Access control based on user, group, or global access.

learn more… | top users | synonyms

1
vote
1answer
82 views

Securing Downloadable Files on Website Per User

I have an ASP.NET website serving up private PDF documents. The PDFs are stored unencrypted on a share on the internal network. The user logs in and navigates to the download page. The web server ...
4
votes
2answers
910 views

Are there any Windows permissions management applications?

I am currently dealing with permission issues with an IIS app pool. I am tired of clicking through window after window to set permissions on folders for domain and local users. Also, I would like ...
4
votes
3answers
151 views

Does allowing everyone know when a server process was started pose a security risk?

I recently found that in Microsoft .NET framework an impersonated thread is not allowed to request "time at which the current process was started". This could be done intentionally or this could be ...
3
votes
3answers
815 views

Proper Linux user authentication through PAM aware applications

Currently I'm building an authentication system using Linux PAM for a python daemon process. It will need to authenticate remote users from a variety of front-ends against the local user list. ...
0
votes
2answers
350 views

How to protect files (cron files) frome being executed by everyone?

I wonder what read / write permissions should I set on my cron files (php files) so they can be executed only by our server. We're using CentOS 5.9 - 64bit and cPanel / WHM + Apache. Thanks!
-6
votes
2answers
584 views

PHP injection on 777 file [closed]

Some one has modified a PHP file, which had permissions set to 777, on my VPS server. How can someone do that without administrative access to the server? What information I can give you? I know ...
4
votes
4answers
612 views

What mechanism enforces user permissions in Unix/Linux?

One of the core pieces of security in Unix/Linux systems is limiting privileges by user. For instance, certain actions can only be done by the root user. In theory, this can keep a malicious process ...
1
vote
2answers
243 views

What's the secure way to change UNIX permissions on a harcoded file often?

I'm writing a daemon that monitors something in the OS and flips execution permissions on a file in /run/ back and forth. The file has static contents and the file name is hardcoded in the daemon. I ...
0
votes
2answers
119 views

How should permissions be stored?

In a system where users have multiple permissions that may overlap (i.e. "Write" might not include "Read" etc.) what is the best way to keep them in the database? Both in terms of security and ...
0
votes
1answer
430 views

is it OK to grant permission for IUSR_ to cmd.exe?

One of my developers asked me to grant permission to IUSR_ user (the IIS user) to CMD.exe (console) now I'm wondering is it safe to do it? He is complaing, that his libraries had to use console for ...
5
votes
1answer
125 views

OpenBSD, fbtab and X Window [closed]

The afterboot(8) man page of OpenBSD advises "You might wish to tighten up security more by editing /etc/fbtab as when installing X. " I would like to know what entries in /etc/fbtab would make sense ...
3
votes
5answers
1k views

Security purpose of asking admin password to mount partition on Linux

So I divided my 250GB laptop drive into 2 partitions and some swap. On the second partition which is an ext4 60GB partition I installed Fedora 17. On the other bigger NTFS partition I've got Win XP ...
11
votes
2answers
1k views

Why do some Java APIs bypass standard SecurityManager checks?

In Java, normally permission checks are handled by the SecurityManager. To prevent untrusted code from invoking privileged code and exploiting some bug in the privileged code, SecurityManager checks ...
0
votes
1answer
456 views

website hacked and all its content erased despite the protections

i was hacked by a guy who erased everything. I spent the day to put everything in order, and i would like to find a solution for this : he erased all the files, and also changed the title for "www" in ...
2
votes
1answer
401 views

Security at writing in a folder

I would like to run with Runtime.exec() programs in Java (the programs' code are in C and Java ) - the users are uploading the Java/C code, and my app runs them. The code is saved in a separate folder ...
4
votes
1answer
59 views

Are viewable permissions an issue?

Is it, generally, considered to be a security issue if a user in 3-tier application has read-only access to other users' permissions? I.e. Alice can see that Bob has or has not access to some ...
3
votes
3answers
2k views

Disable Perl for some/most Linux users?

One of my server's web accounts got hacked a couple of times. Each time someone downloaded a Perl script via some phpBB forum and used the Perl script to do whatever they wanted to do (mostly connect ...
5
votes
1answer
3k views

What's the risk of changing permissions of the Security Eventlog registry key to IT operations?

Background Many developers are unnecessarily lowering the security of the event log, or requiring applications to run in Administrator mode just so they can use the event log with this C# or VB code: ...
1
vote
1answer
116 views

Does the “Special Groups” feature in Vista, 2008, R2, and Windows 7 apply to File System access?

The Windows 2008R2 "Special Groups" feature allows for detailed tracking of domain administrators when they log into the machine. This is accomplished by editing a registry key or the LSA. Is there a ...
2
votes
3answers
1k views

How can winlock virus change Windows Registry without admin permission?

When you try to install program you'll always asked about administrator permission. Same thing when you try to user 'regedit' command. So I'm interested in how does this virus works. How can it edit ...
12
votes
4answers
334 views

Sensitive information was placed in a publicly accessible folder. Who is responsible and how to proceed?

Background We have an IT staff who manages our server and a web developer who is not on the IT staff and has no root access to the server. All involved do very high quality work and I do not consider ...
4
votes
1answer
461 views

Can UNIX Domain Sockets be locked by user ID?

If I created a folder /tmp/me with permissions 700, and started a process under me that starts a listen socket under /tmp/me/socket. I currently assume that a connection to that socket originated ...
7
votes
2answers
2k views

What are the dangers of storing webserver temp files in the /tmp/ folder?

I have configured my first publicly accessible nginx server. I have configured it to use a /tmp/nginx folder to store temp files. This includes the body of http requests, proxy files etc. The /tmp ...
5
votes
2answers
529 views

What is the most appropriate way to notify/request permission from an ISP related to white-hat security testing?

In some of the posts I've read on this site such as Is hacking legal when a friend allows you to attempt to hack their system?, and Best way to test my home network from the outside, users who ...
14
votes
1answer
3k views

Why do you have to be an admin to create a symlink in Windows?

In linux every user can create symlinks, but in Windows I need an admin command line, or mklink fails. Why is that?
14
votes
2answers
3k views

Security implications of having files owned by the apache user?

Currently running a LAMP instance that developers are using for a variety of webapps. I have the following scenario: Multiple developers need access to create and modify files under ...
2
votes
1answer
777 views

Can suPHP lead to security issues due to hijacking people's accounts?

Bear in mind that, although I am pretty good at coding clientside javascript, I am not so great at dealing with serverside PHP. It doesn't help that there is very little information/tutorials/APIs on ...
15
votes
3answers
1k views

Is hacking legal when a friend allows you to attempt to hack their system?

So I've begun learning to penetration test and I want to try it on a real system, (apart from my own), and so I have asked a friend if I can hack their computer. He is as interested as I am on the ...
3
votes
1answer
1k views

Which Domain Administrator created file X on a Windows 2008 R2-based server?

Someone created a file (web.config) in a location that basically caused IIS to not work. Is there any way I can determine who created this file? The creator/owner says "Domain Administrators". ...
8
votes
1answer
179 views

What is your default umask set to?

What is your default umask set to? Did you run into any problem setting a stricter default umask?
26
votes
1answer
18k views

What is the difference between RBAC and DAC/ACL?

What are the benefits of each, and when should I choose one over the other? Are there situations where these should be merged? Do you have examples of common usages? And what about MAC, where ...