Tag Info

Hot answers tagged

53

Nginx has to be compiled with http://wiki.nginx.org/NginxHttpHeadersModule. Then you can do this location ~* \.(eot|ttf|woff)$ { add_header Access-Control-Allow-Origin *; }


20

I haven't tested, but I think you are almost there. <Location /server-status> SetHandler server-status Order Allow,Deny Deny from 192.168.16.100 Allow from 192.168.16.0/24 </Location> Deny from all is not needed. In fact it will screw up because everything will match all, and thus denied (and I think Apache is trying to be ...


12

802.1X. This is not something that is trivial to implement, it requires the appropriate security infrastructure to back it up (associated user accounts, etc), but it as far as I know, the only way to even get close to what your auditors are asking for. It is supported by Windows, Linux, iOS (both the Apple and Cisco versions, so its good for iPads and ...


12

You have many, many errors in your rules. From getting sport/dport wrong to specifying udp instead of TCP. You're also forgetting DNS. The service iptables restart is also unnecessary. Forget about all the output rules, just have a rule that allows all outgoing traffic on established connections at the top of both INPUT and OUTPUT. iptables -A INPUT -m ...


9

If you need to restrict these users' access on this system, they cannot be administrators. Nothing that you've listed (RDP access, control over their applications) requires them to be full-blown administrators of the system. Assign just the permissions needed.


9

The solution for me happened to be straight forward. Create, validate new group; add required users to this group: Create: groupadd no-internet Validate: grep no-internet /etc/group Add user: useradd -g no-internet username Note: If you're modifying already existing user you should run: usermod -g no-internet username Create a script in your path and ...


8

Don't plug-in their network cable, and turn off wifi.


7

Not sure how PAM would need to fit into this. With a recent version of SSH (like what is available on 8.04) it should be as easy as using a Match blocks for the address space you wish to allow. So your sshd_config should contain something like this. # global option no password auth (keys only) PasswordAuthentication no # permit password from rfc1918 ...


7

Generally the rule is highly limited access, generally only the IT facilities team and the Hardware Operations team. All people with unsupervised access should have background checks. Cameras and door logs should be used to audit employee access. System Administration teams should generally never need to touch the hardware (except where ...


7

Explicit "Deny" permissions always take precedence over all other permissions (assuming canonical ACL ordering-- but that's probably a safe assumption). The permission denying the user "Write" permission will override any permission granting the user "Write" based on group membership.


6

The only such products that I'm aware of are Avea's line of Ethernet-connected proximity card readers that, when tagged with a card, send an HTTP request to a web server at an IP address that you specify via DHCP option 72. You build your own web services to respond to these HTTP requests with instructions that the card reader can understand, e.g. with ...


6

Proftpd has a built-in sftp server that would allow you to completely segregate users from sshd for the purposes of file transfers. You can set it up so that it uses a completely separate passwd file to even further isolate them (it's hard to login to a system with ssh and break through a chroot if you don't actually have a user in /etc/passwd ...) proftpd ...


6

Amongst other things this line iptables -A OUTPUT -p udp --sport 22 -j ACCEPT is your problem. You're only allowing UDP packets out on port 22. It should be iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT


5

Put those other users in their own group, make sure the logfiles belong to that group and make them group-readable.


5

Yes, they are equivalent in the aspect of both providing the same result, only allowing access from 127.0.0.1. Let me quote the relevant part from the documentation on the Order directive. Allow,Deny First, all Allow directives are evaluated; at least one must match, or the request is rejected. Next, all Deny directives are evaluated. If any ...


5

Since your "some users" have sudo or root access to the machine, it is not fully possible. Because every thing you doing as root can revert by them. So, the only thing you can do is attributing. So it makes them some difficulty to modify the files, but still its not fully proof because of the same reason I mentioned in first sentence. Using following ...


4

The issue is probably relating to the splitting of configuration between two location directives, but I'm not sure. Rather than defining permissions in two places (apache config and the authz file), just define them in the authz file. Like so: httpd.conf <Location /svn> DAV svn SVNParentPath /var/lib/svn/repository Require valid-user ...


4

What objectClass is used for service identities? Whatever you want, really. In order for Crowd (or anything else) to authenticate, you need a distinguished name somewhere in your tree and it needs to have a userPassword attribute. If you look at your schema (if you're using OpenLDAP, that's usually /etc/openldap/schema), you can find objectClasses ...


4

SQL Server has the ability to use Windows Authentication for granting access to resources on the database server, and this feature is turned on even if you decide to use SQL Authentication. You do not need to create an explicit SQL Server login for each user unless your application requires it. For managing user access using Windows Authentication and ...


4

Your content on D:\ should not be available to "Users" since a newly created user is put into this group by default. Just remove the "Users" and "Everyone" entries from D:\ and all subdirectories - do not use "deny" type ACEs as they effectively will deny access for everyone who is the member of "Users", even if the user would otherwise have been granted ...


4

If they have root access, all bets are pretty much off..depending how savvy they are. One ugly way is to set immutable bit on your file. It will be unmodifiable as long as that attribute is set. Then change your scripts to remove that attribute before updating your file and set it back afterwards. Hopefully your users won't notice that attribute and their ...


4

The employeeNumber field while not viewable via the GUI is still able to be queried by anyone with read access to AD if I'm not mistaken. It may take more effort than "Outlook" though. But honestly...it's the last 4 of the SSN...so I think your approach, if management is fine with it, is good enough. Just make sure you don't care about an actual employee ...


4

In response to your comment: Your comment is valid if the data I want to protect is some kind of business deeds with sensitive financial figures. But, consider I am doing it for a software company that wants to protect their programmers to upload their software source files to their private cloud storage (they are usually 1000+ files). and your ...


3

Have you checked out ViewVC? It can provide a nicely-formatted read-only view of your repo, and is quite configurable.


3

First off, get rid of factsync, fact_sync, and plugin_sync -- they're all either not required or misspelt. Second, auth.conf is unnecessary -- my 0.25 setups don't have an auth.conf anywhere to be found. I really think you're overcomplicating it. If you fix up your host/cert name issues (as per your other question) and use the fileserver.conf you've got ...


3

Basically, it comes down to users being able to override the access controls at their discretion. In a MAC-based system, the policy cannot be overriden by a user to allow less privileged users access to a resource. The MAC is mandatory. In some situations, it may be necessary to have this behaviour. Typically, I've heard of MACs used in highly secure ...


3

You could deny access to a range of IP addresses known to originate from that country, while using a white list to enable access to those specific IP addresses which you want to allow. However, this could easily be subverted by, for example, using a proxy from a different country, or simply by going to a different country and then viewing the website from ...


3

This might help you - Developing Software in Visual Studio .NET with Non-Administrative Privileges.


3

I am assuming you are running Apache on a Linux machine, you can use iptables to block the IPs. Here is the command to block the selected IP. iptables -A INPUT -s <IP ADDRESS> -j DROP And here is the little bash script that will read the IP list from the txt file and will block all the IPs. #!/bin/bash while read IPADDR; do iptables -A INPUT ...



Only top voted, non community-wiki answers of a minimum length are eligible