The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
0answers
29 views

How to determine new file name from audit log on renaming?

[Windows 2008 R2 File System audit] When I delete the file, two event log audit messages appear: 4663 which means request for file deletion and 4660 which confirms the deletion. Thay can be joined by ...
1
vote
0answers
80 views

Auditctl - filtering out cron messages

Im using auditctl and get a lot of logging events for crond. I do not wish to log any cron/crond events. node=127.0.0.1 type=CRED_DISP msg=audit(1405678801.149:5571): user pid=1757 uid=0 auid=0 ...
2
votes
1answer
28 views

auditctl - logging when a user logs out

Is it possible to log when a user logs out of a session on Linux using Auditctl? My current audit.rules relating to users are: -w /etc/login.defs -p xwa -k login -w /etc/securetty -p xwa -k login -w ...
-2
votes
2answers
39 views

How to monitor and list modified files server wide for brief periods of time?

I would like to, from time to time, enable server-wide file monitoring that will show me all files being modified, updated and created while I have it running and thus simply spewing forth a list of ...
5
votes
2answers
277 views

How do I audit network connections that exceed a certain amount of traffic or bandwidth on Linux?

I've looking after some Debian boxes and occasionally I see a big spike in the network traffic. I'm graphing metrics with graphite (being fed by a sensu check which gathers per-interface metrics every ...
1
vote
1answer
162 views

How to parse audit.log using logstash

I want to use logstash to collect a log file, and the format of the file was like this: type=USER_START msg=audit(1404170401.294:157): user pid=29228 uid=0 auid=0 ses=7972 ...
-3
votes
1answer
45 views

Sysprep Forever [closed]

I want to use Windows in Audit Mode without continuing the Windows installation. Because: It's clean and fast, no Metro and others packages. It's the built-in Administrator; full permission ...
0
votes
0answers
107 views

Setup CENTOS Centralized AUDIT and RSYSLOG server

Attempting to use these links: Sending audit logs to SYSLOG server or http://wiki.rsyslog.com/index.php/Centralizing_the_audit_log I have been unable to get centralized AUDIT logging to work on my ...
0
votes
1answer
49 views

Replacing a super user by many finer grained users (security)

I find myself in the situation where I have a super user account that can basically do everything in the domain and is set to run scheduled tasks, windows services and websites. I have inherited this ...
2
votes
0answers
239 views

Audit access to USB drives

Is there a way to audit access to USB drives with built-in windows logging? We already do GP based auditing on our server's NTFS file system, but how do we extend that to workstations? There are no ...
5
votes
3answers
167 views

Audit files on a Debian box

Is it possible to list every file on the system that does not belong to a package? or if they have been modified? Might need to use something like: apt-get, apt-files, dpkg-query, etc For context, ...
3
votes
1answer
73 views

How do you audit cloud servers?

So we have a decent number for cloud servers that are on Rackspace (numerous) accounts. I'm looking for a solution to the - What's on that server? Where is that server? How do I get to that server? I ...
1
vote
2answers
358 views

SELinux: denied { execute } for pid=2174 comm=“httpd” path=“/etc/httpd/lib/libaprutil-1.so.0.5.3”

I have problem with SELinux. setroubleshoot suggested to enable mypol.pp with semodule -i mypol.pp so apache could run. after I run the suggested command, I'm keep getting: type=AVC ...
0
votes
1answer
272 views

Restore legacy audit policies on Windows Server 2008 R2

Recently, I was trying to reduce spam of my security audits by disabling auditing of "Filtering Platform Packet Drop". In a week's time, I get enough of these audits the fill a 200Mb logfile. I tried ...
0
votes
0answers
88 views

Audit file removal (auditctl)

For some reason, some script or program is removing a pid file for the service on the linux server (centos5.4 / 2.6.18-308.4.1.el5xen). I suspect a faulty cron script, but manual investigation did not ...
0
votes
1answer
63 views

Looking for VCS wrapper that tracks system files changing across the whole *nix OS and sends diffs through email

I need some software that looks after custom directories across the whole OS (i.e. /etc) and alerting me if someone edit something file inside. Additionally, this tool must automatically commit and ...
2
votes
1answer
661 views

How can I set audit controls on files owned by TrustedInstaller using Powershell?

I am trying to set audit controls on a number of files (listed in ACLsWin.txt) located in \%Windows%\System32 (for example, aaclient.dll) using the following Powershell script: $FileList = ...
0
votes
0answers
169 views

Linux audit failure flag ignored? (can't silence printk)

We're using the Linux audit subsystem to monitor process execution. # in audit.rules -a exit,always -F arch=b32 -F subj_user=unconfined_u -S execve -a exit,always -F arch=b64 -F ...
1
vote
1answer
297 views

Simple Printer Audit Script

I'm working on Windows Server 2008 R2 and I want to create a simple script to audit the printing carried out in the company. I would like these details to be audited in an text file in a share and ...
2
votes
1answer
147 views

Cannot disable Windows 2008 R2 file access auditing

I was trying to audit file access in a Windows 2008 R2 server, and (my fault) enabled it for the entire volume (say, disk e:). Of course I was getting lots of entries in the security log, a big amount ...
0
votes
1answer
129 views

SQL Server Trace keeps outputting files

A consultant has come and gone to do some audit on our SQL server, and has left a bit of a mess here. The problem is that he did things that we don't know anything about. In the C:\Program ...
2
votes
1answer
118 views

Reporting tools for auditd [closed]

I need to set up auditing in my environment, specifically file integrity monitoring. I've tried OSSEC, but found it cumbersome. I've since discovered auditd (already installed on my CentOS 6 system) ...
0
votes
1answer
22 views

Linux / Ubuntu fingerprinting command/method(s) to identify system wide differences in hardware / packages / configurations between 2 environments

I have 2 separate environments, and some strange behaviour occurring in one environment that is not in the other. Specifically the error is related to the PHP: Fatal error: Nesting level too deep - ...
3
votes
3answers
211 views

Logging when limit Exceeds

Is there a log file that logs information when the values set in /etc/security/limits.conf are exceeded? If the values are too tight in the above file the clients using the website hosted on the ...
0
votes
1answer
54 views

Log Review Process

Currently I have a fairly large syslog-ng cluster setup that is my main log aggregation point. I have the need to be able to acknowledge certain logs and mark them as review for auditing purposes. ...
2
votes
2answers
84 views

Windows 2008 file server: How to find unused permissions?

Following some security breach in my office and stealing data from the company, my manager gave me the task of finding all the folders on the file server which users have read access to and they ...
4
votes
4answers
152 views

Is it possible to audit the Amazon AWS console?

We had a situation recently where an elastic IP address assigned to a production server mysteriously became disassociated from that server. We have had this same thing happen in the past to other ...
0
votes
1answer
182 views

Integrity checking vs. audit

In RHEL5 Security Guide using of AIDE for checking software integrity is recomended. And also built-in RPM integrity checking functionality. But frequent checking can be resource demanding and rare ...
2
votes
1answer
90 views

Does Windows contain default System ACLs for auditing purposes?

While trying to test SACL creation on a filesystem object, I noticed that it was not logging to the event log. After some digging, I found that I had to flip the "master switch" in Local Security ...
0
votes
1answer
52 views

Win 2008r2 Audit

I'm trying to turn on auditing but every time i check Success and failure in Local policy / Computer Conf/Windows settings/security settings/local policies/Audit Policy/ Audit Object access, it turns ...
5
votes
2answers
332 views

What does a standard tech audit include and what is a reasonable price for it?

I am a programmer, but the company I am working for has been growing and has outgrown the 2 man IT contractor team that has been servicing us. We are looking into several different solutions for our ...
1
vote
1answer
168 views

mysql logging activity from specific user or ip

I have mysql server. The server is accessed by my application, and by external auditor (person using mysql workbench). The auditor has specific user and password and dedicated IP and it is granted ...
12
votes
7answers
1k views

How do you document/track your permissions

I'm a Windows Admin so those that integrate with Windows will likely be most helpful. My main challenge at this point is just with file shares but as SharePoint use increases it will only make this ...
3
votes
1answer
249 views

How to view / enumerate / obtain a list of all effective rights / permissions on an Active Directory object?

I am new to Server Fault and was hoping to find an answer to a question that I have been struggling with for the past week or so. I have been recently asked by my management to furnish a list of all ...
0
votes
2answers
89 views

Security: How to improve security of Linux servers when few resident developers need shell access? [duplicate]

Possible Duplicate: SysAdmin & Developer: Responsibilities Suppose, I have 20 servers: We keep data in Linux servers Developers often need to Login to the server to debug some issue ...
11
votes
4answers
1k views

Git commit auditing

I have a git server running over ssh and each user has a unix account on the system. Given that two users have access to a repo, how can I be sure which user performed which commit, since the commit ...
1
vote
1answer
136 views

central log-server with auditdisp

I want to setup a central log-server. The log-server is running with debian 6.0.6 and the audit daemon is installed in version 1.7.13-1. The Clients are running with Red Hat 5.5 and they connect to ...
2
votes
1answer
345 views

SELinux - Allow multiple services access to same /home/dir

I currently have SELinux enabled and have been able to configure apache to allow access to /home/src/web with a chcon command granting the 'httpd_sys_content_t' type. But now I am trying to serve the ...
1
vote
0answers
101 views

Exchange Admin Audit log

i was looking at the admin audit logs today and found it very usefull. But it doesn't include the source computer launching the commands. An example, i have the EMC on my computer modifying some ...
0
votes
2answers
155 views

Logging shell command executed by all users on Linux server [duplicate]

Possible Duplicate: How to log every linux command to a logserver I want to log the commands executed by all users on the server. Is there any better way than using script command?
1
vote
2answers
112 views

Replay the logs created by script?

In our RedHat server, we ave enabled user session logging using script and it's logging the user sessions. But I can't find scriptreplay to play the logs recorded. How to read/play the logs ?
6
votes
4answers
403 views

Penetration Testing - Trust and Hiring

When you hire someone/business to come in how can you be sure they won't have a rogue employee who will backdoor your systems? Is there a way you can trust anyone? How do big corporations do it? Seems ...
1
vote
0answers
251 views

USER_LOGIN audit log with incorrect auid value?

We have a CentOS 6.2 x86_64 system that's logging what looks to be erroneous audit information. We were receiving alerts for failed logins by a user who wasn't actually trying to log in. After some ...
0
votes
1answer
270 views

Rebuilding a file if files have changed

I'm having a hard time wrapping my head around this. It seems trivial, but I'm not getting it. I have two files. If either of those two files changes, I want to rebuild one of them. Essentially: ...
3
votes
2answers
2k views

Unable to start auditd

I am on CentOS 5.8 final I recently installed auditd via yum install audit however I am unable to start it. I edited the configuration file to give a verbose output of the error it is recieving in ...
3
votes
1answer
433 views

linux audit - exclude a process that updates the time

I have set my auditd rules to log when the system time is changed However, our servers are VMs and thus have problems with the time drifting out. We needed to solve this issue so we used a VMware ...
1
vote
1answer
254 views

Dynamics CRM 2011 On-Premise & Security Certifications (ISO 27001, SAS70, etc)

I'm unclear on how to properly word our security status. The data center our hosted IFD CRM instance is running on has not paid for these audits. However, the Microsoft literature suggests that CRM ...
2
votes
3answers
5k views

Windows Server 2008R2 - Auditing changes to a service account

I want to setup auditing so I can see if any changes are being made to a service account (any changes) in AD which is used to run a backup application. What do I need to enable in Group Policy ...
1
vote
3answers
124 views

How to see when what processes have accessed certain files

There is a directory on our server where we manually copy files to, and then some magical procedure runs at night to process these fiels and rename them. This was setup before I got here, and I can't ...
5
votes
3answers
865 views

Security when SSH private keys are lost

User A has two SSH private keys, and over time has used this public key on a number of servers He lost one of them, and has created a new pair. How does User A inform me (the sysadmin), that he has ...