The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
0answers
9 views

Error 4673 audit failure filling security logs

I have an isolated desktop computer in my office that I run weekly security audits on. I check the logs for odd behavior then export and clear them out. The logs are filled with "Audit failure ...
-1
votes
1answer
34 views

Helpful linux command for do some forensic on compromised linux web server [duplicate]

What are helpful linux command for do some forensic on compromised linux web server for giving out sort of information/evidence/backtrace? for example checking log, checking last file edit, suspicious ...
1
vote
1answer
66 views

Windows Server Auditing Capabilities

I was curious if it were possible to audit a file share on windows server 2012 for a copy. How can one differentiate a copied file rather than a read file based on the events they send to the event ...
0
votes
1answer
43 views

Linux Monthly Login Report

Is there a command to find out if anyone logged into a machine as one of the System IDs (bin, sshd, rpc, etc)? I've tried last, faillog, ausearch and aureport (this has worked the best), but I'd like ...
1
vote
1answer
43 views

windows security log - failure reason startswith %%

Please help - do You have the list with descriptions of failure reasons eg. %%2313, %%2307... I've researched Net and nothing.. :( Mainly I see it in ID 4625 in Windows security logs. On ...
1
vote
1answer
168 views

Filtering Security Logs by User and Logon Type

I have been asked to find out when a user has logged on to the system in the last week. Now the audit logs in Windows should contain all the info I need. I think if I search for Event ID 4624 (Logon ...
1
vote
1answer
68 views

vsftpd on ubuntu saucy - “OOPS: Child died”

I have installed vsftpd with apt-get install vsftpd on my freshly deployed ubuntu saucy amd64 linode. vsftpd starts but when I connect to it from an ftp client, even from localhost, I get this error: ...
2
votes
1answer
61 views

SSAE 16 and application to datacenters and SaaS providers

Where in ssae 16 does it describe specific operational proceedures for data centers or SaaS providers? Where does it describe restrictions on who can access production hardware? Is this ...
0
votes
0answers
41 views

Ignore specific types with auditd

I've recently been playing around with auditd and trying to cut out some of what it is logging. Here is my audit.rules entry to log execve # First rule - delete all -D -a always,exit -F arch=b64 -S ...
2
votes
1answer
56 views

Auditing full access permissions on Exchange 2010 without audit being on

We are currently running Exchange 2010 SP1. I would like to see who has been granted full access or send as permissions on a specific mailbox, the issue is we do not have audit logging turned on this ...
1
vote
1answer
19 views

SQL Server Access Logs

Is it possible to show some type of access log where a valid user (who had access to a specific database [or multiple ones]) tried to access a database they didn't have access to? For example, if I ...
2
votes
2answers
185 views

Passing PCI Scan on apache 2.2.22

We are on Ubuntu 12.04 and apache 2.2.2 version. We had PCI scan done on our site and 2 vulnerabilities came out that we can not get under control. First one is BEAST attack and other one SSL RC4 ...
-3
votes
1answer
42 views

how to prevent windows server massive login tries [closed]

i've been looking to a windows 8 web server eventlog on security option and i'm wordless with the ammout of audit failure logs. what i'm trying to understand is that i've very, very much audit ...
0
votes
1answer
126 views

Patch management on multiple systems

I'm in charge of auditing the security configuration of an important farm of Unix servers. So far, I came up with a way to assess the basic configuration but not the installed updates. The very ...
2
votes
1answer
76 views

Freqeunt Failure Audit errors on web server (MSSQLSERVER)

We have detected a lot of Failure Audit errors (MSSQLSERVER) on our Web Server for. Something like Login failed for user 'sa'. [CLIENT: 74.208.102.175] For more information, see Help and ...
0
votes
1answer
111 views

MBSA fails MSSQL folder permissions because MSSQL$SQLEXPRESS has access

I am not sure what exactly it's expecting. If you remove this user the check passes, but the server fails. How can it be resolved so the check passes, yet it has the limited permissions MBSA is ...
0
votes
1answer
143 views

Windows Server 2008 R2 (Rdp) Logon Audit trail

Is there a way to to retrieve an audit trail / history of remote/rdp logons for a particular user on a Windows 2008 R2 machine? We have a server here in our intranet which has a domain-wide user as ...
0
votes
3answers
84 views

Tamper-proof AWS AMI

I need to convince my customer that my server to which he submits his sensitive data runs only applications/processes approved by him. Also the customer is not allowed to get access to my server. He ...
0
votes
2answers
165 views

selinux Missing type enforcement (TE) allow rule

When I run my FTP test to test for full functionality, I'm concerned on why am I getting an avc denial error on such a popular command, such as 'mkdir'? Here is the AVC denial message: type=AVC ...
0
votes
1answer
44 views

Win 2008r2 Audit

I'm trying to turn on auditing but every time i check Success and failure in Local policy / Computer Conf/Windows settings/security settings/local policies/Audit Policy/ Audit Object access, it turns ...
-1
votes
1answer
109 views

Vulnerability Assessment against application [closed]

Is it legal to run a vuln assessment vs. a site other than one you currently own? Say you own a security software and want to test potential clients' websites for vulnerabilities (without their ...
3
votes
1answer
114 views

What's the difference between these two GPO options?

What's the difference between the two GPO options below? NETWORK ACCESS : DO NOT ALLOW storage of credentials or .NET passports for network NETWORK ACCESS : DO NOT ALLOW storage of passwords and ...
1
vote
1answer
118 views

central log-server with auditdisp

I want to setup a central log-server. The log-server is running with debian 6.0.6 and the audit daemon is installed in version 1.7.13-1. The Clients are running with Red Hat 5.5 and they connect to ...
3
votes
3answers
376 views

How to check which process/utility/cron created/modified a file/folder in Linux

I have a folder on server, which has a website in it. the server has been cutoff from the internet, but after some time, few folders are automatically created in it with some suspicious files inside ...
1
vote
0answers
29 views

Software for defining rules for folder permissions and monitoring deviations

Let's say a company has a large number of users, and each user has a home area. On each share used for home area folders, I would like to define some rules saying who is supposed to have which ...
4
votes
1answer
470 views

ActiveSync Audit: Who sent the Remote Wipe command to a device?

I need to perform and audit of how many Remote wipe commands have been sent, who sent them, and to which user's devices? Can someone let me know if this is possible? I get lots of Google hits for ...
1
vote
2answers
1k views

How to safely use corporate Active Directory (LDAP) authentication for an internet facing web site? [closed]

Let's say you have a public web service (Jira in my case) that is used by both intranet users and external users. The server is already configured to use HTTPS (secure). Because the server is ...
0
votes
0answers
129 views

Windows Server 2008 Security Auditing Disabled

I have a Windows Server 2008r2 that is hosted by a 3rd party company (fairly common set up where the hosting company provides the hardware/software). A few days ago, I noticed all of the Security ...
5
votes
1answer
352 views

Locking Preferences in Mozilla

For security reasons, we need to "lock" some of the preferences in Mozilla Firefox. We are running Windows XP and the latest version of Mozilla version 14.0.1. In particular some of the security ...
1
vote
0answers
85 views

Client Address is not showing correct in Event Log

I had enable the Advance Audit Policy Configuration on my Domain Controller. Server OS - Window Server 2008 R2 Standard. Client OS - Window XP Whenever the Domain User enter wrong password for ...
1
vote
0answers
121 views

The description for Event ID (560) in Source (security) cannot be found. with users in specified group

I have some users in a group that look at the audits. They are in a group I created. This group should have permissions to view the security audits. They can see them, but the descriptions are ...
0
votes
1answer
40 views

Any high-level and cross-platform wrappers for security event auditing

There exists some high-level wrappers for system file events, for here it is an example of usage of Listen ruby gem: Listen.to('some/path', 'some/another/path', :filter => [/\.tmp$/]) do ...
-2
votes
3answers
307 views

Reliably find out if application is using encryption

There is an client-server app written in Java. They communicate to each other somehow. Unfortunately our technician is not reliable (we are going to fire him). He accepted that application from the ...
3
votes
1answer
3k views

How to determine which user sent a specific email with postfix?

We have a postfix server that requires authentication to SMTP relay through it. We use virtual mailboxes in MySQL database. A message was relayed through our system, and we need to determine which ...
5
votes
1answer
92 views

Track bandwith usage by application

I have a server at Rackspace and noticed my server is suddenly sending out 2GB of data per month (this is atypical since I don't use it that much) How can I figure out what application is using that ...
1
vote
3answers
8k views

How to enable Audit Failure logs in Active Directory?

I have a user account that keeps on getting locked out. I am trying to find out what caused it. So I want to enabled failure audits in event viewer as a start. But, I don't know how! How do I enable ...
2
votes
1answer
494 views

Windows Server 2008 - Find out who put a user to a local user group?

How it´s possible to find out, who put a user on a WS 2008 R2 server to a local group? Sometimes I´m wondering, why is this user on this system in this group. I think, the easiest way is to ask the ...
5
votes
2answers
489 views

Options for PCI-DSS on AWS - file integrity monitoring and intrusion detection

I need to deploy some file integrity monitoring and intrusion detections software on AWS instances. I really wanted to use OSSEC, however it does not work well in an environment where servers can ...
4
votes
4answers
356 views

How to audit security on Remote Employees' PCs?

We have several remote developers who are working on our code and have access to our FTP server. Recently someone copied an infected file to the FTP server and virus spread throughout the whole FTP ...
1
vote
0answers
153 views

How to identify vulnerability (.htaccess files have been added/modified) [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY All the .htaccess files inside doc roots of all my virtual hosts seem to have been hacked and have the following code prepended to ...
1
vote
6answers
252 views

Securing the network: IP conflicts and its solutions

Today I found out that I don't know how to fix IP conflicts. Say you have a server with IP1 another machine connects and assigns itself IP1. How do people usually prevent this? How they(you) ...
1
vote
2answers
644 views

Turn on file auditing on network share in server 2008 r2

I have a server running 2008 R2 , is there a role / function on this that can be added / enabled that audits file access. e.g user1 deleted this folder, this file was edited by user2 etc. I have been ...
0
votes
4answers
209 views

How to determine the cause of high resource usage for two hours last week?

I know there are several tools I can use to find out what's causing heavy network and CPU usage right now, but every so often on my server I'll check the logs and notice that there were periods of ...
3
votes
3answers
118 views

Storing sensitive information on wiki

For my sins, I am now in charge of a host of sensitive information: encryption key storage policies, network architecture diagrams, etc. We will soon be covered by HIPPA, so the pain increases. Not ...
0
votes
1answer
153 views

Detect mysql password changes from logs

How can I find out who last changed the MySQL database password for the "root" user. I'm using Ubuntu.
1
vote
1answer
214 views

Audit folder permissions on a windows server

I have a number of servers in the corporate domain that seem to randomly lose ACL permissions to the TEMP folders (c:\temp, c:\windows\temp and any temp folder defined in the environment variables). ...
0
votes
2answers
118 views

Scanning Vendors (non-PCI related) - Hype or Not?

For months now, when building websites for clients, I've come across virtually trillions of "Site Security Scanners" supposedly endorsed/approved by various shared web hosts who claim to run XSS, SQL ...
3
votes
2answers
948 views

Is there a way to disable the ptrace system call on RHEL5 Linux?

Is there any wat to disable the ptrace system call on RHEL5?
6
votes
9answers
1k views

Is it worth hiring a hacker to perform some penetration testing on my servers? [closed]

I'm working in a small IT company with paranoid clients, so security has always been an important consideration to us. In the past, we've already mandated penetration testing from two independent ...
3
votes
2answers
264 views

Check the ip addresses accessing my server

I'm running a Cent OS Linux apache web server, and its primary function is to serve the content in an iframe to one specific ip address. I want to see all ip addresses that have accessed the web ...