Tag Info

Hot answers tagged

15

You should look at using etckeeper, instead of trying to reinvent the wheel.


7

How do you decide what is permissible to allow users control over? In my experience this takes a committee. Even if there is a separate Information Security office in the organization, this kind of thing takes buy-in from a lot of people before coming down to implementation details. Whatever lock-down system you end up using needs to be flexible enough ...


5

This isn't the normal Windows behavior. It must be something application-specific that is unique to this specific application/service.


4

You should look into getting untangle (http://www.untangle.com/) and get a dedicated box to run that on. It's FREE, open source, and allows you to do a lot of things to both monitor traffic, and make the internet safer for your company's network. If you just want to monitor traffic, I'd suggest you use Wireshark, although it won't let you control that ...


4

What you are looking for is called "KVM over IP". Generally it's pretty expensive...your hardware device needs to be capable of connecting to the network, capturing VGA signals from the host, compressing and sending them over the internet, etc.


4

Personally, I think the best strategy is to look everything down to begin with, then slowly start opening things up until you're users can do their jobs. If there is a special case (which their usually is) then these can be considered and acted upon in what can be considered a secure environment. Most of the time the issues you have described (setting ...


4

Could be overkill for a single system (unless you need to 'rebuild' it from time to time) but the usual solution for configuration management is to use some scm like cfEngine, Puppet, bcfg2 , or the like, and then put their data under source control.


4

Just have your remote systems create ssh connections back to a central "management" server, using the -R reverse tunnel. That way you'll be able to ssh to your remote systems through the tunnel they've created. Use autossh for this, and it'll automatically monitor the state of the tunnels and will re-start them if necessary. From the command line of your ...


4

Ask them


4

Doh! It was due to user error. We figured out that someone, unbeknownst to my team and presumably someone on the team that made the virtual machines and installed the OS, deliberately configured the Services snapin on all three machines to connect to the same single host! So the software was working as designed. Erasing the service entries on each of the ...


4

The majority of your question is unrealistic. If there's no preparation then there's no chance to run 3 commands. The only "damage control" to be done is to assess what access the laptop might have to devices that you still physically control, revoke that access, reset passwords and disable anything and everything. assess what information is likely to be ...


3

You can use the hardware/software combinations as the above/below stated. I have another recommendation. There is Broadcom-based router replacement firmware called Tomato. It can do QoS and track connection information and even has some beautiful bandwidth graphs with totals, monthly usage, etc. It basically turns a $50 router into a fully managed switch ...


3

In general I'm of the opinion that developers (and DBAs) should not receive any lockdown at all. But they should certainly have access to a locked down user account for testing with (and also a standard desktop build), otherwise you run the risk that they'll cook up something that only works on their machines. Regarding the general user populace, Raymond ...


3

A lot of great comments here already. I'll just throw in my two cents. I think the foremost problem you have here is that you don't have a real security policy in place, or the one you have is obviously woefully inadequate. do you default to locking something down until it's asked for / demanded, or leaving something allowed until there is a problem ...


3

I second sysadmin1138 in terms of buy-in, but there's another reason to get input - depending on your organization, you may not actually know enough about what all your users do every day in their jobs. Some issues I've seen as a developer are IT not understanding that we need to do software installations - of our own software, on our own machines. Not ...


3

What's the difference between administering Mac OS vs Windows machines in terms of : - difficulties encountered Depends on what you mean by difficulties. The tools for administering the machines on a LAN are not as mature and well developed as the ones for Windows, so things that a Windows admin would normally do easily enough with Group Policies may be ...


2

Think back to the lessons of TRON. Systems should be designed to service users. Your overall goal should be to create usable systems that do not hinder the productivity of an employee. Remember that in IT we facilitate business not control it. Your best guide is to keep the business running smoothly and the productive and happy end users supplied with the ...


2

It seems like management needs to get involve and communicate the costs of not conforming to corporate guidelines ... or to communicate the benefits of following the guidelines.


2

All of your requirements (with the possible exception of #5) can be handled with Squid caching proxy and DansGuardian. There are probably products (both free and commercial) out there that combine them into a cohesive platform.


2

In short... your application is doing too much heavy lifting. There are a HUGE number of reasons why this could be... and even more ways to try & debug it. Unfortunately, there is not 1 universal tool for finding the saggy bits. Most of the tools for doing this are platform specific... (not just OS specific, but language & framework specific) ...


2

I faced a situation where I wanted to give a client scp access to my linux box, but nothing else. To accomplish when I created the user account I specified it's shell environment to be rssh, or resticted shell. Then in the conf file (/etc/rssh.conf, can't remember) I turned off all connections except scp and/or sftp. To turn off a connection type, simply ...


2

What I did was use my firewall to block all LAN to WAN port 53 (DNS) traffic. Then I configure the firewall's DHCP to push out the DNS server of it's IP address (because it has a caching DNS proxy built in). Then I modified the DNS records to block some ad and marketing/tracking companies. Last I set the firewall to forward requests to OpenDNS and signed ...


2

An answer to that question highly depends on wether you talk only about clients or if you think about using Mac servers as well. First, the clients: Security and access control is somewhat comparable to Windows, at least for small to medium sized organizations it should be possible to model any permission/security model you need with the tools offered ...


2

Looking at the output of sysctl kernel.pid_max. The default should be 32768. The safest way of changing it is to edit /etc/sysctl.cfg to whatever value you want, and then run sysctl -p to make it active. This way it will survive reboots. However, you're probably going to run into limits in CPU, RAM and Disk IO long before you hit the max number of ...


2

Yes, what you intend to do is possible since BlackArmor can provide an iSCSI target. Yet you should be aware that there is always a risk of loosing data in applying any modifications to your storage setup. First BlackArmor user manual does not mention iSCSI at all. You would have to search Seagate knowledgebase for "blackarmor iscsi". There is this article ...


1

Though from a high-level functionality perspective they're very similar they have vastly different management interfaces and scripting APIs.


1

The product page for that switch does mention that it has this feature: Traffic shaping prioritizes traffic on user-definable ports to guarantee bandwidth View chapter 12 of the manual for details about how to set this up. You will probably need to create a couple rules to priorities important types of traffic like RDP. But realistically if a ...


1

Here's a way using SVN and cron to manage /etc. I suppose it could be adapted.



Only top voted, non community-wiki answers of a minimum length are eligible