The tag has no wiki summary.

learn more… | top users | synonyms

2
votes
0answers
65 views

Audit access to USB drives

Is there a way to audit access to USB drives with built-in windows logging? We already do GP based auditing on our server's NTFS file system, but how do we extend that to workstations? There are no ...
5
votes
3answers
108 views

Audit files on a Debian box

Is it possible to list every file on the system that does not belong to a package? or if they have been modified? Might need to use something like: apt-get, apt-files, dpkg-query, etc For context, ...
3
votes
1answer
65 views

How do you audit cloud servers?

So we have a decent number for cloud servers that are on Rackspace (numerous) accounts. I'm looking for a solution to the - What's on that server? Where is that server? How do I get to that server? I ...
1
vote
2answers
101 views

SELinux: denied { execute } for pid=2174 comm=“httpd” path=“/etc/httpd/lib/libaprutil-1.so.0.5.3”

I have problem with SELinux. setroubleshoot suggested to enable mypol.pp with semodule -i mypol.pp so apache could run. after I run the suggested command, I'm keep getting: type=AVC ...
0
votes
1answer
81 views

Restore legacy audit policies on Windows Server 2008 R2

Recently, I was trying to reduce spam of my security audits by disabling auditing of "Filtering Platform Packet Drop". In a week's time, I get enough of these audits the fill a 200Mb logfile. I tried ...
0
votes
0answers
61 views

Audit file removal (auditctl)

For some reason, some script or program is removing a pid file for the service on the linux server (centos5.4 / 2.6.18-308.4.1.el5xen). I suspect a faulty cron script, but manual investigation did not ...
0
votes
1answer
53 views

Looking for VCS wrapper that tracks system files changing across the whole *nix OS and sends diffs through email

I need some software that looks after custom directories across the whole OS (i.e. /etc) and alerting me if someone edit something file inside. Additionally, this tool must automatically commit and ...
2
votes
1answer
320 views

How can I set audit controls on files owned by TrustedInstaller using Powershell?

I am trying to set audit controls on a number of files (listed in ACLsWin.txt) located in \%Windows%\System32 (for example, aaclient.dll) using the following Powershell script: $FileList = ...
0
votes
0answers
126 views

Linux audit failure flag ignored? (can't silence printk)

We're using the Linux audit subsystem to monitor process execution. # in audit.rules -a exit,always -F arch=b32 -F subj_user=unconfined_u -S execve -a exit,always -F arch=b64 -F ...
1
vote
1answer
159 views

Simple Printer Audit Script

I'm working on Windows Server 2008 R2 and I want to create a simple script to audit the printing carried out in the company. I would like these details to be audited in an text file in a share and ...
2
votes
1answer
108 views

Cannot disable Windows 2008 R2 file access auditing

I was trying to audit file access in a Windows 2008 R2 server, and (my fault) enabled it for the entire volume (say, disk e:). Of course I was getting lots of entries in the security log, a big amount ...
0
votes
1answer
74 views

SQL Server Trace keeps outputting files

A consultant has come and gone to do some audit on our SQL server, and has left a bit of a mess here. The problem is that he did things that we don't know anything about. In the C:\Program ...
2
votes
1answer
81 views

Reporting tools for auditd [closed]

I need to set up auditing in my environment, specifically file integrity monitoring. I've tried OSSEC, but found it cumbersome. I've since discovered auditd (already installed on my CentOS 6 system) ...
0
votes
1answer
21 views

Linux / Ubuntu fingerprinting command/method(s) to identify system wide differences in hardware / packages / configurations between 2 environments

I have 2 separate environments, and some strange behaviour occurring in one environment that is not in the other. Specifically the error is related to the PHP: Fatal error: Nesting level too deep - ...
3
votes
3answers
198 views

Logging when limit Exceeds

Is there a log file that logs information when the values set in /etc/security/limits.conf are exceeded? If the values are too tight in the above file the clients using the website hosted on the ...
0
votes
1answer
51 views

Log Review Process

Currently I have a fairly large syslog-ng cluster setup that is my main log aggregation point. I have the need to be able to acknowledge certain logs and mark them as review for auditing purposes. ...
2
votes
2answers
69 views

Windows 2008 file server: How to find unused permissions?

Following some security breach in my office and stealing data from the company, my manager gave me the task of finding all the folders on the file server which users have read access to and they ...
0
votes
0answers
28 views

Can't access Oracle Audit Server Interface. NICs are not linked (Hyper-V Manager VM)

I have Oracle Audit Vault Server installed and and running on its VM on Hyper-V Manager, but there is a problem with the NICs. I can't access the server through its IP address. It seemed obvious in ...
4
votes
4answers
124 views

Is it possible to audit the Amazon AWS console?

We had a situation recently where an elastic IP address assigned to a production server mysteriously became disassociated from that server. We have had this same thing happen in the past to other ...
0
votes
1answer
113 views

Integrity checking vs. audit

In RHEL5 Security Guide using of AIDE for checking software integrity is recomended. And also built-in RPM integrity checking functionality. But frequent checking can be resource demanding and rare ...
2
votes
1answer
76 views

Does Windows contain default System ACLs for auditing purposes?

While trying to test SACL creation on a filesystem object, I noticed that it was not logging to the event log. After some digging, I found that I had to flip the "master switch" in Local Security ...
0
votes
1answer
44 views

Win 2008r2 Audit

I'm trying to turn on auditing but every time i check Success and failure in Local policy / Computer Conf/Windows settings/security settings/local policies/Audit Policy/ Audit Object access, it turns ...
5
votes
2answers
261 views

What does a standard tech audit include and what is a reasonable price for it?

I am a programmer, but the company I am working for has been growing and has outgrown the 2 man IT contractor team that has been servicing us. We are looking into several different solutions for our ...
1
vote
1answer
108 views

mysql logging activity from specific user or ip

I have mysql server. The server is accessed by my application, and by external auditor (person using mysql workbench). The auditor has specific user and password and dedicated IP and it is granted ...
12
votes
7answers
927 views

How do you document/track your permissions

I'm a Windows Admin so those that integrate with Windows will likely be most helpful. My main challenge at this point is just with file shares but as SharePoint use increases it will only make this ...
3
votes
1answer
202 views

How to view / enumerate / obtain a list of all effective rights / permissions on an Active Directory object?

I am new to Server Fault and was hoping to find an answer to a question that I have been struggling with for the past week or so. I have been recently asked by my management to furnish a list of all ...
0
votes
2answers
85 views

Security: How to improve security of Linux servers when few resident developers need shell access? [duplicate]

Possible Duplicate: SysAdmin & Developer: Responsibilities Suppose, I have 20 servers: We keep data in Linux servers Developers often need to Login to the server to debug some issue ...
10
votes
4answers
884 views

Git commit auditing

I have a git server running over ssh and each user has a unix account on the system. Given that two users have access to a repo, how can I be sure which user performed which commit, since the commit ...
1
vote
1answer
118 views

central log-server with auditdisp

I want to setup a central log-server. The log-server is running with debian 6.0.6 and the audit daemon is installed in version 1.7.13-1. The Clients are running with Red Hat 5.5 and they connect to ...
2
votes
1answer
301 views

SELinux - Allow multiple services access to same /home/dir

I currently have SELinux enabled and have been able to configure apache to allow access to /home/src/web with a chcon command granting the 'httpd_sys_content_t' type. But now I am trying to serve the ...
1
vote
0answers
95 views

Exchange Admin Audit log

i was looking at the admin audit logs today and found it very usefull. But it doesn't include the source computer launching the commands. An example, i have the EMC on my computer modifying some ...
0
votes
2answers
136 views

Logging shell command executed by all users on Linux server [duplicate]

Possible Duplicate: How to log every linux command to a logserver I want to log the commands executed by all users on the server. Is there any better way than using script command?
1
vote
2answers
87 views

Replay the logs created by script?

In our RedHat server, we ave enabled user session logging using script and it's logging the user sessions. But I can't find scriptreplay to play the logs recorded. How to read/play the logs ?
6
votes
4answers
393 views

Penetration Testing - Trust and Hiring

When you hire someone/business to come in how can you be sure they won't have a rogue employee who will backdoor your systems? Is there a way you can trust anyone? How do big corporations do it? Seems ...
1
vote
0answers
221 views

USER_LOGIN audit log with incorrect auid value?

We have a CentOS 6.2 x86_64 system that's logging what looks to be erroneous audit information. We were receiving alerts for failed logins by a user who wasn't actually trying to log in. After some ...
0
votes
1answer
253 views

Rebuilding a file if files have changed

I'm having a hard time wrapping my head around this. It seems trivial, but I'm not getting it. I have two files. If either of those two files changes, I want to rebuild one of them. Essentially: ...
3
votes
2answers
2k views

Unable to start auditd

I am on CentOS 5.8 final I recently installed auditd via yum install audit however I am unable to start it. I edited the configuration file to give a verbose output of the error it is recieving in ...
2
votes
1answer
355 views

linux audit - exclude a process that updates the time

I have set my auditd rules to log when the system time is changed However, our servers are VMs and thus have problems with the time drifting out. We needed to solve this issue so we used a VMware ...
1
vote
1answer
227 views

Dynamics CRM 2011 On-Premise & Security Certifications (ISO 27001, SAS70, etc)

I'm unclear on how to properly word our security status. The data center our hosted IFD CRM instance is running on has not paid for these audits. However, the Microsoft literature suggests that CRM ...
2
votes
3answers
4k views

Windows Server 2008R2 - Auditing changes to a service account

I want to setup auditing so I can see if any changes are being made to a service account (any changes) in AD which is used to run a backup application. What do I need to enable in Group Policy ...
1
vote
3answers
112 views

How to see when what processes have accessed certain files

There is a directory on our server where we manually copy files to, and then some magical procedure runs at night to process these fiels and rename them. This was setup before I got here, and I can't ...
5
votes
3answers
675 views

Security when SSH private keys are lost

User A has two SSH private keys, and over time has used this public key on a number of servers He lost one of them, and has created a new pair. How does User A inform me (the sysadmin), that he has ...
1
vote
1answer
75 views

How can I see which applications have accessed a certain file within a given time period on Linux?

Is it possible on Linux to find out which applications have accessed a certain file in the last 24 hours? I've come with a few possible solutions: Watch lsof. It works, but it's constrained to ...
-1
votes
1answer
36 views

Where do I see a log of user connections to PC in Windows Server 2008 Event Log Viewer?

Event Log Viewer is listing a bunch of infos but where am I supposed to see the list of user connections to PC in Windows Server 2008 ?
1
vote
1answer
465 views

What does sysprep do on Win2k8 with /audit?

Windows 2008 R2 host running Hyper-V. I meant to run "sysprep /audit /reboot" on one of the virtual machines, but ended up running that on the host (doing this through 2 layers of RDP - bad idea). The ...
1
vote
2answers
391 views

Tracking files/folders changes on the system

I've been wondering as to how can I track changes done to files located at certain directory (including subdirectories if any). I am specially interested in file modifications rather than ...
3
votes
1answer
70 views

How do I check whether an administrator has viewed the security audit log?

A colleague and I have been discussing an IS audit demo on Windows. One point we'd like to cover is that an administrative/high-privilege user should view the security log within X hours of a failure ...
6
votes
1answer
6k views

Server locking up, /var/log/messages reports “backlog limit exceeded”

We have a CentOS OS that became unresponsive this morning to external network traffic. It is a virtual machine. I was able to reboot the VM. After logging back in, I found the following in the ...
2
votes
2answers
336 views

Auditing changes to the audit log

I have configured auditd for PCI compliance reasons PCI states that existing logs cannot be changed without generating an alert This article ...
1
vote
6answers
262 views

Network Administration and Auditing Tools

We're a small company (~50) who outsource the bulk of our IT to an... average quality provider. I am taking on the role of day-to-day IT (think of things that can be fixed in 15 mins or less only). ...