Tag Info

Hot answers tagged

14

Instead of granting him the root password, use sudo. If you want to see everything he is doing in realtime as superuser, check out sudosh2. From the docs: sudosh is an auditing shell filter and can be used as a login shell. Sudosh records all keystrokes and output and can play back the session as just like a VCR. "All keystrokes" includes keystrokes ...


12

If you're using OpenSSH 5.1 or later then it supports Match Group negation. Assuming the defaults are OK for the admin group, then just change everyone else: Match Group *,!admin X11Forwarding no AllowTcpForwarding no ForceCommand internal-sftp There's really no reason to rely on third-party shells to do this kind of job with recent OpenSSH ...


11

You should place the scripts outside of the site's directory so they cannot be download no matter what happens with the server configuration or permissions. You can still execute them from your PHP code so long as the apache process has execute permission on them.


11

Commit your modules and puppet scripts to a shared Git repository. Your developers and this new dev can then fork the repository, and make changes, then you can merge the changes back in. Using root access to edit files without versioning or change control is a recipe for disaster.


9

While the slow client is transmitting data, due to CSMA-CA, no other client can transmit. A slow client will take significantly longer to transmit its packet of data than a fast client. Similarly while the AP is talking to a slow client all other wireless devices on that channel will have to wait for their turn. The slower the device the longer that the ...


8

This cannot be done, in any true meaning anyway. If you don't trust the administrators you're out of options - there's always a way for them to get to the data in the described scenarios as they control your hardware (client and/or server) and your infrastructure. Regulate access through written policy.


7

chrooting users using ssh is not a desirable configuration in most cases. When they're jailed into their home dir, they won't be able to use any programs outside their home dir. This makes unix almost unusable as a shell server. You can use FTPS instead of SFTP/SCP, which will send passwords over SSL, but uses an ssh server, allowing you to chroot them for ...


7

It will make the initial connection a fraction slower, but past that should have no bearing on the responsiveness once connected. Generally speaking hosts.deny is pretty fast: on a test I just ran, a zero-length hosts.deny took 0.93 seconds to initiate and close an ssh connection ("time ssh testhost env"). With a 64,010-line hosts.deny (of the form "ALL: ...


7

You can let him connect with a regular account and then monitor his SSH session. The screen based solution is the best in my opinion and will let you do "pair" system administration. For example he could type the sudo commands and you would type the password in case it's needed. P.S. If you use screen it doesn't mean you shouldn't also use sudosh2 or other ...


7

We use sudo configured to allow commands from the group. To prevent the sudo -i or sudo bash, I have setup an alias including all known shells which I disallow using ! in the definition of what the group can do. That way, all commands run with sudo are logged to syslog. The only shell I have installed and allowed is rootsh, which logs everything done from ...


7

This is expected behaviour, the sudoers file is only consulted when you run sudo so it denies the user access to the command and gives you the relevant error message. When the user tries to run the command directly, sudo is not involved so you get the error messages produced by the individual commands failing because the user lacks privilege. If you want ...


6

Yes. Generally speaking, a G-only network is about three times faster than a mixed B/G network. Please see the following: What do I need to transform my network from Ethernet to WiFi? From the Cisco White Paper Capacity Coverage & Deployment Considerations for IEEE 802.11g "When 802.11b clients are associated to an 802.11g access point, the ...


6

Without a dedicated IP, you have to fall back on implementing some sort of certificate authentication (which can be copied from one machine to another) or username / password authentication (which an be used on any machine in the world). In short, the problem you're trying to solve is extremely difficult to solve, if it's even solvable at all.


5

OK Guys, this issue plagued me for some time. I finally found a solution and would like to share. Warning! The following solution involves the Windows System Registry. Editing or manipulating the registry incorrectly can result in serious system damage which may require reinstallation of the operating system. If you are not comfortable editing the ...


5

Yes, it's someone scanning servers to see if they can tunnel through them by using the CONNECT verb. It's failing (HTTP response code is 500), so it's nothing to worry about. You'll see lots of this with your web server open to the world. 124.31.204.10 is the client IP address, and 205.188.251.43 is the address the client wants your web server to tunnel to. ...


5

To access the server from itself, use http://localhost/ or http://127.0.0.1/. To access the server from a separate computer on the same network, use http://192.168.X.X where X.X is your server's local IP address. You can find the sever's local IP address (assuming it's Linux) by running hostname -I.


5

You're probably out of luck. If those services are even close to properly configured, they're not going to give you the access that you need. You might be looking at a reboot, if nothing else works.


5

URL match with another location. Post configure file. Interchanging location(regular expressions are checked in the order defined in the configuration file): location ~ /views/(.+)\.php$ { deny all; } location ~ \.php$ { .....


5

The firewall has no way of identifying who you are at this point, so whether or not you are a domain admin is irrelavent. Your TCP traffic is being blocked. So, to allow access you are going to need to relax your firewall restrictions, be this by adding exceptions for file and print sharing (see here) or by disabling your firewalls on the domain network.


5

Type visudo, you will see something like this: <your_user> ALL=(ALL) NOPASSWD:ALL If you want sudo prompt for a password, just remove NOPASSWD <your_user> ALL=(ALL) ALL UPDATE As @MikeyB mentioned, by default, sudo will prompt for a password of the invoking user. But if you turn on the targetpw flag: Defaults targetpw sudo will ...


5

As already noted by @NickW you might just have encountered a change to the container that is your "virtual server". In OpenVZ - a technology to provide low overhead virtual Linux-based servers - a VM (commonly refered as a Virtual Private Server) is just a jailed "slice" of the host operating system, much like a jail in FreeBSD. Thus, if you have full ...


4

By default MySQL users are allowed to access databases from localhost only. You need to add access from your IP or all IPs by using GRANT. GRANT USAGE ON *.* to foouser@1.2.3.4 IDENTIFIED BY 'password for user'; GRANT ALL PRIVILEGES ON foodatabasename.* TO foouser@1.2.3.4; FLUSH PRIVILEGES;


4

The simple answer for this is to have a default virtualhost redirect to one of your other virtual hosts. Unfortunately I don't know how to do this with litespeed, but with apache, you would have several virtualhosts, with the default listed first and other name based virtual hosts listed after that. When the Host: header matches one of the virtual hosts, it ...


4

Remember that log directives within a VirtualHost section can conflict with log directives from the "Main" configuration sections. Duplicate log lines are often caused by a line like CustomLog /var/log/apache2/access_log in the main configuration section and a second CustomLog inside a VirtualHost section. Grep for "access_log" in all of your configuration ...


4

I'm not sure if this is clear for you but the hostname localhost is a local alias on every machine pointing to 127.0.0.1 which is the local loopback interface. It is therefore only accessible from the local machine. When you have such problem, what you want to do is check what IP the Apache socket is bound to. In order to do this, you can use netstat -ap | ...


4

SQL Server and MySQL can handle this sort of workload without issue. 500 transactions per second isn't a very high workload. As for the 3G cell service, you'll want to use the cell phones to simply get access to the internet then have them contact the web server over the normal internet. You wouldn't want to have the application connecting to the database ...


4

In order to make it permanent, you should add that to your ~/.vimrc file. That's a personal vimrc, as opposed to the system wide one that you're probably looking at. The syntax is slightly different, so what you would do is add the line colors desert to your local config file, again that's ~/.vimrc and you're good to go.


3

Try installing the Windows 2003 Administration Tools. The download is available from MS here.


3

I use MySecureShell to limit users to SFTP only connections. I do this for specific users, but I am sure you can configure it to limit by default so the exemption would be for you to give shell access as well. http://mysecureshell.sourceforge.net/



Only top voted, non community-wiki answers of a minimum length are eligible