Tag Info

Hot answers tagged

12

You can assign this in either a GPO or Local Security Policy. The setting that you're looking for is in Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment > Shutdown the system


10

You could use sudo in place of your custom script to accomplish the same thing. That is, given the default supervisord configuration, in which only root can run supervisorctl, you could put an entry like this into /etc/sudoers: alice ALL = (root) NOPASSWD:/usr/bin/supervisorctl restart app1 bob ALL = (root) NOPASSWD:/usr/bin/supervisorctl restart app2 ...


8

Yes, adding a new non-root user, then sudoing from it is the "best-practice". If you have a lot of commands to run at once many people say to run sudo su -. However, sudo has a -i option that is used to give you a root shell. Also, if you want to disable interactive logins for root, you can change the password in /etc/shadow to '!'. To have two users ...


8

Short answer - you can't. Long answer - you can monkey with permissions on specific registry keys, folders, etc such that it is more difficult for a local admin to remove the product. If you want to go this way I recommend the uninstall registry keys under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall. Unless someone has the ...


7

Personally, I would set the ownership of /var/www/html to apache. You can do this by: chown apache /var/www/html Next, I would create a group of let's say "Web admins": groupadd webadmins Add the user webadmin to the newly created group: usermod -G webadmins webadmin Add group permissions to the newly created group: chmod g+rw /var/www/html


7

Windows Server Update Services (WSUS) provides the server-side component to handle update deployment. Its provided by Microsoft as a no-cost add-on to Windows Server 2003 and up. Computers (client PCs, servers, etc) are typically directed to the WSUS server to receive updates by way of Group Policy settings (that can also be done through simple registry ...


7

Assuming the jumpbox is a linux box, iptables can usefully be used on the OUTPUT chain to restrict which group members can connect to which servers. Something like iptables -A OUTPUT --gid-owner project1 -p tcp --dport 22 -d ip.of.project1.com -j ACCEPT iptables -A OUTPUT --gid-owner project1 -j REJECT iptables -A OUTPUT --gid-owner project2 -p tcp --dport ...


6

Well, first off, using Dropbox as a deployment-platform is a bad idea. There are more suited tools to do this, I'm thinking about rsync and/or git... Nevertheless, you probably installed DropBox with the root-user. Don't do this, install it as the apache-user. The deamon will run under the apache-user and will create files that apache has rights to ...


6

Generally you want to chroot them into their home directory. If you do a google search on something like "linux chroot home directory" You will pull up hundreds of howto's on the subject. It's just not as easy as running a single command.


6

GNU chown uses a colon instead now to separate user and group. chown abc-def:abc-def * -R


5

I uses a reverse DNS lookup. It takes the IP address of the client and uses whatever PTR record is returned for that name. IMO doing authentication based on the name is not very useful at all, I suggest you consider using IP addresses instead. See this document about how Mysql uses DNS.


5

There are two basic techniques I'm aware of -- Method One: Microsoft's Identity Management for UNIX - This allows you to expose ActiveDirectory as a NIS server. This works with pretty much any *NIX flavor out there (they all support NIS), and has all the benefit (and drawbacks) of NIS. It is also officially supported by Microsoft, which means you have ...


5

The way I have implemented it, based on Microsoft's recommendations for Windows Server 2003 (found in the MCSE Self-Paced Training Kit for exam 70-294: Planning, Implementing and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure) is: Create a global security group for each position within the organisation (eg, CEO, Sales Director ...


5

You can use the sc command to set permissions on a specific service. The format is a little difficult to understand, but first you will need to find the user or group's SID to use the command (something like "S-1-5-21-...."). sc myserver sdset spooler D:(A;;RPWP;;;place-sid-here) A couple notes on that command: RP Allows service start WP Allows service ...


5

You may also need to set the ACL's for the object you are trying to query. See http://msdn.microsoft.com/en-us/library/aa374872%28v=vs.85%29.aspx I've had to do this in the past for access to MS services, event logs, etc. EDIT: In a nutshell, you may need to set ACL's for the WMI objects you are trying to access, using an administrative account, before ...


5

Run the command again as root and try restart.


5

They are likely either a member of BUILT-IN\Administrators, DOMAIN\Domain Admins, or DOMAIN\Enterprise Admins. Remove them from these groups and don't let anyone ever log into a DC that isn't a systems administrator.


5

Why are your users browsing somewhere that they can see this in the first place? There are a few things I'd like to address, so bear with me. It appears you're using a domain controller as a file server if your users are seeing NETLOGON and SYSVOL. Don't do this. Have your domain controllers run AD DS, DNS, and nothing else if at all possible. You don't ...


5

Nothing is wrong, this is the way permissions with UAC work. Try the search function next time :-) User in domain admin group cannot access directory the group has permission to access


4

Rather than worrying about "hiding" them, you should put appropriate permissions on them. It doesn't matter whether or not people see they exist. What matters is whether people can access things they shouldn't.


4

There's no such thing as a user who is not a member of any groups at all in AD. Users [SID S-1-5-32-545, Domain Local] Members of this group can perform most common tasks, such as running applications, using local and network printers, and locking the server. By default, the Domain Users group, Authenticated Users, and Interactive are members of ...


4

You are receiving this error because (as you correctly surmised) foouser is not a superuser, and does not have the CREATE DATABASE privilege. You can create the database as your postgres superuser, with foouser as the owner, which is probably the most sane option. Alternatively you could make foouser a DB superuser (definitely not recommended), or grant ...


4

Windows ACLs are applied in a certain order to be effective. Back in the WinNT and Windows 2000 days, the command-line utilities to modify file-permissions could cause problems if you blindly added/removed things. For example, if you were granting a group Modify permissions when they'd previously been granted R/O, it would add a second ACL with Modify and ...


4

That error is because you haven't added that user to the local Remote Desktop Users group on that machine. Check group membership again. Double check. Triple check. To answer your other question, you can have two concurrent RDP sessions for server management on a server OS. On a client OS, I believe that limit is one.


4

The user will need rights to modify the member attribute on the target group.


4

All of the *_priv columns are set to N for the test01 user. Did you check it from mysql.user table, something like this: mysql> select * from mysql.user where user='test01' and host='localhost'\G If so, you're checking in wrong place. All the privileges in this table is global privileges, it is assigned by using on *.*. While you are granting at ...


4

Your content on D:\ should not be available to "Users" since a newly created user is put into this group by default. Just remove the "Users" and "Everyone" entries from D:\ and all subdirectories - do not use "deny" type ACEs as they effectively will deny access for everyone who is the member of "Users", even if the user would otherwise have been granted ...


4

One way is to launch a shell for that user (explicitly specifying the shell): sudo -u www-data bash This will launch a (bash) shell as the specified user. You can then execute your command(s) and logout (to return to your previous shell)


4

Set the group of the directory to the group you want and then set the sgid permission bit. That should do the trick. $ chgrp ftpusers /data/ftp $ chmod g+s $_


3

As root you can use su -s /bin/sh $user — the -s option overrides the configured shell for the user.



Only top voted, non community-wiki answers of a minimum length are eligible