The tag has no wiki summary.

learn more… | top users | synonyms

-1
votes
2answers
36 views

Audit policy applied, then removed after each gpupdate

This question addresses my issue, however the solution isn't solving it on all my workstations. One of my workstations turned off auditing this morning magically on its own. Each time I run a gpupdate ...
0
votes
0answers
28 views

Failed logons not being audited Server 2008r2

We recently configured advanced auditing on our Windows Server 2008 R2 domain and now the domain controller is not displaying failed user login attempts. There are some 4625 login failures, but none ...
-3
votes
3answers
90 views

How to find out who accessed a document? [closed]

I got a call today from a friend asking for help, it is not my area, he is from a school, it is a big institution. They have 2 windows 2003 server sp 1, one for MS Sql and the other is Domain ...
0
votes
0answers
117 views

Check for SSL Weak Ciphers SSL3_RSA_RC4_128_MD5, SSL3_RSA_RC4_128_SHA, TLS1_RSA_RC4_128_MD5, TLS1_RSA_RC4_128_SHA

I am getting a serve ready for PCI compliance, and have one area with crypto from apache with the following report: Weak ciphers offered by this service: SSL3_RSA_RC4_128_MD5 SSL3_RSA_RC4_128_SHA ...
0
votes
1answer
74 views

Security Auditing on Ubuntu 14.04 LTS

The Tiger security auditing tool has been a standard install in the past. However, it doesn't look like Tiger is being updated. Is Tiger still a valid security auditing tool on Ubuntu 14.04. If ...
0
votes
1answer
71 views

Is it possible to create a read-only user account for security auditing purposes?

An organization requires several administrators to have a role of a security auditor. They must have read-only (via network/remote) access to Windows Server 2008 / R2 systems and have permissions to ...
0
votes
0answers
40 views

Ssecurity Log (Audit Event 5140) ipc$

The security log on my file server is filling up with Event 5140 for connections to \*\IPC$ This makes my security log useless for auditing file share events. How do I disable auditing security ...
1
vote
0answers
45 views

CIS benchmark: How to define the BUILTIN\Administrator account within GPOs?

I am responsible for configuring GPOs according to the latest CIS benchmark policy. However the test for "Impersonate a client after authentication" always fails, although everything seems to be ...
0
votes
2answers
67 views

reset aspnet machince account password

Our small Windows Active Directory domain is undergoing a security review by our grandparent company. I am the Domain Administrator of this domain of about 25 Win2K3, Win2K8, Enterprise & ...
3
votes
1answer
77 views

How to monitor Windows server Registry changes [closed]

Hi i want tools or audit policy that can help me to track all changes made to windows server registry (include who done the change - what is the old value -what is new value -change type {delete ...
0
votes
1answer
51 views

Exchange 2010 security audit

Our IT department has received reports from HR that managers are reading their subordinates email, and we've been tasked with identifying if there is a technical way to achieve this. I'm looking for ...
1
vote
0answers
2k views

Error 4673 audit failure filling security logs

I have an isolated desktop computer in my office that I run weekly security audits on. I check the logs for odd behavior then export and clear them out. The logs are filled with "Audit failure ...
0
votes
1answer
77 views

Helpful linux command for do some forensic on compromised linux web server [duplicate]

What are helpful linux command for do some forensic on compromised linux web server for giving out sort of information/evidence/backtrace? for example checking log, checking last file edit, suspicious ...
1
vote
1answer
130 views

Windows Server Auditing Capabilities

I was curious if it were possible to audit a file share on windows server 2012 for a copy. How can one differentiate a copied file rather than a read file based on the events they send to the event ...
0
votes
1answer
54 views

Linux Monthly Login Report

Is there a command to find out if anyone logged into a machine as one of the System IDs (bin, sshd, rpc, etc)? I've tried last, faillog, ausearch and aureport (this has worked the best), but I'd like ...
1
vote
1answer
132 views

windows security log - failure reason startswith %%

Please help - do You have the list with descriptions of failure reasons eg. %%2313, %%2307... I've researched Net and nothing.. :( Mainly I see it in ID 4625 in Windows security logs. On ...
4
votes
2answers
3k views

Filtering Security Logs by User and Logon Type

I have been asked to find out when a user has logged on to the system in the last week. Now the audit logs in Windows should contain all the info I need. I think if I search for Event ID 4624 (Logon ...
1
vote
1answer
154 views

vsftpd on ubuntu saucy - “OOPS: Child died”

I have installed vsftpd with apt-get install vsftpd on my freshly deployed ubuntu saucy amd64 linode. vsftpd starts but when I connect to it from an ftp client, even from localhost, I get this error: ...
2
votes
1answer
171 views

SSAE 16 and application to datacenters and SaaS providers

Where in ssae 16 does it describe specific operational proceedures for data centers or SaaS providers? Where does it describe restrictions on who can access production hardware? Is this ...
1
vote
1answer
87 views

Ignore specific types with auditd

I've recently been playing around with auditd and trying to cut out some of what it is logging. Here is my audit.rules entry to log execve # First rule - delete all -D -a always,exit -F arch=b64 -S ...
2
votes
1answer
312 views

Auditing full access permissions on Exchange 2010 without audit being on

We are currently running Exchange 2010 SP1. I would like to see who has been granted full access or send as permissions on a specific mailbox, the issue is we do not have audit logging turned on this ...
1
vote
1answer
22 views

SQL Server Access Logs

Is it possible to show some type of access log where a valid user (who had access to a specific database [or multiple ones]) tried to access a database they didn't have access to? For example, if I ...
2
votes
2answers
276 views

Passing PCI Scan on apache 2.2.22

We are on Ubuntu 12.04 and apache 2.2.2 version. We had PCI scan done on our site and 2 vulnerabilities came out that we can not get under control. First one is BEAST attack and other one SSL RC4 ...
-3
votes
1answer
53 views

how to prevent windows server massive login tries [closed]

i've been looking to a windows 8 web server eventlog on security option and i'm wordless with the ammout of audit failure logs. what i'm trying to understand is that i've very, very much audit ...
0
votes
1answer
256 views

Patch management on multiple systems

I'm in charge of auditing the security configuration of an important farm of Unix servers. So far, I came up with a way to assess the basic configuration but not the installed updates. The very ...
2
votes
1answer
91 views

Freqeunt Failure Audit errors on web server (MSSQLSERVER)

We have detected a lot of Failure Audit errors (MSSQLSERVER) on our Web Server for. Something like Login failed for user 'sa'. [CLIENT: 74.208.102.175] For more information, see Help and ...
0
votes
1answer
156 views

MBSA fails MSSQL folder permissions because MSSQL$SQLEXPRESS has access

I am not sure what exactly it's expecting. If you remove this user the check passes, but the server fails. How can it be resolved so the check passes, yet it has the limited permissions MBSA is ...
0
votes
1answer
350 views

Windows Server 2008 R2 (Rdp) Logon Audit trail

Is there a way to to retrieve an audit trail / history of remote/rdp logons for a particular user on a Windows 2008 R2 machine? We have a server here in our intranet which has a domain-wide user as ...
0
votes
3answers
91 views

Tamper-proof AWS AMI

I need to convince my customer that my server to which he submits his sensitive data runs only applications/processes approved by him. Also the customer is not allowed to get access to my server. He ...
0
votes
2answers
279 views

selinux Missing type enforcement (TE) allow rule

When I run my FTP test to test for full functionality, I'm concerned on why am I getting an avc denial error on such a popular command, such as 'mkdir'? Here is the AVC denial message: type=AVC ...
0
votes
1answer
54 views

Win 2008r2 Audit

I'm trying to turn on auditing but every time i check Success and failure in Local policy / Computer Conf/Windows settings/security settings/local policies/Audit Policy/ Audit Object access, it turns ...
-1
votes
1answer
110 views

Vulnerability Assessment against application [closed]

Is it legal to run a vuln assessment vs. a site other than one you currently own? Say you own a security software and want to test potential clients' websites for vulnerabilities (without their ...
3
votes
1answer
132 views

What's the difference between these two GPO options?

What's the difference between the two GPO options below? NETWORK ACCESS : DO NOT ALLOW storage of credentials or .NET passports for network NETWORK ACCESS : DO NOT ALLOW storage of passwords and ...
1
vote
1answer
153 views

central log-server with auditdisp

I want to setup a central log-server. The log-server is running with debian 6.0.6 and the audit daemon is installed in version 1.7.13-1. The Clients are running with Red Hat 5.5 and they connect to ...
3
votes
3answers
694 views

How to check which process/utility/cron created/modified a file/folder in Linux

I have a folder on server, which has a website in it. the server has been cutoff from the internet, but after some time, few folders are automatically created in it with some suspicious files inside ...
1
vote
0answers
29 views

Software for defining rules for folder permissions and monitoring deviations

Let's say a company has a large number of users, and each user has a home area. On each share used for home area folders, I would like to define some rules saying who is supposed to have which ...
5
votes
1answer
838 views

ActiveSync Audit: Who sent the Remote Wipe command to a device?

I need to perform and audit of how many Remote wipe commands have been sent, who sent them, and to which user's devices? Can someone let me know if this is possible? I get lots of Google hits for ...
1
vote
2answers
2k views

How to safely use corporate Active Directory (LDAP) authentication for an internet facing web site? [closed]

Let's say you have a public web service (Jira in my case) that is used by both intranet users and external users. The server is already configured to use HTTPS (secure). Because the server is ...
0
votes
0answers
156 views

Windows Server 2008 Security Auditing Disabled

I have a Windows Server 2008r2 that is hosted by a 3rd party company (fairly common set up where the hosting company provides the hardware/software). A few days ago, I noticed all of the Security ...
5
votes
1answer
448 views

Locking Preferences in Mozilla

For security reasons, we need to "lock" some of the preferences in Mozilla Firefox. We are running Windows XP and the latest version of Mozilla version 14.0.1. In particular some of the security ...
1
vote
0answers
99 views

Client Address is not showing correct in Event Log

I had enable the Advance Audit Policy Configuration on my Domain Controller. Server OS - Window Server 2008 R2 Standard. Client OS - Window XP Whenever the Domain User enter wrong password for ...
1
vote
0answers
136 views

The description for Event ID (560) in Source (security) cannot be found. with users in specified group

I have some users in a group that look at the audits. They are in a group I created. This group should have permissions to view the security audits. They can see them, but the descriptions are ...
0
votes
1answer
40 views

Any high-level and cross-platform wrappers for security event auditing

There exists some high-level wrappers for system file events, for here it is an example of usage of Listen ruby gem: Listen.to('some/path', 'some/another/path', :filter => [/\.tmp$/]) do ...
-2
votes
3answers
408 views

Reliably find out if application is using encryption

There is an client-server app written in Java. They communicate to each other somehow. Unfortunately our technician is not reliable (we are going to fire him). He accepted that application from the ...
3
votes
1answer
4k views

How to determine which user sent a specific email with postfix?

We have a postfix server that requires authentication to SMTP relay through it. We use virtual mailboxes in MySQL database. A message was relayed through our system, and we need to determine which ...
5
votes
1answer
95 views

Track bandwith usage by application

I have a server at Rackspace and noticed my server is suddenly sending out 2GB of data per month (this is atypical since I don't use it that much) How can I figure out what application is using that ...
2
votes
3answers
13k views

How to enable Audit Failure logs in Active Directory?

I have a user account that keeps on getting locked out. I am trying to find out what caused it. So I want to enabled failure audits in event viewer as a start. But, I don't know how! How do I enable ...
2
votes
1answer
627 views

Windows Server 2008 - Find out who put a user to a local user group?

How it´s possible to find out, who put a user on a WS 2008 R2 server to a local group? Sometimes I´m wondering, why is this user on this system in this group. I think, the easiest way is to ask the ...
5
votes
2answers
598 views

Options for PCI-DSS on AWS - file integrity monitoring and intrusion detection

I need to deploy some file integrity monitoring and intrusion detections software on AWS instances. I really wanted to use OSSEC, however it does not work well in an environment where servers can ...
4
votes
4answers
360 views

How to audit security on Remote Employees' PCs?

We have several remote developers who are working on our code and have access to our FTP server. Recently someone copied an infected file to the FTP server and virus spread throughout the whole FTP ...