New answers tagged

4

The search string you are looking for is "SMTP server require authentication" (or just "<server product name> authentication"). To be clear, what you're establishing isn't really a "Telnet Connection", it's an SMTP connection that you're typing in by hand using telnet. If you tried to send anything that wasn't valid SMTP traffic, the server would ...


0

Do not use user input (because you camnot trust it) This answer extends the accepted with what looks to me a significant simplification. Now, from your description and from my best understanding, you have said that you want to prevent Sales Agent A (namely 12345) to peek into Sales Agent B's (namely 54321) data. Simply, kill the agentId parameter from ...


1

KMS allows you to encrypt/decrypt data without ever seeing your master keys. It makes managing encryption keys simpler because there's nothing you can do that can allow you to leak the master key. They can also manage the choices of encryption algorithm, and the mechanism for upgrading algorithm choice. So these decisions are made for you so you can't ...


0

What's the purpose/benefit of KMS? KMS prevents the leaking of decryption keys, similar to a HSM, but HSM's are expensive and hard to use. KMS's are cheap and easy to use because they have API endpoints. KMS shifts the problem of controlling access to encrypted data from a decryption key management problem (where granular access and ability to revoke access ...


2

How about something like a human bottleneck via procedure instead of automation and access to all files at once? All of the proposed solutions propose making the computer restrict access. This suffers from the problem that computers are ultimately stupid at the lowest level, and do what they're told. Since the HD is using whole disk encryption, all files ...


2

Following the principle of "only gives one the rights needed to achieve his task", maybe you can implement a restricted shell that will enforce that users of your system only do what you allow them to do. If your users are not able to: scp mount launch any network utility (firefox, netcat, curl) Use bash builtins to open network stream. Then the only way ...


10

VNC Your files could be stored on a computer in a secure location. Setup a VNC server on it and disable file transfer capability. Per this question on ServerFault it can be done in TightVNC. Ensure no other ports are open on the computer that stores your files. Provide a VNC client station and lock it down by: disabling I/O ports in the OS and on the ...


13

OK, I'm totally not a security expert and maybe this is completely off the mark (let me know in the comments!), but... If you can secure the box physically (otherwise all bets are off), then maybe you can let the user log on only with user A. All the sensitive files however would belong to user B and inaccessible to user A. EXCEPT for one program "PDF ...


21

Client-server architecture This is another approach that could make copying files much harder, but it requires investing more effort from your side. Access to the information could be setup on a client-server architecture basis with information being stored in a database (such as MySQL or PostgreSQL) on a remote server in a secure location. Then, provide ...


20

In addition to blocking USB (see other answers above): Disable networking, because... ... otherwise user will use remote access to your machine, e.g. via scp or ftp, and copy files from your machine. ... otherwise logged in users will be able to transfer file via net from your machine to some other machine via scp, ftp, samba, http.


3

If you just want to disable all usb devices, have a look at usb-storage.ko (USB Mass Storage driver under Linux). Disabling the driver would affect all usb devices, keyboards/mice included. To disable the driver, you could blacklist it by modifying /etc/modprobe.d/blacklist.conf. Just add the line: blacklist usb-storage This solution assumes other users ...


58

You can disable USB storage on Linux by blacklisting the module. modprobe -r usb-storage echo blacklist usb-storage >> /etc/modprobe.d/10-usbstorage-blacklist.conf echo blacklist uas >> /etc/modprobe.d/10-usbstorage-blacklist.conf If your users have physical access to the machine, and knows the encryption keys, the game is up no matter what ...


1

I don't consider myself an expert of S3, but I think the first option makes more sense for several reasons. The most important one is that a developer will inevitably set the wrong ACL at some point and allow public access. Not out of malice, not out of laziness, but out of ignorance (e.g. what is the developer turnover on your company?, because that is how ...


Top 50 recent answers are included