Security Changes Summary

[drgrussell]

I am going to start this thread concerning what security changes I was forced to implement due to strange activity by users. Strange does not automatically mean evil, but the potential is there for strange activity to become a problem.

[drgrussell]

You must control your virtual machine from outside the virtual machine network (eg from your own PC).

Someone over the last few days has been switching on a virtual machine, logging onto it, then switching control of the machine to a browser instance running on that virtual machine. This effectively stops me from knowing when a person has left the system, and potentially could make attacks on the system harder to trace (I say potentially, but actually my logs are much more complete than those shown via the interface).

I have now blocked all traffic from 10.0.0.0 from running virtual machine control scripts.