprof and aa-logprof but big programs like ...
-2
votes
1answer
41 views

directory access permission seemingly inconsistent

I want to grant new users access to a directory owned by root. "ls -lt" returns drw-rw-rw- 74 root root 4096 Mar 21 20:51 dirname My old user can cd into it. However, when I ...
0
votes
4answers
796 views

Can I restrict a user with root privileges(with sudo) from accessing/deleting a specific file?

I want to keep a log-file on my computer. I also want to give privileges to a different account to do all sorts of system specific jobs such as mount volume/install packages etc. So that user has to ...
0
votes
1answer
28 views

cd fails when trying to enter maldetect version-agnostic directory

I'm installing Maldet on Debian 9.3: cd /usr/local/src wget http://www.rfxn.com/downloads/maldetect-current.tar.gz tar -xzvf maldetect-current.tar.gz cd maldetect-* bash ./install.sh While doing cd ...
-1
votes
1answer
10k views

Getting “Permission denied” even though I have set global read permissions on a file

I'm using Amazon Linux. I have set global read permissions on a file, but I can't seem to access it as a normal user: [myuser@mymachine ~]$ ls -al /usr/java/jboss/standalone/deployments/myproject.war/...
2
votes
1answer
226 views

CAP_DAC_OVERRIDE and other permisions

Who can see the content of my directory other than root? What is CAP_DAC_OVERRIDE? Can sysadmin give this privilege to my content to some user? My understanding is someone who has CAP_DAC_OVERRIDE ...
3
votes
2answers
491 views

Can I disable command execution in find

I have been asked to provide access to a stack of RedHat EL servers to an external discovery tool (and no is not an option). This tool requires access to a list of commands via sudo. Most of those are ...
-2
votes
2answers
2k views

Removing user access to some directories

In my Unix system, there is a user which has access to multiple (but not all) subdirectories of /home/. How can I remove access to most directories for this user? I've looked in /etc/groups, but didn'...
3
votes
1answer
111 views

SSH account locking reveals real users

On my ssh server, I'm trying to hide the existence of all the users except for one. For any user besides that one user, I will get a Password: prompt which will never allow the user to enter. That's ...
1
vote
0answers
1k views

How can I block ssh access to users with pam?

I've been poking around /etc/ssh/sshd_config for the last week or so, trying to figure out how to block ssh access to all users besides myself. My goal is for it to be impossible for all users except ...
1
vote
0answers
161 views

Correct configuration of nginx for rewrite and access control

Here is my current nginx config server_name web.com; server_tokens off; root /usr/share/nginx/html/web; index index.php; if ( $request_uri ~ "/index.(php|html?)" ) { rewrite ^ /$1 permanent; } ...
0
votes
1answer
44 views

Running unknown apps securely

What would be the fastest way to run unknown scripts and apps in *nix environments? For example, to forbid writing and reading outside the working directory. Or to restrict access to hardware and ...
1
vote
0answers
32 views

Password protect a program without system accounts

we have a Linux system with a program to control a machine. We want to restrict and log access to this program with some kind of user/password combination, but I don't want to create a new user ...
0
votes
0answers
42 views

User directory logged out while logged in

I'm having this really weird issue sometimes where I be logged in to my user account, and then suddenly unexpectedly I get bunch of errors popping up because whatever application I'm using can't ...
0
votes
1answer
99 views

Restrict the access of an account in linux?

I've created a service account in my Redhat machine. The purpose of the account is to execute the bash script which I had created. The bash script basically checks the system properties like cpuinfo,...
2
votes
0answers
47 views

set ACL by NFS V4 IBM

I have the following directories and files: /project/ src/ test.txt temp.xls data/ data.xls The owner is always mytu and the Group is mytug. Now there is a user (e.g. user1) woh is ...
4
votes
2answers
400 views

Prevent already running process to write to an existing file

I have a process P which writes contents to a file F. I need to be able to dynamically enable/disable P to write to F. I tried changing the permissions for the user/group but this requires the process ...
0
votes
1answer
68 views

File permissions for root

So file permissions are divided into three parts, for example: -rwxr--r-x I understand that the order is the following: owner, group, others But, can root do anything with the file even if there is ...
21
votes
1answer
1k views

Are SELinux rules enforced before or after standard linux permissions?

When SELinux is installed on a system are its rules enforced before or after the standard linux permissions? For example if a non-root linux user tries to write to a file with linux permission -rw-----...
1
vote
0answers
40 views

Azure Ubuntu server not accessible from remote machine

I have setup WildFly and mySQL so many times and they are easily accessible from browser or mySQL workbench. I recently purchased an Azure server and setup WildFly and mySQL on that as usual. But ...
2
votes
1answer
62 views

Disable accounts and print info message on attempted login

Other people log into my Raspberry Pi via SSH. It runs Ubuntu Mate 16.04 with OpenSSH. I want to disable some of the accounts but not delete them. Now, I could just delete the passwords (which ...
1
vote
1answer
66 views

filesystem/directory merging mount points as layers

I am looking for a way to implement filesystem files/directories access layers. So I could have this structure ex.: /mountPointMerged/ /mountPointLayer1/a/b/c.txt /mountPointLayer2/a/b/c.txt /...
3
votes
1answer
191 views

Let a process read and write all files inside a certain directory, at any depth

I have a directory, owned by me (e.g. /sync), and a process, run by me, which I want to have full read&write access to this directory (in my case the process is Resilio Sync, formerly known as ...
1
vote
1answer
86 views

Set some grub unprotected

Im trying to set an administration password to just some of the entries of the grub.So far I manage to set a password to every entry to the grub by editing the /etc/grub/01_users files. So now, I need ...
1
vote
0answers
381 views

Software for time based access control of WiFi hotspots

I'm looking for a very simple WiFi hotspot control software which allows internet access to clients for a certain period of time. After the time limit is expired, it blocks access to clients based on ...
0
votes
3answers
805 views

Changing group in shell

Simple enough. I have user foo. foo belongs to groups foo (main), audio, A, B and common. Normally files are created with ownership foo.foo. For a while I would like foo to create files with group ...
0
votes
1answer
622 views

Allow to run a python script but not allow to read its content

I want to demonstrate a client how my python script works on my server to which I'll give him access. Also, I don't want him to be able to see the code of the python script, only run it. Is it ...
1
vote
0answers
53 views

How to install remote public X server without compromising machine running it?

I currently have headless rsyslog/network monitoring server which is kind of critical in terms of security and access control. On the other hand this machine stays relatively close to presentation ...
1
vote
1answer
568 views

Is it MAC or DAC

I am having trouble seeing the utility or use of the LSM attribute/caps implementations. I've put together a pseudo code snippet of sorts to try to express my concern and question. It's modeled ...