The tag has no wiki summary.

learn more… | top users | synonyms

18
votes
10answers
15k views

How do I know if my Linux server has been hacked?

What are the tell-tale signs that a Linux server has been hacked? Are there any tools that can generate and email an audit report on a scheduled basis?
15
votes
11answers
90k views

Best way to find the computer a user last logged on from?

I am hoping that somewhere in Active Directory the "last logged on from [computer]" is written/stored, or there is a log I can parse out? The purpose of wanting to know the last PC logged on from is ...
6
votes
9answers
1k views

Is it worth hiring a hacker to perform some penetration testing on my servers? [closed]

I'm working in a small IT company with paranoid clients, so security has always been an important consideration to us. In the past, we've already mandated penetration testing from two independent ...
6
votes
5answers
7k views

How do I scan a firewall to find open outgoing ports?

I'm looking for a tool that I can use within a firewalled network to scan the firewall to find open outgoing ports. I've done some research and found Firewalk but it hasn't been maintained in 10 ...
5
votes
2answers
528 views

Options for PCI-DSS on AWS - file integrity monitoring and intrusion detection

I need to deploy some file integrity monitoring and intrusion detections software on AWS instances. I really wanted to use OSSEC, however it does not work well in an environment where servers can ...
5
votes
1answer
379 views

Locking Preferences in Mozilla

For security reasons, we need to "lock" some of the preferences in Mozilla Firefox. We are running Windows XP and the latest version of Mozilla version 14.0.1. In particular some of the security ...
5
votes
1answer
94 views

Track bandwith usage by application

I have a server at Rackspace and noticed my server is suddenly sending out 2GB of data per month (this is atypical since I don't use it that much) How can I figure out what application is using that ...
5
votes
1answer
610 views

ActiveSync Audit: Who sent the Remote Wipe command to a device?

I need to perform and audit of how many Remote wipe commands have been sent, who sent them, and to which user's devices? Can someone let me know if this is possible? I get lots of Google hits for ...
4
votes
4answers
359 views

How to audit security on Remote Employees' PCs?

We have several remote developers who are working on our code and have access to our FTP server. Recently someone copied an infected file to the FTP server and virus spread throughout the whole FTP ...
3
votes
1answer
4k views

How to determine which user sent a specific email with postfix?

We have a postfix server that requires authentication to SMTP relay through it. We use virtual mailboxes in MySQL database. A message was relayed through our system, and we need to determine which ...
3
votes
2answers
321 views

Check the ip addresses accessing my server

I'm running a Cent OS Linux apache web server, and its primary function is to serve the content in an iframe to one specific ip address. I want to see all ip addresses that have accessed the web ...
3
votes
1answer
121 views

What's the difference between these two GPO options?

What's the difference between the two GPO options below? NETWORK ACCESS : DO NOT ALLOW storage of credentials or .NET passports for network NETWORK ACCESS : DO NOT ALLOW storage of passwords and ...
3
votes
2answers
681 views

Filtering Security Logs by User and Logon Type

I have been asked to find out when a user has logged on to the system in the last week. Now the audit logs in Windows should contain all the info I need. I think if I search for Event ID 4624 (Logon ...
3
votes
3answers
500 views

How to check which process/utility/cron created/modified a file/folder in Linux

I have a folder on server, which has a website in it. the server has been cutoff from the internet, but after some time, few folders are automatically created in it with some suspicious files inside ...
3
votes
3answers
120 views

Storing sensitive information on wiki

For my sins, I am now in charge of a host of sensitive information: encryption key storage policies, network architecture diagrams, etc. We will soon be covered by HIPPA, so the pain increases. Not ...
3
votes
1answer
595 views

How to audit a specific folder in Windows Server 2003?

We have had several cases of file deletion in one of our windows file servers. Server is also a domain controller. Unfortunately we kept the auditing disabled completely due it being such a resource ...
3
votes
2answers
1k views

Is there a way to disable the ptrace system call on RHEL5 Linux?

Is there any wat to disable the ptrace system call on RHEL5?
3
votes
2answers
670 views

What are some good security audit tools for PHP web applications?

I'm interested in finding open-source tools for auditing some PHP code I didn't write, before putting it into production. I'll need black-box HTTP-probing scanners as well as static code ...
3
votes
1answer
45 views

How to monitor Windows server Registry changes [closed]

Hi i want tools or audit policy that can help me to track all changes made to windows server registry (include who done the change - what is the old value -what is new value -change type {delete ...
2
votes
2answers
239 views

Passing PCI Scan on apache 2.2.22

We are on Ubuntu 12.04 and apache 2.2.2 version. We had PCI scan done on our site and 2 vulnerabilities came out that we can not get under control. First one is BEAST attack and other one SSL RC4 ...
2
votes
3answers
237 views

Tools for conducting a Security Audit / Probe

What are some good tools to run tests validating a Windows server Web & DB server is properly secure? Are there any tools which are comprehensive and will scan for all the popular known ...
2
votes
1answer
5k views

How to log when a file is accessed on server share? Win Server 2008. Student needing help!

Hi All I am a student in a Information Technology Program and I need a little help. ISSUE CLIFF NOTES Have a few files in a share folder on a server that need logged when they are opened and by ...
2
votes
4answers
2k views

File auditing software for Windows Server 2003

I am looking for a program or program suite that will allow the auditing of network shared resources (specifically storage space), and render reports (who created, deleted, moved, modified files, ...
2
votes
1answer
83 views

Freqeunt Failure Audit errors on web server (MSSQLSERVER)

We have detected a lot of Failure Audit errors (MSSQLSERVER) on our Web Server for. Something like Login failed for user 'sa'. [CLIENT: 74.208.102.175] For more information, see Help and ...
2
votes
1answer
552 views

Windows Server 2008 - Find out who put a user to a local user group?

How it´s possible to find out, who put a user on a WS 2008 R2 server to a local group? Sometimes I´m wondering, why is this user on this system in this group. I think, the easiest way is to ask the ...
2
votes
1answer
118 views

Auditing full access permissions on Exchange 2010 without audit being on

We are currently running Exchange 2010 SP1. I would like to see who has been granted full access or send as permissions on a specific mailbox, the issue is we do not have audit logging turned on this ...
2
votes
1answer
114 views

SSAE 16 and application to datacenters and SaaS providers

Where in ssae 16 does it describe specific operational proceedures for data centers or SaaS providers? Where does it describe restrictions on who can access production hardware? Is this ...
2
votes
3answers
437 views

How to find out if my server is compromised?

I have a linux VPS and I received a complaint that my server was scanning on port 22 some other network. How do I find out if it was compromised or not?
2
votes
1answer
234 views

Server 2003 DNS Auditing

I used the instructions on the following link to set up DNS auditing on Server 2003: http://blogs.technet.com/b/yuridiogenes/archive/2008/03/06/auditing-a-dns-zone.aspx It works. When ever a forward ...
1
vote
4answers
765 views

Linux backdoors I should be wary of

I'm new to the server management realm and I'm sure my server is very insecure. I've gone through the WHM CPanel security check but I'm sure to the real gurus, that check is stupid and nowhere near ...
1
vote
6answers
1k views

Auditing Windows Server security

Inspired by this question: What tools are available to audit security on an existing Windows server, say Windows 2003, for my case, but what else, for which Windows Server version? What can I do to ...
1
vote
6answers
258 views

Securing the network: IP conflicts and its solutions

Today I found out that I don't know how to fix IP conflicts. Say you have a server with IP1 another machine connects and assigns itself IP1. How do people usually prevent this? How they(you) ...
1
vote
1answer
87 views

Windows Server Auditing Capabilities

I was curious if it were possible to audit a file share on windows server 2012 for a copy. How can one differentiate a copied file rather than a read file based on the events they send to the event ...
1
vote
2answers
1k views

How to safely use corporate Active Directory (LDAP) authentication for an internet facing web site? [closed]

Let's say you have a public web service (Jira in my case) that is used by both intranet users and external users. The server is already configured to use HTTPS (secure). Because the server is ...
1
vote
3answers
967 views

Turn on file auditing on network share in server 2008 r2

I have a server running 2008 R2 , is there a role / function on this that can be added / enabled that audits file access. e.g user1 deleted this folder, this file was edited by user2 etc. I have been ...
1
vote
1answer
346 views

Changing pam.d/system_auth?

I'm trying to change pam.d/system_auth to help with password complexity as required by an audit. I'm not familiar with PAM, but the system_auth file says This file is auto generated User ...
1
vote
3answers
445 views

Server security auditing tools for both windows and *nix servers

When we deploy a new server currently we do a Nessus scan on the sever from inside the firewall and we do a firewall audit to verify that only the desired ports are open on the firewall (since we do ...
1
vote
3answers
10k views

How to enable Audit Failure logs in Active Directory?

I have a user account that keeps on getting locked out. I am trying to find out what caused it. So I want to enabled failure audits in event viewer as a start. But, I don't know how! How do I enable ...
1
vote
2answers
1k views

problem of setting audit rules: Syscall name unknown: stime

I am setting audit rules in /etc/audit/audit.rules. As the requirement : The audit system should be configured to audit all administrative, privileged, and security actions. So I add one line into ...
1
vote
1answer
226 views

Audit folder permissions on a windows server

I have a number of servers in the corporate domain that seem to randomly lose ACL permissions to the TEMP folders (c:\temp, c:\windows\temp and any temp folder defined in the environment variables). ...
1
vote
2answers
45 views

Solaris Security and Id's

On a Solaris machine I need to transfer files from windows to unix server as well as server to server. Is there a way to get the oracle id permissions (uid gid) when I do this here is an example : ...
1
vote
1answer
408 views

Oracle Database character set issue with the audit tables on Debian

I've got Oracle XE installed on Debian linux and the character set is configured to AL32UTF8. There are several client applications that connects to a database from Windows with the different locales ...
1
vote
1answer
95 views

windows security log - failure reason startswith %%

Please help - do You have the list with descriptions of failure reasons eg. %%2313, %%2307... I've researched Net and nothing.. :( Mainly I see it in ID 4625 in Windows security logs. On ...
1
vote
1answer
107 views

vsftpd on ubuntu saucy - “OOPS: Child died”

I have installed vsftpd with apt-get install vsftpd on my freshly deployed ubuntu saucy amd64 linode. vsftpd starts but when I connect to it from an ftp client, even from localhost, I get this error: ...
1
vote
1answer
20 views

SQL Server Access Logs

Is it possible to show some type of access log where a valid user (who had access to a specific database [or multiple ones]) tried to access a database they didn't have access to? For example, if I ...
1
vote
1answer
128 views

central log-server with auditdisp

I want to setup a central log-server. The log-server is running with debian 6.0.6 and the audit daemon is installed in version 1.7.13-1. The Clients are running with Red Hat 5.5 and they connect to ...
1
vote
0answers
29 views

Software for defining rules for folder permissions and monitoring deviations

Let's say a company has a large number of users, and each user has a home area. On each share used for home area folders, I would like to define some rules saying who is supposed to have which ...
1
vote
0answers
93 views

Client Address is not showing correct in Event Log

I had enable the Advance Audit Policy Configuration on my Domain Controller. Server OS - Window Server 2008 R2 Standard. Client OS - Window XP Whenever the Domain User enter wrong password for ...
1
vote
0answers
130 views

The description for Event ID (560) in Source (security) cannot be found. with users in specified group

I have some users in a group that look at the audits. They are in a group I created. This group should have permissions to view the security audits. They can see them, but the descriptions are ...
1
vote
0answers
153 views

How to identify vulnerability (.htaccess files have been added/modified) [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY All the .htaccess files inside doc roots of all my virtual hosts seem to have been hacked and have the following code prepended to ...