Skip to main content

Questions tagged [principle-of-least-privilege]

Filter by
Sorted by
Tagged with
1 vote
2 answers
91 views

Permissions, Groups, and Principle of Least Privilege

Lets say I have the following setup Two teams: TeamAlice and TeamBob A command that requires admin access: admin_command Two sets of computers: TeamAlice_Computers and TeamBob_Computers Only ...
CaffeineAddiction's user avatar
0 votes
1 answer
108 views

Recommendations on PKI roles as per ETSI EN 319 401 - V2.3.1

I want to configure roles (least privilege) on my CA instance (EJBCA) and I'm trying to find what are the best practices to do this. I've tried to read the ETSI EN 319 401 - V2.3.1 standard and try to ...
No name's user avatar
  • 223
2 votes
1 answer
447 views

If browsing the web with root is dangerous, isn't browsing the web with a sudo enabled account only marginally safer?

If I get hit with malware while performing daily tasks (e.g. - checking email, web browsing, etc.) with a root shell, the malware will own my machine. If the aforementioned occurs whilst on a standard ...
OTM's user avatar
  • 143
0 votes
1 answer
140 views

Can I use root account if every server only runs one service [Debian/Ubuntu Server] [duplicate]

Usually people say directly using root account is a very bad idea. However, my current setting is like this: to achieve a higher level of isolation, all services have their own virtual machine ...
user avatar
1 vote
3 answers
1k views

Why is it not recommended to permanently use the root account for all tasks?

Yes, I did read this answer: https://apple.stackexchange.com/questions/192365/is-it-ok-to-use-the-root-user-as-a-normal-user/192422#192422 But I still fail to understand the reasoning behind this ...
gaazkam's user avatar
  • 6,027
2 votes
0 answers
171 views

Best practices or advice to convince IT admins not to map network drives in privileged sessions with users

We are currently trying to enhance the security posture of our company, and this means changing how some IT personnel work. Put precisely, our IT helpdesk currently have 2 separate accounts: 1 for ...
Ob1lan's user avatar
  • 123
2 votes
1 answer
335 views

Best way to apply least privilege to one specific jar application on Linux

Let's say I have some java application running on the host and do different things, and now I have built a jar that captures network traffic. While reading What's a least-privilege way to allow node....
A.Ho's user avatar
  • 25
0 votes
0 answers
147 views

IoT Device user needs to perform task requiring Windows admin privilege

Our IoT device runs only our application and the device users can not launch additional apps. The IoT device users and IoT device admins both run under normal (non-admin) accounts with identical ...
Ken's user avatar
  • 1,091
3 votes
0 answers
284 views

Can a non-root process (MySQL) authenticate to RADIUS via PAM?

I've run across a dilemma with PAM RADIUS authentication for the database layer. In our environment, the OS login authenticates via PAM to a RADIUS server which accepts a token code and authenticates ...
Mike McManus's user avatar
  • 1,355
2 votes
2 answers
373 views

How does separating concerns into separate processes (without enforcement) help security?

In this talk on privilege separation, Theo de Raadt explains that OpenBSD's ntpd has a master process which calls settimeofday(), a DNS process responsible for querying DNS servers, and an NTP ...
strugee's user avatar
  • 719
3 votes
2 answers
1k views

Low priv users for Windows Services

This is about secure configuration of Windows Services. I've noticed many many times that software developers, when designing software for the Windows platform, don't spend enough time on the ...
kaidentity's user avatar
  • 2,654