Tag Info

Hot answers tagged

7

How do you decide what is permissible to allow users control over? In my experience this takes a committee. Even if there is a separate Information Security office in the organization, this kind of thing takes buy-in from a lot of people before coming down to implementation details. Whatever lock-down system you end up using needs to be flexible enough ...


4

You should look into getting untangle (http://www.untangle.com/) and get a dedicated box to run that on. It's FREE, open source, and allows you to do a lot of things to both monitor traffic, and make the internet safer for your company's network. If you just want to monitor traffic, I'd suggest you use Wireshark, although it won't let you control that ...


4

Could be overkill for a single system (unless you need to 'rebuild' it from time to time) but the usual solution for configuration management is to use some scm like cfEngine, Puppet, bcfg2 , or the like, and then put their data under source control.


4

Just have your remote systems create ssh connections back to a central "management" server, using the -R reverse tunnel. That way you'll be able to ssh to your remote systems through the tunnel they've created. Use autossh for this, and it'll automatically monitor the state of the tunnels and will re-start them if necessary. From the command line of your ...


4

Personally, I think the best strategy is to look everything down to begin with, then slowly start opening things up until you're users can do their jobs. If there is a special case (which their usually is) then these can be considered and acted upon in what can be considered a secure environment. Most of the time the issues you have described (setting ...


3

What's the difference between administering Mac OS vs Windows machines in terms of : - difficulties encountered Depends on what you mean by difficulties. The tools for administering the machines on a LAN are not as mature and well developed as the ones for Windows, so things that a Windows admin would normally do easily enough with Group Policies may be ...


3

A lot of great comments here already. I'll just throw in my two cents. I think the foremost problem you have here is that you don't have a real security policy in place, or the one you have is obviously woefully inadequate. do you default to locking something down until it's asked for / demanded, or leaving something allowed until there is a problem ...


3

You can use the hardware/software combinations as the above/below stated. I have another recommendation. There is Broadcom-based router replacement firmware called Tomato. It can do QoS and track connection information and even has some beautiful bandwidth graphs with totals, monthly usage, etc. It basically turns a $50 router into a fully managed switch ...


3

I second sysadmin1138 in terms of buy-in, but there's another reason to get input - depending on your organization, you may not actually know enough about what all your users do every day in their jobs. Some issues I've seen as a developer are IT not understanding that we need to do software installations - of our own software, on our own machines. Not ...


3

In general I'm of the opinion that developers (and DBAs) should not receive any lockdown at all. But they should certainly have access to a locked down user account for testing with (and also a standard desktop build), otherwise you run the risk that they'll cook up something that only works on their machines. Regarding the general user populace, Raymond ...


2

Think back to the lessons of TRON. Systems should be designed to service users. Your overall goal should be to create usable systems that do not hinder the productivity of an employee. Remember that in IT we facilitate business not control it. Your best guide is to keep the business running smoothly and the productive and happy end users supplied with the ...


2

What I did was use my firewall to block all LAN to WAN port 53 (DNS) traffic. Then I configure the firewall's DHCP to push out the DNS server of it's IP address (because it has a caching DNS proxy built in). Then I modified the DNS records to block some ad and marketing/tracking companies. Last I set the firewall to forward requests to OpenDNS and signed ...


2

I faced a situation where I wanted to give a client scp access to my linux box, but nothing else. To accomplish when I created the user account I specified it's shell environment to be rssh, or resticted shell. Then in the conf file (/etc/rssh.conf, can't remember) I turned off all connections except scp and/or sftp. To turn off a connection type, simply ...


2

In short... your application is doing too much heavy lifting. There are a HUGE number of reasons why this could be... and even more ways to try & debug it. Unfortunately, there is not 1 universal tool for finding the saggy bits. Most of the tools for doing this are platform specific... (not just OS specific, but language & framework specific) ...


2

An answer to that question highly depends on wether you talk only about clients or if you think about using Mac servers as well. First, the clients: Security and access control is somewhat comparable to Windows, at least for small to medium sized organizations it should be possible to model any permission/security model you need with the tools offered ...


2

Looking at the output of sysctl kernel.pid_max. The default should be 32768. The safest way of changing it is to edit /etc/sysctl.cfg to whatever value you want, and then run sysctl -p to make it active. This way it will survive reboots. However, you're probably going to run into limits in CPU, RAM and Disk IO long before you hit the max number of ...


2

Yes, what you intend to do is possible since BlackArmor can provide an iSCSI target. Yet you should be aware that there is always a risk of loosing data in applying any modifications to your storage setup. First BlackArmor user manual does not mention iSCSI at all. You would have to search Seagate knowledgebase for "blackarmor iscsi". There is this article ...


1

yes its possible, but it all depends on the equipment you are using. I know for a fact though that this is possible with Pfsense (router/firewall OS), DD-WRT (Custom Router Firmware), and TomoatoUSB (Custom Router Firmware). You could also think about setting up QOS to prioritize traffic over the network.


1

I'm assuming there are no PS/2 Ports and so you can't use a USB keyboard to get into the BIOS if the ports are disabled in BIOS. If you have connected/configured the iLO, you should be able to use that to connect to the remote console and get into the BIOS. Otherwise, I would look at resetting the BIOS/NVRAM back to factory defaults. If you open up the ...


1

The product page for that switch does mention that it has this feature: Traffic shaping prioritizes traffic on user-definable ports to guarantee bandwidth View chapter 12 of the manual for details about how to set this up. You will probably need to create a couple rules to priorities important types of traffic like RDP. But realistically if a ...


1

The big difference is that there is no WMI on OSX. It's a different sort of animal. Group policy for mac is called managed preferences. Apple has put together a webcast on what's available. See Best Practices for Mac OSX client management


1

The "easiest" way to control and monitor all of this would be to eliminate the hardware router and put in a PC with multiple NICs. Use it to act as a router, and you can perform filtering, Quality of Service, bandwidth throttling, etc. Since you're not a large company, this is much more doable. Enterprise solutions would be very expensive for you. This ...


1

How do you decide what is permissible to allow users control over? With a given feature or functionality (say, setting shares on a folder, attaching certain filetypes in email, installing USB devices) is there a Best Practices rule to look at to help weigh the risks vs. rewards? Every organization has different risk tolerance. You need to ...


1

Risk vs Reward analysis. For any given feature that you may disable for a user, consider how much time you would lose resolving a problem, how likely a problem is, and how much time* it will cost the user to not have that feature. Adjust for relative value of your time and the user's time (lock down the janitor's PC more than the CEO's). *You may need to ...


1

If you want to get into content filtering, you could use something like DansGuardian. It's a free, open-source content filtering system that doesn't just block by a big list, but actually analyzes the pages as they are being served into the system. If it doesn't hit any flags, the page is served through to the user, completely transparently, but if it sees ...


1

EULAs in installation programs are already legally dubious. I would expect that since they are working on your behalf that they can agree to it on your behalf. Although as a technician I would probably cover myself by making sure that the customer had at least seen it. But since this is a legal issue, not a technical one, you should really be seeking ...


1

If web application hosting infra is accessed internally only (no internet) then just extend the current domain structure by promoting a new DC in new location (assuming there is proper network connectivity between them) If web application hosting infra is accessed over Internet then for security purpose I would go with separate forest in new location (i.e. ...


1

It's possible, depending on the print server, to create a custom filter to do this. This could be done in a standard UNIX lpd setup. The filter could scan the submitted file, look for hints that it's a PowerPoint document, and then pipe it through the likes of enscript or mpage and then pass it onto the printer. This, however, this is a nasty kludge ...



Only top voted, non community-wiki answers of a minimum length are eligible