Questions tagged [security]

The processes and mechanisms by which computer-based equipment, information and services are protected from unintended or unauthorized access, change or destruction

Filter by
Sorted by
Tagged with
0 votes
1 answer
23 views

Change GeoServer's "XML User Group Service default" via REST API

On GeoServer 2.24.2 I want to update the default "XML User Group Service default" to use "Digest" password encryption and to recode the existing passwords as I set that setting. In ...
0 votes
0 answers
13 views

Set GeoServer's password encryption to "Strong PBE" via REST API

On GeoServer 2.24.2 I want to set the password encryption to "Strong PBE" via REST API. In the GUI one can navigate "Settings" -> "Security": I do not want to do this ...
1 vote
1 answer
300 views

How can I block WMTS GetCapabilities Link

I want to block to below link like WMS services. http://localhost:8080/geoserver/gwc/service/wmts?REQUEST=GetCapabilities In services, WMS method's has "GetCapabilities" and selected roles only "...
0 votes
1 answer
188 views

Unauthorized SQL Query Execution warning- ArcGIS map services

A security scan of an application I maintain that uses several ArcGIS 10.7.1 map services (hosted with stand alone ArcGIS Server, not Enterprise, on AWS server, with IIS as web server) produced this ...
4 votes
0 answers
130 views

Access control for SaaS-based GIS, which is the right way to go?

I'm currently researching on some access control models for SaaS-based GIS, and in the future would like to implement one. The common use cases would be like: some of the services, resources, layers, ...
0 votes
1 answer
146 views

GeoServer authentication key not working as expected

I'd like to secure access to my layers published on GeoServer 2.21.1. running on Apache Tomcat Version 9.0.65. What I want My goal is to create a user who is the only one who can read the layers of a ...
1 vote
2 answers
900 views

Log4J vulnerability handling in QGIS

I am using QGIS in a work environment so it is critical to know if and how QGIS is affected by the Log4J vulnerability. There are affected software lists, where I cannot find QGIS on, eg. here or here....
3 votes
1 answer
321 views

Secure a QGIS layer with password and protection from copy-pasting

In a project we want to share a geographic layer, but we want to avoid that this data can be accessed without password and easily copied & pasted (and of course can't be edited). The polygons ...
0 votes
0 answers
186 views

QGIS plugin error with PyArmor

My Python project works fine when I include it as a QGIS 3.28.6 plugin. I have also successfully used PyArmor to obfuscate the Python files in PyCharm, however that causes me to get some errors in ...
1 vote
1 answer
58 views

GeoNetwork 3.12.9 support for OpenID Connect Authentication protocol

The GeoNetwork 4.x documentation indicates, among several supported authentication modes, the OpenID Connect protocol (https://geonetwork-opensource.org/manuals/4.0.x/en/administrator-guide/managing-...
1 vote
1 answer
106 views

How are WFS/WMS APIs secured?

Here's a dumb question, about something I barely understand. Please forgive me if even the premise of the question is wrong. When a WFS or WMS API is secured behind a password, is it then always also ...
0 votes
0 answers
296 views

GeoServer layer security: How to remove rights for a single layer?

I am using GeoServer 2.19.2 Following the documentation on https://docs.geoserver.org/2.19.x/en/user/security/layer.html I try to remove rights for every layer in a specific workspace. I have the ...
1 vote
1 answer
107 views

Providing MS_ENCRYPTION_KEY as an enviornment variable instead of a file in a mapserver mapfile

In order to use a secured WMS service in a mapfile, one can directly provide credentials as follow: LAYER NAME "topic-infra-service" TYPE RASTER STATUS ON CONNECTION "...
1 vote
0 answers
112 views

ArcGIS Server Security related justification [closed]

We just installed ArcGIS server(JAVA) and the network security has a few policy that requires us to provide justification on our setting. Does anyone have any reference document for the following ...
1 vote
0 answers
547 views

Privately sharing web maps with clients

Goal: to share a web map (ideally created on ArcGIS Online) with clients that do not have an ArcGIS Online (AGOL) account, via a private link or password-protected page. Research Findings: It is NOT ...
0 votes
1 answer
581 views

Unauthenticated sensitive Information Disclosure - ArcGIS REST services [closed]

Recently a security audit has been done on our servers and applications which has ArcGIS enterprise installed on it. Our Architecture setup : We have ArcGIS installed on the server, ArcGIS exposes its ...
4 votes
1 answer
429 views

Parametrized queries for ArcGIS?

Since our ArcGIS applications are developed as desktop and as server applications, I'm looking for a way create our SQL-queries in a safe way. The state of the art to mitigate SQL-injection is, to use ...
0 votes
0 answers
225 views

Protect my GeoJSON in Leaflet

My GeoJSON map is published by Leaflet, how can prevent download from user who want to steal it? I'd taken long time to prepare GeoJSON and I want to preserve my effort. Any suggestion? Do I need to ...
4 votes
1 answer
225 views

Anonymize site locations

I'm putting together some training materials for a workshop on R for spatial data analysis in archaeology, and need to anonymize the true site locations (confidential information) while keeping the ...
0 votes
1 answer
380 views

Protecting Vector Tile Server Data

I am deploying a Vector Tile Server on AWS with data I don't want to make publicly available and there are two main elements I want to cover regarding the security of the data The tile server needs ...
1 vote
1 answer
443 views

Dealing with log4j vulnerability in FME products

Is there a way to mitigate any risk associated with the log4j vulnerability in FME Products? FME Desktop FME Server FME License Server (FlexLM)
3 votes
1 answer
505 views

Dealing with log4j vulnerability in ArcGIS Enterprise products

Is there a way to deal with the log4j vulnerability in the ArcGIS Enterprise products? Portal for ArcGIS ArcGIS Server ArcGIS Datastore
0 votes
1 answer
449 views

Leaflet Tilelayer from Mapbox with URL restrictions

I’m having great difficulty with this topic. I’m building a Gatsby/React mapping web app for the Swiss paddlesports community (GitHub repo) using Leaflet to load a custom tile layer from Mapbox. I’d ...
2 votes
1 answer
506 views

Setting user access permissions for QGIS and SpatiaLite database

SpatiaLite databases seems to match all my desires to store GIS layers and table but an important question is: If it is possible to limit writing to only one user, then what is the way to do it? I ...
2 votes
1 answer
1k views

Accessing secure ArcGIS Online map service from custom web mapping application?

I'm building a custom web mapping application for a client. The application will be hosted externally to ArcGIS Online, but the application is registered with AGOL. The application will access the ...
0 votes
0 answers
57 views

Protecting ArcPy Files (.py) [duplicate]

I'm writing a program in ArcGIS with Python language (ArcPy). I would like to publish it as a commercial program, but ArcPy or ToolBox script is not secure, because ToolBox can be converted to .py ...
0 votes
1 answer
147 views

Setting up SAML access to Portal for ArcGIS (via Reverse Proxy Server)

We are having several Portal for ArcGIS installations behind a reverse-proxy server (Nevis) and would like to configure SAML access to them. We have followed the doc available online (e.g. definition ...
1 vote
0 answers
194 views

Is there an advantage to installing an ArcGIS web adaptor in the DMZ

I'm trying to architect a new ArcGIS Portal site. I see ESRI has instructions on configuring a reverse proxy to work with a web adapter installed on the network. However I have also seen sources ...
13 votes
1 answer
16k views

Changing geoserver admin password

How can I change the default password of geoserver admin from geoserver to something else? I have tried two different things, but none worked. First thing I tried following the online documentation ...
1 vote
1 answer
180 views

How to restrict features that users can see by area?

Basically I have around 10 tables that are worked by several teams of users. What I need to avoid is team A complaining that team B got a better area to work on or worse, having them sabotaging each ...
4 votes
2 answers
598 views

Geoserver JDBC User Group Services Problem

I use the Geoserver 2.11.4 version in Windows.I am adding the JDBC service to the PostgreSQL database using JDBC Users and Group Services. Next, I add a Provider for JDBC that I created using the JDBC ...
2 votes
2 answers
1k views

Implementing GeoServer WFS Row Level Security

I am trying to implement row level security with GeoServer. I know out of the box it supports service, layer and REST security and not row level. However, I am sure there must be a workaround. Has ...
2 votes
2 answers
4k views

Access secured WMS server in Leaflet?

I browsed regarding this question and I couldn't find any better solution. This link has some information for OpenLayers but not for Leaflet. How do I access a secured WMS via Leaflet in with ...
0 votes
0 answers
307 views

ArcGIS Portal not working with LDAP users

I have set user identity store of ArcGIS Portal administration page like following. { "type": "LDAP", "properties": { "userPassword": "secret",...
1 vote
0 answers
95 views

Secured WMS call from web application

I have a GIS application where users have to login in with username and password. The WMS is served using GeoServer and displayed using OpenLayers. I need to restrict WMS layers. I want to access the ...
2 votes
1 answer
532 views

Rules and roles in GeoServer not working

I have in a GeoServer (v2.16) two workspaces, with associated users and roles for those users. The file in /opt/geoserver/data_dir/security/layers.properties looks like this: #Thu Mar 12 10:44:20 ...
3 votes
2 answers
273 views

Spectrum Server Analyst on AWS

I have installed Spectrum Server/SSA from Pitney Bowes on an AWS server and opened the ports to all traffic. The default site opens when I am logged in on the AWS VM, but not from any other computer. ...
0 votes
1 answer
717 views

Security of GeoServer WMS layer URL

How can I secure my WMS layer URL on GeoServer as whenever a WMS layer is loaded from GeoServer than the layer URL can be easily seen in the browser console?
-1 votes
1 answer
1k views

Getting a token access to feature layer using Postman and Python

I am trying to query a feature server using postman as ESRI'S documentation: https://developers.arcgis.com/labs/rest/get-an-access-token/ I have succesfully added the Authorization to the body of the ...
-1 votes
1 answer
57 views

User privileges

My query is just about security level How can a layer be secured with username and password only that user can see that layer? And if other user logged in but access is not given to him for that ...
5 votes
1 answer
3k views

How to create services with session tokens in geoserver?

I have a multi-tenant web mapping application running on ArcGIS server. I am trying to replace with geoserver. Identity of the users for tenants are maintained through another identity api. After ...
20 votes
11 answers
3k views

Would you consider online geocoding a breach of privacy?

Suppose I have a bunch of addresses of individuals participating in a certain study (most likely - health related, where privacy and ethical considerations are always important issues). Nowadays, ...
0 votes
1 answer
206 views

Block user after 3 attempts of login

Do you know if there is a way to block a user after 3 attempts of login? I was looking for information about but I haven't find anything.
4 votes
1 answer
2k views

Geoserver authkey configuration question

I'm running geoserver 2.8.0 in tomcat7 on Ubuntu 14.04. Could anybody help me with the security configuration? I want to serve WMS and WFS from a specific workspace using authorization based on a ...
2 votes
1 answer
738 views

Using GeoServer geowebcache watermark setting [closed]

I have successfully set watermark to my WMS layer, but in my OpenLayers 3 project, I use 'Tiled': true WMS setting and my GeoWebCache doesn't display any watermark. I have same problem in the layer ...
1 vote
0 answers
649 views

ArcGIS Server getToken Encrypted Password with Python

I originally posted this in the geonet, but unfortunately got crickets. I'd like to fetch an ArcGIS Server token with a python web service and an encrypted password. I have it working nicely with ...
0 votes
0 answers
64 views

Allowing ArcGIS Server accessing our Geodatabase Enterprise over the web

In my organization there is an installation of ArcGIS Server that is linked with an Enterprise geodatabase (PostgreSQL) in a DMZ for editing only over the web. However, we have another installation ...
0 votes
1 answer
374 views

Data security under WebGIS by QGIS [closed]

We would like to offer our Client a webGIS solution for showing/Monitoring their data. Based on my Knowledge WebGIS by ESRI would be helpful and provide the user with the Login Information and it is ...
1 vote
1 answer
136 views

Arcgis Server 10.1: Workflow/Setup for Secure Content?

We have a server which has ports 80 and 6080 open to the outside world--and probably port 443 as well. But port 6643--the default secure port for ArcGIS Server is not open to the outside. The server ...
1 vote
0 answers
70 views

Is there any open source implementation of GeoXACML based access control mechanism for OGC Web Services?

I am looking for an open source implementation of GeoXACML PEP, PDP to provide access control to my OGC web services. I have already set-up SAML based authentication. I found a non-opensource ...