The tag has no usage guidance.

learn more… | top users | synonyms

2
votes
0answers
14 views

security audit flags redhat/centos package version numbers despite patches

Redhat has this policy of backporting security fixes. But then when RHEL and CentOS sites get audited, the auditors invariably just list the package versions or ask ssh what it's version number is, ...
1
vote
1answer
93 views

How to enable syscall auditing in CoreOs?

Since CoreOs 766, the auditing subsystem is partially integrated: The audit subsystem has been enabled in the kernel and auditctl added to the image. Most audit events are ignored by default. ...
2
votes
2answers
92 views

How to log all commands run on Linux including their arguments (parameters)? [duplicate]

How can I log all commands executed on Linux, including their command-line arguments (parameters)? So, for example, if someone runs: rm -rf /tmp/foo I would see a log entry similar to this: ...
1
vote
0answers
29 views

Audit IP change on a Windows machine

I want to get an audit (event in the event viewer) for every change in the IP address (static or DHCP). I tried setting an audit configuration on the registry key ...
2
votes
1answer
24 views

Do any OpenSSH 6.7 `preauth` error log entries warrant specific human attention?

A Linux (specifically Debian Jessie) server that needs to be exposed to the Internet is spitting out various OpenSSH 6.7 preauth errors in the logs. For example, I'm getting (timestamps elided for ...
0
votes
0answers
45 views

No event ID 4625 for administrator account

I'm having an issue where no 4625 Event is logged when I type an incorrect password for the domain administrator account when attempting to login to a domain controller via remote desktop. If I use a ...
0
votes
0answers
11 views

MariaDB audit log empty host

I'm running MariaDB 10.0.23 with the audit plugin logging CONNECT type. The audit log is showing a failed connect with error 1042. Does the host field not show the IP address when a host cannot be ...
0
votes
0answers
22 views

Windows Object Access Audit vs File Properties “Accessed” Date/Time

I'm attempting to audit all attempted access to a specific executable on a Windows 2008 R2 system, and have turned on success and failure auditing for all subcategories in "Object Access" in Advanced ...
0
votes
0answers
76 views

Can't start auditctl in Ubuntu 14.04

When I'm trying to start auditctl in my terminal (vds container ubuntu 14.04) I have the message: The audit system is disabled in audit.log: type=DAEMON_START msg=audit(1453274392.823:9236): ...
1
vote
0answers
71 views

How do audit file permissions changes over CIFS?

I have a few windows file servers but am slowly changing to Freenas/ZFS boxes which are working much better however I can't figure out how to audit when people change permissions to critical folders. ...
1
vote
0answers
43 views

Sending auditd records to my audispd plugin

After setting auditctl's rules, I want to send those matched records to my Python script for further analysis. auditd records: type=PATH msg=audit(1451011319.268:533): ... type=CWD ...
1
vote
0answers
24 views

Server 2008 R2 & Auditing

Having an issue with auditing a network for logins. I am looking for Event 4740 but the logs are not showing them. Neither on the local machines either. I have verified that Account Management ...
0
votes
0answers
12 views

Server 2008 - Auditing folder access not working correctly

In a nutshell, we have a Windows Server 2008 R2 fileserver. I want to audit all access to one specific folder by a specific group of 10 users. I am not running any Group policies on this server. ...
2
votes
1answer
79 views

How to log execution of a specific binary/script using auditd or other

I have the following situation in hand. I have one or more specific execuatble files in /usr/bin, I will call one /usr/bin/execute , and they may either be a compiled binary or a script file, such as ...
2
votes
1answer
1k views

How can I list MACs, Ciphers and KexAlogrithms supported by my ssh server?

How can I determine the supported MACs, Ciphers, Key length and KexAlogrithms supported by my ssh servers? I need to create a list for an external security audit. I'm looking for something similar to ...
2
votes
0answers
302 views

New Server 2012 R2 Essentials generating Audit Failure Event 4625 Null SID Logon Attempts

I am researching a failed login issue that is triggering our monitoring software. Researching the issue, the only other information I could find that was exactly what I was seeing, was on here: Event ...
0
votes
0answers
43 views

Windows Server File Share Audit

I have a file service on Windows Server 2012 R2 and I want to track these events on it: User created a file/folder User edited a file/folder or its' permissions User renamed a file/folder User ...
0
votes
1answer
65 views

When does augenrules run automatically on CentOS 7.1?

I need to update /etc/audit/audit.rules. I would replace the file restart the service, but I found in the log a call to augenrules during initial startup of the machine. Apart from the initial ...
0
votes
1answer
62 views

Missing Account audit events on DC's

I recently discovered that all of our Domain controllers (2008 R2, domain and forest fuctional level is 2008 R2) are no longer logging AD account logon events to the Security Log. The Default ...
1
vote
0answers
157 views

Windows Server 2008 R2 - Failed login auditing

I am having issue with configuring Auditing on the server in order to catch failed and successful network logins. This morning we found one of our test machines with a strange login on the locked ...
0
votes
0answers
28 views

Why is solaris auditing not working after adding new class entry

I have setup a new class entry in the audit_control, audit_class and audit_event files as below: $ grep pf /etc/security/audit_control flags:pf $ grep pf /etc/security/audit_event ...
0
votes
0answers
11 views

Flush audit logs before process termination

I configured auditd by modifying /etc/pam.d/common-auth: session required pam_loginuid.so session required pam_tty_audit.so enable=* The logging works fine. The issue is that the log is not written ...
1
vote
0answers
31 views

Best practices / settings to create “Read-Only” Admin role for auditors and similar

I am trying very diligently to remove as many over-privileged accounts/roles in our Active Directory and Windows (server and desktop) environment. This means retiring as many users as possible from ...
0
votes
0answers
14 views

Exchange 2010 Public Folder Auditing

Quick Question - I know how to turn on Diagnostic Logging within Exchange 2010 for Public folders (9001 Public Store) - General. However, I am wondering does the General category set to 5 or higher ...
1
vote
1answer
36 views

Check whether GRANT EXECUTE TO user or role was applied

In Microsoft SQL Server, I can use GRANT EXECUTE TO <principal> to grant execute permission to some user or role. I'm interested in detection: How can I equally simply check whether that ...
1
vote
2answers
330 views

How to audit file and folder deletes on Windows Server 2008 r2

I need to enable auditing of delete actions on a specific network shared folder (and all its children) on a Windows Server 2008 r2 machine. The closest I could find was this article - ...
1
vote
1answer
72 views

Window Logs - Is any event logged when a user overwrites files? (Win Server 2012 R2)

Is any event logged when a user/process overwrites files? (Win Server 2012 R2)
0
votes
0answers
12 views

Audit Group Object Use?

Say you have a Security group. It's undocumented, nobody knows "what" it does, but everybody "knows" it is used for something. If some application (SQL Server or some random web app) for instance, ...
1
vote
0answers
229 views

Audit trail for all actions taken with admin privileges

PCI DSS 10.2 says, "Implement automated audit trails for all system components to reconstruct the following events:" and 10.2.2 continues, "All actions taken by any individual with root or ...
2
votes
0answers
80 views

Why does ausearch skip entries?

I am trying to use the ausearch tool search my auditd logs for specific entries. The problem is that most of the entries in audit.log appear to be unsearchable. Searching with matching parameters ...
0
votes
1answer
31 views

Audit logging for OpenLDAP changes

How can I produce and examine an audit trail of changes made to an OpenLDAP database, such as which user was created when, by whom, when was it edited, what was edited etc?
0
votes
0answers
58 views

How to monitor keystrokes of an lxc guest that is connected via ssh?

I have an unprivileged LXC container which runs an SSH server (both LXC guest and LXC host are Ubuntu 14 servers) . The ports to connect to the container are forwarded, so one can connect from outside ...
0
votes
1answer
324 views

Set up auditing on Windows Server 2012 R2: logging on, logging off, open, read, write, etc. (Sucesses and failures)

I have enabled auditing on Windows Server 2012 R2 (domain controller) but liked warned, there are just way too many events being generated and it really doesnt tell me anything or just too troublesome ...
0
votes
1answer
113 views

389DS Access.log parsing - turning LDAP request type into an audit event

Has anyone authored code to parse a 389 Directory Server's access.log file with an aim of generating audit events based around the LDAP request type. Bascially, take the log sequence ...
0
votes
0answers
53 views

how to get info on failed authentication to domain - security audit?

Setup: 1 Windows Server 2012 box as Domain Controller, named DC1. 2 Windows Server 2012 R2 boxes, S1 and S2, on the same network, same config, joined to the domain. Issue: At random times, S1, S2 or ...
0
votes
0answers
29 views

Debug or audit SDDL setting of a service

I have set a custom SDDL for a service, that contains an entry with custom SID, and after checking that new SDDL grants that SID remote restart rights I went off for a night, and today I have ...
1
vote
1answer
43 views

AWS Firewall Configuration Review

We had a situation where an incorrect AWS firewall rule buried in our configuration was causing some headaches. After a few days we found the rule and fixed it. Does anyone know of a good way to ...
0
votes
2answers
27 views

How can I audit Ip adresses of users logging into system?

I have a group of servers which use Kerberos for authentication. We distribute keytabs to users but want to ensure that a user never pass their keytab to someone else. Essentially we need to audit the ...
0
votes
0answers
313 views

why is ip address sometimes missing from Security audit log Source Network address for log on audit failures?

Most of the time when someone who is not authorized attempts to log on to my Windows 2008 R2 web server, an ip address is displayed. With the ip address, i can easily block the external host from ...
2
votes
1answer
34 views

Checking Who Applied GPO

I know how to check what GPOs are applied on systems and users, but I'm wondering, is there a way to check who applied a specific GPO?
0
votes
0answers
126 views

Domain Administrator Login - Unknown Source

I'm trying to clear out all traces of old legacy settings from a new Domain I've inherited. One of my pet hates is using the Domain Administrator account for tasks, services, etc. I've managed to get ...
1
vote
0answers
132 views

what are the advantages and disadvantages of auditing mailboxes in exchange server?

I want to know the pros and the cons of enabling this feature in our exchange server 2010. Primarily we would like to start of with few mailboxes first, I am aware that the login logos will require ...
1
vote
1answer
124 views

Strange SECCOMP entries for sshd in audit log

I'm seeing strange entries for sshd in my audit logs along the lines of: type=SECCOMP audit(1433519794.902:46): auid=20003 uid=22 gid=22 ses=21 pid=25136 comm="sshd" exe="/usr/sbin/sshd" sig=31 ...
2
votes
1answer
155 views

Audit logs are not being generated on linux machine

Hi We are using four linux servers for on application. Application just simply generates reports using scripts... Now for three servers audit logs are being generated in /var/log/audit directory (as ...
2
votes
2answers
204 views

Is there a reverse Proxy for REST interfaces, which requires approval?

My organization employs a number of services that expose REST interfaces. POST, PUT or DELETE requests to such an interface can be destructive. Using firewalls and user authentication, we can restrict ...
1
vote
2answers
126 views

Audit what version of Remote Desktop users are using

we're trying to find out if there's any specific way to audit what version of remote desktop users are connecting with to a terminal server. You can find the version number manually by right clicking ...
1
vote
2answers
15k views

Event 4625 Audit Failure NULL SID failed network logons

In 3 separate systems, the following event is being logged many times (between 30 to 4,000 times a day depending on the system) on the domain controller server: An account failed to log on. Subject: ...
0
votes
1answer
68 views

Remote Desktop Connection Audit [closed]

My company recently fired someone. They said, they are auditing that person's electronic activity. We all have Remote Desktop connections that we use to work from home. Do you know what level of ...
2
votes
4answers
476 views

How to get Microsoft license authentication for all machines on a network?

We have a small network (~150 desktops, ~20 servers) much of which is Linux. MS keeps wanting to audit our MS products every 3 years or so. I really don't have time to go around to 80-90 desktops and ...
0
votes
0answers
252 views

event 4656 even though handle manipulation auditing is disabled

windows server 2012R2 auditpol /set /subcategory:"Handle Manipulation" /Success:Disabled /Failure:Disabled still getting events 4656 "A handle to an object was requested." any ideas?