Tag Info

Hot answers tagged

11

I would install openvpn. http://openvpn.net/index.php/open-source.html Here is a tutorial for using windows as a server and client http://www.runpcrun.com/howtoopenvpn You'll need dynamic DNS on your server and forward the openvpn port on your linksys to your server. Once openvpn is configured, you'll be able to connect to your dynamic DNS host name from ...


11

Linux doesn't have magic security pixie dust. Linux installs can be poorly configured, too. Whatever server operating system you use, you need to: Turn off unnecessary services / daemons. Check to make sure you really turned off unnecessary services / daemons. Change any default passwords or disable default accounts. Understand how to manipulate ...


8

This is what I have in my favourites for reference: http://blogs.technet.com/b/migreene/archive/2008/03/24/3019467.aspx CREATOR OWNER - Full Control (Apply onto: Subfolders and Files Only) System - Full Control (Apply onto: This Folder, Subfolders and Files) Domain Admins - Full Control (Apply onto: This Folder, Subfolders and Files) Everyone - Create ...


7

chrooting users using ssh is not a desirable configuration in most cases. When they're jailed into their home dir, they won't be able to use any programs outside their home dir. This makes unix almost unusable as a shell server. You can use FTPS instead of SFTP/SCP, which will send passwords over SSL, but uses an ssh server, allowing you to chroot them for ...


6

du -hcs /home/*/ Or, for exactly what you want: for i in /home/*/; do user=${i#/*/} space=$(du -hs "$i" | cut -f1) echo "${user%/} = $space" done


6

It doesn't "delete on reboot"; it only exists in RAM in the first place. Mount tmpfs to a directory under your home directory.


5

This guide is pretty major surgery, only follow it if you are confident at the command line - a few mistakes could lead to losing all your data. You will have to copy all the files from your home directory somewhere else, and then copy them back once you have turned off the encryption, but you don't have to reinstall. So let's say you have an external drive ...


4

I have done that once, and I do not recommend it. The reason is that distributions (mostly) do not use exactly the same version of applications. As an illustration, Ubuntu uses application X-APP version a.1 and Centos uses version a.2. When you boot Ubuntu and start X-APP for the first time, it creates ~/.x-app.rc. Later when you reboot into Centos and start ...


4

You should allow NO inbound traffic. You should allow the outbound traffic for the protocols that you will be using. Your list is good, although you might want to add DNS and also NTP if you are want to sync time. Be aware that (by definition) TCP/IP is bi-directional. The directionality referred to here is the direction in which the connection is ...


4

If you already have a Windows 2008 server you can just set up RRAS and forward PPTP/GRE traffic to it from your router. It's simple and should do the job.


4

Keep it simply - use RRAS (Routing & Remote Access Service), which is built-in to Windows Server. It even runs through a wizard which has the option to set the server up for VPN/routing. It's simplest if you use the box as a NAT router, which means assigning it a public IP (behind your firewall, obviously).


4

It's documented here: https://blogs.technet.com/b/askds/archive/2008/06/30/automatic-creation-of-user-folders-for-home-roaming-profile-and-redirected-folders.aspx Administrators: Full Control System: Full Control Creator Owner: Full Control Authenticated Users: Read & Execute, List Folder Contents, Read And you must further edit the ACE ...


4

Ask them


4

You're modifying inodes and not files, it should be fairly quick. Last time I did that it took under a minute on our old LTSP boxen. You've made a bunches of changes already if it worked at all. But it's generally a bad idea to do such indiscriminate changes. Update based on the comments: @wombats You need to set up another directory on the box, set up a ...


4

This might be the intended behavior. The manual page shows an --env option for start-stop-daemon: -e|--env env-name Set an environment variable whose name and value is env-name before starting executable. Example: -e HOME="/home/user" exports an environment variable whose name is HOME with value ...


3

You could go with dynamic IPs and something like DynDNS or maybe EasyDNS. Linux is good. And, if you are not into getting too deep, you could consider Ubuntu server edition; Book reference: Beginning Ubuntu Server Administration For the hardware, if you are setting up at home, consider a UPS unless you are located in some place that will never have power ...


3

Lose the inbound allow any! Only reason to have that is for active FTP but you can use passive instead. I personally allow any outbound. If it's only simple browing then you should be good with the ones you have. The only difference is when applets or plugins in web pages want to talk directly to their home servers over something other than HTTP/HTTPS.


3

LogMeIn Hamachi also offers a configuration free VPN. Its free for non-commercial use, see https://secure.logmein.com/products/hamachi/list.asp All you do is run it - and it works. I've been using it for a year now and its quite solid. The only (very minor) problem I've run into is coexistence with VMware. This problem can be fixed in about 10 seconds by ...


3

The freeSSHd supports Secure FTP and SSH very comfortably. The name says it all... freeSSHD is a free implementation of an SSH server. It provides strong encryption and authentication over insecure networks like Internet. Users can open remote console or even access their remote files thanks to buit-in SFTP server. And the Secure FTP support, ...


3

If they already have unjailed ssh access then there would be nothing to gain by restricting sftp even if you could do it. Sure, there was a good reason to chroot the ftp server, but If I already have ssh access to the full machine there's no added security risk to me having sftp access.


2

First of since your are talking about a home server and have strong budget constraints (nearly) forget about physical security. Place the box somewhere where your spouse/kid/pets can't reach it to not run into trouble when someone unplugs this thing just to get a place to plug the vacuum cleaner in. Label that plug so that it is absolutely clear! Should ...


2

Perhaps not directly relevant to vsftpd, but something I ran across with SFTP is that pam_mkhomedir.so creates the homedir owned by the user:group - naturally, even if the skel files are owned by root. But chroot with SFTP wants root:root to own the chroot homedir for security reasons (with permissions 755). Even with the skel files owned by root.


2

You should definitely try MySQL Sandbox : To run a simple MySQL service in your $HOME, you just need to : Download a MySQL binary tarball from MySQL's website run "make_sandbox /path/to/tarball.tar.gz" You will get a complete MySQL server running in the directory of your choice. The full documentation is there.


2

I think that clustering and home use are pretty much incompatible. The closest you are going to get to such a setup is virtualization. I highly recommend XenServer which will allow you to create virtual machines for free with a lot of management tools.


2

There are some possible solutions for this: You can go for a replicated block storage like DRBD (or MARS as mentioned above), but you need to setup a cluster file system on top of the block storage. Such file systems could be GFS2 or OCFS2 which are both available in the Debian kernel afaik. DRBD can handle primary/primary and you can mount it on both ...


2

Remove auto-umount file from ~/.ecryptfs/ - each time you will need to umount your private directory manually. The other option is to keep your ssh session running using screen or tmux. More info on ecryptfs Ubuntu


2

what would happen if usage gets 100 percent. No user will be able to login and all logged users will lost terminals? Generally, yes, if /home fills up the system will become largely unusable. People will probably not lose their existing terminal sessions, but they will be effectively dead in the water since they will not be able to create any more ...


2

Home IP addresses are typically dynamic, your ISP can change them at any time. DNS A records map domains/hostnames to IP addresses, that's a problem when your IP address can change at any time. What you want is a Dynamic DNS service, that supports changing the IP address in the A record when your home IP changes. Some DNS providers offer that service, but ...


2

O_o what were you doing this for? I'm hoping you're the only person on this machine. At any rate, there's no way to answer this, because it depends on the size of your /home directory. It can take minutes. It can take days. Depends on users and number of files and the disk subsystem speed, drive speed, system load...etc... At any rate...it's usually a ...


2

It is possible with a sufficiently complete set of SELinux rules. You'd probably need to create a separate home file context and a root domain for each user, and then allow/deny access as appropriate.



Only top voted, non community-wiki answers of a minimum length are eligible