The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
2answers
18 views

reset aspnet machince account password

Our small Windows Active Directory domain is undergoing a security review by our grandparent company. I am the Domain Administrator of this domain of about 25 Win2K3, Win2K8, Enterprise & ...
3
votes
1answer
44 views

How to monitor Windows server Registry changes [closed]

Hi i want tools or audit policy that can help me to track all changes made to windows server registry (include who done the change - what is the old value -what is new value -change type {delete ...
0
votes
1answer
35 views

Exchange 2010 security audit

Our IT department has received reports from HR that managers are reading their subordinates email, and we've been tasked with identifying if there is a technical way to achieve this. I'm looking for ...
0
votes
0answers
477 views

Error 4673 audit failure filling security logs

I have an isolated desktop computer in my office that I run weekly security audits on. I check the logs for odd behavior then export and clear them out. The logs are filled with "Audit failure ...
-1
votes
1answer
50 views

Helpful linux command for do some forensic on compromised linux web server [duplicate]

What are helpful linux command for do some forensic on compromised linux web server for giving out sort of information/evidence/backtrace? for example checking log, checking last file edit, suspicious ...
1
vote
1answer
87 views

Windows Server Auditing Capabilities

I was curious if it were possible to audit a file share on windows server 2012 for a copy. How can one differentiate a copied file rather than a read file based on the events they send to the event ...
0
votes
1answer
50 views

Linux Monthly Login Report

Is there a command to find out if anyone logged into a machine as one of the System IDs (bin, sshd, rpc, etc)? I've tried last, faillog, ausearch and aureport (this has worked the best), but I'd like ...
1
vote
1answer
93 views

windows security log - failure reason startswith %%

Please help - do You have the list with descriptions of failure reasons eg. %%2313, %%2307... I've researched Net and nothing.. :( Mainly I see it in ID 4625 in Windows security logs. On ...
3
votes
2answers
659 views

Filtering Security Logs by User and Logon Type

I have been asked to find out when a user has logged on to the system in the last week. Now the audit logs in Windows should contain all the info I need. I think if I search for Event ID 4624 (Logon ...
1
vote
1answer
103 views

vsftpd on ubuntu saucy - “OOPS: Child died”

I have installed vsftpd with apt-get install vsftpd on my freshly deployed ubuntu saucy amd64 linode. vsftpd starts but when I connect to it from an ftp client, even from localhost, I get this error: ...
2
votes
1answer
110 views

SSAE 16 and application to datacenters and SaaS providers

Where in ssae 16 does it describe specific operational proceedures for data centers or SaaS providers? Where does it describe restrictions on who can access production hardware? Is this ...
0
votes
0answers
61 views

Ignore specific types with auditd

I've recently been playing around with auditd and trying to cut out some of what it is logging. Here is my audit.rules entry to log execve # First rule - delete all -D -a always,exit -F arch=b64 -S ...
2
votes
1answer
115 views

Auditing full access permissions on Exchange 2010 without audit being on

We are currently running Exchange 2010 SP1. I would like to see who has been granted full access or send as permissions on a specific mailbox, the issue is we do not have audit logging turned on this ...
1
vote
1answer
20 views

SQL Server Access Logs

Is it possible to show some type of access log where a valid user (who had access to a specific database [or multiple ones]) tried to access a database they didn't have access to? For example, if I ...
2
votes
2answers
238 views

Passing PCI Scan on apache 2.2.22

We are on Ubuntu 12.04 and apache 2.2.2 version. We had PCI scan done on our site and 2 vulnerabilities came out that we can not get under control. First one is BEAST attack and other one SSL RC4 ...
-3
votes
1answer
49 views

how to prevent windows server massive login tries [closed]

i've been looking to a windows 8 web server eventlog on security option and i'm wordless with the ammout of audit failure logs. what i'm trying to understand is that i've very, very much audit ...
0
votes
1answer
165 views

Patch management on multiple systems

I'm in charge of auditing the security configuration of an important farm of Unix servers. So far, I came up with a way to assess the basic configuration but not the installed updates. The very ...
2
votes
1answer
83 views

Freqeunt Failure Audit errors on web server (MSSQLSERVER)

We have detected a lot of Failure Audit errors (MSSQLSERVER) on our Web Server for. Something like Login failed for user 'sa'. [CLIENT: 74.208.102.175] For more information, see Help and ...
0
votes
1answer
134 views

MBSA fails MSSQL folder permissions because MSSQL$SQLEXPRESS has access

I am not sure what exactly it's expecting. If you remove this user the check passes, but the server fails. How can it be resolved so the check passes, yet it has the limited permissions MBSA is ...
0
votes
1answer
237 views

Windows Server 2008 R2 (Rdp) Logon Audit trail

Is there a way to to retrieve an audit trail / history of remote/rdp logons for a particular user on a Windows 2008 R2 machine? We have a server here in our intranet which has a domain-wide user as ...
0
votes
3answers
88 views

Tamper-proof AWS AMI

I need to convince my customer that my server to which he submits his sensitive data runs only applications/processes approved by him. Also the customer is not allowed to get access to my server. He ...
0
votes
2answers
210 views

selinux Missing type enforcement (TE) allow rule

When I run my FTP test to test for full functionality, I'm concerned on why am I getting an avc denial error on such a popular command, such as 'mkdir'? Here is the AVC denial message: type=AVC ...
0
votes
1answer
47 views

Win 2008r2 Audit

I'm trying to turn on auditing but every time i check Success and failure in Local policy / Computer Conf/Windows settings/security settings/local policies/Audit Policy/ Audit Object access, it turns ...
-1
votes
1answer
109 views

Vulnerability Assessment against application [closed]

Is it legal to run a vuln assessment vs. a site other than one you currently own? Say you own a security software and want to test potential clients' websites for vulnerabilities (without their ...
3
votes
1answer
121 views

What's the difference between these two GPO options?

What's the difference between the two GPO options below? NETWORK ACCESS : DO NOT ALLOW storage of credentials or .NET passports for network NETWORK ACCESS : DO NOT ALLOW storage of passwords and ...
1
vote
1answer
128 views

central log-server with auditdisp

I want to setup a central log-server. The log-server is running with debian 6.0.6 and the audit daemon is installed in version 1.7.13-1. The Clients are running with Red Hat 5.5 and they connect to ...
3
votes
3answers
493 views

How to check which process/utility/cron created/modified a file/folder in Linux

I have a folder on server, which has a website in it. the server has been cutoff from the internet, but after some time, few folders are automatically created in it with some suspicious files inside ...
1
vote
0answers
29 views

Software for defining rules for folder permissions and monitoring deviations

Let's say a company has a large number of users, and each user has a home area. On each share used for home area folders, I would like to define some rules saying who is supposed to have which ...
5
votes
1answer
608 views

ActiveSync Audit: Who sent the Remote Wipe command to a device?

I need to perform and audit of how many Remote wipe commands have been sent, who sent them, and to which user's devices? Can someone let me know if this is possible? I get lots of Google hits for ...
1
vote
2answers
1k views

How to safely use corporate Active Directory (LDAP) authentication for an internet facing web site? [closed]

Let's say you have a public web service (Jira in my case) that is used by both intranet users and external users. The server is already configured to use HTTPS (secure). Because the server is ...
0
votes
0answers
142 views

Windows Server 2008 Security Auditing Disabled

I have a Windows Server 2008r2 that is hosted by a 3rd party company (fairly common set up where the hosting company provides the hardware/software). A few days ago, I noticed all of the Security ...
5
votes
1answer
379 views

Locking Preferences in Mozilla

For security reasons, we need to "lock" some of the preferences in Mozilla Firefox. We are running Windows XP and the latest version of Mozilla version 14.0.1. In particular some of the security ...
1
vote
0answers
93 views

Client Address is not showing correct in Event Log

I had enable the Advance Audit Policy Configuration on my Domain Controller. Server OS - Window Server 2008 R2 Standard. Client OS - Window XP Whenever the Domain User enter wrong password for ...
1
vote
0answers
129 views

The description for Event ID (560) in Source (security) cannot be found. with users in specified group

I have some users in a group that look at the audits. They are in a group I created. This group should have permissions to view the security audits. They can see them, but the descriptions are ...
0
votes
1answer
40 views

Any high-level and cross-platform wrappers for security event auditing

There exists some high-level wrappers for system file events, for here it is an example of usage of Listen ruby gem: Listen.to('some/path', 'some/another/path', :filter => [/\.tmp$/]) do ...
-2
votes
3answers
360 views

Reliably find out if application is using encryption

There is an client-server app written in Java. They communicate to each other somehow. Unfortunately our technician is not reliable (we are going to fire him). He accepted that application from the ...
3
votes
1answer
4k views

How to determine which user sent a specific email with postfix?

We have a postfix server that requires authentication to SMTP relay through it. We use virtual mailboxes in MySQL database. A message was relayed through our system, and we need to determine which ...
5
votes
1answer
94 views

Track bandwith usage by application

I have a server at Rackspace and noticed my server is suddenly sending out 2GB of data per month (this is atypical since I don't use it that much) How can I figure out what application is using that ...
1
vote
3answers
10k views

How to enable Audit Failure logs in Active Directory?

I have a user account that keeps on getting locked out. I am trying to find out what caused it. So I want to enabled failure audits in event viewer as a start. But, I don't know how! How do I enable ...
2
votes
1answer
552 views

Windows Server 2008 - Find out who put a user to a local user group?

How it´s possible to find out, who put a user on a WS 2008 R2 server to a local group? Sometimes I´m wondering, why is this user on this system in this group. I think, the easiest way is to ask the ...
5
votes
2answers
526 views

Options for PCI-DSS on AWS - file integrity monitoring and intrusion detection

I need to deploy some file integrity monitoring and intrusion detections software on AWS instances. I really wanted to use OSSEC, however it does not work well in an environment where servers can ...
4
votes
4answers
359 views

How to audit security on Remote Employees' PCs?

We have several remote developers who are working on our code and have access to our FTP server. Recently someone copied an infected file to the FTP server and virus spread throughout the whole FTP ...
1
vote
0answers
153 views

How to identify vulnerability (.htaccess files have been added/modified) [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY All the .htaccess files inside doc roots of all my virtual hosts seem to have been hacked and have the following code prepended to ...
1
vote
6answers
258 views

Securing the network: IP conflicts and its solutions

Today I found out that I don't know how to fix IP conflicts. Say you have a server with IP1 another machine connects and assigns itself IP1. How do people usually prevent this? How they(you) ...
1
vote
3answers
956 views

Turn on file auditing on network share in server 2008 r2

I have a server running 2008 R2 , is there a role / function on this that can be added / enabled that audits file access. e.g user1 deleted this folder, this file was edited by user2 etc. I have been ...
0
votes
4answers
225 views

How to determine the cause of high resource usage for two hours last week?

I know there are several tools I can use to find out what's causing heavy network and CPU usage right now, but every so often on my server I'll check the logs and notice that there were periods of ...
3
votes
3answers
120 views

Storing sensitive information on wiki

For my sins, I am now in charge of a host of sensitive information: encryption key storage policies, network architecture diagrams, etc. We will soon be covered by HIPPA, so the pain increases. Not ...
0
votes
1answer
158 views

Detect mysql password changes from logs

How can I find out who last changed the MySQL database password for the "root" user. I'm using Ubuntu.
1
vote
1answer
226 views

Audit folder permissions on a windows server

I have a number of servers in the corporate domain that seem to randomly lose ACL permissions to the TEMP folders (c:\temp, c:\windows\temp and any temp folder defined in the environment variables). ...
0
votes
2answers
121 views

Scanning Vendors (non-PCI related) - Hype or Not?

For months now, when building websites for clients, I've come across virtually trillions of "Site Security Scanners" supposedly endorsed/approved by various shared web hosts who claim to run XSS, SQL ...