E D R , A S I H C RSS

Moni WikiACL

/!\ since MoniWiki 1.1.2

๋ชจ๋‹ˆœ„‚ค˜ SecurityPlugin˜ •œฐ€ง€

1. „ •

config.php— ๋‹Œ„„œผ๋ฉด ACL SecurityPlugin™œ„™”๋ฉ๋‹ˆ๋‹ค.
$security_class="acl";
$acl_type="default";

2. ๋ฏธ๋ฆฌ  •˜๋œ ธ๋ฃน @group

  • @ALL: ๋ชจ๋“  ‚ฌšฉž (priority: 1)
  • @User: ๋“ฑ๋ก ‚ฌšฉž (priority: 2)

3. ‚ฌšฉž  •˜ ธ๋ฃน @group ธ๋ฆฌ  @group˜ priority

##@ธ๋ฃนด๋ฆ„ ‚ฌšฉž๋ฆฌŠคŠธ [priority]
@Guest  Anonymous                   # priority๋ฅผ ง€ ••˜ง€ •Šœผ๋ฉด ธฐ๋ณธฐ’ 2
@Kiwirian foobar,kiwi,hello123   20 # @Kiwirain ธ๋ฃน˜ priority๋ฅผ žก๋Š”๋‹ค.
/!\ —ฌธฐ„œ Anonymous ‚ฌšฉž๋Š” @Guest๋กœ ง€ •๋˜–ด žˆœผ๋ฉฐ, @Guest๋Š” ๋ฏธ๋ฆฌ  •˜๋œ ธ๋ฃน•„‹™๋‹ˆ๋‹ค.

<!> ๋ชจ๋‹ˆœ„‚ค 1.1.5๋ถ€„ฐ๋Š” network/ip ฃผ†Œ๋ฅผ ง€›•ฉ๋‹ˆ๋‹ค.
# ๋ถ€๋ถ„ IP, CIDR ๋“ฑ๋“ฑ๋„ ๋ชจ๋‘ ง€›.
@Block 123.123.0.0/255.255.0.0, 123.12, 123.125.0/16 

œ„˜ ˜ˆ—„œ @Block ธ๋ฃน„  •˜•˜  žˆœผ๋ฉฐ — •ด๋‹น๋˜๋Š” IP๋Œ€—ญ, ๋ถ€๋ถ„IP ๋“ฑ๋“ฑ„ ง€ ••˜  žˆŠต๋‹ˆ๋‹ค.

•„๋ž˜™€ ฐ™ธ๋ฃน— ๋Œ€•œ šจ๋ „ ๋ฐœƒ‹œ‚ฌ ˆ˜ žˆŠต๋‹ˆ๋‹ค.
*       @Block            deny    * // ๋ชจ๋“  Ž˜ง€(*)๋ฅผ @Block ‚ฌšฉžธ๋ฃน— ๋Œ€•ด ๋ชจ๋“  •…˜(*)„ ฑฐ๋ถ€(deny)

/!\ IP, CDIR, ๋ถ€๋ถ„IP ๋“ฑ๋“ฑ€ ธ๋ฃน ง€ •—„œ๋งŒ ‚ฌšฉ ฐ€๋Šฅ•ฉ๋‹ˆ๋‹ค.

4. ACL ƒ€ž…

  • allow : —ˆšฉ
  • deny :  œ•œ
  • protect: ๋น„๋ฐ€๋ฒˆ˜ œ•œฐ€๋Šฅ•œ ๋ช‡๋ช‡ POST•…˜— ๋Œ€•ด (๋ชจ๋“  •…˜ด€๋ฆฌ๋น„๋ฒˆœผ๋กœ  œ•œฐ€๋Šฅ•˜ง€๋Š” •ŠŠต๋‹ˆ๋‹ค)
    • ผ๋ถ€ POST•…˜€ ด€๋ฆฌž ๋น„๋ฐ€๋ฒˆ˜ธ๋กœ  œ•œ„ ฑธ–ด๋‘˜ ˆ˜ žˆ๋Š” •…˜€ protect ฐ€๋Šฅ•œ •…˜ž…๋‹ˆ๋‹ค. protect •…˜€  œ•œ๋œ allowด๋ฉฐ, ผ๋ถ€ POST•…˜๋งŒ ง€›•ฉ๋‹ˆ๋‹ค. ˜ˆ) do_post_savepage()๋Š” post •…˜ด๋ฉฐ, ผ๋ฐ˜ do_goto()ฐ™€ •…˜ณผ๋Š” ๋‹ฌ๋ฆฌ ด€๋ฆฌž ๋น„๋ฐ€๋ฒˆ˜ธ๋กœ •…˜„  œ•œ„ •  ˆ˜ žˆŠต๋‹ˆ๋‹ค.

ง€ • ๋ฐฉ๋ฒ•€ *๋Š” ๋ชจ๋“  •…˜„ ฐ€๋ฆฌ‚ค๋ฉฐ, Ž˜ง€ ด๋ฆ„€ regexฐ€ ฐ€๋Šฅ•ฉ๋‹ˆ๋‹ค.
# Ž˜ง€ด๋ฆ„ @ธ๋ฃน/Šน •‚ฌšฉž allow/deny •…˜๋ฆฌŠคŠธ
FoobarPage @ALL allow *
FoobarPage babo deny edit,diff,info
HelpOn.*   @ALL deny edit,savepage

4.1. „‹•œ  šฉ˜ ผ๋ถ€

@Guest  Anonymous  // @Guest ‚ฌšฉž ธ๋ฃน  •˜
*       @ALL            deny    * // ๋ชจ๋“  Ž˜ง€(*)๋ฅผ ๋ชจ๋“  ‚ฌšฉž(@ALL)—„œ ๋ชจ๋“  •…˜(*)„ ฑฐ๋ถ€(deny)
*       @ALL            allow   ticket // ๋ชจ๋“  Ž˜ง€๋ฅผ ๋ชจ๋“  ‚ฌšฉž—ฒŒ ticket •…˜„ —ˆ๋ฝ(allow)
*       @ALL            allow   read,userform,rss_rc,aclinfo,fortune,deletepage,fixmoin,ticket // —ฌ๋Ÿฌ „๋กœ ๋‚˜๋ˆ “ฐธฐ ฐ€๋Šฅ
*       @User           allow   *
// ๋ชจ๋“  Ž˜ง€(*)๋ฅผ ผ๋ฐ˜ ฐ€ž… ‚ฌšฉž—ฒŒ(@User) —ˆ๋ฝ(*)
WikiSandBox     @Guest  allow   edit,info,diff
// WikiSandBox Ž˜ง€๋ฅผ @Guest ธ๋ฃน— edit,info,diff •…˜„ —ˆšฉ(allow)
WikiSandBox     Foobar deny edit
// ‚ฌšฉž Foobar๋Š” WikiSandbox Žธ‘ ๋ชป•˜ฒŒ •

4.2. ™„ „•œ  šฉ˜ ˜ˆ

/!\ //๋กœ ‹œž‘๋˜๋Š” „€ „ค๋ช…„ž…๋‹ˆ๋‹ค.
# acl.default.php
# <?php exit()?> // ŒŒ€ phpง€๋งŒ ˜•‹€ phpฐ€ •„‹Œ ผ๋ฐ˜ …ŠคŠธ๋‹ค.
# Please don't modify the lines above
#
# A sample Access Control Lists file for Moniwiki
#
@Guest  Anonymous  // @Guest ‚ฌšฉž ธ๋ฃน  •˜
*       @ALL            deny    *
// ๋ชจ๋“  Ž˜ง€(*)๋ฅผ ๋ชจ๋“  ‚ฌšฉž(@ALL)—„œ ๋ชจ๋“  •…˜(*)„ ฑฐ๋ถ€(deny)
*       @ALL            allow   ticket
// ๋ชจ๋“  Ž˜ง€(*)๋ฅผ ๋ชจ๋“  ‚ฌšฉž(@ALL)—ฒŒ ticket •…˜„ —ˆ๋ฝ(allow) ticket€ ฐ€ž… ผ— ๋‚˜˜ค๋Š” ๋กœ๋ด‡ฐ€ž…๋ฐฉง€ captcha
*       @User           allow   *
// ๋ชจ๋“  Ž˜ง€(*)๋ฅผ ผ๋ฐ˜ ฐ€ž… ‚ฌšฉž—ฒŒ(@User) —ˆ๋ฝ(*)
# some pages are allowed to edit
WikiSandBox     @Guest  allow   edit,info,diff
// WikiSandBox Ž˜ง€๋ฅผ @Guest ธ๋ฃน— edit,info,diff •…˜„ —ˆšฉ(allow)
# some POST actions support protected mode using admin password
*       @ALL            protect deletefile,deletepage,rename,rcspurge,rcs,chmod,backup,restore
// ๋ชจ๋“  Ž˜ง€(*)— ๋Œ€•ด ๋ชจ๋“  ‚ฌšฉž˜(@ALL) detetefile,deltetepage ๋“ฑ๋“ฑ˜ protect ฐ€๋Šฅ•œ •…˜„ protect
# some actions allowed to @ALL
*       @ALL            allow   read,userform,rss_rc,aclinfo,fortune,deletepage,fixmoin,ticket
# some pages have restrict permission
MoniWiki        @ALL    deny    edit,uploadfile,diff
// MoniWiki Ž˜ง€๋ฅผ @ALL ๋ชจ๋“  ‚ฌšฉž—ฒŒ edit,upload,diff๋“ฑ˜ ผ๋ถ€ •…˜„ ฑฐ๋ถ€

5. ACL„ฑ๋ฆฝ๋˜๋Š” ณผ •

5.1. ๋งˆง€๋ง‰ ACL •ญ๋ชฉ šฉ๋œ‹

explicit•˜ฒŒ ง€ ••  ฒฝšฐ œข… ACL •ญ๋ชฉ šฉ๋œ‹ค.
  • allow read + deny read = deny read
  • deny read + allow read = allow read

wildcard๋ฅผ “ด ฒฝšฐ๋„ —ญ‹œ œข… ACL •ญ๋ชฉ šฉ๋œ‹ค.
  • allow * + deny * = deny * ๋ชจ๋“  •…˜„ ฑฐ๋ถ€
  • deny * + allow * = allow * ๋ชจ๋“  •…˜„ Šน

5.2. explicit•˜ฒŒ ง€ ••••œ‹

wildcard๋ฅผ “ด ฒƒ ๋ณด๋‹ค explicit•˜ฒŒ ง€ •๋œ ฒƒด ๋จผ €  šฉ๋œ‹ค. (ˆœ„œ— ƒด€ —†๋‹ค)
  • deny * + allow edit,info = edit™€ info •…˜๋งŒ ฐ€๋Šฅ: explicit•˜ฒŒ ง€ •๋œ •…˜๋งŒ —ˆ๋
  • allow * + deny info,diff = info/diff ™ธ˜ •…˜ด ๋ชจ๋‘ —ˆšฉ: explicit•˜ฒŒ ง€ •๋œ •…˜๋งŒ ฑฐ๋ถ€
  • deny info,diff + allow * = œ„˜ ฒฝšฐ™€ ฐ™๋‹ค. explicit•˜ฒŒ ง€ •๋œ •…˜ธ info, diff๋งŒ ฑฐ๋ถ€

/!\ deny * + allow read๋Š” •„ŒŒ˜˜ Order allow,deny™€ ฐ™๋‹ค. ฆ‰, explicit•˜ฒŒ ง€ •๋œ allow— ๋Œ€•ด ๋จผ € ฒ€‚ฌ•˜—ฌ •…˜ด readผ๋•Œ๋งŒ —ˆ๋•˜  ๋‚˜๋จธง€ •…˜€ deny.

deny edit + allow *€ ธ ๋ฐ˜๋Œ€๋กœ Order deny,allowฐ€ ๋œ‹ค.

5.3. ˜ˆ

๋ชจ๋“  Ž˜ง€— ๋Œ€•„œ ธฐ๋งŒ ฐ€๋Šฅ•˜ฒŒ, ProtectedPage— ๋Œ€•„œ๋Š” ธฐ๋„ ฑฐ๋ถ€
* @ALL deny *
* @ALL allow read
ProtectedPage @ALL deny read
ProtectedPage๋Š” deny * + allow read + deny read = deny *ด ๋œ‹ค.

/!\ ฃผ˜: ๋ชจ๋“  ฒฝšฐ, explicit•˜ฒŒ ง€ •๋  ฒฝšฐ— šจ๋ ด ๋ฐœƒ•œ‹ค.

* @ALL deny *
* @ALL allow read
ProtectedPage @ALL deny *
ProtectedPage๋Š” deny * + allow read + deny *ด ๋œ‹ค: explicit•˜ฒŒ —ˆ๋ฝ๋œ readฐ€ —ˆšฉ๋œ‹ค.
๋งˆง€๋ง‰ „ ProtectedPage @ALL deny *๋Š” ๋ฌด‹œ๋˜ฒŒ ๋˜๋Š” ฒƒด๋‹ค.

6. priorityฐ€ ๋‹ค๋ฅธ ฒฝšฐ ACL˜ „ฑ๋ฆฝ ณผ •

•ž ˆ˜ „ค๋ช…€ priorityฐ€ ฐ™€ ฒฝšฐ— ๋Œ€•œ ผ๋ฐ˜ „ค๋ช…—ˆ๋‹ค. ธ๋ฃน˜ priority๋ฅผ ๋‘—ˆ„•Œ๋Š” –ด๋–ปฒŒ  šฉ๋ นŒ?

6.1. ˜ˆ œ 1

@ALL deny *
@User allow *
ฒฝšฐ @User˜ priorityฐ€ ๋†’œผ๋ฏ€๋กœ allow * šฉ๋œ‹ค.

6.2. ˜ˆ œ 2

@ALL deny *
@User allow read

@User—„œ readฐ€ —ˆšฉ. ๋‚˜๋จธง€๋Š” @ALL deny *— ˜•ฑฐ๋ถ€๋œ‹ค.

6.3. ˜ˆ œ 3

*       @ALL            deny    *
*       @ALL            allow   read,ticket,info,diff,titleindex,bookmark,pagelist
ProtectedPage @All      deny    read,ticket,info,diff,titleindex,bookmark,pagelist
  • ๋ชจ๋“  ‚ฌšฉž(@ALL)—ฒŒ allow๋ฅผ  œ™ธ•œ ๋ชจ๋“  •…˜ ฑฐ๋ถ€.
  • ProtectedPage๋Š” edit,savepage๋ฅผ  œ™ธ•˜  ๋ชจ๋‘ ๋ถˆ—ˆ
    • ฒฝšฐ, allow๋ฅผ explicit•˜ฒŒ •œ ๋ชจ๋“  •…˜— ๋Œ€•ด explicit•˜ฒŒ deny๋ฅผ ฑธ–ดฃผ–ด•ผ ๋œ‹ค. deny * ๋งŒ •˜๋ฉด •ˆ๋œ‹ค.

*       @ALL            deny    *
*       @ALL            allow   show,ticket,titleindex,bookmark,pagelist
*       @User           allow   edit,savepage
ProtectedPage @User     deny    * # ฒƒ๋งŒœผ๋กœ๋Š” ˜๋„๋Œ€๋กœ ž‘๋™ •ˆ•œ‹ค.
# ๋‹Œ„ explicit•˜ฒŒ ๋ช…‹œ••˜๋„๋Œ€๋กœ ž‘๋™•œ‹ค.
ProtectedPage @User     deny    edit,savepage
  • ผ๋ฐ˜ ๋“ฑ๋ก ‚ฌšฉž(@User)๋Š” edit,savepage —ˆ๋ฝ.
  • ProtectedPage๋Š” ๋ชจ๋‘ ๋ถˆ—ˆ
    • ฒฝšฐ ๋“ฑ๋ก ‚ฌšฉž— ๋Œ€•@User deny * + @User allow edit,savepageด๋ฏ€๋กœ edit,savepage๋งŒ —ˆšฉ๋œ‹ค.
    • allow edit,savepage  explicit•˜ฒŒ  •˜๋œ ฒƒ„‹‹œ †Œ‹œœ•˜๋„๋Œ€๋กœ ž‘๋™•˜๋Š” ฒƒด๋‹ค. ๋”ฐ๋„œ ProtectedPage @User deny edit,savepage  จ ฃผ–ด••œ‹ค.

6.4. —ฐŠต

1) ธ๋ฃน priorityฐ€ ฐ™€ •ญ๋ชฉ๋ผ๋ฆฌ •ณง€ , 2) ธ๋ฃน priorityฐ€ ๋†’€ •ญ๋ชฉšฐ„  œผ๋กœ  šฉ๋œ‹ค.
####### @ALL ธ๋ฃน˜ priority๋Š” 1ด๋‹ค.
@Guest     Anonymous             # @ALL„  œ™ธ•œ ๋ชจ๋“  ธ๋ฃน˜ priority๋Š” ฐ’ง€ •๋˜ง€ •Šœผ๋ฉด 2 ด๋‹ค.
@Group1    peter,john      20    # priority = 20
@Group2    simon,soo             # default group priorty = 2
* @ALL     allow *               # group priority = 1
* @ALL     deny  backup,restore
* @Guest   deny  *               # group priority = 2
* @Group1  deny  *               # User defined @Group1 group
* @Group1  allow read,info,diff
* @Group2  deny  info,diff
  • peter™€ john: allow read,info,diff + deny * = read,info,diff๋งŒ —ˆšฉ
  • Anonymous (@Guest): deny *: ๋ชจ๋‘ ฑฐ๋ถ€ (@Guestธ๋ฃน˜ priorityฐ€ ๋†’œผ๋ฏ€๋กœ @ALL— ๋Œ€•—ˆšฉ๋œ ฒƒณผ ๋ฌดด€•˜ฒŒ ฑฐ๋ถ€๋œ‹ค)
  • ‹ค๋ฅธ ๋ชจ๋“  ‚ฌšฉž(@ALL): deny backup,resotre + allow * (Order Deny,Allow)
  • @Group1 : allow read,info,diff + deny * (Order Allow,Deny)
  • @Group2 : deny info,diff + @ALL deny backup,restore + allow *: priorityฐ€ ฐ™€ •ญ๋ชฉ•ณ„‹ค.

/!\ ฐ ACL •ญ๋ชฉ˜ ฐ™€ priority๋ฅผ ฐ€ง€๋Š” ๋ชจ๋“  •ญ๋ชฉ•• „œ  šฉ๋ฉ๋‹ˆ๋‹ค.

config.php— $acl_debug=1 ˜…˜„„œผ๋ฉด, –ด๋–ค ‹œผ๋กœ  šฉ๋ ง€๋ฅผ ๋ณด—ฌค๋‹ˆ๋‹ค.


See TwinPages : MoniWiki:MoniWikiACL
SecurityPlugin
Valid XHTML 1.0! Valid CSS! powered by MoniWiki
last modified 2021-02-07 05:23:47
Processing time 0.0274 sec