Questions tagged [access-control]
The access-control tag has no usage guidance, but it has a tag wiki.
180
questions
1
vote
3
answers
57
views
How to restrict user login for specific IP-address (private address)?
I have two users on my ssh-server machine, user_A and user_B. user_B is permitted to log in with private key only for security reasons, because he needs to log in from remote. All this works.
My ...
- 13
1
vote
1
answer
54
views
Restrict access to SocketCAN to a certain user group
I have a PC to which a robot is connected via CAN (using SocketCAN). I'd like to control who can send commands to the robot, ideally through a group (i.e. only users who are in the "use_robot&...
- 181
0
votes
0
answers
29
views
Accessing OneDrive Folder on ElementaryOS
I have a computer with Windows 11 and Elementary OS 7. I can't access my OneDrive folder. I tried fsutil reparsepoint delete "C:\Path\To\OneDrive\Folder" but it output an access permission ...
3
votes
1
answer
105
views
What effect has "+:ALL:cron crond" in /etc/security/access.conf?
I am refining our rules in /etc/securiy/access.conf. I found the following rule and I am not sure what it is used for:
+:ALL:cron crond
According to the man page of access.conf it means something ...
0
votes
1
answer
43
views
What is the best way to manage multiple access using same user?
Scenario:
We have a couple of Ubuntu servers, each with a single user.
The user account has some specific software that bind to the host IP address and a specific port (we cannot change the port ...
- 109
0
votes
1
answer
194
views
Limiting sudo access for certain tasks
I am trying to implement an functionality where I need to limit the acccess of user that currently has sudo permissions to certain processes or files. I need the user to be able to certain tasks like ...
0
votes
0
answers
24
views
Why is ACL default:other field showing a different value from Linux's own 'other' field?
So I have set a default ACL on a folder so that:
# file: Accounting/
# owner: ivan
# group: accounting
# flags: --t
user::rwx
group::r-x
other::---
default:user::rwx
default:group::r-x
default:group:...
- 101
0
votes
0
answers
30
views
How to allow every admin access except viewing and editing a single directory?
We have some servers running our web application as well as nginx, redis and a few other services. I want to grant access to these servers to a system administrator to manage these systems, but I want ...
- 145
1
vote
1
answer
2k
views
Access denied for rsyslog
Good Morning,
I am trying to sends Zeek logs to another host on my local network with rsyslog.
So far I have a configuration file in /etc/rsyslog.d which looks like this :
module(load="imfile&...
- 33
0
votes
0
answers
328
views
Read access for Nginx, write access for developers
What are the best-practice permissions one should set in this scenario?
The document root is owned by the PHP-FPM user ("website user") who needs to be able to read and write folders+files ...
- 111
1
vote
0
answers
273
views
Setting ACL recursive execute permission on a folder makes files executable
Running Ubuntu 20.04 LTS running Nginx 1.18.0 and PHP-FPM to serve a website.
I create a new folder as document root in /var/www, owned by the the FPM user foo, that will host a site:
$ sudo mkdir foo
...
- 111
0
votes
1
answer
609
views
restrict sudo user acess to file/folder
First, sorry in advance, I know there are a billion of these questions but nothing worked for me...
I got a certain file in a directory that shall not be deleted by a sudo user. I know that sudo is ...
user541118
2
votes
1
answer
155
views
Restrict User Functions to only "su" to other users
I have a server running on CentOS 7 that have 100 user each user with restricted access to its home dir. I want to create a user that only able to su to one of these other users, where all other ...
- 1,681
0
votes
0
answers
17
views
Categorizing Debian Linux VPS
I like to Categorize or Divide one Debian VPS for different Tasks and Testing.
For Example two Apache Web Servers with no any connection between both. Something like installing apache2 web server only ...
- 53
1
vote
2
answers
903
views
Applications of fakeroot and chroot
Why are there two utilities chroot and fakeroot when both can fake a privileged access to the user?
- 229
2
votes
1
answer
1k
views
How do you make a non-root user use openconnect?
Openconnect website does have a chapter called "Running as a non-root user".
However, if you read it more closely, you will see that it does not answer the question of how to run openconnect ...
- 219
8
votes
3
answers
733
views
Is there a tool that could allow the users of our scientific computer to book it exclusively?
We have one beefy ubuntu rig for our research department that can do heavy lifting with its CPUs and GPUs. All of our researchers SSH into the machine and run (machine learning) workloads on the ...
- 81
0
votes
1
answer
54
views
User directory permissions
I'm trying to make it so that different users have different permissions for certain directories.
For example user Bob has access to read, write, and execute the directory of /configuration, but Alice ...
- 1
1
vote
2
answers
362
views
Sudo Help - normal user should not change root password as sudo
I am adding sudo rules for L0 team wherein they will be able to change password for OS users.
BUT i dont want the L0 team to change root password using sudo
How to do it
PS - !/usr/bin/passwd root - ...
- 11
1
vote
1
answer
883
views
Restrict linux process write permission to one folder
I want a process (and all its potential children) to be able to read the filesystem according to my user profile but I want to restrict that process's write permission to only a set of pre-selected ...
- 195
1
vote
1
answer
18
views
How to schedule a period of time in which power-on or log-in is prevented?
So you may get a better idea of the context, this idea comes from the specific problematic of "letting kids being progressively responsible of their own devices".
So I was wondering if there ...
- 123
0
votes
0
answers
38
views
Why am i able to access a folder which technically shouldn't allow me in?
I found a folder whose ls -ld output goes like this
drwxr-x--- 14 root somegroup 12K Jan 13 20:10 somefolder
I dont belong to the group somegroup as found from the groups command. Rules say that i ...
0
votes
2
answers
501
views
Can ssh-copy-id respect my ssh config?
I store all my keys outside of .ssh and configured which key to use for which server in my .ssh/config. How can I make ssh-copy-id respect that?
- 501
1
vote
1
answer
145
views
AIX ACLs difference "permit" versus "specify"
What's the difference in AIX ACLs with permit versus specify:
This is what the documentation says:
"The permit, deny, and specify keywords are defined as follows:
permit
Grants the user or ...
- 45
1
vote
1
answer
22
views
Is it possible to whitelist-limit programs from accessing audio input?
I guess I'm paranoid enough that I will install something bad, but not paranoid enough to think that I'll give that bad program privileges...
I want to allow microphone access only to the programs I ...
- 113
0
votes
0
answers
134
views
Use selinux for path based access
Consider the following scenario. I've a ro file system mounted at /system and I can't remount it rw at all. There is a file /system/bin/xyz with context u:r:bin_t. Naturally I cannot change the ...
- 31
0
votes
1
answer
31
views
Authorize and Unauthorize by adding and remove user to a group
I want to authorize (or unauthorise) by adding (or removing) user to a group. Is it possible to have the changes be effective immediately without having to reboot?
I just want to give one time access ...
- 1,700
0
votes
1
answer
229
views
Why is changing password on user account is taking time?
I have created a few accounts on my Linux Mint installation. A few of them have admin privileges. About 30 min ago I changed the password on one of the admin accounts using the Users Settings GUI. But ...
- 3
0
votes
0
answers
168
views
Restrict access to a directory to just one process and its children
I want to mount a remote directory via sshfs to the local machine in order to use a code editor (Visual Studio Code) to locally edit files on the remote location.
Is there a way to limit access to ...
- 827
1
vote
0
answers
38
views
Restrict root to su local accounts
I know that root can modify any config file.
As a best practice, I would like to disable the capacity for root to su on accounts which authenticates against NIS or Active Directory.
As a best practice,...
- 131
0
votes
1
answer
2k
views
Restrict user to switch to root user but have all commands to execute
I want to provide a user to execute all command what a root user can do except from switching to root user.
SO I added as below in sudoers file in centos7/redhat7
guest ALL=(ALL:ALL) NOPASSWD: ALL,!/...
- 223
1
vote
1
answer
771
views
Is there a way to disable all write access for a specific user in a directory?
I recently learned about ACL and setfacl for setting per-user access rights. But there is one thing that I cannot figure out how to pull off, and that is restricting all write(*) access for a specific ...
- 11
0
votes
1
answer
482
views
How to restrict the access/activation times for a service/socket with systemd?
I have a simple systemd service that is activated by system socket.
It's as simple as that (a little simplified):
$ systemctl cat example.socket
# /usr/lib/systemd/system/example.socket
[Unit]
...
- 2,826
0
votes
2
answers
621
views
Can't access files I own
I have created a folder /root/bin where I inteded to store my custom scripts. The idea is that these scripts shall be accessible to any user, so I added users to "users" group. I gave this ...
- 11
1
vote
0
answers
31
views
Counting directories based on access
I need to get the number of directories that
Can only be read and opened by the owner of the directory.
Can only be opened by their group.
My current solution is this:
ls -la . | grep "^dr-x--x-...
- 149
1
vote
1
answer
705
views
Can you access bluetooth or Audio devices over XRDP
I have setup XRDP on a ubuntu computer that I wanted to access remotely. There are Bluetooth and audio devices attached to that remote device that I would like to access. Using XRDP, it shows that ...
0
votes
0
answers
31
views
Is there any free system for testing fs security implementation?
I'm writing my own Fuse filesystem and I'm in need of good testing, in particular the access control implementation investigation, as I've already found test suites for I/O. There will be other things ...
user422875
0
votes
0
answers
126
views
SSH Restrict User Access
When I ssh into the machine as webmaster I ssh into the correct chroot directory var/www/domainname/public_html but I can still access the entire filesystem.
I have changed the home ssh directory of ...
- 435
1
vote
1
answer
78
views
Linux Security Modules - SELinux/AppArmor
can someone explain to me why SELinux is officially broken under Ubuntu while AppArmor works fine? AppArmor is build on the "Linux Security Modules" framework and so is SELinux. As a result, ...
- 11
2
votes
0
answers
590
views
Failed to mount "Volume" The given volume was not found
I have been experiencing the following problem since a long time now:
So, When I start my computer and I get my Xubuntu op system Desktop, I always get an usb icon to be shown up on my Desktop.
When ...
- 21
0
votes
1
answer
38
views
user permission reporting based on extracted sudoers group & passwd files [duplicate]
Did anyone come up with an answer to this question (permission reporting on sudoers)?
0
votes
0
answers
75
views
Dynamic file access control
I have a shared folder that different program use.
I would like to be able for "file events" in this folder, like file creation, access for read or write.
The idea is to hang the open of the ...
- 169
0
votes
1
answer
397
views
Listing the content of the SFTP working directory
I am trying to create SFTP Account and I have the following configuration in /etc/ssh/sshd_config
Match group sftpgroup ChrootDirectory /sftp/ X11Forwarding no AllowTcpForwarding no ForceCommand ...
-3
votes
1
answer
426
views
How to get password for Linux [closed]
Good day
I think my friend is running li**nux on my home PC and Android Samsung S7 phone.
Is it possible?
How can I check if its running?
Can I get access to the account on the PC or Phone ...
- 1
1
vote
1
answer
844
views
SSH - restrict access to only one directory
I want to have a user to be able to login with ssh, but only be able to read files from a specific directory.
I did some research. Is it true that this is only possible with chroot and home ...
1
vote
0
answers
3k
views
Samsung SMT-G7401 hack
Samsung SMT-G7401 hack
introduction
I have an SMT-G7401_PCS01B (Horizon box) from UPC Switzerland and I would like to install debian or multimedia linux distribution on it if is it possible, if is ...
- 11
0
votes
1
answer
216
views
Accessing system utilities from docker
I'm building a docker container that should show information on the system status on a webpage.
I have an PHP-fpm and NGINX container running. If I use shell_exec or exec the .sh script I made is ...
- 115
0
votes
2
answers
94
views
Setting up a git server with ssh access
I want to set up a server that hosts git repositories over ssh and https with client certificates. I don't want any snazzy GUI or anything like that (i.e. not Bitbucket, GitLab, etc) I want a bare ...
0
votes
0
answers
27
views
Access control at process level
I'm sorry if this was asked but I was unable to find a satisfcatory answer. I know how access control works with respect to objects (files, devices, etc.), but it's not clear to me how this translate ...
- 119
1
vote
1
answer
201
views
Is it good or bad to use group in sudoers file instead of using user_aliases?
I have used user groups heavily while designing access control policies. I find user groups very convenient as it's very easy to implement with PAM.
Another reason I have organized the users with ...
- 1,389