The security-audit tag has no wiki summary.
0
votes
1answer
40 views
+50
MBSA fails MSSQL folder permissions because MSSQL$SQLEXPRESS has access
I am not sure what exactly it's expecting. If you remove this user the check passes, but the server fails.
How can it be resolved so the check passes, yet it has the limited permissions MBSA is ...
0
votes
0answers
50 views
How to securely audit passwords using John the Ripper [migrated]
When my clients create a password, they are shown a strength meter and I have set the requirements fairly high. However, the strength meter is essentially only useful if being attacked by a very dumb ...
0
votes
1answer
43 views
Windows Server 2008 R2 (Rdp) Logon Audit trail
Is there a way to to retrieve an audit trail / history of remote/rdp logons for a particular user on a Windows 2008 R2 machine?
We have a server here in our intranet which has a domain-wide user as ...
0
votes
3answers
70 views
Tamper-proof AWS AMI
I need to convince my customer that my server to which he submits his sensitive data runs only applications/processes approved by him. Also the customer is not allowed to get access to my server. He ...
0
votes
2answers
38 views
selinux Missing type enforcement (TE) allow rule
When I run my FTP test to test for full functionality, I'm concerned on why am I getting an avc denial error on such a popular command, such as 'mkdir'?
Here is the AVC denial message:
type=AVC ...
0
votes
1answer
30 views
Win 2008r2 Audit
I'm trying to turn on auditing but every time i check Success and failure in Local policy / Computer Conf/Windows settings/security settings/local policies/Audit Policy/ Audit Object access, it turns ...
-1
votes
1answer
102 views
Vulnerability Assessment against application [closed]
Is it legal to run a vuln assessment vs. a site other than one you currently own?
Say you own a security software and want to test potential clients' websites for vulnerabilities (without their ...
0
votes
0answers
54 views
Solaris 10 Auditing of HTTP / HTTPS Request Logs
I need to gather data about HTTP/S requests made to the server. However, the application server (IBM WebSphere 7) running on it doesn't have any auditing turned on, and the applications on it don't ...
0
votes
0answers
24 views
What events are related to exchange server if downloads an attachment?
I'm exhaustively trying to find a event id that maps to user-action resulting into download of attachment. I'm requiring this information as i need to build use case as SIEM requirement.
The lack of ...
0
votes
0answers
26 views
FreeRadius securing the service
radiusd -v
radiusd: FreeRADIUS Version 2.1.12, for host i386-redhat-linux-gnu, built on Oct 3 2012 at 01:20:08
I have the firewall blocking ALL ports but allows the IPs of the VPN servers to ...
3
votes
1answer
68 views
What's the difference between these two GPO options?
What's the difference between the two GPO options below?
NETWORK ACCESS : DO NOT ALLOW storage of credentials or .NET passports for network
NETWORK ACCESS : DO NOT ALLOW storage of passwords and ...
1
vote
1answer
90 views
central log-server with auditdisp
I want to setup a central log-server. The log-server is running with debian 6.0.6 and the audit daemon is installed in version 1.7.13-1.
The Clients are running with Red Hat 5.5 and they connect to ...
3
votes
3answers
102 views
How to check which process/utility/cron created/modified a file/folder in Linux
I have a folder on server, which has a website in it. the server has been cutoff from the internet, but after some time, few folders are automatically created in it with some suspicious files inside ...
1
vote
0answers
27 views
Software for defining rules for folder permissions and monitoring deviations
Let's say a company has a large number of users, and each user has a home area.
On each share used for home area folders, I would like to define some rules saying who is supposed to have which ...
0
votes
0answers
76 views
Audit object access stays in No Auditing in LSP
We trying to enable objects auditing policy on 2008 R2, and enabled for that "Audit object access" on both Domain and Domain controller levels.
The problem that in our Local Security Policy, the ...
4
votes
1answer
182 views
ActiveSync Audit: Who sent the Remote Wipe command to a device?
I need to perform and audit of how many Remote wipe commands have been sent, who sent them, and to which user's devices?
Can someone let me know if this is possible? I get lots of Google hits for ...
0
votes
2answers
737 views
How to safely use corporate Active Directory (LDAP) authentication for an internet facing web site? [closed]
Let's say you have a public web service (Jira in my case) that is used by both intranet users and external users. The server is already configured to use HTTPS (secure).
Because the server is ...
0
votes
0answers
96 views
Windows Server 2008 Security Auditing Disabled
I have a Windows Server 2008r2 that is hosted by a 3rd party company (fairly common set up where the hosting company provides the hardware/software).
A few days ago, I noticed all of the Security ...
5
votes
1answer
228 views
Locking Preferences in Mozilla
For security reasons, we need to "lock" some of the preferences in Mozilla Firefox. We are running Windows XP and the latest version of Mozilla version 14.0.1. In particular some of the security ...
1
vote
0answers
75 views
Client Address is not showing correct in Event Log
I had enable the Advance Audit Policy Configuration on my Domain Controller.
Server OS - Window Server 2008 R2 Standard.
Client OS - Window XP
Whenever the Domain User enter wrong password for ...
1
vote
0answers
83 views
The description for Event ID (560) in Source (security) cannot be found. with users in specified group
I have some users in a group that look at the audits. They are in a group I created. This group should have permissions to view the security audits. They can see them, but the descriptions are ...
0
votes
1answer
36 views
Any high-level and cross-platform wrappers for security event auditing
There exists some high-level wrappers for system file events, for here it is an example of usage of Listen ruby gem:
Listen.to('some/path', 'some/another/path', :filter => [/\.tmp$/]) do ...
-2
votes
3answers
133 views
Reliably find out if application is using encryption
There is an client-server app written in Java. They communicate to each other somehow.
Unfortunately our technician is not reliable (we are going to fire him).
He accepted that application from the ...
2
votes
1answer
681 views
How to determine which user sent a specific email with postfix?
We have a postfix server that requires authentication to SMTP relay through it. We use virtual mailboxes in MySQL database.
A message was relayed through our system, and we need to determine which ...
5
votes
1answer
89 views
Track bandwith usage by application
I have a server at Rackspace and noticed my server is suddenly sending out 2GB of data per month (this is atypical since I don't use it that much)
How can I figure out what application is using that ...
0
votes
2answers
5k views
How to enable Audit Failure logs in Active Directory?
I have a user account that keeps on getting locked out. I am trying to find out what caused it. So I want to enabled failure audits in event viewer as a start. But, I don't know how!
How do I enable ...
2
votes
1answer
231 views
Windows Server 2008 - Find out who put a user to a local user group?
How it´s possible to find out, who put a user on a WS 2008 R2 server to a local group?
Sometimes I´m wondering, why is this user on this system in this group.
I think, the easiest way is to ask the ...
4
votes
1answer
360 views
Options for PCI-DSS on AWS - file integrity monitoring and intrusion detection
I need to deploy some file integrity monitoring and intrusion detections software on AWS instances.
I really wanted to use OSSEC, however it does not work well in an environment where servers can ...
4
votes
4answers
344 views
How to audit security on Remote Employees' PCs?
We have several remote developers who are working on our code and have access to our FTP server. Recently someone copied an infected file to the FTP server and virus spread throughout the whole FTP ...
1
vote
0answers
153 views
How to identify vulnerability (.htaccess files have been added/modified) [duplicate]
Possible Duplicate:
My server's been hacked EMERGENCY
All the .htaccess files inside doc roots of all my virtual hosts seem to have been hacked and have the following code prepended to ...
1
vote
6answers
218 views
Securing the network: IP conflicts and its solutions
Today I found out that I don't know how to fix IP conflicts.
Say you have a server with IP1
another machine connects and assigns itself IP1.
How do people usually prevent this? How they(you) ...
1
vote
2answers
236 views
Turn on file auditing on network share in server 2008 r2
I have a server running 2008 R2 , is there a role / function on this that can be added / enabled that audits file access. e.g user1 deleted this folder, this file was edited by user2 etc. I have been ...
0
votes
4answers
181 views
How to determine the cause of high resource usage for two hours last week?
I know there are several tools I can use to find out what's causing heavy network and CPU usage right now, but every so often on my server I'll check the logs and notice that there were periods of ...
3
votes
3answers
113 views
Storing sensitive information on wiki
For my sins, I am now in charge of a host of sensitive information: encryption key storage policies, network architecture diagrams, etc. We will soon be covered by HIPPA, so the pain increases.
Not ...
0
votes
1answer
114 views
Detect mysql password changes from logs
How can I find out who last changed the MySQL database password for the "root" user.
I'm using Ubuntu.
0
votes
1answer
169 views
Audit folder permissions on a windows server
I have a number of servers in the corporate domain that seem to randomly lose ACL permissions to the TEMP folders (c:\temp, c:\windows\temp and any temp folder defined in the environment variables).
...
0
votes
2answers
111 views
Scanning Vendors (non-PCI related) - Hype or Not?
For months now, when building websites for clients, I've come across virtually trillions of "Site Security Scanners" supposedly endorsed/approved by various shared web hosts who claim to run XSS, SQL ...
3
votes
2answers
749 views
Is there a way to disable the ptrace system call on RHEL5 Linux?
Is there any wat to disable the ptrace system call on RHEL5?
4
votes
8answers
782 views
Is it worth hiring a hacker to perform some penetration testing on my servers?
I'm working in a small IT company with paranoid clients, so security has always been an important consideration to us. In the past, we've already mandated penetration testing from two independent ...
3
votes
2answers
194 views
Check the ip addresses accessing my server
I'm running a Cent OS Linux apache web server, and its primary function is to serve the content in an iframe to one specific ip address. I want to see all ip addresses that have accessed the web ...
2
votes
1answer
4k views
How to log when a file is accessed on server share? Win Server 2008. Student needing help!
Hi All I am a student in a Information Technology Program and I need a little help.
ISSUE CLIFF NOTES
Have a few files in a share folder on a server that need logged when they are opened and by ...
0
votes
1answer
114 views
Backup and Restore privilege
I have a windows server 2008 r2 and I want to give the built in Administrator acount backup and restore previllige
how can i do this?
Greetz
1
vote
1answer
104 views
SQL Server 2008 Audit Service
I'm designing an application that will run on SQL Server 2008 R2. There's a requirement to audit any updates to a customer table. The new Audit service that was release as part of SQL Server 2008 ...
1
vote
1answer
102 views
Where I can get the SQL-Server 2005 C2 Audit Event List
I couldn't found the list of SQL-Server 2005 C2 Audit Events on google! Any suggestion?
0
votes
3answers
114 views
Is there a way to tell if there is key stroke logging software installed? [closed]
I have a Windows-XP machine as my desktop system at work. Is there any way to tell if there is keystroke logging software running on my system or any other software that may be monitoring my system ...
1
vote
1answer
326 views
PGP encryption key with split-knowledge and dual control
An auditor recommends:
We recommend that PGP environment be re-keyed using the industry required (ISO x9.8 and x9.24) standards of “split-knowledge and dual control”
Is there something that we're ...
1
vote
2answers
823 views
problem of setting audit rules: Syscall name unknown: stime
I am setting audit rules in /etc/audit/audit.rules.
As the requirement : The audit system should be configured to audit all administrative, privileged, and security actions.
So I add one line into ...
2
votes
1answer
185 views
Server 2003 DNS Auditing
I used the instructions on the following link to set up DNS auditing on Server 2003:
http://blogs.technet.com/b/yuridiogenes/archive/2008/03/06/auditing-a-dns-zone.aspx
It works. When ever a forward ...
1
vote
1answer
606 views
How can I monitor user access to a shared folder on Windows SBS 2008
I have multiple shared folders on Windows SBS 2008 server. I need to be able to tell if a domain user is accessing these shares and copying large quantities of files to their laptop. Is there a way of ...
1
vote
1answer
381 views
windows 2003 server security audit -logging computer IP
We have a network with 1 primary domain controller and 3 additional domain controllers.
We're trying to identify a user who attempted to use someone else's credentials to access some resources in our ...
