Tag Info

Hot answers tagged

5

Uninstalling update KB 3002657 worked for me. We were getting authentication prompts/failed authentication in Outlook when trying to connect to the exchange server. Uninstalled the update from the Exchange server and domain controllers and everything is working again.


5

It would be nice if you could use the immutable flag on directories, but you can cheat by making a file in that directory that is immutable. So touch virtu_user_X/.immutable then chattr +i virt_user_x/.immutable. For example: [root@hellonurse ~]# cd /root [root@hellonurse ~]# mkdir z [root@hellonurse ~]# cd z [root@hellonurse z]# touch .i [root@hellonurse ...


4

StrictModes checks the home directory permissions not just the .ssh directory. As the man pages say: This is normally desirable because novices sometimes accidentally leave their directory or files world-writable. Authentication refused: bad ownership or modes for directory /home/myUser. Says it has a problem with the home directory permissions.


3

A user account by default has read access to most other objects and their attributes in AD. You can minimize access by assigning a long random password, and creating a special security group for those accounts. In the Default Domain Policy, assign that group the following Windows rights located at Computer Configuration > Policies > Windows Settings > ...


3

Take away write permissions for that user using file system access control lists (ACL) - setfacl command. setfacl -m u:master_virtual_user:r-x virtual_user_*


3

According to the documentation for documentation for the sys.database_permissions DMV: Any user can see their own permissions. To see permissions for other users, requires VIEW DEFINITION, ALTER ANY USER, or any permission on a user. To see user-defined roles, requires ALTER ANY ROLE, or membership in the role (such as public). And, according to ...


3

The reasoning for this question is questionable ... To critique your desired solution of creating a new user -- even if other root users can't change new-user's password they don't need to since root can read any file or change the file permissions of the file -- they don't ever need to "be" that user." I you have terabytes of data you want to prevent ...


3

Move your pictures out of /usr/lib//cgi-bin/ folder and put them somewhere within /var/www/ Update your paths accordingly. Every time you trying to access any file within cgi-bin path it is expecting that content will be generated by executing that file.


3

The permission of /var/www does not permit the chrooted-user to create files in it. That is correct and by design. You must create a folder inside of /var/www with the proper rights of the user. /var/www can not be writeable for the user.


2

Can read and write permissions will be assigned to groups so that users in those groups will inherit the same properties. Yes. if yes how to assign read permission to specific group. It is done exactly how you would manage permissions for individual users.


2

On NTFS volumes, you can set security permissions on files and folders. These permissions grant or deny access to the files and folders. You can view security permissions for files and folders by completing the following steps: In Windows Explorer, right-click the file or folder you want to work with. From the pop-up menu, select Properties, and ...


2

So the issue is your syslog process still has the deleted file open. You need to restart your syslog process. By default that is rsyslog in centos service rsyslog restart I'm sure you can see it opened as deleted also if you try something like lsof | grep '/var/log/secure' That will give you the pid/process name of what is holding it open. For ...


2

Ultimately if you give someone root access to your system, you give them everything on the system, that's why it is important for you to trust people you give root to.


1

I suppose you could set an immutable extended filesystem attribute on /etc/shadow. That will prevent all changes to passwords, until the root user undoes the immutable bit. The command is "chattr +i /etc/shadow" If you are provisioning root access to a professional sysadmin you're supposed to assume that they won't change the password if you ask them not to ...


1

Apply the point and print restrictions policy: Point and Print Restrictions: This policy setting controls the client Point and Print behavior, including the security prompts for Windows Vista computers. The policy setting applies only to non-Print Administrator clients, and only to computers that are members of a domain. When the policy setting is enabled, ...


1

There may be a third-party tool for this, but natively Linux doesn't support something like this. However, you can simply prevent any user but the owner from changing the file. Just set the chmod of the script to 755 (full access for the owner, read/execute for all others). You can compare this to most of the files in "generic" folders like /bin, they all ...


1

Turns out I had to add the following line to the /etc/mail/spamassassin config and then re-compile spamassassin. Note, it is important to include file name at the end e.g. bayes bayes_path /path/to/dir/bayes


1

We have similar issue with AD authentication here. In our case, we made modification to domain group policy, similar to the one mentioned in this link. Basically you need to set LAN Manager authentication level to "Send LM & NTLM responses". This policy was not set before, since the default setting (Send NTLM response only) in Windows local security ...


1

This would be obtained by the VIEW DEFINITION permissions. However you probably don't want to allow them access to your database servers. An alternative way would be to query the permissions on your database, and supply them with the output. This can be done using DMV's or SQL queries. There are some examples in this StackOverflow post.


1

The simple answer is yes. The how is by simply setting the correct owner and file-system permissions. In some cases file-system ACL's (setfacl) provide the additional ganularity you might need. Typically though you would restrict FTP users with chroot to their home-directories and move content your users are not allowed to see/edit/remove to a separate ...


1

I've often seen this when client machines have Offline Files enabled for a given share. Same user, same share, different files on different machines.


1

Darn. It was a different userid afterall. My Windows admin gave me bad info because she had confused herself with different client accounts.


1

This is a typical job for ACLs :-) Your example $ mkdir /tmp/foo Set the permissions for the directory itself $ setfacl -m g::rwx -m o::rx /tmp/foo Set the permissions for the newly created directory and files in that directory. $ setfacl -m default:g::rwx -m o::rx /tmp/foo Test $ mkdir /tmp/foo/bar $ touch /tmp/foo/bar/baz.py $ ls -ld ...



Only top voted, non community-wiki answers of a minimum length are eligible