Profiles management : “deny all” propagation to all nodes

Forum / NoMachine Cloud Server Products / Profiles management : “deny all” propagation to all nodes

Viewing 4 posts - 1 through 4 (of 4 total)
  • Author
    Posts
  • #50907
    Steve92
    Participant

    Hello,

    On “Enterprise Cloud Server”, is it possible with only one command line to deny all rights to all nodes ?

    It’ a good practice in cyber security to deny all and then add only well identified required rights.

    Instead of  having a command for each rule (about 33) that can be propagated, we would type something like:

    $ sudo /etc/NX/nxserver –ruleadd –class propagation –type all –value no

    or, even more precise, for each type family :

    $ sudo /etc/NX/nxserver –ruleadd –class propagation –type all-session –value no

    $ sudo /etc/NX/nxserver –ruleadd –class propagation –type all-service –value no

    $ sudo /etc/NX/nxserver –ruleadd –class propagation –type all-feature –value no

    If not, please could you take this as an FR ?

    Thanks!

    Regards,

    Steve.

     

     

     

    #50915
    Britgirl
    Keymaster

    Denying rules across the board is planned. In the meantime you can do it using following script:

    #!/bin/bash
    #
    # CLASS can be one of: all|feature|service|session
    
    CLASS=all;
    
    if [[ $CLASS = "all" ]]; then
    
         CLASS=" -E feature|service|session";
    
    fi;
    
    TYPES=$(sudo /etc/NX/nxserver --resourcelist --class $CLASS | grep $CLASS | awk '{print $2}');
    
    for i in $(echo $TYPES); do
    
         sudo /etc/NX/nxserver --ruleadd --class propagation --type $i --value no;
    
    done

    This script will systematically deny all propagated rules for the specified session class. After which, you can then add the specific, individual rules.

    #50930
    Steve92
    Participant

    Hello,

    Good job !

    It seems to show much more (52) types of rights than in the ECS documentation (chap. 4.5 lists 33 types).

    NoMachine Enterprise Cloud Server – Installation And Configuration Guide

    All these types of rules can be propagated from the ECS to the nodes ?

    Thanks!

    Steve.

    #50968
    Britgirl
    Keymaster

    Indeed the rules that can be propagated from the Cloud Server to its nodes are those listed in the guide. We can check if it can be updated.

    The command ‘nxserver --resourcelist‘ lists all the resources of the host where command is run (not necessarily that can be associated to a rule). Those resources with value yes, are available on that machine. If a profile rule denies a resource, its value will become no.

Viewing 4 posts - 1 through 4 (of 4 total)

You must be logged in to reply to this topic. Please login .