Tagged Questions

The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
1answer
28 views

Monitor root commands issued by users

I tried to log the commands issued by the system administrators in our organization and its output using sudo plus the log_output directive as follows on the visudo file Defaults env_reset ...
2
votes
1answer
50 views

Domain member server causing continuous login failure for Administrator account

One of our domain member servers keeps producing continuous login failures (caught in Event viewer via Audit Policy) almost every minute. Here's a typical failure log (names & IPs obfuscated): ...
1
vote
3answers
81 views

Logon attempts - Tons of failure audits in Event Viewer on Domain Controller (Server 2003)

This is what the event looks like, under Security logs. There are tons of them. Is someone trying to brute force the network? This server is also used as a terminal services server.. Thanks any advice ...
1
vote
0answers
156 views

How to determine new file name from audit log on renaming?

[Windows 2008 R2 File System audit] When I delete the file, two event log audit messages appear: 4663 which means request for file deletion and 4660 which confirms the deletion. Thay can be joined by ...
1
vote
1answer
211 views

Auditctl - filtering out cron messages

Im using auditctl and get a lot of logging events for crond. I do not wish to log any cron/crond events. node=127.0.0.1 type=CRED_DISP msg=audit(1405678801.149:5571): user pid=1757 uid=0 auid=0 ...
2
votes
1answer
38 views

auditctl - logging when a user logs out

Is it possible to log when a user logs out of a session on Linux using Auditctl? My current audit.rules relating to users are: -w /etc/login.defs -p xwa -k login -w /etc/securetty -p xwa -k login -w ...
-1
votes
2answers
58 views

How to monitor and list modified files server wide for brief periods of time?

I would like to, from time to time, enable server-wide file monitoring that will show me all files being modified, updated and created while I have it running and thus simply spewing forth a list of ...
5
votes
2answers
304 views

How do I audit network connections that exceed a certain amount of traffic or bandwidth on Linux?

I've looking after some Debian boxes and occasionally I see a big spike in the network traffic. I'm graphing metrics with graphite (being fed by a sensu check which gathers per-interface metrics every ...
1
vote
1answer
536 views

How to parse audit.log using logstash

I want to use logstash to collect a log file, and the format of the file was like this: type=USER_START msg=audit(1404170401.294:157): user pid=29228 uid=0 auid=0 ses=7972 ...
-3
votes
1answer
52 views

Sysprep Forever [closed]

I want to use Windows in Audit Mode without continuing the Windows installation. Because: It's clean and fast, no Metro and others packages. It's the built-in Administrator; full permission ...
0
votes
0answers
209 views

Setup CENTOS Centralized AUDIT and RSYSLOG server

Attempting to use these links: Sending audit logs to SYSLOG server or http://wiki.rsyslog.com/index.php/Centralizing_the_audit_log I have been unable to get centralized AUDIT logging to work on my ...
0
votes
1answer
51 views

Replacing a super user by many finer grained users (security)

I find myself in the situation where I have a super user account that can basically do everything in the domain and is set to run scheduled tasks, windows services and websites. I have inherited this ...
2
votes
0answers
365 views

Audit access to USB drives

Is there a way to audit access to USB drives with built-in windows logging? We already do GP based auditing on our server's NTFS file system, but how do we extend that to workstations? There are no ...
5
votes
3answers
232 views

Audit files on a Debian box

Is it possible to list every file on the system that does not belong to a package? or if they have been modified? Might need to use something like: apt-get, apt-files, dpkg-query, etc For context, ...
3
votes
1answer
81 views

How do you audit cloud servers?

So we have a decent number for cloud servers that are on Rackspace (numerous) accounts. I'm looking for a solution to the - What's on that server? Where is that server? How do I get to that server? I ...
1
vote
2answers
677 views

SELinux: denied { execute } for pid=2174 comm=“httpd” path=“/etc/httpd/lib/libaprutil-1.so.0.5.3”

I have problem with SELinux. setroubleshoot suggested to enable mypol.pp with semodule -i mypol.pp so apache could run. after I run the suggested command, I'm keep getting: type=AVC ...
1
vote
2answers
621 views

Restore legacy audit policies on Windows Server 2008 R2

Recently, I was trying to reduce spam of my security audits by disabling auditing of "Filtering Platform Packet Drop". In a week's time, I get enough of these audits the fill a 200Mb logfile. I tried ...
0
votes
1answer
65 views

Looking for VCS wrapper that tracks system files changing across the whole *nix OS and sends diffs through email

I need some software that looks after custom directories across the whole OS (i.e. /etc) and alerting me if someone edit something file inside. Additionally, this tool must automatically commit and ...
2
votes
1answer
854 views

How can I set audit controls on files owned by TrustedInstaller using Powershell?

I am trying to set audit controls on a number of files (listed in ACLsWin.txt) located in \%Windows%\System32 (for example, aaclient.dll) using the following Powershell script: $FileList = ...
1
vote
1answer
418 views

Simple Printer Audit Script

I'm working on Windows Server 2008 R2 and I want to create a simple script to audit the printing carried out in the company. I would like these details to be audited in an text file in a share and ...
2
votes
1answer
171 views

Cannot disable Windows 2008 R2 file access auditing

I was trying to audit file access in a Windows 2008 R2 server, and (my fault) enabled it for the entire volume (say, disk e:). Of course I was getting lots of entries in the security log, a big amount ...
0
votes
1answer
198 views

SQL Server Trace keeps outputting files

A consultant has come and gone to do some audit on our SQL server, and has left a bit of a mess here. The problem is that he did things that we don't know anything about. In the C:\Program ...
2
votes
1answer
136 views

Reporting tools for auditd [closed]

I need to set up auditing in my environment, specifically file integrity monitoring. I've tried OSSEC, but found it cumbersome. I've since discovered auditd (already installed on my CentOS 6 system) ...
0
votes
1answer
22 views

Linux / Ubuntu fingerprinting command/method(s) to identify system wide differences in hardware / packages / configurations between 2 environments

I have 2 separate environments, and some strange behaviour occurring in one environment that is not in the other. Specifically the error is related to the PHP: Fatal error: Nesting level too deep - ...
3
votes
3answers
223 views

Logging when limit Exceeds

Is there a log file that logs information when the values set in /etc/security/limits.conf are exceeded? If the values are too tight in the above file the clients using the website hosted on the ...
0
votes
1answer
57 views

Log Review Process

Currently I have a fairly large syslog-ng cluster setup that is my main log aggregation point. I have the need to be able to acknowledge certain logs and mark them as review for auditing purposes. ...
2
votes
2answers
104 views

Windows 2008 file server: How to find unused permissions?

Following some security breach in my office and stealing data from the company, my manager gave me the task of finding all the folders on the file server which users have read access to and they ...
4
votes
4answers
189 views

Is it possible to audit the Amazon AWS console?

We had a situation recently where an elastic IP address assigned to a production server mysteriously became disassociated from that server. We have had this same thing happen in the past to other ...
0
votes
1answer
235 views

Integrity checking vs. audit

In RHEL5 Security Guide using of AIDE for checking software integrity is recomended. And also built-in RPM integrity checking functionality. But frequent checking can be resource demanding and rare ...
2
votes
1answer
97 views

Does Windows contain default System ACLs for auditing purposes?

While trying to test SACL creation on a filesystem object, I noticed that it was not logging to the event log. After some digging, I found that I had to flip the "master switch" in Local Security ...
0
votes
1answer
55 views

Win 2008r2 Audit

I'm trying to turn on auditing but every time i check Success and failure in Local policy / Computer Conf/Windows settings/security settings/local policies/Audit Policy/ Audit Object access, it turns ...
6
votes
2answers
405 views

What does a standard tech audit include and what is a reasonable price for it?

I am a programmer, but the company I am working for has been growing and has outgrown the 2 man IT contractor team that has been servicing us. We are looking into several different solutions for our ...
1
vote
1answer
210 views

mysql logging activity from specific user or ip

I have mysql server. The server is accessed by my application, and by external auditor (person using mysql workbench). The auditor has specific user and password and dedicated IP and it is granted ...
12
votes
7answers
2k views

How do you document/track your permissions

I'm a Windows Admin so those that integrate with Windows will likely be most helpful. My main challenge at this point is just with file shares but as SharePoint use increases it will only make this ...
3
votes
1answer
301 views

How to view / enumerate / obtain a list of all effective rights / permissions on an Active Directory object?

I am new to Server Fault and was hoping to find an answer to a question that I have been struggling with for the past week or so. I have been recently asked by my management to furnish a list of all ...
0
votes
2answers
94 views

Security: How to improve security of Linux servers when few resident developers need shell access? [duplicate]

Possible Duplicate: SysAdmin & Developer: Responsibilities Suppose, I have 20 servers: We keep data in Linux servers Developers often need to Login to the server to debug some issue ...
12
votes
4answers
1k views

Git commit auditing

I have a git server running over ssh and each user has a unix account on the system. Given that two users have access to a repo, how can I be sure which user performed which commit, since the commit ...
1
vote
1answer
157 views

central log-server with auditdisp

I want to setup a central log-server. The log-server is running with debian 6.0.6 and the audit daemon is installed in version 1.7.13-1. The Clients are running with Red Hat 5.5 and they connect to ...
2
votes
1answer
375 views

SELinux - Allow multiple services access to same /home/dir

I currently have SELinux enabled and have been able to configure apache to allow access to /home/src/web with a chcon command granting the 'httpd_sys_content_t' type. But now I am trying to serve the ...
1
vote
0answers
104 views

Exchange Admin Audit log

i was looking at the admin audit logs today and found it very usefull. But it doesn't include the source computer launching the commands. An example, i have the EMC on my computer modifying some ...
0
votes
2answers
171 views

Logging shell command executed by all users on Linux server [duplicate]

Possible Duplicate: How to log every linux command to a logserver I want to log the commands executed by all users on the server. Is there any better way than using script command?
1
vote
2answers
120 views

Replay the logs created by script?

In our RedHat server, we ave enabled user session logging using script and it's logging the user sessions. But I can't find scriptreplay to play the logs recorded. How to read/play the logs ?
6
votes
4answers
409 views

Penetration Testing - Trust and Hiring

When you hire someone/business to come in how can you be sure they won't have a rogue employee who will backdoor your systems? Is there a way you can trust anyone? How do big corporations do it? Seems ...
1
vote
0answers
282 views

USER_LOGIN audit log with incorrect auid value?

We have a CentOS 6.2 x86_64 system that's logging what looks to be erroneous audit information. We were receiving alerts for failed logins by a user who wasn't actually trying to log in. After some ...
0
votes
1answer
285 views

Rebuilding a file if files have changed

I'm having a hard time wrapping my head around this. It seems trivial, but I'm not getting it. I have two files. If either of those two files changes, I want to rebuild one of them. Essentially: ...
3
votes
2answers
3k views

Unable to start auditd

I am on CentOS 5.8 final I recently installed auditd via yum install audit however I am unable to start it. I edited the configuration file to give a verbose output of the error it is recieving in ...
3
votes
1answer
485 views

linux audit - exclude a process that updates the time

I have set my auditd rules to log when the system time is changed However, our servers are VMs and thus have problems with the time drifting out. We needed to solve this issue so we used a VMware ...
1
vote
1answer
279 views

Dynamics CRM 2011 On-Premise & Security Certifications (ISO 27001, SAS70, etc)

I'm unclear on how to properly word our security status. The data center our hosted IFD CRM instance is running on has not paid for these audits. However, the Microsoft literature suggests that CRM ...
2
votes
3answers
5k views

Windows Server 2008R2 - Auditing changes to a service account

I want to setup auditing so I can see if any changes are being made to a service account (any changes) in AD which is used to run a backup application. What do I need to enable in Group Policy ...
1
vote
3answers
129 views

How to see when what processes have accessed certain files

There is a directory on our server where we manually copy files to, and then some magical procedure runs at night to process these fiels and rename them. This was setup before I got here, and I can't ...