3
votes
2answers
37 views

sshd logging attempts to login without a private key

On my VPS, running Debian 7, I have ssh enabled on the default port 22 with only private key authentication enabled, all other ports are filtered with iptables. I am frequently getting login attempts ...
1
vote
3answers
270 views

Is this a security breach?

I have a server running Ubuntu 10.04LTS (I know it is too old), which over the last couple of weeks has on occasion been unresponsive to network traffic, and needed a hard reset first thing in the ...
3
votes
3answers
198 views

Logging when limit Exceeds

Is there a log file that logs information when the values set in /etc/security/limits.conf are exceeded? If the values are too tight in the above file the clients using the website hosted on the ...
0
votes
1answer
277 views

phppath/php as URL has strange behaviour and seems to be an attack

Warning: The following requests might harm your server. I got some strange things in the apache log: "POST ...
2
votes
2answers
82 views

Are passwords sent via a bash script retrievable?

As part of running a backup script for a linux server, I have commands like mysqldump within a bash script which contain the mysql root password, and certain ftp server passwords. Are these ...
0
votes
1answer
103 views

Cisco asa 5500 series - Logging VPN connections to easily search connection history

We have a fresh requirement to log information to do with vpn connections. The ultimate goal would be facilitating IT management being able to easily review when someone had been connecting / ...
0
votes
1answer
67 views

How to ensure a password entered on command line is not stored at all on Linux server?

I've got a web page PHP script which runs p7zip on the server: This passes a user supplied password for encrypting their uploaded files. Secondly the password is then emailed via PHP to the ...
0
votes
0answers
98 views

Filter rsyslog message by message id?

I'm trying to filter out some windows logs, that from program named Security-Auditing and with a message id 4624, but it doesn't work: if $programname == 'Security-Alert' and $msgid == '4624' then ...
1
vote
2answers
609 views

How do I list the N last successful and unsuccessful login attempts for my user when I log in with e.g. ssh on Linux?

This seems like such a basic security feature I'm surprised it's not already standard.
1
vote
3answers
152 views

Apache httpd server 'is it possible': Alert on specific condition in access/error log

I'm just wondering is it there some module which can detect certain event in access/error log and if it matches it, to send an email with information. example: I want to detect when someone makes ...
-1
votes
3answers
122 views

How to automatically copy a file uploaded by a user by FTP in Linux (CentOS)?

Outside contractor says they need read/write/execute permissions on part of the filesystem so they can run a script. I'm ok with that, but I want to know what they're running, in case it turns out ...
4
votes
3answers
1k views

How do I secure my Asterisk server?

Our asterisk server was compromised. some calls were made to Asia countries last weekend. Thought we have improved our network configuration, we still want to determine how the intrusion was done, we ...
0
votes
1answer
119 views

Is there a way to get Apache to blank sensitive data from logs?

We're trying to clean up one of our systems as much as possible & have found that despite our attempts to block, users are accessing a certain part of our system through a HTTP GET with their ...
1
vote
3answers
1k views

Setting up fail2ban to ban failed phpMyAdmin login attempts

We've been using fail2ban to block failed ssh attempts. I would like to setup the same thing for phpMyAdmin as well. As phpMyAdmin doesn't log authentication attempts to a file (that I know of), I'm ...
2
votes
0answers
126 views

a good tool to analyse iptables log? [closed]

I have some linux server with iptables and I'm looking for an offline tool that allow log analysis to detect suspicious activity . I dont think that installing a web tool is a good choice beacause ...
1
vote
2answers
1k views

Security Log in Event Viewer does not store IPs

I'd like to write a service that pulls Event Viewer records, specifically from the Security log. Of particular interest to me are things like event id 4625 (audit fail) messages. Ideally I'd like ...
0
votes
1answer
171 views

Linking RSA with Logstash etc

I was wondering whether we can use logstash or any other open source or free log management tool to collect and index the data and then feed this index into RSA envision or any other enterprise SIEM ...
2
votes
2answers
1k views

Giving other users write access to apache logs can result in root exploit - How does this work?

On http://httpd.apache.org/docs/2.2/logs.html Anyone who can write to the directory where Apache is writing a log file can almost certainly gain access to the uid that the server is started as, ...
3
votes
2answers
227 views

Suspicious password login in sshd log

I have a linux server running under a windows virtualbox. I use ssh with publickey to login, and use lftp's sftp feature for file transfer, which also use publickey. Today when I check the log file, ...
0
votes
3answers
92 views

Getting Some Specific Types of Log [closed]

I'm want to get some logs from my server, but not general logs like syslog that gives me a lot of random logs. I want to know how I can get logs of things like logins(with time, IP and username), ...
0
votes
1answer
251 views

iptables logging packets coming from the outside world

I want to log all INPUT packets that do not originate in the LAN for audit purposes, I have a script with tcpdump basically appending to a file the result from this: tcpdump "(dst net 192.168.0.0/24 ...
1
vote
1answer
86 views

Oddities in server log

I have a logging script set up on my site so that whenever you go to the site, the script logs the time, user agent, IP address, referrer, and what page you went to. For some reason, as I was looking ...
2
votes
1answer
546 views

Via logwatch, I get messages that root is opening sessions “-> nobody”. Is this a security concern, or normal operation?

Here are some lines from logwatch: pam_unix sshd: Authentication Failures: root (211.167.103.115): 5 Time(s) unknown (219.239.110.139): 1 Time(s) Invalid Users: Unknown Account: 1 ...
0
votes
2answers
188 views

Linux: Where are non-interactive commands logged?

As far as I know, when I SSH to a box, it will add my command history to something like .bash_history. But when I execute a command like rsync and it executes a remote SSH connection, rsync -avz -e ...
9
votes
7answers
2k views

Hacking prevention, forensics, auditing and counter measures

Recently (but it is also a recurrent question) we saw 3 interesting threads about hacking and security: My server's been hacked EMERGENCY. Finding how a hacked server was hacked File ...
1
vote
5answers
22k views

Are there any RDP activity logs? - Windows Server 2008 R2

a few users have logged into a server through RDP. I would like to monitor activity, but do not know my way round Windows Server that well. I am hoping there are logs of some kind around that I can ...
0
votes
1answer
120 views

system logging in linux

Which one is better? syslog-ng or rsyslog or dsyslog? Please help me
10
votes
7answers
10k views

How to log every linux command to a logserver

I want every single command typed to go to a logserver. Already configured is the syslog-ng to send all logs to the logserver. I'm interested in any and all methods to do this. I would expect ...
0
votes
4answers
165 views

Find something out about a former process

Yesterday my vServer was shut down by my provider cause of some unusual load. They told me there were multiple processes running with the name dtdfs. I also see in the log that there was some some ...
2
votes
2answers
543 views

How to get access denied for files logged in WIndows event log

I need to log access denied events for files and directories on a Windows Server 2008 R2. How do I go about getting them into the Windows Event Log?
0
votes
3answers
1k views

Finding outbound connections from Apache/PHP

A client website was recently compromised, and we're analyzing the damage and exposure from the attack. We've found a script that is "calling home" to a URL we can easily find in a log, but is this ...
3
votes
3answers
4k views

How to see activity logs on a Linux PC?

I want to find out everything possible about how the PC was used in the past few days. Like who logged in, for how long was the PC was locked and any other information about user activity that is ...
2
votes
2answers
570 views

Web Server Users - Best Practice

I was wondering what is considered best practice when several developers/administrators require access to the same web server. Should there be one non-root user with a secure username and password ...
5
votes
6answers
4k views

Monitor the shell activity of a user on your Unix system?

Trust, but verify. Let's say I want to hire someone a sysadmin, and give them root access to my Unix system. I want to disable X windows for them, only allow shell usage (through SSH, maybe), so that ...
2
votes
3answers
2k views

repeated failing passwords in linux security log (/var/log/secure)

Recently, I opened up the SSH port through my firewalls (and redirecting to my server) so I could check on the (http) server while on the road. The first week or two there was nothing different. But ...
1
vote
2answers
58 views

Where can I find a list of the Windows EventCodes and their definitions?

It's fallen to me recently to sift through Windows logs and do some analysis on them. To start, I'm trying to get familiar with the EventCodes, but I've not had much success finding any comprehensive ...
1
vote
3answers
169 views

Giving supplier root access to server, and logging it?

One of our suppliers needs to debug a problem with an application by logging remotely into one of our servers. They'll need to have root access, which I plan to provide via ssh and sudo. I generally ...
0
votes
1answer
157 views

Unexplained spike in web traffic

Question I am suspicious of an unexplained 1600% increase in traffic and massive slow-down that lasted about 10 minutes. I'm not sure if it was an attempted DoS attack, dictionary login attack, etc. ...
4
votes
4answers
5k views

How to trace possible SQL injection attack?

We just had one of our (fairly important) wordpress databases inexplicably dropped. Fortunately we keep nightly backups so it's not going to be the end of the world, but I want to avoid or at least be ...
4
votes
2answers
707 views

MySQL enabling the query log for the root user only

I want to an audit log for a particular user/connection and not the application itself. Anytime a client manually connects to the server with specific credentials, I want the query log, and binary ...
2
votes
2answers
638 views

What's the best way to get notified of a user login on Linux?

I'm currently using gentoo and have the following method of knowing when anyone logs into my server (it's really just me, but if anyone were to gain access, I'd want to know about it) 1) Use sec to ...
1
vote
1answer
1k views

Strange Centos 5 Lighttpd access log

I've investigated my Lighttpd access log and found some strange things listed below. I do not know if it's good or bad, but bearshare? I was never or these sites I use my Centos only for website ...
3
votes
2answers
2k views

OSSIM - Snort/OSSEC/Nagios Logging Config Question

Quick n00b OSSIM question. I've looked around but haven't found exactly what I'm looking for. I currently have a Nagios, OSSEC, Nessus, and Snort server and I want to keep those servers active but ...
6
votes
11answers
152 views

Security, user access, login and reporting. How do you mentally adjust for the negative aspects of security management?

Employees get laid off, do stupid things (like peek at a porn site), talk about personally offensive/suggestive subjects on IM & email. As IT Manager, I am tasked to lock user accounts, change ...
4
votes
5answers
489 views

Logs worth to keep and analyze in a central repository

In the need to centralize logs we have selected syslog as the collector and Splunk (free for now) as the analysis tool, but there's always the question about which events should get to the central ...
0
votes
5answers
5k views

How to log all Internet traffic that goes through a server running Windows 2008?

I have a need to find out how to log all Internet traffic of all users on a network that uses a Windows Server 2008 machine to provide Internet access to the entire network. I know, since this server ...
1
vote
3answers
668 views

Auditing on UNIX System

I'm working on a project which requires some auditing of read/write/modifications to various files. Additionally I must log ftp access, user logins, NTP/system time changes etc. Is there a nice tool ...
6
votes
3answers
1k views

Is SSH logging capabilities equivalent to su logging for private/public key authentication?

Here at work, we have a non-root shared login account on UNIX that is used to admin a particular application. The policy is to not allow direct logins to the shared account; you must login as yourself ...