Tag Info

Hot answers tagged

14

Instead of granting him the root password, use sudo. If you want to see everything he is doing in realtime as superuser, check out sudosh2. From the docs: sudosh is an auditing shell filter and can be used as a login shell. Sudosh records all keystrokes and output and can play back the session as just like a VCR. "All keystrokes" includes keystrokes ...


11

If you're using OpenSSH 5.1 or later then it supports Match Group negation. Assuming the defaults are OK for the admin group, then just change everyone else: Match Group *,!admin X11Forwarding no AllowTcpForwarding no ForceCommand internal-sftp There's really no reason to rely on third-party shells to do this kind of job with recent OpenSSH ...


11

Commit your modules and puppet scripts to a shared Git repository. Your developers and this new dev can then fork the repository, and make changes, then you can merge the changes back in. Using root access to edit files without versioning or change control is a recipe for disaster.


8

While the slow client is transmitting data, due to CSMA-CA, no other client can transmit. A slow client will take significantly longer to transmit its packet of data than a fast client. Similarly while the AP is talking to a slow client all other wireless devices on that channel will have to wait for their turn. The slower the device the longer that the ...


8

This cannot be done, in any true meaning anyway. If you don't trust the administrators you're out of options - there's always a way for them to get to the data in the described scenarios as they control your hardware (client and/or server) and your infrastructure. Regulate access through written policy.


7

chrooting users using ssh is not a desirable configuration in most cases. When they're jailed into their home dir, they won't be able to use any programs outside their home dir. This makes unix almost unusable as a shell server. You can use FTPS instead of SFTP/SCP, which will send passwords over SSL, but uses an ssh server, allowing you to chroot them for ...


7

You can let him connect with a regular account and then monitor his SSH session. The screen based solution is the best in my opinion and will let you do "pair" system administration. For example he could type the sudo commands and you would type the password in case it's needed. P.S. If you use screen it doesn't mean you shouldn't also use sudosh2 or other ...


7

This is expected behaviour, the sudoers file is only consulted when you run sudo so it denies the user access to the command and gives you the relevant error message. When the user tries to run the command directly, sudo is not involved so you get the error messages produced by the individual commands failing because the user lacks privilege. If you want ...


6

Without a dedicated IP, you have to fall back on implementing some sort of certificate authentication (which can be copied from one machine to another) or username / password authentication (which an be used on any machine in the world). In short, the problem you're trying to solve is extremely difficult to solve, if it's even solvable at all.


6

We use sudo configured to allow commands from the group. To prevent the sudo -i or sudo bash, I have setup an alias including all known shells which I disallow using ! in the definition of what the group can do. That way, all commands run with sudo are logged to syslog. The only shell I have installed and allowed is rootsh, which logs everything done from ...


6

It will make the initial connection a fraction slower, but past that should have no bearing on the responsiveness once connected. Generally speaking hosts.deny is pretty fast: on a test I just ran, a zero-length hosts.deny took 0.93 seconds to initiate and close an ssh connection ("time ssh testhost env"). With a 64,010-line hosts.deny (of the form "ALL: ...


5

To access the server from itself, use http://localhost/ or http://127.0.0.1/. To access the server from a separate computer on the same network, use http://192.168.X.X where X.X is your server's local IP address. You can find the sever's local IP address (assuming it's Linux) by running hostname -I.


5

Yes, it's someone scanning servers to see if they can tunnel through them by using the CONNECT verb. It's failing (HTTP response code is 500), so it's nothing to worry about. You'll see lots of this with your web server open to the world. 124.31.204.10 is the client IP address, and 205.188.251.43 is the address the client wants your web server to tunnel to. ...


5

Yes. Generally speaking, a G-only network is about three times faster than a mixed B/G network. Please see the following: What do I need to transform my network from Ethernet to WiFi? From the Cisco White Paper Capacity Coverage & Deployment Considerations for IEEE 802.11g "When 802.11b clients are associated to an 802.11g access point, the ...


5

Type visudo, you will see something like this: <your_user> ALL=(ALL) NOPASSWD:ALL If you want sudo prompt for a password, just remove NOPASSWD <your_user> ALL=(ALL) ALL UPDATE As @MikeyB mentioned, by default, sudo will prompt for a password of the invoking user. But if you turn on the targetpw flag: Defaults targetpw sudo will ...


5

The firewall has no way of identifying who you are at this point, so whether or not you are a domain admin is irrelavent. Your TCP traffic is being blocked. So, to allow access you are going to need to relax your firewall restrictions, be this by adding exceptions for file and print sharing (see here) or by disabling your firewalls on the domain network.


4

SQL Server and MySQL can handle this sort of workload without issue. 500 transactions per second isn't a very high workload. As for the 3G cell service, you'll want to use the cell phones to simply get access to the internet then have them contact the web server over the normal internet. You wouldn't want to have the application connecting to the database ...


4

In order to make it permanent, you should add that to your ~/.vimrc file. That's a personal vimrc, as opposed to the system wide one that you're probably looking at. The syntax is slightly different, so what you would do is add the line colors desert to your local config file, again that's ~/.vimrc and you're good to go.


4

Remember that log directives within a VirtualHost section can conflict with log directives from the "Main" configuration sections. Duplicate log lines are often caused by a line like CustomLog /var/log/apache2/access_log in the main configuration section and a second CustomLog inside a VirtualHost section. Grep for "access_log" in all of your configuration ...


4

I'm not sure if this is clear for you but the hostname localhost is a local alias on every machine pointing to 127.0.0.1 which is the local loopback interface. It is therefore only accessible from the local machine. When you have such problem, what you want to do is check what IP the Apache socket is bound to. In order to do this, you can use netstat -ap | ...


4

By default MySQL users are allowed to access databases from localhost only. You need to add access from your IP or all IPs by using GRANT. GRANT USAGE ON *.* to foouser@1.2.3.4 IDENTIFIED BY 'password for user'; GRANT ALL PRIVILEGES ON foodatabasename.* TO foouser@1.2.3.4; FLUSH PRIVILEGES;


4

The simple answer for this is to have a default virtualhost redirect to one of your other virtual hosts. Unfortunately I don't know how to do this with litespeed, but with apache, you would have several virtualhosts, with the default listed first and other name based virtual hosts listed after that. When the Host: header matches one of the virtual hosts, it ...


4

OK Guys, this issue plagued me for some time. I finally found a solution and would like to share. Warning! The following solution involves the Windows System Registry. Editing or manipulating the registry incorrectly can result in serious system damage which may require reinstallation of the operating system. If you are not comfortable editing the ...


3

If they already have unjailed ssh access then there would be nothing to gain by restricting sftp even if you could do it. Sure, there was a good reason to chroot the ftp server, but If I already have ssh access to the full machine there's no added security risk to me having sftp access.


3

I use MySecureShell to limit users to SFTP only connections. I do this for specific users, but I am sure you can configure it to limit by default so the exemption would be for you to give shell access as well. http://mysecureshell.sourceforge.net/


3

In Vista/Server 2008, each network has its own profile, and you'll need to enable File and Print Services(netbios services) for each network. For more help, try these two links: Enable File and Printer Sharing and File and Print Sharing in Vista hth, ~H


3

Admin's need access to data. Even if for nothing else than backup and restore. What you need to do is trust your admins a certain amount, and make the consequences for abusing that trust high and definite. As an admin you have a lot of power and access, your trustworthiness is one of your job's requirements, gross misconduct/suspension/dismissal type charges ...


3

With root access, I often like to take pauska's approach. I'll often set sudo all for admins, which allows them to sudo su as well as run commands through it. .bash_history is still in scope, which allows review in case a question occurs in the future. skinp's solution is more an administrative policy than anything else, as others have pointed out, it's ...


3

Do you have a Modem/router type device to connect to the internet? It sounds like you are connecting to the configuration interface for this. Alternatively: On what platform do you use XAMPP? Could you post the output of ipconfig in Windows or sudo ifconfig in Linux/MacOS? --- Edit OK, so with the info you gave here, it is now clear what the problem is ...



Only top voted, non community-wiki answers of a minimum length are eligible