Profiles management : “deny all” propagation to all nodes

[Steve92]

Hello,

On “Enterprise Cloud Server”, is it possible with only one command line to deny all rights to all nodes ?

It’ a good practice in cyber security to deny all and then add only well identified required rights.

Instead of  having a command for each rule (about 33) that can be propagated, we would type something like:

$ sudo /etc/NX/nxserver –ruleadd –class propagation –type all –value no

or, even more precise, for each type family :

$ sudo /etc/NX/nxserver –ruleadd –class propagation –type all-session –value no

$ sudo /etc/NX/nxserver –ruleadd –class propagation –type all-service –value no

$ sudo /etc/NX/nxserver –ruleadd –class propagation –type all-feature –value no

If not, please could you take this as an FR ?

Thanks!

Regards,

Steve.

 

 

 

[Britgirl]

Denying rules across the board is planned. In the meantime you can do it using following script:

#!/bin/bash
#
# CLASS can be one of: all|feature|service|session

CLASS=all;

if [[ $CLASS = "all" ]]; then

     CLASS=" -E feature|service|session";

fi;

TYPES=$(sudo /etc/NX/nxserver --resourcelist --class $CLASS | grep $CLASS | awk '{print $2}');

for i in $(echo $TYPES); do

     sudo /etc/NX/nxserver --ruleadd --class propagation --type $i --value no;

done

This script will systematically deny all propagated rules for the specified session class. After which, you can then add the specific, individual rules.

[Steve92]

Hello,

Good job !

It seems to show much more (52) types of rights than in the ECS documentation (chap. 4.5 lists 33 types).

NoMachine Enterprise Cloud Server – Installation And Configuration Guide

All these types of rules can be propagated from the ECS to the nodes ?

Thanks!

Steve.

[Britgirl]

Indeed the rules that can be propagated from the Cloud Server to its nodes are those listed in the guide. We can check if it can be updated.

The command ‘nxserver --resourcelist‘ lists all the resources of the host where command is run (not necessarily that can be associated to a rule). Those resources with value yes, are available on that machine. If a profile rule denies a resource, its value will become no.

[Author]

Posts