This article explains what a bastion host (jump server) is, its design principles, core functions, authentication methods, deployment options, and the value it brings to IT operations, helping organizations improve security, auditability, and compliance while reducing operational risk.
This tutorial explains the fundamentals of HTTP API authentication versus authorization, introduces Casbin's model and policy syntax for role‑based access control, and provides step‑by‑step PHP code examples to add permissions, assign roles, and enforce RBAC checks.
The article explains how data security diagrams map which participants can access specific enterprise data, discusses best practices such as using focused participant‑centric or external‑access diagrams, presents example tables and UML/BPMN and Archimate visualizations, and highlights their role in compliance and trust management.
This article provides an in-depth overview of Nginx, covering its introduction, architecture, and various modules, including real IP and rewrite modules, with practical examples and configuration details.
This guide introduces Casbin, an efficient open‑source authorization library, outlines its supported languages, key features, what it does not handle, core concepts, installation via Composer, and provides a complete PHP example with model and policy files to enforce access control.
Fluid v0.3, the open‑source cloud‑native data acceleration platform, introduces PVC and HostPath acceleration, fine‑grained dataset permission controls, and built‑in parameter optimizations, delivering over 20% faster AI training while simplifying configuration for diverse storage back‑ends.
This article introduces the role‑based access control (RBAC) model, outlines its historical development, explains its core principles and various extensions (RBAC0‑RBAC3), and discusses how RBAC simplifies permission management in software systems for enterprise.
The article explains permission system fundamentals, classifies page, function, and data permissions, compares DAC, MAC, RBAC, and ABAC models, details RBAC variants, and demonstrates a practical Egg framework plugin implementation that configures roles, resources, and data rules to achieve flexible, secure backend access control.
This article explains how Nginx can be used for static file serving, various load‑balancing strategies, rate limiting with the leaky‑bucket algorithm, caching mechanisms, and black‑/white‑list access control, providing practical guidance for improving web service performance and reliability.
The article explains how permission control in a front‑back separation architecture defines resources and permissions, outlines the distinct responsibilities of frontend and backend in enforcing access, and provides practical implementation examples with component tags and Java interceptor code.
This article explains the principles, architecture, features, and step‑by‑step deployment of Apache Sentry with Kerberos to provide role‑based access control across Hadoop components such as Hive, Impala, and HDFS, including command‑line examples and visual diagrams.
This article explains the core RBAC0 model and its extensions (RBAC1, RBAC2, RBAC3), discusses user groups, organizations and positions, and outlines manual and approval-based authorization workflows along with a sample database schema for implementing role‑based access control in complex systems.
The article explains how the vague term “user” leads to design flaws and security vulnerabilities across systems like ticket‑booking platforms, Unix, and SaaS, and argues that precise terminology and early conceptual planning can prevent costly rework.
This article explains the critical importance of securing RESTful APIs—covering data protection, DoS risks, and business impact—and outlines practical measures such as authentication, API keys, access control, rate limiting, and input validation with code examples.
The article presents a comprehensive approach to dynamic role‑based permission management in a front‑end/back‑end separated admin system, covering user‑role‑page‑function relationships, database schema design, front‑end menu rendering, route guarding, fine‑grained function control, and backend API authorization.
This article analyses various authentication scenarios in multi‑client information systems, classifies token types such as password, session, access, and QR‑code tokens, compares their natural and controllable attributes, and proposes a four‑layer hierarchical architecture to improve security and manageability.
This tutorial shows how to integrate Spring Security into a Spring Boot project that already uses Swagger2, configuring dependencies, application properties, Swagger and security classes so that the generated API documentation is protected by a login page without affecting other business endpoints.
This article explains how permission control is re‑designed for front‑end/back‑end separated applications, defining resources and permissions, outlining the distinct responsibilities of front‑end routing and component rendering versus back‑end API validation, and providing practical implementation examples in React and Java.
This tutorial explains MySQL 8.0 role concepts, demonstrates how to create roles, assign them to multiple users, activate default roles, configure role parameters, and revoke roles, providing step‑by‑step examples with complete MySQL commands and explanations for effective privilege management.
This article explains why data security is vital for businesses, outlines common technical, process and human threats, and provides actionable cloud‑based measures—including backup strategies, snapshot usage, permission management, data classification, and encryption—to protect enterprise data throughout its lifecycle.
This article explains the fundamentals of permission system design, covering the core RBAC0 model, its extensions RBAC1, RBAC2, RBAC3, as well as user groups, organizational structures, authorization processes, database schema considerations, and common implementation frameworks for secure backend access control.
This article presents a practical checklist for securing web applications, covering unit testing, access control, change tracking, admin privilege management, least‑privilege principles, remote redundancy, monitoring, encryption, automated security scanning, and SQL injection prevention, offering actionable guidance for developers.
This article explains why Role‑Based Access Control (RBAC) is essential for modern applications, outlines the four RBAC model variants (RBAC0‑RBAC3), clarifies core concepts such as users, roles, sessions and permissions, and shows how RBAC improves scalability and security in Spring Security projects.
This article explains the fundamentals of role‑based access control, introduces user groups and role groups for batch authorization, and provides a detailed data‑dictionary with database tables and diagrams to help developers design a flexible, extensible permission system for large applications.
This article explains the differences between functional and security testing, introduces common web vulnerabilities such as SQL injection, cross‑site scripting (XSS), and cross‑site request forgery (CSRF), provides concrete code examples, and offers practical tips for detecting and preventing these issues.
This article describes Qunar's comprehensive data security framework, covering data classification, warehouse access control, permission compliance, encryption, leakage detection, and the supporting institutional policies that together enable a small security team to protect large‑scale business data.
This article explores the concept of permissions, distinguishes their noun and verb attributes, outlines minimal‑privilege and data‑abstraction principles, examines server‑side versus client‑side access control, discusses role‑based access control and table design, and compares common Java security frameworks.
This article outlines practical Nginx security settings—including hiding version info, enabling HTTPS, configuring allow/deny lists, basic authentication, request method restrictions, user‑agent blocking, hotlink protection, connection limits, buffer size tweaks, timeout adjustments, and secure response headers—to help harden your web server against common attacks.
This article explains the fundamentals of role‑based access control, how roles and permissions are structured, the use of user groups to simplify large‑scale authorizations, and presents a comprehensive database schema—including tables for users, roles, permissions, resources, and logs—to support flexible and extensible permission management.
The article explains how the vague term “User” leads to poor requirements, hidden security flaws like the Confused Deputy problem, and costly redesigns, urging developers to adopt precise terminology such as “team” and “member” early in a project.
This article analyses various client‑side authentication scenarios, classifies tokens into password, session, and API categories, compares their natural and controllable attributes, and proposes a four‑layer hierarchical token architecture to improve security, usability, and decoupling across multiple platforms.
This article details Meituan's data security platform architecture, explaining why traditional ACL and RBAC models fall short for data‑level control, how a new hierarchical permission model and plug‑in services were designed, and the microservice, caching, and high‑availability techniques used to support flexible, high‑QPS data governance across multiple business lines.
Meituan’s data security permission platform introduces a hierarchical, fine‑grained model that unifies approval, permission, and audit functions across business lines, using a plug‑in service layer, micro‑service architecture, and high‑availability mechanisms such as caching, load balancing, and distributed locks to protect data assets.
The article outlines practical Elasticsearch security measures—including network isolation, removal of public IPs, non‑root operation, port changes, and user authentication with the open‑source Search Guard plugin—to protect against data leaks and unauthorized access.
The article outlines Youzan’s evolving security architecture for its big‑data platform—starting with Apache Ranger‑based permission control, moving to a centralized permission‑management service for easier requests and audits, and finally implementing column‑level masking via SQL rewriting to protect sensitive data while balancing usability.
Designing a relatively secure account system requires integrating strong multi-factor authentication, fine-grained authorization models like RBAC or ABAC, and continuous real-time and offline auditing to mitigate breaches, while recognizing that absolute security is impossible and ongoing vigilance is essential.
This article presents a comprehensive guide to operational security, covering essential habits, a layered technical architecture, access‑control strategies, CI/CD safeguards, DDoS mitigation, data protection, incident‑response procedures, and collaboration with IT, security, and network teams.
This article explains Linux ACL permission management, covering the concepts, how to check and enable ACL support on partitions, and detailed commands for setting, viewing, masking, deleting, recursive, and default ACLs to securely control file and directory access for users and groups.
Learn how to build robust role‑based access control (RBAC) and attribute‑based (AUTH) permission systems in Laravel by adapting concepts from ThinkPHP, covering database schema design, route‑linked permissions, menu integration, and practical implementation tips to secure your PHP applications.
This article walks designers and developers through the challenges of permission design, explains the RBAC model and its extensions, and offers practical tips for splitting, configuring, and managing permissions to build robust, user‑friendly access control systems.
The article evaluates Kerberos, Apache Sentry, and Apache Ranger for securing Meitu’s large‑scale Hadoop ecosystem, highlighting Ranger’s comprehensive, fine‑grained, policy‑based authorization across HDFS, HBase, Hive, YARN, Storm, and Kafka, and describing its configuration, LDAP integration, and custom SDK implementation.
The article outlines a comprehensive, layered data‑security lifecycle—from secure traffic and authentication through encrypted storage, role‑based access, audit logging, and safe production‑to‑test data handling—emphasizing privacy‑compliant practices, anti‑scraping measures, secure deletion, and incremental ROI‑driven adoption for enterprises.
Youzan’s SAM permission system implements a scalable RBAC framework for its Retail platform—using binary‑encoded permission bits, micro‑service architecture, and unified menu/API checks—to flexibly assign and verify roles across PC, App, Pad, and future custom‑role scenarios, enhancing operational efficiency and security.
This article explains the fundamental nature of permissions as limited authorized access to protected resources, defines what constitutes a resource in software, outlines permission classifications by method and layer, describes the control model using receptor‑ligand analogy, and summarizes the three core components of a permission system.
This article explains the fundamental nature of permissions as limited licensed access to protected resources, defines what constitutes a resource in software, outlines resource identification and limitation, and describes permission classifications, control models, and authorization mechanisms such as role‑based access.
This article presents a comprehensive overview of cloud‑era network boundary management, detailing security challenges, unified access control concepts, endpoint protection, traffic analysis, and how automated operations and visualization platforms can reduce risk while maintaining efficient network operations.
This article explains how MongoDB’s security features—including access control, authentication, encryption, data discovery, retention policies, zone sharding, backup, monitoring, and audit logging—help organizations meet GDPR requirements while minimizing operational overhead and ensuring data sovereignty.
This article explains GDPR's key principles, the Discover‑Defend‑Detect framework, and concrete database controls such as data identification, retention, pseudonymisation, encryption, access control, disaster recovery, and audit logging needed to achieve compliance.
Guardian 5.0 transforms big‑data security by introducing a standalone service, an enhanced ARBAC model, fine‑grained permission and quota management, visual configuration, unified LDAP/Kerberos authentication, and simplified operations, delivering higher flexibility, availability, and efficiency for enterprise data protection.
This article explains the background, installation, certificate generation, Elasticsearch and Kibana configuration, role mapping, performance testing, and final recommendations for securing an Elasticsearch 5.1.1 cluster with the open‑source Search Guard plugin, focusing on index‑level access control and RPC traffic encryption.
This article outlines a comprehensive, multi‑layered security framework for operations teams, covering policy design, dual‑account permission separation, grid‑based vulnerability management, topology and network safeguards, OS and database hardening, common misconceptions, and actionable principles for maintaining robust protection.
This article outlines eight practical measures—including changing the default port, blocking public access, running MongoDB under non‑root users, enabling authentication, tightening permissions, implementing robust backup and recovery plans, and encrypting sensitive data—to dramatically improve MongoDB security and keep ransomware at bay.
This article presents the design, implementation, and ongoing improvements of Qunar's network device operations platform, detailing its background, optimization strategies, permission model, automated tasks, monitoring capabilities, and how it enhances operational efficiency while reducing risk.
This guide outlines essential MySQL security measures—including removing default accounts, disabling unsafe LOCAL INFILE commands, enforcing strict user role permissions, encrypting sensitive data, ensuring data integrity through replication and backups, and standardizing operational practices—to protect database assets from irreversible breaches.
In the era of big data, banks face unprecedented information security challenges due to massive, valuable, and highly damaging data breaches, and must adopt encryption, flexible access control, rigorous auditing, DLP solutions, strict data management, and robust outsourcing controls to safeguard customer information.
This article explains why protecting database‑stored sensitive data is critical, analyzes common attack vectors and breach statistics, and provides detailed logical and physical security measures—including user and permission management, auditing, encryption, disaster‑recovery planning, and Oracle replication technologies—to help organizations achieve comprehensive database protection.
To protect MySQL databases from unauthorized access and performance issues, this guide outlines fourteen essential security measures—including restricting remote access, regular backups, disabling default accounts, tightening user privileges, securing configuration files, and enabling logging—providing concrete commands and configuration snippets for robust protection.
The article outlines a real‑world scenario where a small company's database was directly reachable from the Internet, then presents a redesign that inserts an intermediate database, restricts firewall access, and enforces strict credential management to protect sensitive data.
This guide outlines practical MySQL hardening techniques—including restricting remote access, regular backups, disabling unsafe features, managing root credentials, removing test databases, and applying security patches—to protect data integrity and prevent unauthorized intrusion.
This article introduces CrazyEye, an open‑source bastion host that centralizes permission and audit management for large server fleets, explains its key features such as fine‑grained access control, command logging, and batch operations, and provides setup screenshots and the Git repository link.
A DBA community debate examines whether developers should be allowed to touch production databases, weighing the dangers of unrestricted access against the need for troubleshooting, and outlines practical policies, approval processes, and separation‑of‑duty safeguards to protect data integrity.
This article explains how to objectively assess cloud service reliability by examining three key aspects—availability, access control, and disaster recovery—and provides practical strategies such as redundancy design, gradual deployment, automation, and robust backup to improve overall cloud service trustworthiness.
This guide demonstrates how to configure an access control list (ACL) with specific deny rules, traffic classifiers, behaviors, and policies on an internal interface, and notes that the same setup can be created easily via a web page.
This article summarizes a comprehensive ops security talk that breaks down network segmentation, system hardening, and permission management into layered defenses, offering practical guidance on VLANs, ACLs, least‑privilege principles, and account auditing for robust enterprise protection.
This guide walks through Apache httpd setup on CentOS, covering virtual host types (IP‑based, port‑based, name‑based), detailed configuration steps, access control methods for users and IPs, and enabling HTTPS with SSL certificates, complete with practical command examples and testing procedures.
