Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [audit]

Observing/logging a resource for purposes of: - Adding it to a blacklist of whitelist - Keeping tabs on the security of a system

325 questions
0
votes
1 answer

Audit logging for OpenLDAP changes

How can I produce and examine an audit trail of changes made to an OpenLDAP database, such as which user was created when, by whom, when was it edited, what was edited etc?
user304436
  • 1
  • 1
0
votes
0 answers

how to get info on failed authentication to domain - security audit?

Setup: 1 Windows Server 2012 box as Domain Controller, named DC1. 2 Windows Server 2012 R2 boxes, S1 and S2, on the same network, same config, joined to the domain. Issue: At random times, S1, S2 or both will not allow me to RDP on the boxes with a…
Razvan Zoitanu
  • 655
  • 1
  • 11
  • 26
0
votes
2 answers

How can I audit Ip adresses of users logging into system?

I have a group of servers which use Kerberos for authentication. We distribute keytabs to users but want to ensure that a user never pass their keytab to someone else. Essentially we need to audit the Ip's of users logging into our system. If the Ip…
Josh Wyatt
  • 3
  • 2
0
votes
0 answers

why is ip address sometimes missing from Security audit log Source Network address for log on audit failures?

Most of the time when someone who is not authorized attempts to log on to my Windows 2008 R2 web server, an ip address is displayed. With the ip address, i can easily block the external host from attempting to log on to my server by setting up a…
gerryLowry
  • 185
  • 3
  • 13
0
votes
1 answer

Remote Desktop Connection Audit

My company recently fired someone. They said, they are auditing that person's electronic activity. We all have Remote Desktop connections that we use to work from home. Do you know what level of information they can access on rdp activity? For…
Puppydog
  • 11
0
votes
2 answers

ssh pass original user to environment on server

First off, i do not know wether passing the information to the environment is the best approach, so i will start by detailing what i actually want to achieve. on a corporate scale, there are servers where a number of employees have individual shell…
Niko S P
  • 1,182
  • 8
  • 16
0
votes
0 answers

File Auditing in Cluster Shared Volumes

I'm trying to simply enable file auditing on a windows share (2012 R2)on top of cluster shared volume. But it doesn't behave as I expected it to behave. Here's the story: I enabled file auditing policy and confirmed that it was applied by RSOP.msc…
user2629636
  • 774
  • 5
  • 19
  • 40
0
votes
2 answers

Configure account event auditing with Secedit

I'm currently putting together a number of PS scripts which can be run against a new webserver in order to harden it prior to it being placed in production. One of these scripts will launch secedit and import a policy I have defined. My query is…
JLPH
  • 71
  • 2
  • 8
0
votes
2 answers

Monitor root commands issued by users

I tried to log the commands issued by the system administrators in our organization and its output using sudo plus the log_output directive as follows on the visudo file Defaults env_reset Defaults …
Ignacio Mondino
  • 19
  • 4
0
votes
1 answer

Replacing a super user by many finer grained users (security)

I find myself in the situation where I have a super user account that can basically do everything in the domain and is set to run scheduled tasks, windows services and websites. I have inherited this situation (I understand this is very bad…
buckley
  • 61
  • 7
0
votes
1 answer

Looking for VCS wrapper that tracks system files changing across the whole *nix OS and sends diffs through email

I need some software that looks after custom directories across the whole OS (i.e. /etc) and alerting me if someone edit something file inside. Additionally, this tool must automatically commit and push changes into backup server, so I can easily…
nextus
  • 1
  • 1
0
votes
1 answer

SQL Server Trace keeps outputting files

A consultant has come and gone to do some audit on our SQL server, and has left a bit of a mess here. The problem is that he did things that we don't know anything about. In the C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\DATA…
thomasb
  • 103
  • 6
0
votes
1 answer

Linux / Ubuntu fingerprinting command/method(s) to identify system wide differences in hardware / packages / configurations between 2 environments

I have 2 separate environments, and some strange behaviour occurring in one environment that is not in the other. Specifically the error is related to the PHP: Fatal error: Nesting level too deep - recursive dependency? This only occurs on AWS, but…
DanH
  • 827
  • 2
  • 9
  • 26
0
votes
1 answer

Log Review Process

Currently I have a fairly large syslog-ng cluster setup that is my main log aggregation point. I have the need to be able to acknowledge certain logs and mark them as review for auditing purposes. Such as all failed sudo attempts. I can easily send…
Eric
  • 1,383
  • 3
  • 17
  • 34
0
votes
1 answer

Integrity checking vs. audit

In RHEL5 Security Guide using of AIDE for checking software integrity is recomended. And also built-in RPM integrity checking functionality. But frequent checking can be resource demanding and rare might not be very useful. On the other hand,…
akalenuk
  • 543
  • 2
  • 6
  • 17
1 2 3
…
21 22