Tag Info

Hot answers tagged

61

All passwords (for all devices, applications and accounts). All records relating to software, licensing and media (including purchase order history/proof). All media (including installation media and live data backups). All documentation, including, Server, hardware, network (including IP addresses) and operating system configurations. Details of processes ...


36

Nginx has to be compiled with http://wiki.nginx.org/NginxHttpHeadersModule. Then you can do this location ~* \.(eot|ttf|woff)$ { add_header Access-Control-Allow-Origin *; }


16

In addition: Account information related to domain registrations.


15

I haven't tested, but I think you are almost there. <Location /server-status> SetHandler server-status Order Allow,Deny Deny from 192.168.16.100 Allow from 192.168.16.0/24 </Location> Deny from all is not needed. In fact it will screw up because everything will match all, and thus denied (and I think Apache is trying to be ...


11

802.1X. This is not something that is trivial to implement, it requires the appropriate security infrastructure to back it up (associated user accounts, etc), but it as far as I know, the only way to even get close to what your auditors are asking for. It is supported by Windows, Linux, iOS (both the Apple and Cisco versions, so its good for iPads and ...


11

You have many, many errors in your rules. From getting sport/dport wrong to specifying udp instead of TCP. You're also forgetting DNS. The service iptables restart is also unnecessary. Forget about all the output rules, just have a rule that allows all outgoing traffic on established connections at the top of both INPUT and OUTPUT. iptables -A INPUT -m ...


9

If you need to restrict these users' access on this system, they cannot be administrators. Nothing that you've listed (RDP access, control over their applications) requires them to be full-blown administrators of the system. Assign just the permissions needed.


9

In addition to those that you mentioned... static IPs of all devices/servers (so you know what devices you need to manage) information about telecom accounts all other passwords for all devices and services (the domain admin account isn't the only one)


9

in addition: Logins to any websites you might need. (Download software, open support cases.. )


8

Don't plug-in their network cable, and turn off wifi.


7

Not sure how PAM would need to fit into this. With a recent version of SSH (like what is available on 8.04) it should be as easy as using a Match blocks for the address space you wish to allow. So your sshd_config should contain something like this. # global option no password auth (keys only) PasswordAuthentication no # permit password from rfc1918 ...


7

Generally the rule is highly limited access, generally only the IT facilities team and the Hardware Operations team. All people with unsupervised access should have background checks. Cameras and door logs should be used to audit employee access. System Administration teams should generally never need to touch the hardware (except where ...


6

Explicit "Deny" permissions always take precedence over all other permissions (assuming canonical ACL ordering-- but that's probably a safe assumption). The permission denying the user "Write" permission will override any permission granting the user "Write" based on group membership.


6

The only such products that I'm aware of are Avea's line of Ethernet-connected proximity card readers that, when tagged with a card, send an HTTP request to a web server at an IP address that you specify via DHCP option 72. You build your own web services to respond to these HTTP requests with instructions that the card reader can understand, e.g. with ...


6

Proftpd has a built-in sftp server that would allow you to completely segregate users from sshd for the purposes of file transfers. You can set it up so that it uses a completely separate passwd file to even further isolate them (it's hard to login to a system with ssh and break through a chroot if you don't actually have a user in /etc/passwd ...) proftpd ...


6

All of the answers so far have been awesome. Ensure that you have purchase records for Licenses. Some that you may not think of include Small Business Server (SBS) CALs, SQL Server Licenses, Terminal Services Licenses. Also if your servers have Out-Of-Band Management (HP's iLO, Dell's DRAC, etc), ensure that you are provided with those license keys. ...


6

Amongst other things this line iptables -A OUTPUT -p udp --sport 22 -j ACCEPT is your problem. You're only allowing UDP packets out on port 22. It should be iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT


6

The solution for me happened to be straight forward. Create, validate new group; add required users to this group: Create: groupadd no-internet Validate: grep no-internet /etc/group Add user: useradd -g no-internet username Note: If you're modifying already existing user you should run: usermod -g no-internet username Create a script in your path and ...


5

Since your "some users" have sudo or root access to the machine, it is not fully possible. Because every thing you doing as root can revert by them. So, the only thing you can do is attributing. So it makes them some difficulty to modify the files, but still its not fully proof because of the same reason I mentioned in first sentence. Using following ...


5

Yes, they are equivalent in the aspect of both providing the same result, only allowing access from 127.0.0.1. Let me quote the relevant part from the documentation on the Order directive. Allow,Deny First, all Allow directives are evaluated; at least one must match, or the request is rejected. Next, all Deny directives are evaluated. If any ...


5

Put those other users in their own group, make sure the logfiles belong to that group and make them group-readable.


4

The issue is probably relating to the splitting of configuration between two location directives, but I'm not sure. Rather than defining permissions in two places (apache config and the authz file), just define them in the authz file. Like so: httpd.conf <Location /svn> DAV svn SVNParentPath /var/lib/svn/repository Require valid-user ...


4

What objectClass is used for service identities? Whatever you want, really. In order for Crowd (or anything else) to authenticate, you need a distinguished name somewhere in your tree and it needs to have a userPassword attribute. If you look at your schema (if you're using OpenLDAP, that's usually /etc/openldap/schema), you can find objectClasses ...


4

SQL Server has the ability to use Windows Authentication for granting access to resources on the database server, and this feature is turned on even if you decide to use SQL Authentication. You do not need to create an explicit SQL Server login for each user unless your application requires it. For managing user access using Windows Authentication and ...


4

Your content on D:\ should not be available to "Users" since a newly created user is put into this group by default. Just remove the "Users" and "Everyone" entries from D:\ and all subdirectories - do not use "deny" type ACEs as they effectively will deny access for everyone who is the member of "Users", even if the user would otherwise have been granted ...


4

If they have root access, all bets are pretty much off..depending how savvy they are. One ugly way is to set immutable bit on your file. It will be unmodifiable as long as that attribute is set. Then change your scripts to remove that attribute before updating your file and set it back afterwards. Hopefully your users won't notice that attribute and their ...


4

The employeeNumber field while not viewable via the GUI is still able to be queried by anyone with read access to AD if I'm not mistaken. It may take more effort than "Outlook" though. But honestly...it's the last 4 of the SSN...so I think your approach, if management is fine with it, is good enough. Just make sure you don't care about an actual employee ...


3

The default, out of the box schema already contains both an employeeNumber and an employeeID attribute... Reading the attributes: PS H:\> Get-ADUser jbob -Properties EmployeeId,EmployeeNumber DistinguishedName : CN=JoeBob,OU=Users,OU=Bros,DC=contoso,DC=com EmployeeID : A1B2C3 EmployeeNumber : 1234556 Enabled : True GivenName ...


3

You can use .htaccess . Simply create such a file in your picture directory and enter the following directives: Order allow, deny Deny from all See the manual for details about the Order and Deny directives. Note that the error would be 403 Forbidden instead of 404 Not Found. Note that this will deny all access via HTTP to the files in your directory. ...



Only top voted, non community-wiki answers of a minimum length are eligible