Questions tagged [audit]
Observing/logging a resource for purposes of: - Adding it to a blacklist of whitelist - Keeping tabs on the security of a system
322
questions
0
votes
0
answers
13
views
Audit who calls binary
Need to get parent process and/or user of curl that, I know, starts from time to time on some server.
Audit is used by others, so I can not trivialy configure it. Is there any other tools?
- 30
1
vote
2
answers
76
views
What can you do when auditd halts the system?
I recently had an issue where my server powered off in the middle of running a script, seemingly randomly, but at about the same point each time, and then whenever I tried to power the server on again ...
- 111
1
vote
1
answer
53
views
Auditd - Don't log events from salt-minion
I'm updating our Auditd rules (Red Hat Linux) to log all tty/interactive commands from all users. That part works no problem.
What I'm trying to do now is to exclude commands issued by our salt-...
- 141
0
votes
0
answers
46
views
Windows 2019: Audit policy being overwritten by "something"
I have similar problem as it was described in thread below:
Audit policy being overwritten by "something"
unfortunately deletion of audit.csv did not help
let me summarize problem:
we are ...
0
votes
0
answers
23
views
why almalinux is hanging over night with auditlog
hey there is a hosting server
overnight my server hanged up and must to restart it in morning to get it back online and saw this error in my console (you can see the picture)
please help me
https://...
0
votes
0
answers
57
views
Auditing Domain Administrators - Best practice / Advice needed please
Please do advise if I am posting in the wrong place, I have not found this the easiest site to navigate (or maybe it is me...).
I have been tasked with auditing and fixing our privileged accounts ...
0
votes
0
answers
42
views
For auditing purposes, how can we record all commands executed inside a kubernetes container?
We have enabled kubernetes audit logging that records the orchestration related activity.
Also, the underlying host audit logs have been enabled to capture the commands executed on the host.
But, once ...
- 1
0
votes
0
answers
198
views
Exchange 2013 Search Admin Audit Log Error
I am hoping someone can help me with an issue I can't seem to get past. I am trying to search the admin audit log on an Exchange 2013 server. Here is the error.
The attempt to search the administrator ...
1
vote
0
answers
14
views
HashiCorp Vault User Audit Capability
We're seeking a solution to enable us audit our HashiCorp Vault instance to obtain a namespace breakdown of:
For each Vault user, the roles or groups that their entity belongs to.
Having reviewed ...
- 11
0
votes
0
answers
98
views
Auditd service mysteriously stopped after 2 minutes on Ubuntu
ubuntu:~$ systemctl status auditd
● auditd.service - Security Auditing Service
Loaded: loaded (/lib/systemd/system/auditd.service; enabled; vendor preset: enabled)
Active: inactive (dead) since ...
- 1
0
votes
1
answer
89
views
Can I see a printer's log about who connected to a network printer?
There's been a problem at work about a given printer that you have to connect to using a printers' server.
I don't control the server itself, but if there's a log that I can require to the server ...
- 101
0
votes
0
answers
157
views
Windows audit "Removable Storage" not generating an event for file deletion
I have a Windows 10 system on which I have enabled removable storage audits (via GPO: Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Advanced Audit Policy ...
- 1
0
votes
1
answer
106
views
Losing Audit Logs When Tracing a Container
As you know, Linux Audit is not installed on Ubuntu Focal by default. I installed it, and my goal is to trace what containers do. I have this seccomp profile:
{
"defaultAction": &...
- 1
0
votes
0
answers
82
views
Domain Controller isn't logging events enabled in subcategories
I have an environment with 3 domain controllers, one on 2019, one on 2016, and one on 2012R2. A GPO is set on the Domain Controllers OU that has the following enabled
Audit: Force audit policy ...
- 1
0
votes
0
answers
231
views
MySQL 5.7 (5.7.38): install audit plugin - MariaDB variant gives problems
To get a audit trail of users/hosts they're connecting to a MySQL server, I would like to install an audit plugin.
I read a lot about the MariaDB server_audit plugin. However, when I try to install ...
- 1
1
vote
1
answer
65
views
RHEL 8: Administrator vs. Auditor role
On RHEL 8, are there prepared functions, methods, processes or tools to implement administrator/operator and auditor roles in the following way:
An administrator/operator should be able to do almost ...
- 556
1
vote
0
answers
124
views
auditd killing a server?
In /var/log/kernellog we can see many entries for audit (since we have "space_left_action = SYSLOG" and "write_logs = no"):
...
audit: audit_backlog=32769 > audit_backlog_limit=...
- 51
2
votes
1
answer
122
views
"aureport -x --summary" shows -> /usr/sbin/sshd;61b30d72 (deleted)
On one of the machines running Centos i.e.
cat /etc/redhat-release
CentOS Linux release 7.9.2009 (Core)
i found something strange by the command aureport -x --summary
aureport -x --summary
...
- 143
1
vote
0
answers
539
views
stop kernel audit messages logged in syslog without disabling auditing
OS: CentOS 7
I am trying to figure out how audit (kaudit) events are logged in /var/log/messages.
I have enabled audit=1 in grub which means when the server boots, kernel auditing is enabled. This is ...
- 1,724
1
vote
2
answers
274
views
Google Cloud - Hipaa Compliance - PgAudit vs IAM Audit Logs
Our infrastructure is hosted on Google Cloud and uses postgresql instances via Cloud SQL
I need to configure logging for HIPAA compliance.
I have read 2 articles from Google's documentation:
https://...
google-cloud-platform
0
votes
1
answer
532
views
Event 4771 (Bad Password Logon) Does not show proper client
We are having issues with frequently locked out accounts.
We are having 4771 {Bad Password} events on our main DC.
Issue: Within the event, the client machine is not properly shown. Instead another DC ...
- 123
4
votes
5
answers
5k
views
How can root start a process that only root can kill?
It is easy to start a process at background or make it as systemd service.
However, if I want to start a process that monitors activities on the Linux machine, it fells to the target of attacks. If ...
- 434
0
votes
1
answer
45
views
daemonized alternative to tcpdump to save mirrored traffic
I need to save mirrored traffic for audit purposes. Traffic for audited server is send to other server. I need to capture that traffic on dedicated interface, save it to pcap files of reasonable scope ...
- 256
0
votes
0
answers
400
views
Rsyslog & Auditd - Parsing audit.log / proctitle hexadecimal value to ascii
I'm trying to edit my rsyslog.conf in order to set hex parts of my auditd logs in clear.
Does anyone know if it is possible to configure rsyslog in order to apply a parsing on the log received by a ...
0
votes
2
answers
1k
views
How log commands executed by user
First at all, I have working some years with snoopy and it's not what I need, also checking history file isn't a solution for me.
I have to give ROOT access to a developer to install a program on the ...
- 1
2
votes
1
answer
3k
views
CentOS doesn't boot with "A stop job is running for Security Auditing Service" message
CentOS prints the following during boot
[ *** ] A stop job is running for Security Auditing Service (9s / 1min 30s)
and then switches into the single user mode.
- 61
1
vote
0
answers
175
views
Monitoring IPv6 connection via auditd
some time i was interested in monitoring TCP/UDP connections with detailed information about process that initiated connection
I'have found helpful article about that - Finding short-lived TCP ...
- 11
3
votes
0
answers
145
views
Why are docker permission errors not logged by selinux?
If you try to bind mount a directory into a container under Red Hat you might have problems with selinux. The directory will be unreadable from inside the container. Unless you add a z/Z volume option....
- 2,065
3
votes
0
answers
241
views
Configuring Solaris audit to include username into his events
Need to configure audit logging in Solaris but I have a problem. There are two SunOS servers which were configured before. When I started analysing logs I found out that in Solaris 10 I can see the ...
- 31
1
vote
0
answers
142
views
What makes a selinux-caused EACCESS to not be logged in audit
I've got a system with samba running with standard targetted policy for Fedora.
At some point samba is trying to access a directory tagged unconfined_u:object_r:unlabeled_t:s0 and fails. Through ...
- 1,284
0
votes
1
answer
25
views
Identifying user activity/processes from log message on remote machine - 10.0.0.2 - user A, using service account B trying to connect to 10.0.0.3
I just inherited an older Linux server. I am getting asked to identify and stop a process initiated by a user. How can I go about identifying what process a user is executing that matches the logs ...
- 1
1
vote
1
answer
199
views
Detecting Windows Physical Console Logon
I'm trying to find a way to detect a logon where someone is physically at the machine. I know you can do it with Type 2 but the issue is that events get logged when services make a logon request such ...
- 3,881
0
votes
1
answer
76
views
How long should accounts be deactivated before being deleted?
How long should accounts be deactivated before being deleted? Should accounts be deactivated?
For example, our organization uses 1Password Business, which allows for accounts to be deactivated. How ...
0
votes
0
answers
396
views
Windows Server 2019 - Audit which human-user who restart a service
Trying to audit which AD-user who actually restart a service on a particular service.
The service (MyService) is using a serviceaccount to run and get access to different resources.
I want to audit ...
- 21
0
votes
0
answers
593
views
pam_tty_audit collect only TTY events
I'm trying to put together a TTY logging feature under Ubuntu 18.04 server and created /etc/pam.d/tty-audit with the following content:
session required pam_tty_audit.so enable=*
and added that ...
- 3
2
votes
1
answer
148
views
Linux audit files(data=)
type=TTY msg=audit(08/12/2020 02:33:30.163:107) : tty pid=2709 uid=e4ws5 auid=root ses=1 major=4 minor=1 comm=sh data="/bin/bash -i",<nl>
Can anyone tell me how in this audit.log there ...
- 23
0
votes
1
answer
158
views
How to enable file auditing for exchange server V15 folder
So I want to enable auditing on this specific folder V15 located under program files>Microsoft>Exchange server
But on the auditing tab I get a Message "you must be an administrator or have ...
- 37
0
votes
0
answers
50
views
Logging SSH commands on Linux - is custom kernel the only way?
I've done some research and it looks like that the way linux keeps history is less about security and audit and more about helping the user.
Even after making changes to instantly log the command and ...
- 3,881
1
vote
1
answer
2k
views
RHEL: Splitting auditd logs into multiple files for different rules
We have an audit.rules defined and things in rules.d. Many of these are for RHEL CIS compliance and others are more specific for Docker CIS compliance.
One problem we are having is that certain rules ...
- 151
0
votes
1
answer
2k
views
Logging all failed authentication attempts against Active Directory
I need to log all failed authentication attempts against my Active Directory domain. An external app binds to MS AD via LDAPS and uses AD for user authentication requests.
When the wrong user or ...
- 71
2
votes
1
answer
1k
views
Comparing two Linux servers for any differences [closed]
I tried to find a similar post, but couldn't. Apologies if this is a duplicate.
We have a number of RHEL6 servers hosting different applications. Over time, these servers have had some tweaks to ...
- 121
0
votes
1
answer
486
views
Auditd not sending to remote central server
I'm setting up a central server using rsyslog and auditd on CentOS 8. I was following this guide on how to send remote audit logs to my central server.
Note: instead of going to /etc/audisp/, these
...
- 3
0
votes
1
answer
1k
views
how to audit a reboot?
Quick and simple question: How to I use auditd to log a system reboot?
I tried using the reboot syscall to no avail. I could imagine that the audit daemon is stopped before the actual syscall is made.
...
- 1
0
votes
3
answers
4k
views
Security Log Event ID 4625 - An account failed to log on every few minutes - random source IP addresses
A fairly new MS Windows Server 2019 VM installation is logging over a hundred Security Log Audit Failures a day with Event ID 4625.
RDP for the server is enabled only for a single trusted WAN source ...
- 11
1
vote
1
answer
1k
views
Auditpol gets reset after rebooting
I have created a script that deletes a file and updates some advanced auditing settings using auditpol. However, whenever the computer gets reset, those auditpol changes get reset as well. Is there ...
- 61
0
votes
0
answers
157
views
Updating Advanced Audit Policy Conifguration via auditpol
I just started a new job last week as a software developer and one of the first tasks I was give was to update a script my company sends out to the client laptops. Basically all it is supposed to do ...
- 61
1
vote
0
answers
129
views
Does mcafee mysql audit plugin not work on Percona Server 5.7.27-30?
My environment is 5.7.27-30-log Percona Server on CentOS 7.4.
When I installed this plugin (audit-plugin-percona-5.7-1.1.7-866), I got the following error messages.
mysql> INSTALL PLUGIN AUDIT ...
- 11
0
votes
1
answer
717
views
What's the meaning of parameter Priority_boost
I have searched the web for answers to this. In auditd configuration file auditd.conf there is a parameter priority_boost. The RedHat manpage says:
priority_boost
This is a non-negative number that ...
0
votes
1
answer
911
views
Windows Server 2019 auditing removed as soon as applied
I've got a Windows Server 2019 domain controller with a GPO applying auditing on logon events. RSOP shows it is applied, however, if I look at the event logs, the moment it applies I can see that it ...
0
votes
1
answer
165
views
Monitoring users logged in with SSH-CA (certificates)
I was hoping to get some help with an approach that could be used...
I am building out a solution that will use SSH-CA (that is, SSH where authentication is done via certificates).
Flow is simple:
...
- 103