Am trying to see if there is a way to get the output of "show security policies hit-count descending" via SNMP,
it has the following o/p like so,
show security policies hit-count descending
node0:
--------------------------------------------------------------------------
Logical system: root-logical-system
Index From zone To zone Name Policy count
1 WIFI-DEVICETEST UNTRUST allow-internet-traffic-only 284046
2 USERS UNTRUST allow-all 273438
3 AV UNTRUST allow-media-to-internet 187757
The closest MIB i came to where info related to security policies were is "jnxJsSecPolicyMIB" but Iam unable to figure out how to get the hit count using the MIB.
Related
I am building the inventory service, all tables keep track the owner of each record in column createdBy which store the user id.
The problem is this service does not hold the user info, so it cannot map the id to username which is required for FE to display data.
Calling user service to map the username and userid for each request does not make sense in term of decouple and performance. Because 1 request can ask for maximum 100 records. If I store the username instead of ID, there will be problem when user change their username.
Is there any better way or pattern to solve this problem?
I'd extend the info with the data needed with from the user service.
User name is a slow changing dimension so for most of the time the data is correct (i.e. "safe to cache")
Now we get to what to do when user info changes - this is, of course, a business decision. In some places it makes sense to keep the original info (for example what happens when the user is deleted - do we still want to keep the original user name (and whatever other info) that created the item). If this is not the case, you can use several strategies - you can have a daily (or whatever period) job to go and refresh the users info from the user service for all users used in the inventory, you can publish a daily summary of changes from the user service and have the inventory subscribe to that, you can publish changes as they happen and subscribe to that etc. - depending on the requirement for freshness. The technology to use depends on the strategy..
In my option what you have done so far is correct. Inventory related data should be Inventory Services' responsibility just like user related data should be User Services'.
It is FE's responsibility to fetch the relevant user details from User Service that are required to populate the UI (Remember, call backend for each user is not acceptable at all. Bulk search is more suitable).
What you can do is when you fetch inventory data from Inventory Service, you can publish a message to User Service to notify that "inventory related data was fetched for these users. So there is a possibility to fetch user related data for these users. Therefore you better cache them."
PS - I'm not an expert in microservices architecture. Please add any counter arguments if you have any.*
We're building our API and looking for an organized way to grant users access based on what role and permission they have.
From the starting point, we have 3 roles
Admin: can get and edit everything in his organization
Team Admin: can get and edit only his team info and users' info
User: can get any edit his own information
Entity
Team
User
For Security Filters:
We're using JAX-RS with Security Roles and #RoleAllowed to filter access to resources
Id-based filter by if / then / else function. Example with a team admin access to a user.
function isAllowAccess(teamAdminId, userId) {
allowedUserIdsList = queryfor(teamAdminId);
if (userId in allowedUserIdsList) then ... else BAD_REQUEST
}
This code is growing with the increase complexity of multiple roles and many entities. So my questions:
What will be the best way to have an organized id-based filter, is there reputable library for this?
Should we maintain a separate table containing accessible ids of each
entity for each team_admin_id? Then every row updated or inserted will trigger the update of this table.
Is there a formal or widely acceptable method to reduce database
call overhead in each call just to check if the team_admin is
allowed to access a particular user?
I have a User1 in Domain1 which belongs to a group Group1.
Group1 belongs to a different domain Domain2.
Using the memberof attribute, I can easily see that User1 belongs to Group1. But memberof only gives me the values of OU and the domains which the group belongs.
e.g.
CN=Groupname,OU=ou1,DC=Domain1,DC=Domain2,DC=com
Does Domain1 store other information of Group1?
If yes how can I get sid or guid or any other information of the Group1 without connecting to Domain2?
Edit:
Both the domains are in trust relationship.
You can get also the SID and GUID by the "Extended DN" LDAP extended control.
Please check:
How to get AD user's 'memberof' property value in terms of objectGUID?
I am trying to run a LDAP query against AD to give me all the email addressed for a given group. I tried this but it gives me the email address for the distribution but not for the members.
I tried this (&(objectCategory=group)(Name=My-TEST-Group)) LDAP query with Mail being output but it does not give emails for the members .
I tried member as output but that gives me members CN details with this format CN=Smith\, Johne,OU=Standard Users,OU=SouthWest,OU=Active-Users,DC=NOV,DC=net
I found the problem. The problem is the memberof (at least in my environment) requires full OU.
so 2 steps. First I had to get the full OU for the given group.
(&(objectCategory=group)(cn=dg-fmog-sp-test)) and get distinguishedName
so my final query looks like following and it works.
(&(&(objectCategory=person)(objectClass=user))(memberOf=cn=my-test-group, OU=SW Distribution, OU=Email Servers, OU=Data Mining, OU=US, dc=NOV,dc=net)) and get mail
Which MIB do I need if I am trying to find the routing table of a Linksys WRT54G with openWRT installed on it?
That should be MIB II. The SNMP ObjectID (OID) is .1.3.6.1.2.1.4.21 which translates to ip.ipRouteTable. (This works for me on Windows, so I see no reason why it should be different for your Linksys/openWRT system.)
Here is the hierarchy table for the routing table leaf:
1 - ISO assigned OIDs
1.3 - ISO Identified Organization
1.3.6 - US Department of Defense
1.3.6.1 - OID assignments from 1.3.6.1 - Internet
1.3.6.1.2 - IETF Management
1.3.6.1.2.1 - SNMP MIB-2
1.3.6.1.2.1.4 - ip
1.3.6.1.2.1.4.21 - ipRouteTable