PC Review


Reply
Thread Tools Rate Thread

Command Line Security/Usage

 
 
Derek
Guest
Posts: n/a
 
      2nd Dec 2003
Hello,

We have been evaluating a secure telnet program for one of our servers. We
have run into a problem however that I have been unable to solve. The goal
is to allow one of our users access to edit some web files without having to
FTP them down, then back up. From a command line he can run edit and make
quick changes easily. However, I need to restrict this user to only the web
directories. I have done with with NTFS permissions, and the user's home
directory is set to the appropriate directory. The user can connect to the
secure telnet server, login, and is placed in his home directory, and can
then do anything needed except use the "dir" command. When attempting to
use the dir command you receive a message "Access is Denied."

Here are the details of the installation: it is a Windows 2000 Advanced
Server machine that is a DC. This is identical to what will be my
production environment.



The user that I am testing with, "Test", is a member of only one user group,
"Test Group." The user has been assigned the home directory of d:\Test.
The Test Group has the following User Rights Assignments under the Local
Security Settings:



Bypass Traverse Checking

Log On Locally



It also gains Access This Computer From The Network via the Everyone
listing.



The Drive where the home directory is located, D:\, has the following
permissions:



Domain Admins: Full Control

Domain Users: Full Control



The home directory of the user, d:\Test, does not inherit permissions from
parent, and has the following permissions:



Domain Admins: Full Control

Domain Users: Full Control

Test Group: Full Control



The ability to login and not go anywhere else works perfectly. The test
user cannot get out of that directory, and can maneuver through the sub
directories, and edit files, just fine. The test user just can't run the
"dir" command. This makes the access very cumbersome to use.



It seems to me that it is related to the security structure within windows,
since the dir command is not part of the telnet app, but part of the command
prompt on windows. If anyone has any ideas I'd appreciate it.



Thanks,

Derek Grimme

IT Manager

DoxEMR



 
Reply With Quote
 
 
 
 
Brian
Guest
Posts: n/a
 
      2nd Dec 2003
Check the directory permissions and make sure the user has
full permissions. (Read/Write, Modify, Delete, List Folder
Contents)

>-----Original Message-----
>Hello,
>
>We have been evaluating a secure telnet program for one

of our servers. We
>have run into a problem however that I have been unable

to solve. The goal
>is to allow one of our users access to edit some web

files without having to
>FTP them down, then back up. From a command line he can

run edit and make
>quick changes easily. However, I need to restrict this

user to only the web
>directories. I have done with with NTFS permissions, and

the user's home
>directory is set to the appropriate directory. The user

can connect to the
>secure telnet server, login, and is placed in his home

directory, and can
>then do anything needed except use the "dir" command.

When attempting to
>use the dir command you receive a message "Access is

Denied."
>
>Here are the details of the installation: it is a Windows

2000 Advanced
>Server machine that is a DC. This is identical to what

will be my
>production environment.
>
>
>
>The user that I am testing with, "Test", is a member of

only one user group,
>"Test Group." The user has been assigned the home

directory of d:\Test.
>The Test Group has the following User Rights Assignments

under the Local
>Security Settings:
>
>
>
>Bypass Traverse Checking
>
>Log On Locally
>
>
>
>It also gains Access This Computer From The Network via

the Everyone
>listing.
>
>
>
>The Drive where the home directory is located, D:\, has

the following
>permissions:
>
>
>
>Domain Admins: Full Control
>
>Domain Users: Full Control
>
>
>
>The home directory of the user, d:\Test, does not inherit

permissions from
>parent, and has the following permissions:
>
>
>
>Domain Admins: Full Control
>
>Domain Users: Full Control
>
>Test Group: Full Control
>
>
>
>The ability to login and not go anywhere else works

perfectly. The test
>user cannot get out of that directory, and can maneuver

through the sub
>directories, and edit files, just fine. The test user

just can't run the
>"dir" command. This makes the access very cumbersome to

use.
>
>
>
>It seems to me that it is related to the security

structure within windows,
>since the dir command is not part of the telnet app, but

part of the command
>prompt on windows. If anyone has any ideas I'd

appreciate it.
>
>
>
>Thanks,
>
>Derek Grimme
>
>IT Manager
>
>DoxEMR
>
>
>
>.
>

 
Reply With Quote
 
Derek
Guest
Posts: n/a
 
      2nd Dec 2003
Yep, got all that. The Test Group has full control, and all sub items
allowed.

Derek


"Brian" <(E-Mail Removed)> wrote in message
news:053601c3b91f$bcb26b00$(E-Mail Removed)...
> Check the directory permissions and make sure the user has
> full permissions. (Read/Write, Modify, Delete, List Folder
> Contents)
>
> >-----Original Message-----
> >Hello,
> >
> >We have been evaluating a secure telnet program for one

> of our servers. We
> >have run into a problem however that I have been unable

> to solve. The goal
> >is to allow one of our users access to edit some web

> files without having to
> >FTP them down, then back up. From a command line he can

> run edit and make
> >quick changes easily. However, I need to restrict this

> user to only the web
> >directories. I have done with with NTFS permissions, and

> the user's home
> >directory is set to the appropriate directory. The user

> can connect to the
> >secure telnet server, login, and is placed in his home

> directory, and can
> >then do anything needed except use the "dir" command.

> When attempting to
> >use the dir command you receive a message "Access is

> Denied."
> >
> >Here are the details of the installation: it is a Windows

> 2000 Advanced
> >Server machine that is a DC. This is identical to what

> will be my
> >production environment.
> >
> >
> >
> >The user that I am testing with, "Test", is a member of

> only one user group,
> >"Test Group." The user has been assigned the home

> directory of d:\Test.
> >The Test Group has the following User Rights Assignments

> under the Local
> >Security Settings:
> >
> >
> >
> >Bypass Traverse Checking
> >
> >Log On Locally
> >
> >
> >
> >It also gains Access This Computer From The Network via

> the Everyone
> >listing.
> >
> >
> >
> >The Drive where the home directory is located, D:\, has

> the following
> >permissions:
> >
> >
> >
> >Domain Admins: Full Control
> >
> >Domain Users: Full Control
> >
> >
> >
> >The home directory of the user, d:\Test, does not inherit

> permissions from
> >parent, and has the following permissions:
> >
> >
> >
> >Domain Admins: Full Control
> >
> >Domain Users: Full Control
> >
> >Test Group: Full Control
> >
> >
> >
> >The ability to login and not go anywhere else works

> perfectly. The test
> >user cannot get out of that directory, and can maneuver

> through the sub
> >directories, and edit files, just fine. The test user

> just can't run the
> >"dir" command. This makes the access very cumbersome to

> use.
> >
> >
> >
> >It seems to me that it is related to the security

> structure within windows,
> >since the dir command is not part of the telnet app, but

> part of the command
> >prompt on windows. If anyone has any ideas I'd

> appreciate it.
> >
> >
> >
> >Thanks,
> >
> >Derek Grimme
> >
> >IT Manager
> >
> >DoxEMR
> >
> >
> >
> >.
> >



 
Reply With Quote
 
 
 
Reply

Thread Tools
Rate This Thread
Rate This Thread:

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Newgroup for Command Line usage? SixSigmaGuy Windows Vista General Discussion 2 18th May 2008 02:31 AM
[Q] is .NET Framework SDK 2.0 command-line tools free for commercial usage? Vaidas Microsoft Dot NET 2 26th Jun 2006 12:03 PM
Usage of environment variable in a batch file as command line argument kk Microsoft Windows 2000 CMD Promt 2 28th Jan 2006 06:33 AM
Registry Security via Command Line =?Utf-8?B?RGFuaWVsIFAuIENheWVh?= Windows XP Setup 4 19th Mar 2005 06:51 AM
Windows 2000 command line usage and documentation Paul Microsoft Windows 2000 4 23rd Feb 2004 08:55 AM


Features
 

Advertising
 

Newsgroups
 


All times are GMT +1. The time now is 04:56 PM.