E D R , A S I H C RSS

Moni WikiACL

/!\ since MoniWiki 1.1.2

‹ˆœ„‚ค˜ SecurityPlugin˜ •œ๊ฐ€€

1. „ค •

config.php— ‹คŒ„ „ฃœผ ACL SecurityPlugin ™œ„ฑ™”ฉ‹ˆ‹ค.
$security_class="acl";
$acl_type="default";

2. ฏธฆฌ  •˜œ ๊ทธฃน @group

  • @ALL: “  ‚ฌšฉž (priority: 1)
  • @User: “ฑก ‚ฌšฉž (priority: 2)

3. ‚ฌšฉž  •˜ ๊ทธฃน @group ๊ทธฆฌ๊ณ  @group˜ priority

##@๊ทธฃนฆ„ ‚ฌšฉžฆฌŠคŠธ [priority]
@Guest  Anonymous                   # priorityฅผ € ••˜€ •Šœผ ๊ธฐณธ๊ฐ’ 2
@Kiwirian foobar,kiwi,hello123   20 # @Kiwirain ๊ทธฃน˜ priorityฅผ žกŠ”‹ค.
/!\ —ฌ๊ธฐ„œ Anonymous ‚ฌšฉžŠ” @Guestกœ € •˜– žˆœผฉฐ, @GuestŠ” ฏธฆฌ  •˜œ ๊ทธฃน •„‹™‹ˆ‹ค.

<!> ‹ˆœ„‚ค 1.1.5€„ฐŠ” network/ip ฃผ†Œฅผ €›•‹ˆ‹ค.
# €ถ„ IP, CIDR “ฑ“ฑ„ ‘ €›.
@Block 123.123.0.0/255.255.0.0, 123.12, 123.125.0/16 

œ„˜ ˜ˆ—„œ @Block ๊ทธฃน„  •˜•˜๊ณ  žˆœผฉฐ — •‹น˜Š” IPŒ€—ญ, €ถ„IP “ฑ“ฑ„ € ••˜๊ณ  žˆŠต‹ˆ‹ค.

•„ž˜™€ ๊ฐ™ ๊ทธฃน— Œ€•œ šจ ฅ„ ฐœƒ‹œ‚ฌ ˆ˜ žˆŠต‹ˆ‹ค.
*       @Block            deny    * // “  Ž˜€(*)ฅผ @Block ‚ฌšฉž๊ทธฃน— Œ€• “  •…˜(*)„ ๊ฑฐ€(deny)

/!\ IP, CDIR, €ถ„IP “ฑ“ฑ€ ๊ทธฃน € •—„œงŒ ‚ฌšฉ ๊ฐ€Šฅ•‹ˆ‹ค.

4. ACL ƒ€ž…

  • allow : —ˆšฉ
  • deny :  œ•œ
  • protect: น„€ฒˆ˜ธ  œ•œ ๊ฐ€Šฅ•œ ‡‡ POST•…˜— Œ€• (“  •…˜€ฆฌน„ฒˆœผกœ  œ•œ๊ฐ€Šฅ•˜€Š” •ŠŠต‹ˆ‹ค)
    • ผ€ POST•…˜€€ฆฌž น„€ฒˆ˜ธกœ  œ•œ„ ๊ฑธ–‘˜ ˆ˜ žˆŠ” •…˜€ protect ๊ฐ€Šฅ•œ •…˜ž…‹ˆ‹ค. protect •…˜€  œ•œœ allowฉฐ, ผ€ POST•…˜งŒ €›•‹ˆ‹ค. ˜ˆ) do_post_savepage()Š” post •…˜ฉฐ, ผฐ˜ do_goto()๊ฐ™€ •…˜๊ณผŠ” ‹ฌฆฌ ๊€ฆฌž น„€ฒˆ˜ธกœ •…˜„  œ•œ„ •  ˆ˜ žˆŠต‹ˆ‹ค.

€ • ฐฉ•€ *Š” “  •…˜„ ๊ฐ€ฆฌ‚คฉฐ, Ž˜€ ฆ„€ regex๊ฐ€ ๊ฐ€Šฅ•‹ˆ‹ค.
# Ž˜€ฆ„ @๊ทธฃน/Šน •‚ฌšฉž allow/deny •…˜ฆฌŠคŠธ
FoobarPage @ALL allow *
FoobarPage babo deny edit,diff,info
HelpOn.*   @ALL deny edit,savepage

4.1. ๊ฐ„‹จ•œ  šฉ˜ ผ€

@Guest  Anonymous  // @Guest ‚ฌšฉž ๊ทธฃน  •˜
*       @ALL            deny    * // “  Ž˜€(*)ฅผ “  ‚ฌšฉž(@ALL)—„œ “  •…˜(*)„ ๊ฑฐ€(deny)
*       @ALL            allow   ticket // “  Ž˜€ฅผ “  ‚ฌšฉž—๊ฒŒ ticket •…˜„ —ˆฝ(allow)
*       @ALL            allow   read,userform,rss_rc,aclinfo,fortune,deletepage,fixmoin,ticket // —ฌŸฌ ค„กœ ‚˜ˆ “ฐ๊ธฐ ๊ฐ€Šฅ
*       @User           allow   *
// “  Ž˜€(*)ฅผ ผฐ˜ ๊ฐ€ž… ‚ฌšฉž—๊ฒŒ(@User) —ˆฝ(*)
WikiSandBox     @Guest  allow   edit,info,diff
// WikiSandBox Ž˜€ฅผ @Guest ๊ทธฃน— edit,info,diff •…˜„ —ˆšฉ(allow)
WikiSandBox     Foobar deny edit
// ‚ฌšฉž FoobarŠ” WikiSandbox Žธง‘ •˜๊ฒŒ •

4.2. ™„ „•œ  šฉ˜ ˜ˆ

/!\ //กœ ‹œž‘˜Š” ค„€ „ค…ค„ž…‹ˆ‹ค.
# acl.default.php
# <?php exit()?> // ŒŒผ€ php€งŒ ˜•‹€ php๊ฐ€ •„‹Œ ผฐ˜ …ŠคŠธ‹ค.
# Please don't modify the lines above
#
# A sample Access Control Lists file for Moniwiki
#
@Guest  Anonymous  // @Guest ‚ฌšฉž ๊ทธฃน  •˜
*       @ALL            deny    *
// “  Ž˜€(*)ฅผ “  ‚ฌšฉž(@ALL)—„œ “  •…˜(*)„ ๊ฑฐ€(deny)
*       @ALL            allow   ticket
// “  Ž˜€(*)ฅผ “  ‚ฌšฉž(@ALL)—๊ฒŒ ticket •…˜„ —ˆฝ(allow) ticket€ ๊ฐ€ž… ผ— ‚˜˜คŠ” กœ‡๊ฐ€ž…ฐฉ€ captcha
*       @User           allow   *
// “  Ž˜€(*)ฅผ ผฐ˜ ๊ฐ€ž… ‚ฌšฉž—๊ฒŒ(@User) —ˆฝ(*)
# some pages are allowed to edit
WikiSandBox     @Guest  allow   edit,info,diff
// WikiSandBox Ž˜€ฅผ @Guest ๊ทธฃน— edit,info,diff •…˜„ —ˆšฉ(allow)
# some POST actions support protected mode using admin password
*       @ALL            protect deletefile,deletepage,rename,rcspurge,rcs,chmod,backup,restore
// “  Ž˜€(*)— Œ€• “  ‚ฌšฉž˜(@ALL) detetefile,deltetepage “ฑ“ฑ˜ protect ๊ฐ€Šฅ•œ •…˜„ protect
# some actions allowed to @ALL
*       @ALL            allow   read,userform,rss_rc,aclinfo,fortune,deletepage,fixmoin,ticket
# some pages have restrict permission
MoniWiki        @ALL    deny    edit,uploadfile,diff
// MoniWiki Ž˜€ฅผ @ALL “  ‚ฌšฉž—๊ฒŒ edit,upload,diff“ฑ˜ ผ€ •…˜„ ๊ฑฐ€

5. ACL „ฑฆฝ˜Š” ๊ณผ •

5.1. งˆ€ง‰ ACL •  šฉœ‹ค

explicit•˜๊ฒŒ € ••  ๊ฒฝšฐ ตœข… ACL •  šฉœ‹ค.
  • allow read + deny read = deny read
  • deny read + allow read = allow read

wildcardฅผ “ ๊ฒฝšฐ„ —ญ‹œ ตœข… ACL •  šฉœ‹ค.
  • allow * + deny * = deny * “  •…˜„ ๊ฑฐ€
  • deny * + allow * = allow * “  •…˜„ Šนธ

5.2. explicit•˜๊ฒŒ € ••••œ‹ค

wildcardฅผ “ ๊ฒƒ ‹ค explicit•˜๊ฒŒ € •œ ๊ฒƒ จผ €  šฉœ‹ค. (ˆœ„œ— ƒ๊€ —†‹ค)
  • deny * + allow edit,info = edit™€ info •…˜งŒ ๊ฐ€Šฅ: explicit•˜๊ฒŒ € •œ •…˜งŒ —ˆฝ
  • allow * + deny info,diff = info/diff ™˜ •…˜ ‘ —ˆšฉ: explicit•˜๊ฒŒ € •œ •…˜งŒ ๊ฑฐ€
  • deny info,diff + allow * = œ„˜ ๊ฒฝšฐ™€ ๊ฐ™‹ค. explicit•˜๊ฒŒ € •œ •…˜ธ info, diffงŒ ๊ฑฐ€

/!\ deny * + allow readŠ” •„ŒŒน˜˜ Order allow,deny™€ ๊ฐ™‹ค. ฆ‰, explicit•˜๊ฒŒ € •œ allow— Œ€• จผ € ๊ฒ€‚ฌ•˜—ฌ •…˜ readผ•ŒงŒ —ˆฝ•˜๊ณ  ‚˜จธ€ •…˜€ deny.

deny edit + allow *€ ๊ทธ ฐ˜Œ€กœ Order deny,allow๊ฐ€ œ‹ค.

5.3. ˜ˆ

“  Ž˜€— Œ€•„œ ฝ๊ธฐงŒ ๊ฐ€Šฅ•˜๊ฒŒ, ProtectedPage— Œ€•„œŠ” ฝ๊ธฐ„ ๊ฑฐ€
* @ALL deny *
* @ALL allow read
ProtectedPage @ALL deny read
ProtectedPageŠ” deny * + allow read + deny read = deny * œ‹ค.

/!\ ฃผ˜: “  ๊ฒฝšฐ, explicit•˜๊ฒŒ € •  ๊ฒฝšฐ— šจ ฅ ฐœƒ•œ‹ค.

* @ALL deny *
* @ALL allow read
ProtectedPage @ALL deny *
ProtectedPageŠ” deny * + allow read + deny * œ‹ค: explicit•˜๊ฒŒ —ˆฝœ read๊ฐ€ —ˆšฉœ‹ค.
งˆ€ง‰ ค„ ProtectedPage @ALL deny *Š” ‹œ˜๊ฒŒ ˜Š” ๊ฒƒ‹ค.

6. priority๊ฐ€ ‹คฅธ ๊ฒฝšฐ ACL˜ „ฑฆฝ ๊ณผ •

•ž ˆ˜ „ค…€ priority๊ฐ€ ๊ฐ™€ ๊ฒฝšฐ— Œ€•œ ผฐ˜ ธ „ค…—ˆ‹ค. ๊ทธฃน˜ priorityฅผ ‘—ˆ„ •ŒŠ” ––๊ฒŒ  šฉ ๊นŒ?

6.1. ˜ˆ œ 1

@ALL deny *
@User allow *
 ๊ฒฝšฐ @User˜ priority๊ฐ€ †’œผ€กœ allow *  šฉœ‹ค.

6.2. ˜ˆ œ 2

@ALL deny *
@User allow read

@User—„œ read๊ฐ€ —ˆšฉ. ‚˜จธ€Š” @ALL deny *— ˜• ๊ฑฐ€œ‹ค.

6.3. ˜ˆ œ 3

*       @ALL            deny    *
*       @ALL            allow   read,ticket,info,diff,titleindex,bookmark,pagelist
ProtectedPage @All      deny    read,ticket,info,diff,titleindex,bookmark,pagelist
  • “  ‚ฌšฉž(@ALL)—๊ฒŒ allowฅผ  œ™•œ “  •…˜ ๊ฑฐ€.
  • ProtectedPageŠ” edit,savepageฅผ  œ™•˜๊ณ  ‘ ถˆ—ˆ
    •  ๊ฒฝšฐ, allowฅผ explicit•˜๊ฒŒ •œ “  •…˜— Œ€• explicit•˜๊ฒŒ denyฅผ ๊ฑธ–ฃผ–•œ‹ค. deny * ผ๊ณ งŒ •˜ •ˆœ‹ค.

*       @ALL            deny    *
*       @ALL            allow   show,ticket,titleindex,bookmark,pagelist
*       @User           allow   edit,savepage
ProtectedPage @User     deny    * # ๊ฒƒงŒœผกœŠ” ˜„Œ€กœ ž‘™ •ˆ•œ‹ค.
# ‹คŒ„ explicit•˜๊ฒŒ …‹œ••˜„Œ€กœ ž‘™•œ‹ค.
ProtectedPage @User     deny    edit,savepage
  • ผฐ˜ “ฑก ‚ฌšฉž(@User)Š” edit,savepage —ˆฝ.
  • ProtectedPageŠ” ‘ ถˆ—ˆ
    •  ๊ฒฝšฐ “ฑก ‚ฌšฉž— Œ€• @User deny * + @User allow edit,savepage€กœ edit,savepageงŒ —ˆšฉœ‹ค.
    • allow edit,savepageผ๊ณ  explicit•˜๊ฒŒ  •˜œ ๊ฒƒ„ ‹ค‹œ ทจ†Œ‹œผœ•˜„Œ€กœ ž‘™•˜Š” ๊ฒƒ‹ค. ”ฐผ„œ ProtectedPage @User deny edit,savepageผ๊ณ  จ ฃผ–••œ‹ค.

6.4. —ฐŠต

1) ๊ทธฃน priority๊ฐ€ ๊ฐ™€ •ผฆฌ •ณ€๊ณ , 2) ๊ทธฃน priority๊ฐ€ †’€ • šฐ„  œผกœ  šฉœ‹ค.
####### @ALL ๊ทธฃน˜ priorityŠ” 1‹ค.
@Guest     Anonymous             # @ALL„  œ™•œ “  ๊ทธฃน˜ priorityŠ” ๊ทธ ๊ฐ’ € •˜€ •Šœผ 2 ‹ค.
@Group1    peter,john      20    # priority = 20
@Group2    simon,soo             # default group priorty = 2
* @ALL     allow *               # group priority = 1
* @ALL     deny  backup,restore
* @Guest   deny  *               # group priority = 2
* @Group1  deny  *               # User defined @Group1 group
* @Group1  allow read,info,diff
* @Group2  deny  info,diff
  • peter™€ john: allow read,info,diff + deny * = read,info,diffงŒ —ˆšฉ
  • Anonymous (@Guest): deny *: ‘ ๊ฑฐ€ (@Guest๊ทธฃน˜ priority๊ฐ€ †’œผ€กœ @ALL— Œ€• —ˆšฉœ ๊ฒƒ๊ณผ €•˜๊ฒŒ ๊ฑฐ€œ‹ค)
  • ‹คฅธ “  ‚ฌšฉž(@ALL): deny backup,resotre + allow * (Order Deny,Allow)
  • @Group1 : allow read,info,diff + deny * (Order Allow,Deny)
  • @Group2 : deny info,diff + @ALL deny backup,restore + allow *: priority๊ฐ€ ๊ฐ™€ • •ณง„‹ค.

/!\ ๊ฐ ACL •˜ ๊ฐ™€ priorityฅผ ๊ฐ€€Š” “  • •• ธ„œ  šฉฉ‹ˆ‹ค.

config.php— $acl_debug=1 ˜ต…˜„ „ฃœผ, ––ค ‹œผกœ  šฉ €ฅผ —ฌค‹ˆ‹ค.


See TwinPages : MoniWiki:MoniWikiACL
SecurityPlugin
Valid XHTML 1.0! Valid CSS! powered by MoniWiki
last modified 2021-02-07 05:23:47
Processing time 0.0258 sec