module 2 day 3: windows file permissions through windows special permissions Flashcards
who do we want to give access to certain files and directories?
those who need it
How are files and directory permissions assigned in Windows?
using Access Control Lists, or ACLs
What will we work with in this course for files and directory permissions?
Discretionary Access Control Lists, or DACLs
What can windows files and folders also have for permissions?
System Access Control Lists, or SACLs, assigned to them
What are used to tell Windows that it should use an event log to make a note of every time someone accesses a file or folder?
SACLs
What is a note about who can use a file and what they’re allowed to do with it?
DACL
What has an owner and one or more DACL?
Each file or folder on a Windows machin
how can you see the properties dialogue for your Home Directory in Windows?
Go in file explorer, home directory, right click desktop, select properties
how do you see the permissions window in the properties dialogue for a directory?
go to the securities tab, and that tab is the permissions window.
what is in the top box in the permissions window for a directory?
Group or user names
what is in the bottoms box in the permissions window for a directory?
Permissions for SYSTEM, a list of permissions that each user group has been assigned
What permission lets you see that a file exists and lets you read its contents and also lets you read the files and directories in a directory?
Read
What permission lets you read files, and if the file is executable, you can run the file? Includes Read, so if you select it, Read will be automatically selected
Read and Execute
what permission is an alias for Read and Execute on a directory? so checking one will check the other? You can read and execute files in that directory
List folder contents
what permission lets you make changes to a file? you can have this access without having read permission. Lets you create subdirectories and write to files in the directory
Write
what permission is an umbrella permission that includes read, execute, and write?
Modify
what permission gives a user or group access to do anything they want to the file? All the permissions of modify, and the ability to take ownership of a file and change its ACLs.
Full Control
how can you see the permissions for the user?
click on the user’s name in the permissions page for the file or directory, and it will show in the Permissions list below.
how can you see which ACLs are assigned to a file? what utility designed to view and change ACLs?
use icacls, improved change ACLs. PowerShell.
how would you look at the desktop with icacls?
icacls ~\Desktop
what does the output for icacls ~\Desktop show us?
you can see the user accounts with access to your Desktop, and you can see if your account is one of them.
In PowerShell, in icacls, what do the capital letters in parentheses represent?
the ones in front of the user represent the file permissions the user has.
what is the help parameter for icacls?
icacls /? It’s a DOS command
in icacls, what does F mean?
full access
what is full access the same as?
full control
what permissions can be inherited?
ntfs
what does OI mean in icacls?
object inherit
what does CI mean in icacls?
container inherit
what does it mean if I have object and container inherit permissions, with full access?
if I create objects, files, or containers, directories, inside that directory, they inherit that DACL, and I retain full access permissions with them. objects and containers.
what is a list of access control entries, or ACE?
ACL
What identifies a trustee and specifies the access rights allowed, denied, or audited for that trustee?
Each ACE in an ACL
What can contain two types of ACL: a DACL and a SACL?
the security descriptor for a securable object
What does DACL stand for?
discretionary access control list
What identifies the trustees that are allowed or denied access to a securable object?
DACL
When does the system check the ACEs in the object’s DACL to determine whether to grant access to it?
when a process tries to access a securable object
what does the system do if the object doesn’t have a DACL?
grants full access to everyone
what happens if the object’s DACL has no ACE?
the system denies all attempts to access the object because the DACL doesn’t allow any access rights
What does the system do until it finds one or more ACE that alllow all the requested access rights or until any of the requested access rights are denied?
checks the ACE’s in sequence
what allows admins to log attempts to access a secured object?
sacls
what specifies the types of access attempts by a specified trustee that cause the system to generate a record in the security event log?
each ACE
what can generate audit records when an access attempt fails, when it succeeds, or both?
an ACE in a SACL
What should i use to make sure that ACLs are semantically correct?
use the appropriate functions to create and manipulate ACLs. Don’t work directly with them.
what provide access control to Microsoft Active Directory service objects?
ACLs
What include routines to create and modify the contents of ACLs?
Active Directory Service Interfaces, ADSI
How many different permissions can you have in Linux?
three
in Linux, what permission lets someone read the contents of a file or folder?
Read
in linux, what permission allows someone to write information to a file or folder?
write
in linux, what permission allows someone to execute a program?
Execute
what flag with the ls command in linux lets us see the permissions on a file?
ls -l
when looking at a file’s long ls, what is the first thing we see in the first column? linux.
10 bits. the first is the file type, the next 9 bits are our actual permissions, grouped in trios or sets of three.
what does a - mean for the file type? linux
regular file, in this example
what does a d stand for as file type?
directory
in linux, in the 9 bits that tell us our actual permissions, what does the first trio refer to?
the permission of the owner of the file
in linux, in the 9 bits that tell us our actual permissions, what does the second trio refer to?
the permission of the group this file belongs to
