[SOLVED] Setting up Mandatory Access Control (MAC)

Hi,
I know it's not the Arch way to ask for instructions but I am very new to Arch and I don't want to screw up the kernel.
From the wiki, I read that Arch has removed Apparmor as well as TOMOYO. I have googled high and low, but I cannot understand why this isn't a security hole. Arch only seems to be using Discretionary Access Control (DAC).
I looked up both Apparmor and TOMOYO in the wiki, but all the instructions pertain to kernels < 3.16, which I'm using.
Linux sim74stic 3.16.3-1-ARCH #1 SMP PREEMPT Wed Sep 17 21:54:13 CEST 2014 x86_64 GNU/Linux
The only options are to either build a custom kernel, which gets complicated for me as I would need to take care of NVIDIA drivers (I have laptop, hence I need to configure with Bumblebee), or to use linux-lts kernel, which is old.
Can anyone tell me if not using MAC is a security loophole, or point me in the right direction on how to install one if it is?
Last edited by prakharsingh95 (2014-10-06 21:27:49)

prakharsingh95 wrote:Can you elaborate on whether MAC is really needed
It's a really tough one as to whether MAC is really needed or not, and it's not something I really know that well
prakharsingh95 wrote:or is Arch secure enough (regular desktop usage) without it? If I can get away without it, I would rather stay away and enjoy my Arch installation, but I don't want to leave my PC unsecured either.
Any operating system is secure for regular day-to-day use, as long as you're careful (firewall, not clicking unknown links without research first etc). This includes Windows.
For both of your above questions, it depends on what your environment you're in. Because I'm surrounded by Ethical Hackers as part of what I do, I should really switch over to a hardened kernel, but I will also have to go to the trouble of configuring the user-space tools for it to be useful. That last sentence is important, because if you have SELinux compiled in, but not configured, you might as well not have it there.
prakharsingh95 wrote: Do I simply install this (linux-pax) from the AUR and it will automatically patch my kernel keeping my current modules or should I (can I?) modify the PKGBUILD for NVIDIA, Xorg and additionally add Apparmor?
Whilst the PKGBUILDs for linux-pax and linux from [core] look similar, they produce different packages with different results. As a result, you'll have to compile the nVidia modules for it. That's true for any (patched) kernel, be it CK, BFS, PaX, CK-PaX, TRESOR, etc.
If you're not up to writing your the modules, there's the nvidia-dkms package, which should be able to compile the nVidia modules for your system.
prakharsingh95 wrote:If it's that simple, can I simply get linux-selinux from the AUR and it will get me up and running with 3.14 + my modules + SELinux?
On paper, it is that simple, as long as you know how to build the modules you need. I'd use nvidia-dkms, but it's up to you on how you do this.
This is an example guide outlining the steps you could take to installing linux-selinux.
Last edited by clfarron4 (2014-10-06 13:42:43)

Similar Messages

How do I set up timed access control for a time past midnight

I would like to set up timed access control for a number of my devices that would stretch past midnight... An open network from 6AM to 2AM - effectively only blocking access from 2AM tp 6AM in the morning....
Any notion on how to do this? the timed factily does not like the setting to enable 6A to 2A, says the times are invalid.
Setting up timed access from 6AM to 11:59P, then doing another from 12A to 2A causes a service "hiccup" of 1 Minute.

Set up each device as follows:
Everyday........Between.......6:00 AM and 11:59 PM
Add a second rule for each device that will state....
Everyday.....Between.......12:00 AM and 2:00 AM
You might think that there would be a one minute break between 11:59 PM and 12:00 AM, but that will not be the case, at least on every AirPort that I have ever programmed.. Reason.....11:59 is really 11:59:59:59 turning off at 12:00 AM. But, you have a second rule to allow access at 12:00 AM, so the AirPort will be "on" at the same time the first rule ends, so there will be no break.
If you really want the second rule to turn the AirPort "off" at 2:00 AM.......then set that time for 1:59 AM. If you set the rule for 2:00 AM, then AirPort will really turn off at 2:01 AM.

Set up Remote Access for Mac Mini

I recently bought a Mac Mini and set it up at home. It is running on Mac OS X 10.8.3, and runs on Server 2.2.1 and Airport Utilities 6.2. I would like to be able to access the Mac Mini server from outside my home. Does anyone know the procedure of setting up remote access (through SSH or VPN) without creating an internet domain name? Thanks!
I'm quite new to many of the Apple products, so it would be good if the answers are clearer and more detailed. Thanks!

As Barney-15E says, Back-to-My-Mac is the best option.
After that, try TeamViewer.com
ssh can be done, but there are setup details with respect to your home router to allow port 22 from the Internet side to your Mac mini <http://portforward.com>. And then you will need a dynamic DNS name from someone like No-IP.com or DynDNS.org so you can find your home router. Once you have that setup, you should make sure you use a good strong password, as you have now exposed a known port to the internet <http://xkcd.com/936/> and <https://www.grc.com/haystack.htm>. Don't forget to enable System Preferences -> Sharing -> Remote Login. So now you can ssh, but what do you want to do with that? You can create ssh tunnels for VNC screen sharing and AFP file sharing.
ssh -L 22590:localhost:5900 -L 22548:localhost:548 [email protected]
Now you have logged in and you have 2 tunnels. How to use them.
Finder -> Go -> Connect to server -> vnc://localhost:22590
Finder -> Go -> Connect to server -> afp://localhost:22548
Back-to-My-Mac and/or TeamViewer.com are easier

Can I set up Internet access for Mac book air

I am able to set up wireless for my Mac book air but I am looking to set up internet (same as I have with my iPad). Is it possible?

Have you got Home Sharing set up (http://support.apple.com/kb/HT3819) ? i.e. he may be viewing the content from your computer, not on the actual iPad. If that is the case (which would explain to me him being able to access the videos via the iPod app), then the Restrictions settings that I've already mentioned should also work on that 'remote' content.
Edit : your last reply appeared whilst I was typing/checking this. And no, the Videos/iPod apps can't be passcode protected, you will need to go back into Restrictions and remove the restriction, or if the films are only on your computer and not on the iPad itself you could turn off home sharing on the iPad whilst he's playing the games : Settings > iPod and tap on your account id and/or password on the right under Home Sharing and delete it/ them (re-enter them when you want to re-enable it).
Message was edited by: King_Penguin

Security advice on mandatory access control

Hi,
i'm trying to optimize my arch setup and also want to improve my security so i came across the MAC-stuff and would like to hear your oppinion.
My usercase is normal browsing/coding/multimedia stuff so nothing so special.
I try to maintain my system with care and and only install/run stuff i really need and trust somehow.
Now reading the wiki i found articles about these MAC-solutions, but i couldn't figure out how much these could improve my system considering the fact,
i have to somehow configure all the stuff more or less. - Is it really worth dealing with them as a normal user and if yes, which one?
Unfortunately neither the wiki nor google helped me with general recommendations so i put my hope in your experiences
Greetings
Knusperkeks

I can only talk about tomoyo because I'm not familiar with other mac systems. My reason for choosing it was that everything needed was already on the repos.
brebs wrote:AppArmor files use a convenient BASH-like syntax, and can have common requirements grouped for easy specification.
Tomoyo's syntax can be a little tricky since it requires a good amount of escaping and it can get tiresome after a while so I guess apparmor might be easier in that regard. Tomoyo does allow you to make permission groups that you can use how many times you want, or you can specify it as global permissions, it all depends on how common certain things are.
I don't know about apparmor but tomoyo allows you to get into the nitty gritty details of what each program can do, up to the point where it can get tiresome. I didn't elaborate much on it in my last post because I don't want to discourage anyone from trying it or any other mac system.
With tomoyo you can specify if a program is allowed to read/write/unlink/truncate/rename files, mkdir/rmdir directories, which chmod values it can use, which values it can use with chown, if you allow it to use tcp/udp/unix sockets, which ioclts it can use, just to name a few common things that will show up in policy files.
Tomoyo can learn all this by recording what a program accesses, then you want to use an utility (tomoyo-patternize) to reduce the amount of rules. Many things can be reduced to a simple rule (image access to a program's config directory). This is where the trouble starts because the config file tomoyo-patternize uses is very bare. You will also find that you may need to take into account not only the program itself but also the toolkit it uses and other things like fontconfig.
One problem that might be common to both tomoyo and apparmor is that if a program's behavior changes slightly, then things will break in subtle ways and you will only find out when you are short on time and really need things to work, unless you are more lax where you allow programs to have free reign, and then you may be leaving some security whole open.
I'm not using tomoyo now but it can be a nice tool to use when you want to find out what a program is doing. Like I said in my previous post, pick the low hanging fruit first, there are other things that can be set and almost forgotten and will not break anything, then give mac a try and be sure to check regularly if you have to update the security policy.

Access Control MAC address by Radius doesn't work

Hi,
How I can try if my Airport TimeCapsule can ping to my windows 2008 server with Radius?
I snnifed the lan on Radius server and I only saw the broadcast messages of the airport.
I have wpa personal with mac addres filter by radius, but doesn't works and I can access with any pc without check de mac.
Anyone can help me please?
Regards!!

I am not so familiar with setup of wireless with Radius.. The Apple routers are not enterprise class but very much domestic.. so the enterprise level login seems to be problematic.
Give us a couple of screenshots of the setup and that might help determine the issue.
There is some info with help on setting it up here.
Multiple airport Extremes and RADIUS
Using windows server will of course make life that much harder.

After trying to set up access control, my Airport Utility is no longer able to find my Base Station. My PC still sees my wireless network but I can't connect to it.

A friend told me he was able to access my network from a different device with no password so I decided to set up an access control. Following the prompts, I entered my IP address, and then my Airport stopped working. I tried uninstalling it and reinstalling it, but got the same thing. The screen I get is that "Airport Utility was unable to find any Airport wireless devices", and askes me if I want to rescan. When I rescan I get the same message. My Airport light is green and my PC recognizes the network, my software just can't connect to it. A friend suggested I entered the wrong IP address (which I found on my computer under "connections", but even after I tried a different one which is supposed to be from the network, I still get the same error message. What am I doing wrong?

A friend told me he was able to access my network from a different device with no password so I decided to set up an access control.
This could be bullsh!t on your friend's part perhaps? Do you ever recall seeing a blue-light on the base station?
Following the prompts, I entered my IP address, and then my Airport stopped working.
The acces control list is where you put in your Mac Address, this is not the same thing as an IP.

[Solved] Apache user dir access forbidded

I am getting Access forbidden! when I am trying to connect to http://localhost/~simha/ where simha is my user name
my /var/log/httpd/error_log says
[Thu Jul 08 17:44:30 2010] [error] [client 127.0.0.1] (13)Permission denied: access to /~simha/ denied
I tried a lot and gave up. Can any one help me in this in regard
The following are the permisions of my home dir simha and public_html
drwx--x--x 130 simha users 16384 Jul 8 17:04 simha
drwxr-xr-x 2 simha users 4096 Jul 8 17:02 public_html
The following are my httpd.conf
# This is the main Apache HTTP server configuration file. It contains the
# configuration directives that give the server its instructions.
# See <URL:http://httpd.apache.org/docs/2.2> for detailed information.
# In particular, see
# <URL:http://httpd.apache.org/docs/2.2/mod/directives.html>
# for a discussion of each configuration directive.
# Do NOT simply read the instructions in here without understanding
# what they do. They're here only as hints or reminders. If you are unsure
# consult the online docs. You have been warned.
# Configuration and logfile names: If the filenames you specify for many
# of the server's control files begin with "/" (or "drive:/" for Win32), the
# server will use that explicit path. If the filenames do *not* begin
# with "/", the value of ServerRoot is prepended -- so "/var/log/httpd/foo_log"
# with ServerRoot set to "/etc/httpd" will be interpreted by the
# server as "/etc/httpd//var/log/httpd/foo_log".
# ServerRoot: The top of the directory tree under which the server's
# configuration, error, and log files are kept.
# Do not add a slash at the end of the directory path. If you point
# ServerRoot at a non-local disk, be sure to point the LockFile directive
# at a local disk. If you wish to share the same ServerRoot for multiple
# httpd daemons, you will need to change at least LockFile and PidFile.
ServerRoot "/etc/httpd"
# Listen: Allows you to bind Apache to specific IP addresses and/or
# ports, instead of the default. See also the <VirtualHost>
# directive.
# Change this to Listen on specific IP addresses as shown below to
# prevent Apache from glomming onto all bound IP addresses.
#Listen 12.34.56.78:80
Listen 80
# Dynamic Shared Object (DSO) Support
# To be able to use the functionality of a module which was built as a DSO you
# have to place corresponding `LoadModule' lines at this location so the
# directives contained in it are actually available _before_ they are used.
# Statically compiled modules (those listed by `httpd -l') do not need
# to be loaded here.
# Example:
# LoadModule foo_module modules/mod_foo.so
LoadModule authn_file_module modules/mod_authn_file.so
LoadModule authn_dbm_module modules/mod_authn_dbm.so
LoadModule authn_anon_module modules/mod_authn_anon.so
LoadModule authn_dbd_module modules/mod_authn_dbd.so
LoadModule authn_default_module modules/mod_authn_default.so
LoadModule authz_host_module modules/mod_authz_host.so
LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
LoadModule authz_user_module modules/mod_authz_user.so
LoadModule authz_dbm_module modules/mod_authz_dbm.so
LoadModule authz_owner_module modules/mod_authz_owner.so
LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
LoadModule authz_default_module modules/mod_authz_default.so
LoadModule auth_basic_module modules/mod_auth_basic.so
LoadModule auth_digest_module modules/mod_auth_digest.so
LoadModule file_cache_module modules/mod_file_cache.so
LoadModule cache_module modules/mod_cache.so
LoadModule disk_cache_module modules/mod_disk_cache.so
LoadModule mem_cache_module modules/mod_mem_cache.so
LoadModule dbd_module modules/mod_dbd.so
LoadModule dumpio_module modules/mod_dumpio.so
LoadModule ext_filter_module modules/mod_ext_filter.so
LoadModule include_module modules/mod_include.so
LoadModule filter_module modules/mod_filter.so
LoadModule substitute_module modules/mod_substitute.so
LoadModule deflate_module modules/mod_deflate.so
LoadModule ldap_module modules/mod_ldap.so
LoadModule log_config_module modules/mod_log_config.so
LoadModule log_forensic_module modules/mod_log_forensic.so
LoadModule logio_module modules/mod_logio.so
LoadModule env_module modules/mod_env.so
LoadModule mime_magic_module modules/mod_mime_magic.so
LoadModule cern_meta_module modules/mod_cern_meta.so
LoadModule expires_module modules/mod_expires.so
LoadModule headers_module modules/mod_headers.so
LoadModule ident_module modules/mod_ident.so
LoadModule usertrack_module modules/mod_usertrack.so
#LoadModule unique_id_module modules/mod_unique_id.so
LoadModule setenvif_module modules/mod_setenvif.so
LoadModule version_module modules/mod_version.so
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_connect_module modules/mod_proxy_connect.so
LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
LoadModule ssl_module modules/mod_ssl.so
LoadModule mime_module modules/mod_mime.so
LoadModule dav_module modules/mod_dav.so
LoadModule status_module modules/mod_status.so
LoadModule autoindex_module modules/mod_autoindex.so
LoadModule asis_module modules/mod_asis.so
LoadModule info_module modules/mod_info.so
LoadModule suexec_module modules/mod_suexec.so
LoadModule cgi_module modules/mod_cgi.so
LoadModule cgid_module modules/mod_cgid.so
LoadModule dav_fs_module modules/mod_dav_fs.so
LoadModule vhost_alias_module modules/mod_vhost_alias.so
LoadModule negotiation_module modules/mod_negotiation.so
LoadModule dir_module modules/mod_dir.so
LoadModule imagemap_module modules/mod_imagemap.so
LoadModule actions_module modules/mod_actions.so
LoadModule speling_module modules/mod_speling.so
LoadModule userdir_module modules/mod_userdir.so
LoadModule alias_module modules/mod_alias.so
LoadModule rewrite_module modules/mod_rewrite.so
LoadModule php5_module modules/libphp5.so
<IfModule !mpm_netware_module>
<IfModule !mpm_winnt_module>
# If you wish httpd to run as a different user or group, you must run
# httpd as root initially and it will switch.
# User/Group: The name (or #number) of the user/group to run httpd as.
# It is usually good practice to create a dedicated user and group for
# running httpd, as with most system services.
User http
Group http
</IfModule>
</IfModule>
# 'Main' server configuration
# The directives in this section set up the values used by the 'main'
# server, which responds to any requests that aren't handled by a
# <VirtualHost> definition. These values also provide defaults for
# any <VirtualHost> containers you may define later in the file.
# All of these directives may appear inside <VirtualHost> containers,
# in which case these default settings will be overridden for the
# virtual host being defined.
# ServerAdmin: Your address, where problems with the server should be
# e-mailed. This address appears on some server-generated pages, such
# as error documents. e.g. [email protected]
ServerAdmin [email protected]
# ServerName gives the name and port that the server uses to identify itself.
# This can often be determined automatically, but we recommend you specify
# it explicitly to prevent problems during startup.
# If your host doesn't have a registered DNS name, enter its IP address here.
#ServerName www.example.com:80
# DocumentRoot: The directory out of which you will serve your
# documents. By default, all requests are taken from this directory, but
# symbolic links and aliases may be used to point to other locations.
DocumentRoot "/srv/http"
# Each directory to which Apache has access can be configured with respect
# to which services and features are allowed and/or disabled in that
# directory (and its subdirectories).
# First, we configure the "default" to be a very restrictive set of
# features.
<Directory />
Options FollowSymLinks
AllowOverride None
Order deny,allow
Deny from all
</Directory>
# Note that from this point forward you must specifically allow
# particular features to be enabled - so if something's not working as
# you might expect, make sure that you have specifically enabled it
# below.
# This should be changed to whatever you set DocumentRoot to.
<Directory "/srv/http">
# Possible values for the Options directive are "None", "All",
# or any combination of:
# Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
# Note that "MultiViews" must be named *explicitly* --- "Options All"
# doesn't give it to you.
# The Options directive is both complicated and important. Please see
# http://httpd.apache.org/docs/2.2/mod/core.html#options
# for more information.
Options Indexes FollowSymLinks includes
# AllowOverride controls what directives may be placed in .htaccess files.
# It can be "All", "None", or any combination of the keywords:
# Options FileInfo AuthConfig Limit
AllowOverride None
# Controls who can get stuff from this server.
Order allow,deny
Allow from all
</Directory>
# DirectoryIndex: sets the file that Apache will serve if a directory
# is requested.
<IfModule dir_module>
DirectoryIndex index.html
</IfModule>
# The following lines prevent .htaccess and .htpasswd files from being
# viewed by Web clients.
<FilesMatch "^\.ht">
Order allow,deny
Deny from all
Satisfy All
</FilesMatch>
# ErrorLog: The location of the error log file.
# If you do not specify an ErrorLog directive within a <VirtualHost>
# container, error messages relating to that virtual host will be
# logged here. If you *do* define an error logfile for a <VirtualHost>
# container, that host's errors will be logged there and not here.
ErrorLog "/var/log/httpd/error_log"
# LogLevel: Control the number of messages logged to the error_log.
# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
LogLevel warn
<IfModule log_config_module>
# The following directives define some format nicknames for use with
# a CustomLog directive (see below).
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %b" common
<IfModule logio_module>
# You need to enable mod_logio.c to use %I and %O
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
</IfModule>
# The location and format of the access logfile (Common Logfile Format).
# If you do not define any access logfiles within a <VirtualHost>
# container, they will be logged here. Contrariwise, if you *do*
# define per-<VirtualHost> access logfiles, transactions will be
# logged therein and *not* in this file.
CustomLog "/var/log/httpd/access_log" common
# If you prefer a logfile with access, agent, and referer information
# (Combined Logfile Format) you can use the following directive.
#CustomLog "/var/log/httpd/access_log" combined
</IfModule>
<IfModule alias_module>
# Redirect: Allows you to tell clients about documents that used to
# exist in your server's namespace, but do not anymore. The client
# will make a new request for the document at its new location.
# Example:
# Redirect permanent /foo http://www.example.com/bar
# Alias: Maps web paths into filesystem paths and is used to
# access content that does not live under the DocumentRoot.
# Example:
# Alias /webpath /full/filesystem/path
# If you include a trailing / on /webpath then the server will
# require it to be present in the URL. You will also likely
# need to provide a <Directory> section to allow access to
# the filesystem path.
# ScriptAlias: This controls which directories contain server scripts.
# ScriptAliases are essentially the same as Aliases, except that
# documents in the target directory are treated as applications and
# run by the server when requested rather than as documents sent to the
# client. The same rules about trailing "/" apply to ScriptAlias
# directives as to Alias.
ScriptAlias /cgi-bin/ "/srv/http/cgi-bin/"
</IfModule>
<IfModule cgid_module>
# ScriptSock: On threaded servers, designate the path to the UNIX
# socket used to communicate with the CGI daemon of mod_cgid.
#Scriptsock /var/run/httpd/cgisock
</IfModule>
# "/srv/http/cgi-bin" should be changed to whatever your ScriptAliased
# CGI directory exists, if you have that configured.
<Directory "/srv/http/cgi-bin">
AllowOverride None
Options None
Order allow,deny
Allow from all
</Directory>
# DefaultType: the default MIME type the server will use for a document
# if it cannot otherwise determine one, such as from filename extensions.
# If your server contains mostly text or HTML documents, "text/plain" is
# a good value. If most of your content is binary, such as applications
# or images, you may want to use "application/octet-stream" instead to
# keep browsers from trying to display binary files as though they are
# text.
DefaultType text/plain
<IfModule mime_module>
# TypesConfig points to the file containing the list of mappings from
# filename extension to MIME-type.
TypesConfig conf/mime.types
# AddType allows you to add to or override the MIME configuration
# file specified in TypesConfig for specific file types.
#AddType application/x-gzip .tgz
# AddEncoding allows you to have certain browsers uncompress
# information on the fly. Note: Not all browsers support this.
#AddEncoding x-compress .Z
#AddEncoding x-gzip .gz .tgz
# If the AddEncoding directives above are commented-out, then you
# probably should define those extensions to indicate media types:
AddType application/x-compress .Z
AddType application/x-gzip .gz .tgz
# AddHandler allows you to map certain file extensions to "handlers":
# actions unrelated to filetype. These can be either built into the server
# or added with the Action directive (see below)
# To use CGI scripts outside of ScriptAliased directories:
# (You will also need to add "ExecCGI" to the "Options" directive.)
#AddHandler cgi-script .cgi
# For type maps (negotiated resources):
#AddHandler type-map var
# Filters allow you to process content before it is sent to the client.
# To parse .shtml files for server-side includes (SSI):
# (You will also need to add "Includes" to the "Options" directive.)
#AddType text/html .shtml
#AddOutputFilter INCLUDES .shtml
</IfModule>
# The mod_mime_magic module allows the server to use various hints from the
# contents of the file itself to determine its type. The MIMEMagicFile
# directive tells the module where the hint definitions are located.
#MIMEMagicFile conf/magic
# Customizable error responses come in three flavors:
# 1) plain text 2) local redirects 3) external redirects
# Some examples:
#ErrorDocument 500 "The server made a boo boo."
#ErrorDocument 404 /missing.html
#ErrorDocument 404 "/cgi-bin/missing_handler.pl"
#ErrorDocument 402 http://www.example.com/subscription_info.html
# EnableMMAP and EnableSendfile: On systems that support it,
# memory-mapping or the sendfile syscall is used to deliver
# files. This usually improves server performance, but must
# be turned off when serving from networked-mounted
# filesystems or if support for these functions is otherwise
# broken on your system.
#EnableMMAP off
#EnableSendfile off
# Supplemental configuration
# The configuration files in the conf/extra/ directory can be
# included to add extra features or to modify the default configuration of
# the server, or you may simply copy their contents here and change as
# necessary.
# Server-pool management (MPM specific)
#Include conf/extra/httpd-mpm.conf
# Multi-language error messages
Include conf/extra/httpd-multilang-errordoc.conf
# Fancy directory listings
Include conf/extra/httpd-autoindex.conf
# Language settings
Include conf/extra/httpd-languages.conf
# User home directories
Include conf/extra/httpd-userdir.conf
# Real-time info on requests and configuration
#Include conf/extra/httpd-info.conf
# Virtual hosts
#Include conf/extra/httpd-vhosts.conf
# Local access to the Apache HTTP Server Manual
#Include conf/extra/httpd-manual.conf
# Distributed authoring and versioning (WebDAV)
#Include conf/extra/httpd-dav.conf
# phpMyAdmin configuration
Include conf/extra/httpd-phpmyadmin.conf
# Various default settings
Include conf/extra/httpd-default.conf
# Secure (SSL/TLS) connections
#Include conf/extra/httpd-ssl.conf
Include conf/extra/php5_module.conf
# Note: The following must must be present to support
# starting without SSL on platforms with no /dev/random equivalent
# but a statically compiled-in mod_ssl.
<IfModule ssl_module>
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
</IfModule>
The following are my /etc/httpd/conf/extra/httpd-userdir.conf
# Settings for user home directories
# Required module: mod_userdir
# UserDir: The name of the directory that is appended onto a user's home
# directory if a ~user request is received. Note that you must also set
# the default access control for these directories, as in the example below.
UserDir public_html
# Control access to UserDir directories. The following is an example
# for a site where these directories are restricted to read-only.
<Directory /home/*/public_html>
AllowOverride FileInfo AuthConfig Limit Indexes
Options MultiViews Indexes SymLinksIfOwnerMatch ExecCGI
<Limit GET POST OPTIONS PROPFIND>
Order allow,deny
Allow from all
</Limit>
<LimitExcept GET POST OPTIONS PROPFIND>
Order deny,allow
Deny from all
</LimitExcept>
</Directory>
I also tried adding user to the group http. BUt nothing is working.
Last edited by sant527 (2010-07-12 04:23:51)

I finally found the solution.
http://ubuntuforums.org/showthread.php?t=1476965&page=1
I found that even my /home directory permisions also to be changed to by chmod 711
the following shoul be final permissions for the directories of /home /home/user and public_html to work
$ ls -ld /home ~ public_html
drwx--x--x 3 root users 4096 Nov 1 2009 /home
drwx--x--x 130 simha users 16384 Jul 12 09:33 /home/simha
drwxr-xr-x 2 simha users 4096 Jul 8 17:02 public_html
I think in the wiki of LAMP should also mention of changing the permission of /home directory.
$ chmod o+x ~
$ chmod o+x ~/public_html
additionally
$sudo chmod o+x /home

What is better for security? WPA2 or Access control

I have a Airport express and 2 computers; a Mac and a PC.
When it come to securing your wi-fi connection so you don't get unauthorized clients on your network.
What is better
A- Just using encryption like WPA2 or some other password based system or
B- Just entering the "Airport ID" (MAC) of the computers I want to authorize in my network on the Access control panel.
Seems to me like the later is easier on the clients since they don't need a password or anything, It's completely transparent for the client. And I believe encryption slows down the connection a bit and create overhead for the computer. But maybe I don't have the full picture of the situation.
Is there anybody who can illuminated this subject for me?
thanks
PowerBookG4 Mac OS X (10.3.9)

WPA2 is virtually uncrackable only really vulnerable if you use a real word as a password.
When using access control, MAC addresses are sent unecrypted can be read and spoofed and therefore do not add any security.
Unfortunately "Closed" networks, MAC access control lists, and reduction in transmission power are all more "feel good" security rather than real security. All these various approaches are dated and mistakenly lead to overconfidence.
WPA is your friend if you value wireless security.

Internet Access Control

Hi.
Is it possible to keep track of the quantity of internet content received(in bytes) on a client machine?
How does the proxy server allow or disallow internet access to a subset of clients (or one client) in the LAN to which it is connected.
Thanks

miraglia wrote:
I am using Network Magic version 5.5.9195.0-Pure0, platform version 11.2.9195.1 on a couple of Windows 7 laptops and I am finding when I set the Internet Access Control to "Prevent" that some websites like the www.yahoo.com and www.google.com can be still be accessed. I thought "Prevent" was supposed to completely turn off internet access? I also have BitDefender installed on these laptops for anti-virus and firewall and it includes parental controls, also, which I currently have set to always on for internet. Is BitDefender conflicting with Network Magic? Is there a way to get them to work together? I want to be able to turn off the internet so my kids can't get on whenever they want to. Thanks.
This won’t work anymore since HND is obsolete and I believed it is not actively maintained anymore. http://homecommunity.cisco.com/t5/Home-Network-Defender/Is-Home-Network-Defender-still-supported/td-...

After time capsule 7.6 Firmware upgrade I can't set up Access Control / Timed Access using mac adresses.

After time capsule 7.6 Firmware upgrade I can't set up Access Control / Timed Access using mac adresses.
I have a Time Capsule and an Airport express and when I change access control parameters on whatever one of those
two devices through Airport Utility its duplicating the same setup on the other device !
What a mess !
I had to choose "Not Enabled" in the Access Control stup window.
Has anyone experienced same problem ?
Jean.

I did downgraded firmware to 7.5.2 ...
and the Acess Control Setting from Airport Utility is back to normal behaviour.
Jean.

Require MAC (Media Access Control) address for my ...

Hi
I recently bought the Nokia C6.
I want to connect to my WiFi network in my office.
My network administrator require the MAC (Media Access Control) address of my set to give me access to the network.
How can I find this address for my set?
Solved!
Go to Solution.

On home screen:
Open the number keypad (button in the middle in bottom row) and then dial *#62209526# (equals *#MAC0WLAN#) => Device will show your WLAN MAC address.

Setting up remote access from PC to Mac using DynDNS

Hi Guys,
I'm hoping someone can help out, I'm quite desperate here.
I am about to head overseas for three weeks, and need to leave my Mac running, so that I can log into it remotely using a PC. My Mac, is a MacBook Pro, and the PC I will be using is an Asus EEE PC. I will need to do simple things like grab files, open PDFs and run a few applications from time to time on the Mac.
I have a billion 7404VGP router that my Mac will be plugged into, using an ADSL connection. I have a dynamic IP address so I have setup a DynDNS account.
I have read countless tutorials, and posted to a few different sites, but I can not get any consistency in responses or guidance on how to set this up properly. It's killing me.
Am I correct in understanding that VNC is the best method to do this? I'm being told that I also need to open all sorts of ports on the router. Some say I need to 'SSH', others say I need to 'VPN'. I'm quite technically literate but I'm lost in all the protocols and variations people are saying I need to use.
So far, I have setup the following:
*On the Mac:*
- Enabled 'Screen Sharing' in OS X System Preferences > Screen Sharing
- Specified a password for 'VNC viewers may control the screen' within Screen Sharing settings
- Setup a DynDNS account, and created a custom name (ie myname.dyndns.org)
*On the Billion Router*
- Setup the DynDNS configuration so that when the IP address changes it tells the server
- Under Virtual Server, I have added a port forwarding entry as follows:
Schedule: Always On
Application: DynDNS
Protocol: TCP
External Port: 80 to 80
Redirect Port 80 to 80
Internal IP Address: This is where I think I need guidance. I have to select the IP associated with my MAC address, so the IP is 192.168.1.4.
This is as far as I have gotten. I have installed a VNC viewer on the PC, and tried to login using the IP address that shows up in my DynDNS account, but nothing is working.
What am I doing wrong? Can somebody kindly explain (or direct me to), a straight english step by step process of how I can get this going? Any guidance is appreciate it.
Thanks so much.

I am about to head overseas for three weeks, and need to leave my Mac running, so that I can log into it remotely using a PC. My Mac, is a MacBook Pro, and the PC I will be using is an Asus EEE PC. I will need to do simple things like grab files, open PDFs and run a few applications from time to time on the Mac.
The grabbing of files is going to complicate things a little bit, as now you want 2 things, not just one.
I have a billion 7404VGP router that my Mac will be plugged into, using an ADSL connection. I have a dynamic IP address so I have setup a DynDNS account.
I have read countless tutorials, and posted to a few different sites, but I can not get any consistency in responses or guidance on how to set this up properly. It's killing me.
Am I correct in understanding that VNC is the best method to do this? I'm being told that I also need to open all sorts of ports on the router. Some say I need to 'SSH', others say I need to 'VPN'. I'm quite technically literate but I'm lost in all the protocols and variations people are saying I need to use.
VNC is a way to control the Mac remotely. But grabbing files will require something else, which is most likely why you got some suggestions for ssh, and/or VPN.
I'm going to suggest TeamViewer Screen Sharing and File Transfer utility (free for personal use).
<http://teamviewer.com/index.aspx>
The advantage of TeamView is that you can both control the screen and you can grab files all in one package.
Just make sure you fully test your setup before leaving.
However, if you want to pursue VNC, I'll add comments below.
So far, I have setup the following:
*On the Mac:*
- Enabled 'Screen Sharing' in OS X System Preferences > Screen Sharing
- Specified a password for 'VNC viewers may control the screen' within Screen Sharing settings
This should be a strong password.
- Setup a DynDNS account, and created a custom name (ie myname.dyndns.org)
So far so good
*On the Billion Router*
- Setup the DynDNS configuration so that when the IP address changes it tells the server
- Under Virtual Server, I have added a port forwarding entry as follows:
Schedule: Always On
Application: DynDNS
Protocol: TCP
External Port: 80 to 80
Redirect Port 80 to 80
Internal IP Address: This is where I think I need guidance. I have to select the IP associated with my MAC address, so the IP is 192.168.1.4.
The port numbers are wrong. Port 80 is for a web server. VNC uses port 5900.
Did you have to manually enter that IP address when you setup the port forwarding? Or does the router have some way of locking into your Mac?
I ask, because of your Mac's IP address is assigned via DHCP, then it is possible the router could change the address it gives to the Mac on a power failure restart, but the port forwarding might be locked into 192.168.1.4.
So if the router needs to have a stable IP address for port forwarding, then you might want to configure the Mac with a fixed IP address (preferably one outside of the routers DHCP assignment range), then use that fixed IP address with port forwarding (always test any configuration change such as this).
Oh yea, you are configuring your Mac to automatically reboot when power is restored (System Preferences -> Energy Saver -> Options -> Restart automatically after power failure
This is as far as I have gotten. I have installed a VNC viewer on the PC, and tried to login using the IP address that shows up in my DynDNS account, but nothing is working.
As mentioned, you need to forward port 5900 for VNC.
What am I doing wrong? Can somebody kindly explain (or direct me to), a straight english step by step process of how I can get this going? Any guidance is appreciate it.
Port forwarding port 5900 should do the trick.
However, at this point you only have screen sharing. You can do stuff to your Mac, but you can not transfer files via this connection.
This is where suggestions for ssh come in (or you could go back to my TeamViewer idea ).
Ssh can offer remote terminal login (PuTTY is a very good Windows Terminal emulator). Ssh can also offer scp (ssh cp) and sftp (ssh ftp) services, both of which can be used to transfer files to and from the Mac securely over the internet.
The easiest PC/Mac file transfer while traveling, would be to find a good Windows sftp GUI application. There are a bunch of them for the Mac so there must be 4 or 5 times as many Windows GUI sftp clients. A Google "windows sftp gui client" search should come up with a few.
OK, getting ssh working.
Enable System Preferences -> Sharing -> Remote Login.
Now on your router, Port Foward port 22, the ssh port.
Now you should be able to fire up a Windows sftp GUI client, and access your Mac via your DynDNS.org name. The username and password will be your Mac's account short name and password. If you do not know your short name, you can find this via System Preferences -> Accounts
Summary:
o Forward port 5900 for VNC
o Forward port 22 for ssh
o Enable Remote Login on the Mac
o You have already enabled Screen Sharing, and specified a VNC password (goodness).
o Configure the Mac so it will reboot in case of a power failure.
o Make sure the router will still be able to port foward 5900 and 22 after a power failure, either because it locks into the Mac, or because you have given the Mac a fixed IP address.
Now test the heck out of this, from a coffee shop or a friends house.
Even if you configure VNC and ssh, I would suggest also trying TeamView so you have a "Plan B".

Airport Utility Timed Access Control does not allow/restrict access to wireless clients per the time set.

I have been trying to setup Timed Access Control in Airport Utility and it does not seem to be working correctly.
In Airport Utility from Edit Timed Access Control I Enter a name for my device (iPad/iPhone any device), enter my mac address, set time for Everyday and use default Between 9:00 AM and 5:00 PM, save and then update. When I go to my device iPad iPhone etc. I still have access even when it is after the time set, 5:00PM. If I set no access it will restrict access also I set a time between 2:00 PM and 5:00 PM and access was restricted. It doesnt seem to matter what the device is. I know that the MAC Adress is set correctly. It seems like an issue with the Utility, possibly time miss match or something. Not sure if I am missing something or if this Utility just has flaws. Please Help.

I changed the default to (no access) and set an entry for my test device (an iPad) to "Everyday Between 9am to 5pm. The iPad was still able to gain access to the network.
Something else to note, if I try to edit the time of an entry it gives me an error on my MBP "Invalid value", "The value for “Timed Access Control” is invalid." This happens even if I delete a digit (number or letter in the time field) and replace with the exact same. Not sure if the two are related. I have tried to edit access from my iPad. I don't get any errors but I still don't get the expected results. I called Apple to try and get Tech support but they were not much help. Thanks again.

Where's iPhone's ID for MAC Access Control on Airport Express?

I'm running Apple Express (NOT Extreme) base station v5.5.1, & require Access Control on 802.11g network. I have "Apple IDs" for all our computers using network, but I can't figure how to get ID #s for iPhone. As workaround, I temporarily opened my network to standard 128-WEP encrypt w/ password, disabling Access Control. But some hash-chart wizard in my apt complex keeps beating WEP & bogging down network, no matter how many times I change passwords. Note: I can't set up WPA w/o Airport Extreme, so that's not an option.
Thanks in advance for any suggestions...

Hello sportshark1. Welcome to the Apple Discussions!
To find the iPhone's MAC address: Settings > General > About

[SOLVED] Setting up Mandatory Access Control (MAC)

Similar Messages

Maybe you are looking for