0
votes
1answer
35 views

Exchange 2010 security audit

Our IT department has received reports from HR that managers are reading their subordinates email, and we've been tasked with identifying if there is a technical way to achieve this. I'm looking for ...
0
votes
1answer
28 views

How to enable auditing for a folder only (and not anything within that folder)

I am trying to track down a process responsible for resetting ACLs on a particular folder, and ONLY that folder, not any of the 10,000 folders and files it contains. I tried going to Properties > ...
1
vote
0answers
43 views

Ignoring auditing messages for particular PAM messages

I've got too many messages from PAM logging into audit.log, like this: type=USER_ACCT msg=audit(1378995943.792:867411): pid=4419 uid=0 auid=4294967295 ses=4294967295 ...
2
votes
1answer
793 views

Configuration Compliance auditing for many CentOS 5.x boxes

Current Situation I have a client with many (200x) CentOS 5.x servers deployed in various web, mail, database and file server roles, and these boxes have been variously administrated to a lessor or ...
9
votes
7answers
2k views

Hacking prevention, forensics, auditing and counter measures

Recently (but it is also a recurrent question) we saw 3 interesting threads about hacking and security: My server's been hacked EMERGENCY. Finding how a hacked server was hacked File ...