Permissions are listed as “user”, “group”, “other”. I.e. the user who made the file, the group of the user who made the file (usually just their name as a group), and everyone else. In this case the rxw is for the user.
For chmod, you can also represent these as binary numbers: 111 would mean having all 3, 101 would mean having read and write, etc. These binary numbers then get turned back into regular numbers (7 in the first example, since it’s 111) for chmod. Giving a file “chmod 777” means the user, group, and other all have full permissions on the file. “chmod 700” gives the creator full control, but no one else can view, modify, or execute the file.
🤷♂️ They’re just internet points, lemmy doesn’t notify about up/downvotes so I will only see it if people respond. Either way it’s hopefully still useful to someone else looking at the post who isn’t familiar with basic permissions or acl
Confusing. You set a mask for a user and somehow it propagated down to a group and then you change permission on that group suddenly it applies to the user? Either something is wrong here or ACL permissions make absolutely zero sense. It is 5 billion times easier to use normal permissions to set these things up.
I think it’s like this: what used to be group in regular permissions output is a union of group and ACL mask in ACL output. Mask sets the upper limit of what ACL can do, so if mask is rw- then it’s impossible to set a r-x ACL permission because allowing execution is not allowed.
This seems to be more geared towards enterprise environment where it could be complicated to cleanly define groups, since you can only give access to one you might run into a problem where dept. A needs access to that directory but also person G from dept. B and person K from dept. C.
Network ACLs are my bane. Someone long ago decided we needed to “isolate” the network, so they put ACLs everywhere and so now 50% of my teams time is spend fucking with ACLs :/ It’s awful.
Only if you assume IP Addresses act as authentication for what that host is. But since they don’t, I see ACLs as a security blanket.
I can change the IP of a server I control and bypass any ACL easily. If I have control of my network as well, then no ACL you apply can stop any of my servers from hitting whatever server you have allowed any of my servers to hit. So why not just allow my entire network block?
I don’t assume that, and that’s why I only consider IP based ACL’s as a “part of this balanced security solution” because while handy, modern attacks are smarter everyday and heuristics based NIP systems are essential.
In the military we called it the “swiss cheese model”, in ORM you use as many layers of security as you can to prevent a mishap. Controlling what subnets can access certain others keeps Becky from accounts payable from getting access into accounts receivable’s data and writing her own checks. Sure, a network admin/sysadmin could just change their IP, but Becky doesn’t have that access. I usually define network access by the subnet, if we aren’t comfortable with all devices in a LAN having access then it’s a pretty locked down solution, in which case we most likely have higher level requirements like application/port number or port security .1X.
I’m assuming your servers all reside in the same subnet? If not, changing the IP without changing the VLAN and/or trunking it to the access layer switch you’re attached to would only result in a loss of connection.
For your use case I’d just allow the whole LAN and define applications we are ok with having communications between the two subnets, and as always a well thought out DMZ goes a really long way.
Right but if you want to start doing application level blocking, then the proper tool for the job is a stateful firewall and even better, a RADIUS/Kerberos system that authenticates every connection between servers.
Basically I use ACLs to prevent spoofing attacks from originating out of my network, and also to lock down the management plane of my network devices to specific subnets. In all other cases a stateful firewall should be used exclusively.
In any other case ACLs provide the illusion of security and create a huge amount of operational friction especially in a dynamic environment.
Cool, I didn’t know ACLs were a widely available thing but the infographic explains pretty well! Sounds really useful when granular controls are needed, but I could also imagine it being a huge pain in environments already built out and scripted around regular permissions. Still as always, options are good and an ounce of planning is worth a pound of troubleshooting.
I do low-key hate seeing a directory named “dir” and a group named “me” though. That’s chaotic neutral shit at the very least.
Technically, this is also possible by creating extra groups, but this kind of access control presumably exists because the old-school method can be a pain to administer. Choosing group names can also be an "interesting" secondary challenge.
i.e. Dude's not going to be best pleased if they ls -l and see the group on the file is xyzgroup-but-not-dude even if it is with good reason. (Shouldn't have deleted the database, dude.)
I don’t really think that that’s a realistic goal for ACLs. I mean, getfacl showing the user specifically being excluded probably isn’t any more-polite.
Windows has ACLs and they are an important part of Windows administration, and used extensively for managing file permissions.
Windows has supported ACLs on NTFS since Windows NT & NTFS were released in 1993 (possibly partly influenced by AIX ACLs in the late 80s influenced by VMS ACLs introduced the early 80s).
ACLs were not introduced to standard POSIX until c.1998, and NFS and Linux filesystems didn’t get them until 2003. In fact, the design of the NFSv4 ACL standard was heavily influenced by the design of NTFS/Windows ACL model – a specific decision by the designers to model it more like NTFS rather than AIX/POSIX.
Technically, at the filesystem level, exFAT also provides support for ACLs, but I am not sure if any implementation actually makes use of this feature (not even Windows AFAIK, certainly not any desktop version).
Yep, you’re right. I was thinking of an ACL evolution/chain of influence of VMS -> AIX -> NT, but it seems VMS -> NT and VMS -> AIX as two separate histories is much more accurate. Thanks for the correction – I’ve updated my comment accordingly.
Yeah, I’m familiar with VMS, and Cutler bringing a lot of the internal design to W/NT. (I’m told in particular a lot of the data structures for system calls in NT look like VMS.) My AIX experience has consisted entirely of “This is weird. This isn’t normal for Unix.” Ha ha. (I had a 1st gen RS/6000 at home briefly in the late 90s.)
Damn, giving me flashbacks of slowly moving through ACLs then hitting domain groups, domain local groups, global groups, then eventually universal groups as AD moved forward in complex situations.
(Verse 1) In a world controlled by giants, where data flows so fast, We seek freedom and control, a future that will last. A rebellion of the geeks, united in our might, We raise our servers high, ready to take flight.
(Chorus) United hosts, we stand strong and tall, Self-hosting warriors, breaking down the walls. Data sovereignty, our battle cry, United hosts, together we defy.
(Verse 2) No more reliance on the cloud, where privacy can fade, We reclaim our digital lives, where we have a say. Our servers hum with power, our networks interlace, We build our own oasis, in this digital space.
(Chorus) United hosts, we stand strong and tall, Self-hosting warriors, breaking down the walls. Data sovereignty, our battle cry, United hosts, together we defy.
(Bridge) Through firewalls and encryption, we secure our domain, We choose the software we trust, where freedom will remain. Open-source revolution, our code is our might, With each line we write, we reclaim the night.
(Verse 3) In a world where data’s king, we take back our control, No more surveillance or censorship, as our stories unfold. From personal blogs to community forums, we forge our own path, United hosts, we’re the architects of a digital aftermath.
(Chorus) United hosts, we stand strong and tall, Self-hosting warriors, breaking down the walls. Data sovereignty, our battle cry, United hosts, together we defy.
(Outro) United hosts, spreading knowledge and freedom, We shape a world where privacy shall never succumb. Join the revolution, become one of us, United hosts, together we trust.
Note: This song is based on the structure and theme of S.O.D’s “United Forces” but with original lyrics.
I used to get ads exclusively for cleaning supplies on this one music app I used only when I cleaned. Never talked about cleaning, just the sounds of cleaning and dishes being done. Probably a coincidence but it freaked me out enough I stopped using that and just downloaded a shit ton of music to my phone.
lemmy.g97.top
Hot