Questions tagged [security]
The processes and mechanisms by which computer-based equipment, information and services are protected from unintended or unauthorized access, change or destruction
168
questions
0
votes
0
answers
18
views
Where to find documents or any Information about Information Security in QField? [closed]
Our companys information security team requires any information on data/information security standards in relation to QField app.
Where can i find it?
0
votes
1
answer
91
views
GeoServer authentication key not working as expected
I'd like to secure access to my layers published on GeoServer 2.21.1. running on Apache Tomcat Version 9.0.65.
What I want
My goal is to create a user who is the only one who can read the layers of a ...
- 638
3
votes
1
answer
294
views
Secure a QGIS layer with password and protection from copy-pasting
In a project we want to share a geographic layer, but we want to avoid that this data can be accessed without password and easily copied & pasted (and of course can't be edited). The polygons ...
- 31
0
votes
0
answers
156
views
QGIS plugin error with PyArmor
My Python project works fine when I include it as a QGIS 3.28.6 plugin. I have also successfully used PyArmor to obfuscate the Python files in PyCharm, however that causes me to get some errors in ...
- 101
1
vote
1
answer
47
views
GeoNetwork 3.12.9 support for OpenID Connect Authentication protocol
The GeoNetwork 4.x documentation indicates, among several supported authentication modes, the OpenID Connect protocol (https://geonetwork-opensource.org/manuals/4.0.x/en/administrator-guide/managing-...
1
vote
1
answer
96
views
How are WFS/WMS APIs secured?
Here's a dumb question, about something I barely understand. Please forgive me if even the premise of the question is wrong.
When a WFS or WMS API is secured behind a password, is it then always also ...
- 391
0
votes
0
answers
248
views
GeoServer layer security: How to remove rights for a single layer?
I am using GeoServer 2.19.2
Following the documentation on https://docs.geoserver.org/2.19.x/en/user/security/layer.html I try to remove rights for every layer in a specific workspace.
I have the ...
1
vote
1
answer
90
views
Providing MS_ENCRYPTION_KEY as an enviornment variable instead of a file in a mapserver mapfile
In order to use a secured WMS service in a mapfile, one can directly provide credentials as follow:
LAYER
NAME "topic-infra-service"
TYPE RASTER
STATUS ON
CONNECTION "...
- 9,776
1
vote
0
answers
480
views
Privately sharing web maps with clients
Goal: to share a web map (ideally created on ArcGIS Online) with clients that do not have an ArcGIS Online (AGOL) account, via a private link or password-protected page.
Research Findings:
It is NOT ...
- 11
0
votes
0
answers
196
views
Protect my GeoJSON in Leaflet
My GeoJSON map is published by Leaflet, how can prevent download from user who want to steal it?
I'd taken long time to prepare GeoJSON and I want to preserve my effort.
Any suggestion?
Do I need to ...
4
votes
1
answer
210
views
Anonymize site locations
I'm putting together some training materials for a workshop on R for spatial data analysis in archaeology, and need to anonymize the true site locations (confidential information) while keeping the ...
- 143
0
votes
1
answer
346
views
Protecting Vector Tile Server Data
I am deploying a Vector Tile Server on AWS with data I don't want to make publicly available and there are two main elements I want to cover regarding the security of the data
The tile server needs ...
- 13
1
vote
1
answer
429
views
Dealing with log4j vulnerability in FME products
Is there a way to mitigate any risk associated with the log4j vulnerability in FME Products?
FME Desktop
FME Server
FME License Server (FlexLM)
- 21.8k
3
votes
1
answer
499
views
Dealing with log4j vulnerability in ArcGIS Enterprise products
Is there a way to deal with the log4j vulnerability in the ArcGIS Enterprise products?
Portal for ArcGIS
ArcGIS Server
ArcGIS Datastore
- 21.8k
1
vote
2
answers
842
views
Log4J vulnerability handling in QGIS
I am using QGIS in a work environment so it is critical to know if and how QGIS is affected by the Log4J vulnerability.
There are affected software lists, where I cannot find QGIS on, eg. here or here....
- 659
0
votes
0
answers
56
views
Protecting ArcPy Files (.py) [duplicate]
I'm writing a program in ArcGIS with Python language (ArcPy). I would like to publish it as a commercial program, but ArcPy or ToolBox script is not secure, because ToolBox can be converted to .py ...
0
votes
1
answer
422
views
Leaflet Tilelayer from Mapbox with URL restrictions
I’m having great difficulty with this topic.
I’m building a Gatsby/React mapping web app for the Swiss paddlesports community (GitHub repo) using Leaflet to load a custom tile layer from Mapbox.
I’d ...
0
votes
1
answer
132
views
Setting up SAML access to Portal for ArcGIS (via Reverse Proxy Server)
We are having several Portal for ArcGIS installations behind a reverse-proxy server (Nevis) and would like to configure SAML access to them.
We have followed the doc available online (e.g. definition ...
- 1,263
1
vote
1
answer
160
views
How to restrict features that users can see by area?
Basically I have around 10 tables that are worked by several teams of users. What I need to avoid is team A complaining that team B got a better area to work on or worse, having them sabotaging each ...
- 2,278
0
votes
1
answer
179
views
Unauthorized SQL Query Execution warning- ArcGIS map services
A security scan of an application I maintain that uses several ArcGIS 10.7.1 map services (hosted with stand alone ArcGIS Server, not Enterprise, on AWS server, with IIS as web server) produced this ...
- 600
0
votes
0
answers
282
views
ArcGIS Portal not working with LDAP users
I have set user identity store of ArcGIS Portal administration page like following.
{
"type": "LDAP",
"properties": {
"userPassword": "secret",...
- 1,704
1
vote
0
answers
93
views
Secured WMS call from web application
I have a GIS application where users have to login in with username and password. The WMS is served using GeoServer and displayed using OpenLayers. I need to restrict WMS layers. I want to access the ...
-1
votes
1
answer
55
views
User privileges
My query is just about security level
How can a layer be secured with username and password only that user can see that layer?
And if other user logged in but access is not given to him for that ...
- 1
2
votes
1
answer
487
views
Rules and roles in GeoServer not working
I have in a GeoServer (v2.16) two workspaces, with associated users and roles for those users.
The file in /opt/geoserver/data_dir/security/layers.properties looks like this:
#Thu Mar 12 10:44:20 ...
- 1,103
0
votes
1
answer
185
views
Block user after 3 attempts of login
Do you know if there is a way to block a user after 3 attempts of login?
I was looking for information about but I haven't find anything.
- 9
0
votes
0
answers
63
views
Allowing ArcGIS Server accessing our Geodatabase Enterprise over the web
In my organization there is an installation of ArcGIS Server that is linked with an Enterprise geodatabase (PostgreSQL) in a DMZ for editing only over the web.
However, we have another installation ...
- 3,573
0
votes
1
answer
369
views
Data security under WebGIS by QGIS [closed]
We would like to offer our Client a webGIS solution for showing/Monitoring their data. Based on my Knowledge WebGIS by ESRI would be helpful and provide the user with the Login Information and it is ...
- 105
1
vote
0
answers
67
views
Is there any open source implementation of GeoXACML based access control mechanism for OGC Web Services?
I am looking for an open source implementation of GeoXACML PEP, PDP to provide access control to my OGC web services. I have already set-up SAML based authentication. I found a non-opensource ...
- 11
0
votes
1
answer
539
views
Unauthenticated sensitive Information Disclosure - ArcGIS REST services [closed]
Recently a security audit has been done on our servers and applications which has ArcGIS enterprise installed on it.
Our Architecture setup :
We have ArcGIS installed on the server, ArcGIS exposes its ...
- 109
1
vote
0
answers
191
views
Is there an advantage to installing an ArcGIS web adaptor in the DMZ
I'm trying to architect a new ArcGIS Portal site. I see ESRI has instructions on configuring a reverse proxy to work with a web adapter installed on the network. However I have also seen sources ...
- 2,334
-1
votes
1
answer
1k
views
Getting a token access to feature layer using Postman and Python
I am trying to query a feature server using postman as ESRI'S documentation:
https://developers.arcgis.com/labs/rest/get-an-access-token/
I have succesfully added the Authorization to the body of the ...
- 143
2
votes
1
answer
208
views
Stop ArcGIS 'Geodatabase Adminstration' Reporting Connection as 'DBO' Instead of My Username?
We are running ArcGIS 10.5.1 and MS SQL Server, and using an SDE connection file which is configured to use 'Operating System' credentials.
When most users connect, the 'Geodatabase Administration' ...
- 7,922
1
vote
1
answer
258
views
Is it possible to migrate users from one ArcGIS Server instance to different one
We are planning to consolidate 2 ArcGIS Server instances, by migrating all services and users from one into the other.
So users are stored in json files:
{
"username": "foo",
"password": "...
- 147
0
votes
1
answer
709
views
Security of GeoServer WMS layer URL
How can I secure my WMS layer URL on GeoServer as whenever a WMS layer is loaded from GeoServer than the layer URL can be easily seen in the browser console?
- 85
1
vote
0
answers
206
views
Securing one single WMS layer on GeoServer
My aim is to secure one specific layer (ex. topp:states) with username and password.
I tried a couple of combinations in the layer.properties file.
*.*.r=*
*.*.w=GROUP_ADMIN,ADMIN
topp.states.r=...
12
votes
3
answers
1k
views
Is licensed file geodatabase really secure?
I am planning to deliver our geo data in Licensed File Geodatabase format. This option was quite impressive as customer can have good look of the data with limitation and expiry date before purchasing....
- 1,914
4
votes
2
answers
568
views
Geoserver JDBC User Group Services Problem
I use the Geoserver 2.11.4 version in Windows.I am adding the JDBC service to the PostgreSQL database using JDBC Users and Group Services. Next, I add a Provider for JDBC that I created using the JDBC ...
- 43
0
votes
1
answer
30
views
Enabling service sharing in ArcGis Online?
I am an admin for my organization. I enabled both Allow Anonymous Access and Member can share content publicly under the security panel. I am trying to connect a webservice we host that is in an ...
- 355
1
vote
1
answer
273
views
How can I block WMTS GetCapabilities Link
I want to block to below link like WMS services.
http://localhost:8080/geoserver/gwc/service/wmts?REQUEST=GetCapabilities
In services, WMS method's has "GetCapabilities" and selected roles only "...
- 139
1
vote
1
answer
2k
views
openlayers 4 method forEachLayerAtPixel() throws SecurityError: The operation is insecure
Working with GeoExt 3.1.0, ExtJS 6.2.0 and Open Layers 4.4.1.
I am trying to select a layer on my map with the singleclick event so I can use layer.getSource().getGetFeatureInfoUrl and display the ...
- 205
2
votes
1
answer
543
views
Configuring security for WFS layer
We are using GeoServer 2.8, PostgreSQL 9.6 & QGIS 2.16 on our side. We have certain WFS layers.
As per documentation disabled Anonymous WFS access and looking more settings for Web part.
However ...
- 4,753
2
votes
0
answers
706
views
Restrict access to geoserver's web administration interface [closed]
I am a bit worried because the web administration interface for my geoserver is open to everybody. Of course there is a password set, but I wonder if it is reasonable to block access to the padel from ...
- 3,533
2
votes
0
answers
92
views
Boundless Suite - Composer Security Permissions [closed]
I’m having trouble getting users-roles-data access rules correctly configured in the Boundless Suite 4.9.1. The issue appears to be with Composer, not Geoserver.
BLUF: I want 2 separate editors for ...
- 21
3
votes
1
answer
1k
views
Adding a security layer to my tile server [closed]
I have a tile server (apache2 + mod_tile serving OpenStreetMap data) that I'm going to use via Leaflet. Everything's working fine but before putting this public, I have a big concern about the ...
- 141
1
vote
1
answer
1k
views
How to Access Secured ArcGIS Online Services from a Custom JS Web app?
I have some Layers Hosted on my company's ArcGIS Online Account. I want to make a Custom WebMapping Application hosted on our public server, which General Public can use without Logging in.
I'm ...
- 41.1k
0
votes
1
answer
192
views
Setting SSL Cipher Suites in Portal Admin
I am trying to update the SSL cipher suites (to be in compliance with my org security requirements) at '/portal/portaladmin/security/sslCertificates/update'
according to this page
I am getting: ...
1
vote
0
answers
625
views
Password protected WMS in Openlayers 4
I would like to use OpenLayers to access a Wms, which is protected by a password. Unfortunately, I find no solution to this problem. My problem is in particular that I want to prevent that password ...
- 11
4
votes
1
answer
425
views
Parametrized queries for ArcGIS?
Since our ArcGIS applications are developed as desktop and as server applications, I'm looking for a way create our SQL-queries in a safe way. The state of the art to mitigate SQL-injection is, to use ...
- 365
1
vote
1
answer
412
views
Geoserver/Geofence - Trigger Authentication
Geoserver Catalog MIXED mode in Data Security section is perfect for my purposes since I want to trigger an alert for authentication whenever a specific layer is requested.
Since I need to create ...
- 1,120
2
votes
1
answer
2k
views
Openlayers 3 getting 401 error from geoserver with secured layers
I have an OL3 webmap that is attempting to access services from Geoserver that is running on a server on our internal network that uses LDAP logins using windows credentials. I found this link (...
- 336