From 417f6dcb2343d33f56196bc24227334a5723974b Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Thu, 21 Jan 2016 14:53:28 +0100 Subject: [PATCH 1/2] Update for file firewall docs --- .../enterprise_firewall/file_firewall.rst | 73 ++++++------------ .../enterprise_firewall/images/firewall-3.png | Bin 0 -> 18065 bytes 2 files changed, 23 insertions(+), 50 deletions(-) create mode 100644 admin_manual/enterprise_firewall/images/firewall-3.png diff --git a/admin_manual/enterprise_firewall/file_firewall.rst b/admin_manual/enterprise_firewall/file_firewall.rst index 4875268b3..17968ac59 100644 --- a/admin_manual/enterprise_firewall/file_firewall.rst +++ b/admin_manual/enterprise_firewall/file_firewall.rst @@ -11,12 +11,14 @@ expressions. Each rule consists of one or more conditions. A request matches a rule if all conditions evaluate to true. If a request matches at least one of the -defined rules, the request is blocked. +defined rules, the request is blocked and the file content can not be read or +written. -Administrators are excluded from the firewall when they -access the instance via the WebUI, to allow admins to modify the rules. -Otherwise they could potentially be locked out. Public share links and syncing -via WebDAV are subject to firewall rules for all users all the time. +.. note:: + As of ownCloud 9.0 administrators are no longer exceptions to the rules. + This was changed, because since ownCloud 9.0 the file firewall app no longer + can lock out administrators from the web interface, when rules are + misconfigured. Figure 1 shows an empty firewall configuration panel. Set your logging level to **Failures Only** for debugging, and create a new ruleset by clicking the **Add @@ -52,7 +54,7 @@ User Agent The User-Agent of the request (matches|does not match) the given string. User Device - A shortcut for matching all known (``android``|``ios``|``desktop``) sync clients by + A shortcut for matching all known (``android`` | ``ios`` | ``desktop``) sync clients by their User Agent string. Request Time @@ -80,6 +82,10 @@ File Mimetype Upload When a file is uploaded the mimetype (is|is not|begins with|does not begin with|ends with|does not end with) the given string. +System File Tag + One of the parent folders or the file itself (is|is not) tagged with a System + tag. + Regular Expression The File Firewall supports regular expressions, allowing you to create custom rules using the following conditions: @@ -107,54 +113,21 @@ and a single typo will break all of your rules. Controlling Access to Folders ----------------------------- -These examples show how to use regular expressions to control access to folders. -It is quite important to note that WebDAV and WebUI require two different URL -matches in 8.2, and are therefore split into 2 rules. +The easiest way to block access to a folder starting ownCloud 9.0 is to use a +system tag. A new rule type was added, which allows you to block access to +files and folders, where at least one of the parents has a given tag. Now you +just need to add the tag to the folder or file and then block the tag with the +file firewall. -This example blocks access to any folder with "Secure" in the name. +This example blocks access to any folder with the tag "Confidential". -Block Web UI:: +Block by System Tag:: - Request Type: Other - Request IP: 127.0.0.1/24 - Regex: Request URL: apps\/files\/ - Regex: Request URL: dir\=(.*)\%2FSecure(\%2F(.*)|$|&(.*)) - -Block WebDAV:: + System file tag: is "Confidential" + Subnet IPv4: is not "255.255.255.0/24" - Request Type: WebDAV - Request IP: 127.0.0.1/24 - Regex: Request URL: remote\.php\/webdav(\/(.*))*\/Secure(\/(.*)|$) - -This example blocks only the root folder named Secure. - -Block Web UI:: - - Request Type: Other - Request IP: 127.0.0.1/24 - Regex: Request URL: apps\/files\/ - Regex: Request URL: dir\=(\%2F)+Secure(\%2F(.*)|$|&(.*)) - -Block Webdav:: - - Request Type: WebDAV - Request IP: 127.0.0.1/24 - Regex: Request URL: remote\.php\/webdav(\/)+Secure(\/(.*)|$) - -Blocking multiple folders isn't much more complicated. These examples block the folders named Secure and Secret. - -Block Web UI:: - - Request Type: Other - Request IP: 127.0.0.1/24 - Regex: Request URL: apps\/files\/ - Regex: Request URL: dir\=(.*)\%2F(Secure|Secret)(\%2F(.*)|$|&(.*)) - -Block Webdav:: - - Request Type: WebDAV - Request IP: 127.0.0.1/24 - Regex: Request URL: remote\.php\/webdav(\/(.*))*\/(Secure|Secret)(\/(.*)|$) +.. figure:: images/firewall-3.png + :alt: Protecting files tagged with "Confidential" from outside access Custom Configuration for Branded Clients ---------------------------------------- diff --git a/admin_manual/enterprise_firewall/images/firewall-3.png b/admin_manual/enterprise_firewall/images/firewall-3.png new file mode 100644 index 0000000000000000000000000000000000000000..742a9dda9ff9136ebf01d39f93fcc9936b6f4697 GIT binary patch literal 18065 zcmce;WmFtdv?dAxg1dVN7Tn!}2M-~^CAhm=H}38ZfndQQxCIaH-Z+iBHI2T`opsmD z+?jc^-k;Y$x~l8cI<@Q6u5-Subh)LPd9>ZkAE)D?ZzE^LPHWh9(?mr&w3Yu zNl4zLMId9?9uZL%5fxN+poZ&TN1S3JkAz_hc0*=6k=1 zON!w!&?891(=so&m8XKKm_Q1JCIn~Tz(xcPww0O_OM3V3KyNr5%Dh*pA<) zpm(rl6zc!dY+N?A;(eSUx{bvDL*A&@#PsQNp8t#R(P>6cAGN^u-rWl8&)UJJL#%^< zgunfk91LwgV<%$=={&m;Z_zbCB@ zoR5R77tR^v^k*agHn?^DGq=I$G%qM6wu)L};D(a2^>}*m0FNB5nwQ^SJU2bB;qv~c zt+iQo^+>1SZ1eR13vh?>iL)j?mKILH!MyCFodubPW0d`igqh)NLK!|(S=<+}5w?gv z3R$sU6yB7nn&>-TBA&_24&t5qQ&D&*^u#2`harbu_JqI+FeT#v8pT^y+kGAt`Gi8# z-~Fv>-Nfkx8YH0A&tn4`cZA%V^a{$j4Vd4KU z^Mg|eZi*FE-|PD0+{iZyS1r?>P?)nw*lBy?n8LNFP|o6CV^Ea2JR_rk}pA zAp^$f5--J#w#%koM3_NMXM?h5X@xWAA5R&Z*B?bzdwr&>l(blZHMK>Da_K4CB} zr#;#-jkYKI*t2-KrPiqyeh$vo7^|0~4JEp>J~(hyG*i73+lbYIA5jf!K#=~$C4>ia zfw#^k;JxLJud>fE4y7Z- zAc6oNz3}Jww+WAoYVpr~YDKWIjyU?}>$>U2@P>^GqvhQE%+AoB2X|5#$&_c%{fF#J zsoiK>RN0OB6XjfVMX!56+{2o1kwrDVxfN@kN_(waN6=@=P2oR5kcF9>y!6)As?=@k z2p18j(Rl>e8`fBMxA*R#&kFRXuM44dUKsZ><|{A1>l-mL%X$wZqG6x|%|Q?rQZf#_ zslKOh+hRQzU$6nt*J{4{`$TX(wS}*Tm@uC(pAei=@yYx7Z;dMdMvJ+Sh>=OxO1Ksw z6CG%hUv$!Ft0`;RkTh2$KD6jyvL->~(;eDfPd+VF{rx4-q88`p zB<;M%3MNkKK-hU&G6OyVYzXEGb^XVtXO86LnzYBGXZPy&KA#P@zRB~8JJ;@835L!s zq~1jhl;DC2$tCpwW~~dk6Qv!LBQj4=`@h;Z2*^k7^mSHW%sy(c3v)y}No_a zd<3y?ov!C4!fi@&VZ$SX%3GYG9F7m$?PuB@%KCTZEonT&f0Oim!avuC&3tr{u%k2~ z*a|rRe>VSU5_;K+oi@FHN@%wkeLC0f64r-uUkh~ni5LRVjO!se&$|ymWWSxIA1w{> z=>Rax|7vRp>D}AS09&8$MDEY8l@xC0oRm`!uU*Z6k*-Eid_*-giMaN>;~I{q^DsT= zc?juK?QGbuLAc4B^b`BhhEvcn>g<#XCGRNmhc$PI^i0v&fUBF;vCKRP(!nn)lb*Q8FDC7?S}(=E?belxlAa#>xh4F9oIiFSVFUsHXy~8bDS2$| zbYx{9xO}=P|k3}O^mx$Znb33Eft$AC=1G=2hJ*iUadv) zfM+I!w<(5A$0)EBJXokAF5&#L0Nu84imO@UJpIt`H<&XnoytPvyV%9D$nuiRq za#k~Da;l)m6@~1svi^uYSQs!Ek(^SK*xLT{r_oHd7^yRR zfjxHY{?mLUw0<|J*z!HnItn$QP%Id+s@DwrH@+$K=q&^I7|Qpy!Kg`^oe& z*;L14xI%QEg(I^PU5GMe$y4-HYodiN`fnFHe7Xa#cO z^UhUaDo$C<{KY>`S|ca=k}G_osVIb91~onZtmfCK1orM6N$mI}#wqa?t?~P^Zk-8%Ixj3);S^d^DYG20Po80ItEw#bVxO8=o z^)PFj{w1WNS`DUR(Gd?;9dqH-FBASpv&b(MFU@O!`mvb>u~02A^?ISlPr(!|?^OF^ z-=nkDlCs8DMW#nhKGR)JJ{ORP4H&om>KFHlL5^$w!%5H9Q6xuGxn1)YL-`WLad+Yr z???BexO9Mqe6C?}2h?WK61!|Q&#;=i(>&$8W^5X}f+IPX*>}g+X6&H+D4jO+@_tQC zWbVa^75E}7B3+{b2D=62S(`O8SvmvrSXMR`z_V&9SJZcnkFd(>{Z z2kD7CuU~Yiic?(5`_Ko=w?d!4Bt9Gdc-HH9DSYLq{>k-u;hxQKAu|R%JD8~UI6@}< zvZBBIB0M`Otz$awC51syVPUMS7wdt za-Tb1r!+3y|EM8cuB^0sqx7m%(fbs6ep2K7D+E|8y_~8<4-}G%&FNAHGZl9ncK@a zl~nrS=?$zE2z~4hL9(-)1Gn2rKY3q3334x6sg>?-ds*n@CJP^lK~X*F0!$kM{7>ms zvUIqKT`{37p2^?^AxAWK7eUfdX_53w#2+! z^zPXE$f|n-1Fb6;%@tv;lNln!V@aM+Jkl}_?K14rRq$H5<=jW~cU`7Rtfb+8UDBs( zUPcge9=nZK#yW4vAaKveQBeNR2lQ`HJU^o`Z%nLAo=d%Gd{}3O0ea z_v~oZCh7Ct1D@J+YaBKz5m6@(vd)|3nl8$PndC7sohTjDd#dG5S0C~|wzx{KgE%F2O-X$J*j(fj zmYFEc?1 z);iC6IqU&b0o%`olE&RBZ5&F>r8&;&tJbCkyFQ99*QBxFD?i2Om>-Ibt!=O=Fs8A7 z~cBuxaM=78p5D=InAJ0CtbWb+zKA&{}%HU+w+ z(VOLte0oMfMObysJGI+_B?MHib?$vXT)*CibzEI($w+Kd#Ok5O2y*8-;*vGl#O*DXf&EzYu@cnxSV6ClJI zXSrIHF&c~vsf4S;x9?H^im1kA-GAJWTx0ClWRJ1%q$LRg;JAEV z!9q$)Y7-z)5PisAO27d-2(ob&Vw2EZSNXzb^lw}rQ=0(G z&gmP6&QR*^f!t|rc7E|u>RE+UYgc!FDmTqn({Z5C9e1I4!=#4npadKh`C(IXsjvCu zyFPn*P~kOo_fCHDWyoA#l4s0`Nxre#ow^+}Ze9j>da^^XV=t-oAK3Nuynk!WS0IhUzSY-N;v)zRkTj~n%i@Pqe;`ri%4Eu%e> zcHl2e)RgwL^Lm#G7;|rIp*{n+`esF`zD``lu$BZy#9Mr;RXzW=8_ z)UF}*B_g4FNmZw&2kORCW4=D=i@pM`OH6a%xZa|DeLgBxHh8C=xb?f$86$nyZ-iyz zY)D7WyX39dVVTj80E^mLsZrO4dhb?C4B+Z#-5JF0t+HPv)1>&Q2E<4q8)uF5*3p`| zeq)pplF4lPMC2)F+A7$6%A!DOU%mape7^sqvQBf|h547wAdp6lp@R5nSUvrXx#>_L z5`{e|Jxx*<8jtSm-@<7}oB#Udf>blk43OWAF>enSJ03vvY4+?^@McZmB=T6L;yb2+ zmxxb@9e6c#=+nV8EYYIHEzx!RcH@j4psb!m5usS#?<(n2_y`&-KvKJ2pMe(@6HNRO zA7^q_x!4K>kf~y4?6krB74oG9z~kWO^}(@AJP?=qur5qs>xt?VW#g-MN*zu5`gFY3 zhJOrKez*x==+sXGPZI$mHjd7dbtsV2b_M&S;h5_PBcz$K_W<2=>X=Z>@t|*p6r0-w z@Sa%WieT|TQ3oQE%^M^F>YrCK+PcKuFvX1gc^I0`{lVJ$aBY*Z$!Ec2%~o;yK|cI? zI-A33F^585+uHeAhKgEWPT-NH8z3~o%jg1@?pqQz7S3<-%UjijZm0>wl8)#(iuOdr z^TIIN;e0psrL8LVuSx(n9#Pt0c>G%L8(v;%xI`5n=bg^J!*A0sY@v)*Pmj-o46;Ub z6W?FcAj?p3T0p_nC8n#JL*3`&d1>Co_GQ28K+E)Q=Pfe?m>RrlTOt{sO#)Q9 z4#JlZmeO-)IH*!XC0hx@!JLwxuB*t5-;?2NvHsqJiRdXTvQRbPvCgJHO;>Rs&|83HdcBRPpNI50&HtsR0)gGQV=3}Dfi!RNjjD*Sy>wh;Da zY}1|ByuCoj8xnW4W`TfvhgahJpq~zYNx2MPPbV#&k%bK-L^g2QBhG7`#-{B zK*6C@U#y@thar=?PcHvbbx-IiB9a$gq9n0{M=`Sh!bSHG(SiSM67N5Ad|&Tn6)Y8* zWPN;u`Li*bR}D1gqZ$%=zP}R`%&4v9^tO>hp|MejrAH|*FaJ;+5gpz4y{yh=K<6*m zB{3-}sKh!XG<4oWPzvR;=BsHli5)+=y86F2ikmc6uCSlt8I)#WgWIa5?wcw5_ zTcgQ-40uQ7(EW@hCkDkF1{g9Nf^MlG>#tnCw%1G&63>PU;GLS-|6n0#LlzzKFmdrbh6*?3?DM_c0v>2 z>{l@?TkJnz%cU~}q z>*E_kfP-*8Z+;Jue9^=1TaU`a3#*ha9d04AO8TDy5r;k;t?{)QZXE$j_UxKN7j8*T zzDl#T#yKL`F!B95qnzhMFdp}v6**%`D;D}(N{@0j$2aDEY?^j9(Gwl%lN-)`6emfi zgI+D(@*xbRxAp37Pc_Z5Q0|oyV{@rJL4wF z-A(;@O*M+qtNt-y>WS|YzlxSR9lm~~UH9K9=b`3-InOWsH6@&s?8@9x?Yy-Z@$ol8 z;N~ZNWawUK^Aey3(Gb{ys_BUaobZV%e~sQOMsCO37XK^2(J{PXK(+PC@S8>%oRnud zIM!9zJG?5MU+zd*uyH?h0MvE){273{+KzQq-0cH@1-Uv7{L#T{O|a#|K{{H(d3TzB zaM?TmyZZ$oR|1-REu`8RASW|%JK0?;6wdX{c-^-9@>XoTaulCS=s_2Yx0q3;R3xb+jaC;y$1<50FdkJpY_+`3Tgqb@Q*%KnG-@05}X zYovEeD!lPrTcAgw9Y(<4k*;J?lCQm8)1eQJO3r}ou7O)7YKP-q4W1gh^)e?j3YPPO ze~ByUqrY?meofu{S$dAGq1g^Cks|pIu|5JI$$YD4CfnAy%1ua2lfJJrekIxWn37|6 zEu1E28a)@nYFZYZwCOlw=@pz3WDH4}5E3;y(z8AZZvO}26;aMOnpgzE=kO4v)pY~8 zPPl`<1Ku)(Egv|_9)&8DaiNcLq}_I>!u3(}-lr{lg)(DgR`8KG?e$`TE5rO8D)!^I z>HLhJ5&X?8-+DSV0Khaksb$RpVXcO?y8Ri`Q=9?^A6Ie6hg?O$%Plb;sZ`BTR?1%o zU5MCMCBx9iwr*Jr@?o>(uW$0z@3gI)fiOrax|FoYxjzu8>@Gfu@2^%39#){)z*G5D zS9UAO6_TX#Ydl&2A_!gZ2}$LJOt|LIzh=u*Rkglb5fFk?TWKTOjt1Oy zR_{F?ct8G2Kb9#S{bdW=CaC`1tyBL#HX^N#Kq8#n)R*U-56d;tS$_$f7MkroP+qRR z=Qq|2=V0z6lqNf)*$KJT@K3gyk0O;JTyAPv8D|zIWgjLyx)*eo4auB2b}*W>8wG$Uq4l06X>_n zIDN?vIl&htZ%2ZMa3rI}i@e;d-pG06>W||LneUv@z5;o?on(j{%;`${aHyUg1*G`? zEJfH-btXRv7=iOR8l0GEFM}C4p@Sxj&ZexvXWhwFJBH?(qt>ERJWpn6Usvw>vL9=j zxyMvm04JR508>2A33w$ZQ3GU5hVla$`xwi=MUc%LzUc5U>Y=SWlL(v9RBVafDeYI; zqUeIh+Gy>EmA;sJ;W$HVvC&)wS#-XCP;kn~2z;0*VTy`MyA?#EKYfHFlxp`y$JwZQ z;i~7i*%RRa#E6%larHu`1^m$JKr6{Kv~&`nb}z(w}S*a)LxEGL$yzz zP=5UQ(MTBu11+}mOWFUD`6$kJ2?|mF4Ew(^kpBle|1bQdeCl&n(SPEt5Buj5|8P}d z+^-}=8V(NZ^wH3Hn}P3~1=hOX2v}fXDnj?m;s1iT7d5Pv7RZ5|BW4uMstZ3|A9bOWWbN|Fu6`|Q~5y^#rdqPNe{y%fY3d##JXke49%X_wE0iwO)kzh zNWJPG6y47Qf%N(9mOjEj9aeZzQy;EW4t&G1va&M9>1s2_E%Of;(Hr41Iy`KAI8*%F zWujQ19cB4XL@PDkzEt);9!+#Xvm zR#T2=@g?tmjA%&tf)+m{ZD+?COU7q%y*Ex@%?Klq3qf(z5~_ZFe*aKj*&9Ws?VTMV zpBt;lQF<7Ik&^vI5#TEu;Tln5y}Q4k-lF^;G{?5l$nkAj+kgAo=0YRs$4uLK_-Mr{t~|*AfX2Y+Cu4@BL-Iqyk`5 z&C>is-*dtyv5KV(O?*ec>x8x|4ZtPF)}fZs4w!3PoBNWfYYAAQAgMCQ&OF|ly^PP? z&@KB-eVN?rd@H-<;phj5*BE!`nL_+(L3Fqg0#H*tY}T#F_vhhQ7fe#STb#07^N%6S z2acAEeIYYga8c*lw*oGD1#PMr4OccV;`l%FjQQ;wtONYHA%^q0B|Q&3ET7HmE-PxZ zlXdYWDtBmhzGL;M;G-@CTSS#UB%Gc6rxsviTwsdj4r4>$TTxxKA`gEV=;cN0GNBc! zWJq;QT}{E85Qu>6vW)p^KGNIw^@ZS&!Fwy4^>^G}Cr7v09X{s$Zd^Om%*dV5!La_t zus18kgst{<{AQI|t9fK&^4#e8uf#GymFjHg>2e-oH*(`z`C(GnJ**et$1&VQCTN@| z`)ndn8&gAUPg4;WqPrt69M2ZYs$m-TJF5RD{2nKsZfM}+2MJNWQ2TU=QE3C|DLB!g z`^)A1`^Ti=n8V%gw;<1Zmo;Y!LxGW;KcPiovu5M0dk!i+053dWHe)v`D2_CFrc-In z{-~#f=`uhhiz|meJ$|$41r@R7j?;IBk;I1~sRNAD+M2nWq3b%l`Ea7!mbRlxEF>hS zYvhaF>=wN#v$8#IaU2w%(I6ab+P3IrtsS#IgS|v+>|Pu z}y`q^y}MP9?uF`AwnAk+wp?z37}kr@|1N zXDKlKQtjOF>_={*tU3d60Du1cm5{`#TM{PeK< z6#U2LB~Lf6s{-xY)CT+|rFEk_jqM$u#YcSG%mJoiW-Vh<8&OHlg=59|TI;bFFRo^+ zQOU!BJjhk&vJ%S#9k(^vgFS8Z;ep14TF#@}V z554%|Jl{v%;?{&CMf3=$a@OSUp|_Cb^-Fj|l2t_4L7VkF(O@X*q>JtQ?;Df(<Q1*$IU<~k02y_|I*7giGOlouZqL)hVZtXdq*=V82D7z|#@ry6eiBgmdB zm}z_qxqy!HpdE*qDs60rV!v)Cj7Rq2t1fP-UHwgvOUdFFj;p^7NVEv<kd8& zau0$7)7TDicS&RfjUUQUFNCmniX?0IqAn-5$GeX%)`|2*TAX*jm=qcS}sZix>@ zIWC%5ld0;uFt9fxh^YTQTuUZ0M$+?kxw~AX2G%jIMfS>g?Zn-jfHH9W#gP}EMplY+ zT7b`Kv?brOZco)#YqycPI9h$R8ccR*>T{_;%mHsHA6x*@oEUj0NvqU$EbT_U1k3GO z4cq4gpseUhWpYCdM1ix>Vlj+LgUuQhfJtH0gC4PrNd*eO-MYNP&H`e3qDbmZ#P-=* zyOKT!7Z+}FxyevjR=1{&;`hJzm;EmnY_5zzNe5-Ew}#$)2)g08>&`eT-A`%Xm^xd2 z=B3jDpCUU?fmXO>#wcp<-n$Y;zuHX@iY1|-NB1Cp?oAb2tea<5bL^=NRH?Q3D1-da zoIAQ|i?ySScw_v#y+BBkEFd*Z}7W} zuktjTmF}ED-KiB}N7S4?wgXmzg|*yuL=f>jA_Fg@;Ircw{q)c06pA>1ATnC%NeBfu zm)gj49viLkRa=uW44}Doz%ViiY|WE^3j1EEv;BGEWVo%2ITtardY~7UJz}bo1 zA1>KVjXCOp;H2nG-~je@i=FD(&2=bui_Z?G6hpq9FXn__y+48!2s^QfoaQj z4dXD?BNlcOyC`@yT0mLtQv-Ud>xz}`V8-9oCk9V3DAw_#T8TW9ysp+B;7cs#0Zti$ zKZ=41E9(k?Kt338EI`DcINUArCYrOh$|~CwSjSJF*t7VXL8iuO&tj+UVC#k>IgcXg zTG$Di>W@0p{%P%=Hah+My~}skAXOcXWHu$O#P$34)sz&GX^pwX5-)=bf0eAM_xAs6 zE1G&bAXk(4iNj~5pHxX)^c@A$Vc5hBB=?jQR}5S6C;SNRcyUB(#$8x&eC zwKB5BvGzE>;P}X-&j|^SCB`1|)}l`bzRek0xLBL%7F=nOxc#E!0Q7#41)uK3yD#&$ z-ne8T2ih-ku!2@oqJ8=PoCxi8!yGhf@tXkzQJkW+Vzk-^L=D=chVxn}*orn@rsda2nD9{m+0+ol(92zI5Lm3I7t zvyhSTM7`vg}vY5b%2v2tqzf9wU`MW|L7O9uzVJ=^dH?fS1?v|&<&0=v>AWn5nhKus}0umXR|7CCYZ`8IP^>iOVDS@MHEB5GYbBet8^x z>U0ya-j~HIBD`5Fe|Bb;cEV5(^|!!?r`2zU&z{w@c@zU55I3{MifZtx!;>in3cV-m zDno|}`Ug{`&vxOs+| zotsT(*Icha>Xh4hJ@0J-)e%G8cO)j`e}WGe?{a*jqAK_S#}ekU8xqT}&=9TeplpVi zBHI+)@z!W;Dq!>X+XPjRup4P|iTLnJm@#5VrQ46GDo4e2MR#hw1dG@svKlsMZ^xnScI}8(IsuHk=IX zN%M+U{eVQ;8;P&1-n-dU{2g2QUB6Skost=foPi{$`lQdSq~`k-B{`=Jl6lK@rwsoj z$A?v;PJ%ht5rr!4wUO+;JK20r&td)dI%(K9(q?z|834TH0+ zZnPp;`^i)9k}2iK=rA$lN>3P7%i3z2Fisr7=i|WI@44^WWEtC<>^~L=-~O!NrPVa8 zdoITQQz5cx-;$#pnhU~iz4|sg|@X#xM+18=`-oPuB8Tz@L01W~DZI!kW6G2`O zH>HqZtZ~Ng zq7-&In4%G-!e-O`{f?LS_niB4IaDEvw0$X+T(+p?^O%q9`j1A|Rm{syw6h(n%g#gc z8$2VxkJ>w*kfq+DDn?(4;XFaIF!E_+fdXfJxX}};6!wJg8dS&F7F!Ou!SFD6Ie|pO zaRH7OX@S)5A*E+?$0u3D2&o&oU+DqA*EO_GxagjsX*m#KY2cekVOWg}Uv{U}a;^0t z!R0CQv#S-a_Q8`E>M#8Ka(dIpw1 z*)01xN_HCij^}kThMm42W$2ag-$vgHA9S@#RdR1C1dHc#uyL(PJ%jTL;o4>EiqX?ipA{%ZqSCZ)%bRflII+=18ba!eRTC#sb=0M0Yh;d7%7KS1M>SefEtTwHq!b zg8Qbj#i0N>I;2_C$%+0<%IW(H6mV*_}^s}f~`;aL!Nd9HTOyY>6g!#lV zp1c(Kri@#{wwMhY1LLPogT={8V|0`Ks^6oyNTUto=t`qmKRU65m2qQQ6I5(BGUzBNJd3R#DGKr!UkmuD)*=DBY-5(!mW3 zSAVc?54j$=9PFuvHXr3T9}Z~qS_BA7hoZ#`>C-{}9O;V?eEn}+59O~Zh%{r2cX}%Z zePEV#lNE$+6I85XNl1@A=!vrxE-NtMLf=BIHQQ)<>PAj#N5tvSzIj@Lt6)M^Tbwvm zn95e9mhAK1n6(CvLrWu}XZH(%ZouDHqqJl+e{i7j(z0JyLd)2u|LKWKl1x+K^&~09E{0G7eW54e&(aV;I>-;HFFXT7nU~&zn z2-xxA;!gkeqi^+eJy%?*L3mE18ebZ^E{Eu$!+soU5CS4 z;!+lxJ34k>E3)+5`gNp$WHDExz17Xt%!fg58RUb{)%thrS%Wu|%~Sr$`@IV3g)2Gr z-AdH)`)&2qRWtZv7pR7)_bHzHs%H12IxX;~R<7*%f~kpYg#%W`YD_9?+VWxLiB~?9j78}N2z9XGShigHnqcE ztJ!9jvu`Z-7OqrO93)cPhg180Zw!2)r;osh?i=nEA|OV?{oTOhuMe93C{+(`L(qMf zF6e5Y)*-5jV0;&4A=)0Dl_uVbfC*#-$*+qk#=`&Y)Q=_9RsC1dl@r~G!pUZ1UcE@W znV=F}-=`)cumiJv_W>vJZk@*#MN{FALkw+Na_4nut~CWLw0klA_3H(T`^d?hg07FG z&pTBaCq|AI#wT0mP{3LJ%EA6(VP=LyMP+!_ZE0y)WKAex>dh^1vE|w@9q*O)`a8vO zfU(R@v-2J?x?N>=8W5_b2|BdP5KCQ-*=}9UdSU76%tI|EfFW71;j8k{S?j?~SGELD zTua|smQBtrP91t;@PM#Nj$!gS`U?Z%!u!QKLO+O>AOgEXZ1*B>4khU4^DTbGSLBC0 zVxDFtZwo78oR$nJ?$boKN3i9SV?`4P`%IW0ho$-CPVbk}XH^S~mU+EiPZWoR8 zJ=fgDfi=%BAGSf0iySZ164YE%ZWjiid8wpe4XYlv4k%fZ-vxI(+YBe^pB*lo`3IM? z_NGWW7L+K={L2@W#rkHY`=)jT zQUP5DnnBT`*~l6ps4C^U`O>=+OA~`JZ{1Faf~qMlzwRA<^q$K_>`D3iEnbadC+Vp> zGpt^%%uoBm&@cWgXj)mD!?tDp>D>x?w** zWnGYxmvE1zKPB3tN{2E+qBaTN6GAo$5fVve#Ahx%`#hN^^ctxQJLk1 z;TGXF9SKvFhz7%NbSOm8p#cE_cFH^bSagARc+59|U0>6qmF2{84;>S=ZHK?qK& zF)tbHYU2NqT))@0M|~48Zc%YJ#2Io?S~x6;OWJO^?g`U&NH?yVpkQEBPHcyk@pF5G z;=For6YBhvY5bp5{bg=J1&hbdt@__^qyLc#M-hsQDDd#`u$1}e|89mx5sTs39wUFPZ{XwWbpn~ zk8D$@9}1zst{gq^emL+y3@UdEg2`Ms$zuQWR#3d7{(D8k*Gw_ryEzY-$1uPDFV$z? z?h1b6xdEOhTGXH~gh2A`>A^E>cS01Y3Dw+^!1O$j{ z7FiHJ&M`Nysu&s?hN`-8d!XkiY@{;q@evjiI6FI&V9Y;s%FH>lr$?ux5b&zdva(jf zSQEh4RkpW6f1=tx&i+ONnx_5-0Rt=Q%8rHcSqfN)az%*;2UadFE-=qif14TnE~L!E zu!cBS6-%HnVA`r5>@x2`QiyRC3DX<>Zz?uOrKKXWc80%Sd**XmPLth%nK9s<-C8|( zX_5H`3&9P}E4iZ03*IjNt|C-fP(-odQ$U*azA7}}`mbZh>q9B)Mn3vNSPpR3A2eM9 zzlUD|t~+cDhYDUQlo&b~+m>GvoI?oGR4MzinY6A)l%%cS$ph4}xRqgI5;-unxsjo( zL!M}qW+DT{WA{F^wB*`6`Vf?3#VE#@VW`&G`)vP4b#-d8-nGmRrlhzl#ul90SFjLU zBzc}T^1dy%9#iv6)JsxEk~Md<*h>5Gc1;`G;3aNm$NK9Htq*$=aaWI)_hrZ^uF=;3 z5R5jOBVj8e)B<^NRnd-HSt0g&7FoJs`OfNZPSDd&Dt6*@o`=1pUUrx!x?hF==Pt55zq1|o=Z@{5yXiZahW=^3K%7a3_G4mwYLb2uhXT@CuAGq>roc0LE$&XPK~HSg*CSC4ReqjF4)s#2 z_^#W^4s^e)5u1>Pcgy!OI+>oJJH}Z?tASH^+rsozAD3UY8ZvFIcpgY6X2ti4(9UTt z9X&kgQ6|L30Na#f5b^Ow)WP~iVyQU;7>#l_VaNR#{{t99_1gjic$~!h32O(!J^#-k|BRwiVRm}CWy%jh-mau#bs`qsYayr8{egTe$n!cS8(~ zR~w>Yt&6*bRKa$;Yp9c#{`Kfz8Acg5`cl5Ne)#YNft}xytX?GNykFMtZFcpl-NJ_K zDBFASv(E1UNP2niN#V@m!r#?rnoR68rE^zOm?h-NfLlh<(xqKu~ zh6-Oui2C?zyg{4vcz|PJpbW^{{P_a%(m@nSKOZn0tamN;>s$_6&yBBuWt8ljclflq z4s%Y7u0*OGh-c@%Xo^zJXmyOsAErBP5JtM#O6DYzb^j-4HnllnnXycR7tE6^?Hh+r zaPqpY?>v7+q@Ox4Skq;445k$1sQ>BUT>H4Hw!H2`*UZcLC4mqok}fGS{O$*N$Lq=O z3-C|ZTE9tf?rFnH2UpD`8v?Iim_}$7ZJkXiq4zOB}OOqu41{yQ76|2 zoEhgD;95SdrN+_I5LNgy=095(Ktg23%m-ldrJce?isibfM+cw%lq~8td-_F{%wBgF zLd}#PgYm*tdT2T&gBaF?kqQW7#&o}#pL(z!i7Z5g<1OOVcDFNv)N);4DHyuSNuI}I zdEfj|8M%UZ-PPFt+!LCfKknu8TpvTKW8j6Qh1DJqcaUNQe;>Z{o)E1!;JWELRb_Xy zkVOC;9z(CzCbgS3;w&&q$HBBMRYoKt`<*?YDyAiDHIo|pmQW8P3fi9wNQ?8La>IR#jE?IvtxL#Qt%nA-|N^{53I~F1cRXI&w`NG zKO)_WJ1fWTW3Pp^6#jy_Z~6D4IW(Or7jd>Ha<65||9A8m;9jAJts2Iljr)glEK&|_ zxfj6_hk_4)YDH##;SnLKZXY1kC*oRb2Tp&uj zC|bI^W8^pKMk1&62UNJb=gLoAF{MM#;hdf6V-iN-^7!-_^KJ8fmymoTVE!p3^=4?D z3a4e|-svz;M*anBv!O^1yk3dx$$|oCxmN(miBfmmL4%w-aaAVfsw`oI>q=j}MeesdZ+}yW=QXW}?&W<@psiK#+~y{_ zRNFJ}m(6`##3@nDMcZ^OtUzaMd4HE{#A#`XOqJ<@>MR$^!-JIF7?RxFeOZ>IbH9Ro za&(8IF~r-ut!jEIuL14G?(=@Aj{D7Gs+{)I0h0S3QUken+TmKd=cVluZk5^a;o}2qpnfcOU|V-@I6?FPaTynUp@tBLdQeA5SyNl#Rn;bT_C>a)~dUo+|!??jjXNBNIJiMAdhFN zfYLS)3fM3ur@_I!<^1=*01(Ho7hlLt=_qR`#vsW=4dV-e)!+|nift{v_6(_(Sn388fq?31XrN9SIjhK|~>{94c9noGfCj zXaRqJI|qZ@Gzmw>horK|s7S9!lZa;Ij~X)g>NJ5akzd+RJyy?(8+H)hHLglEpL#Td zAqo%mYni#KlP6DmIoA@hzf3qg)GgL(b95FxoxVTHcXXXuzW^>2(iU#6_VP@h2eo@& z9O{;CG|p6TkKN+VbDT}vZWT!0h9wU;|512S(KBImoRhfOpw3fq-|P~Mb)B&m)%g-h zkT&V*ru|dRuw>oc4ofP2Bg34StHuJ~=#`?#!GmSv+$qEPoSQxsN(Kh&!BIu0rM5KeqB(?JTD2^ThMVUxJ{|-VELo! z3{^uUL()1*phM;)m|87?KTD+k#*wwcv)J!U#?0))*{764T3t_CB@a8(of;Lld6JB` zX6>PG7?%~f$&c=&7{^h`1@AsMGTt)^g_YGjraPTeTiy@hqfBluSe}{bPI7Ei2QvzN zMzD=R7s<8w(?}#2aa|*t43V(jbQ*vs12yRAfCKGfjGB2b7W1feTp=Q_t3Lq)9@P~! zmg=%$U(?ZRzC|o&7N6e7R^O1sR8^Z^in+5!z4q+aRPGFnr;0YUWaX%qh`-odIK5fl zrNJ}Ev6?uQj}U<$@wdodz12F*6Tu}#4f78fiF+PC8zlPDgkW|kSR3pJ`S_bZ#ypmm z%xVkbKct9!N(5McK(}9`&N)RCk$4OYwnon3joq-{YyP8Lq9%G9qwgt8nI7tKxkcQK z-waPN!xk6A1qE+gmvr*jJkExs~tAlW-gS9DJs^5Jv%?zIMl-8y>KkBne?wwOf_ic6`DtJ(>9{?;!K`+tjaUB5h}J zl}}^A@)azs33Krcm-F3gYgzT_Bxc|9Fw4$9(aqqko=#=!R(8j)r7AMO8?|>TS6tY} zvs=qqcH8)Vmn^0aHn87w77Hfmf+`hu%TC^1_Z<5=P2846uy!uD-d>Ymy}31stM0#x z1flKB08nwpx3L?XCc3c9DWuC6YQ963TT7%cXo z$SD|(XxMnM)VC=#cYZ7;0llc{T1yRdTjl9kiJFR$0LF}#Y$ zmuSJ0fp8p$P$+cjHy$(U+U_9ad+zq`-Aiq4ZLj-jZf+)#NMPH=UKCA=$>nkp3WW%V z!@AB&oT_2_%NWP>o33Wd^B?fjoaM|456|dK=D-#{+;c8BJ(}m!sYnSi41-7{LL?F? z_MwPKKPe#O!CiS353D|qRx6*8=D~1q{4=;?%>*Wgl(a=eWcVl`Eh=_<3k*XL(L_{RVzixlnkWmuh Q!T5C8xG literal 0 HcmV?d00001 From 13cecfb0f611fd951750b2c32b5ae27bb5d24d0e Mon Sep 17 00:00:00 2001 From: Carla Schroder Date: Thu, 21 Jan 2016 08:42:40 -0800 Subject: [PATCH 2/2] Update file_firewall.rst --- admin_manual/enterprise_firewall/file_firewall.rst | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/admin_manual/enterprise_firewall/file_firewall.rst b/admin_manual/enterprise_firewall/file_firewall.rst index 17968ac59..6274eb4e5 100644 --- a/admin_manual/enterprise_firewall/file_firewall.rst +++ b/admin_manual/enterprise_firewall/file_firewall.rst @@ -15,10 +15,7 @@ defined rules, the request is blocked and the file content can not be read or written. .. note:: - As of ownCloud 9.0 administrators are no longer exceptions to the rules. - This was changed, because since ownCloud 9.0 the file firewall app no longer - can lock out administrators from the web interface, when rules are - misconfigured. + As of ownCloud 9.0, the File Firewall app cannot lock out administrators from the Web interface when rules are misconfigured. Figure 1 shows an empty firewall configuration panel. Set your logging level to **Failures Only** for debugging, and create a new ruleset by clicking the **Add @@ -113,11 +110,11 @@ and a single typo will break all of your rules. Controlling Access to Folders ----------------------------- -The easiest way to block access to a folder starting ownCloud 9.0 is to use a -system tag. A new rule type was added, which allows you to block access to +The easiest way to block access to a folder, starting with ownCloud 9.0, is to use a +system tag. A new rule type was added which allows you to block access to files and folders, where at least one of the parents has a given tag. Now you -just need to add the tag to the folder or file and then block the tag with the -file firewall. +just need to add the tag to the folder or file, and then block the tag with the +File Firewall. This example blocks access to any folder with the tag "Confidential".