The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
0answers
167 views

How to identify vulnerability (.htaccess files have been added/modified) [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY All the .htaccess files inside doc roots of all my virtual hosts seem to have been hacked and have the following code prepended to ...
1
vote
6answers
265 views

Securing the network: IP conflicts and its solutions

Today I found out that I don't know how to fix IP conflicts. Say you have a server with IP1 another machine connects and assigns itself IP1. How do people usually prevent this? How they(you) ...
1
vote
3answers
2k views

Turn on file auditing on network share in server 2008 r2

I have a server running 2008 R2 , is there a role / function on this that can be added / enabled that audits file access. e.g user1 deleted this folder, this file was edited by user2 etc. I have been ...
0
votes
4answers
255 views

How to determine the cause of high resource usage for two hours last week?

I know there are several tools I can use to find out what's causing heavy network and CPU usage right now, but every so often on my server I'll check the logs and notice that there were periods of ...
3
votes
3answers
123 views

Storing sensitive information on wiki

For my sins, I am now in charge of a host of sensitive information: encryption key storage policies, network architecture diagrams, etc. We will soon be covered by HIPPA, so the pain increases. Not ...
0
votes
1answer
190 views

Detect mysql password changes from logs

How can I find out who last changed the MySQL database password for the "root" user. I'm using Ubuntu.
1
vote
1answer
275 views

Audit folder permissions on a windows server

I have a number of servers in the corporate domain that seem to randomly lose ACL permissions to the TEMP folders (c:\temp, c:\windows\temp and any temp folder defined in the environment variables). ...
0
votes
2answers
128 views

Scanning Vendors (non-PCI related) - Hype or Not?

For months now, when building websites for clients, I've come across virtually trillions of "Site Security Scanners" supposedly endorsed/approved by various shared web hosts who claim to run XSS, SQL ...
3
votes
2answers
1k views

Is there a way to disable the ptrace system call on RHEL5 Linux?

Is there any wat to disable the ptrace system call on RHEL5?
6
votes
9answers
1k views

Is it worth hiring a hacker to perform some penetration testing on my servers? [closed]

I'm working in a small IT company with paranoid clients, so security has always been an important consideration to us. In the past, we've already mandated penetration testing from two independent ...
3
votes
2answers
504 views

Check the ip addresses accessing my server

I'm running a Cent OS Linux apache web server, and its primary function is to serve the content in an iframe to one specific ip address. I want to see all ip addresses that have accessed the web ...
2
votes
1answer
6k views

How to log when a file is accessed on server share? Win Server 2008. Student needing help!

Hi All I am a student in a Information Technology Program and I need a little help. ISSUE CLIFF NOTES Have a few files in a share folder on a server that need logged when they are opened and by ...
0
votes
1answer
121 views

Backup and Restore privilege

I have a windows server 2008 r2 and I want to give the built in Administrator acount backup and restore previllige how can i do this? Greetz
1
vote
1answer
109 views

SQL Server 2008 Audit Service

I'm designing an application that will run on SQL Server 2008 R2. There's a requirement to audit any updates to a customer table. The new Audit service that was release as part of SQL Server 2008 ...
1
vote
1answer
110 views

Where I can get the SQL-Server 2005 C2 Audit Event List

I couldn't found the list of SQL-Server 2005 C2 Audit Events on google! Any suggestion?
0
votes
3answers
120 views

Is there a way to tell if there is key stroke logging software installed? [closed]

I have a Windows-XP machine as my desktop system at work. Is there any way to tell if there is keystroke logging software running on my system or any other software that may be monitoring my system ...
1
vote
1answer
454 views

PGP encryption key with split-knowledge and dual control

An auditor recommends: We recommend that PGP environment be re-keyed using the industry required (ISO x9.8 and x9.24) standards of “split-knowledge and dual control” Is there something that we're ...
1
vote
2answers
1k views

problem of setting audit rules: Syscall name unknown: stime

I am setting audit rules in /etc/audit/audit.rules. As the requirement : The audit system should be configured to audit all administrative, privileged, and security actions. So I add one line into ...
2
votes
1answer
259 views

Server 2003 DNS Auditing

I used the instructions on the following link to set up DNS auditing on Server 2003: http://blogs.technet.com/b/yuridiogenes/archive/2008/03/06/auditing-a-dns-zone.aspx It works. When ever a forward ...
1
vote
1answer
736 views

How can I monitor user access to a shared folder on Windows SBS 2008

I have multiple shared folders on Windows SBS 2008 server. I need to be able to tell if a domain user is accessing these shares and copying large quantities of files to their laptop. Is there a way of ...
1
vote
1answer
593 views

windows 2003 server security audit -logging computer IP

We have a network with 1 primary domain controller and 3 additional domain controllers. We're trying to identify a user who attempted to use someone else's credentials to access some resources in our ...
1
vote
2answers
45 views

Solaris Security and Id's

On a Solaris machine I need to transfer files from windows to unix server as well as server to server. Is there a way to get the oracle id permissions (uid gid) when I do this here is an example : ...
6
votes
5answers
9k views

How do I scan a firewall to find open outgoing ports?

I'm looking for a tool that I can use within a firewalled network to scan the firewall to find open outgoing ports. I've done some research and found Firewalk but it hasn't been maintained in 10 ...
0
votes
1answer
2k views

Get the “source network address” in Event ID 529 audit entries on Windows XP

In windows server 2003 when an Event 529 (logon failure) occures with a logon type of 10 (remote logon), the source network IP address is recorded in the event log. On a windows XP machine, this (and ...
1
vote
0answers
29 views

How to track when full access rights were issued in Exchange 2007?

Does anyone know if there is a way to see when a user had been issued full mailbox rights in Exchange 2007. Or is there a way to check which commands were issued when and by whom? Thanks ashln
0
votes
1answer
315 views

Excluding specific file types from a security audit in windows server 2008

I am looking for a way to exclude specific file types from being logged in the security audits. I have a folder being audited for deletion events and the majority of logged events are .tmp files (such ...
3
votes
1answer
626 views

How to audit a specific folder in Windows Server 2003?

We have had several cases of file deletion in one of our windows file servers. Server is also a domain controller. Unfortunately we kept the auditing disabled completely due it being such a resource ...
2
votes
4answers
2k views

File auditing software for Windows Server 2003

I am looking for a program or program suite that will allow the auditing of network shared resources (specifically storage space), and render reports (who created, deleted, moved, modified files, ...
2
votes
3answers
438 views

How to find out if my server is compromised?

I have a linux VPS and I received a complaint that my server was scanning on port 22 some other network. How do I find out if it was compromised or not?
1
vote
4answers
803 views

Linux backdoors I should be wary of

I'm new to the server management realm and I'm sure my server is very insecure. I've gone through the WHM CPanel security check but I'm sure to the real gurus, that check is stupid and nowhere near ...
3
votes
2answers
759 views

What are some good security audit tools for PHP web applications?

I'm interested in finding open-source tools for auditing some PHP code I didn't write, before putting it into production. I'll need black-box HTTP-probing scanners as well as static code ...
1
vote
2answers
1k views

What is the best solution for PCI-DSS compliance?

I'm comparing different solutions for PCI-DSS compliance, reading a lot of white papers and brochures regarding RSA enVision, Splunk, LogRhythm, SenSage, ArcSight and OSSEC. Unfortunately, ...
1
vote
6answers
1k views

Auditing Windows Server security

Inspired by this question: What tools are available to audit security on an existing Windows server, say Windows 2003, for my case, but what else, for which Windows Server version? What can I do to ...
0
votes
1answer
737 views

Configuring MySQL logging for an audited environment such as SOX

How do you configure MySQL users and logging to satisfy SOX auditors? For example, if you need to log queries and the source of the query for later review by an internal SOX controls group. Is there ...
15
votes
11answers
99k views

Best way to find the computer a user last logged on from?

I am hoping that somewhere in Active Directory the "last logged on from [computer]" is written/stored, or there is a log I can parse out? The purpose of wanting to know the last PC logged on from is ...
1
vote
1answer
357 views

Changing pam.d/system_auth?

I'm trying to change pam.d/system_auth to help with password complexity as required by an audit. I'm not familiar with PAM, but the system_auth file says This file is auto generated User ...
1
vote
3answers
453 views

Server security auditing tools for both windows and *nix servers

When we deploy a new server currently we do a Nessus scan on the sever from inside the firewall and we do a firewall audit to verify that only the desired ports are open on the firewall (since we do ...
1
vote
1answer
408 views

Oracle Database character set issue with the audit tables on Debian

I've got Oracle XE installed on Debian linux and the character set is configured to AL32UTF8. There are several client applications that connects to a database from Windows with the different locales ...
22
votes
10answers
18k views

How do I know if my Linux server has been hacked?

What are the tell-tale signs that a Linux server has been hacked? Are there any tools that can generate and email an audit report on a scheduled basis?