E D R , A S I H C RSS

Moni WikiACL

/!\ since MoniWiki 1.1.2

๋ชจ๋‹ˆœ„‚ค˜ SecurityPlugin˜ •œ๊ฐ€ง€

1. „ •

config.php— ๋‹คŒ„„œผ๋ฉด ACL SecurityPluginด ™œ„™”๋ฉ๋‹ˆ๋‹ค.
$security_class="acl";
$acl_type="default";

2. ๋ฏธ๋ฆฌ  •˜๋œ ๊ทธ๋ฃน @group

  • @ALL: ๋ชจ๋“  ‚ฌšฉž (priority: 1)
  • @User: ๋“๋ก ‚ฌšฉž (priority: 2)

3. ‚ฌšฉž  •˜ ๊ทธ๋ฃน @group ๊ทธ๋ฆฌ๊ณ  @group˜ priority

##@๊ทธ๋ฃนด๋ฆ„ ‚ฌšฉž๋ฆฌŠคŠธ [priority]
@Guest  Anonymous                   # priority๋ฅผ ง€ ••˜ง€ •Šœผ๋ฉด ๊ธฐ๋ณธ๊ฐ’ 2
@Kiwirian foobar,kiwi,hello123   20 # @Kiwirain ๊ทธ๋ฃน˜ priority๋ฅผ žก๋Š”๋‹ค.
/!\ —ฌ๊ธฐ„œ Anonymous ‚ฌšฉž๋Š” @Guest๋กœ ง€ •๋˜–ด žˆœผ๋ฉฐ, @Guest๋Š” ๋ฏธ๋ฆฌ  •˜๋œ ๊ทธ๋ฃนด •„๋‹™๋‹ˆ๋‹ค.

<!> ๋ชจ๋‹ˆœ„‚ค 1.1.5๋ถ€„ฐ๋Š” network/ip ฃผ†Œ๋ฅผ ง€›•ฉ๋‹ˆ๋‹ค.
# ๋ถ€๋ถ„ IP, CIDR ๋“๋“๋„ ๋ชจ๋‘ ง€›.
@Block 123.123.0.0/255.255.0.0, 123.12, 123.125.0/16 

œ„˜ ˜ˆ—„œ @Block ๊ทธ๋ฃน„  •˜•˜๊ณ  žˆœผ๋ฉฐ ด— •ด๋‹น๋˜๋Š” IP๋Œ€—ญ, ๋ถ€๋ถ„IP ๋“๋“„ ง€ ••˜๊ณ  žˆŠต๋‹ˆ๋‹ค.

•„๋ž˜™€ ๊ฐ™ด ๊ทธ๋ฃน— ๋Œ€•œ šจ๋ ฅ„ ๋ฐœƒ‹œ‚ฌ ˆ˜ žˆŠต๋‹ˆ๋‹ค.
*       @Block            deny    * // ๋ชจ๋“  Ž˜ดง€(*)๋ฅผ @Block ‚ฌšฉž๊ทธ๋ฃน— ๋Œ€•ด ๋ชจ๋“  •ก…˜(*)„ฐ๋ถ€(deny)

/!\ IP, CDIR, ๋ถ€๋ถ„IP ๋“๋“€ ๊ทธ๋ฃน ง€ •—„œ๋งŒ ‚ฌšฉ ๊ฐ€๋Šฅ•ฉ๋‹ˆ๋‹ค.

4. ACL ƒ€ž…

  • allow : —ˆšฉ
  • deny :  œ•œ
  • protect: ๋น„๋ฐ€๋ฒˆ˜ธ  œ•œด ๊ฐ€๋Šฅ•œ ๋ช‡๋ช‡ POST•ก…˜— ๋Œ€•ด (๋ชจ๋“  •ก…˜ด ๊ด€๋ฆฌ๋น„๋ฒˆœผ๋กœ  œ•œ๊ฐ€๋Šฅ•˜ง€๋Š” •ŠŠต๋‹ˆ๋‹ค)
    • ผ๋ถ€ POST•ก…˜€ ๊ด€๋ฆฌž ๋น„๋ฐ€๋ฒˆ˜ธ๋กœ  œ•œ„–ด๋‘˜ ˆ˜ žˆ๋Š” •ก…˜€ protect ๊ฐ€๋Šฅ•œ •ก…˜ž…๋‹ˆ๋‹ค. protect •ก…˜€  œ•œ๋œ allowด๋ฉฐ, ผ๋ถ€ POST•ก…˜๋งŒ ง€›•ฉ๋‹ˆ๋‹ค. ˜ˆ) do_post_savepage()๋Š” post •ก…˜ด๋ฉฐ, ผ๋ฐ˜ do_goto()๊ฐ™€ •ก…˜๊ณผ๋Š” ๋‹ฌ๋ฆฌ ๊ด€๋ฆฌž ๋น„๋ฐ€๋ฒˆ˜ธ๋กœ •ก…˜„  œ•œ„ •  ˆ˜ žˆŠต๋‹ˆ๋‹ค.

ง€ • ๋ฐฉ๋ฒ•€ *๋Š” ๋ชจ๋“  •ก…˜„ ๊ฐ€๋ฆฌ‚ค๋ฉฐ, Ž˜ดง€ ด๋ฆ„€ regex๊ฐ€ ๊ฐ€๋Šฅ•ฉ๋‹ˆ๋‹ค.
# Ž˜ดง€ด๋ฆ„ @๊ทธ๋ฃน/Šน •‚ฌšฉž allow/deny •ก…˜๋ฆฌŠคŠธ
FoobarPage @ALL allow *
FoobarPage babo deny edit,diff,info
HelpOn.*   @ALL deny edit,savepage

4.1. ๊ฐ„๋‹จ•œ  šฉ˜ ผ๋ถ€

@Guest  Anonymous  // @Guest ‚ฌšฉž ๊ทธ๋ฃน  •˜
*       @ALL            deny    * // ๋ชจ๋“  Ž˜ดง€(*)๋ฅผ ๋ชจ๋“  ‚ฌšฉž(@ALL)—„œ ๋ชจ๋“  •ก…˜(*)„ฐ๋ถ€(deny)
*       @ALL            allow   ticket // ๋ชจ๋“  Ž˜ดง€๋ฅผ ๋ชจ๋“  ‚ฌšฉž—๊ฒŒ ticket •ก…˜„ —ˆ๋ฝ(allow)
*       @ALL            allow   read,userform,rss_rc,aclinfo,fortune,deletepage,fixmoin,ticket // —ฌ๋Ÿฌ „๋กœ ๋‚˜๋ˆ “ฐ๊ธฐ ๊ฐ€๋Šฅ
*       @User           allow   *
// ๋ชจ๋“  Ž˜ดง€(*)๋ฅผ ผ๋ฐ˜ ๊ฐ€ž… ‚ฌšฉž—๊ฒŒ(@User) —ˆ๋ฝ(*)
WikiSandBox     @Guest  allow   edit,info,diff
// WikiSandBox Ž˜ดง€๋ฅผ @Guest ๊ทธ๋ฃน— edit,info,diff •ก…˜„ —ˆšฉ(allow)
WikiSandBox     Foobar deny edit
// ‚ฌšฉž Foobar๋Š” WikiSandbox Žธง‘ ๋ชป•˜๊ฒŒ •จ

4.2. ™„ „•œ  šฉ˜ ˜ˆ

/!\ //๋กœ ‹œž‘๋˜๋Š” „€ „ค๋ช…„ž…๋‹ˆ๋‹ค.
# acl.default.php
# <?php exit()?> // ŒŒผ€ phpดง€๋งŒ ˜•‹€ php๊ฐ€ •„๋‹Œ ผ๋ฐ˜ …ŠคŠธ๋‹ค.
# Please don't modify the lines above
#
# A sample Access Control Lists file for Moniwiki
#
@Guest  Anonymous  // @Guest ‚ฌšฉž ๊ทธ๋ฃน  •˜
*       @ALL            deny    *
// ๋ชจ๋“  Ž˜ดง€(*)๋ฅผ ๋ชจ๋“  ‚ฌšฉž(@ALL)—„œ ๋ชจ๋“  •ก…˜(*)„ฐ๋ถ€(deny)
*       @ALL            allow   ticket
// ๋ชจ๋“  Ž˜ดง€(*)๋ฅผ ๋ชจ๋“  ‚ฌšฉž(@ALL)—๊ฒŒ ticket •ก…˜„ —ˆ๋ฝ(allow) ticket€ ๊ฐ€ž… ผ— ๋‚˜˜ค๋Š” ๋กœ๋ด‡๊ฐ€ž…๋ฐฉง€ captcha
*       @User           allow   *
// ๋ชจ๋“  Ž˜ดง€(*)๋ฅผ ผ๋ฐ˜ ๊ฐ€ž… ‚ฌšฉž—๊ฒŒ(@User) —ˆ๋ฝ(*)
# some pages are allowed to edit
WikiSandBox     @Guest  allow   edit,info,diff
// WikiSandBox Ž˜ดง€๋ฅผ @Guest ๊ทธ๋ฃน— edit,info,diff •ก…˜„ —ˆšฉ(allow)
# some POST actions support protected mode using admin password
*       @ALL            protect deletefile,deletepage,rename,rcspurge,rcs,chmod,backup,restore
// ๋ชจ๋“  Ž˜ดง€(*)— ๋Œ€•ด ๋ชจ๋“  ‚ฌšฉž˜(@ALL) detetefile,deltetepage ๋“๋“˜ protect ๊ฐ€๋Šฅ•œ •ก…˜„ protect
# some actions allowed to @ALL
*       @ALL            allow   read,userform,rss_rc,aclinfo,fortune,deletepage,fixmoin,ticket
# some pages have restrict permission
MoniWiki        @ALL    deny    edit,uploadfile,diff
// MoniWiki Ž˜ดง€๋ฅผ @ALL ๋ชจ๋“  ‚ฌšฉž—๊ฒŒ edit,upload,diff๋“˜ ผ๋ถ€ •ก…˜„ฐ๋ถ€

5. ACLด „๋ฆฝ๋˜๋Š” ๊ณผ •

5.1. ๋งˆง€๋ง‰ ACL •ญ๋ชฉด  šฉ๋œ๋‹ค

explicit•˜๊ฒŒ ง€ ••  ๊ฒฝšฐ ตœข… ACL •ญ๋ชฉด  šฉ๋œ๋‹ค.
  • allow read + deny read = deny read
  • deny read + allow read = allow read

wildcard๋ฅผ “ด ๊ฒฝšฐ๋„ —ญ‹œ ตœข… ACL •ญ๋ชฉด  šฉ๋œ๋‹ค.
  • allow * + deny * = deny * ๋ชจ๋“  •ก…˜„ฐ๋ถ€
  • deny * + allow * = allow * ๋ชจ๋“  •ก…˜„ Šนธ

5.2. explicit•˜๊ฒŒ ง€ ••ด•ผ •œ๋‹ค

wildcard๋ฅผ “ด ๊ฒƒ ๋ณด๋‹ค explicit•˜๊ฒŒ ง€ •๋œ ๊ฒƒด ๋จผ €  šฉ๋œ๋‹ค. (ˆœ„œ— ƒ๊ด€ —†๋‹ค)
  • deny * + allow edit,info = edit™€ info •ก…˜๋งŒ ๊ฐ€๋Šฅ: explicit•˜๊ฒŒ ง€ •๋œ •ก…˜๋งŒ —ˆ๋ฝ
  • allow * + deny info,diff = info/diff ด™ธ˜ •ก…˜ด ๋ชจ๋‘ —ˆšฉ: explicit•˜๊ฒŒ ง€ •๋œ •ก…˜๋งŒ ๊ฐ๋ถ€
  • deny info,diff + allow * = œ„˜ ๊ฒฝšฐ™€ ๊ฐ™๋‹ค. explicit•˜๊ฒŒ ง€ •๋œ •ก…˜ธ info, diff๋งŒ ๊ฐ๋ถ€

/!\ deny * + allow read๋Š” •„ŒŒน˜˜ Order allow,deny™€ ๊ฐ™๋‹ค. ฆ‰, explicit•˜๊ฒŒ ง€ •๋œ allow— ๋Œ€•ด ๋จผ € ๊ฒ€‚ฌ•˜—ฌ •ก…˜ด readผ๋•Œ๋งŒ —ˆ๋ฝ•˜๊ณ  ๋‚˜๋จธง€ •ก…˜€ deny.

deny edit + allow *€ ๊ทธ ๋ฐ˜๋Œ€๋กœ Order deny,allow๊ฐ€ ๋œ๋‹ค.

5.3. ˜ˆ

๋ชจ๋“  Ž˜ดง€— ๋Œ€•ด„œ ฝ๊ธฐ๋งŒ ๊ฐ€๋Šฅ•˜๊ฒŒ, ProtectedPage— ๋Œ€•ด„œ๋Š” ฝ๊ธฐ๋„ฐ๋ถ€
* @ALL deny *
* @ALL allow read
ProtectedPage @ALL deny read
ProtectedPage๋Š” deny * + allow read + deny read = deny *ด ๋œ๋‹ค.

/!\ ฃผ˜: ๋ชจ๋“  ๊ฒฝšฐ, explicit•˜๊ฒŒ ง€ •๋  ๊ฒฝšฐ— šจ๋ ฅด ๋ฐœƒ•œ๋‹ค.

* @ALL deny *
* @ALL allow read
ProtectedPage @ALL deny *
ProtectedPage๋Š” deny * + allow read + deny *ด ๋œ๋‹ค: explicit•˜๊ฒŒ —ˆ๋ฝ๋œ read๊ฐ€ —ˆšฉ๋œ๋‹ค.
๋งˆง€๋ง‰ „ ProtectedPage @ALL deny *๋Š” ๋ฌด‹œ๋˜๊ฒŒ ๋˜๋Š” ๊ฒƒด๋‹ค.

6. priority๊ฐ€ ๋‹ค๋ฅธ ๊ฒฝšฐ ACL˜ „๋ฆฝ ๊ณผ •

•ž ˆ˜ „ค๋ช…€ priority๊ฐ€ ๊ฐ™€ ๊ฒฝšฐ— ๋Œ€•œ ผ๋ฐ˜ ธ „ค๋ช…ด—ˆ๋‹ค. ๊ทธ๋ฃน˜ priority๋ฅผ ๋‘—ˆ„ ๋•Œ๋Š” –ด๋–ป๊ฒŒ  šฉ๋ ๊นŒ?

6.1. ˜ˆ œ 1

@ALL deny *
@User allow *
ด ๊ฒฝšฐ @User˜ priority๊ฐ€ ๋†’œผ๋ฏ€๋กœ allow *ด  šฉ๋œ๋‹ค.

6.2. ˜ˆ œ 2

@ALL deny *
@User allow read

@User—„œ read๊ฐ€ —ˆšฉ. ๋‚˜๋จธง€๋Š” @ALL deny *— ˜•ด ๊ฐ๋ถ€๋œ๋‹ค.

6.3. ˜ˆ œ 3

*       @ALL            deny    *
*       @ALL            allow   read,ticket,info,diff,titleindex,bookmark,pagelist
ProtectedPage @All      deny    read,ticket,info,diff,titleindex,bookmark,pagelist
  • ๋ชจ๋“  ‚ฌšฉž(@ALL)—๊ฒŒ allow๋ฅผ  œ™ธ•œ ๋ชจ๋“  •ก…˜ ๊ฐ๋ถ€.
  • ProtectedPage๋Š” edit,savepage๋ฅผ  œ™ธ•˜๊ณ  ๋ชจ๋‘ ๋ถˆ—ˆ
    • ด ๊ฒฝšฐ, allow๋ฅผ explicit•˜๊ฒŒ •œ ๋ชจ๋“  •ก…˜— ๋Œ€•ด explicit•˜๊ฒŒ deny๋ฅผ ๊–ดฃผ–ด•ผ ๋œ๋‹ค. deny * ๋ผ๊ณ ๋งŒ •˜๋ฉด •ˆ๋œ๋‹ค.

*       @ALL            deny    *
*       @ALL            allow   show,ticket,titleindex,bookmark,pagelist
*       @User           allow   edit,savepage
ProtectedPage @User     deny    * # ด๊ฒƒ๋งŒœผ๋กœ๋Š” ˜๋„๋Œ€๋กœ ž‘๋™ •ˆ•œ๋‹ค.
# ๋‹คŒ„ explicit•˜๊ฒŒ ๋ช…‹œ•ด•ผ ˜๋„๋Œ€๋กœ ž‘๋™•œ๋‹ค.
ProtectedPage @User     deny    edit,savepage
  • ผ๋ฐ˜ ๋“๋ก ‚ฌšฉž(@User)๋Š” edit,savepage —ˆ๋ฝ.
  • ProtectedPage๋Š” ๋ชจ๋‘ ๋ถˆ—ˆ
    • ด ๊ฒฝšฐ ๋“๋ก ‚ฌšฉž— ๋Œ€•ด @User deny * + @User allow edit,savepageด๋ฏ€๋กœ edit,savepage๋งŒ —ˆšฉ๋œ๋‹ค.
    • allow edit,savepage๋ผ๊ณ  explicit•˜๊ฒŒ  •˜๋œ ๊ฒƒ„ ๋‹ค‹œ ทจ†Œ‹œผœ•ผ ˜๋„๋Œ€๋กœ ž‘๋™•˜๋Š” ๊ฒƒด๋‹ค. ๋”ฐ๋ผ„œ ProtectedPage @User deny edit,savepage๋ผ๊ณ  จ ฃผ–ด•ผ •œ๋‹ค.

6.4. —ฐŠต

1) ๊ทธ๋ฃน priority๊ฐ€ ๊ฐ™€ •ญ๋ชฉ๋ผ๋ฆฌ •ฉณง€๊ณ , 2) ๊ทธ๋ฃน priority๊ฐ€ ๋†’€ •ญ๋ชฉด šฐ„  œผ๋กœ  šฉ๋œ๋‹ค.
####### @ALL ๊ทธ๋ฃน˜ priority๋Š” 1ด๋‹ค.
@Guest     Anonymous             # @ALL„  œ™ธ•œ ๋ชจ๋“  ๊ทธ๋ฃน˜ priority๋Š” ๊ทธ ๊ฐ’ด ง€ •๋˜ง€ •Šœผ๋ฉด 2 ด๋‹ค.
@Group1    peter,john      20    # priority = 20
@Group2    simon,soo             # default group priorty = 2
* @ALL     allow *               # group priority = 1
* @ALL     deny  backup,restore
* @Guest   deny  *               # group priority = 2
* @Group1  deny  *               # User defined @Group1 group
* @Group1  allow read,info,diff
* @Group2  deny  info,diff
  • peter™€ john: allow read,info,diff + deny * = read,info,diff๋งŒ —ˆšฉ
  • Anonymous (@Guest): deny *: ๋ชจ๋‘ ๊ฐ๋ถ€ (@Guest๊ทธ๋ฃน˜ priority๊ฐ€ ๋†’œผ๋ฏ€๋กœ @ALL— ๋Œ€•ด —ˆšฉ๋œ ๊ฒƒ๊ณผ ๋ฌด๊ด€•˜๊ฒŒ ๊ฐ๋ถ€๋œ๋‹ค)
  • ๋‹ค๋ฅธ ๋ชจ๋“  ‚ฌšฉž(@ALL): deny backup,resotre + allow * (Order Deny,Allow)
  • @Group1 : allow read,info,diff + deny * (Order Allow,Deny)
  • @Group2 : deny info,diff + @ALL deny backup,restore + allow *: priority๊ฐ€ ๊ฐ™€ •ญ๋ชฉด •ฉณ„๋‹ค.

/!\ ๊ฐ ACL •ญ๋ชฉ˜ ๊ฐ™€ priority๋ฅผ ๊ฐ€ง€๋Š” ๋ชจ๋“  •ญ๋ชฉด •ฉ•ด ธ„œ  šฉ๋ฉ๋‹ˆ๋‹ค.

config.php— $acl_debug=1 ˜ต…˜„„œผ๋ฉด, –ด๋–ค ‹œผ๋กœ  šฉ๋ ง€๋ฅผ ๋ณด—ฌค๋‹ˆ๋‹ค.


See TwinPages : MoniWiki:MoniWikiACL
SecurityPlugin
Valid XHTML 1.0! Valid CSS! powered by MoniWiki
last modified 2021-02-07 05:23:47
Processing time 0.0423 sec