Movatterモバイル変換

37 captures

18 Jun 2008 - 29 Sep 2012

Jul	AUG	Sep
	29
2011	2012	2013

success

fail

About this capture

COLLECTED BY

Organization:Alexa Crawls

Starting in 1996,Alexa Internet has been donating their crawl data to the Internet Archive. Flowing in every day, these data are added to theWayback Machine after an embargo period.

Collection:Alexa Crawls

Starting in 1996,Alexa Internet has been donating their crawl data to the Internet Archive. Flowing in every day, these data are added to theWayback Machine after an embargo period.

TIMESTAMPS

commands:

Trustee could be user or group, domain\trustee or SID (S-1-x ....).

Simple Rights

Switches:

New ! FILEACL use a more accurate inheritance scheme and allowfor "apply toobjects and sub-folders in this folder only"
With standard FILEACL syntax, just add “!” in front of your access mask to limit propagationto the first level.

Ex:

FILEACL c:\temp\testacl /s user:R/!W/Fwill limit inheritance of Write access for files to the testacl directory.

You also can use a different syntax adding your inheritance flagmanually at the end of a single mask command line.

Inheritance can be :

FILEACL c:\temp\testacl /s user:R/!W/F 
Would then translate into
FILEACL c:\temp\testacl /s user:R:FO /s user:W/F/NP /s user:F:SF
or
FILEACL c:\temp\testacl /s user:R:FO /s user:W/OI/IO/NP /s user:F/CI/IO

Error Codes:

Typical : 

FILEACL d:\temp\acltest /S user1:RW

gives Read/Write access on directory d:\temp\acltest to trusteeuser1

FILEACL\\server\share\dir /Sadmingroup1:F /S usergroup1:RX/W/D /O admingroup1 /SUB:3  /FILES

give admingroup1 Full right to network dir, and give usergroup1RX to dir; right to modify existing files to dir, and delete files on 3 sub-levelsof directories and files.

admingroup1 is set as owner for all files and dirs

FILEACL\\server\share\dir /SS-1-5-21-1606980848-1383384898-842925246-1008:R

give Read right to a user given its SID, even if the DC for thatdomain is not online or the account is not created/synchronized yet !

or even :

FILEACL\\server\share\dir /SS-1-5-21-1606980848-1383384898-842925246-1008:0x120089/0x100116

to set a special mask

FILEACL d:\temp\acltest /INHERIT /REPLACE  

Reset permissions and allow propagation from upper levels

FILEACL d:\temp\acltest /owner /raw 

gives ACEs (one trustee per line) and owner with RAW sid and accessmask

What are  ACL and ACE ?

ACE stands for Access control entry, it specifies :

·        atrustee

·        anaccess mask

·        anACE type (could be deny ACE, audit ACE)

·        aninheritance flag

ACL stands for Access control List, it is a list of ACEs.

What does ACLs levels means ?

Multi-level ACLs treat inheritance (ONLY for directories !)

If you see/give one level 
(/S trustee:RW = /S trustee:RW/RW/RW )

ACL is built with RW rights for the directory, and all inheritedfiles and sub-directories.

If you see/give two levels of ACE 
(/S trustee:RW/X = /S trustee:RW/X/RW )

ACL is built with RW rights for the directory and all inheritedsub-directories, and X right for all inherited 

If you see/give three levels of ACE 
(/S trustee:RW/X/R )

ACL is built with RW rights for the directory, X right for inheritingfiles  and R right for inheriting sub-directories.

Difference between OSes

NT4 SP3, NT4 SP4 and later and Windows 2000 treats ACLs in a slightlydifferent manner :

NT4 SP3 uses GENERIC_RIGHTS (ie 0x10000000 to 0x80000000 accessmasks) to grant access to files and inherited files.

NT4 SP4 and later do not use GENERIC_RIGHTS any more (althoughit understands it), it uses the same masks for directories and files masks.

On directories NT4 (All sps)  always build a 2 ACEs ACL fora trustee,

First ACE is set with Directory Inherit flag (0x2).

Second ACE is set with Files inherit  only  flag (0x9).

This means that the first ACE addresses the directory and its inheritedsub-directories, and the second ACE addresses only inherited files.

In only one case does NT4 build a single ACE ACL for a trustee:

When you select "Take ownership" for a directory, it deletes theACL and replace it with a 0x3 ACE (Inherit  on files and directories).

Windows 2000 is much more consistent about all that : it only createseparate ACE if needed, each time a single ACE can be used, it is.

Differences in Access Masks :

Windows 2000 does not need READ_CONTROL (0x20000) mask for writingto a directory and NT4 does need it.

A Write ACE would typically be (0x120116) with NT4 and (0x100116)with Windows 2000, be sure to use /NT4 switch if your ACLs will be read by NT 4.0workstation .

Windows 2000 introduce "Delete file and subfolder" right (0x110040).

Windows 2000 has an  Autopropagation feature, all rights ona parent are propagated on children.

FILEACL keeps the protection status of a folder unless /PROTECTor /INHERIT 

Go Windows 2000 now !

Questions ? :this

OUTPUT : 
d:\test;Administrators:F[I] Administrators have Inherited Full Control from Autopropagation([I]) 
d:\test;Everyone:F/RWEveryone has Full Control over this directory and future sub-directoriesand RW on future Files
d:\test;Guest:F/W/RGuest has Full Control in the dir, W on future files, and Readon future subdirs


Detailed Rights

File Deletion is performed if : 
Parent dir has Rr and Dc access OR file has D

Minimum Access for reading a file is Rr on parent dir and RrRepon file
Minimum Access for saving an open file is Rr on parent and RrRepW on file 
Minimum Access for creating new file is Ww on parent dir
Minimum Access for creating new dir is A on parent dir 

Access masks are defined this way : 

GR = Generic Read

GW = Generic Write

GE = Generic Execute

GA = Generic All

AS = Access to Audit ACL (SACL)