Tag Info

New answers tagged

5

dd. Take an image of your compromised machine, then wipe it and start over. You cannot trust anything your host is telling you any more. Once you have said disk image though, the question is very much 'what do you want to accomplish'? If it's evidence/legal, then you're going to have to be incredibly careful, and probably want to consul a legal ...


0

My take is that you won't know what those variables stand for if you don't have the source code. But why do you need to know though? You can have all text description in Event Viewer. Or if it's an exported file, ask whoever export it to export as full text.


0

There was a bug in vsftpd that affected 64-bit machines, here's the bug report - it looks fixed on Red Hat's distributions but it's not yet fixed on some other distributions. As a workaround, you may add seccomp_sandbox=NO to its configuration file but that will disable a sandboxing feature (not sure about what it does exactly, but if security is your ...


4

At the share level, no. This is due to shares do not have system acl's. But you can enable auditing on the file system level for Write access to the shared folder. Refer to the following help text for the Advanced Audit Policy Configuration > Object Access: File System This policy setting allows you to audit user attempts to access file system ...



Top 50 recent answers are included