The tag has no wiki summary.

learn more… | top users | synonyms

4
votes
2answers
1k views

Filtering Security Logs by User and Logon Type

I have been asked to find out when a user has logged on to the system in the last week. Now the audit logs in Windows should contain all the info I need. I think if I search for Event ID 4624 (Logon ...
0
votes
1answer
57 views

Is it possible to create a read-only user account for security auditing purposes?

An organization requires several administrators to have a role of a security auditor. They must have read-only (via network/remote) access to Windows Server 2008 / R2 systems and have permissions to ...
0
votes
0answers
11 views

Ssecurity Log (Audit Event 5140) ipc$

The security log on my file server is filling up with Event 5140 for connections to \*\IPC$ This makes my security log useless for auditing file share events. How do I disable auditing security ...
1
vote
0answers
26 views

CIS benchmark: How to define the BUILTIN\Administrator account within GPOs?

I am responsible for configuring GPOs according to the latest CIS benchmark policy. However the test for "Impersonate a client after authentication" always fails, although everything seems to be ...
0
votes
1answer
78 views

Ignore specific types with auditd

I've recently been playing around with auditd and trying to cut out some of what it is logging. Here is my audit.rules entry to log execve # First rule - delete all -D -a always,exit -F arch=b64 -S ...
0
votes
2answers
37 views

reset aspnet machince account password

Our small Windows Active Directory domain is undergoing a security review by our grandparent company. I am the Domain Administrator of this domain of about 25 Win2K3, Win2K8, Enterprise & ...
1
vote
3answers
1k views

Turn on file auditing on network share in server 2008 r2

I have a server running 2008 R2 , is there a role / function on this that can be added / enabled that audits file access. e.g user1 deleted this folder, this file was edited by user2 etc. I have been ...
3
votes
1answer
56 views

How to monitor Windows server Registry changes [closed]

Hi i want tools or audit policy that can help me to track all changes made to windows server registry (include who done the change - what is the old value -what is new value -change type {delete ...
0
votes
1answer
41 views

Exchange 2010 security audit

Our IT department has received reports from HR that managers are reading their subordinates email, and we've been tasked with identifying if there is a technical way to achieve this. I'm looking for ...
1
vote
0answers
989 views

Error 4673 audit failure filling security logs

I have an isolated desktop computer in my office that I run weekly security audits on. I check the logs for odd behavior then export and clear them out. The logs are filled with "Audit failure ...
-1
votes
1answer
57 views

Helpful linux command for do some forensic on compromised linux web server [duplicate]

What are helpful linux command for do some forensic on compromised linux web server for giving out sort of information/evidence/backtrace? for example checking log, checking last file edit, suspicious ...
1
vote
1answer
112 views

windows security log - failure reason startswith %%

Please help - do You have the list with descriptions of failure reasons eg. %%2313, %%2307... I've researched Net and nothing.. :( Mainly I see it in ID 4625 in Windows security logs. On ...
1
vote
1answer
125 views

vsftpd on ubuntu saucy - “OOPS: Child died”

I have installed vsftpd with apt-get install vsftpd on my freshly deployed ubuntu saucy amd64 linode. vsftpd starts but when I connect to it from an ftp client, even from localhost, I get this error: ...
1
vote
1answer
105 views

Windows Server Auditing Capabilities

I was curious if it were possible to audit a file share on windows server 2012 for a copy. How can one differentiate a copied file rather than a read file based on the events they send to the event ...
0
votes
1answer
50 views

Linux Monthly Login Report

Is there a command to find out if anyone logged into a machine as one of the System IDs (bin, sshd, rpc, etc)? I've tried last, faillog, ausearch and aureport (this has worked the best), but I'd like ...
2
votes
1answer
142 views

SSAE 16 and application to datacenters and SaaS providers

Where in ssae 16 does it describe specific operational proceedures for data centers or SaaS providers? Where does it describe restrictions on who can access production hardware? Is this ...
20
votes
10answers
16k views

How do I know if my Linux server has been hacked?

What are the tell-tale signs that a Linux server has been hacked? Are there any tools that can generate and email an audit report on a scheduled basis?
5
votes
2answers
565 views

Options for PCI-DSS on AWS - file integrity monitoring and intrusion detection

I need to deploy some file integrity monitoring and intrusion detections software on AWS instances. I really wanted to use OSSEC, however it does not work well in an environment where servers can ...
2
votes
1answer
200 views

Auditing full access permissions on Exchange 2010 without audit being on

We are currently running Exchange 2010 SP1. I would like to see who has been granted full access or send as permissions on a specific mailbox, the issue is we do not have audit logging turned on this ...
1
vote
1answer
21 views

SQL Server Access Logs

Is it possible to show some type of access log where a valid user (who had access to a specific database [or multiple ones]) tried to access a database they didn't have access to? For example, if I ...
2
votes
2answers
257 views

Passing PCI Scan on apache 2.2.22

We are on Ubuntu 12.04 and apache 2.2.2 version. We had PCI scan done on our site and 2 vulnerabilities came out that we can not get under control. First one is BEAST attack and other one SSL RC4 ...
1
vote
2answers
45 views

Solaris Security and Id's

On a Solaris machine I need to transfer files from windows to unix server as well as server to server. Is there a way to get the oracle id permissions (uid gid) when I do this here is an example : ...
1
vote
3answers
11k views

How to enable Audit Failure logs in Active Directory?

I have a user account that keeps on getting locked out. I am trying to find out what caused it. So I want to enabled failure audits in event viewer as a start. But, I don't know how! How do I enable ...
-3
votes
1answer
53 views

how to prevent windows server massive login tries [closed]

i've been looking to a windows 8 web server eventlog on security option and i'm wordless with the ammout of audit failure logs. what i'm trying to understand is that i've very, very much audit ...
2
votes
4answers
2k views

File auditing software for Windows Server 2003

I am looking for a program or program suite that will allow the auditing of network shared resources (specifically storage space), and render reports (who created, deleted, moved, modified files, ...
6
votes
9answers
1k views

Is it worth hiring a hacker to perform some penetration testing on my servers? [closed]

I'm working in a small IT company with paranoid clients, so security has always been an important consideration to us. In the past, we've already mandated penetration testing from two independent ...
0
votes
1answer
197 views

Patch management on multiple systems

I'm in charge of auditing the security configuration of an important farm of Unix servers. So far, I came up with a way to assess the basic configuration but not the installed updates. The very ...
15
votes
11answers
93k views

Best way to find the computer a user last logged on from?

I am hoping that somewhere in Active Directory the "last logged on from [computer]" is written/stored, or there is a log I can parse out? The purpose of wanting to know the last PC logged on from is ...
2
votes
1answer
85 views

Freqeunt Failure Audit errors on web server (MSSQLSERVER)

We have detected a lot of Failure Audit errors (MSSQLSERVER) on our Web Server for. Something like Login failed for user 'sa'. [CLIENT: 74.208.102.175] For more information, see Help and ...
6
votes
5answers
8k views

How do I scan a firewall to find open outgoing ports?

I'm looking for a tool that I can use within a firewalled network to scan the firewall to find open outgoing ports. I've done some research and found Firewalk but it hasn't been maintained in 10 ...
0
votes
1answer
141 views

MBSA fails MSSQL folder permissions because MSSQL$SQLEXPRESS has access

I am not sure what exactly it's expecting. If you remove this user the check passes, but the server fails. How can it be resolved so the check passes, yet it has the limited permissions MBSA is ...
0
votes
3answers
88 views

Tamper-proof AWS AMI

I need to convince my customer that my server to which he submits his sensitive data runs only applications/processes approved by him. Also the customer is not allowed to get access to my server. He ...
0
votes
1answer
278 views

Windows Server 2008 R2 (Rdp) Logon Audit trail

Is there a way to to retrieve an audit trail / history of remote/rdp logons for a particular user on a Windows 2008 R2 machine? We have a server here in our intranet which has a domain-wide user as ...
0
votes
2answers
235 views

selinux Missing type enforcement (TE) allow rule

When I run my FTP test to test for full functionality, I'm concerned on why am I getting an avc denial error on such a popular command, such as 'mkdir'? Here is the AVC denial message: type=AVC ...
0
votes
1answer
51 views

Win 2008r2 Audit

I'm trying to turn on auditing but every time i check Success and failure in Local policy / Computer Conf/Windows settings/security settings/local policies/Audit Policy/ Audit Object access, it turns ...
-1
votes
1answer
109 views

Vulnerability Assessment against application [closed]

Is it legal to run a vuln assessment vs. a site other than one you currently own? Say you own a security software and want to test potential clients' websites for vulnerabilities (without their ...
0
votes
1answer
1k views

Get the “source network address” in Event ID 529 audit entries on Windows XP

In windows server 2003 when an Event 529 (logon failure) occures with a logon type of 10 (remote logon), the source network IP address is recorded in the event log. On a windows XP machine, this (and ...
3
votes
1answer
127 views

What's the difference between these two GPO options?

What's the difference between the two GPO options below? NETWORK ACCESS : DO NOT ALLOW storage of credentials or .NET passports for network NETWORK ACCESS : DO NOT ALLOW storage of passwords and ...
1
vote
1answer
136 views

central log-server with auditdisp

I want to setup a central log-server. The log-server is running with debian 6.0.6 and the audit daemon is installed in version 1.7.13-1. The Clients are running with Red Hat 5.5 and they connect to ...
3
votes
3answers
584 views

How to check which process/utility/cron created/modified a file/folder in Linux

I have a folder on server, which has a website in it. the server has been cutoff from the internet, but after some time, few folders are automatically created in it with some suspicious files inside ...
1
vote
0answers
29 views

Software for defining rules for folder permissions and monitoring deviations

Let's say a company has a large number of users, and each user has a home area. On each share used for home area folders, I would like to define some rules saying who is supposed to have which ...
5
votes
1answer
717 views

ActiveSync Audit: Who sent the Remote Wipe command to a device?

I need to perform and audit of how many Remote wipe commands have been sent, who sent them, and to which user's devices? Can someone let me know if this is possible? I get lots of Google hits for ...
1
vote
2answers
1k views

How to safely use corporate Active Directory (LDAP) authentication for an internet facing web site? [closed]

Let's say you have a public web service (Jira in my case) that is used by both intranet users and external users. The server is already configured to use HTTPS (secure). Because the server is ...
0
votes
0answers
149 views

Windows Server 2008 Security Auditing Disabled

I have a Windows Server 2008r2 that is hosted by a 3rd party company (fairly common set up where the hosting company provides the hardware/software). A few days ago, I noticed all of the Security ...
5
votes
1answer
392 views

Locking Preferences in Mozilla

For security reasons, we need to "lock" some of the preferences in Mozilla Firefox. We are running Windows XP and the latest version of Mozilla version 14.0.1. In particular some of the security ...
1
vote
0answers
96 views

Client Address is not showing correct in Event Log

I had enable the Advance Audit Policy Configuration on my Domain Controller. Server OS - Window Server 2008 R2 Standard. Client OS - Window XP Whenever the Domain User enter wrong password for ...
1
vote
0answers
134 views

The description for Event ID (560) in Source (security) cannot be found. with users in specified group

I have some users in a group that look at the audits. They are in a group I created. This group should have permissions to view the security audits. They can see them, but the descriptions are ...
0
votes
1answer
40 views

Any high-level and cross-platform wrappers for security event auditing

There exists some high-level wrappers for system file events, for here it is an example of usage of Listen ruby gem: Listen.to('some/path', 'some/another/path', :filter => [/\.tmp$/]) do ...
1
vote
6answers
1k views

Auditing Windows Server security

Inspired by this question: What tools are available to audit security on an existing Windows server, say Windows 2003, for my case, but what else, for which Windows Server version? What can I do to ...
-2
votes
3answers
376 views

Reliably find out if application is using encryption

There is an client-server app written in Java. They communicate to each other somehow. Unfortunately our technician is not reliable (we are going to fire him). He accepted that application from the ...