Tag Info

Hot answers tagged

45

You need to apply and be granted your own IP allocation by your local registry like RIPE or APNIC. They require annual fees, and you need to justify your requirement (yours is legit). They will assign you an Autonomous System number and a range of IP addresses. You must then find people to peer with (in a datacenter usually), preferably more than one. You ...


35

Who said that "bulletproof hosting" is expensive? PRQ, the company that hosts thepiratebay.org, offers dedicated servers for less than $200 a month and simple web hosting for $10 a month. From their website: Refugee hosting Our boundless commitment to free speech has been tested and proven over and over again. If it is legal in Sweden, we will ...


33

No, this is not normal. Contact your provider to resolve this issue. When they can't, switch away ASAP.


30

A sysadmin should be able to access any files a user has, unless they're encrypted, in which case the user's Windows password won't help. Having the system knowing the passwords means that you can never know if a user did something, or a sysadmin did, which could cause a lot of problems if you ever get into a dispute. The passwords would have to be stored ...


24

There is no justification. A sysadmin can change the password if needed but they should not know or store it. There are only cons. What about my private information that I expect HR to keep private? Finding out where I live because I took their parking space... posting my salary on the internet... passing on information to an ex.. emailed porn to the ...


24

Whether or not it is a 'major concern' is a point of opinion, but this idea has been had before, and resulted in action. Microsoft itself proposed an RFC to cover just this. RFC 4941, Privacy Extensions for Stateless Address Autoconfiguration in IPv6 (Sept, 2007). IIRC, Windows defaults to use this, the Linux IPv6 stack has this as an option (your ...


18

Don't mix up authentication and authorization. A password proves to the system who you are (authentication) Group membership and filesystem permissions typically dicates what you can do (authorization). To give a trusted admin access to files that are owned by someone else, you bump up their authorization level. You do not let them log in as if they were ...


17

Rule #1 of IP-based networks. Everyone communicating on it has an IP. You can masquerade it through a 3rd party, but you still have a public IP. There are no exceptions. The Internet is an IP-based network. I suspect you have some bad logic in your code someplace.


16

The "bulletproof hosting" does not work because of the ISPs reading and evaluating every abuse complaint, but simply because they are throwing every abuse complaint into the bin. This is certainly not expensive and certainly cannot be performed more efficiently if you do it yourself. Apart from that the internet looks quite hierarchic if you do not happen ...


13

I don't know if you can lock out the administrator. How would you repair the mailbox if there's corruption? Sysadmins are sysadmins in part because there's a layer of implicit trust for the high ranking system administrator. Sysadmins can read any data on the server, read emails, sniff traffic, reset passwords...essentially they are gods within the network ...


12

It has been a while since I consulted to the telecom industry so I am going off of what is still likely. For DSL, this is sub-par. You should never see traffic destined for another IP address. I would check with your provider. This is not a standard configuration and it is likely that there are some settings in the RedBack that are not right. Each ...


11

Your last requirement screams 'Truecrypt'. There are some other options (like EncFS and luks / cryptsetup), but I wouldn't exactly call those 'easy' if you do not set them up during installation. A Truecrypt volume is most likely not a partition, it would be a file, but from your question, I guess that would be ok. If mounted, root would be able to read it ...


11

DNS by design does not enable having an authoritative copy of all zones, as it utilizes a hierarchical naming system. The root servers are authoritative for identifying the server responsible for the Top Level Domain (TLD) in question. For example, resolving www.example.net will first query a root server to identify the authoritative nameserver for .net. ...


10

Absolutely. Several enterprise-level proxies support re-encrypting the connections your browser makes using a corporate certification authority. Essentially the administration team can push out a certificate to your workstation via group policies, and add it to the list of trusted authorities. The proxy then has the private key corresponding to that ...


10

Yes, the MS model is very much centered around delegated trust. There are going to be super-users, and it is up to the Organization to manage who can see what, where. Engineering a system like you're looking for using Exchange will require some out-of-Exchange business practices. Domain/Enterprise Admin accounts are not used. Such accounts are only broken ...


9

As I said in http://serverfault.com/questions/82556/domains-and-private-registration-services/82584#82584: "Domain Privacy" is a risky thing to engage in -- you don't actually own the domain and don't really have any rights to it if it's registered through a privacy service. Although it's spruiking their own Privacy service, Dynadot's QA on domain ...


8

The vast majority of my domains do not have any sort of "private" registration enabled and I have never, in 12 years, been contacted in a negative way by someone who got my information from the WHOIS database. It used to be a spam source, but I haven't seen that in years. I have the benefit of listing a business address and phone number, but still, no ...


8

It is also possible that those variables are just not returning the expected results, and thus are blank. You could try something like this: if ($_SERVER["HTTP_X_FORWARDED_FOR"]) { if ($_SERVER["HTTP_CLIENT_IP"]) { $proxy = $_SERVER["HTTP_CLIENT_IP"]; } else { $proxy = $_SERVER["REMOTE_ADDR"]; } $ip = $_SERVER["HTTP_X_FORWARDED_FOR"]; } ...


7

Administrators can always change a user's password. They have no reason to know the user's password. If there is a problem or the user is away and someone else needs access to files, then a manager can ask for the password to be changed for the day and the user can set their password back the next time they are in. There is a benefit in administrators ...


7

I would like to know some suggestions for open source solutions, I dont want something really complex ("a complete enterprise groupware solution", just the name "enterprise" gives me itches), I want a simple web based e-mail account. If a web interface is not possible, at least a *nix solution very light which supports pop3/imap. I use: Postfix for ...


7

A basic SSL provides an encrypted connection only. I has no actual identity information. Network Solutions sells these as "Express" certificates. Most SSL provides have an equivalent. The name and address provided when purchasing are for billing purposes.


6

As has been said, it isn't really possible. What can be done, of course, is events on those mailboxes can be audited and the event logs on the exchange servers can be secured. As Erik points out, even this won't help if a sysadmin takes a backup tape home and restore it. At the end of the day though, if the directors don't trust the sysadmins then the ...


6

As Chopper said, a striped data format will make it slightly less convenient to recover data from your drives. If you're RMAing the drives, you absolutely cannot count on any sort of wipe operation to do much good, since the most likely failure mode prevents you from reliably writing to some sectors, and the other failure mode prevents you from verifying ...


6

"If I could answer them personally, I would save another company the trouble and hopefully save myself some money along the way." Have you provided a place on your site for users to submit feedback? This will prevent many users from going directly to your ISPs with complaints and allow you to state your case to them before they take further action. ...


6

Explicit "Deny" permissions always take precedence over all other permissions (assuming canonical ACL ordering-- but that's probably a safe assumption). The permission denying the user "Write" permission will override any permission granting the user "Write" based on group membership.


5

Mail encryption, performed on the client, where only the user has access to their private key, is the only foolproof way to accomplish this. There are far too many ways an unscrupulous admin could "snoop", it's impossible to account for them all. This raises the question, though. Why are these untrusted admins still employed?


5

As already noted by @NickW you might just have encountered a change to the container that is your "virtual server". In OpenVZ - a technology to provide low overhead virtual Linux-based servers - a VM (commonly refered as a Virtual Private Server) is just a jailed "slice" of the host operating system, much like a jail in FreeBSD. Thus, if you have full ...


5

With some providers of SSL certificates (Digicert as one) you can generate new private keys and CSRs to request certificates on each server. This allows you to maintain separate private keys (and also generate these certificates for subdomains using Subject Alternative Names.). This does increase the administrative burden, but decreases the risk of sharing a ...


4

As others have already noted here: No good reason for IT to know user's password, instead the access of user's password might serve a negative situation in a few forms. In addition to what has already been said, if you do need to know a password is local administrator's password for the machine (or root), and the master encryption password for the System. ...


4

Keep in mind that if you go for having written down username/password combos, you have a very important list. Losing that list, or, worse yet, having someone copy that list without you knowing that a copy was made, would be a big big problem. And you really really do not want that in a file one some disk somewhere, which would be the common solution. This ...



Only top voted, non community-wiki answers of a minimum length are eligible