Re: Permissions

From: Nexus (nexus06@drxlabs.com)
Date: 12/10/02

  • Next message: Leon Pholi: "RE: XP admin shares" 
    Date: Mon, 09 Dec 2002 15:32:26 -0800
From: Nexus <nexus06@drxlabs.com>
To: Chris Berry <compjma@hotmail.com>

    If what you have is working good(i assume you have some kind of 'image'
    or something,

    Then i would just use the sysinternal tools to understand more of whats
    going on, and test a image with the newer perimission set.
    and with your current permission set,users have full contrl over way to
    many directorys (i have a Like issue having to run old apps based on NT
    and such)
    other then users being able to make changes and such, you have security
    issues with virus's and webpage exploits have access to /winnt and
    /system and /system32

    folders and being able to totaly get into a system. but ultimetly it you
    who has to deside on a security model and a standard image.

    but:

    having security groups is hard to setup, but makes admin way easyer
    because you can easyly remove acccess from an app by just removing said
    person from the
    security group. if your on a win2k AD you can even setup GPO's for
    software uses and access & times and such.

    its all about , your needs and how much time you can spend setting it
    all up. But once up its much better.

    Nexus

    Chris Berry wrote:

    >> From: Nexus <nexus06@drxlabs.com>
    >> goto sysinternals.com there are lots of good tools there that when
    >> run before you run an app will tell you what it is accessing,
    >> including reg keys dll , etc...
    >
    >
    > Hmm, I might try that. I wonder if its worth it though, I'm pretty
    > paranoid when it comes to security, but this just sounds like an
    > administrative nightmare. What is it that you think a user could do
    > with the permissions I mentioned that they couldn't with the ones
    > you're suggesting? I mean you're going to have to give them some
    > write permissions in order for some of your apps to work, and then all
    > they have to do to install software is direct it to one of those
    > directories.
    >
    >> another group you can utizile is authencated users, this group will
    >> make sure a user is 'authencated'
    >> this group is in leiu of the 'everyone' group.
    >
    >
    > I pretty much never use the everyone group except where it is already
    > installed. I tried setting up one machine where I removed the
    > everyone group and gave explicit permissions instead, but win2k choked
    > on that big time, revealing the fact that many M$ process depend on
    > the base permissions in order to function. (bad coding practice if
    > you ask me)
    >
    > Chris Berry
    > compjma@hotmail.com
    > Systems Administrator
    > JM Associates
    >
    > "Live dangerously, overclock your servers."
    >
    > _________________________________________________________________
    > MSN 8 with e-mail virus protection service: 2 months FREE*
    > http://join.msn.com/?page=features/virus
    >
    >
    >

    Relevant Pages

    • Re: FxCop App Security
      ... this applies to normal .NET apps and not ASP.NET apps. ... information on what security settings should be used when running the app on ... > This is used to indicate the minimum permissions your assembly require... ... > Microsoft Online Support ...
      (microsoft.public.dotnet.framework.aspnet)
    • Re: storedproc.edit: "select permission denied" when assigning to a field
      ... people who are concerned with security prefer NOT giving end users ... I think you're also suggesting that there be a single userid that everyone ... have other apps that do use them successfully. ... > you should be using a sql userid that has the correct permissions for the ...
      (borland.public.delphi.database.ado)
    • RE: What server hardening are you doing these days?
      ... permissions on their data, and Microsoft encourages ISVs to minimize ... I've been able to discuss ACLs and other security issues in Windows with ... Control or DAC (which is what you're referring to by the "stupid ...
      (Focus-Microsoft)
    • Re: Are bad developer libraries the problem with M$ software?
      ... rarely poeple on security lists. ... If you want to add language specific content to the OWASP Guide feel ... > I think that most on the list would agree that, overall, most web apps are ... > programmers when they haven't been offered a clue. ...
      (SecProg)
    • Re: Windows Firewall Wont Stay On
      ... I have come up with a solution that does not disable Security Center, ... By changing the Permissions of that key, ... settings from being changed again. ... the firewall alert settings in Security Center get ...
      (microsoft.public.windowsxp.help_and_support)