6

I’m working for a large organization which are using ArcGis Desktop on some (windows) clients. The security requirements for the system is very strict, and a part of that is prohibiting the users the ability to use compilers and interpreters. This pose an issue with ArcGis products since they rely heavily on Python scripting. We are looking into different ways of locking down python as much as possible without rendering ArcGis Desktop useless. The environment is Windows 2008 R2 servers with Windows clients. We would prefer to lock down python to only allow for execution of scripts in the ArcGis folder, and block other folders as well as the interactive prompt.

We have heard rumors that a solution for locking down Python in ArcGis has been presented at a user conference but we have not seen a description of how it was done. The ArcGis version we are using is 10.2 and we have experimented using both the “in process” bundled python as well as the external python installation in the system. Our first approach was looking into restricting python with group policies, but that is not easily done since Python is not “GPO aware”. Using software restriction policies are basically a block Python for all or allow Python for all. Since python scripts are run through the interpreter (python.exe), the GPO software restriction settings for executable locations only checks the python.exe and not the script location itself (the GPO system only sees the python script as a generic argument to the python.exe executable). So my question is if anyone has have any experience in tightening the security concerning ArcGis and Python?

2
  • 1
    I feel this is more of a security issue than a GIS issue and the IT security stack exchange may be an improved forum. My advice would be to not issue them ArcGIS if you have a level of security that does not allow python. What is the point? Commented Jan 7, 2015 at 17:29
  • put arcgis on other machines without the secure data Commented Dec 19, 2015 at 14:16

1 Answer 1

1

You are really limiting users functionality and may have some unintended consequences because of this. What if users need to access external python libs for tasks. You can easily handle access through GPO but limiting users functionality is one reason that frustrates users with ArcGIS. For instance the windows UAC blocks sending requests out of most ports which makes urllib, smtp not work on users machines. Which wastes time and causes them to chase there tail troubleshooting when it is really the UAC blocking things.

2
  • Unfortunately GIS is only one part of the output for the organization. Other parts are handling data classified by national law, meaning that security takes precedence over convenience. We have handled the UAC situation after some experimentation. We have one GPO solution in place where we are limiting the client computers and users concerning access to Python, but that solution does not scale very well and its a timely process to manage new and changed users and computers. And since I heard rumors about a solution being presented at a conference I'm trying to find some input about that.
    – andpou
    Commented Jan 9, 2015 at 9:56
  • 2
    @andpou Is the classified data being used with ArcGIS? If not would it not be enough to sandbox the machines with ArcGIS? Nicholas' right - trying to plug holes and run bits of Python would likely have consequences.
    – om_henners
    Commented Nov 19, 2015 at 13:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.