The audit tag has no wiki summary.
1
vote
1answer
17 views
Dynamics CRM 2011 On-Premise & Security Certifications (ISO 27001, SAS70, etc)
I'm unclear on how to properly word our security status. The data center our hosted IFD CRM instance is running on has not paid for these audits. However, the Microsoft literature suggests that CRM ...
1
vote
1answer
68 views
Windows Server 2008R2 - Auditing changes to a service account
I want to setup auditing so I can see if any changes are being made to a service account (any changes) in AD which is used to run a backup application.
What do I need to enable in Group Policy ...
1
vote
3answers
34 views
How to see when what processes have accessed certain files
There is a directory on our server where we manually copy files to, and then some magical procedure runs at night to process these fiels and rename them. This was setup before I got here, and I can't ...
0
votes
1answer
74 views
What prevents banks from creating money in their database? [closed]
I was wondering: If banks store all the account balances in a database, what keeps them from going into said database and "creating" money by changing the data (Replacing 10 000 $ with 100 000 $ is ...
5
votes
3answers
115 views
Security when SSH private keys are lost
User A has two SSH private keys, and over time has used this public key on a number of servers
He lost one of them, and has created a new pair.
How does User A inform me (the sysadmin), that he has ...
1
vote
1answer
40 views
How can I see which applications have accessed a certain file within a given time period on Linux?
Is it possible on Linux to find out which applications have accessed a certain file in the
last 24 hours?
I've come with a few possible solutions:
Watch lsof. It works, but it's constrained to ...
-1
votes
1answer
21 views
Where do I see a log of user connections to PC in Windows Server 2008 Event Log Viewer?
Event Log Viewer is listing a bunch of infos but where am I supposed to see the list of user connections to PC in Windows Server 2008 ?
1
vote
1answer
87 views
What does sysprep do on Win2k8 with /audit?
Windows 2008 R2 host running Hyper-V. I meant to run "sysprep /audit /reboot" on one of the virtual machines, but ended up running that on the host (doing this through 2 layers of RDP - bad idea). The ...
0
votes
2answers
38 views
Tracking files/folders changes on the system
I've been wondering as to how can I track changes done to files located at certain directory (including subdirectories if any). I am specially interested in file modifications rather than ...
3
votes
1answer
56 views
How do I check whether an administrator has viewed the security audit log?
A colleague and I have been discussing an IS audit demo on Windows.
One point we'd like to cover is that an administrative/high-privilege user should view the security log within X hours of a failure ...
0
votes
0answers
51 views
User activity auditing on Solaris 10
I want to track the user activity ie. capture the remote login details like login name, time stamp, commands executed etc. on a Solaris 10 box. The users access the node over SSH.
Let me know if we ...
3
votes
1answer
363 views
Server locking up, /var/log/messages reports “backlog limit exceeded”
We have a CentOS OS that became unresponsive this morning to external network traffic. It is a virtual machine. I was able to reboot the VM. After logging back in, I found the following in the ...
2
votes
2answers
119 views
Auditing changes to the audit log
I have configured auditd for PCI compliance reasons
PCI states that existing logs cannot be changed without generating an alert
This article ...
0
votes
0answers
117 views
Solaris Auditing (BSM) - How to log argv to syslog
By default, it seems that the argv from execs is not passed to the audit_syslog.so plugin. The binary audit log has the arguments included, but the plugin won't write them into the syslog. Everything ...
1
vote
6answers
158 views
Network Administration and Auditing Tools
We're a small company (~50) who outsource the bulk of our IT to an... average quality provider. I am taking on the role of day-to-day IT (think of things that can be fixed in 15 mins or less only). ...
1
vote
2answers
359 views
CentOS - Percona MySQL - Not Reading /etc/my.cnf
I've compiled Percona 5.5 on my CentOS 6.1 server and it starts fine, however it doesn't appear to be reading my /etc/my.cnf file.
# In /etc/my.cnf
character_set_server = utf8
collation_server = ...
5
votes
1answer
93 views
Exchange security monitoring tools
I am trying to identify tools that can perform security monitoring of Exchange. Ideally, the tools should be able to pick up things like:
permission changes for high risk mailboxes
multiple ...
0
votes
1answer
49 views
database scanning tools recommendation? [closed]
Lately my boss is asking me to looking into database scanners. I know very little about db scanning technology. Just wondering if it is worth to purchase tools like Sentrigo ( ...
1
vote
4answers
55 views
sendmail sending mail to recipients I don’t know of; possible spam host
Recently I did an audit of my machine with logwatch and found out that my machine sends around 582 mails everyday.
STATISTICS
----------
Messages To Recipients: 582
Addressed Recipients: ...
4
votes
1answer
138 views
Survive a Software Audit
I received a letter from Autodesk asking for a "License Assessment". I understand it as a software audit. They plan to do it remotely.
The thing is, I'm a freelancer, I don't use any Software Asset ...
0
votes
1answer
73 views
Audit folder permissions on a windows server
I have a number of servers in the corporate domain that seem to randomly lose ACL permissions to the TEMP folders (c:\temp, c:\windows\temp and any temp folder defined in the environment variables).
...
0
votes
2answers
67 views
Logging user activities
I add the following line to my bash_profile file to log all my activities.
script ~/mylog_$(date '+%Y%m%d%H%M').log
If I have 100 users, I can not modify all the user accounts with the change ...
3
votes
1answer
97 views
Possible to forward logs for microsoft products
This may be a duplicate, as i'm fishing for information, as I'm not that au fait with logging on windows. I know on Unix you can ship syslogs via the relay and RFC 5424. I also know you forward ...
3
votes
1answer
63 views
Possible to audit newly added Exchange 2007 ActiveSync devices?
We have a client who would like to be notified when a new ActiveSync device is added. My thoughts are that this is not possible but I would like to confirm.
1
vote
0answers
78 views
Want to find cause of recurring failed SQL Server 2005 login attempts
I've been noticing recurring failed logon attempts onto our SQL server. It happens every minute with the same login. An example from the log file viewer
10/18/2011 13:54:50,Logon,Unknown,Login ...
0
votes
0answers
23 views
Exchange 2007 - Attachment Monitoring
Through logging on Exchange 2007 is it possible to log / monitor the filenames of attachments received and sent through an exchange server?
3
votes
2answers
120 views
Software for monitoring a Windows network environment (Change Control)
I need to implement change control and auditing in a Microsoft Windows network environment. My question is in methods to audit or better yet changes made to the networking environment. This starts ...
4
votes
1answer
96 views
How can I log the creation of Exchange 2003 and 2010 mailboxes?
We are trying to acquire a new certificate/label. In order to get this certificate/label we need to monitor the creation of mailboxes in Microsoft Exchange.
We are currently using Microsoft ACS ...
0
votes
0answers
28 views
How to audit when a particular program / exe is run
I want to audit our users computers for when a particular program is run, kind of like getting a more detailed report on the lines of the "Used Rarely / Occasionally" type you see in Add/Remove ...
1
vote
1answer
105 views
Is there a way to pam_tty_audit on Linux OpenVZ containers?
Looks like pam_tty_audit in Linux (http://www.slashzero.com/2009/11/shell-session-logging/) could have been a great way to help figure out "what happened!" when one gets rooted.
I say "could have ...
3
votes
2answers
64 views
How do you check that servers/pcs are not infected
Simple question. Developers PCs have to have free access to network, including servers etc., and they have to have administrative access to perform work effectively.
However developers also use a lot ...
1
vote
2answers
200 views
DML Auditing (“Who did inserts?”)
Does an out-of-the-box newly created database (in SQL Server 2008) keep any DML audit records, such as:
User 'George' did an insert on table
'Alpha' on 6/20/2011
User 'Fred' did a delete on table ...
0
votes
1answer
121 views
What does “Invalid AVC allowed in current policy” mean?
I was looking into my selinux alert logfile and running over multiple entries labeled
**** Invalid AVC allowed in current policy ***
I understand that this signals a problem (on read or getattr ...
2
votes
2answers
87 views
Determine when a Domain Controller was promoted
On Windows Server 2003 standard is there a way to determine when a domain controller was promoted?
This is for an Active Directory 2000 functional domain.
The event logs don't go back far enough.
0
votes
2answers
68 views
check inventory of IBM software on *nix machines
We have a bunch of *nix machines some of which probably have IBM software installed on them.
Is there a way to identify the machines and the type of IBM software that is installed?
1
vote
0answers
60 views
Windows 2008 Audit - Acess Request Information
I'm auditing some folders in a Windows 2008 R2 server and I have a "Success Audit" entry in the Security Event Log with the following "Access Request Information":
Access Request Information:
...
0
votes
0answers
52 views
Failure Audit on SQL Server
It may be a classic but yes I am newbie and I need your help with stg.
Server 2003 and SQL Server 2005 runs on the same server. A process (.exe) has to be running all the time. However, sometimes I ...
1
vote
1answer
68 views
Auditing user behavior in a small organization to prepare IT restructuring
My company will be working on restructuring/rethinking the whole IT infrastructure for a small company (about 25 employees). A part of this is a migration to Google Apps for email, calendar, etc. That ...
4
votes
2answers
68 views
Is there any viable alternative to using Oracle Auditing
I am currently tasked with developing a action plan for monitoring DB activity, encompassing general actions (failed logons etc) with some finer grained monitoring(e.g. who selected from table x, what ...
1
vote
1answer
187 views
Recommend tools for auditing/testing MIT Kerberos Passwords
Debian 6
MIT Kerberos i.e. krb5
I want to be able to audit/test the passwords in our Kerberos server periodically for quality. If the passwords can be cracked quickly I want to notify the users to ...
0
votes
1answer
1k views
Windows Filtering Platform not turning off until admin logon. Win2008R2sp1
Just installed Windows Server 2008R2 SP1 to see if it would fix this problem, but it didn't.
Until an administrator logs onto the domain controller, there are many events that WFP blocked a connection ...
0
votes
3answers
690 views
Export a list of installed features on a Windows 2008 server
I have been asked to specify the features which are installed on a production web server so a replica test environment can be created.
I could point and click my way to the solution but I am curious ...
1
vote
1answer
86 views
SQL Server 2008 Audit Service
I'm designing an application that will run on SQL Server 2008 R2. There's a requirement to audit any updates to a customer table. The new Audit service that was release as part of SQL Server 2008 ...
2
votes
2answers
595 views
Best practice ACLs to prepare for auditors?
An auditor will be visiting our office soon, and they will require read-only access to our data. I have already created a domain user account and placed them into a group called "Auditors".
We have a ...
0
votes
2answers
208 views
Auditing bandwidth of remote sites
I would like to do an automatic audit of bandwidth of my remote offices. I understand that there are many websites where I could ask each user to go to a webpage and run the test. I was hoping there ...
1
vote
3answers
300 views
Tools to monitor users activity on Linux/Unix servers
Is there any specific open source tool which can be used to monitor what users are doing on linux system. I have multiple servers and with access to some users on them. I want to monitor which user ...
0
votes
1answer
98 views
How well does Cocoa allow auditing of I/O to USB, FireWire and optical media on a Mac?
I have a client who wants us to lock down the Mac laptops we're using to access his data. He wants an audit of all files read and written from removable media (USB, FireWire, optical). I have a ...
3
votes
1answer
122 views
Is Exchange protected from/allow back dated emails?
Does Exchange Server adequately protect against backdating items in a mailbox folder? I want to determine from an auditing perspective what level of risk exists/what trust can be put into Exchange ...
2
votes
2answers
351 views
Is it worth running nessus as well as OpenVAS?
Apparently OpenVAS originated as a fork of Nessus. It is very easy to install and use OpenVAS because it's, well, open. However, am I kidding myself if I just use that instead of Nessus? Should I ...
6
votes
3answers
3k views
Sending audit logs to SYSLOG server
I'm running several RHEL based systems which utilize the audit functionality within the 2.6 kernel to track user activity and I need to have these logs sent to centralized SYSLOG servers for ...
