Tag Info

Hot answers tagged

18

There are no issues with people using both tools at the same time. I frequently install things using apt-get or aptitude from the command line or use the curses interface to do security updates. Both apt-get and aptitude are front-ends to libapt-pkg, which deals with the dependency resolving and fetching of packages. libapt-pkg in turn uses dpkg to do the ...


14

The answer is that short of compiling your own version of bash, you can't. Furthermore, even if you succeeded, if your users can compile programs or move binaries onto the system, they can always bring in a kill binary of their own, and be able to issue kills anyway. Now, the question is: What do you really want to do? Because disabling the kill command ...


11

This has thrown me for a loop in the past as well, as I had read (and experienced) this first hand. The answer is that Microsoft changed the behaviour of store.exe with 2 hotfixes. The 2 hotfixes that modify this behavior is 916783 and 903158. More information on the change can be found : ...


8

Everyone is doing this the hard way.. he said deny for all non-root users.. so just edit /etc/ssh/sshd_config Add the following AllowGroups wheel root Then restart ssh Anyone in the wheel or root group will be allowed to ssh in


5

The easiest way to do this is to use a custom-built cable with doesn't have the TX pin connected. Cables are trivial to make, you just have to follow the correct color pattern. You'll also have to make sure you put the TX-disabled connector in the computer and not the switch, but that's easy to fix if you get it wrong. :)


4

Microsoft released a tool for that purpose: Windows Service Pack Blocker Tool Kit. Microsoft text: "A blocking tool is available for organizations that would like to temporarily prevent installation of Service Pack updates through Windows Update. This tool can be used with: Windows 7 Service Pack 1 (valid through 2/22/2012) Windows Server 2008 R2 Service ...


4

Whatever you use, the kill command, or the shell builtin, it is going to use the kill or related system call. To read about this, see man 2 kill. Kill isn't just use to kill a process, but it is used to send a signal. Sending signals is a fundamental function of the Unix operating systems, so you don't want to disable it. The Correct Way: The correct way ...


3

There is no standard way but there are several ways to accomplish this, each being a configuration option in ldap.conf (or pam-ldap.conf depending on your distribution and their pam_ldap build-time settings): pam_filter: Use a custom filter together with an attribute in LDAP that denotes an inactive account. pam_check_host_attr: pam_ldap will check if ...


3

Following on Michael's answer, it would be very, very hard to prevent a user from sending signals (which is what kill does) to a process running in that user's protection domain (i.e. running under that user's id). Likely, you would not really want to, since it would also prevent the user from terminating a runaway program, for example. Also, it could well ...


3

The official way is to use Adobes Customization Wizard - it will help you deploy Reader properly and can do this for you easily. While you're at it, get the msi packaged version of Reader 9.1 and the 9.1.3 patch. For the manual "hacker" the FeatureLockdown registry key seems to be working still in 9, check this article out. REG ADD ...


3

How can I prevent users to access my server by the hostname or ip address?! Then you want to block completely your site for some hosts. (or am I missing something?) Best way to block users from some hosts is to use iptables of course if you are using linux or pf on bsd. For example: (iptables) BLOCK_THIS_IP="x.x.x.x" iptables -A INPUT -s "$BLOCK_THIS_IP" ...


2

From comment: This is not possible as you describe, because: the information is described only in shadow, and shadow can only be read by root. Any program needing password hashes or account expiration must be SUID (if you're using local accounts stored in shadow, as you say.) Added information: I initially used chage(1) as source. Note The chage ...


2

We have setup a group policy with the below which seems to help Computer Configuration Administrative Templates Do not allow Flip3D invocation Enabled Do not allow window animations Enabled Use solid color for Start background Enabled User Configuration (Enabled) Administrative Templateshide Do not allow Flip3D invocation Enabled ...


2

You can also disable the animations in the Windows RDP client. Show Options -> Experience. On the MAC cleint you can adjust these options under RDC->Preferences->Display. Good part about doing it at the client side is you can scale down the colors too and significantly speed up the paint times. I can't comment on other clients though.


2

I would suspect this is network location awareness: http://blog.superuser.com/2011/05/16/windows-7-network-awareness/ Basically, Windows is making HTTP requests to verify it still has a connection to the internet.


2

You can create a group called sftponly. Add the user to this group and configure ssh /etc/ssh/sshd_config Added Conf: Match Group sftponly ChrootDirectory %h AllowTCPForwarding no X11Forwarding no ForceCommand internal-sftp Now the users in this group will only be able to sftp There is a smal problem with this setup, is that chroot ...


2

I don't believe there is a universal solution, but there are still some options. Some modules (for instance, mod_rewrite) have their own logging facilities, but you'd have to read the documentation for each module to find out. Any modules listed as static are compiled in and can't be disabled unless you recompile Apache. For the rest, you might try three ...


2

Postfix is secured that way by default. You have to explicitly misconfigure it to be an so called open relay. For different requirements there is a documentation about several common scenarios: http://www.postfix.org/STANDARD_CONFIGURATION_README.html


2

The Disable action on mailbox users removes their Exchange attributes and marks the mailbox for deletion in the database. It won't delete until the retention period on the database has lapsed (so it depends on how you've set that, but the default is quite generous). In effect the mailbox has just been disconnected. Unless you manuall You can recover the ...


2

Heh. Unix/Linux and a standardized way to do something. Funny lad you are. I know, I know, in many cases there are standard ways of doing things, but LDAP certainly is not one of them. LDAP rhymes with the Perl motto, "There's more than one way to do it". The same convention than in the /etc/passwd (or, in /etc/shadow to be precise) will work. Undernearth ...


2

If you are using the SFTP SubSystem where it spawns a separate process, you could create a sftp group and only allow execution of the sftp-server binary for that group. It will not be possible to do this with the newer internalized sftp daemon, which is specified with internal-sftp. If they have shell access, they will still be able to scp. Do you have a ...


1

Can use PAM as well: cp /etc/security/access.conf /etc/security/sshd.conf echo "+ : root : ALL" >> /etc/security/sshd.conf echo "- : ALL : ALL" >> /etc/security/sshd.conf Then modify /etc/pam.d/sshd to add the following line after the other accounts: account required pam_access.so accessfile=/etc/security/sshd.conf This ...


1

If you want it to be on-demand, the standard way is to use /etc/nologin (have a look at man 5 nologin). Creating this file (with an optional message inside) will deny non-admin logins and display the message instead; removing the file will allow logins back. It can be applied to ssh, local logins, and anything else that uses PAM; just make sure that the ...


1

Is there a reason that the IP subnet must be the same on both ports? What you attempting to do is normally done through the use of separate subnets/VLANs, with an ACL/firewall rule restricting access between the two subnets. Briefly, without using vendor specific config: VLAN10: 192.168.1.0/24 VLAN20: 192.168.2.0/24 Port 1 -> VLAN 10 Port 2 -> VLAN ...


1

I haven't used Windows much in a while but Firefox will check for updates of addon's itself too - if the flash plugin has any add-on hooks (I'm not sure it does as it doesn't on OS X or Linux) - but other addons & firefox itself will also periodically check for updates. All of this can be disabled and/or have timing changed in Firefox's Preferences > ...


1

Here's an official page from Adobe: Managing Flash Player auto-update. Basically it says you need to create the file C:\WINDOWS\System32\mms.cfg with the following text in it: AutoUpdateDisable=1


1

If you make postfix just reject the mail as it comes in, it doesn't use the sender address, it just refuses the email at the "RCPT TO" stage. Make sure you have soft_bounce=no unknown_local_recipient_reject_code = 550 I'm not sure what else you've got going on, but at least on my postfix, if somebody attempts to send an email to an unknown local user, it ...


1

The question is why your MTA accepts mails to non-existent recipients in the first place. It should just finish the SMTP dialog with the connecting (Spam-) client with a permanent error (5xx) message. You should really have a good reason disabling DSNs (delivery status notifications). See smtpd_recipient_restrictions or more precisely the restriction ...


1

Exim has extensive configuration for setting the retry times. In your exim.conf, there will be a retry section near the bottom. The retry configuration is three fields, the email address, the error code causing the failure and a list of timing patterns. These are defined as a group of three numbers: a letter behaviour code, the length of time to apply this ...


1

Set retry to something absurdly long, cron a script to pull message ids from exim -bpu in queue greater than length x, then remove with exim -Mrm <msgid> You can alternatively run exim as a non-queueing daemon with mua_wrapper = true. Look at Section 48 "Using Exim as a non-queuing client", it may do what you need. When delivery fails, an error ...



Only top voted, non community-wiki answers of a minimum length are eligible