Off the top of mu head, this seems contradictory. If you have read, write, and execute on any file, that means new user creation is possible. If you employ ACL's and block this special user from accessing files then what happens when the user employs setfacl (or whatever tool) to undo your change to the ACL?
Absolutely! If someone is allowed to do "everything" then everything it is - no less!
I remember a former customer took away root privileges for a certain system from us system administrators but because we were still supposed to edit a certain file owned by root (!) they created a sudo rule for us:
They wondered why we still became root whenever we needed to and probably still are wondering, LOL!
Quote:
Originally Posted by jim mcnamara
Note: Linux system roles are beginning to receive support, I think the concept was demonstrated well in Solaris 10. I do not know how robust the support of roles using Ansible is in your version of RH.
I don't know Solaris too well but RBAC (Role Based Access Control) is available in AIX for about 10-15 years. I would strongly prefer jumping out of the next available window to using it, though. It makes the administration of a system practically impossible (yes, i know all the "but"s - i still stand by what i said). My advice: stay away as far as you can. If you can't do it with standard UNIX privileges it isn't worth doing and/or your model is plain wrong.
I need to set up/modify a user account on one of our machines which will allow the user to stay on the system, but not use their user id and password to login to the machine. It is for the purposes of an ftp user, so that nobody can then login as ftp/passwd. Ta.:) (2 Replies)
Hi all,
I am a newbe to aix 5.2. I want to specify the characters used by users while creating user in aix like specifying the length of the password
should i use some sript for that if it is then please let me know how to do this
if yes give me the link for the scripts.
Thanks in advance
... (2 Replies)
I created a user, i login as a root. I add him in the group where he can access and login as a root! I checked it in users' list and in group's list, he is there. My problem is this, I cant login using the username/account I just created! What should i do to use and login the user/account i've just... (5 Replies)
Hi,
My requirement is that i am login from ROOT in a script but when any
command is coming which is logging to sqlplus then i have to run it with normal user as only normal user have permission to connect to sqlplus .
i tried making a script like this :
#! /bin/ksh
su -... (3 Replies)
hi all,
i want to prevent users downloading files in the office as bandwidth becomes very low
and affects work.
one of my friend tried to close the connection using ethercap but this does not work.
i have a debian desktop while other users use MS W!ndows.
Please provide any help. Thanks (5 Replies)
Hi Every body,
I would need a shell script program to login as different user and perform some copy commands in the script.
example: Supppose ora_toms is the active user
ora_toms should be able to run a script where user: ftptomsp pass: XXX should login through and run the commands
... (9 Replies)
now i have logged in username : ramesh in unix
Now i have to created script file to login into another user and have run a command inside that user and after executing the command i have to exit from that user.
Inside script, i have to login into su - ram along with password : haihow and have to... (4 Replies)
Hi could some let me know how to prevent user from changing his home directory.......
Thanks in advance.... (6 Replies)
Discussion started by: rahul547
6 Replies
LEARN ABOUT DEBIAN
catalyst::plugin::authorization::roles
Catalyst::Plugin::Authorization::Roles(3pm) User Contributed Perl Documentation Catalyst::Plugin::Authorization::Roles(3pm)NAME
Catalyst::Plugin::Authorization::Roles - Role based authorization for Catalyst based on Catalyst::Plugin::Authentication
SYNOPSIS
use Catalyst qw/
Authentication
Authorization::Roles
/;
sub delete : Local {
my ( $self, $c ) = @_;
$c->assert_user_roles( qw/admin/ ); # only admins can delete
$c->model("Foo")->delete_it();
}
DESCRIPTION
Role based access control is very simple: every user has a list of roles, which that user is allowed to assume, and every restricted part
of the app makes an assertion about the necessary roles.
With "assert_user_roles", if the user is a member in all of the required roles access is granted. Otherwise, access is denied. With
"assert_any_user_role" it is enough that the user is a member in one role.
There are alternative approaches to do this on a per action basis, see Catalyst::ActionRole::ACL.
For example, if you have a CRUD application, for every mutating action you probably want to check that the user is allowed to edit. To do
this, create an editor role, and add that role to every user who is allowed to edit.
sub edit : Local {
my ( $self, $c ) = @_;
$c->assert_user_roles( qw/editor/ );
$c->model("TheModel")->make_changes();
}
When this plugin checks the roles of a user it will first see if the user supports the self check method.
When this is not supported the list of roles is extracted from the user using the "roles" method.
When this is supported, the "check_roles" method will be used to delegate the role check to the user class. Classes like the one provided
with iCatalyst::Authentication::Store::DBIx::Class optimize the check this way.
METHODS
assert_user_roles [ $user ], @roles
Checks that the user (as supplied by the first argument, or, if omitted, "$c->user") has the specified roles.
If for any reason ("$c->user" is not defined, the user is missing a role, etc) the check fails, an error is thrown.
You can either catch these errors with an eval, or clean them up in your "end" action.
check_user_roles [ $user ], @roles
Takes the same args as "assert_user_roles", and performs the same check, but instead of throwing errors returns a boolean value.
assert_any_user_role [ $user ], @roles
Checks that the user (as supplied by the first argument, or, if omitted, "$c->user") has at least one of the specified roles.
Other than that, works like "assert_user_roles".
check_any_user_role [ $user ], @roles
Takes the same args as "assert_any_user_role", and performs the same check, but instead of throwing errors returns a boolean value.
SEE ALSO
Catalyst::Plugin::Authentication
Catalyst::ActionRole::ACL
Catalyst::Manual::Tutorial::06_Authorization
AUTHOR
Yuval Kogman <nothingmuch@woobling.org>
COPYRIGHT & LICENSE
Copyright (c) 2005-2011 the Catalyst::Plugin::Authorization::Roles "AUTHOR" as listed above.
This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself.
perl v5.14.2 2011-04-29 Catalyst::Plugin::Authorization::Roles(3pm)