The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
1answer
11 views

Audit logging for OpenLDAP changes

How can I produce and examine an audit trail of changes made to an OpenLDAP database, such as which user was created when, by whom, when was it edited, what was edited etc?
0
votes
0answers
19 views

How to monitor keystrokes of an lxc guest that is connected via ssh?

I have an unprivileged LXC container which runs an SSH server (both LXC guest and LXC host are Ubuntu 14 servers) . The ports to connect to the container are forwarded, so one can connect from outside ...
0
votes
1answer
34 views

Set up auditing on Windows Server 2012 R2: logging on, logging off, open, read, write, etc. (Sucesses and failures)

I have enabled auditing on Windows Server 2012 R2 (domain controller) but liked warned, there are just way too many events being generated and it really doesnt tell me anything or just too troublesome ...
0
votes
0answers
34 views

389DS Access.log parsing - turning LDAP request type into an audit event

Has anyone authored code to parse a 389 Directory Server's access.log file with an aim of generating audit events based around the LDAP request type. Bascially, take the log sequence ...
0
votes
0answers
29 views

how to get info on failed authentication to domain - security audit?

Setup: 1 Windows Server 2012 box as Domain Controller, named DC1. 2 Windows Server 2012 R2 boxes, S1 and S2, on the same network, same config, joined to the domain. Issue: At random times, S1, S2 or ...
0
votes
0answers
13 views

Debug or audit SDDL setting of a service

I have set a custom SDDL for a service, that contains an entry with custom SID, and after checking that new SDDL grants that SID remote restart rights I went off for a night, and today I have ...
1
vote
1answer
20 views

AWS Firewall Configuration Review

We had a situation where an incorrect AWS firewall rule buried in our configuration was causing some headaches. After a few days we found the rule and fixed it. Does anyone know of a good way to ...
0
votes
2answers
19 views

How can I audit Ip adresses of users logging into system?

I have a group of servers which use Kerberos for authentication. We distribute keytabs to users but want to ensure that a user never pass their keytab to someone else. Essentially we need to audit the ...
0
votes
0answers
53 views

why is ip address sometimes missing from Security audit log Source Network address for log on audit failures?

Most of the time when someone who is not authorized attempts to log on to my Windows 2008 R2 web server, an ip address is displayed. With the ip address, i can easily block the external host from ...
2
votes
1answer
30 views

Checking Who Applied GPO

I know how to check what GPOs are applied on systems and users, but I'm wondering, is there a way to check who applied a specific GPO?
0
votes
0answers
40 views

Domain Administrator Login - Unknown Source

I'm trying to clear out all traces of old legacy settings from a new Domain I've inherited. One of my pet hates is using the Domain Administrator account for tasks, services, etc. I've managed to get ...
1
vote
0answers
53 views

what are the advantages and disadvantages of auditing mailboxes in exchange server?

I want to know the pros and the cons of enabling this feature in our exchange server 2010. Primarily we would like to start of with few mailboxes first, I am aware that the login logos will require ...
0
votes
1answer
58 views

Strange SECCOMP entries for sshd in audit log

I'm seeing strange entries for sshd in my audit logs along the lines of: type=SECCOMP audit(1433519794.902:46): auid=20003 uid=22 gid=22 ses=21 pid=25136 comm="sshd" exe="/usr /sbin/sshd" sig=31 ...
2
votes
1answer
53 views

Audit logs are not being generated on linux machine

Hi We are using four linux servers for on application. Application just simply generates reports using scripts... Now for three servers audit logs are being generated in /var/log/audit directory (as ...
1
vote
2answers
40 views

Is there a reverse Proxy for REST interfaces, which requires approval?

My organization employs a number of services that expose REST interfaces. POST, PUT or DELETE requests to such an interface can be destructive. Using firewalls and user authentication, we can restrict ...
1
vote
1answer
30 views

Audit what version of Remote Desktop users are using

we're trying to find out if there's any specific way to audit what version of remote desktop users are connecting with to a terminal server. You can find the version number manually by right clicking ...
0
votes
1answer
2k views

Event 4625 Audit Failure NULL SID failed network logons

In 3 separate systems, the following event is being logged many times (between 30 to 4,000 times a day depending on the system) on the domain controller server: An account failed to log on. Subject: ...
0
votes
1answer
58 views

Remote Desktop Connection Audit [closed]

My company recently fired someone. They said, they are auditing that person's electronic activity. We all have Remote Desktop connections that we use to work from home. Do you know what level of ...
0
votes
0answers
51 views

Auditing user commands with ip address

i have to set auditing system to my firm's server. Server runs Debian Wheezy. I'm working on "auditd" system on server. I have only two rule. # Log any command run on this system -a exit,always ...
2
votes
4answers
176 views

How to get Microsoft license authentication for all machines on a network?

We have a small network (~150 desktops, ~20 servers) much of which is Linux. MS keeps wanting to audit our MS products every 3 years or so. I really don't have time to go around to 80-90 desktops and ...
0
votes
0answers
96 views

event 4656 even though handle manipulation auditing is disabled

windows server 2012R2 auditpol /set /subcategory:"Handle Manipulation" /Success:Disabled /Failure:Disabled still getting events 4656 "A handle to an object was requested." any ideas?
0
votes
2answers
101 views

ssh pass original user to environment on server [closed]

First off, i do not know wether passing the information to the environment is the best approach, so i will start by detailing what i actually want to achieve. on a corporate scale, there are servers ...
2
votes
1answer
75 views

What is causing WMI to delete registry keys

on one of our servers registry keys keep disappearing. These keys contain certificate keys for our sophos av management console and parts of the enterprise console stop working after each reboot (the ...
-1
votes
0answers
14 views

Auditing tool for Windows security policies [closed]

What tools do you use to audit Windows security policies. For example, I configured a Windows machine (A) with the policies (GPO security policies) that we want. (A) now is a baseline. How then could ...
2
votes
1answer
106 views

Monitoring Linux system Calls (efficiently)

What is the fastest way to monitor linux system calls and log them to a file? This post has some great info: Monitoring system calls (in a reliable and secure way) It's seems that the Audit ...
0
votes
0answers
57 views

File Auditing in Cluster Shared Volumes

I'm trying to simply enable file auditing on a windows share (2012 R2)on top of cluster shared volume. But it doesn't behave as I expected it to behave. Here's the story: I enabled file auditing ...
0
votes
1answer
69 views

Configure account event auditing with Secedit

I'm currently putting together a number of PS scripts which can be run against a new webserver in order to harden it prior to it being placed in production. One of these scripts will launch secedit ...
0
votes
1answer
86 views

Monitor root commands issued by users

I tried to log the commands issued by the system administrators in our organization and its output using sudo plus the log_output directive as follows on the visudo file Defaults env_reset ...
2
votes
1answer
442 views

Domain member server causing continuous login failure for Administrator account

One of our domain member servers keeps producing continuous login failures (caught in Event viewer via Audit Policy) almost every minute. Here's a typical failure log (names & IPs obfuscated): ...
1
vote
3answers
950 views

Logon attempts - Tons of failure audits in Event Viewer on Domain Controller (Server 2003)

This is what the event looks like, under Security logs. There are tons of them. Is someone trying to brute force the network? This server is also used as a terminal services server.. Thanks any advice ...
4
votes
1answer
573 views

How to determine new file name from audit log on renaming?

[Windows 2008 R2 File System audit] When I delete the file, two event log audit messages appear: 4663 which means request for file deletion and 4660 which confirms the deletion. Thay can be joined by ...
2
votes
1answer
748 views

Auditctl - filtering out cron messages

Im using auditctl and get a lot of logging events for crond. I do not wish to log any cron/crond events. node=127.0.0.1 type=CRED_DISP msg=audit(1405678801.149:5571): user pid=1757 uid=0 auid=0 ...
2
votes
1answer
141 views

auditctl - logging when a user logs out

Is it possible to log when a user logs out of a session on Linux using Auditctl? My current audit.rules relating to users are: -w /etc/login.defs -p xwa -k login -w /etc/securetty -p xwa -k login -w ...
-1
votes
2answers
119 views

How to monitor and list modified files server wide for brief periods of time?

I would like to, from time to time, enable server-wide file monitoring that will show me all files being modified, updated and created while I have it running and thus simply spewing forth a list of ...
5
votes
2answers
410 views

How do I audit network connections that exceed a certain amount of traffic or bandwidth on Linux?

I've looking after some Debian boxes and occasionally I see a big spike in the network traffic. I'm graphing metrics with graphite (being fed by a sensu check which gathers per-interface metrics every ...
1
vote
2answers
2k views

How to parse audit.log using logstash

I want to use logstash to collect a log file, and the format of the file was like this: type=USER_START msg=audit(1404170401.294:157): user pid=29228 uid=0 auid=0 ses=7972 ...
-3
votes
1answer
64 views

Sysprep Forever [closed]

I want to use Windows in Audit Mode without continuing the Windows installation. Because: It's clean and fast, no Metro and others packages. It's the built-in Administrator; full permission ...
0
votes
1answer
55 views

Replacing a super user by many finer grained users (security)

I find myself in the situation where I have a super user account that can basically do everything in the domain and is set to run scheduled tasks, windows services and websites. I have inherited this ...
2
votes
0answers
767 views

Audit access to USB drives

Is there a way to audit access to USB drives with built-in windows logging? We already do GP based auditing on our server's NTFS file system, but how do we extend that to workstations? There are no ...
5
votes
3answers
352 views

Audit files on a Debian box

Is it possible to list every file on the system that does not belong to a package? or if they have been modified? Might need to use something like: apt-get, apt-files, dpkg-query, etc For context, ...
3
votes
1answer
120 views

How do you audit cloud servers?

So we have a decent number for cloud servers that are on Rackspace (numerous) accounts. I'm looking for a solution to the - What's on that server? Where is that server? How do I get to that server? I ...
1
vote
2answers
2k views

SELinux: denied { execute } for pid=2174 comm=“httpd” path=“/etc/httpd/lib/libaprutil-1.so.0.5.3”

I have problem with SELinux. setroubleshoot suggested to enable mypol.pp with semodule -i mypol.pp so apache could run. after I run the suggested command, I'm keep getting: type=AVC ...
1
vote
2answers
2k views

Restore legacy audit policies on Windows Server 2008 R2

Recently, I was trying to reduce spam of my security audits by disabling auditing of "Filtering Platform Packet Drop". In a week's time, I get enough of these audits the fill a 200Mb logfile. I tried ...
0
votes
1answer
75 views

Looking for VCS wrapper that tracks system files changing across the whole *nix OS and sends diffs through email

I need some software that looks after custom directories across the whole OS (i.e. /etc) and alerting me if someone edit something file inside. Additionally, this tool must automatically commit and ...
2
votes
1answer
2k views

How can I set audit controls on files owned by TrustedInstaller using Powershell?

I am trying to set audit controls on a number of files (listed in ACLsWin.txt) located in \%Windows%\System32 (for example, aaclient.dll) using the following Powershell script: $FileList = ...
1
vote
1answer
653 views

Simple Printer Audit Script

I'm working on Windows Server 2008 R2 and I want to create a simple script to audit the printing carried out in the company. I would like these details to be audited in an text file in a share and ...
2
votes
1answer
266 views

Cannot disable Windows 2008 R2 file access auditing

I was trying to audit file access in a Windows 2008 R2 server, and (my fault) enabled it for the entire volume (say, disk e:). Of course I was getting lots of entries in the security log, a big amount ...
0
votes
1answer
431 views

SQL Server Trace keeps outputting files

A consultant has come and gone to do some audit on our SQL server, and has left a bit of a mess here. The problem is that he did things that we don't know anything about. In the C:\Program ...
2
votes
1answer
215 views

Reporting tools for auditd [closed]

I need to set up auditing in my environment, specifically file integrity monitoring. I've tried OSSEC, but found it cumbersome. I've since discovered auditd (already installed on my CentOS 6 system) ...
0
votes
1answer
28 views

Linux / Ubuntu fingerprinting command/method(s) to identify system wide differences in hardware / packages / configurations between 2 environments

I have 2 separate environments, and some strange behaviour occurring in one environment that is not in the other. Specifically the error is related to the PHP: Fatal error: Nesting level too deep - ...