31
votes
How can root start a process that only root can kill?
Having unrestricted sudo/wheel privileges anybody will be able to undo anything you done. Even if you manage to achieve this by removing the possibility to kill process directly, e.g. with sudo kill, ...
- 12.6k
18
votes
How can root start a process that only root can kill?
You can't give someone a power and then prevent them from using it. You have to narrowly focus the power you give them to only include what you want them to have.
In a comment, you said:
I have to ...
- 536
10
votes
How can root start a process that only root can kill?
Linux noob here. Could you consider writing programs or scripts that do only what these guys are meant to do, then make them root-owner and add them setuid bit?
Of course, one big issue is you might ...
- 201
5
votes
Accepted
User directory does not exist when logging in via ssh to a Synology NAS
Go to "Control Panel > User & Group > Advanced > User Home" and check "Enable user home service" before persisting it with "Apply".
- 166
4
votes
Accepted
Can i update the windows registry entries for HKEY_CURRENT_USER values without elevated privileges?
The subkey HKEY_CURRENT_USER\SOFTWARE\ Policies is special.
Please check the security on it, you will notice your username is read-only and the built-in administrator's group is read/write.
This is ...
- 17.1k
3
votes
Run a PowerShell script once on all computers as admin via GPO without changing execution policy
Create a GPO and execute the script in system context during boot or shutdown (see "Computer setting > Windows Settings > Scripts (Startup/Shutdown)"). Startup/Shutdown scripts got the ...
2
votes
Accepted
Linux root using domain users kerberos tickets
Well, yeah. PAM allows root to do whatever it wants, including assume the identity of other users.
If an ipa admin happens to be logged into the test vm then the
developer can sudo su to the ipa ...
- 33.3k
2
votes
How can root start a process that only root can kill?
If you give a user free reign as root, then the user could kill almost anything. For some in depth discussion and possible workarounds see: unix stack sigkill discussion.
Also the watchdog solution ...
- 1,572
2
votes
How does Windows establish whether application makes changes to device
which are the characteristics that are detected by Windows in order to decide to trigger UAC
Attempting to access a resource that the account's standard user token does not have permission to access.
...
- 36.8k
1
vote
Accepted
What permissions would I need to give a developer for a Wordpress website?
You'll have to give them the administrator role, as that is the only role out of the box that can do anything to plugins.
https://wordpress.org/support/article/roles-and-capabilities/#administrator
...
- 26
1
vote
Run a PowerShell script once on all computers as admin via GPO without changing execution policy
You can deploy the script as a Computer setting using Windows Settings > Scripts (Startup/Shutdown.
These scripts will run in the system context and not the user. To limit this to only running once,...
- 3,469
1
vote
RHEL 8: Administrator vs. Auditor role
AFAIK there are some ready made provisions for privilege separation in SELinux in Multi Level Security mode here but nothing immediately useful and practical.
When you need to protect and tamperproof ...
- 1,193
1
vote
Windows 11 home/ Win 10 Pro. How to prevent standard users from installing software?
Any user can run or install in its own user profile folder without admin privilege if the application don’t invoke admin right access or write file in restriction place.
You need AppLocker or such ...
- 17.1k
1
vote
Running Powershell scripts pushed from AD GPO as admin on domain computers
Try this implementation approach:
Use GPO to run your script via Task Scheduler as SYSTEM, not a user
Give Domain Computers AD group access to a share for the script to be able to copy file from it
- 2,040
1
vote
Accepted
Hiring a contractor to migrate databases and websites. What kind of security plan should I put in place to mitigate risks?
Some generic tips if your target is more Windows; as your question don't state wich OS you are using.
Create for the contractor a account for him only. If an local admin for the new and old server it'...
- 17.1k
1
vote
Accepted
Granting full global domain admin rights to license reseller?
In my experience, only Billing Administrator privilege is required for a reseller to manage licenses within your tenancy.
- 26
1
vote
Granting full global domain admin rights to license reseller?
No, I work for a reseller and our shop never asked such, but our customers just order more license when they need more, or less.
Are you sure the shop you asked are a reseller ? as some small IT ...
- 17.1k
1
vote
Accepted
How to make a service (or the system process) impersonate the *elevated* variant of a user account?
Your theory is correct. This behaviour can be changed via a registry setting.
In
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
find or create the DWORD value ...
- 6,055
1
vote
Accepted
Dialogs still ask for user password (instead of root's) after adding rootpw to sudoers file
waddayaknow! I found the answer myself: it's indeed to do with policykit. On my Kubuntu 18.10 I had to change the following file (/etc/polkit-1/localauthority.conf.d/51-ubuntu-admin.conf) to have it ...
- 31
1
vote
How to prevent users from installing software on Windows 2016 on Azure?
don't give users admin rights, then, if you want to lock down what runs on windows, configure AppLocker. without GPMC use secpol.msc see https://docs.microsoft.com/en-us/windows/security/threat-...
- 24.1k
1
vote
How to prevent users from installing software on Windows 2016 on Azure?
Application whitelisting. Which for Windows usually means AppLocker.
- 33.3k
1
vote
Accepted
Windows 2008R2 RDP only works for Standard User but not for an Admin User
This is caused by a known issue in the January 2019 cumulative update:
Local users who are part of the local “Administrators“ group may not be able to remotely access shares on Windows Server 2008 ...
- 6,055
1
vote
Accepted
Accessing Local Directory via UNC Prompts for Credentials
If you are using kerberos authentication, adding another DNS record pointed to a file server will not work. The correct why to add another name is the following command:
NETDOM COMPUTERNAME foo /ADD ...
- 1,180
1
vote
Accepted
Administrators lost access to network drive and remote desktop Windows Server 2008
Two recent Windows Updates (KB 4480970 and KB 4480960) broke the ability for administrators to access SMB2 shares on several OS versions, including Windows Server 2008 R2. That fits your description ...
- 1,904
1
vote
Accepted
Can I grant "Virtual Disk Service" to a non-local administrator?
Using VDS
An application that is using VDS must run under the Backup Operator or
Administrators group account. Without the appropriate privilege, an
application can create a service loader ...
- 33.3k
1
vote
Accepted
Windows - Fine-grained administrator permissions
The UAC prompt is an all-or-nothing proposition, you either allow the program administrator access or don't run it at all.
That doesn't necessarily mean that you can't achieve your goals in other ...
- 6,055
1
vote
Scheduled Task in Windows Server 2016, run by non-admin Users
After digging into the topic for a while and also trying some suggestions I've came up with this script which requires the PsExec tool from PsTools/SysInternals from Microsoft:
$task = "Test-...
- 555
1
vote
What happens to Task Scheduler if User has no permission?
There's a couple things here. When you selected 'run when not logged in' did it ask for your password and save? If there was no error, then it should still be able to run. The next question is what is ...
- 1,339
Only top scored, non community-wiki answers of a minimum length are eligible