Policies - how to best "protect" an LDAP installation?

Hello. This isn't as much a technical question. I've been looking "all over the Internet" to see what people might have found to work before. If only there was some "How to run and protect your LDAP installation - best practices" guide somewhere :D
When you're the administrator of an LDAP installation, how do you deal with things when someone in your organization comes with some application they want to hook up to the LDAP? My main concern here isn't LDAP browsers etc, but bigger applications that use LDAP all the time.
Do you just give them the Directory Manager password and tell them to just go ahead, or do you instead make separate users for them? One user for each application?
Also, how do you go about determining which permissions to set for those users? (in my experience, the ones bringing in an application hardly ever knows what it needs to work)
Regards
Eivind Olsen

First, you should avoid using the Directory Manager account, it's best practice to create administrator accounts and/or groups instead.
Remember that the Directory Manager bypasses not only ACI's but also any limit (number of entries sent, search time limit and so on).
Then, depending on your security requirements, you could have an "anonymous access" rule, which is usually enough for lots of applications,
as far as you only need read access. Any authenticated access will also inherit the anonymous access rights
You should then create dedicated acccounts for applications that need "more than usual" rights, that is write rights or readability of usually
hidden entries or attributes.
If you don't know what exactly an application requires, just ask yourself what this application is used for, it should give you some hints. You
should also test it in a empirical manner, including all your use cases, starting with the least rights, and then have a look at the directory
server logs and possibly your application logs too. It should help you determine what are exactly the required rights.
Good luck !..

Similar Messages

Im new to apple products and just recently purchased a macbook pro, im just wondering how to keep it as best protected as possible?

I want to know how to keep my pro as best protected as possible from any type of threats

Just in case you meant software threats:
There are many forms of ‘Malware’ that can affect a computer system, of which ‘a virus’ is but one type, ‘trojans’ another. Using the strict definition of a computer virus, no viruses that can attack OS X have so far been detected 'in the wild', i.e. in anything other than laboratory conditions. The same is not true of other forms of malware, such as Trojans. Whilst it is a fairly safe bet that your Mac will NOT be infected by a virus, it may have other security-related problem, but more likely a technical problem unrelated to any malware threat.
You may find this User Tip on Viruses, Trojan Detection and Removal, as well as general Internet Security and Privacy, useful: The User Tip seeks to offer guidance on the main security threats and how to avoid them.
https://discussions.apple.com/docs/DOC-2435
More useful information can also be found here:
www.thesafemac.com/mmg

How to password protect an external hard drive

I just bought an external HD to use with Time Machine and for some extra space, but I would really like to password protect it. Since it has all my files on it, it is just as important as password protecting my computer. I'm thinking I probably have to use Disk Utilities, but I'm not quite sure how to do it.
Please be as detailed as possible, because I don't delve into Utilities very often.
Thanks
P.S. My HD is a Toshiba Portable Hard Drive, if it makes any difference. It advertises on the back that it can be password protected, but I have been unable of finding any way to do so.

Hello FidgetingFinhc,
The best protection for your data is to maintain the data as a encrypted disk image. Creating a "sparse image" will require a password to open:
I would follow the instructions provided by the Apple Support document below on how to make this happen.
http://support.apple.com/kb/HT1578
Hope this helps.
B-rock

How to refer to pacman's installation root in pre_install, etc

I have been unable to find any documentation of exactly how to refer to pacman's installation root from inside the .install script functions. Curious, I started looking through /var/abs/core for some real-world examples that might clue me in. What I found surprised me - from the looks of it, many of the functions there simply assume that their working directory IS the pacman installation root. For example:
/var/abs/core/ca-certificates/ca-certificates.install:
post_install() {
usr/sbin/update-ca-certificates --fresh
post_upgrade() {
usr/sbin/update-ca-certificates --fresh
pre_remove() {
# clean up certificates
local _backup=$(mktemp)
mv etc/ca-certificates.conf ${_backup}
echo > etc/ca-certificates.conf
usr/sbin/update-ca-certificates --fresh
mv ${_backup} etc/ca-certificates.conf
post_remove() {
# remove the cert file if it is empty
[[ -s etc/ssl/certs/ca-certificates.crt ]] || rm -f etc/ssl/certs/ca-certificates.crt
And yet, some others seem to assume that the install root is "/", like here:
/var/abs/core/crda/crda.install:
## arg 1: the new package version
post_install() {
echo "Uncomment the right regulatory domain in /etc/conf.d/wireless-regdom."
echo "It will automatically be set when necessary."
## arg 1: the new package version
## arg 2: the old package version
post_upgrade() {
# In an upgrade from 1.0.1-1 or older, the wireless-regdom file moves from the crda package
# to the new wireless-regdb package. If the user changed the file, it is save to overwrite the one
# from wireless-regdb by the user-defined one
if [ $(vercmp $2 1.0.1-2) -lt 0 ]; then
if [ -f /etc/conf.d/wireless-regdom.pacorig -a -n "$(grep -v ^# /etc/conf.d/wireless-regdom.pacorig 2>/dev/null | grep -v ^$)" ]; then
mv /etc/conf.d/wireless-regdom.pacorig /etc/conf.d/wireless-regdom
fi
fi
or here:
/var/abs/core/cryptsetup/encrypt_install:
# vim: set ft=sh:
install ()
if [ -z "${CRYPTO_MODULES}" ]; then
MODULES=" dm-crypt $(all_modules "/crypto/") "
else
MODULES=" dm-crypt ${CRYPTO_MODULES} "
fi
FILES=""
SCRIPT="encrypt"
add_dir "/dev/mapper"
[ -f "/sbin/cryptsetup" ] && add_binary "/sbin/cryptsetup" "/sbin/cryptsetup"
[ -f "/usr/sbin/cryptsetup" ] && add_binary "/usr/sbin/cryptsetup" "/sbin/cryptsetup"
add_binary "/sbin/dmsetup"
add_file "/lib/udev/rules.d/10-dm.rules"
add_file "/lib/udev/rules.d/13-dm-disk.rules"
add_file "/lib/udev/rules.d/95-dm-notify.rules"
help ()
cat<<HELPEOF
This hook allows for an encrypted root device.
HELPEOF
Since I'd normally take the PKGBUILDs in /core/ as fairly good examples of what the Arch devs consider best practice, it's leaving me with either two conclusions: this is a bug, or I'm missing something. Any input is appreciated. :)

We chroot() and then chdir() to the root directory in every install script executed- so it is no assumption at all.
http://projects.archlinux.org/pacman.gi … aa3e7#n421
Preference would be to omit the leading /, but due to the chroot/chdir combo, both should work.

How to password protect a numbers document

I'm trying to figure out how to password protect a numbers document.
My intention is to load this document onto a website, but only want authorized persons with the correct password to be able to access.
Any ideas??
Thanks

bscaplan wrote:
I am using Numbers 08
And the Numbers User Guide, supplied with iWork '08, make no mention of password protection, which was introduced in Numbers '09.
Looks like the best option is Wayne's second suggestion—open via File > Print > PDF > Open in Preview, then Save the resulting PDF document with encryption turned on.
An alternate, if you want the recipients to receive a copy of the Numbers '08 file, and to be able to edit that file, you could enclose it in a secure disk image file.
The basic procedure is to:
Use Disk Utility to create a new, blank, sparse disk image, assign a password and save.
Double-click the .dmg file (and enter the password when requested) to mount the disk image on your desktop, then Save a copy of your file to the (open) disk image.
When done, eject the image, and upload the (encrypted) .dmg file to the website.
Detailed instructions may be found in Disk Utility's Help files.
Launch DU (found in the Utilities folder in Applications), click the Help menu and choose Disk Utility help.
Go to the index, scroll to and click Security, then click a title similar to "Protecting confidential documents in a secure disk image." (a search on 'confidential' should also take you to a list containing that title.)
My version of DU is old enough that sparse images hadn't been introduced, or I'd post a copy of the article here.
Regards,
Barry

How is best to rip DVDs that I own to my iMac then move them to my iPads so my kids can watch them during a long drive?

How is best to rip DVDs that I own to my new iMac for viewing on my iPads and iPods (for kids during a long drive)? I've read about a lot of options, but I don't find anything that sounds authoritative on what is the ideal way. There is freeware out there and a bunch of paid options. I don't mind paying as long as I know what I'm getting will work. I've asked a few buddies and haven't gotten any straight answers. It seems like everyone has their own way that has its own set of benefits and issues. Any strong opinions out there on what works well (especially for a rookie)?

https://discussions.apple.com/static/apple/tutorial/tou.html
Do not submit software or descriptions of processes that break or otherwise ‘work around’ digital rights management software or hardware. This includes conversations about ‘ripping’ DVDs or working around FairPlay software used on the iTunes Store.
The backing up part isn't illegal, but in order to do this you need to break copy protection..this part is.

How do I protect images from being downloaded in Muse?

When creating a slideshow in Muse, how can I protect the images from being downloaded?

Essentially, you can't.
If something is available online to view, it can also be downloaded and there is little you can do to actually stop it.
There are scripts that you can add to your site to disable "right click > save image" BUT someone who really wants the image can get around this using a variety of ways, including creen caps and looking at your code to determine the source where is image is hosted on your server.
The best that you can do it watermark the images clearly and also imbed data into the image file. It won't stop anyone taking the images, but it clearly tracks the fact that you're the copyright owner. Do take note though, that someone who understands about this, can also remove these bits of data - but your average user wouldn't either know about it, or know how to remove it. This, however is one of the best ways to 'stamp' your ownership to an image.
http://www.ehow.com/how_4578212_information-digital-photos-photoshop-cs.html
http://www.photometadata.org/META-101-metadata-Q-and-A

How do I fix Adobe Reader installation freezing up?

How do I fix Adobe Reader installation freezing up?

Pat,
Thanks for your response. I have Windows 7, 64 bit.
Howard L. Templin
(214) 668-0669 (c)
[email protected]

How to passw protect my pdf files generated by Adobe Acrobat?

I simply want to passw protect my pdf files generated by Adobe Acrobat. However the option as indicated by the helpdesk is not available in my pdf generator. I am working with apple? Can someone tell me how to pass protect my files?
Can some one help me out here?

Hi josr,
You can password protect your files in Adobe Acrobat by choosing File > Properties when you have the PDF open, and clicking the Security tab. Here is a Help topic that goes into detail: Acrobat Help | Securing PDFs with passwords.
If you don't have Acrobat, you're welcome to give it a try! Feel free to download a 30-day trial from http://www.adobe.com/products/acrobat.html.
Best,
Sara

Hi, how do I create a standalone installer for Mountain Lion, ie, download once and then no more broadband required, thanks?

Hi, how do I create a standalone installer for Mountain Lion, ie, download once and then no more broadband required, thanks?
Context is that my other computers are not mobile and I do not have broadband worth troubling for a 4GB download - so will go to Apple Store with MacBook Pro for first download.

The easiest way is to download the installer but do not open it.
Next, make a copy of it and store it where it won't get lost.
Then take one of the copies and place into the applications directory and open it to begin the installer.
This has saved me the trouble of ever having to download the installer twice, plus you can mess around with the installer and try different options without having to worry about not having a clean install file if needed.
Best wishes

How can I protect my air file !

hi to there !
how can I protect my air application ..
such as serial number to activist ..
I need to get a serial number for one if hardware !
is nay solution ?
best.
kiamoz

You can now protect an Air application and apply a secure activation process with AirLicense.
http://www.excelsoftware.com/airlicense.html

What is the best protection against virus

what is best protection against any virus.

what is best protection against any virus.
You.
There will always be threats to your information security associated with using any Internet - connected communications tool:
You can mitigate those threats by following commonsense practices
Delegating that responsibility to software is an ineffective defense
Assuming that any product will protect you from those threats is a hazardous attitude that is likely to result in neglecting point #1 above.
OS X already includes everything it needs to protect itself from viruses and malware. Keep it that way with software updates from Apple.
A much better question is "how should I protect my Mac":
Never install any product that claims to "clean up", "speed up", "optimize", "boost" or "accelerate" your Mac; to "wash" it, "tune" it, or to make it "shiny". Those claims are absurd.Such products are very aggressively marketed. They are all scams.
Never install pirated or "cracked" software, software obtained from dubious websites, or other questionable sources.
Illegally obtained software is almost certain to contain malware.
"Questionable sources" include but are not limited to spontaneously appearing web pages or popups, download hosting sites such as C net dot com, Softonic dot com, Soft pedia dot com, Download dot com, Mac Update dot com, or any other site whose revenue is primarily derived from junk product advertisements.
If you need to install software that isn't available from the Mac App Store, obtain it only from legitimate sources authorized by the software's developer.
Don’t supply your password in response to a popup window requesting it, unless you know what it is and the reason your credentials are required.
Don’t open email attachments from email addresses that you do not recognize, or click links contained in an email:
Most of these are scams that direct you to fraudulent sites that attempt to convince you to disclose personal information.
Such "phishing" attempts are the 21st century equivalent of a social exploit that has existed since the dawn of civilization. Don’t fall for it.
Apple will never ask you to reveal personal information in an email. If you receive an unexpected email from Apple saying your account will be closed unless you take immediate action, just ignore it. If your iCloud, iTunes, or App Store account becomes disabled for valid reasons, you will know when you try to buy something or log in to this support site, and are unable to.
Don’t install browser extensions unless you understand their purpose. Go to the Safari menu > Preferences > Extensions. If you see any extensions that you do not recognize or understand, simply click the Uninstall button and they will be gone.
Don’t install Java unless you are certain that you need it:
Java, a non-Apple product, is a potential vector for malware. If you are required to use Java, be mindful of that possibility.
Java can be disabled in System Preferences.
Despite its name JavaScript is unrelated to Java. No malware can infect your Mac through JavaScript. It’s OK to leave it enabled.
Beware spontaneous popups: Safari menu > Preferences > Security > check "Block popup windows".
Popup windows are useful and required for some websites, but unsolicited popups are commonly used to deceive people into installing unwanted software they would never intentionally install.
Popups themselves cannot infect your Mac, but many contain resource-hungry code that will slow down Internet browsing.
If you ever receive a popup window indicating that your Mac is infected with some ick or that you won some prize, it is 100% fraudulent. Ignore it.
The same goes for a spontaneously appearing dialog insisting that you upgrade your video player right this instant. Such popups are frequently associated with sites that promise to deliver "free" movies or other copyrighted content that is not normally "free".
The more insistent it is that you upgrade or install something, the more likely it is to be a scam. Close the window or tab and forget it.
Ignore hyperventilating popular media outlets that thrive by promoting fear and discord with entertainment products arrogantly presented as "news". Learn what real threats actually exist and how to arm yourself against them:
The most serious threat to your data security is phishing. Most of these attempts are pathetic and are easily recognized, but that hasn't stopped prominent public figures from recently succumbing to this age-old scam.
OS X viruses do not exist, but intentionally malicious or poorly written code, created by either nefarious or inept individuals, is nothing new.
Never install something without first knowing what it is, what it does, how it works, and how to get rid of it when you don’t want it any more.
If you elect to use "anti-virus" software, familiarize yourself with its limitations and potential to cause adverse effects, and apply the principle immediately preceding this one.
Most such utilities will only slow down and destabilize your Mac while they look for viruses that do not exist, conveying no benefit whatsoever - other than to make you "feel good" about security, when you should actually be exercising sound judgment, derived from accurate knowledge, based on verifiable facts.
Do install updates from Apple as they become available. No one knows more about Macs and how to protect them than the company that builds them.
Summary: Use common sense and caution when you use your Mac, just like you would in any social context. There is no product, utility, or magic talisman that can protect you from all the evils of mankind.

How to use Protected event CLICK_ROW_COL of cl_gui_alv_grid.

I've worked with Double_click,Hotspot_click events of Cl_gui_alv grid class quite comfortable as they are Public.
But i'm unable to work with click_row_col..
Could u tell me how to use protected event click_row_col..

Hi Ilayarajaramana
Did you try to build up a subclass of cl_gui_alv_grid and access the protected events via the subclass?
You could e.g. throw an own public event every time the click_row_col event is risen.
I know this isn't the best way, but it should work.
Kind Regards,
Sebastian

What is the best protective case for the iPhone 4s?

What is the best protective case for the iPhone 4s? If I drop my phone I don't want it to crack or break. How protective is the Gorrila Glass?

I am using the Otterbox Defender, and it's a great case.
Gorilla glass is a glass applied to phones (not the iPhone, it does not use Corning branded glass), but the iPhone screen is pretty good against scratches.

How do I protect audio that I put up with iweb?

How do I protect audio that I put up with iweb? I want them to be able to play it but not download it.
Any advice gratefully received!

It's impossible to do with iWeb.
If anyone says otherwise and suggests something like 'use a Flash player - more info on my ad-filled website' they simply don't know any better.
Just remember that whatever you upload to a website can be downloaded by others. The best deterrent is to only play a small portion of the music file and if you want to sell the song then provide the option for the user to purchase the full version. To enable download purchases and assure that the method can not be circumvented requires some rather involved server side scripting. The typical iWeb user that possesses little-to-no knowledge of web coding may find the limited and costly alternative of using a third party service their best method of delivery.

Policies - how to best "protect" an LDAP installation?

Similar Messages

Maybe you are looking for