Mumble - ACL Management Guide

A guide dedicated to explaining Mumble permissions and roles. Will walk through with several different tricks and tips allowing you to configure your Mumble server like a pro. Please refrain from adding me for questions, and instead post in this guide.

Introduction

ㅤ


ㅤThis guide will cover information on Mumble ACLs as well as a few tricks and neat features you can bring to your mumble by customizing these ACLs. All this information is from my own experience and information gathered from the many different out-of-date information sources available on Google.

ㅤI will be using the current developer snapshot 1.3.0~1015, on Windows 7. While my Mumble may look different than the current version you use, rest assured that both operate the same and older versions still can use this guide.

ㅤㅤㅤㅤㅤㅤㅤㅤㅤMake sure to always download your Mumble from the wiki:
ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤhttps://wiki.mumble.info/wiki/Main_Page

As always, make sure to up vote the guide if you found it useful/good! It encourages people to continue making guides.

Permissions

ㅤ


ㅤWith the exception of the write ACL permission, there are two different categories for ACLs. The first is server-wide, which are given in the root server channel and give the user the permission across the entire server regardless of channel. The second is channel-wide, which are given per channel and give the user permission only inside said channels. Server-wide permissions can not be denied at a lower channel.

ㅤㅤㅤㅤㅤㅤㅤㅤㅤExample of server root versus channel permissions

ㅤㅤㅤㅤㅤㅤㅤServer Root ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤChannel

Permission Descriptions:

Permission	Category	Description
Write ACL	Both	When given at the server root , grants every permission except speak. When given outside of the server root, allows user/group to access the edit channel feature. They are able to change properties, groups, and ACLs for that channel.
Enter	Channel	Grants the user/group the ability to access a channel.
Speak	Channel	Grants the user/group the ability to speak. A user entering a channel without permission to speak will be automatically muted by the server.
Mute/Deafen	Channel	Grants the user/group the ability to server mute/deafen another user. Users can rejoin the server to remove this effect.
Move	Channel	Grants the user/group the ability to move users in the channel to another channel as long as either user has Enter permission to the destination channel. Functions similarly to the Enter permission if given, allowing access.
Make Channel	Channel	Grants the user/group the ability to create a channel. They will automatically be added to the @admin group and given Write ACL permission inside the created channel.
Link Channel	Channel	Grants the user/group the ability to link their current channel and target channel. Linked channels allow users to speak between both channels as long as they have the speak permission in the destination channels.
Whisper	Channel	Grants user/group the ability to use the mumble whisper feature. This can be used to talk directly to another user, or to a group of channels. If the user/group does not have the speak permission, but given the whisper permission, they will be able to speak using the whisper feature.
Text Message	Channel	Grants the user/group the ability to use the mumble chat feature. This can be used to text directly to another user, or a group of channels. If the user/group does not have the text permission in the destination channel, their message will not be sent.
Make Temporary	Channel	Grants the user/group the ability to create a temporary channel. This channel operates like a normal channel, however the channel will disappear once there are no more users present inside it.
Kick	Server	Can only be granted at server root. Allows user/group to kick another user from the server regardless of target channel permissions.
Ban	Server	Can only be granted at server root. Allows user/group to temporary or permanently ban another user from the server regardless of target channel permissions.
Register User	Server	Can only be granted at server root. Allows user/group to change or delete registered users from the server database. Can register other users.
Register Self	Server	Can only be granted at server root. Allows user/group to register themselves to the server.

Options

ㅤ


ㅤThere are severally toggleable options that can be used alongside ACL permissions to further customize your Mumble experience.

ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤProperties

Password: Automatically creates two ACLs, @all and @#password. I do not recommend using this feature as a whitelist is superior. Furthermore, you can just manually add the cvars and password directly into the ACLs.

Position: Determines how the channel will be ordered in the channel list. The lower the number, the higher it's position. I suggest using large numbers in between each channel (100, 200, 300) to allow you a buffer of 98 numbers to later add/move channels.

ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤGroups

Inherit: Users specified in higher channels will be included in the groups for this channel.

Inheritable: Users specified in this channel will be included in groups for sub-channels.

Excluded Members: Excluded users will be denied group permissions in this channel, and all connected sub-channels.

ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤACL

Inherit ACLs: Permissions and rules in higher channels will be included in this channel.

Applies to sub-channels: Specified permission applies to connected sub-channels.

Applies to this channel: Specified permission applies to current channel.

ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤAdditional Parameters - User/Group ACL

@out: Affects users outside of the channel. If @out is given enter, users outside of the channel will be able to enter.

@in: Affects users inside of the channel. If @in is given enter, users inside of the channel will be able to enter.

@all: Affects all users. If @all is denied enter, no one can enter.

@auth: Affects authorized/registered users. If @auth is denied enter, authorized/registers users will be unable to enter.

ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤACL Permission Ordering

ㅤMumble uses all active ACLs from the channel to determine permissions for each user/group. However, the order of your ACLs will determine how Mumble reads this information and decides whether or not to allow/deny something.

ㅤMumble reads ACLs from top to down, over-writing permissions as it gets closer to the bottom. So for example you create a Booker's Trash. Inside this channel, you create @all [deny enter]. No one will be able to enter the channel as that is what Mumble determines.

ㅤLets say however, you want to allow the group @Booker's Fans to join the channel. Underneath @all, you would add a new ACL with the group @Booker's Fans giving @allow enter. Users in the group @Booker's Fans will now be able to enter.

ㅤThis is because while @All denies enter to everyone, @Booker's Fans allows enter and is executed last meaning it over-writes the enter permission. If a user is apart of two groups, @Booker's Haters and @Booker's Fans, and you then create an ACL @Booker's Haters [deny enter] then users in @Booker's Haters will not be able to join the channel, even if they are apart of @Booker's Fans.

ㅤHowever, if you switch the order of @Booker's Haters with @Booker's Fans so @Booker's Fans is at the bottom, then users that are in @Booker's Haters will be able to join the channel if they are in the group @Booker's Fans.

TL;DR: Permissions are executed in order, with the last permission override the previous permission.

Advanced

ㅤ


ㅤHere's a few great examples I can give to further educate you on the possibilities of Mumble's ACL permissions. When I refer to something as @all [allow enter] that means check boxing the enter permission as allow.

ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤSpectator Channel

ㅤUsing channel A and channel B, you can link two channels together allowing both channels to interact with each other. However, if you add @out [deny speak] to channel A then will be unable to hear channel B, but channel B will still be able to hear channel A and talk amongst themselves without disrupting channel A.

ㅤThis is because while channel A and channel B are linked, they are still separate channels. The @out [deny speak] in channel A prevents all users outside of channel A from having the permission to speak, meaning channel B no longer has speak permissions in channel A.

ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤGlobal Move From Entrance Channel

ㅤUsing an entrance channel that all users must join when they connect, you are able to create a neat move feature usable by anyone. Adding @out[allow move] to the entrance channel allows all users outside of the channel to move users from the entrance channel to a channel that the mover has enter permission to.

ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤMove/Mute Inside A Channel

ㅤIf a channel is given @in [allow move & mute] then any user while inside the channel will be able to move or mute/deafen users within the channel.

ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤAuthorized Channel Only

ㅤIf a channel is given @all [deny enter] and then given @auth [allow enter] then only authorized/registers users can enter the channel.

ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤCreating A Blacklist / Whitelist

ㅤUsing Mumble's ACL group feature, you can create two different groups. One to reject permissions, and one to grant permissions. For example:

@whitelisted [allow enter / speak]
@blacklisted [deny enter / speak / text]

Users apart of the @blacklisted group will not be able to enter, speak, or text, while members of the @whitelisted group will be allowed to enter and speak. If a user is apart of both groups, their permissions will be determined based off the order of the ACLs.

Thanks!

ㅤI hope you learned a few things from this guide. I plan to add more to it in terms of examples but felt I wanted to throw this out as soon as possible. If you have any questions please feel free to ask in the comment section down below.

[nahka]

Thanks for the guide, didn't know about those advanced ACL features.