Tech Blog

Hello,

Had a requirement to take ownership of a long list of windows file paths which were conviently in a csv file like this:

path

\\domain.local\site\users\User.Name\

So I used the following PowerShell and NTFSSecurity module.

#import this first (run powershell as Admin)
#Install-Module -Name NTFSSecurity

#Fill out the csv with all the paths you want to change

Import-CSV "C:\Temp\scripts\permissions.csv" |
    ForEach-Object{
    Add-NTFSAccess -Path $_.path -Account jacob.admin@kil.kingspan.net -AccessRights FullControl
    Set-NTFSOwner -Path $_.path -Account  jacob.admin@kil.kingspan.net

    }

Hi All,

We’ve recently implemented a BYOD wireless SSID for end users to check facebook or what ever it is they do.  As we’re short on resources we had to use existing DC’s to doll out IP’s but we were obviously worried around users “hacking” into the system.  So first thing we did was create a VLAN and assigned it to the wireless then applied several access control lists (ACL’s) to the core switch limiting the access to only the DC’s, proxy, core switch, each other and firewall then blocked the rest:

Firstly check the subnet mask of the VLAN you want to apply the ACL too as the wildcard/subnet address in the ACL will change dependant of the subnet.

The below example will use a subnet mask of 255.255.255.0 (the bits in red are notes only – do not try and apply them)

Logon to a switch and go into config mode:

#Here we specify the ACL will be extended rather than standard then we create a name for the ACL 
ip access-list extended NEWACL      
#The below rules specify what servers the users on the ACL  can have access too:
10 permit ip 192.168.241.0 0.0.0.255 192.168.250.2 0.0.0.0
15 permit ip 192.168.241.0 0.0.0.255 192.168.250.3 0.0.0.0
20 permit ip 192.168.241.0 0.0.0.255 10.0.0.1 0.0.0.0
25 permit ip 192.168.241.0 0.0.0.255 192.168.250.18 0.0.0.0
30 permit ip 192.168.241.0 0.0.0.255 10.0.0.76 0.0.0.0
31 permit ip 192.168.241.0 0.0.0.255 192.168.241.254 0.0.0.0
35 permit ip 192.168.241.254 0.0.0.0 0.0.0.0 255.255.255.255
#The below denies access to certain subnets
50 deny ip 192.168.241.0 0.0.0.255 192.168.0.0 0.0.255.255
55 deny ip 192.168.241.0 0.0.0.255 10.0.0.0 0.255.255.255
57 deny ip 192.168.241.0 0.0.0.255 172.0.0.0 0.255.255.255
#This final permit allows access to itself and therefor out of its network to other networks:
60 permit ip 192.168.241.0 0.0.0.255 0.0.0.0 255.255.255.255
#Apply this ACL to a vlan, in this case 3241:
VLAN 3241 ip access-group NEWACL in
#Show me my handy work:
Show Access-List GuestACL

Finally test!

Ok so what if you have a network that has a subnet of 255.255.252.0, well the wildcard changes in the ACL or above we had 0.0.0.255 where as in a 255.255.252.0 subnet we’d need 0.0.3.255.

Example:

#Name of ACL and extended:
ip access-list extended "StudentACL1"
#List of allowed servers:
10 permit ip 192.168.216.0 0.0.3.255 192.168.250.2 0.0.0.0
15 permit ip 192.168.216.0 0.0.3.255 192.168.250.3 0.0.0.0
20 permit ip 192.168.216.0 0.0.3.255 10.0.0.1 0.0.0.0
25 permit ip 192.168.216.0 0.0.3.255 192.168.250.18 0.0.0.0
26 permit ip 192.168.216.0 0.0.3.255 192.168.250.30 0.0.0.0
27 permit ip 192.168.216.0 0.0.3.255 192.168.250.68 0.0.0.0
30 permit ip 192.168.216.0 0.0.3.255 10.0.0.76 0.0.0.0
31 permit ip 192.168.216.0 0.0.3.255 192.168.216.254 0.0.0.0
35 permit ip 192.168.216.254 0.0.0.0 0.0.0.0 255.255.255.255
#List denied subnets:
50 deny ip 192.168.216.0 0.0.3.255 192.168.0.0 0.0.255.255
55 deny ip 192.168.216.0 0.0.3.255 10.0.0.0 0.255.255.255
57 deny ip 192.168.216.0 0.0.3.255 172.0.0.0 0.255.255.255
#Apply to this VLAN:
VLAN 3216 ip access-group StudentACL1 in
#Show me the money:
Show Access-List StudentACL1
Save

So what happens if you want to delete a ACL from a VLAN:

#remove the ACL from the VLAN: 
no VLAN 3216 ip access-group StudentACL in
#Remove the ACL from the switch:
no ip access-list extended StudentACL
Save
#Now to check its gone either do Show Access-List or Show Config.