<br><br><div class="gmail_quote">On Jan 23, 2008 5:07 PM, John Summerfield <<a href="mailto:debian@herakles.homelinux.org">debian@herakles.homelinux.org</a>> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div><div></div><div class="Wj3C7c">Aldo Foot wrote:</div></div></blockquote><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div><div class="Wj3C7c">
... snip...<br><br>> Perhaps a good practice is to configure accounts such as those for<br>> cron jobs to use only specific commands.<br>> Does anyone reading this thread uses such setup?<br>> I'll play with this a bit.
<br><br></div></div>cron jobs are created either by your vendor (Fedora in this case), or by<br>users with access to accounts on the system.<br><br>If you use decent passwords, exercise due care with invited content<br>(email, www etc & especially software[1] you install/allow to be
<br>installed), secure your servers[2] I don't think you have a lot to do with.<br><br>If you're trying to protect high-value assets, best to hire an expert<br>with the skills needed, it's pretty clear you don't have them.
<br><br><br>[1] I'm very picky. Most stuff from the FOSS world I trust, it will<br>quickly get a bad name if it contains malware. I mostly avoid Acrobat &<br>flash (the latter's main use seems to be adware, and there are serious
<br>security concerns), and absolutely shun toys such google desktop etc.<br><br>[2] I run ssh, and I allow five connexions/hour globally (not per source<br>IP) from parts of the world I don't expect connexions from, it covers me
<br>for the case I've been too strict. I don't think anyone's going to<br>succeed with even a weak password without a fair bit of lock. I don't<br>think my password's weak.<br><br><br>--<br><br>Cheers<br>
John<br></blockquote></div><br><br>I have a couple of questions:<br><br>1. If you use the connection/hour limit scheme does it mean you don't<br> use tcpwrappers and you only rely on user/password for authorization?
<br><br>2. Is this what you use to configure five ssh connections per hour?<br> #tcplimit 22 5 hour on<br><br>~af<br><br>