Hot answers tagged

6

You can visualize the failed user names after you turn up the verbosity of the log in sshd_configĀ¹, but there is no way to see the failed passwords as this could be a potential security issue and would violates the privacy of users (for example you could mistype your password and it would be leaked into some log file). All the passwords are handled as ...


3

You could recreate these files with following commands: touch /var/log/auth.log && chmod 640 /var/log/auth.log && chown syslog:adm /var/log/auth.log touch /var/log/mail.log && chmod 640 /var/log/mail.log && chown syslog:adm /var/log/mail.log It's hard to say why the files got deleted. I have never experienced that. Maybe it ...


3

This looks like your server is being used in a DNS amplification attack[1][2][3]. This means that your server is bombarding Google's DNS server with queries, so yes your server is being used to attack Google. You are not being attacked, your server has been compromised and being used to attack someone else, in this case it looks like that it is Google. ...


2

First, if users are able to delete files that they shouldn't delete, you have a bigger problem. File permissions should be set so that regular (non-root) users can not do serious damage. I would first investigate this. If all users use the same account, consider creating an account for each user. Do not give anyone (except the system administrators) the ...


1

Which Nginx log file is for fail2ban? Whichever one contains the log entries you want to match. So anything wrong with my Nginx and fail2ban configuration? If it's working as you expect then no, however the log file /var/log/nginx/access.log is empty. But the /var/log/nginx/access.log.1 is being appended as always. This would suggest ...


1

Each log is created a 0 hours UTC time, and added to as the day and activity progresses, probably with some memory caching. You will see any given days log file long before that day ends.


1

Sudo has something called sudoreplay when enabled sessions is logged and can be replayed later, works similar as the script command that make a typescript of terminal session that later can be replayed with the scriptreplay command.


1

Here is what I have on my server: if ($time_iso8601 ~ "^(\d{4})-(\d{2})-(\d{2})") { set $year $1; set $month $2; set $day $3; } access_log /path/to/logs/nginx-access-$year-$month.log; Now, sometimes $time_iso8601 has not the expected format, and the logs are then written in a file called nginx-access--.log (indeed, $year and $month are not ...


1

You don't say how large your installation is, but if it's small install the free edition of SecAst, and let it monitor registration and dial attempts. Start by letting it watch the 6001 extension (SIP/6001) and then the PBX in general. Depending on your settings it may be an external hacker trying extensions looking for DISA. A 6 followed by 001 could be ...


1

Assuming these are new fields in a given index, you'll need to tell Kibana to refresh it's field listing. Reloading the Index Fields List When you add an index mapping, Kibana automatically scans the indices that match the pattern to display a list of the index fields. You can reload the index fields list to pick up any newly-added fields. ...


1

You need to increase the logging level in your OpenLDAP instance. I believe the one you're looking for is 256. http://www.openldap.org/doc/admin24/slapdconf2.html#cn=config For OLC, create a file with the following contents: dn: cn=config changetype: modify replace: olcLogLevel olcLogLevel: stats Then: ldapmodify -H ldapi:// -Y EXTERNAL -f ...


1

In OSX the pop3 information is currently logged at /Library/Logs/Mail/mail-info.log. It sounds like you are using Server.app, so you may be able to manually monitor that log in the Logs tab on the top left, under the Mail category (which you select in the drop-down list under the log window). I realize that you are on a much older version of OSX, so this ...



Only top voted, non community-wiki answers of a minimum length are eligible