Following is the scenario in the picture, We have one server at back and five other servers (running 5+ applications). We are developing LDAP instead of basic Database authentication rule in which we have to set it manually. Obviously, We have different roles like: Developer, Support, Managers, Directors, etc.  So, Our aim is to give permissions respectively. For example. A user who fall in developer group can edit and commit, while support person can view only. Please feel free if my concept is wrong.  Technologies:   Wamp Server 2.5 Apache 2.4.9 PHP 5.5 MySQL 5.6 LDAP Ubnutu v3   Following are my Questions:   Does LDAP allow user permission mechanism? or I want any other third party software. In case to  - NO, Do I have to make application capable to act like this? Does LDAP users/groups are linked with Linux sudoers user? in: visudo i.e. /etc/sudoers
2986
This is a  about  the use of a *AMPP's stack.    I recently had a talk with some experienced people and they suggested to me not to use a WAMP stack, and instead install apache, mysql and php separately.  I don't understand why they have suggested this, though, so can anyone tell me?  Is there a particular disadvantage of WAMP, or a particular advantage to installing all of them separately?  Since a WAMP stack itself is composed of apache, mysql and php, then what's the difference between using the WAMP stack and installing them all separately?
11898
I'm gearing up to deploy a Drupal 7 site and I can't find any documentation about what the recommended security-conscious file and directory permissions should be set to.  Specifically default/files/ (also sub directories?), settings.php, .htaccess and anything else I should be aware of.
20739
I'm logged into a server as user "ubuntu" and I've got files that look like this:  -rw-rw-r-- 1 www-data www-data 33150 2012-06-04 22:17 file-a.png -rw-rw-r-- 1 www-data www-data 36371 2012-06-04 22:15 file-b.png -rw-rw-r-- 1 www-data www-data 41439 2012-06-04 22:16 file-c.png   The ubuntu user is a member of the group www-data:  groups ubuntu   produces  ubuntu : ubuntu www-data   So shouldn't I be able to change other permissions since I have access to the file? I'm not an expert on the user/group stuff. So this is just perplexing me.  I'm trying to run:  chmod o-r *  I realize I can do it with sudo, easily, but I'm trying to understand why I can't modify the files without sudo.
69555
I want to create a user with administrative privileges and all the regular setups like home directory.   Is there a adduser parameter to give the user sudo powers automatically? What are the default settings for adduser? Will it automatically create home directories and all the other things without extra parameters? (i.e. is adduser &lt;username&gt; enough?)
2712
I just ran into something unexpected (for me) regarding file permissions on Linux (Arch Linux). Basically I have:   userX in groupX fileX userX:groupX ---rwx----   What puzzles me: I cannot perform any action (rwx) on fileX. Is this right? Can someone please confirm this is indeed the expected behaviour?  The only actions I can perform are mv and rm because I have write permissions on the parent directory.  The thing is, I always thought these permissions collapse on each other, starting with the most general one (other -> group -> user). In other words, if o=rwx who cares what the persmissions for group and user are? Apparently this is not the case but it doesn't make much sense to me; it seems counterintuitive. The only thing this approach seems to be useful at, is to easily exclude a very specific person / group, which doesn't seem like a smart way to go at it (imho). Besides, the owner (and group?) should be able to chmod anyway right? Any thoughts on this matter?
48355
I've working LDAP authentication with the following setup   AuthName            "whatever"  AuthType            Basic  AuthBasicProvider   ldap  AuthLDAPUrl         "ldap://server/OU=SBSUsers,OU=Users,OU=MyBusiness,DC=company,DC=local?sAMAccountName?sub?(objectClass=*)"  Require ldap-group  CN=MySpecificGroup,OU=Security Groups,OU=MyBusiness,DC=company,DC=local   This works, however I've to put all users I want to authenticate into MySpecificGroup. But on LDAP server I've configured that MySpecificGroup also contains the group MyOtherGroup with another list of users.  But those users in MyOtherGroup are not authenticated, I've to manually add them all to MySpecificGroup and basically can't use the nested grouping. I'm using Windows SBS 2003.  Is there a way to configure Apache LDAP to do this? Or is there a problem with possible infinite recursion and thus not allowed?
93069
This might be a very naive question, but I wanted to know how I could give multiple users access to a single computer without making them root users. How would I give them limitted sudo access such that they could still issue commands like  sudo apt-get install epstopdf   I imagine this could be an incredibly stupid question as once root user access is given, they could do whatever they want. Therefore, is there any way around this? I am open to suggestions
41141
I messed around with the sudoers file without really knowing what I was doing using   Assume I did everything that was in the top answer along with editing it with vim and not visudo. How do I fix this?  I'm running Xubuntu 12.04, and I didn't set a root password.
89254
My company has asked me to look into connecting our CentOS 7 instance's to our Active Directory to make it easier for user management.  I have so far looked at:   Kerberos, doing it via command line -   OpenLDAP -     Is there any other tool or resource I should look into to do my due diligence?
66318
Am loving using Drupal 6 for creating a site with more than one user "type", with different Content Profiles, different Roles with associated Permissions, different access to nodes etc. My current site has 3 different roles - Recruiters, Candidates and a Simple Administrator (as a reduced feature subset administrator, to limit the amount of damage that a non-technical administrator can do to the site, yet still do things like edit the outgoing emails, add/remove users etc).  I was wondering... when I am testing, I am currently using multiple browsers (dev in Firefox, Testing one user type in Chrome, one in ie9) to get around the "current" session issue (you can only be logged in as one user). What techniques do people use to test on multiple roles simultaneously? Is there, for example, a Firefox plugin or something else to isolate different browser based session cookies in different tabs?
59956
I confess that I come from the happy world of unix computers, and am used to the concept of user accounts and hence group gids and userids uids. For the occasional usage of an untrusted app (i.e. whatsapp/facebook) I have created another user profile for many reasons, but mostly because I wanted to reduce any potential access whatsapp/facebook might gain with regards to my main account.  Now the strange thing is that to the best of my understanding the protection mechanism of AOSP, relies on assigning a actually user ids to individual apps, as with those uid, the apps can be limited using that the underlying linux kernel provides Unix Discretionary Access Controls (i.e. file accesss dependent on uid and gid).  My question is if I am misleading myself that AOSP provides any stronger protection with regards to multi-users (in between the accounts) than it does with regards to the various apps to each other?
34755
When I am creating a user for my Drupal in cPanel, it asks me to check all privileges. What privileges should be enabled, to make Drupal work correctly?  Currently, my user has all privileges except Drop permission.
114939
I want to grant a single user write permissions to a directory owned by root over command line. With chmod, it seems that I can only change the permissions for owner, group and other, not for a specific user.
4761
I have an app to deploy in production that uses 'honor system' security. That is, all users connect to the DB using a SQL user/passwd credential and the app manages permissions itself. The latter part doesn't bother me as much as the fact that the connection object contains embedded credentials and can be copied around freely. I'm try to find some way to limit connections to a more limited set of clients. I can create firewall rules to limit by IP, of course. Is there any way to 'prequalify' SQL logins either by Machine account or domain membership?
79072
We have an application in our organization that is based on Oracle Forms 11g (on Oracle Fusion Middleware/WLS). Users have access to the application through accounts created at the database (i.e. they exist in dba_users). Each user is assigned a specific role based on their area of work and they use the user id to log on to the application. The user may have read/write access to certain functionality in the application and for this their roles have the following permissions-  EXECUTE ANY LIBRARY    SELECT  ANY SEQUENCE    EXECUTE ANY TYPE       EXECUTE ANY PROCEDURE  UPDATE  ANY TABLE       SELECT  ANY TABLE       DELETE  ANY TABLE       EXECUTE ANY INDEXTYPE  INSERT  ANY TABLE     Now we have some users requesting for SQL Client access (i.e. TNS settings) so that they can connect to the DB and perform queries for their research. These business users are ofcourse knowledgeable in SQL but we want to restrict their access based on the type of client they use to log on to the database. Any client other than the application itself, should restrict them to "read only".  Is there a way to achieve this?
75882
I'm trying to wrap my head around how SQL Server decides to grant certain rights based on a users login privileges.  If a user is part of a group "READ ONLY" which has access to DB1, but they are also a part of a group "SysAdmin" which has full db owner rights to the same DB1, which rights are they given when they log in?  On a similar note. What if they are part of a group but also have a standalone account with other middle of the road privileges?
62779
I've got some code like this:   $query_args = array(); $query_args['fields'] = array( 'ID', 'display_name' ); $query_args['role'] = 'subscriber'; $users = get_users( $query_args ); foreach ($users as $user) $users_array[$user->ID] = $user->display_name;   I want to get more roles and also include contributor, author and some custom roles I created with the Role Scoper plugin e.g. Manager, etc. Any ideas how I can do this with get_users?   Thanks