Hot answers tagged

55

You can use Group Policy to prevent the installation of new network devices. You'll find an option in Administrative Templates \ System \ Device Installation \ Device Installation Restrictions \ Prevent installation of devices using drivers that match these driver setup classes. From its description: This policy setting allows you to specify a list of ...


16

You need to provide the entire certificate chain in order for it to show up as trusted. Here's the link I got for comodo's instructions on installing the cert chain in apache: https://support.comodo.com/index.php?/Default/Knowledgebase/Article/View/637/37/certificate-installation-apache--mod_ssl I got this from http://www.sslshopper.com/ssl-checker.html#...


16

There's several options: On windows 7 you can control which USB devices can be connected. See this article for example. You can monitor that the PC is connected to the network, for example by monitoring the status of the switch port the machine is connected to. (modern computers keep the NIC connected even when the machine is off, so shutting down the ...


10

Per RFC952, hostnames are: A "name" (Net, Host, Gateway, or Domain name) is a text string up to 24 characters drawn from the alphabet (A-Z), digits (0-9), minus sign (-), and period (.). Note that periods are only allowed when they serve to delimit components of "domain style names". Microsoft in the usual "Embrace, Extend and Extinguish&...


9

What type of antivirus you are using? In Kaspersky antivirus you can define trusted and local networks. So, you can configure your local network as trusted and prohibit any other networks. This works if computer is only used in office. I have KSC and i can manage centralized all computer.


8

Shouldn't the switch be responsible for tagging the network traffic based on a machine's subnet and the ports it is plugged into? VLAN's are a Layer 2 construct and IP addresses are a Layer 3 construct. There's no direct relationship between a VLAN and an ip address. It sounds to me like you have your switch ports configured as tagged ports for your VLAN's ...


6

For example, let's say I own a domain example.com, I'd like to create a subdomain mypc.example.com (not just only one though) that is only resolved for those phones (Android/iOS) and PCs (Windows, Linux) that have a specific key, those machines who do not have that key mustn't be able to resolve the IP. Basically a private replacement to dynamic DNS services....


5

To configure XAuth PSK with strongSwan 5.0.x (as responder) you have to use: leftauth=psk rightauth=psk rightauth2=xauth While deprecated authby=xauthpsk would actually still work as an alias for the above (with xauth=server also added). can not load config '/etc/ipsec.conf': /etc/ipsec.conf:25: syntax error, unexpected STRING [leftauth] ...


4

Well it has to be 1 of 3 things. Something changed in the AD account, something changed in the Exchange account or something changed on the phone itself. Can you enable debugging on the phone to ascertain why exactly the phone is throwing an error. Follow these steps to enable debugging: 1. On the android phone go to menu -> email. You will need to have ...


4

AirWatch has an MS Exchange client for iOS and Android. They support encryption and have a number of other security features as well. http://www.air-watch.com/solutions/apple-ios


4

It's not possible. The way to solve this problem is with a layer on top of the TCP layer that provides the semantics you need. This layer would have to add an identifier to each message, implement message acknowledgements, re-establish the TCP connection if it broken, and re-send all unacknowledged messages.


4

man tcp - look for tcp_retries[1,2] for Linux machines. I have no idea what to do for Android and given Apples attitude to system-level tweaking there is probably absolutely no way to do this on iOS except when you jailbreak. TCP socket timeouts put aside, most applications will implement their own timeouts which are probably considerably shorter than the ...


4

Erik Fair has answered this extensively over at Quora: The keyboard of the Teletype (TTY) ASR-33 (a very common terminal interface of the period from whence this standard hails) doesn't have underscore on it: http://www.pdp8.net/asr33/pics/k... which gives one a nasty problem: how do you type (input) a hostname if the hostname in question contains ...


4

A certificate can contain a special Authority Information Access extension (RFC-3280) with URL to issuer's certificate. Most browsers can use the AIA extension to download missing intermediate certificate to complete the certificate chain. But some clients (mobile browsers, OpenSSL) don't support this extension, so they report such certificate as untrusted. ...


4

To announce a printer for Android's Mopria-Print-Service via Bonjour use: bonjour-service-type: _ipp._tcp txt-record pdl: one or more of these pdls image/pwg-raster application/PCLm application/pdf txt-record ty: must exist, e.g. CUPS txt-record rp: the appropriate IPP-URI-Path (cups-printer-name) (code geeks may look into mopria/wfds java source code) ...


4

One of the certs in the chain ending with AddTrust External CA Root (02faf3e291435468607857694df5e45b68851868) is missing from what your server provides. Specifically the intermediate cert COMODO RSA Certification Authority (f5ad0bcc1ad56cd150725b1c866c30ad92ef21b0) is not included in what you serve. What can also be seen is that the actual anchor is ...


4

You really shouldn't be in a situation where you set VLAN tags on an actual client device. There's too much administrative overhead and it's simply not scalable. Instead, you should set the relevant switch ports for the devices to be untagged (or native) for the desired VLAN. VMware is an exception to this, but the parallel would be understanding why ...


4

I think an option is to create, on the target machine, a script to monitor the PC network settings (eg: IP address and gateway) and to alert you (eg: via email) when something change.


3

No-one's voted to close, so I'll make my comment into an answer: Why not run the check-out on the devices? Since you write apps, write one that locks the device until a user logs in. I wouldn't think it needs to be very secure, since it's being used in-house. To check a device out, the user simply takes it, logs in, and the app can transmit the fact that ...


3

Microsoft Windows does not prohibit the underscore in the name of a computer. Some system administrators, either not knowing or not caring about RFC952, use underscores in the name of a computer that is connected to the internet, and either put this name in the DNS explicitly or allow it to be published via dynamic DNS. There's nothing particularly strange ...


3

It's not abnormal. I had this discussion before with someone building custom Android distros. You will need a lot more memory than 8 GB. IIRC they used a 32 GB ram machine.


3

I wouldn't use conntrack in this scenario but a much simpler set iptables -A INPUT -i tun0 -j ACCEPT iptables -A INPUT -s 10.10.10.10 -j ACCEPT iptables -A OUTPUT -o tun0 -j ACCEPT iptables -A OUTPUT -d 10.10.10.10 -j ACCEPT No need for any connection tracking. You also don't need the DROP rules at the end, by the way, the -P ... DROP takes care of that. ...


3

You have a number of options: Run the SSH server on port 80 or 443. Run a tunnel on the SSH server to listen on port 443 or 80 and forward it to 22. Run a VPN on port 80/443. Essentially, something on the server you're trying to connect to needs to be listening on port 443/80 in order for you to connect to it. The other solution is to talk to the sysadmin ...


3

You appear to have hit a long-standing issue in Android. In particular Android will only load the autodiscover XML over HTTPS. If you serve it over HTTP then Android will refuse to even attempt to use it. As described in the bug, Android does not use DNS SRV records to locate mail services.


3

Assuming your cert is strong, and not generated by a compromised or weak piece of software, certificate-only root login protects you against root logins from people who do not have your certificate. That's it. It does not protect you against remote access vulnerabilities or exploits, it does not protect you against someone stealing your certificate, it ...


3

We can't properly answer capacity planning questions since they are highly dependent on your actual use cases and usage patterns. The vendor documentation more or less says the same: CPU requirements are very difficult to specify because of the wildly different requirements and use-cases. ... Memory requirements are highly dependent on the amount of ...


3

Chrome requires SAN. For two years now, Chrome has used the Server Alternative Name (SAN) extension in a certificate, NOT the CommonName (CN) attribute in the Subject as was used last century. (Other browsers, TTBOMK all, and nearly all clients today prefer SAN, but will fall back to Subject CN if necessary; Chrome won't.) You don't tell us what is in your ...


2

Here are a few answers to your questions Amazon will not give you access to the Hypervisor machine. You can get boot messages from your instance through CLI or the EC2 Management Console, just right click on an instance and select "Console" Unfortunately the only way you can get a VNC server is to install one.


2

It's almost certainly HTTPS. If you want to offer android apps for download, you can just put the .apk file on your site and link to it. Mind you, only people who've ticked the option for "Allow unauthorised sources" will be able to download it. Why don't you just submit it to the Google Play store?


2

Google has lots and lots of IPs, and they'll serve you the IPs that are geographically closest to where they think you're located. When I dig against Google's own public DNS at 8.8.8.8, I get the same list you get from EC2: [] csternal@~: dig @8.8.8.8 android.apis.google.com ; <<>> DiG 9.6-ESV-R4-P3 <<>> @8.8.8.8 android.apis....


Only top voted, non community-wiki answers of a minimum length are eligible