Security and Prevention for 6500 & 3560's

The following are my 6500 & 3560 layer 2 switch settings.
I need feedback on the settings. Are they good, bad, something missing?
My considerations are (security, STP, and prevention of performance degradation and problems)
Thanks
(please see the attachments)

1282/3728
Hi Raoul,
I don't know why the G5 Dual's Software Update doesn't see it (could it be a cookie thing, or a caches problem?),
anyway,
I certainly would install it on both systems.
Download it from Apple Downloads if you don't get Software Update to work properly.
Axl

Similar Messages

Remote desktop is it secure and encrypted for windows 7 and windows 2008 servers

Remote desktop is it secure and encrypted? any supporting documenting showing if it is secure and encrypted .

Hi,
Yes, RDP is secure and encrypted. RDP uses RSA Security's RC4 cipher, a stream cipher designed to efficiently encrypt small amounts of data. RC4 is designed for secure communications over
networks. Administrators can choose to encrypt data by using a 56- or 128-bit key.
For more details, you can refer to the following:
Standard RDP Security
http://msdn.microsoft.com/en-us/library/cc240771.aspx
Enhanced RDP Security
http://msdn.microsoft.com/en-us/library/cc240795.aspx
Secure RDS (Remote Desktop Services) Connections with SSL
http://technet.microsoft.com/en-us/magazine/ff458357.aspx
Configure Security Settings for Remote Desktop Services Connections
http://technet.microsoft.com/en-us/library/cc753488.aspx
Thanks.
Jeremy Wu
TechNet Community Support

Export all Errors and warnings event logs from Application, security and system for last 24 hours and send it to IT administrators.

Dear Team,
I want a powershell script to export servers event logs into excel and it send that file to IT administrators.
Excel format:
Server Name, Log Name, Time, Source, Event ID and Message.
Require logs:
Application, Security, System, DFS Replication and Directory service.
And these excel file has to be send to Email address.
And it would be good, if i get a script same for Hard disk space and RAM and CPU utilization.

Here are some examples:
http://gallery.technet.microsoft.com/site/search?f%5B0%5D.Type=RootCategory&f%5B0%5D.Value=logs&f%5B0%5D.Text=Logs%20and%20monitoring&f%5B1%5D.Type=SubCategory&f%5B1%5D.Value=eventlogs&f%5B1%5D.Text=Event%20Logs
¯\_(ツ)_/¯

Setting up security and such for wireless router wrt54g without admin rights (work computer)

We are moving, I am in a new location with a new company and my only computer is this one from work. Trying to get my home network setup, I'm locked out of admin rights on this thing and am trying to set up the above router. I thought I had a modem problem at first, but finally I am online wired for now to the cable modem. I would like to get this router up and running, but I can't use the easy setup disk, and I just tried using the easy setup download and it is locked out as well. How can I get my router setup with security, with no admin rights on the pc?
This will be my first wireless router, so I am very green on the specifics and terminology. Any help is most appreciated.
Many thanks,

Thank you toomanydonuts!
I will do this when I get back to the townhouse this evening.
Just so that I am prepared for tonight - I want to confirm and ask a few questions on the "options" and note a couple things I noticed that may help with answers...
Internet connection type - should be easy, I assume there is a "cable modem" option.
SSID - I do not know what this means or what to choose
wireless encryption method (WEP, WPA, WPA2) - Which is best, or is there one I must pick due to computer used and such, I also want to get my Nintendo Wii accessing correctly, I saw these options on that setup, though it didn't work per my first message on the board. I assume whatever encryption method used needs to be chosen for the Wii?
wireless encryption password - I think I can handle this one
A couple of notes -
this laptop has this always on radar looking for wireless connections - how can I name my router so I know it's mine, other than the fact that it is the strongest signal. Maybe that's a network setting?
Thanks again, glad I came here.
Edit: I suppose I should add, just to ensure - in order to do this process through the url provided above, I need to be ethernet wired through the router to the modem? in order to access last night, I was straight into the modem, didn't seem to work wired through the router.
Message Edited by Syxpack on 03-27-2008 05:25 AM

HT5361 Security and password for emails on a shared computer

Security of email accounts on a shred computer mac

Alternatives for Help Resetting Security Questions and/or Rescue Mail
     1. If you have a valid rescue email address, then use this procedure:
         Rescue email address and how to reset Apple ID security questions.
     2. Fill out and submit this form. Select the topic, Account Security. You must
         have a Rescue Email to use this option.
     3. This is the only option if you do not already have a valid Rescue Email.
         These are telephone numbers for contacting Apple Support in your country.
         Apple ID- Contacting Apple for help with Apple ID account security. Select
         the appropriate country and call. Ask to speak to the Account Security Team.
Note: If you have already forgotten your security questions, then you cannot
         set up a rescue email address in order to reset them. You must set up
         the rescue email address beforehand.
Your Apple ID: Manage My Apple ID.
                         Apple ID- All about Apple ID security questions.

HT4098 Wrong purchase for Octane Magazine and request for refund

To whom who may concern,
   Regarding for my recently purchase the "Octane Magazine" subscription, I am wrongly puchased due to there are 2 versions confused to me. As my need should be the " Octane Magazine Interactive" not the "Octane Magazine Replica". Please kindly refund the purchase order which I can resubmit for the correct one. Or please direct transfer my purchase order to the correct one. Also, I found there is price difference.
   For the different version of reader AP, I will suggest the APP company should be write clear and prevent for the confuse status.
   Below is the Purchase Receipe to be your reference.
<Image Edited by Host>

No one from Apple is here. We are fellow iPad user like you.
Try contacting them here:
http://www.apple.com/emea/support/itunes/contact.html

Webservices security and authentication..?

Hi Guys,
Thanks for the previous help. Can anyone suggest a solution/mechanism to
enforce security and authentication for published webservices?
I have situation where an external system (of Business Partner) would
like to request-services of webservices deployed via SOAP XML messaging.
How could i authenticate the system requesting the service is our
business partner system?
Any suggestions welcome,
thanks\
RA

You have two choices:
1. Use HTTP simple ( password based ) authentication. This is
usually called transportation level authentication.
2. Use SOAP signature and time stamp (X509 Certificate based) authentication.
This is called content level authentication.
In both case, you need modify the SOAP client to put in authentication information
and add interceptor in server side to do actually authentication before SOAP router
actually dispatch the calls to the service.
Heyun Zheng
Ramesh Ankam <[email protected]> wrote:
Hi Guys,
Thanks for the previous help. Can anyone suggest a solution/mechanism
to
enforce security and authentication for published webservices?
I have situation where an external system (of Business Partner) would
like to request-services of webservices deployed via SOAP XML messaging.
How could i authenticate the system requesting the service is our
business partner system?
Any suggestions welcome,
thanks\
RA

I've had this iPad computer thing for a few months now. I used to just put in my password when I downloaded an app or such like. Now it wants me to set up 4 further questions and answers "for added security". How can I return to the old system?

I've had this iPad thing for a few months. It used to just ask me for my password, but now it is demanding I set up four questions and answers for
"added security". I don't want to do that, I just want to carry on as I was but the machine is preventing any app downloads etc.
Seems the stupid machine is in control.
How do I get it to listen when I threaten it with a good thrashing and a one way trip to the garbage unless it does what I say?
Thanks

Chick3597 wrote:
Regardless of apple updating something or another. I have no need for the additional questions and really don't want to allow them to bully me into compliance.
You may have no need for additional but Apple does. They don't want your iTunes account to be hacked and then go complaining to them that their security procedures are not up to standards.
Chick3597 wrote:
So how can I continue in the good old fashioned way?
Its really absurd to even ask this in light of the information that you have been given already. The "old fashioned" way is gone. It's Apple's store, Apples's rules and IMO - its a wise decision on Apple's part.
You do not have to comply at all, but you will not be able to purchase from iTunes anymore, but nobody is going to force you to do something that you do not want to do.

Integrated ITS in a Separate App Server (DI) for Security and LoadBalancing

Hi Experts,
I have a specific requirement for ITS Configuration.
1. Production Server ( CI + DB ) -> Existing
[ ERP6.0 ]
OS : Solaris 10
DB : oracle 10.2.0.2
H/W: PRIMEPOWER650
Unicode Enabled
2. Application Server ( DI ) --> to be made ( and to be used exclusively for Web users)
OS : Windows2003 sv
H/W: RX200 S3
x64
MEM: 8GB
No. 1 is existing Production Server Environment.
The Customer Requirement.
The Customer wants to use the ITS . But he doesn't want the existing Production Server to be disturbed for the same for 2 reasons. [ Security and Load Balancing ]
We are planning to create a Separate Application Server (DI) to work as ITS.
As the Kernel is 700. The ITS is integrated into the Production Server by Default.
We have written to SAP and have asked whether the Production Server ITS can be disabled and the Separate DI's ITS be enabled so that the NEW ( No.2 ) Application Server will be used for ITS activities.
SAP has replied saying the Integrated ITS cannot be disabled at the Production Server. Instead as an alternative we can create a Logon Group (using transaction SMLG) and divert all the Web users to the Separated DI (No.2). We have decided to go according to SAP.
Now I have the following questions :
1. The Operating Systems of the Production Server (No.1) and the Separate AP (No. 2)
are different. ( Are there any complexities involved or must do points to be taken care. )
2. Brief / MUST DO tasks at the Production Server Environment and Must do tasks at the DI Environment.
I hope someone has already done some few installations on the above combination, if so, request to please share me your ideas.
Thanks in anticipation
Best Regards,
Paguras
PS :
my earlier discussion on the same topic on this community.
ITS Specific Requirement

Hi Markus,
Thanks for the Reply.
We have the following 2 plans :
Plan-01.
As you have advised, we will try to disable ITS of CI and enable ITS of DI.
Plan-02.
If Plan-01 could be worked out successfully, well implement as per SAP suggests. Creating a Logon Group and divert all the web users to the DI alone.
To deactivate ITS on CI, you have mentioned to make sure, that the system does not listen on the HTTP port (transaction SMICM) on the Servers
BTW, I have seen a parameter called <b>ITSP/ENABLE</b>. if we deactivate this parameter at CI & DB and then activate the same parameter at DI.
My questions to you :
1. Shall we go for Plan-01 ignoring what SAP OSS has said. ?
2. Disable ITSP/Enable Parameter -> CI & DB
Enable ITSP/Enable Parameter -> DI has to be implemented .
Thanks & best Regards,
Paguras
PS: Sorry for always pounding you with so many questions on the same topic.
SAP Help on ITSP / enable parameter
itsp/enable
You use this parameter to deactivate (0) or activate (1) the integrated ITS. Even if the integrated ITS is activated, it only accesses system resources when it is actually used. Nevertheless, it can make sense to deactivate it to prevent users from accessing the SAP system with SAP GUI for HTML via special application servers (such as batch or update instances). Since the conversion of SAP screens into HTML pages uses additional CPU time, it makes sense to reserve a number of dedicated application servers to be used with SAP GUI for HTML and to use a special logon group to balance the load between them.

Hackers - What to look out for and prevention!?

Hi, I was just looking through my logs and such and saw some alot of gobbly gook. It made me nervous. so I was wondering what are the main tips on detecting a Hacker, spotting Hacking attempts and prevention of Hackers?
I understand that I depends on what kit you have and such and that your computer has to make connections with others to use the internet but what do I and every other average Apple user need to look out for in logs on modems, firewalls and applications.
I personaly have looked at my logs on my Netgear Modem and logs on my System Profiler application. I see connections to various things but i'm no good at networking. All I know is to have my firewall on!
Also...I am always nervous when using Bit Torrent, do I have any need to be?
Thanks all ~ Joe
p.s - I have also read in other posts that posting log information is a dumb idea so have played safe and kept them to myself. So there's my tip! :)
PowerBook G4 15" - Sept 04- 1.5 GHz Mac OS X (10.4.2) Power Mac G4 1GHz DP - Airport Extreme - 2MBPS Broadband

It's not always true that an invalid access is an attack. For example, if your firewall application reports that the misused source port is a high port number, it might be a trigger packet. Some ISP may configure the servers system incorrectly or insufficiently. Some organization or a group of companies may send scanning packets to P2P users in a special way in order to improve heavy WAN traffics caused by P2P software users. You might mis-configure your modem or router firewall system or a built-in firewall has a bug, etc.
If a source port number is in the rage between 49152 and 65535, it is normally either dynamic or private ports. Dynamic ports are randomly assigned, and private ports are used by OS software or applications. By seeing any high ports with other logs events, you may guess whether someone attacks your node, about his/her skills/ability and the time zone. You may see one of high ports displaying on Netstat program for Network Utility application when pressing "Display the state of all current socket connections"-- udp4 0 0 localhost.xxxxx. Netstat may help to know who is on networks but not in real time. You need to refresh the button manually.
Here are two basic points:
* It is important to know yourself and think of your computer configurations before you start thinking who is there or your enemy.
* The most important matter in computer security is to be aware, and watch the systems carefully something most people do not do. For example, check if asl.log facility status with the level integer value displays differently from regular bases. If system.log or console.log reports that your computer name and the host name are changed, you may be facing to a serious security situation.
If you want to see whether your ISP blocks ports or you have opened ports, security scan service such as grc.com (Shields UP), dshield.org or seifried.org are available on the Internet.
Mac OS X Tiger built-in firewall (ipfw) has basic features. You can add rule-sets if you want. See for example here. Normally, you do not need to change the default rule-sets that blocks unwanted incoming packets.
Here is how to read about a log example for Mac OS X built-in firewall:
ipfw: 64000 Deny TCP 123.456.78.900:4990 444.555.66.777:1433 in via en1
The ipfw rule-set 64000 denies a Transmission Control Protocol IP packet sent by the source address 123.456.78.900 via the port number 4990 to attempt an invalid access to the destination address 444.555.66.777 targeting to the port 1433 in via your interface "AirPort." The destination address in this case is your local IP address, but not a remote IP address assigned for your ISP (for instance) node. The BSD device name for Built-in Ethernet interface is "en0." "en1" is used for AirPort or the first PCI Ethernet card if you install one.
You see the Mac OS X built-in firewall do not tell you the service name of a misused port number and the host name of the source IP address in real time. Therefore, it may be uncomfortable to analyze the background in details-- especially, if events of the firewall log would be flooded by access attempted every minute or more frequently. You may not even be able to send an e-mail to abuse team who is responsible for the source IP address net block to ask for the investigation if you want to do so. To send an enquiry has two meaning-- suggesting their server vulnerability or insufficient configuration and making a good use of their reply to your analysis.
In this case, an unassigned port number 4990 is misused by someone directly or indirectly (e.g. bot, botarmy, etc.) from the server 123.456.78.900, and the port 1433 for sniffing if a Microsoft SQL Server (Windows related) is running on your machine. There is also known history that some viruses try to exploit vulnerabilities in Microsoft SQL Server. The most known ports being misused in recent days are 8 (ICMP ping) 135, 139, 445 and ports for Trojan Horses and P2P technology driven software such as BitTorrent-- See also this world map, http://isc.sans.org/.
You may think about why bad IP packets pass through your ISP servers especially if servers are configured with a firewall system.
If you want to know more about Transmission Control Protocol specification, find "RFC 793" documentation on the Internet. All assigned port numbers document is available at www.iana.org.
If you are interested in third-party firewall, DoorStop X and Who's There are very good applications. You'll see it when you use their trial version with the full features.
Good firewall applications may protect your computer from various invalid access attempts but not for the real solution. Good packet analyzing (Sniffers) applications may help to inform you a result of analysis but not for the real solution. End-users, ISPs and the authorities need to run to the same direction together.

"securely" use one ethernet interface for WAN and other for the LAN

I am reconfiguring our dual 2.7 Intel Xserve running MacOSXServer 10.5.4, and had a question.
Is it possible (or advisable) to use en0 to perform LAN services, and then configure en1 to only allow access to very limited service. VPN, FTP, CALDAV and later Mail.
I imagine that this is possible via a firewall configuration, but first I do not know how to specify interface in addition to ports, and second I don't know how advisable this would be.
Currently I have a DSL package from ATT with 5 static IP addresses. I have an Airport Extreme set up as one of those addresses providing DHCP and NAT to the LAN. I am using the LAN ports on the back of that to bridge my three switches (2 managed [clients and oce print server 100 base-T] and 1 unmanaged [ laser printers and copier 10 base-T]).
I have the LAN based on 192.168.0.x, with the Xserve at 192.168.0.5. I have DNS configured and working (Thank you Antonio Rocco)
I have 20 LAN clients, 18 mac 1 PC and one PC via Parallels. I will have no more than 1 or 2 WAN clients at any one time
I provide AFP, SMB, Directory Services currently. As part of the reconfigure, I desire to take better advantage of the collaboration tools to provide wikis and CALDAV services. I also want to allow our employees to publish their individual calendars, so that they can subscribe to them at home, or vice versa.
I would like to configure VPN, one for me to access configurations when I am away using Remote Desktop (I have used command line to some extent, but still feel more comfortable with the GUI tools) and second for limited access to content for certain users.
It would also be very helpful for us to have a FTP site. It is unnecessary for this the be a FQDN service, sending the IP address is perfectly acceptable as we only use a service like this 10-15 times a year.
(Related but unimportant in the grand scheme, is there a way to generate a link to the FTP server that you could email that not only is a link, but also a temporary username and password?)
Thank you in advance,
Ion Webster

First, I missed a zero in the network speeds, I have two managed GbE switches that have all of the GbE capable machines connected to them, and an unmanaged GbE switch that has all the 10 or 100Base-T connections. My apologies for the mistake. That was one of the reasons I went with the GbE capable Airport to bridge the switches.
Ok, I had been leaning towards a separate hardware firewall, but here is also where there is a hole in my knowledge. Do I need to look at something like the Linksys RVS4000 which bills itself as a +"4-Port Gigabit Security Router with VPN. Secure, smart Gigabit networking for growing business"+ I would like easy configuration, as I take care of these systems in addition to my job, rather than full time. This will be the first time I have set up a VPN connection, so even though I have spent a lot of time researching the manuals, and reading Schoun Regan (Apple Training Series) I don't have real world experience here. So if I buy more hardware, I want it to be the product that will provide the protection, and also allow me to configure it so that I can get these services running. All my VPN clients are running Macs, most on an AIrport connection and have their IP ranges in the 10.0.1.x range. all but one is on OS 10.5.x so I have a fairly homogeneous set of machines to make work together.
I will review the links you provided regarding static routing, but I do believe the hardware solution is a better one, and wish to pursue it, for all the reasons you give, and that in the brief perusal of the links, it is more than I want to tackle.
As far as FTP vs sFTP, I have no preference. I simply want a way to have online storage for transfer of large files on occasion. Ideally I want a folder, or a series of folders that are accessible for my LAN users to put items in and take them out, and for my (s)FTP users to do the same
So long story short, the hardware solution I would like to purchase, I need to be able to do the following:
VPN connections for content access and ARD access ( knew about and will ensure differing IP ranges)
(s)FTP
Calendar publishing
mail(at a later time)
Thank you for your help thus far.
Ion Webster

When I try to open an .ai/pdf file received through my email, it won't open and asks for a password. I have never set up any kind of password for email security, but have tried typing in my standard passwords. Nothing works. I wonder if it has anything to

When I try to open an .ai/pdf file received through my email, it won't open and asks for a password. I have never set up any kind of password for email security, but have tried typing in my standard passwords. Nothing works. I wonder if it has anything to do with the use of my Wacom3 Tablet...I've been having trouble with it and was getting the same message when trying to open the User's Manual in my Applications/WacomTablet file on my hard drive. Any suggestions? I just downloaded the latest version for the Wacom and recently upgraded to Snow Leopard 10.6.7 (which I hate, and my CS3 hates, etc.)

It sounds like you have a a password-protected PDF. The password was set by the person who encoded it.

After AVG PC Tune up, software update message for security and stability update is available FireFox 3.6.18. Should I Update?

My Dell laptop (Operating on Windows XP) was hit with multiple viruses - I could not open Mozilla Firefox or any other applications for that matter. After much time and many attempts, I was finally able to install and run an AVG Scan and then an AVG PC Tune up. 4,559 problems found and repaired. After the repairs, I received the following message:
"Software Update - A security and stability update for Firefox is available: Firefox 3.6.18 - It is strongly recommended that you apply this update for Firefox as soon as possible. - an underlined link reading, "View more information about this update" and then 2 choices - "Ask Later" or "Update Firefox." Since part of the problem was with Firefox and some error messages pointed to that, I'm hesitant to click on any of the three options above. Can you help me to get past this error message, please. I am sending this from my home computer. Thank you. Diane

Sometimes the updater gets in a funny state - Go to http://www.mozilla.org/en-US/firefox/new/ and download the full installer. Close Firefox and run the installer

I have set up two users, one for myself and one for children. The computer automatically logs in for the children with no password required. When the children go to spotlight and type in a search criteria all of my files show up. How do I prevent this?

I have set up two users, one for myself and one for children. The computer automatically logs in for the children with no password required. When the children go to spotlight and type in a search criteria all of my files show and open up. How do I prevent this?

Log in to your account, and move all your files to your home folder. No other users should be able to access them there and they won't show up with a Spotlight search.
Make sure your kids' account(s) do not have admin privileges.

Creating large scale secure document repository for remote access and a few other Azure questions

Hello Microsoft Community,
Is there a way to put a bunch of documents in Azure storage and present them to an end user via an interface that is either web based or local that will provide security (log in control) to the folders and logging along with allowing access from multiple
sites? I have a large document library of medical records that have been scanned to PDF format that are historical. They moved EMR systems to a new system and the documents I'm talking about are historical access only in case a patient needs historical records
and aren't in the new system. Records staff would need to be able to log into said site, gain access to the files, search by file name and print / copy / save the PDF document so it can be sent to the patient requesting the info.

Shared access signature and stored access policy can be used in this case.
A shared access signature is a URI that grants restricted access rights to containers, blobs, queues, and tables for a specific time interval. By providing
a client with a shared access signature, you can enable them to access resources in your storage account without sharing your account key with them. A stored access policy provides an additional level of control over shared access signatures on the server
side.
For more details, please refer the following links:
Create and Use a Shared Access Signature (http://msdn.microsoft.com/en-us/library/azure/jj721951.aspx)
Use a Stored Access Policy (http://msdn.microsoft.com/en-us/library/azure/ee393341.aspx)

Security and Prevention for 6500 & 3560's

Similar Messages

Maybe you are looking for