<metaproperty="og:title"content="Access Condition System (ACS)"/>
<metaproperty="og:locale"content="en_US"/>
<metaname="description"content="Access Condition System (ACS) ENiGMA½ uses an Access Condition System (ACS) that is both familiar to oldschool BBS operators and has it’s own style. With ACS, SysOp’s are able to control access to various areas of the system based on various conditions such as group membership, connection type, etc. Various touch points in the system are configured to allow for acs checks. In some cases ACS is a simple boolean check while others (via ACS blocks) allow to define what conditions must be true for certain rights such as read and write (though others exist as well)."/>
<metaproperty="og:description"content="Access Condition System (ACS) ENiGMA½ uses an Access Condition System (ACS) that is both familiar to oldschool BBS operators and has it’s own style. With ACS, SysOp’s are able to control access to various areas of the system based on various conditions such as group membership, connection type, etc. Various touch points in the system are configured to allow for acs checks. In some cases ACS is a simple boolean check while others (via ACS blocks) allow to define what conditions must be true for certain rights such as read and write (though others exist as well)."/>
{"datePublished":"2023-10-15T23:34:51+00:00","description":"Access Condition System (ACS) ENiGMA½ uses an Access Condition System (ACS) that is both familiar to oldschool BBS operators and has it’s own style. With ACS, SysOp’s are able to control access to various areas of the system based on various conditions such as group membership, connection type, etc. Various touch points in the system are configured to allow for acs checks. In some cases ACS is a simple boolean check while others (via ACS blocks) allow to define what conditions must be true for certain rights such as read and write (though others exist as well).","mainEntityOfPage":{"@type":"WebPage","@id":"/enigma-bbs/configuration/acs.html"},"publisher":{"@type":"Organization","logo":{"@type":"ImageObject","url":"/enigma-bbs/assets/images/enigma-logo.png"}},"url":"/enigma-bbs/configuration/acs.html","@type":"BlogPosting","headline":"Access Condition System (ACS)","dateModified":"2023-10-15T23:34:51+00:00","@context":"https://schema.org"}</script>
<h1class="page-title">Access Condition System (ACS)</h1>
<h2id="access-condition-system-acs">Access Condition System (ACS)</h2>
<p>ENiGMA½ uses an Access Condition System (ACS) that is both familiar to oldschool BBS operators and has it’s own style. With ACS, SysOp’s are able to control access to various areas of the system based on various conditions such as group membership, connection type, etc. Various touch points in the system are configured to allow for <codeclass="language-plaintext highlighter-rouge">acs</code> checks. In some cases ACS is a simple boolean check while others (via ACS blocks) allow to define what conditions must be true for certain <em>rights</em> such as <codeclass="language-plaintext highlighter-rouge">read</code> and <codeclass="language-plaintext highlighter-rouge">write</code> (though others exist as well).</p>
<p>ENiGMA½ does not utilize legacy “security levels” (see note below) but instead utilizes a group system. Users may be long to one or more groups which can be checked by the <codeclass="language-plaintext highlighter-rouge">GM</code> ACS (See <ahref="#acs-codes">ACS Codes</a> below). Two special groups exist out of the box:</p>
<ol>
<li>
<codeclass="language-plaintext highlighter-rouge">users</code>: Any regular user</li>
<li>
<codeclass="language-plaintext highlighter-rouge">sysops</code>: System Operators. The first user (your root, or admin) will alwasy belong to this group.</li>
</ol>
<p>You do not need to explicitly create groups: By checking for them via ACS, and adding members to a group, they implicitly exist within the system. You may use as many groups within your system as you would like. See <ahref="/enigma-bbs/admin/oputil.html#user">‘optuil user group’</a> for information adding and removing users to groups.</p>
<blockquote>
<p><imgclass="emoji"title=":information_source:"alt=":information_source:"src="https://github.githubassets.com/images/icons/emoji/unicode/2139.png"height="20"width="20"> Many dropfile formats require a security level. As such, the following apply: Root user or users in <codeclass="language-plaintext highlighter-rouge">sysops</code> group receive a security level of <codeclass="language-plaintext highlighter-rouge">100</code> while standard <codeclass="language-plaintext highlighter-rouge">users</code> receive <codeclass="language-plaintext highlighter-rouge">30</code>.</p>
<td>Terminal encoding is set to <em>encoding</em> where <codeclass="language-plaintext highlighter-rouge">0</code> is <codeclass="language-plaintext highlighter-rouge">CP437</code> and <codeclass="language-plaintext highlighter-rouge">1</code> is <codeclass="language-plaintext highlighter-rouge">UTF-8</code>
<td>User’s current theme ID is one of [<em>themeId</em>,…] (e.g. <codeclass="language-plaintext highlighter-rouge">luciano_blocktronics</code>)</td>
</tr>
<tr>
<td>TT[<em>termType</em>,…]</td>
<td>User’s current terminal type is one of [<em>termType</em>,…] (<codeclass="language-plaintext highlighter-rouge">ANSI-BBS</code>, <codeclass="language-plaintext highlighter-rouge">utf8</code>, <codeclass="language-plaintext highlighter-rouge">xterm</code>, etc.)</td>
<td>Current day of week is <em>weekDay</em> or one of [<em>weekDay</em>,…] where <codeclass="language-plaintext highlighter-rouge">0</code> is Sunday, <codeclass="language-plaintext highlighter-rouge">1</code> is Monday, and so on.</td>
<td>User’s current <em>Authentication Factor</em> is >= <em>authFactor</em>. Authentication factor 1 refers to username + password (or PubKey) while factor 2 refers to 2FA such as One-Time-Password authentication.</td>
<td>Checks that the property by <em>name</em> for the current user is exactly <em>value</em>. This ACS allows arbitrary user property values to be checked. For example, <codeclass="language-plaintext highlighter-rouge">PV[message_conf,local]</code> checks that the user is currently in the “local” message conference.</td>
</tr>
</tbody>
</table>
<h2id="acs-strings">ACS Strings</h2>
<p>ACS strings are one or more ACS codes in addition to some basic language semantics.</p>
<p>The following logical operators are supported:</p>
<p>ENiGMA½ also supports groupings using <codeclass="language-plaintext highlighter-rouge">(</code> and <codeclass="language-plaintext highlighter-rouge">)</code>. Lastly, some ACS codes allow for lists of acceptable values using <codeclass="language-plaintext highlighter-rouge">[</code> and <codeclass="language-plaintext highlighter-rouge">]</code> — for example, <codeclass="language-plaintext highlighter-rouge">GM[users,sysops]</code>.</p>
<codeclass="language-plaintext highlighter-rouge">NC2</code>: User must have called two more more times for the check to return true (to pass)</li>
<li>
<codeclass="language-plaintext highlighter-rouge">ID1</code>: User must be ID 1 (the +op)</li>
<li>
<codeclass="language-plaintext highlighter-rouge">GM[elite,power]</code>: User must be a member of the <codeclass="language-plaintext highlighter-rouge">elite</code> or <codeclass="language-plaintext highlighter-rouge">power</code> user group (they could be both)</li>
<li>
<codeclass="language-plaintext highlighter-rouge">ID1|GM[co-op]</code>: User must be ID 1 (SysOp!) or belong to the <codeclass="language-plaintext highlighter-rouge">co-op</code> group</li>
<li>
<codeclass="language-plaintext highlighter-rouge">!TH24</code>: Terminal height must NOT be 24</li>
<p>Some areas of the system require more than a single ACS string. In these situations an <em>ACS block</em> is used to allow for finer grain control. As an example, consider the following file area <codeclass="language-plaintext highlighter-rouge">acs</code> block:</p>
<pre><codeclass="language-hjson">acs: {
read: GM[users]
write: GM[sysops,co-ops]
download: GM[elite-users]
}
</code></pre>
<p>All <codeclass="language-plaintext highlighter-rouge">users</code> can read (see) the area, <codeclass="language-plaintext highlighter-rouge">sysops</code> and <codeclass="language-plaintext highlighter-rouge">co-ops</code> can write (upload), and only members of the <codeclass="language-plaintext highlighter-rouge">elite-users</code> group can download.</p>
<h2id="acs-touch-points">ACS Touch Points</h2>
<p>The following touch points exist in the system. Many more are planned:</p>
<ul>
<li><ahref="/enigma-bbs/messageareas/configuring-a-message-area.html">Message conferences and areas</a></li>
