Tag Info

Hot answers tagged

34

I don't see that anyone has spelled out the specific risk with SSH port forwarding in detail. If you are inside a firewall and have outbound SSH access to a machine on the public internet, you can SSH to that public system and in the process create a tunnel so that people on the public internet can ssh to a system inside your network, completely bypassing ...


30

If they're blocking a mishmash of ports, letting some stuff through and blocking some other stuff at random (I love Paul Tomblin's sad tale of the people who block SSH and allowed Telnet) then they either have a very strange edge case for how they go about securing their network perimeter, or their security polices are, from the outside at least, apparently ...


26

As someone who used to be responsible for the proxies, firewalls, and web filters I very much agree with @DanBig's comment and urge you to politely tell management "I don't care" and let them deal with it. Babysitting is a management / HR issue and should not be left to working level IT. If you have resource contention to the point where someone's Facebook ...


11

If what you're doing right now is working but the issue that it's taking too much of your time, then scheduled tasks are you friend :) Pop the two versions of the hosts file on the network somewhere (With FB enabled/disabled), and then set up a scheduled task, pushed out by GPO. At lunch time (say, 11:30) it copies the "FB Enabled" hosts file, and then ...


11

Yes, this is a valid way to check that the socket is non-blocking. The value for a non-blocking socket is 04000, non-blocking sockets in /proc/<pid>/fdinfo are represented in octal. You can validate this behaviour with python. Python 2.7.5 (default, Feb 19 2014, 13:47:28) [GCC 4.8.2 20131212 (Red Hat 4.8.2-7)] on linux2 Type "help", "copyright", ...


10

A certain large company in Rochester NY that used to make a lot of film blocked outgoing ssh when I worked there, but allowed telnet! When I asked about it, they said that ssh was a security hole. In other words, companies sometimes make stupid decisions, and then make up baloney excuses about security rather than admit their mistakes.


10

Please look carefully at the processlist and the 'show engine innodb status'. What do you see ??? Process IDs 1,2,4,5,6,13 are all trying to run COMMIT. Who is holding up everything ??? Process ID 40 is running a query against large_table. Process ID 40 has been running for 33 seconds. Process IDs 1,2,4,5,6,13 having been running less than 33 seconds. ...


9

I've been using Squid as a transparent proxy and using the proxy to filter access to website and as a local cache. The big advantage of it is that you can rules based on regular expression on the whole URL (meaning you can restrict access to portion of site if you want to). There's a bunch of good tutorial about it around the web. You can find a somewhat ...


8

Another alternative would be to block Facebook et al from people's work machines from 9-5 but set up an "Internet Cafe" in a communal area where they can have access to the internet for personal browsing at lunchtime. These machines could be locked for most of the day but only open from 11 am till 2 pm (for example). As these machines are effectively ...


7

You will probably be ok, but you might be better off leaving a hole for your IP, just in case something goes wrong. You might also want to make sure you don't block connections from 127.0.0.1, as that is the localhost IP and may be necessary for internal services to connect to themselves to keep things working properly (it depends on what type of stuff you ...


7

If people weren't allowed to post answers, there wouldn't be any answers. If your employees are spending so much time on SO that it's hurting their job, I'd suggest your resolution should be administrative, not technical. If they're just giving back to the community with occasional answers, then is it really a problem?


7

What you need to do is this: 1) Watch the apache logs for access 2) block IP addresses that you qualify on the firewall (via a script). fail2ban will do what you want, with a little more work than reading the Google search tagline.


7

The correct setting Microsoft added for what you need is AppLocker by GPO. You can add policy by filehash, filepublisher or path. With the filehash, it's harder for an user to bypass it, unless he get another version, but you could block the publisher too.


6

It could be using the value of TMPDIR or TEMPDIR environment variables. You could try setting this to a different directory and see if the program uses that instead. Perhaps it is a config setting. If you're able to delete the /tmp directory or everything in in it, as a non-root user, then your permissions seem wrong. The permissions I have on my system ...


6

A simple and free solution would be to point the DNS servers to OpenDNS. At OpenDNS, you the admin, can setup an account (free), and then you can go through a very simple process to block websites bases on 20 or so predefined categories that they have setup. The nice thing is that they update the list of websites every day so it's automatic for you and ...


6

For the love of God, package your app with a local copy of the Java binary if your app needs a specific version. Don't rely on the system-installed binary. This prevents the users from being able to update their Java browser plug-ins. With the recent major vulnerabilities in Java lately, I'd stop using your product immediately if you told me I couldn't ...


6

Driving straight into the details, let's convert both 42.1.0.0 and 2a01:1e8 into binary (you'll see why I only chose the initial portion in a moment.) 0010 1010 . 0000 0001 . 000 | 42 . 1 . 0 | 0010 1010 0000 0001 : 000 | 0 0001 1110 1000 2a01 : | 1e8 | ^ cut ...


6

You're Doing It Wrong my friend. Aside from both local NAT and "Carrier-Grade NAT" (which mean the information you get from ifconfig on client systems may be a private address that you can't use in your server's access lists), IP-based security is a farce: ISPs may change public network assignments, end-users may be on dynamic IPs, or someone might spoof ...


5

If you have users that are capable of creating ssh tunnels to their home equipment then you are not going to be able to do this using technology unless you can take away the tools that allow them to do this. All you can do is enter into an arms race with them. You will have to get your management involved - it really is their issue to deal with.


4

I can understand blocking inbound SSH communication if the company is disallowing external logins. But, this is the first time I hear of an outbound SSH block. What is important to note is that such firewalling will probably limit only the casual SSH user. If someone really wants to SSH outside (which will typically be to a server/machine they have ...


4

You probably have a pair of scissors somewhere; that'll block peer-to-peer software without costing anything, installing a firewall, or installing any software on a server.


4

In windows firewall (Win+R and wf.msc :P) create new custom inbound rule... You can set there whatever you want (protocol, ports, local and remote ip's).


4

You need somthing like this: acl BlockedHost src 192.168.1.15 http_access deny BlockedHost The config file is well commented searching for the word acl will help you further. Squid acl faq


4

Example : I blocked Facebook & orkut to all user but now i want to open only facebook to particular user or IP Option 1 : Specify site with in configuration file, acl special_clients src "/etc/squid/special_client_ips.txt" acl facebook dstdomain .facebook.com acl orkut dstdomain .orkut.com Under http access http_access allow ...


4

While it is mostly in use by bots and other crawlers, why not block bots the regular way, by adding/changing the robots.txt file (for the "law-obeying" bots) or by changing your .htaccess file to block the criminals. This site is one of many describing these procedures. Update: If I were to write a malicious bot today, I'd use http/1.1, just to throw off ...


4

One of the simplest ways is to set up a squid proxy, and put rules in place to allow only the site you want. Then block access to all ports on your firewall for LAN PCs (you may need to consider if your clients need to access any other internet services). Finally, push out proxy info using wpad.dat or dhcp option 252, both of which should work for linux I ...


4

There are two ways to do this: 1) Block it at the firewall, based on the destination IP address and port. For example, when I look up YouTube from my location I get: C:\Users\mark.henderson>nslookup Default Server: enetsdc2.enets.local Address: 192.168.161.2 > youtube.com Server: enetsdc2.enets.local Address: 192.168.161.2 Name: youtube.com ...


4

So… you're redirecting the real Google site and complaining when Google's browser notices that you've intercepted Google's website? Build Chrome from source and deploy that to your Enterprise. Or stop using OpenDNS.


3

The best way to do this with apache is with the access control module. Basically, just put something like this into your .htaccess Deny from 10.252.46.165 More information on it can be found here. However, that is not necessarily the best way to do it, because Apache is still handling the request. You can actually block all incoming traffic from certain ...



Only top voted, non community-wiki answers of a minimum length are eligible