ACL tune2fs setfacl getfacl default acl (lesson 8)

By OK -
Give permission to more than one user or group on a file or directory
Set default permissions for newly created files and directories
The acl mount option needs to be set
  /etc/fstab or systemd
  tune2fs for Ext file systems
  in XFS it's a default mount option
Use setfacl and getfacl
----------------------------------------------
ldapuser@localhost$ mkdir -p /etc/folder
Permission denied

 root@localhost#setfacl -R -m u:ldapuser:rwx /etc
ldapuser@localhost$ mkdir -p /etc/folder
OK
----------------------------------------------
setfacl -m g:salex:rx /data/account
setfacl -m d:g:sales:rx /data/account #default ACL
[root@localhost kevin]# setfacl -R -m g:lisa:rx filek 
[root@localhost kevin]# getfacl filek 
# file: filek
# owner: kevin
# group: kevin
user::rw-
group::rw-
group:lisa:r-x
mask::rwx
other::r--

You should run 2 commands on directory +defaults
[root@localhost ~]# setfacl -R -m g:lisa:rw /home/kevin/dirk/
[root@localhost ~]# setfacl -m d:g:lisa:rw /home/kevin/dirk/


[root@localhost ~]# getfacl /home/kevin/filek 
getfacl: Removing leading '/' from absolute path names
# file: home/kevin/filek
# owner: kevin
# group: kevin
user::rw-
group::rw-
group:lisa:r-x
mask::rwx
other::r--


[root@localhost ~]# setfacl -m u:lisa:rx /home/kevin/dirk/
[root@localhost ~]# setfacl -m u:lisa:rx /home/kevin/filek 
[root@localhost ~]# su - lisa
Last login: Mon Jun  5 15:49:54 EDT 2017 on pts/1
[lisa@localhost ~]$ ll /home/kevin/
ls: cannot open directory /home/kevin/: Permission denied
[lisa@localhost ~]$ ll /home/kevin/dirk
ls: cannot access /home/kevin/dirk: Permission denied

ACL access on parent folder if there is explicit chmod deny
[root@localhost ~]# setfacl -Rm g:lisa:rx /home/kevin
[root@localhost ~]# setfacl -Rm u:lisa:rx /home/kevin
[root@localhost ~]# su - lisa
Last login: Mon Jun  5 15:54:24 EDT 2017 on pts/1
[lisa@localhost ~]$ ll /home/kevin/
total 4
drwxrwxr-x+ 2 kevin kevin 25 Jun  5 15:46 dirk
-rw-rwxr--+ 1 kevin kevin 29 Jun  5 15:43 filek
[lisa@localhost ~]$ ll /home/kevin/dirk/
total 4
-rw-rwxr--+ 1 kevin kevin 29 Jun  5 15:46 dfilekeving
[lisa@localhost ~]$ cat /home/kevin/filek 
Mon Jun  5 15:43:19 EDT 2017
[lisa@localhost ~]$ 

[lisa@localhost ~]$ getfacl /home/kevin/dirk/
getfacl: Removing leading '/' from absolute path names
# file: home/kevin/dirk/
# owner: kevin
# group: kevin
user::rwx
user:lisa:r-x
group::rwx
group:lisa:r-x
mask::rwx
other::r-x
default:user::rwx
default:group::rwx
default:group:lisa:rw-
default:mask::rwx
default:other::r-x


[root@localhost ~]# touch /home/kevin/dirk/fileroot

on file there is no default settings


[root@localhost ~]# getfacl /home/kevin/dirk/fileroot 
getfacl: Removing leading '/' from absolute path names
# file: home/kevin/dirk/fileroot
# owner: root
# group: root
user::rw-
group::rwx                      #effective:rw-
group:lisa:rw-
mask::rw-
other::r--


Comments

Post a Comment

Popular posts from this blog

HAproxy logging

By OK -
ubuntu@ubuntu:/etc/haproxy$ cat /etc/rsyslog.d/haproxy.conf # Create an additional socket in haproxy's chroot in order to allow logging via # /dev/log to chroot'ed HAProxy processes $ModLoad imudp $UDPServerRun 514 local0.* -/var/log/haproxy-0.log local1.* -/var/log/haproxy-1.log ### keep logs in localhost ## $AddUnixListenSocket /var/lib/haproxy/dev/log ------------------- ubuntu@ubuntu:/etc/haproxy$ cat /etc/haproxy/haproxy.cfg global chroot /var/lib/haproxy user haproxy group haproxy log 127.0.0.1   local0         log 127.0.0.1   local1 notice daemon frontend www     bind 192.168.40.128:8282    # haproxy public IP     default_backend as-backend    # backend used backend as-backend    balance leastconn    mode http  server as1 192.168.40.128:8082 check    # application srv 1 defaults log global mode http option httplog option dontlognull         contimeout 5000    
Read more

tomcat catalina coyote jasper cluster

By OK -
Tomcat Component are Catalina Coyote Jasper Cluster Catalina :  Catalina is the name of the servlet container of Apache Tomcat since version 4.x. Tomcat implements Sun Microsystems' specifications for servlet and JavaServer Pages (JSP), which are important Java-based Web technologies. Tomcat's servlet container was redesigned as Catalina in Tomcat version 4.x. other components of the Tomcat engine are: Tomcat Jasper which converts the code portions within JavaServer Pages into servlets and pass them to Catalina to process. Tomcat Coyote which is an HTTP connector based on HTTP/1.1 specifications that receives and transmits web requests to the Tomcat engine by listening to a TCP/IP port and returns requests back to the requesting client. Coyote :  The Coyote JK Connector element represents a Connector component that communicates with a web connector via the JK protocol (also known as the AJP protocol). This is used for cases where you wish to invisibly integr
Read more

NFS mount add in fstab _netdev instead of default | firewall-cmd --list-all

By OK -
Redhat recommends us to add  _netdev  option for NFS file system in /etc/fstab. So that they can be mounted after starting the networking service. Alternative ways to refer to partitions: Label : LABEL=label Network ID Samba : //server/share NFS : server:/share SSHFS : sshfs#user@server:/share Device : /dev/sdxy (not recommended) Example #1 //192.168.1.134/share_name /mnt/share_name cifs username=server_user,password=server_password,_netdev 0 0 ^ Path to your share ^ Mountpoint ^ Username ^ Password ^ See note A Note A: The  _netdev  options makes sure the mount is only attempted AFTER a network connection has been established. Example #2 10.10.10.1:/vol1/fs1 /data nfs defaults,_netdev 0 0 ============================ [root@localhost ~]# firewall-cmd --list-all public   target: default   icmp-block-inversion: no   interfaces:   sources:   services: dhcpv6-client high-availability ssh   ports:   protocols:   masquera
Read more