The tag has no wiki summary.

learn more… | top users | synonyms

3
votes
2answers
1k views

Is there a way to disable the ptrace system call on RHEL5 Linux?

Is there any wat to disable the ptrace system call on RHEL5?
6
votes
9answers
1k views

Is it worth hiring a hacker to perform some penetration testing on my servers? [closed]

I'm working in a small IT company with paranoid clients, so security has always been an important consideration to us. In the past, we've already mandated penetration testing from two independent ...
3
votes
2answers
339 views

Check the ip addresses accessing my server

I'm running a Cent OS Linux apache web server, and its primary function is to serve the content in an iframe to one specific ip address. I want to see all ip addresses that have accessed the web ...
2
votes
1answer
5k views

How to log when a file is accessed on server share? Win Server 2008. Student needing help!

Hi All I am a student in a Information Technology Program and I need a little help. ISSUE CLIFF NOTES Have a few files in a share folder on a server that need logged when they are opened and by ...
0
votes
1answer
119 views

Backup and Restore privilege

I have a windows server 2008 r2 and I want to give the built in Administrator acount backup and restore previllige how can i do this? Greetz
1
vote
1answer
109 views

SQL Server 2008 Audit Service

I'm designing an application that will run on SQL Server 2008 R2. There's a requirement to audit any updates to a customer table. The new Audit service that was release as part of SQL Server 2008 ...
1
vote
1answer
109 views

Where I can get the SQL-Server 2005 C2 Audit Event List

I couldn't found the list of SQL-Server 2005 C2 Audit Events on google! Any suggestion?
0
votes
3answers
117 views

Is there a way to tell if there is key stroke logging software installed? [closed]

I have a Windows-XP machine as my desktop system at work. Is there any way to tell if there is keystroke logging software running on my system or any other software that may be monitoring my system ...
1
vote
1answer
410 views

PGP encryption key with split-knowledge and dual control

An auditor recommends: We recommend that PGP environment be re-keyed using the industry required (ISO x9.8 and x9.24) standards of “split-knowledge and dual control” Is there something that we're ...
1
vote
2answers
1k views

problem of setting audit rules: Syscall name unknown: stime

I am setting audit rules in /etc/audit/audit.rules. As the requirement : The audit system should be configured to audit all administrative, privileged, and security actions. So I add one line into ...
2
votes
1answer
234 views

Server 2003 DNS Auditing

I used the instructions on the following link to set up DNS auditing on Server 2003: http://blogs.technet.com/b/yuridiogenes/archive/2008/03/06/auditing-a-dns-zone.aspx It works. When ever a forward ...
1
vote
1answer
685 views

How can I monitor user access to a shared folder on Windows SBS 2008

I have multiple shared folders on Windows SBS 2008 server. I need to be able to tell if a domain user is accessing these shares and copying large quantities of files to their laptop. Is there a way of ...
1
vote
1answer
534 views

windows 2003 server security audit -logging computer IP

We have a network with 1 primary domain controller and 3 additional domain controllers. We're trying to identify a user who attempted to use someone else's credentials to access some resources in our ...
1
vote
2answers
45 views

Solaris Security and Id's

On a Solaris machine I need to transfer files from windows to unix server as well as server to server. Is there a way to get the oracle id permissions (uid gid) when I do this here is an example : ...
6
votes
5answers
7k views

How do I scan a firewall to find open outgoing ports?

I'm looking for a tool that I can use within a firewalled network to scan the firewall to find open outgoing ports. I've done some research and found Firewalk but it hasn't been maintained in 10 ...
0
votes
1answer
1k views

Get the “source network address” in Event ID 529 audit entries on Windows XP

In windows server 2003 when an Event 529 (logon failure) occures with a logon type of 10 (remote logon), the source network IP address is recorded in the event log. On a windows XP machine, this (and ...
1
vote
0answers
29 views

How to track when full access rights were issued in Exchange 2007?

Does anyone know if there is a way to see when a user had been issued full mailbox rights in Exchange 2007. Or is there a way to check which commands were issued when and by whom? Thanks ashln
0
votes
1answer
292 views

Excluding specific file types from a security audit in windows server 2008

I am looking for a way to exclude specific file types from being logged in the security audits. I have a folder being audited for deletion events and the majority of logged events are .tmp files (such ...
3
votes
1answer
596 views

How to audit a specific folder in Windows Server 2003?

We have had several cases of file deletion in one of our windows file servers. Server is also a domain controller. Unfortunately we kept the auditing disabled completely due it being such a resource ...
2
votes
4answers
2k views

File auditing software for Windows Server 2003

I am looking for a program or program suite that will allow the auditing of network shared resources (specifically storage space), and render reports (who created, deleted, moved, modified files, ...
2
votes
3answers
437 views

How to find out if my server is compromised?

I have a linux VPS and I received a complaint that my server was scanning on port 22 some other network. How do I find out if it was compromised or not?
1
vote
4answers
765 views

Linux backdoors I should be wary of

I'm new to the server management realm and I'm sure my server is very insecure. I've gone through the WHM CPanel security check but I'm sure to the real gurus, that check is stupid and nowhere near ...
3
votes
2answers
675 views

What are some good security audit tools for PHP web applications?

I'm interested in finding open-source tools for auditing some PHP code I didn't write, before putting it into production. I'll need black-box HTTP-probing scanners as well as static code ...
0
votes
2answers
1k views

What is the best solution for PCI-DSS compliance?

I'm comparing different solutions for PCI-DSS compliance, reading a lot of white papers and brochures regarding RSA enVision, Splunk, LogRhythm, SenSage, ArcSight and OSSEC. Unfortunately, ...
1
vote
6answers
1k views

Auditing Windows Server security

Inspired by this question: What tools are available to audit security on an existing Windows server, say Windows 2003, for my case, but what else, for which Windows Server version? What can I do to ...
0
votes
1answer
686 views

Configuring MySQL logging for an audited environment such as SOX

How do you configure MySQL users and logging to satisfy SOX auditors? For example, if you need to log queries and the source of the query for later review by an internal SOX controls group. Is there ...
15
votes
11answers
91k views

Best way to find the computer a user last logged on from?

I am hoping that somewhere in Active Directory the "last logged on from [computer]" is written/stored, or there is a log I can parse out? The purpose of wanting to know the last PC logged on from is ...
1
vote
1answer
348 views

Changing pam.d/system_auth?

I'm trying to change pam.d/system_auth to help with password complexity as required by an audit. I'm not familiar with PAM, but the system_auth file says This file is auto generated User ...
1
vote
3answers
446 views

Server security auditing tools for both windows and *nix servers

When we deploy a new server currently we do a Nessus scan on the sever from inside the firewall and we do a firewall audit to verify that only the desired ports are open on the firewall (since we do ...
1
vote
1answer
408 views

Oracle Database character set issue with the audit tables on Debian

I've got Oracle XE installed on Debian linux and the character set is configured to AL32UTF8. There are several client applications that connects to a database from Windows with the different locales ...
18
votes
10answers
15k views

How do I know if my Linux server has been hacked?

What are the tell-tale signs that a Linux server has been hacked? Are there any tools that can generate and email an audit report on a scheduled basis?
2
votes
3answers
237 views

Tools for conducting a Security Audit / Probe

What are some good tools to run tests validating a Windows server Web & DB server is properly secure? Are there any tools which are comprehensive and will scan for all the popular known ...