Questions tagged [audit]
Observing/logging a resource for purposes of: - Adding it to a blacklist of whitelist - Keeping tabs on the security of a system
298
questions
1
vote
0answers
36 views
What makes a selinux-caused EACCESS to not be logged in audit
I've got a system with samba running with standard targetted policy for Fedora.
At some point samba is trying to access a directory tagged unconfined_u:object_r:unlabeled_t:s0 and fails. Through ...
0
votes
1answer
16 views
Identifying user activity/processes from log message on remote machine - 10.0.0.2 - user A, using service account B trying to connect to 10.0.0.3
I just inherited an older Linux server. I am getting asked to identify and stop a process initiated by a user. How can I go about identifying what process a user is executing that matches the logs ...
1
vote
1answer
52 views
Detecting Windows Physical Console Logon
I'm trying to find a way to detect a logon where someone is physically at the machine. I know you can do it with Type 2 but the issue is that events get logged when services make a logon request such ...
0
votes
0answers
12 views
Any ways to automate ingestion into OpenAudit?
I work for a small company and we have ~600 Linux servers and Cisco switches and Fortinet devices spread across a few locations in the US. I'm wondering if there is a good way to automate getting the ...
0
votes
1answer
35 views
How long should accounts be deactivated before being deleted?
How long should accounts be deactivated before being deleted? Should accounts be deactivated?
For example, our organization uses 1Password Business, which allows for accounts to be deactivated. How ...
0
votes
0answers
45 views
Windows Server 2019 - Audit which human-user who restart a service
Trying to audit which AD-user who actually restart a service on a particular service.
The service (MyService) is using a serviceaccount to run and get access to different resources.
I want to audit ...
0
votes
0answers
59 views
pam_tty_audit collect only TTY events
I'm trying to put together a TTY logging feature under Ubuntu 18.04 server and created /etc/pam.d/tty-audit with the following content:
session required pam_tty_audit.so enable=*
and added that ...
2
votes
1answer
86 views
Linux audit files(data=)
type=TTY msg=audit(08/12/2020 02:33:30.163:107) : tty pid=2709 uid=e4ws5 auid=root ses=1 major=4 minor=1 comm=sh data="/bin/bash -i",<nl>
Can anyone tell me how in this audit.log there ...
0
votes
1answer
79 views
How to enable file auditing for exchange server V15 folder
So I want to enable auditing on this specific folder V15 located under program files>Microsoft>Exchange server
But on the auditing tab I get a Message "you must be an administrator or have ...
0
votes
0answers
32 views
Logging SSH commands on Linux - is custom kernel the only way?
I've done some research and it looks like that the way linux keeps history is less about security and audit and more about helping the user.
Even after making changes to instantly log the command and ...
1
vote
1answer
1k views
RHEL: Splitting auditd logs into multiple files for different rules
We have an audit.rules defined and things in rules.d. Many of these are for RHEL CIS compliance and others are more specific for Docker CIS compliance.
One problem we are having is that certain rules ...
0
votes
0answers
21 views
How can I get auditctl to show me the bash script being run to create a file?
I have a simple bash script:
root@sophia:~# cat foo.sh
tmp=$(mktemp)
echo >$tmp Hello World
root@sophia:~#
If I run the bash script, it creates a tempfile and writes some stuff to it. It's not ...
0
votes
1answer
320 views
Logging all failed authentication attempts against Active Directory
I need to log all failed authentication attempts against my Active Directory domain. An external app binds to MS AD via LDAPS and uses AD for user authentication requests.
When the wrong user or ...
1
vote
1answer
83 views
Comparing two Linux servers for any differences [closed]
I tried to find a similar post, but couldn't. Apologies if this is a duplicate.
We have a number of RHEL6 servers hosting different applications. Over time, these servers have had some tweaks to ...
0
votes
1answer
68 views
Auditd not sending to remote central server
I'm setting up a central server using rsyslog and auditd on CentOS 8. I was following this guide on how to send remote audit logs to my central server.
Note: instead of going to /etc/audisp/, these
...
0
votes
1answer
231 views
how to audit a reboot?
Quick and simple question: How to I use auditd to log a system reboot?
I tried using the reboot syscall to no avail. I could imagine that the audit daemon is stopped before the actual syscall is made.
...
0
votes
0answers
19 views
Advanced Audit Policy AD
I have configured Advanced Audit Policy in my Active Directory, some Advanced Audit Policy includes
Audit Credential Validation
Audit Kerberos Authentication Service
Both settings, I have updated to ...
0
votes
0answers
26 views
find who is the user with administrative permissions who performed the most administrative activities in the same session ms365
Hi I'm new to ms 365 and I wanted to know if it is possible to find who is the user with administrative permissions who performed the most administrative activities/actions in the same session.
I ...
0
votes
3answers
966 views
Security Log Event ID 4625 - An account failed to log on every few minutes - random source IP addresses
A fairly new MS Windows Server 2019 VM installation is logging over a hundred Security Log Audit Failures a day with Event ID 4625.
RDP for the server is enabled only for a single trusted WAN source ...
1
vote
1answer
367 views
Auditpol gets reset after rebooting
I have created a script that deletes a file and updates some advanced auditing settings using auditpol. However, whenever the computer gets reset, those auditpol changes get reset as well. Is there ...
0
votes
0answers
47 views
Updating Advanced Audit Policy Conifguration via auditpol
I just started a new job last week as a software developer and one of the first tasks I was give was to update a script my company sends out to the client laptops. Basically all it is supposed to do ...
0
votes
0answers
18 views
Suggestions for auditing screensaver unlocking
Our network includes several flavors of system, but all are CentOS 7 and all run either KDE or Gnome. I've implemented a rule:
-w /usr/lib64/security/pam_sss.so -p rwxa
And this works for KDE -- it ...
1
vote
0answers
54 views
Does mcafee mysql audit plugin not work on Percona Server 5.7.27-30?
My environment is 5.7.27-30-log Percona Server on CentOS 7.4.
When I installed this plugin (audit-plugin-percona-5.7-1.1.7-866), I got the following error messages.
mysql> INSTALL PLUGIN AUDIT ...
0
votes
1answer
174 views
What's the meaning of parameter Priority_boost
I have searched the web for answers to this. In auditd configuration file auditd.conf there is a parameter priority_boost. The RedHat manpage says:
priority_boost
This is a non-negative number that ...
0
votes
1answer
184 views
Windows Server 2019 auditing removed as soon as applied
I've got a Windows Server 2019 domain controller with a GPO applying auditing on logon events. RSOP shows it is applied, however, if I look at the event logs, the moment it applies I can see that it ...
0
votes
1answer
25 views
Monitoring users logged in with SSH-CA (certificates)
I was hoping to get some help with an approach that could be used...
I am building out a solution that will use SSH-CA (that is, SSH where authentication is done via certificates).
Flow is simple:
...
1
vote
1answer
579 views
Check Active Directory GPO audit settings via Powershell
I am trying to automate checking the audit settings on GPOs. In the GUI, to check one GPO, I'd open Group Policy Management Console, expand domains, the domain name, Group Policy Objects, select a GPO ...
0
votes
2answers
35 views
How to verify if an e-mail was really sent?
A customer states that an email was received from Bob. Bob claims that the email was never sent.
How can I verify which side is lying? If both sides have on-premises email servers (e.g. Exchange ...
1
vote
1answer
76 views
Protecting activity logs in Azure
I know that managing identity securely, providing least needed access etc are important but another critical best practice is having audit logs which cannot be modified, deleted or disabled even by ...
4
votes
1answer
133 views
Investigate potential breach in Azure App Service
We suspect we have had a data breach, but we are not sure how to investigate it to determine the source of the breach or what data was sent.
We have an app service that has been running for a while ...
1
vote
0answers
1k views
Prevent Anonymous logons on windows-server 2016
I can't figure out how to entirely disable anonymous logon on Windows Server 2016 which is not a domain controller (regular instance). With the settings currently set I'm truly surprised to see such ...
1
vote
1answer
67 views
O365 Emails Getting Marked as Spam when Moved to new Folder
One of our main inbound mail accounts seems to be having a strange issue where the emails are getting marked as spam, not when they arrived, but when they are moved to a folder.
They are also all ...
0
votes
1answer
399 views
Filtering out processes Windows File Audit (event 4663)
I would like to use Windows File Audit to monitor access to a set of files on my system (i.e. event 4663). I noticed that most of the events generated is noise from a few processes. I would like a ...
1
vote
0answers
967 views
How can I control the audit backlog limit without the auditd package installed?
I would like to use OSQuery instead of the Linux audit daemon. In my testing on Ubuntu 18.04, if OSQuery binds to the kernel security module and the auditd package is installed, it complains about ...
0
votes
1answer
46 views
Should Active Directory, Web Apps and MS-SQL all have the same users?
I am looking for a clean way to do audit trails in MS SQL Server, for compliance reasons, preferably completely on the database side without involving the web application.
When talking about audit ...
0
votes
2answers
180 views
View or open audit for the SharePoint Online site
I am trying to figure out how to view Audit logs for the SharePoint Online site. On our on-prem SharePoint 2013 farm in the configure audit settings for a particular site collection, I have audit ...
0
votes
1answer
452 views
Command to Get Security Audit settings
Im looking to retrieve the Security audit configuration on a domain joined PC which has audit settings applied Via a domain GPO, but im getting - what seems to be - conflicting results. If i run an ...
-1
votes
2answers
933 views
Auditing SSH sessions?
I'm looking for a way that I can record and audit SSH sessions for users on my server. I need to be able to know when a user executed a command, what command they executed, and also be able to follow ...
0
votes
1answer
3k views
How to view the history of the command “passwd <username>”
I'am looking for a way to audit the history of password change for the user root (the passwd command) for a local network server.
How i can view the date and/or the time of execution this command and ...
0
votes
1answer
845 views
Auditd Log all executions except some scripts
I configured my auditd to log all execve syscalls using these rules:
-a exit,always -F arch=b32 -S execve
-a exit,always -F arch=b64 -S execve
While this perfectly captures all activity of any user ...
3
votes
1answer
3k views
What's the difference between auid, uid, euid, suid, fsuid, obj_uid, gid, egid, sgid, fsgid, obj_gid in `auditctl`?
My server is centos7.6 with auditd 2.8.5
In audit rule, I set:
-a always,exit -F arch=b32 -S adjtimex,settimeofday -F key=time-change
But this rule also record normal ntpd activities,then I tried ...
3
votes
2answers
162 views
Active Directory Audit of a User and all Services/Software attached
I have a user I need to audit. This single user is used by a bunch of services/software among other things to run. My job is to figure out everything that is tied to this user and then create new ...
1
vote
0answers
516 views
Auditd how to exclude everything
I am trying to exclude everything but the things I want in Auditd, however the things I've tried, seem to log a lot more details, the majority are irrelevant.
-a never,exclude -F msgtype=CWD
-a ...
2
votes
1answer
56 views
Auditing permission changes in Exchange
What's the best way to confirm to an auditor that a change made to any permission in Exchange was actually made by a legitimate admin with an approved change ticket?
We were recently asked to ...
2
votes
1answer
16k views
Exchange 2016: How to audit mailbox user access to get their IP?
I have a mailbox user (Exchange 2016) who belief that his mailbox was hacked.
So I want to audit the access to his mailbox.
I enabled audit via Set-Mailbox -Identity "Ben Smith" -AuditEnabled $true
...
2
votes
0answers
774 views
Auditd - log all ssh sessions
We have about a thousand servers / virtual machines, and currently keeping track of who did what where isn't easy. And to make it worse, clients have access to their own machines and often don't know ...
2
votes
0answers
1k views
Windows registry subkey creation not generating logs (Windows event ID 4657)
I am experiencing an issue where I am trying to audit a specific registry key via Windows Event ID 4657.
TL; DR: I have tried to setup auditing on a registry key when a new subkey is created under it,...
0
votes
0answers
58 views
File system audit doesn't work for folder creation in Windows 7
I wish to enable file system audit in Windows 7. Surprisingly, I've found that no audit events occurs, when folders are creating. There is events for folder/file deletion, for file creation, but no ...
3
votes
2answers
313 views
Windows Server File Share Audit File Attribute Modification
My goal is to identify what user has set the Hidden attribute on a file within the local file share.
I have enabled File Share access auditing as per this article. In short: Added a group policy ...
0
votes
1answer
1k views
Using auditd and retaining log files for 6 months.
Disclaimer: I'm not an accredited nor very experienced sysadmin but have been tasked with some sysadmin responsibilities
Task: Find a way to log all account management activities (e.g., account ...
