Tag Info

Hot answers tagged

62

All passwords (for all devices, applications and accounts). All records relating to software, licensing and media (including purchase order history/proof). All media (including installation media and live data backups). All documentation, including, Server, hardware, network (including IP addresses) and operating system configurations. Details of processes ...


38

Nginx has to be compiled with http://wiki.nginx.org/NginxHttpHeadersModule. Then you can do this location ~* \.(eot|ttf|woff)$ { add_header Access-Control-Allow-Origin *; }


16

In addition: Account information related to domain registrations.


15

I haven't tested, but I think you are almost there. <Location /server-status> SetHandler server-status Order Allow,Deny Deny from 192.168.16.100 Allow from 192.168.16.0/24 </Location> Deny from all is not needed. In fact it will screw up because everything will match all, and thus denied (and I think Apache is trying to be ...


11

802.1X. This is not something that is trivial to implement, it requires the appropriate security infrastructure to back it up (associated user accounts, etc), but it as far as I know, the only way to even get close to what your auditors are asking for. It is supported by Windows, Linux, iOS (both the Apple and Cisco versions, so its good for iPads and ...


11

You have many, many errors in your rules. From getting sport/dport wrong to specifying udp instead of TCP. You're also forgetting DNS. The service iptables restart is also unnecessary. Forget about all the output rules, just have a rule that allows all outgoing traffic on established connections at the top of both INPUT and OUTPUT. iptables -A INPUT -m ...


9

If you need to restrict these users' access on this system, they cannot be administrators. Nothing that you've listed (RDP access, control over their applications) requires them to be full-blown administrators of the system. Assign just the permissions needed.


9

In addition to those that you mentioned... static IPs of all devices/servers (so you know what devices you need to manage) information about telecom accounts all other passwords for all devices and services (the domain admin account isn't the only one)


9

in addition: Logins to any websites you might need. (Download software, open support cases.. )


8

Don't plug-in their network cable, and turn off wifi.


7

Not sure how PAM would need to fit into this. With a recent version of SSH (like what is available on 8.04) it should be as easy as using a Match blocks for the address space you wish to allow. So your sshd_config should contain something like this. # global option no password auth (keys only) PasswordAuthentication no # permit password from rfc1918 ...


7

Generally the rule is highly limited access, generally only the IT facilities team and the Hardware Operations team. All people with unsupervised access should have background checks. Cameras and door logs should be used to audit employee access. System Administration teams should generally never need to touch the hardware (except where ...


7

The solution for me happened to be straight forward. Create, validate new group; add required users to this group: Create: groupadd no-internet Validate: grep no-internet /etc/group Add user: useradd -g no-internet username Note: If you're modifying already existing user you should run: usermod -g no-internet username Create a script in your path and ...


6

All of the answers so far have been awesome. Ensure that you have purchase records for Licenses. Some that you may not think of include Small Business Server (SBS) CALs, SQL Server Licenses, Terminal Services Licenses. Also if your servers have Out-Of-Band Management (HP's iLO, Dell's DRAC, etc), ensure that you are provided with those license keys. ...


6

Amongst other things this line iptables -A OUTPUT -p udp --sport 22 -j ACCEPT is your problem. You're only allowing UDP packets out on port 22. It should be iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT


6

Explicit "Deny" permissions always take precedence over all other permissions (assuming canonical ACL ordering-- but that's probably a safe assumption). The permission denying the user "Write" permission will override any permission granting the user "Write" based on group membership.


6

The only such products that I'm aware of are Avea's line of Ethernet-connected proximity card readers that, when tagged with a card, send an HTTP request to a web server at an IP address that you specify via DHCP option 72. You build your own web services to respond to these HTTP requests with instructions that the card reader can understand, e.g. with ...


6

Proftpd has a built-in sftp server that would allow you to completely segregate users from sshd for the purposes of file transfers. You can set it up so that it uses a completely separate passwd file to even further isolate them (it's hard to login to a system with ssh and break through a chroot if you don't actually have a user in /etc/passwd ...) proftpd ...


5

Yes, they are equivalent in the aspect of both providing the same result, only allowing access from 127.0.0.1. Let me quote the relevant part from the documentation on the Order directive. Allow,Deny First, all Allow directives are evaluated; at least one must match, or the request is rejected. Next, all Deny directives are evaluated. If any ...


5

Put those other users in their own group, make sure the logfiles belong to that group and make them group-readable.


5

Since your "some users" have sudo or root access to the machine, it is not fully possible. Because every thing you doing as root can revert by them. So, the only thing you can do is attributing. So it makes them some difficulty to modify the files, but still its not fully proof because of the same reason I mentioned in first sentence. Using following ...


4

If they have root access, all bets are pretty much off..depending how savvy they are. One ugly way is to set immutable bit on your file. It will be unmodifiable as long as that attribute is set. Then change your scripts to remove that attribute before updating your file and set it back afterwards. Hopefully your users won't notice that attribute and their ...


4

The employeeNumber field while not viewable via the GUI is still able to be queried by anyone with read access to AD if I'm not mistaken. It may take more effort than "Outlook" though. But honestly...it's the last 4 of the SSN...so I think your approach, if management is fine with it, is good enough. Just make sure you don't care about an actual employee ...


4

The issue is probably relating to the splitting of configuration between two location directives, but I'm not sure. Rather than defining permissions in two places (apache config and the authz file), just define them in the authz file. Like so: httpd.conf <Location /svn> DAV svn SVNParentPath /var/lib/svn/repository Require valid-user ...


4

What objectClass is used for service identities? Whatever you want, really. In order for Crowd (or anything else) to authenticate, you need a distinguished name somewhere in your tree and it needs to have a userPassword attribute. If you look at your schema (if you're using OpenLDAP, that's usually /etc/openldap/schema), you can find objectClasses ...


4

SQL Server has the ability to use Windows Authentication for granting access to resources on the database server, and this feature is turned on even if you decide to use SQL Authentication. You do not need to create an explicit SQL Server login for each user unless your application requires it. For managing user access using Windows Authentication and ...


4

Your content on D:\ should not be available to "Users" since a newly created user is put into this group by default. Just remove the "Users" and "Everyone" entries from D:\ and all subdirectories - do not use "deny" type ACEs as they effectively will deny access for everyone who is the member of "Users", even if the user would otherwise have been granted ...


3

I would use WebDav with a https enabled server! The authentication is then base on the standard http authorization scheme. A guide to set up webdav with apache can be found here then it is only neccessary to put that resource behind https, and here I found a nice description how to do that.


3

I am assuming you are running Apache on a Linux machine, you can use iptables to block the IPs. Here is the command to block the selected IP. iptables -A INPUT -s <IP ADDRESS> -j DROP And here is the little bash script that will read the IP list from the txt file and will block all the IPs. #!/bin/bash while read IPADDR; do iptables -A INPUT ...



Only top voted, non community-wiki answers of a minimum length are eligible