Questions tagged [access-control]

The tag has no usage guidance, but it has a tag wiki.

Filter by
Sorted by
Tagged with
0
votes
2answers
23 views

Setting up a git server with ssh access

I want to set up a server that hosts git repositories over ssh and https with client certificates. I don't want any snazzy GUI or anything like that (i.e. not Bitbucket, GitLab, etc) I want a bare ...
0
votes
0answers
17 views

Access control at process level

I'm sorry if this was asked but I was unable to find a satisfcatory answer. I know how access control works with respect to objects (files, devices, etc.), but it's not clear to me how this translate ...
1
vote
1answer
34 views

Is it good or bad to use group in sudoers file instead of using user_aliases?

I have used user groups heavily while designing access control policies. I find user groups very convenient as it's very easy to implement with PAM. Another reason I have organized the users with ...
1
vote
1answer
23 views

In sudoers does (ALL)=All refer to users or privileges? User Privilege Managment

Considering how getting this wrong is extremely dangerous, I feel it deserves an explicit answer. There are many other answers concerning the use of ALL in sudoers, but they do not directly answer ...
1
vote
0answers
43 views

Files reappearing instantly after deleting

Initially, I had the issue of Cannot remove fileX Read-only filesystem and referred this thread which removed that problem but raised other, rather peculiar, problem; when I deleted the files from the ...
1
vote
1answer
49 views

Opening a file *with partially unknown filename* in executable directory

I have a directory in linux which I can eXecute. Thus, I should be allowed to cd into the directory and open the file(s). I know that the file I am interested in starts with f and has a number ...
0
votes
0answers
15 views

Remote Files Not accepted error

Running ubuntu 18.04 with KDE neon 5.16 (vmware) When downloading file from internet and trying to store this file on the remote windows server 2016 (not locally) I get an error: Cannot create ...
0
votes
0answers
33 views

remote id of hardware

Basis of this question. Each hardware circuit board has an id that can be checked with a Linux command, for example lspci. The various hardware circuit boards ids in a computer might together ...
2
votes
0answers
155 views

AWS - Stack creation - How to assign an inline policy to adhoc user?

Background: With cross account role someaccountrole, I have access to aws account xyz. Case 1 To create a stack in account xyz, we upload the Cloudformation file through console. Amidst stack ...
0
votes
0answers
26 views

How to control internet access of each app? [duplicate]

How can I control internet access of each app in my fedora 30 ?And how can I completely block internet access of an app?
1
vote
0answers
106 views

Uptime requires sudo password

I was wondering if anyone could give me some info on why does uptime keeps requiring sudo password? Indeed uptime runs without any sudo access from my trminal. $ id -u; uptime 1000 17:39:48 up 2:27,...
1
vote
0answers
14 views

Logon access control by group - naming conventions?

I want to implement a policy where (ldap) users are only allowed to logon to a host based on their group membership. The pam_listfile module seems to be the most sensible way to achieve this (does ...
0
votes
0answers
89 views

NOEXEC flag prevents users to do /bin/su

I need to prevent the shell escapes in our systems.These are the sudoers file entries. Cmnd_Alias OD_DBA_2 = \ /bin/rm /*/apps/*, \ /bin/rm -[a-z]*...
0
votes
0answers
60 views

Restrict root shell access

Background : 1. I have two users admin and root. admin user is not in sudoers and only runs a menu of restricted commands. 2. root account access is restricted to shell based protocols like scp, ssh ...
0
votes
1answer
190 views

NT_STATUS_ACCESS_DENIED listing \* when moving home directories to another location

I have a server and just finished building my raids. One of the partitions is supposed to house my home folders which I then want to share with my windows computers through samba. Before I begin ...
0
votes
1answer
2k views

su: cannot open session: Permission denied

I'm getting "access denied" attempting to login as root on the console and via ssh (Yes, I know root ssh access should be disabled - I've just inherited this box). I can login as non-root user who has ...
0
votes
0answers
29 views

Restricting user access to command with specific flags

Is there a way to restrict a user's access so that they can still execute a command, but only with a particular flag? For example, if I want to allow users to be able to read all files, they should ...
9
votes
2answers
6k views

Restarting systemd service only as a specific user?

I created some systemd services which basically works: location: /etc/systemd/system/multi-user.target.wants/publicapi.service content: [Unit] Description=public api startup script [Service] ...
1
vote
0answers
18 views

Can I limit a process's access to specified files and stdout only without root?

I want to setup a server for students to upload C code. The server compiles C code, run the binary and shows output to students. Now I am having security concern. Students can upload any code, but I ...
2
votes
1answer
47 views

Keep access to a file after sudo

user1 runs sudo -u user2 SomeCommand. I want SomeCommand to be able to access the files of user1 (or just a specific directory or even a single file, if that's easier), without giving access to user2 (...
2
votes
1answer
1k views

Restrict local port access to a specific user

I'm trying to restrict access to a particular port for a particular user on my Debian. Let's say user's id is 1000 and port I would like to block is 5000. I tried using iptables with the following ...
0
votes
1answer
38 views

Who have previously accessed a shared file?

I just discovered a mistake in the permissions setting of our system. It's kind of serious because it allows normal users to access something they shouldn't see. Currently the mistake has been fixed, ...
1
vote
1answer
66 views

Can a linux user access to a file in this case?

This is a theoretical question. I'm using a linux system with two users: root and nonRoot. I'm debugging an application as nonRoot, that uses a file placed in the following path: /home/nonRootFolder/...
0
votes
1answer
199 views

monit, http access with four different credentials types, one using PAM

monit 5.25.2 These are our credential settings: set httpd port 2812 allow localhost allow guest:guest read-only allow @wheel allow cleartext /opt/monit/htpasswd Rationale: localhost to enable ...
0
votes
2answers
46 views

How to have access to script variables and environmental variables inside a sudo/EOF clause in a script…BASH

PROBLEM: I am struggling with this cp always giving errors because the variables not there... Here is my code: if [ ! -z "$USER1" ] then sudo -u "$USER1" bash <<'EOF' sleep 5 ...
1
vote
1answer
2k views

How do I chmod or chown a file so that anybody in the world can access it? [duplicate]

.I have a font file which I created using a python script from Github. The owner and group are root. I don't actually know what this means... I can guess what owner means, and I can guess that a group ...
2
votes
1answer
80 views

Isolate/prevent files from being accessed by untrusted processes

Goal To defend against malware (or even compromised open source libraries) that would scan the filesystem and exfiltrate data. Question I have a certain path in my filesystem that I want only a ...
1
vote
1answer
122 views

How to deny other people to see my running details after “top” command and press key “c”

In my school, we share one server to run programs. Using top we can see the situation of the server, if press key c, we even can see the command details, somehow including my lab data information. ...
0
votes
1answer
184 views

Give program access to only directories below cwd

Say I run a program like so: cd foo && program x y z How can I give program access to only the directories in foo and below? Pretend my fs looks like: $HOME/ foo/ bar/ baz/ if I run ...
1
vote
2answers
84 views

Why can't I connect to mysql via the browser but via the terminal with php?

I would like to display a MySQL table in the browser with PHP and created the file demo-db.php <!DOCTYPE html> <html> <body> <?php $servername = "localhost"; $username = "...
2
votes
1answer
5k views

How to create a symbolic link from one user directory to anothers?

I have 3 users: admin with sudo, and two normal users - user1 and user2. user2 is under user1 group. There is a folder fold1 as /home/user1/fold1 which is under the group user1 with read and write ...
2
votes
1answer
6k views

Permission denied on files in a directory on a CIFS-mounted Windows share in Linux

I can successfully mount a windows share over the network from my Raspberry/Jessie with both, mount.cifs and fstab entrye then mount -a. E.g. sudo mount.cifs //HPSERVER/linux-bup/ /home/maxg/...
0
votes
0answers
161 views

(AppArmor) Does allowing a confined program to execute another binary unconfined ruin security?

I have recently tried to get to know SELinux and AppArmor and then decided to use AppArmor for its simplicity. I started writing some profiles using aa-genprof and aa-logprof but big programs like ...
-2
votes
1answer
62 views

directory access permission seemingly inconsistent

I want to grant new users access to a directory owned by root. "ls -lt" returns drw-rw-rw- 74 root root 4096 Mar 21 20:51 dirname My old user can cd into it. However, when I ...
0
votes
4answers
2k views

Can I restrict a user with root privileges(with sudo) from accessing/deleting a specific file?

I want to keep a log-file on my computer. I also want to give privileges to a different account to do all sorts of system specific jobs such as mount volume/install packages etc. So that user has to ...
0
votes
1answer
31 views

cd fails when trying to enter maldetect version-agnostic directory

I'm installing Maldet on Debian 9.3: cd /usr/local/src wget http://www.rfxn.com/downloads/maldetect-current.tar.gz tar -xzvf maldetect-current.tar.gz cd maldetect-* bash ./install.sh While doing cd ...
-1
votes
1answer
14k views

Getting “Permission denied” even though I have set global read permissions on a file

I'm using Amazon Linux. I have set global read permissions on a file, but I can't seem to access it as a normal user: [myuser@mymachine ~]$ ls -al /usr/java/jboss/standalone/deployments/myproject.war/...
2
votes
1answer
423 views

CAP_DAC_OVERRIDE and other permisions

Who can see the content of my directory other than root? What is CAP_DAC_OVERRIDE? Can sysadmin give this privilege to my content to some user? My understanding is someone who has CAP_DAC_OVERRIDE ...
3
votes
2answers
758 views

Can I disable command execution in find

I have been asked to provide access to a stack of RedHat EL servers to an external discovery tool (and no is not an option). This tool requires access to a list of commands via sudo. Most of those are ...
-1
votes
2answers
3k views

Removing user access to some directories

In my Unix system, there is a user which has access to multiple (but not all) subdirectories of /home/. How can I remove access to most directories for this user? I've looked in /etc/groups, but didn'...
3
votes
1answer
134 views

SSH account locking reveals real users

On my ssh server, I'm trying to hide the existence of all the users except for one. For any user besides that one user, I will get a Password: prompt which will never allow the user to enter. That's ...
1
vote
0answers
2k views

How can I block ssh access to users with pam?

I've been poking around /etc/ssh/sshd_config for the last week or so, trying to figure out how to block ssh access to all users besides myself. My goal is for it to be impossible for all users except ...
1
vote
0answers
204 views

Correct configuration of nginx for rewrite and access control

Here is my current nginx config server_name web.com; server_tokens off; root /usr/share/nginx/html/web; index index.php; if ( $request_uri ~ "/index.(php|html?)" ) { rewrite ^ /$1 permanent; } ...
0
votes
1answer
50 views

Running unknown apps securely

What would be the fastest way to run unknown scripts and apps in *nix environments? For example, to forbid writing and reading outside the working directory. Or to restrict access to hardware and ...
0
votes
0answers
35 views

Password protect a program without system accounts

we have a Linux system with a program to control a machine. We want to restrict and log access to this program with some kind of user/password combination, but I don't want to create a new user ...
0
votes
0answers
43 views

User directory logged out while logged in

I'm having this really weird issue sometimes where I be logged in to my user account, and then suddenly unexpectedly I get bunch of errors popping up because whatever application I'm using can't ...
0
votes
1answer
118 views

Restrict the access of an account in linux?

I've created a service account in my Redhat machine. The purpose of the account is to execute the bash script which I had created. The bash script basically checks the system properties like cpuinfo,...
2
votes
0answers
62 views

set ACL by NFS V4 IBM

I have the following directories and files: /project/ src/ test.txt temp.xls data/ data.xls The owner is always mytu and the Group is mytug. Now there is a user (e.g. user1) woh is ...
4
votes
2answers
544 views

Prevent already running process to write to an existing file

I have a process P which writes contents to a file F. I need to be able to dynamically enable/disable P to write to F. I tried changing the permissions for the user/group but this requires the process ...
0
votes
1answer
72 views

File permissions for root

So file permissions are divided into three parts, for example: -rwxr--r-x I understand that the order is the following: owner, group, others But, can root do anything with the file even if there is ...