Access Control List

From HSYCO
Revision as of 19:15, 11 March 2014 by Ulde (talk | contribs)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigation Jump to search

HSYCO supports server-side access control lists for Web-based user commands.

The acl.ini file is a text file that defines the rules to allow or reject commands.


Note Changes to acl.ini are immediately effective.


Each line defines an access rule, with the following format:

action; user_id; location; type; command

Rules are evaluated starting from the first line and progressing down the file until a match is found on the user, the IP address of the Web browser, the command type and command.

On the rule that matches, the “allow” or “deny” action is taken, executing or rejecting the command.

You can user the “*” character in the user_id, service and command fields, to match any value or values starting or ending with a specific string.

The following table describes each field of a rule line.

Field Format Description
action allow | deny when this rule matches, the command is either executed or rejected
user_id string [, string]
* matches any user
one or more user names (comma separated)
location local | remote | * clients with an IP address that is part of the trusted range are “local”; clients outside the trusted range are “remote”
type io | timer | camera | *
* matches any service
command type
command string
* matches any string or substring
matching command string.

“io” commands have the <datapoint>=<value> format for I/O Servers, dmx.<channel>=<value> for DMX, <IRTrans_id>=<command> for IRTrans commands, and <name>=<param> for user commands.

“camera” type commands are formatted as <camera_name>=<function>.<action> for PTZ, or<camera_name>=<mail | download> when sending a frame via e-mail or downloading a recorded video.

“timer” commands are formatted as <timer_name>=<action>


If no matching rule is found in the acl.ini file, the command is rejected. If the verbose log level is enabled, an error message is logged in the daily log file:

2012.01.04 16:25:10.223 + ACL ALERT: DENIED - USER: staff LOCATION: local TYPE: io COMMAND: user=test

Examples:

deny; *; *; *; dmx*
allow; *; *; *; *

Allows all commands from the Web interface, except for DMX control.


deny; *; *; camera; *zoom*wide
allow; *; *; camera; *

Disables all commands, only allowing camera control commands, but not the zoom-out command.


deny; guest; *; *; *
allow; *; *; *; *

User “guest” is not authorized to execute any command, all other users are allowed.


deny; *; remote; *; *

Prevents the execution of any command from browsers that are outside of the trusted range of IP addresses, as defined with the trustedNet configuration parameter.