0
votes
0answers
15 views

how to run a web app: users/groups to use for each component?

How do you organize your users/groups to run the different components of your web app? Any best practices? The answer of this question (What permissions should my website files/folders have on a ...
0
votes
1answer
22 views

OpenBSD chroot for nginx/Apache file permissions

I haven't been able to find a satisfying answer on Goole or the various Stack forums: I noticed that files under /var/www (where nginx and I believe Apache are chrooted by default) have permissions ...
1
vote
0answers
64 views

Prevent user interactive logon to domain computers

I currently have a user DOMAINJOINER (located in the WIN7Support OU) which I use to deploy Windows 7 machines. This user can Create and Delete Computer Objects in the WIN7Computers OU, that's about it ...
0
votes
1answer
69 views

Nginx Password Protect Directory Downloads Source Code

I'm trying to password protect a WordPress login page on my Nginx server. When I navigate to http://www.example.com/wp-login.php, this brings up the "Authentication Required" prompt (not the WordPress ...
0
votes
0answers
291 views

you must have read permissions to view the properties of this object, administrators group

I think I'm having some difficulty understanding NTFS permissions. My understanding is that when possible you want to avoid assigning a specific user account to NTFS and instead use a group. So I set ...
1
vote
1answer
35 views

How does one achieve in Windows 7 a level of security comparable to setting a file's permissions to 0600 in Unix?

I want to store securely the file .pgpass, which contains the authentication credentials (including passwords) for client programs to be able to log in to PostgreSQL servers. The Pg documentation ...
1
vote
2answers
214 views

What are the minimal permissions for WMI access to processes CommandLine?

I have been trying to get a remote listing of running windows processes including their CommandLine/ExecutablePath attribute through WMI as a non-administrator domain user for a monitoring tool. I ...
4
votes
3answers
63 views

Server 2008 permissions issues

We have a selection of top level folders: E:\Data1 E:\Data2 E:\Data3 The permissions are simple - the default CREATOR OWNER, SYSTEM Full Control, some security groups allowing Modify and the LOCAL ...
0
votes
0answers
39 views

UNC shared path not accessible though necessary permissions are set

I have 2 environments A and B. A is an original environment whereas B is a clone of A, exactly except AD servers. AD server of B has been assigned a trust relationship with A, so that all the service ...
1
vote
2answers
138 views

Permissions to edit network configuration

We ship a virtual machine to the clients which runs a web service. Clients need to install this virtual machine on one of their hosts using an hypervisor and just need to modify the network ...
2
votes
0answers
100 views

Creating an Openstack user with only reboot permissions

What is the best approach for setting up an Openstack user that is limited to only rebooting servers using the Web API. The user needs to be able to access servers under different tenants, by using ...
0
votes
0answers
53 views

Sanity check: wordpress permission/ownership for multihosting

So I have a small server setup (2 webs, 1 nfs / mysql) that's hosting a couple of different wordpress sites. It's currently configured like this: I have a user called wwwuser (uid 500) and ...
1
vote
1answer
117 views

Correct Permissions VPS /var/www

This is a repost of an "off-topic" question on stackoverflow. My scenario is: I created a user and added that user to sudoers: visudo user ALL=(ALL) ALL Then sudo adduser user www-data and ...
0
votes
1answer
35 views

How to enable auditing for a folder only (and not anything within that folder)

I am trying to track down a process responsible for resetting ACLs on a particular folder, and ONLY that folder, not any of the 10,000 folders and files it contains. I tried going to Properties > ...
1
vote
2answers
309 views

Why can nginx access /etc/passwd? [closed]

I'm trying to setup my new VPS with my couple sites. nginx, php-fpm and other needed services installed. I setup a nginx server block(virtual hosts) for my site, and then try to create a php file ...
0
votes
1answer
80 views

Changing file permissions on web server to follow Least Privilege Security Principle: chmod 750 -R /

I'm not sure what details are relevant, but here is some general context. I'm configuring a Ubuntu 12.04 web server on AWS to process customer payment info before redirecting them to a hosted ...
1
vote
1answer
1k views

Workaround needed to run FileMaker Server 12 Admin Console with the new Java security model

As of Java 7 update 51 (7u51), there is a requirement for a new Permissions attribute (introduced in 7u25) that prevents the FileMaker Server 12 Admin Console from running. This also affects the ...
1
vote
2answers
124 views

Does /etc/fstab need to be world readable?

I would like to put network share mounts in /etc/fstab, but by default that file is world-readable which allows everyone to read the credentials I put into the mount options. Is it safe to make ...
0
votes
1answer
48 views

removing process (and child process) access to file systems? [closed]

is there a unix-type free OS that allows me to remove all disk access for a specific process and any of its children? #!/usr/bin/perl -w use strict; use Perl6::Slurp; my $infile= ...
0
votes
1answer
48 views

How to restrict a Linux program's permissions

I'm running a native linux program from PHP using shell_exec. Specifically, calling antiword to extract text from Microsoft Word files users uploaded. However, as I've got no way of assessing ...
0
votes
0answers
13 views

How to logged in user rights to see process information for processes started by that user as a service on Win Server 2008?

What do I need to to enable logged in user to access processes created by this user via service? Goal Run service as build user, login as build user and dump information about processes started by ...
1
vote
0answers
83 views

What are recommended permissions for files in /var/log?

I am working on tightening the security for various servers (mainly Debian Linux), and one of the tasks is to tighten permissions on files in /var/log so that files are not world readable. But there ...
0
votes
1answer
227 views

Why is `www-data` (Ubuntu / Apache user) listed in the `/etc/at.deny` file?

I have a cgi script that is resending an email on a failed attempt 5-10 minutes after a user accesses a page. My thought was to do this using the at command from a python call (os.system("at now + 5 ...
0
votes
0answers
29 views

Cant Add Columns to a AD Task pad except for the top level of the domain

We are working on Active Directory taskpads application for user management in our organization and facing stange issue. When we create a taskpad, and when we are at top level of the domain, i can ...
-3
votes
2answers
107 views

Permissions and access security for a shared folder on a server

I need to set permissions to a folder for two people. I am not an administrator on the server but I have access to grant and remove permissions to folders. Not even the Server Admin should have ...
1
vote
1answer
89 views

Which way is more secure: apache:admin or folder group owner:apache?

I have been learning in recent days how to set up var/www/ permissions. I understand the common solution is set a group owner of all new folders to apache via sticky bit. How about giving the Apache ...
0
votes
1answer
145 views

What are the permissions to set on SVN root?

I'm trying to provide a remote access to SVN server through Apache. The situation can be illustrated like this: /root /public-project /trunk /branches /restricted-project ...
-3
votes
1answer
459 views

Awstats: Why 'permission denied' reading logfile even with permissions 4777?

When I run Awstats via a web browser and click "Update now" it reports: Error: Couldn't open server log file "/var/log/httpd/domains/domain.net.log" : Permission denied Setup ...
0
votes
1answer
49 views

disallow file types (shell script wordpress security)

We recently got our servers into SVN which has been great, but this causes a lot of problems when using things like WP Filebase for CMS file management. It's also hard to keep the uploads folder ...
0
votes
1answer
94 views

Unsafe to run Apache as LOCALSYSTEM on Windows Server?

On my server (Windows Server 2008 R2), I have installed a couple of programs coming with a web interface. As I want to be able to access those web interfaces from outside my LAN, the relevant ports ...
0
votes
1answer
238 views

Which user should i give permission to in IIS?

I'm running a windows 2012 server with IIS 8 installed, I have a php script which complains about not having write permission on a specific folder. If I grant permissions to this IUSR user, It works ...
1
vote
1answer
206 views

Windows 7: Allow installation of software by non-admins?

I'm running a public library with PCs available for people to use. I'm setting up the next upgrade for the PCs, which will be running Windows 7. We use Deepfreeze to maintain the PC's state (a brief ...
2
votes
2answers
644 views

Permissions for webserver on Centos 6.3 running Plesk

I'm currently setting up an Opencart Ecom website on a VPS running Centos 6.3 which has Plesk Panel 11. I haven't much experience with servers so trying to get things right from the start. When I FTP ...
0
votes
3answers
294 views

Security best practice when running process as non-root user

So I'm trying to run Supervisor (http://supervisord.org/) as a non-root user. However the process outputs logs to the /var/log directory which is owned by root and has 755 permissions. Therefore ...
0
votes
1answer
139 views

Is there a way to allow specific permissions to a non-root user?

I have a program that, at some point, create/destroys tun/tap virtual adapters. Obviously, for these specific operations this program requires root privileges. According to the program ...
1
vote
0answers
30 views

How to give Admins Access to move users to a Single OU [duplicate]

We are delegating few acceses to some admins via taskpads; So we created a OU called "Delete" and we want the admins to move all the users to be deleted to that OU; How can we do that , how can we ...
0
votes
1answer
41 views

Stop certain users accessing C:\Source by security group

We have a security group called SourceCode which allows certain users access to the SVN / GIT repository. This allows them to get the latest repo and store it in C:\Source. This works fine but the ...
4
votes
1answer
54 views

What is this user name for and how did it get created?

When I created a website named Portal on my IIS 7.5 on the website permissions->security I got this user. What is its purpose? From what I have read the ApplicationPool runs under NetworkService ...
1
vote
0answers
577 views

Disabling all write (cd burning) permissions for a specific group of users on all CD/DVD drives mounted in Windows XP Pro SP3

I want all users within 'Restricted' user group (Windows XP Professional SP3) to be able to read from CDs/DVDs they insert. I don't want these users to be able to burn any CDs/DVDs using CDRW/DVDRW ...
0
votes
1answer
198 views

postfix feed to program as root

trying to get postfix to pipe stdin from an email into a script that needs to be run by root (yes I understand the security issues of doing this. no lectures, please). myalias: |/root/script/thing.rb ...
1
vote
1answer
192 views

Setting up limited AD account for external support person

I'm trying to setup a limited account for an outside company in active directory. They need to connect to one server to setup their software. I created a new group called "Limited Access", made that ...
4
votes
1answer
2k views

Granting service control manager access permission to user outside of administrator group

I have a user outside of administrator group. How can I grant service control manager access permission for that (specific) user? It's like SC_MANAGER_ALL_ACCESS from the following link: ...
2
votes
1answer
45 views

Is it possible to change User's Home Directorys permission in OSX?

Most of your staff uses OSX as main operation system. The problem is that recently we were attacked with some odd malware: users are getting zip-file via mail, and when they open this zip file, they ...
1
vote
1answer
47 views

Exchange 2007: Which permissions required to change folder permissions for all mailboxes?

Which permission(s) are required to modify permissions on folders in all mailboxes in Exchange 2007? I'm looking a least-privilege setup. I've seen hints pointing towards that the role Organizational ...
0
votes
1answer
67 views

Is it possible to create an FTP user that can only access certain directories?

Suppose I have the following directories inside my www folder: private_info_1 public_info_1 private_info_2 public_info_2 Is it possible to create an FTP user (I'm using cPanel) that could access ...
2
votes
1answer
1k views

Should I use suPHP or DSO (mod_PHP) when php scripts need to manipulate files?

I recently asked a question on StackOverflow and I'm going to re-ask it here as a different question and with some changes and additional information. I have a bunch of php scripts that need the ...
4
votes
5answers
735 views

NTFS: Deny all permissions for all files, except where explicitly added

I'm running a sandboxed application as a local user. I now want to deny almost all file system permissions for this user to secure the system, except for a few working folders and some system DLLs ...
1
vote
3answers
346 views

Can Solaris RBAC roles be ported to Linux using SElinux only?

We are migrating an application from Solaris to Linux and the main user is allowed, through the use of RBAC roles, to run a few system commands like svccfg/svcadm (chkconfig on redhat). Is it ...
0
votes
1answer
165 views

Should the webserver user have write permission on the uploads/ directory?

I always gave to the webserver user full permissions on these dirs: cache/ logs/ web/uploads/ But now I am wondering if the uploads part is 0K. I was thinking that maybe it would be better if I use ...
-3
votes
1answer
122 views

Protecting a chmodded 0777 cache directory?

A website I'm developing requires several directories to have their permissions set to 0777. The directories are used as cache directories for HTML and PHP files generated by the website. The ...