The tag has no usage guidance.

learn more… | top users | synonyms

-1
votes
0answers
5 views

samba full audit: meaning parameters

I have set full audit in samba, but there are some parameters that would like to know exactly what they mean Full audit full_audit:prefix = %I|%m|%S full_audit:success = mkdir rmdir pread read ...
0
votes
0answers
13 views

Windows Object Access Audit vs File Properties “Accessed” Date/Time

I'm attempting to audit all attempted access to a specific executable on a Windows 2008 R2 system, and have turned on success and failure auditing for all subcategories in "Object Access" in Advanced ...
0
votes
0answers
33 views

Can't start auditctl in Ubuntu 14.04

When I'm trying to start auditctl in my terminal (vds container ubuntu 14.04) I have the message: The audit system is disabled in audit.log: type=DAEMON_START msg=audit(1453274392.823:9236): ...
1
vote
0answers
30 views

How do audit file permissions changes over CIFS?

I have a few windows file servers but am slowly changing to Freenas/ZFS boxes which are working much better however I can't figure out how to audit when people change permissions to critical folders. ...
1
vote
0answers
25 views

Sending auditd records to my audispd plugin

After setting auditctl's rules, I want to send those matched records to my Python script for further analysis. auditd records: type=PATH msg=audit(1451011319.268:533): ... type=CWD ...
1
vote
0answers
21 views

Server 2008 R2 & Auditing

Having an issue with auditing a network for logins. I am looking for Event 4740 but the logs are not showing them. Neither on the local machines either. I have verified that Account Management ...
0
votes
0answers
11 views

Server 2008 - Auditing folder access not working correctly

In a nutshell, we have a Windows Server 2008 R2 fileserver. I want to audit all access to one specific folder by a specific group of 10 users. I am not running any Group policies on this server. ...
2
votes
1answer
71 views

How to log execution of a specific binary/script using auditd or other

I have the following situation in hand. I have one or more specific execuatble files in /usr/bin, I will call one /usr/bin/execute , and they may either be a compiled binary or a script file, such as ...
2
votes
1answer
251 views

How can I list MACs, Ciphers and KexAlogrithms supported by my ssh server?

How can I determine the supported MACs, Ciphers, Key length and KexAlogrithms supported by my ssh servers? I need to create a list for an external security audit. I'm looking for something similar to ...
2
votes
0answers
216 views

New Server 2012 R2 Essentials generating Audit Failure Event 4625 Null SID Logon Attempts

I am researching a failed login issue that is triggering our monitoring software. Researching the issue, the only other information I could find that was exactly what I was seeing, was on here: Event ...
0
votes
0answers
32 views

Windows Server File Share Audit

I have a file service on Windows Server 2012 R2 and I want to track these events on it: User created a file/folder User edited a file/folder or its' permissions User renamed a file/folder User ...
0
votes
1answer
38 views

When does augenrules run automatically on CentOS 7.1?

I need to update /etc/audit/audit.rules. I would replace the file restart the service, but I found in the log a call to augenrules during initial startup of the machine. Apart from the initial ...
0
votes
1answer
36 views

Missing Account audit events on DC's

I recently discovered that all of our Domain controllers (2008 R2, domain and forest fuctional level is 2008 R2) are no longer logging AD account logon events to the Security Log. The Default ...
1
vote
0answers
76 views

Windows Server 2008 R2 - Failed login auditing

I am having issue with configuring Auditing on the server in order to catch failed and successful network logins. This morning we found one of our test machines with a strange login on the locked ...
0
votes
0answers
25 views

Why is solaris auditing not working after adding new class entry

I have setup a new class entry in the audit_control, audit_class and audit_event files as below: $ grep pf /etc/security/audit_control flags:pf $ grep pf /etc/security/audit_event ...
0
votes
0answers
8 views

Flush audit logs before process termination

I configured auditd by modifying /etc/pam.d/common-auth: session required pam_loginuid.so session required pam_tty_audit.so enable=* The logging works fine. The issue is that the log is not written ...
1
vote
0answers
27 views

Best practices / settings to create “Read-Only” Admin role for auditors and similar

I am trying very diligently to remove as many over-privileged accounts/roles in our Active Directory and Windows (server and desktop) environment. This means retiring as many users as possible from ...
0
votes
0answers
13 views

Exchange 2010 Public Folder Auditing

Quick Question - I know how to turn on Diagnostic Logging within Exchange 2010 for Public folders (9001 Public Store) - General. However, I am wondering does the General category set to 5 or higher ...
1
vote
1answer
31 views

Check whether GRANT EXECUTE TO user or role was applied

In Microsoft SQL Server, I can use GRANT EXECUTE TO <principal> to grant execute permission to some user or role. I'm interested in detection: How can I equally simply check whether that ...
1
vote
2answers
164 views

How to audit file and folder deletes on Windows Server 2008 r2

I need to enable auditing of delete actions on a specific network shared folder (and all its children) on a Windows Server 2008 r2 machine. The closest I could find was this article - ...
1
vote
1answer
54 views

Window Logs - Is any event logged when a user overwrites files? (Win Server 2012 R2)

Is any event logged when a user/process overwrites files? (Win Server 2012 R2)
0
votes
0answers
12 views

Audit Group Object Use?

Say you have a Security group. It's undocumented, nobody knows "what" it does, but everybody "knows" it is used for something. If some application (SQL Server or some random web app) for instance, ...
1
vote
0answers
153 views

Audit trail for all actions taken with admin privileges

PCI DSS 10.2 says, "Implement automated audit trails for all system components to reconstruct the following events:" and 10.2.2 continues, "All actions taken by any individual with root or ...
2
votes
0answers
55 views

Why does ausearch skip entries?

I am trying to use the ausearch tool search my auditd logs for specific entries. The problem is that most of the entries in audit.log appear to be unsearchable. Searching with matching parameters ...
0
votes
1answer
29 views

Audit logging for OpenLDAP changes

How can I produce and examine an audit trail of changes made to an OpenLDAP database, such as which user was created when, by whom, when was it edited, what was edited etc?
0
votes
0answers
53 views

How to monitor keystrokes of an lxc guest that is connected via ssh?

I have an unprivileged LXC container which runs an SSH server (both LXC guest and LXC host are Ubuntu 14 servers) . The ports to connect to the container are forwarded, so one can connect from outside ...
0
votes
1answer
215 views

Set up auditing on Windows Server 2012 R2: logging on, logging off, open, read, write, etc. (Sucesses and failures)

I have enabled auditing on Windows Server 2012 R2 (domain controller) but liked warned, there are just way too many events being generated and it really doesnt tell me anything or just too troublesome ...
0
votes
1answer
85 views

389DS Access.log parsing - turning LDAP request type into an audit event

Has anyone authored code to parse a 389 Directory Server's access.log file with an aim of generating audit events based around the LDAP request type. Bascially, take the log sequence ...
0
votes
0answers
44 views

how to get info on failed authentication to domain - security audit?

Setup: 1 Windows Server 2012 box as Domain Controller, named DC1. 2 Windows Server 2012 R2 boxes, S1 and S2, on the same network, same config, joined to the domain. Issue: At random times, S1, S2 or ...
0
votes
0answers
24 views

Debug or audit SDDL setting of a service

I have set a custom SDDL for a service, that contains an entry with custom SID, and after checking that new SDDL grants that SID remote restart rights I went off for a night, and today I have ...
1
vote
1answer
39 views

AWS Firewall Configuration Review

We had a situation where an incorrect AWS firewall rule buried in our configuration was causing some headaches. After a few days we found the rule and fixed it. Does anyone know of a good way to ...
0
votes
2answers
26 views

How can I audit Ip adresses of users logging into system?

I have a group of servers which use Kerberos for authentication. We distribute keytabs to users but want to ensure that a user never pass their keytab to someone else. Essentially we need to audit the ...
0
votes
0answers
219 views

why is ip address sometimes missing from Security audit log Source Network address for log on audit failures?

Most of the time when someone who is not authorized attempts to log on to my Windows 2008 R2 web server, an ip address is displayed. With the ip address, i can easily block the external host from ...
2
votes
1answer
34 views

Checking Who Applied GPO

I know how to check what GPOs are applied on systems and users, but I'm wondering, is there a way to check who applied a specific GPO?
0
votes
0answers
105 views

Domain Administrator Login - Unknown Source

I'm trying to clear out all traces of old legacy settings from a new Domain I've inherited. One of my pet hates is using the Domain Administrator account for tasks, services, etc. I've managed to get ...
1
vote
0answers
112 views

what are the advantages and disadvantages of auditing mailboxes in exchange server?

I want to know the pros and the cons of enabling this feature in our exchange server 2010. Primarily we would like to start of with few mailboxes first, I am aware that the login logos will require ...
1
vote
1answer
99 views

Strange SECCOMP entries for sshd in audit log

I'm seeing strange entries for sshd in my audit logs along the lines of: type=SECCOMP audit(1433519794.902:46): auid=20003 uid=22 gid=22 ses=21 pid=25136 comm="sshd" exe="/usr/sbin/sshd" sig=31 ...
2
votes
1answer
124 views

Audit logs are not being generated on linux machine

Hi We are using four linux servers for on application. Application just simply generates reports using scripts... Now for three servers audit logs are being generated in /var/log/audit directory (as ...
2
votes
2answers
134 views

Is there a reverse Proxy for REST interfaces, which requires approval?

My organization employs a number of services that expose REST interfaces. POST, PUT or DELETE requests to such an interface can be destructive. Using firewalls and user authentication, we can restrict ...
1
vote
2answers
77 views

Audit what version of Remote Desktop users are using

we're trying to find out if there's any specific way to audit what version of remote desktop users are connecting with to a terminal server. You can find the version number manually by right clicking ...
1
vote
2answers
10k views

Event 4625 Audit Failure NULL SID failed network logons

In 3 separate systems, the following event is being logged many times (between 30 to 4,000 times a day depending on the system) on the domain controller server: An account failed to log on. Subject: ...
0
votes
1answer
67 views

Remote Desktop Connection Audit [closed]

My company recently fired someone. They said, they are auditing that person's electronic activity. We all have Remote Desktop connections that we use to work from home. Do you know what level of ...
0
votes
0answers
95 views

Auditing user commands with ip address

i have to set auditing system to my firm's server. Server runs Debian Wheezy. I'm working on "auditd" system on server. I have only two rule. # Log any command run on this system -a exit,always ...
2
votes
4answers
380 views

How to get Microsoft license authentication for all machines on a network?

We have a small network (~150 desktops, ~20 servers) much of which is Linux. MS keeps wanting to audit our MS products every 3 years or so. I really don't have time to go around to 80-90 desktops and ...
0
votes
0answers
201 views

event 4656 even though handle manipulation auditing is disabled

windows server 2012R2 auditpol /set /subcategory:"Handle Manipulation" /Success:Disabled /Failure:Disabled still getting events 4656 "A handle to an object was requested." any ideas?
0
votes
2answers
140 views

ssh pass original user to environment on server [closed]

First off, i do not know wether passing the information to the environment is the best approach, so i will start by detailing what i actually want to achieve. on a corporate scale, there are servers ...
2
votes
1answer
108 views

What is causing WMI to delete registry keys

on one of our servers registry keys keep disappearing. These keys contain certificate keys for our sophos av management console and parts of the enterprise console stop working after each reboot (the ...
-1
votes
0answers
21 views

Auditing tool for Windows security policies [closed]

What tools do you use to audit Windows security policies. For example, I configured a Windows machine (A) with the policies (GPO security policies) that we want. (A) now is a baseline. How then could ...
2
votes
1answer
258 views

Monitoring Linux system Calls (efficiently)

What is the fastest way to monitor linux system calls and log them to a file? This post has some great info: Monitoring system calls (in a reliable and secure way) It's seems that the Audit ...
0
votes
0answers
95 views

File Auditing in Cluster Shared Volumes

I'm trying to simply enable file auditing on a windows share (2012 R2)on top of cluster shared volume. But it doesn't behave as I expected it to behave. Here's the story: I enabled file auditing ...