2022 Developer Survey is open! Take survey.

Questions tagged [audit]

Observing/logging a resource for purposes of: - Adding it to a blacklist of whitelist - Keeping tabs on the security of a system

Filter by
Sorted by
Tagged with
1 vote
1 answer
23 views

RHEL 8: Administrator vs. Auditor role

On RHEL 8, are there prepared functions, methods, processes or tools to implement administrator/operator and auditor roles in the following way: An administrator/operator should be able to do almost ...
user avatar
1 vote
0 answers
38 views

auditd killing a server?

In /var/log/kernellog we can see many entries for audit (since we have "space_left_action = SYSLOG" and "write_logs = no"): ... audit: audit_backlog=32769 > audit_backlog_limit=...
user avatar
  • 21
2 votes
1 answer
54 views

"aureport -x --summary" shows -> /usr/sbin/sshd;61b30d72 (deleted)

On one of the machines running Centos i.e. cat /etc/redhat-release CentOS Linux release 7.9.2009 (Core) i found something strange by the command aureport -x --summary aureport -x --summary ...
user avatar
  • 143
0 votes
0 answers
33 views

Logging user creation and deletion with auditd

What is the best way to log/detect user creation on linux machines by using auditd? I was thinking about logging calls to /usr/bin/ and /usr/sbin/ and filtering out useradd, adduser, deluser and ...
user avatar
  • 103
1 vote
0 answers
56 views

stop kernel audit messages logged in syslog without disabling auditing

OS: CentOS 7 I am trying to figure out how audit (kaudit) events are logged in /var/log/messages. I have enabled audit=1 in grub which means when the server boots, kernel auditing is enabled. This is ...
user avatar
  • 1,595
0 votes
0 answers
20 views

Can't add audit settings to lsass on Windows 2016

I'm trying to add audit settings to lsass as described in the following picture: But it's not available on Windows 2016 What was wrong?
user avatar
  • 707
1 vote
2 answers
130 views

Google Cloud - Hipaa Compliance - PgAudit vs IAM Audit Logs

Our infrastructure is hosted on Google Cloud and uses postgresql instances via Cloud SQL I need to configure logging for HIPAA compliance. I have read 2 articles from Google's documentation: https://...
user avatar
0 votes
1 answer
28 views

Event 4771 (Bad Password Logon) Does not show proper client

We are having issues with frequently locked out accounts. We are having 4771 {Bad Password} events on our main DC. Issue: Within the event, the client machine is not properly shown. Instead another DC ...
user avatar
5 votes
5 answers
5k views

How can root start a process that only root can kill?

It is easy to start a process at background or make it as systemd service. However, if I want to start a process that monitors activities on the Linux machine, it fells to the target of attacks. If ...
user avatar
  • 330
0 votes
1 answer
32 views

daemonized alternative to tcpdump to save mirrored traffic

I need to save mirrored traffic for audit purposes. Traffic for audited server is send to other server. I need to capture that traffic on dedicated interface, save it to pcap files of reasonable scope ...
user avatar
0 votes
0 answers
180 views

Rsyslog & Auditd - Parsing audit.log / proctitle hexadecimal value to ascii

I'm trying to edit my rsyslog.conf in order to set hex parts of my auditd logs in clear. Does anyone know if it is possible to configure rsyslog in order to apply a parsing on the log received by a ...
user avatar
0 votes
2 answers
215 views

How log commands executed by user

First at all, I have working some years with snoopy and it's not what I need, also checking history file isn't a solution for me. I have to give ROOT access to a developer to install a program on the ...
user avatar
1 vote
1 answer
1k views

CentOS doesn't boot with "A stop job is running for Security Auditing Service" message

CentOS prints the following during boot [ *** ] A stop job is running for Security Auditing Service (9s / 1min 30s) and then switches into the single user mode.
user avatar
  • 41
1 vote
0 answers
84 views

Monitoring IPv6 connection via auditd

some time i was interested in monitoring TCP/UDP connections with detailed information about process that initiated connection I'have found helpful article about that - Finding short-lived TCP ...
user avatar
2 votes
0 answers
45 views

Why are docker permission errors not logged by selinux?

If you try to bind mount a directory into a container under Red Hat you might have problems with selinux. The directory will be unreadable from inside the container. Unless you add a z/Z volume option....
user avatar
  • 1,715
3 votes
0 answers
97 views

Configuring Solaris audit to include username into his events

Need to configure audit logging in Solaris but I have a problem. There are two SunOS servers which were configured before. When I started analysing logs I found out that in Solaris 10 I can see the ...
user avatar
  • 31
1 vote
0 answers
56 views

What makes a selinux-caused EACCESS to not be logged in audit

I've got a system with samba running with standard targetted policy for Fedora. At some point samba is trying to access a directory tagged unconfined_u:object_r:unlabeled_t:s0 and fails. Through ...
user avatar
  • 1,254
0 votes
1 answer
22 views

Identifying user activity/processes from log message on remote machine - 10.0.0.2 - user A, using service account B trying to connect to 10.0.0.3

I just inherited an older Linux server. I am getting asked to identify and stop a process initiated by a user. How can I go about identifying what process a user is executing that matches the logs ...
user avatar
1 vote
1 answer
110 views

Detecting Windows Physical Console Logon

I'm trying to find a way to detect a logon where someone is physically at the machine. I know you can do it with Type 2 but the issue is that events get logged when services make a logon request such ...
user avatar
  • 3,791
0 votes
1 answer
39 views

How long should accounts be deactivated before being deleted?

How long should accounts be deactivated before being deleted? Should accounts be deactivated? For example, our organization uses 1Password Business, which allows for accounts to be deactivated. How ...
user avatar
0 votes
0 answers
215 views

Windows Server 2019 - Audit which human-user who restart a service

Trying to audit which AD-user who actually restart a service on a particular service. The service (MyService) is using a serviceaccount to run and get access to different resources. I want to audit ...
user avatar
0 votes
0 answers
297 views

pam_tty_audit collect only TTY events

I'm trying to put together a TTY logging feature under Ubuntu 18.04 server and created /etc/pam.d/tty-audit with the following content: session required pam_tty_audit.so enable=* and added that ...
user avatar
  • 3
2 votes
1 answer
100 views

Linux audit files(data=)

type=TTY msg=audit(08/12/2020 02:33:30.163:107) : tty pid=2709 uid=e4ws5 auid=root ses=1 major=4 minor=1 comm=sh data="/bin/bash -i",<nl> Can anyone tell me how in this audit.log there ...
user avatar
  • 23
0 votes
1 answer
135 views

How to enable file auditing for exchange server V15 folder

So I want to enable auditing on this specific folder V15 located under program files>Microsoft>Exchange server But on the auditing tab I get a Message "you must be an administrator or have ...
user avatar
0 votes
0 answers
37 views

Logging SSH commands on Linux - is custom kernel the only way?

I've done some research and it looks like that the way linux keeps history is less about security and audit and more about helping the user. Even after making changes to instantly log the command and ...
user avatar
  • 3,791
1 vote
1 answer
1k views

RHEL: Splitting auditd logs into multiple files for different rules

We have an audit.rules defined and things in rules.d. Many of these are for RHEL CIS compliance and others are more specific for Docker CIS compliance. One problem we are having is that certain rules ...
user avatar
  • 151
0 votes
1 answer
1k views

Logging all failed authentication attempts against Active Directory

I need to log all failed authentication attempts against my Active Directory domain. An external app binds to MS AD via LDAPS and uses AD for user authentication requests. When the wrong user or ...
user avatar
  • 71
2 votes
1 answer
364 views

Comparing two Linux servers for any differences [closed]

I tried to find a similar post, but couldn't. Apologies if this is a duplicate. We have a number of RHEL6 servers hosting different applications. Over time, these servers have had some tweaks to ...
user avatar
0 votes
1 answer
209 views

Auditd not sending to remote central server

I'm setting up a central server using rsyslog and auditd on CentOS 8. I was following this guide on how to send remote audit logs to my central server. Note: instead of going to /etc/audisp/, these ...
user avatar
  • 3
0 votes
1 answer
667 views

how to audit a reboot?

Quick and simple question: How to I use auditd to log a system reboot? I tried using the reboot syscall to no avail. I could imagine that the audit daemon is stopped before the actual syscall is made. ...
user avatar
  • 1
0 votes
3 answers
2k views

Security Log Event ID 4625 - An account failed to log on every few minutes - random source IP addresses

A fairly new MS Windows Server 2019 VM installation is logging over a hundred Security Log Audit Failures a day with Event ID 4625. RDP for the server is enabled only for a single trusted WAN source ...
user avatar
  • 11
1 vote
1 answer
776 views

Auditpol gets reset after rebooting

I have created a script that deletes a file and updates some advanced auditing settings using auditpol. However, whenever the computer gets reset, those auditpol changes get reset as well. Is there ...
user avatar
  • 61
0 votes
0 answers
86 views

Updating Advanced Audit Policy Conifguration via auditpol

I just started a new job last week as a software developer and one of the first tasks I was give was to update a script my company sends out to the client laptops. Basically all it is supposed to do ...
user avatar
  • 61
1 vote
0 answers
84 views

Does mcafee mysql audit plugin not work on Percona Server 5.7.27-30?

My environment is 5.7.27-30-log Percona Server on CentOS 7.4. When I installed this plugin (audit-plugin-percona-5.7-1.1.7-866), I got the following error messages. mysql> INSTALL PLUGIN AUDIT ...
user avatar
  • 11
0 votes
1 answer
439 views

What's the meaning of parameter Priority_boost

I have searched the web for answers to this. In auditd configuration file auditd.conf there is a parameter priority_boost. The RedHat manpage says: priority_boost This is a non-negative number that ...
user avatar
0 votes
1 answer
569 views

Windows Server 2019 auditing removed as soon as applied

I've got a Windows Server 2019 domain controller with a GPO applying auditing on logon events. RSOP shows it is applied, however, if I look at the event logs, the moment it applies I can see that it ...
user avatar
0 votes
1 answer
81 views

Monitoring users logged in with SSH-CA (certificates)

I was hoping to get some help with an approach that could be used... I am building out a solution that will use SSH-CA (that is, SSH where authentication is done via certificates). Flow is simple: ...
user avatar
1 vote
1 answer
1k views

Check Active Directory GPO audit settings via Powershell

I am trying to automate checking the audit settings on GPOs. In the GUI, to check one GPO, I'd open Group Policy Management Console, expand domains, the domain name, Group Policy Objects, select a GPO ...
user avatar
0 votes
2 answers
135 views

How to verify if an e-mail was really sent?

A customer states that an email was received from Bob. Bob claims that the email was never sent. How can I verify which side is lying? If both sides have on-premises email servers (e.g. Exchange ...
user avatar
  • 151
1 vote
1 answer
78 views

Protecting activity logs in Azure

I know that managing identity securely, providing least needed access etc are important but another critical best practice is having audit logs which cannot be modified, deleted or disabled even by ...
user avatar
4 votes
1 answer
185 views

Investigate potential breach in Azure App Service

We suspect we have had a data breach, but we are not sure how to investigate it to determine the source of the breach or what data was sent. We have an app service that has been running for a while ...
user avatar
1 vote
0 answers
2k views

Prevent Anonymous logons on windows-server 2016

I can't figure out how to entirely disable anonymous logon on Windows Server 2016 which is not a domain controller (regular instance). With the settings currently set I'm truly surprised to see such ...
user avatar
  • 121
1 vote
1 answer
98 views

O365 Emails Getting Marked as Spam when Moved to new Folder

One of our main inbound mail accounts seems to be having a strange issue where the emails are getting marked as spam, not when they arrived, but when they are moved to a folder. They are also all ...
user avatar
  • 506
0 votes
1 answer
699 views

Filtering out processes Windows File Audit (event 4663)

I would like to use Windows File Audit to monitor access to a set of files on my system (i.e. event 4663). I noticed that most of the events generated is noise from a few processes. I would like a ...
user avatar
1 vote
0 answers
1k views

How can I control the audit backlog limit without the auditd package installed?

I would like to use OSQuery instead of the Linux audit daemon. In my testing on Ubuntu 18.04, if OSQuery binds to the kernel security module and the auditd package is installed, it complains about ...
user avatar
  • 11
0 votes
1 answer
53 views

Should Active Directory, Web Apps and MS-SQL all have the same users?

I am looking for a clean way to do audit trails in MS SQL Server, for compliance reasons, preferably completely on the database side without involving the web application. When talking about audit ...
user avatar
0 votes
2 answers
213 views

View or open audit for the SharePoint Online site

I am trying to figure out how to view Audit logs for the SharePoint Online site. On our on-prem SharePoint 2013 farm in the configure audit settings for a particular site collection, I have audit ...
user avatar
  • 3
1 vote
1 answer
710 views

Command to Get Security Audit settings

Im looking to retrieve the Security audit configuration on a domain joined PC which has audit settings applied Via a domain GPO, but im getting - what seems to be - conflicting results. If i run an ...
user avatar
  • 306
-1 votes
2 answers
2k views

Auditing SSH sessions?

I'm looking for a way that I can record and audit SSH sessions for users on my server. I need to be able to know when a user executed a command, what command they executed, and also be able to follow ...
user avatar
  • 107
0 votes
1 answer
6k views

How to view the history of the command "passwd <username>"

I'am looking for a way to audit the history of password change for the user root (the passwd command) for a local network server. How i can view the date and/or the time of execution this command and ...
user avatar

1
2 3 4 5
7