[rt-users] HELP! Serious Security Issues Needing Resolution!

[Harald Wagener]

Am 13.08.2004 um 19:11 schrieb Stevo:

> Alright - so I'm not making any progress on this.  Could the issue be 
> how I
> have my permissions set?  Below are my current global group rights.  
> Any
> groups not noted have no rights.
>
> Any ideas?!!
>
>
> System Groups:
>     Everyone:
>         CommentOnTicket
>         CreateTicket
>         ReplyToTicket

This should only be "CreateTicket"

>
> Roles:
>     Requestor
>         ModifyTicket
>         ReplyToTicket
>         SeeQueue
>         ShowTemplate
>         ShowTicket

This should only be "ReplyToTicket" and "ShowTicket"

>
> User defined groups
>     SupportStaff (this is a group of everyone who has admin rights to 
> the
> ticketing server)
>

You had "SuperUser" in Your list. If they are SuperUser already, they 
don't need any further rights. You might want to limit the access to 
something more sane.

Comment, ModifyTicket, OwnTicket, SeeQueue, ShowTicket, 
ShowTicketComments, Watch,WatchAsAdminCC should suffice for limited 
staff access if You want to keep Your colleagues from severely breaking 
RT.

Regards,
     Harald

-- 
Foote Cone & Belding
FCB/Wilkens, An der Alster 42, D-20099 Hamburg
Harald Wagener, Systemadministrator
Mail: hwagener at hamburg.fcb.com
Tel.: +49 40 2881 1252
Fax.: +49 40 2881 1217