ACL, or Access Control Lists are special permissions. Linux file system by using standard file permission is User, Group, and Other Level. Further, having permissions in form of Write, Read, and Execute. Of course, it will work in maximum situations, but sometimes users can require additional permissions. Here comes the role of ACL. Consider Bob is from the Sales department, but he wants access to a file from the Finance department. Now, the general file permission structure will not work here. The finance department would no like to expose all files other than the desired one. We can grant special permissions with the help of ACLs. Standard permissions can work for a single user or single group, but to add extra users to any file system from a different group, ACL us required. Today we will learn How to create and Mange File System Access Control List.

Understand ACL in practical:

In this scenario, we would be using Ubuntu 20.04 LTS. Before starting let’s verify whether ACLs are supported at kernel level or not in our OS?

List Kernel level support of ACLs.

ubnt@ubnt:~$ uname -r
 5.4.0-53-genericFirst, check kernel version.

Grep ACL supported file systems lists.

ubnt@ubnt:/boot$ grep ACL /boot/config-$(uname -r)

Out put

CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_REISERFS_FS_POSIX_ACL=y
 CONFIG_JFS_POSIX_ACL=y
 CONFIG_XFS_POSIX_ACL=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
 CONFIG_F2FS_FS_POSIX_ACL=y
 CONFIG_FS_POSIX_ACL=y
 CONFIG_SHIFT_FS_POSIX_ACL=y
 CONFIG_TMPFS_POSIX_ACL=y
 CONFIG_JFFS2_FS_POSIX_ACL=y
 CONFIG_EROFS_FS_POSIX_ACL=y
 CONFIG_NFS_V3_ACL=y
 CONFIG_NFSD_V2_ACL=y
 CONFIG_NFSD_V3_ACL=y
 CONFIG_NFS_ACL_SUPPORT=m
 CONFIG_CEPH_FS_POSIX_ACL=y
 CONFIG_9P_FS_POSIX_ACL=y

Here, Y means that ACL is directly compiled into the Linux kernel. Whereas, m means a loadable module.

Set default ACL permissions.

Let’s create a directory first.

 root@ubnt:~# mkdir acldemo

Have a look before setting ACL permissions, only single users permissions are visible.

root@ubnt:~# getfacl acldemo/

Defile ACL rule so that any file created under acldemo will be with no permission at other level.

root@ubnt:~# setfacl -m d:o:--- acldemo

Where, -m stands for modified, d: directory, o: others, and no permission to others is defined for acldemo direct

root@ubnt:~# getfacl acldemo/

root@ubnt:~/acldemo# touch test

Hereditary  is sustained. Can see same permisson with file even. 
Here, let's give additonal access permission to a user e.g. 'raj'

root@ubnt:~# setfacl -dm u:raj:rwx acldemo

Have a look if raj user have access or not.

root@ubnt:~# getfacl acldemo/

Remove ACL entries.

User’s special access can be removed using -x and -b option with setfacl.

Let’s remove ACL permission for user ‘raj’

root@ubnt:~# setfacl -x u:raj acldemo/

Remove ACL records.

root@ubnt:~# setfacl -b  acldemo/

Have a look, original status regained.

Conclusion:

Additional permissions are always required in a complex working environment. ACL permissions are always helpful to sustain permission but, without compromising any security issue.

Reference: https://help.ubuntu.com/community/FilePermissionsACLs

The post How to create and Mange File System Access Control List (ACL) with Ubuntu 20.04. appeared first on Linux Windows and android Tutorials.

Let’s do it.

0. What you need

Installing OpenLDAP on Ubuntu 18.04 is not a really complicated matter, however, it is necessary to have a basic knowledge about the use of the terminal.

Also, your user needs to be able to execute commands with sudo because some commands require root.

With this in mind, you can start the installation without problems.

1. Upgrade the system

In the first place, you need to upgrade the system. It is recommended to get the latest security patches on your system.

:~$ sudo apt update && sudo apt upgrade

Now, you can continue.

2. Set the hostname

The first step is to define the hostname. Run this command:

:~$ sudo hostnamectl set-hostname ldap.osradar.local

And add it to your /etc/hosts file

:~$ echo "192.168.250.6 ldap.osradar.com" | sudo tee -a /etc/hosts

3. Install OpenLDAP

A great advantage of OpenLDAP is that its packages are in the official Ubuntu repositories, which makes installation easy. Just write the following.

:~$ sudo apt install slapd ldap-utils

After downloading the package and during installation you will have to define and confirm the root password.

If you wish to verify that the installation has been carried out effectively. You can use the following command:

:~$ sudo slapcat

As you can see in the image above, OpenLDAP is installed correctly.

4. Add base dn for Users and Groups

it is now necessary to configure OpenLDAP. To do this, the first step is to add to base DN for users and groups.

Create a file called basedn.ldif in your home folder or wherever you want.

:~$ nano basedn.ldif

And add the following:

dn: ou=people,dc=example,dc=com
objectClass: organizationalUnit
ou: people

dn: ou=groups,dc=example,dc=com
objectClass: organizationalUnit
ou: groups

Of course, replace example and com, for your domain properties.

Next, add the configuration file. Run:

:~$ ldapadd -x -D cn=admin,dc=osradar,dc=local -W -f basedn.ldif

Next, install phpLDAPadmin.

5. Install phpLDAPadmin

In order to manage OpenLDAP in a quick and easy way is that you have to install phpLDAPadmin. Let’s do it.

First, install some necessary packages. Among them are Apache web server and PHP.

:~$ sudo apt install apache2 php php-cgi libapache2-mod-php php-mbstring php-common php-pear

Next, it is necessary to enable the php7.2-cgi extension. Then, restart Apache service.

:~$ sudo a2enconf php7.2-cgi
:~$ sudo systemctl reload apache2

Then install phpLDAPadmin.

:~$ sudo apt install phpldapadmin

The next step is to modify the permissions in the phpLDAPadmin configuration file to receive requests from network members.

:~$ sudo nano /etc/apache2/conf-enabled/phpldapadmin.conf

And leave it as I show you in the picture.

With this, we are simply telling phpLDAPadmin to accept requests from network members.

Then, restart Apache.

:~$ sudo systemctl restart apache2

If you use ufw, you must open ports 80 and 443.

:~$ sudo ufw allow 80
:~$ sudo ufw allow 443

Finally, open your favorite web browser and go to http://IP_SERVER_OR_DOMAIN/phpldapadmin

Next, log in.

Finally, you will see this.

And that’s it.

Conclusion

As you can see OpenLDAP is easy to install and configure in Ubuntu, it just remains that you can configure it to your needs.

Please share this article with friends.

The post How to install OpenLDAP on Ubuntu 18.04? appeared first on Linux Windows and android Tutorials.