Home / user-22478

Nikolas Sakic's questions

Martin Hope
Nikolas Sakic
Asked: 2015-03-03 23:18:51 +0800 CST
  • 1

I can't seem to get this right. I have a bunch of users in a group, cn=noc,ou=groups,dc=company,dc=com, who should be able to move a list between ou=internalLists,ou=mail,ou=service,dc=company,dc=com to ou=externalLists,ou=mail,ou=service,dc=company,dc=com.

The DN for that list is:

cn=mylist,ou=internalLists,ou=mail,ou=service,dc=company,dc=com

This is the ACLs i have for ou=mail,ou=service,dc=company,dc=com subtree:

access to dn.subtree="ou=externalLists,ou=mail,ou=service,dc=company,dc=com"
       by group/groupOfUniqueNames/uniqueMember="cn=noc,ou=Groups,dc=company,dc=com" write
       by * break


access to dn.subtree="ou=internalLists,ou=mail,ou=service,dc=company,dc=com"
        by group/groupOfUniqueNames/uniqueMember="cn=noc,ou=Groups,dc=company,dc=com" write
        by * break


access to dn.subtree="ou=mail,ou=service,dc=company,dc=com"
        by group/groupOfUniqueNames/uniqueMember="cn=ops,ou=Groups,dc=company,dc=com" write
        by * read

The above ACLs work but they also give the group 'noc' access to move other lists as well. I just want it to restrict to that just one list (cn=mylist). So, I tried the following:

access to dn.subtree="ou=externalLists,ou=mail,ou=service,dc=company,dc=com"
       filter="(cn=mylist)"
           by group/groupOfUniqueNames/uniqueMember="cn=noc,ou=Groups,dc=company,dc=com" write
           by * break


access to dn.subtree="ou=internalLists,ou=mail,ou=service,dc=company,dc=com"
        filter="(cn=mylist)"
            by group/groupOfUniqueNames/uniqueMember="cn=noc,ou=Groups,dc=company,dc=com" write
            by * break


access to dn.subtree="ou=mail,ou=service,dc=company,dc=com"
        by group/groupOfUniqueNames/uniqueMember="cn=ops,ou=Groups,dc=company,dc=com" write
        by * read

This gives me 'Insufficient access' error. What am I doing wrong?

openldap
Martin Hope
Nikolas Sakic
Asked: 2010-06-15 23:20:51 +0800 CST
  • 2

We supply zone-files to our customers. Some zone files are big about 300MB and some are quite small, maybe like 1MB. We had this issue that someone setup a script to continually download the file. Imagine downloading 300MB file a few hundred times a day. Since, we don't have packet-shaper to throttle the traffic, we need to upgrade ftp server and use add-on modules to limit the download somehow. We currently use proftpd server. Also note that there are different users for different domains - say, if you want to download zone file for .INFO domain, then you use a particular user. That user can't download any other zone's file. This is what we are looking for:

  1. Have maximum of 400MB download per user per day. Or even have different download limit for different users per day.

  2. Have one connection per user at any time.

  3. Max # of connection (non-simultaneous) per user per day is 5. Anyone trying to exceed that gets banned for 24 hours.

Has anyone used FTP server with similar restrictions above? Does anyone have any ideas where I can start? Any help would be appreciated. Thanks.

-N

ftp