Observing/logging a resource for purposes of: - Adding it to a blacklist of whitelist - Keeping tabs on the security of a system

learn more… | top users | synonyms

0
votes
1answer
23 views

Redirect to new log file selected event id - Manage the security event id 4624 and 4634 flooding

the security logs of the two domain controllers of my network are flooded by security events id 4624 and 4634 and to a lesser extent, 4672. Reading from the internet such a behavior is quite common, ...
0
votes
0answers
10 views

How can i track all executed command [duplicate]

newly sysadmin. is there any application that capture complete logs of all executed commands, its just like the bash_history or history? although i saw the auditd and psacct/acct. eg i ssh on the ...
0
votes
0answers
12 views

How to record audit logs for only one specified file in FreeBSD?

On Red Hat Linux I can specify the file I want to record audit logs for with this command: auditctl -a exit,always -F path=/tmp/foo.txt -F perm=war I cannot figure out how to do a similar thing on ...
0
votes
0answers
11 views

SQL Event Notifications to Remote Server

I have event notifications for SQL and I currently have them writing to a another DB on the same database server. Is there a way to have it write to a remote DB on another DB server? My goal is to ...
2
votes
0answers
60 views
+50

Audit RDP security layer used for each logon

I'm looking for a way to monitor the security layer used when a user log on a windows 2012 R2 server with RDP (SSL or RDP, encryption level). I haven't found anything useful in "Advanced Audit Policy ...
1
vote
1answer
16 views

How to know which files to specify exclusions for the installers of whitelisted apps using hashes with a Windows GPO?

To specify in the software restriction GPO, the hashes of executable/script files that are allowed to execute during the installation of a program run from, for example %LOCALAPPDATA%\Temp, during ...
0
votes
1answer
51 views

Network maps, best admin practises and how them saved your ass?

I am reviewing the security of a (quite large) network. There are a some thousands switches, several hundred routers, several hundred access points, tenths of FW, IPS, and so on. PCs and servers are ...
0
votes
0answers
8 views

How can I process auditd logs on the fly using ausearch?

I want to ship off logs into centralized logging (ELK). Because of the way things are, I need to do the processing on the machine that creates the logs. How can I get each new auditd event to ...
2
votes
0answers
15 views

security audit flags redhat/centos package version numbers despite patches

Redhat has this policy of backporting security fixes. But then when RHEL and CentOS sites get audited, the auditors invariably just list the package versions or ask ssh what it's version number is, ...
1
vote
1answer
101 views

How to enable syscall auditing in CoreOs?

Since CoreOs 766, the auditing subsystem is partially integrated: The audit subsystem has been enabled in the kernel and auditctl added to the image. Most audit events are ignored by default. ...
2
votes
2answers
114 views

How to log all commands run on Linux including their arguments (parameters)? [duplicate]

How can I log all commands executed on Linux, including their command-line arguments (parameters)? So, for example, if someone runs: rm -rf /tmp/foo I would see a log entry similar to this: ...
2
votes
0answers
46 views

Audit IP change on a Windows machine

I want to get an audit (event in the event viewer) for every change in the IP address (static or DHCP). I tried setting an audit configuration on the registry key ...
2
votes
1answer
33 views

Do any OpenSSH 6.7 `preauth` error log entries warrant specific human attention?

A Linux (specifically Debian Jessie) server that needs to be exposed to the Internet is spitting out various OpenSSH 6.7 preauth errors in the logs. For example, I'm getting (timestamps elided for ...
0
votes
0answers
46 views

No event ID 4625 for administrator account

I'm having an issue where no 4625 Event is logged when I type an incorrect password for the domain administrator account when attempting to login to a domain controller via remote desktop. If I use a ...
0
votes
0answers
12 views

MariaDB audit log empty host

I'm running MariaDB 10.0.23 with the audit plugin logging CONNECT type. The audit log is showing a failed connect with error 1042. Does the host field not show the IP address when a host cannot be ...
0
votes
0answers
24 views

Windows Object Access Audit vs File Properties “Accessed” Date/Time

I'm attempting to audit all attempted access to a specific executable on a Windows 2008 R2 system, and have turned on success and failure auditing for all subcategories in "Object Access" in Advanced ...
0
votes
0answers
88 views

Can't start auditctl in Ubuntu 14.04

When I'm trying to start auditctl in my terminal (vds container ubuntu 14.04) I have the message: The audit system is disabled in audit.log: type=DAEMON_START msg=audit(1453274392.823:9236): ...
1
vote
0answers
89 views

How do audit file permissions changes over CIFS?

I have a few windows file servers but am slowly changing to Freenas/ZFS boxes which are working much better however I can't figure out how to audit when people change permissions to critical folders. ...
1
vote
0answers
59 views

Sending auditd records to my audispd plugin

After setting auditctl's rules, I want to send those matched records to my Python script for further analysis. auditd records: type=PATH msg=audit(1451011319.268:533): ... type=CWD ...
1
vote
0answers
24 views

Server 2008 R2 & Auditing

Having an issue with auditing a network for logins. I am looking for Event 4740 but the logs are not showing them. Neither on the local machines either. I have verified that Account Management ...
0
votes
0answers
13 views

Server 2008 - Auditing folder access not working correctly

In a nutshell, we have a Windows Server 2008 R2 fileserver. I want to audit all access to one specific folder by a specific group of 10 users. I am not running any Group policies on this server. ...
2
votes
1answer
84 views

How to log execution of a specific binary/script using auditd or other

I have the following situation in hand. I have one or more specific execuatble files in /usr/bin, I will call one /usr/bin/execute , and they may either be a compiled binary or a script file, such as ...
2
votes
1answer
2k views

How can I list MACs, Ciphers and KexAlogrithms supported by my ssh server?

How can I determine the supported MACs, Ciphers, Key length and KexAlogrithms supported by my ssh servers? I need to create a list for an external security audit. I'm looking for something similar to ...
2
votes
0answers
331 views

New Server 2012 R2 Essentials generating Audit Failure Event 4625 Null SID Logon Attempts

I am researching a failed login issue that is triggering our monitoring software. Researching the issue, the only other information I could find that was exactly what I was seeing, was on here: Event ...
0
votes
0answers
46 views

Windows Server File Share Audit

I have a file service on Windows Server 2012 R2 and I want to track these events on it: User created a file/folder User edited a file/folder or its' permissions User renamed a file/folder User ...
0
votes
1answer
80 views

When does augenrules run automatically on CentOS 7.1?

I need to update /etc/audit/audit.rules. I would replace the file restart the service, but I found in the log a call to augenrules during initial startup of the machine. Apart from the initial ...
0
votes
1answer
70 views

Missing Account audit events on DC's

I recently discovered that all of our Domain controllers (2008 R2, domain and forest fuctional level is 2008 R2) are no longer logging AD account logon events to the Security Log. The Default ...
1
vote
0answers
208 views

Windows Server 2008 R2 - Failed login auditing

I am having issue with configuring Auditing on the server in order to catch failed and successful network logins. This morning we found one of our test machines with a strange login on the locked ...
0
votes
0answers
30 views

Why is solaris auditing not working after adding new class entry

I have setup a new class entry in the audit_control, audit_class and audit_event files as below: $ grep pf /etc/security/audit_control flags:pf $ grep pf /etc/security/audit_event ...
0
votes
0answers
12 views

Flush audit logs before process termination

I configured auditd by modifying /etc/pam.d/common-auth: session required pam_loginuid.so session required pam_tty_audit.so enable=* The logging works fine. The issue is that the log is not written ...
1
vote
0answers
36 views

Best practices / settings to create “Read-Only” Admin role for auditors and similar

I am trying very diligently to remove as many over-privileged accounts/roles in our Active Directory and Windows (server and desktop) environment. This means retiring as many users as possible from ...
0
votes
0answers
18 views

Exchange 2010 Public Folder Auditing

Quick Question - I know how to turn on Diagnostic Logging within Exchange 2010 for Public folders (9001 Public Store) - General. However, I am wondering does the General category set to 5 or higher ...
1
vote
1answer
36 views

Check whether GRANT EXECUTE TO user or role was applied

In Microsoft SQL Server, I can use GRANT EXECUTE TO <principal> to grant execute permission to some user or role. I'm interested in detection: How can I equally simply check whether that ...
1
vote
2answers
487 views

How to audit file and folder deletes on Windows Server 2008 r2

I need to enable auditing of delete actions on a specific network shared folder (and all its children) on a Windows Server 2008 r2 machine. The closest I could find was this article - ...
1
vote
1answer
77 views

Window Logs - Is any event logged when a user overwrites files? (Win Server 2012 R2)

Is any event logged when a user/process overwrites files? (Win Server 2012 R2)
0
votes
0answers
12 views

Audit Group Object Use?

Say you have a Security group. It's undocumented, nobody knows "what" it does, but everybody "knows" it is used for something. If some application (SQL Server or some random web app) for instance, ...
1
vote
0answers
257 views

Audit trail for all actions taken with admin privileges

PCI DSS 10.2 says, "Implement automated audit trails for all system components to reconstruct the following events:" and 10.2.2 continues, "All actions taken by any individual with root or ...
2
votes
0answers
90 views

Why does ausearch skip entries?

I am trying to use the ausearch tool search my auditd logs for specific entries. The problem is that most of the entries in audit.log appear to be unsearchable. Searching with matching parameters ...
0
votes
1answer
31 views

Audit logging for OpenLDAP changes

How can I produce and examine an audit trail of changes made to an OpenLDAP database, such as which user was created when, by whom, when was it edited, what was edited etc?
0
votes
0answers
61 views

How to monitor keystrokes of an lxc guest that is connected via ssh?

I have an unprivileged LXC container which runs an SSH server (both LXC guest and LXC host are Ubuntu 14 servers) . The ports to connect to the container are forwarded, so one can connect from outside ...
0
votes
1answer
374 views

Set up auditing on Windows Server 2012 R2: logging on, logging off, open, read, write, etc. (Sucesses and failures)

I have enabled auditing on Windows Server 2012 R2 (domain controller) but liked warned, there are just way too many events being generated and it really doesnt tell me anything or just too troublesome ...
0
votes
1answer
117 views

389DS Access.log parsing - turning LDAP request type into an audit event

Has anyone authored code to parse a 389 Directory Server's access.log file with an aim of generating audit events based around the LDAP request type. Bascially, take the log sequence ...
0
votes
0answers
57 views

how to get info on failed authentication to domain - security audit?

Setup: 1 Windows Server 2012 box as Domain Controller, named DC1. 2 Windows Server 2012 R2 boxes, S1 and S2, on the same network, same config, joined to the domain. Issue: At random times, S1, S2 or ...
0
votes
0answers
32 views

Debug or audit SDDL setting of a service

I have set a custom SDDL for a service, that contains an entry with custom SID, and after checking that new SDDL grants that SID remote restart rights I went off for a night, and today I have ...
1
vote
1answer
50 views

AWS Firewall Configuration Review

We had a situation where an incorrect AWS firewall rule buried in our configuration was causing some headaches. After a few days we found the rule and fixed it. Does anyone know of a good way to ...
0
votes
2answers
27 views

How can I audit Ip adresses of users logging into system?

I have a group of servers which use Kerberos for authentication. We distribute keytabs to users but want to ensure that a user never pass their keytab to someone else. Essentially we need to audit the ...
0
votes
0answers
343 views

why is ip address sometimes missing from Security audit log Source Network address for log on audit failures?

Most of the time when someone who is not authorized attempts to log on to my Windows 2008 R2 web server, an ip address is displayed. With the ip address, i can easily block the external host from ...
2
votes
1answer
34 views

Checking Who Applied GPO

I know how to check what GPOs are applied on systems and users, but I'm wondering, is there a way to check who applied a specific GPO?
0
votes
0answers
134 views

Domain Administrator Login - Unknown Source

I'm trying to clear out all traces of old legacy settings from a new Domain I've inherited. One of my pet hates is using the Domain Administrator account for tasks, services, etc. I've managed to get ...
1
vote
0answers
140 views

what are the advantages and disadvantages of auditing mailboxes in exchange server?

I want to know the pros and the cons of enabling this feature in our exchange server 2010. Primarily we would like to start of with few mailboxes first, I am aware that the login logos will require ...