Fundamentals of Linux Platform Security. Fundamentals of Linux Platform Security. Roadmap. Security Training Course. Module 5 Logging Infrastructures
|
|
- Randolph Wright
- 7 years ago
- Views:
Transcription
1 Fundamentals of Linux Platform Security Security Training Course Dr. Charles J. Antonelli The University of Michigan 2012 Fundamentals of Linux Platform Security Module 5 Logging Infrastructures Roadmap Motivation Challenges Syslog Centralized Logging Log reduction Swatch, logwatch 3 1
2 Motivation Administration & debugging Detect & analyze security & performance incidents Auditing Regulatory requirements HIPAA, SOX, PCI, GLBA, 4 Example Jan 02 16:19:45 host.example.com rpc.statd[351]: gethostbyname error for ^X ÿ ^X ÿ ^Y ÿ ^Y ÿ ^Z ÿ ^Z ÿ ^[ ÿ ^[ ÿ bffff f 6 d e f f 6 6 b f f f f bffff719 bffff71a b f f f f 7 1 b _!! 5 Challenges Log generation & storage Log CIA Log analysis 6 2
3 CEE - Coming soon? Common Event Expression Standardizes the way computer events are described, logged, and exchanged Create an event expression taxonomy for uniform and precise log definitions that lead to a common event representation. Create logging syntax utilizing a single data dictionary to provide consistent event specific details. Standardize flexible event transport mechanisms to support multiple environments. Propose log recommendations for the events and attributes devices generate. (August, 2012) 7 syslog UNIX/Linux logging daemon facility (origin) & priority (importance) log entry accepted by daemon logged according to config file Windows third-party tools Windows event log -> syslog syslog -> Windows 8 syslog LogAnalyzer (née phplogcon) Front end for searching, reviewing and analyzing event data Data sources syslog, rsyslog, WinSyslog log files MySQL databases» Adiscon MonitorWare, php-syslog-ng schemas Any LF-delimited file Multiple instances Data display GUI controls: scroll, search, tooltip, 9 3
4 syslog Splunk Indexes log file data, also config files, arbitrary script output Data sources syslog, rsyslog, WinSyslog log files Config files Arbitrary script outputs Multiple instances Indexes data Free for indexing up to 500 MB/day Data display GUI controls: scroll, search, tooltip, 10 rsyslog The reliable & extended Linux logging daemon Upward-compatible with syslogd Provides reliable remote logging TCP ubiquitous, uses reliable connection RELP- queues locally until loghost accessible man rsyslogd man 5 rsyslog.conf /etc/rsyslog.conf 11 rsyslog basic lab Edit log destination sudo vi /etc/rsyslog.conf Add line under RULES section *.debug,mark.debug /var/log/fulllog Tell syslog to re-read config file sudo service rsyslog restart Test the syslog logger Hello, world! 12 4
5 centralized logging lab Your instructor will provide the identity of a central logging host pst.merit.edu Edit local /etc/rsyslog.conf Add forwarding rule with remote host Tell local syslog to re-read config file sudo service rsyslog restart Test with logger 13 Relay Architecture 14 Log Reduction Make three piles ignore don t want to see these, ever baseline aren t likely to contain time-critical security information investigate - those that do 15 5
6 Log Reduction A simple first step cut -f5- -d\ /var/log/fulllog sed -e s/[0-9] [0-9]*/###/g sort uniq -c sort -nr Use script in /usr/local/lab/syslog/reduce 16 Baselining I Construct a baseline Measure set of known data to compute range of normal values Examples Network traffic by protocol Logins/logouts Accesses of admin accounts DHCP address management DNS requests Amount of log data/day Number of processes running 17 Baselining II Compare against baseline Anomaly detection detecting things you haven t seen before Thresholding identifying data that exceed a given baseline Windowing detecting events within a given time period 18 6
7 Log parsing tools swatch logwatch 19 swatch lab Examine man page man swatch Copy sample rule cp /usr/local/lab/swatch/sample.swatchrc ~lab/.swatchrc Examine sample rule Start swatch sudo /usr/local/bin/swatch -c ~lab/.swatchrc Trigger swatch Start a new terminal window logger Hello, World! Experiment with different rules 20 log parsing lab Examine man page man logwatch Examine config and service files System-wide /usr/share/logwatch/default.conf/logwatch.conf /usr/share/logwatch/scripts/services Locally-configured /etc/logwatch/conf/logwatch.conf /etc/logwatch/scripts/services Perform log parse /usr/sbin/logwatch [--service sendmail] [-- range all] [--archives] 21 7
8 Maintaining log files Log files expand to fill available space Control by rotation switch over to a new log file periodically overwrite oldest log file logrotate needs logging facility s cooperation /sbin/killall -HUP facility copytruncate man logrotate /etc/logrotate.conf /etc/logrotate.d/ 22 log analysis lab Enable httpd sudo service httpd start Install LogAnalyzer (1) cd; cp /usr/local/lab/loganalyzer/ loganalyzer tar.gz. tar zxf loganalyzer tar.gz cd loganalyzer less Install 23 Install LogAnalyzer (2) sudo cp -r src/* /var/www/html sudo touch /var/www/html/config.php log analysis lab sudo chmod 666 /var/www/html/config.php sudo chcon -hr -t httpd_sys_script_rw_t /var/www/html Install LogAnalyzer (3) sudo setfacl -m u:apache:r /var/log/messages cp /usr/local/lab/loganalyzer/lpspol_log.te. checkmodule -M -m -o lpspol_log.mod lpspol_log.te semodule_package -o lpspol_log.pp -m lpspol_log.mod sudo semodule -i lpspol_log.pp 24 8
9 log analysis lab Install LogAnalyzer (4) Browse to Click the word here in the Critical Error Notice Accept all defaults except: Step 7 Set Syslog file to /var/log/messages Install LogAnalyzer (5) sudo chmod 644 /var/www/html/config.php sudo restorecon -R /var/www/html Run LogAnalyzer! Browse to When done with lab: sudo setfacl -b /var/log/messages 25 References Abe Singer and Tina Bird, Building a Logging Infrastructure, USENIX Association, ISBN , The SANS 2007 Log Management Market Report (accessed April 2010) Common Event Expression (Anton Chuvakin, cee@mitre.org) (accessed April 2010) Karen Kant and Murugiah Souppaya, Guide to Computer Security Log Management," NIST Publication , September LogAnalyzer Documentation, (accessed December 2010)
Syslog & xinetd. Stephen Pilon
Syslog & xinetd Stephen Pilon What create log files? Logging Policies Throw away all data immediately Reset log files at periodic intervals Rotate log files, keeping data for a fixed time Compress and
More informationsyslog - centralized logging
syslog - centralized logging David Morgan A logging system Conforming programs emit categorized messages Messages are candidates for logging syslog handles the logging performed by syslogd per /etc/syslog.conf
More informationCSE/ISE 311: Systems Administra5on Logging
Logging Por$ons courtesy Ellen Liu Outline Introduc$on Finding log files Syslog: the system event logger Linux logrotate tool Condensing log files to useful informa$on Logging policies 13-2 Who and Why
More informationReliable log data transfer
OWASP Switzerland Chapter December 2015 Reliable log data transfer About (r)syslog, logstash, and log data signing A field report pascal.buchbinder@adnovum.ch Agenda Why we need log data transfer Syslog
More informationHow To Analyze Logs On Aloha On A Pcode On A Linux Server On A Microsoft Powerbook (For Acedo) On A Macbook Or Ipad (For An Ubuntu) On An Ubode (For Macrocess
Application Note Analyze ALOHA s HAProxy logs with halog Document version: v1.1 Last update: 3rd September 2013 Purpose Being able to analyze logs generated by the ALOHA Load-Balancer stored in a third
More informationCSE 265: System and Network Administration
CSE 265: System and Network Administration If you aren't measuring it, you aren't managing it. Service Monitoring Syslog and Log files Historical data Real-time monitoring Alerting Active monitoring systems
More informationUnless otherwise noted, all references to STRM refer to STRM, STRM Log Manager, and STRM Network Anomaly Detection.
TECHNICAL NOTE FORWARDING LOGS USING TAIL2SYSLOG MARCH 2013 The Tail2Syslog support script provides a method for monitoring and forwarding events to STRM using syslog for real-time correlation. Tail2Syslog
More informationLinux System Administration. System Administration Tasks
System Administration Tasks User and Management useradd - Adds a new user account userdel - Deletes an existing account usermod - Modifies an existing account /etc/passwd contains user name, user ID #,
More informationNetwork Monitoring & Management Log Management
Network Monitoring & Management Log Management Network Startup Resource Center www.nsrc.org These materials are licensed under the Creative Commons Attribution-NonCommercial 4.0 International license (http://creativecommons.org/licenses/by-nc/4.0/)
More informationTopics. CIT 470: Advanced Network and System Administration. Logging Policies. System Logs. Throwing Away. How to choose a logging policy?
Topics CIT 470: Advanced Network and System Administration Logging 1. System logs 2. Logging policies 3. Finding logs 4. Syslog 5. Syslog servers 6. Log monitoring CIT 470: Advanced Network and System
More informationLog Management: Monitoring and Making Sense of Logs
License Log Management: Monitoring and Making Sense of Logs This work by Z. Cliffe Schreuders at Leeds Metropolitan University is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License.
More informationIntrusion Detection and Prevention: Network and IDS Configuration and Monitoring using Snort
License Intrusion Detection and Prevention: Network and IDS Configuration and Monitoring using Snort This work by Z. Cliffe Schreuders at Leeds Metropolitan University is licensed under a Creative Commons
More informationdisect Systems Logging Snort alerts to Syslog and Splunk PRAVEEN DARSHANAM
disect Systems Logging Snort alerts to Syslog and Splunk PRAVEEN DARSHANAM INTRODUCTION Snort is an open source network Intrusion Detection and Prevention Systems (IDS/IPS) developed by Martin Roesch capable
More informationSystem Administration
Performance Monitoring For a server, it is crucial to monitor the health of the machine You need not only real time data collection and presentation but offline statistical analysis as well Characteristics
More informationIMPORTANCE OF CENTRALIZED LOG SERVER AND LOG ANALYZER SOFTWARE FOR AN ORGANIZATION
IMPORTANCE OF CENTRALIZED LOG SERVER AND LOG ANALYZER SOFTWARE FOR AN ORGANIZATION R.Anusooya 1, J.Rajan 2, S.A.V.SatyaMurty 3 1. Scientific Officer-E, Computer Division, Indira Gandhi Centre for Atomic
More informationipta iptables Log Analyzer Anders Sikvall ichimusai.org
ipta iptables Log Analyzer Anders Sikvall ichimusai.org May 17, 2015 Version 0.1 Copyright 2015 Anders Sikvall http://ichimusai.org/projects/ipta ichi@ichimusai.org Contents 1 Introduction 5 1.1 Project
More informationIncremental Backup Script. Jason Healy, Director of Networks and Systems
Incremental Backup Script Jason Healy, Director of Networks and Systems Last Updated Mar 18, 2008 2 Contents 1 Incremental Backup Script 5 1.1 Introduction.............................. 5 1.2 Design Issues.............................
More informationAnalyze Traffic with Monitoring Interfaces and Packet Forwarding
Analyze Traffic with Monitoring Interfaces and Packet Forwarding Published: 2016-04-08 This guide explains how to configure an ExtraHop appliance to analyze network traffic using both monitoring interfaces
More informationRed Condor Syslog Server Configurations
Red Condor Syslog Server Configurations May 2008 2 Red Condor Syslog Server Configurations This application note describes the configuration and setup of a syslog server for use with the Red Condor mail
More informationNetwork Monitoring & Management Log Management
Network Monitoring & Management Log Management These materials are licensed under the Creative Commons Attribution-Noncommercial 3.0 Unported license (http://creativecommons.org/licenses/by-nc/3.0/) Syslog
More informationAlert Logic Log Manager
whitepaper Alert Logic Log Manager Configuring Log Sources for Best Practice Reports CONTENTS Introduction 1 Best Practice Reports in Log Manager 2 Active Directory 2 Databases 2 Network Devices 2 Windows
More informationBirmingham Environment for Academic Research. Introduction to Linux Quick Reference Guide. Research Computing Team V1.0
Birmingham Environment for Academic Research Introduction to Linux Quick Reference Guide Research Computing Team V1.0 Contents The Basics... 4 Directory / File Permissions... 5 Process Management... 6
More informationConfiguring System Message Logging
CHAPTER 25 This chapter describes how to configure system message logging on the Catalyst 2960 switch. Note For complete syntax and usage information for the commands used in this chapter, see the Cisco
More informationNetwork Monitoring & Management Log Management
Network Monitoring & Management Log Management Network Startup Resource Center www.nsrc.org These materials are licensed under the Creative Commons Attribution-NonCommercial 4.0 International license (http://creativecommons.org/licenses/by-nc/4.0/)
More informationRuntime Monitoring & Issue Tracking
Runtime Monitoring & Issue Tracking http://d3s.mff.cuni.cz Pavel Parízek parizek@d3s.mff.cuni.cz CHARLES UNIVERSITY IN PRAGUE faculty of mathematics and physics Runtime monitoring Nástroje pro vývoj software
More informationAn Introduction to Event Modeling and Correlation. Stephen Rondeau Institute of Technology
An Introduction to Event Modeling and Correlation Stephen Rondeau Institute of Technology Agenda Background Recording Events Event Operations Modeling Events Correlating Events Commercial Approaches Rule
More informationhttp://cnmonitor.sourceforge.net CN=Monitor Installation and Configuration v2.0
1 Installation and Configuration v2.0 2 Installation...3 Prerequisites...3 RPM Installation...3 Manual *nix Installation...4 Setup monitoring...5 Upgrade...6 Backup configuration files...6 Disable Monitoring
More informationSyslog Monitoring Feature Pack
AdventNet Web NMS Syslog Monitoring Feature Pack A dventnet, Inc. 5645 G ibraltar D rive Pleasanton, C A 94588 USA P ho ne: +1-925-924-9500 Fa x : +1-925-924-9600 Em ail:info@adventnet.com http://www.adventnet.com
More informationTools. (Security) Tools. Network Security I-7262a
Tools (Security) Tools Tools: Overview syslog - history - interna - examples & products traffic capture / view / analyze port scanner vulnerability scanner other utilities closing thoughts Tools: Syslog
More informationWorking with ESX(i) Log Files
Working with ESX(i) Log Files Working with ESX(i) log files is important when troubleshooting issues within the virtual environment. You can view and search log files in ESX(i) and in vcenter Server using
More informationLinux logging and logfiles monitoring with swatch
Linux logging and logfiles monitoring with swatch, wire.less.dk edit: November 2009, Pacnog6 http://creativecommons.org/licenses/by-nc-sa/3.0/ 1 Agenda Linux logging The most important logs Swatch and
More informationHIPAA Compliance Use Case
Overview HIPAA Compliance helps ensure that all medical records, medical billing, and patient accounts meet certain consistent standards with regard to documentation, handling, and privacy. Current Situation
More informationMCNC Webinar Series. Syslog
MCNC Webinar Series Syslog Gonz Guzman Lead Client Network Engineer gonz@mcnc.org Bradley Stevens Sr Client Network Engineer bstevens@mcnc.org Webinar Links: www.mcnc.org/cne-webinars Agenda What is syslog?
More informationlogstash The Book Log management made easy James Turnbull
The logstash Book Log management made easy James Turnbull The Logstash Book James Turnbull August 2, 2015 Version: v1.5.3 (e8fdab5) Website: The Logstash Book Contents Chapter 1 Shipping Events without
More informationIn my first ;login: article [1], I provided an overview of how to build an
DAVID LANG David Lang is a Staff IT Engineer at Intuit, where he has spent more than a decade working in the Security Department for the Banking Division. He was introduced to Linux in 1993 and has been
More informationLog Analysis with the ELK Stack (Elasticsearch, Logstash and Kibana) Gary Smith, Pacific Northwest National Laboratory
Log Analysis with the ELK Stack (Elasticsearch, Logstash and Kibana) Gary Smith, Pacific Northwest National Laboratory A Little Context! The Five Golden Principles of Security! Know your system! Principle
More informationHelping You Piece IT Together. Best Practices for Log Monitoring
Helping You Piece IT Together Best Practices for Log Monitoring http://www.bhconsulting.ie info@bhconsulting.ie Introduction What are logs? Why are logs important? The Challenges Recommended Best Practises
More informationCisco Setting Up PIX Syslog
Table of Contents Setting Up PIX Syslog...1 Introduction...1 Before You Begin...1 Conventions...1 Prerequisites...1 Components Used...1 How Syslog Works...2 Logging Facility...2 Levels...2 Configuring
More informationLinux Security on HP Servers: Security Enhanced Linux. Abstract. Intended Audience. Technical introduction
Linux Security on HP Servers: Security Enhanced Linux Technical introduction This white paper -- one in a series of Linux security white papers -- discusses Security Enhanced Linux (SELinux), a mandatory
More informationInstalling Booked scheduler on CentOS 6.5
Installing Booked scheduler on CentOS 6.5 This guide will assume that you already have CentOS 6.x installed on your computer, I did a plain vanilla Desktop install into a Virtual Box VM for this test,
More informationLogitoring : log driven monitroing. the Rocket science. and. Eugene Istomin. IT Architect. e.istomin@edss.ee. Cone Center,Tallinn
Logitoring : log driven monitroing and the Rocket science Eugene Istomin IT Architect e.istomin@edss.ee Cone Center,Tallinn Topic goal: talking about a common way of delivering, storing and analyzing monitoring/log/trace
More informationOpenCanary Documentation
OpenCanary Documentation Release 0.1 Thinkst Applied Research May 09, 2016 Contents 1 Getting Started 3 2 Services 7 3 Alerting 9 4 Indices and tables 11 i ii OpenCanary Documentation, Release 0.1 Welcome
More informationNetwork Probe User Guide
Network Probe User Guide Network Probe User Guide Table of Contents 1. Introduction...1 2. Installation...2 Windows installation...2 Linux installation...3 Mac installation...4 License key...5 Deployment...5
More informationEMC VNX Version 8.1 Configuring and Using the Audit Tool on VNX for File P/N 300-015-126 Rev 01 August, 2013
EMC VNX Version 8.1 Configuring and Using the Audit Tool on VNX for File P/N 300-015-126 Rev 01 August, 2013 This technical note contains information on these topics: Executive summary... 2 Introduction...
More informationPrivileged Account Access Management: Why Sudo Is No Longer Enough
Access Control Excellence Privileged Account Access Management: Why Sudo Is No Longer Enough The new privileged access management solutions available on the market today provide highly efficient and effective
More informationAn Introduction to Syslog. Rainer Gerhards Adiscon
An Introduction to Syslog Rainer Gerhards Adiscon What is Syslog? The heterogeneous network logging workhorse a system to emit/store/process meaningful log messages both a communications protocol as well
More informationNETWRIX EVENT LOG MANAGER
NETWRIX EVENT LOG MANAGER ADMINISTRATOR S GUIDE Product Version: 4.0 July/2012. Legal Notice The information in this publication is furnished for information use only, and does not constitute a commitment
More informationInsider Threat Control: Using a SIEM signature to detect potential precursors to IT Sabotage. CERT Insider Threat Center
Insider Threat Control: Using a SIEM signature to detect potential precursors to IT Sabotage CERT Insider Threat Center April 2011 NOTICE: THIS TECHNICAL DATA IS PROVIDED PURSUANT TO GOVERNMENT CONTRACT
More informationTEST AUTOMATION FRAMEWORK
TEST AUTOMATION FRAMEWORK Twister Topics Quick introduction Use cases High Level Description Benefits Next steps Twister How to get Twister is an open source test automation framework. The code, user guide
More informationTroubleshooting. System History Log. System History Log Overview CHAPTER
CHAPTER 10 This section provides you will tools to help you to troubleshoot the Cisco Intercompany Media Engine server. For more information on troubleshooting the Cisco Intercompany Media Engine feature,
More informationNETWRIX EVENT LOG MANAGER
NETWRIX EVENT LOG MANAGER USER GUIDE Product Version: 4.0 July/2012. Legal Notice The information in this publication is furnished for information use only, and does not constitute a commitment from NetWrix
More informationReporting Guide for Novell Sentinel
www.novell.com/documentation Reporting Guide for Novell Sentinel Identity Manager 4.0.2 November 2012 Legal Notices Novell, Inc., makes no representations or warranties with respect to the contents or
More informationConfiguring LocalDirector Syslog
Configuring LocalDirector Syslog Document ID: 22178 LocalDirector is now End of Sale. Refer to the Cisco LocalDirector 400 Series bulletins for more information. Contents Introduction Before You Begin
More informationSyslog Server. Eddie Aronovich. Tel-Aviv University. www.eu-egee.org. egee INFSO-RI-508833
Syslog Server Eddie Aronovich School of CS Tel-Aviv University www.eu-egee.org egee Table of context Motivation Possible attitudes Possible solutions & Implementations How good is our memory? Count the
More informationHow To Set Up Rsyslog On Ubuntu And Debian 2.5.2 (For Ubuntu)
Remote Logging with Rsyslog Or, How I Learned to Start Worrying and Love the Panopticon Paul Nijjar Kitchener-Waterloo Linux User Group August 10, 2009 Goals Centralize Logging: Look in one place,
More informationLINUX SECURITY COOKBOOK. DanieIJ. Barren, Richard E Silverman, and Robert G. Byrnes
LINUX SECURITY COOKBOOK DanieIJ. Barren, Richard E Silverman, and Robert G. Byrnes ORELLY Beijing " Cambridge " Farnham " Koln " Paris " Sebastopol " Taipei - Tokyo Table of Contents Preface............,....................................................A
More informationScheduled Tasks and Log Management
Scheduled Tasks and Log Management TELE301 Laboratory Manual Contents 1 Cron..................................... 1 2 Syslog.................................... 3 3 Rotating Logs................................
More informationlogstash The Book Log management made easy James Turnbull
The logstash Book Log management made easy James Turnbull The Logstash Book James Turnbull May 6, 2016 Version: v2.3.2 (e9c3ebc) Website: The Logstash Book Contents Page Chapter 1 Shipping Events without
More informationSSL Tunnels. Introduction
SSL Tunnels Introduction As you probably know, SSL protects data communications by encrypting all data exchanged between a client and a server using cryptographic algorithms. This makes it very difficult,
More informationNETWRIX EVENT LOG MANAGER
NETWRIX EVENT LOG MANAGER QUICK-START GUIDE FOR THE ENTERPRISE EDITION Product Version: 4.0 July/2012. Legal Notice The information in this publication is furnished for information use only, and does not
More informationUser Guide. SysMan Utilities. By Sysgem AG
SysMan Utilities User Guide By Sysgem AG Sysgem is a trademark of Sysgem AG. Other brands and products are registered trademarks of their respective holders. 2013 Sysgem AG, Lavaterstr. 45, CH-8002 Zürich,
More informationMcAfee Network Threat Response (NTR) 4.0
McAfee Network Threat Response (NTR) 4.0 Configuring Automated Reporting and Alerting Automated reporting is supported with introduction of NTR 4.0 and designed to send automated reports via existing SMTP
More informationHow To Configure Syslog over VPN
How To Configure Syslog over VPN Applicable Version: 10.00 onwards Overview Cyberoam provides extensive logging capabilities for traffic, system and network protection functions. Detailed log information
More informationIntrusion Detection Systems. Darren R. Davis Student Computing Labs
Intrusion Detection Systems Darren R. Davis Student Computing Labs Overview Intrusion Detection What is it? Why do I need it? How do I do it? Intrusion Detection Software Network based Host based Intrusion
More informationThe Ins and Outs of System Logging Using Syslog
Interested in learning more about security? SANS Institute InfoSec Reading Room This paper is from the SANS Institute Reading Room site. Reposting is not permitted without express written permission. The
More informationEmerald. Network Collector Version 4.0. Emerald Management Suite IEA Software, Inc.
Emerald Network Collector Version 4.0 Emerald Management Suite IEA Software, Inc. Table Of Contents Purpose... 3 Overview... 3 Modules... 3 Installation... 3 Configuration... 3 Filter Definitions... 4
More informationSyslog Configuration for Auditing
Access Manager Syslog Configuration for Auditing Access Manager 4.2 Contents... 1 1. Introduction... 3 2. How Access Manager auditing works with Syslog... 3 3. Linux: Configuring Access Manager and Syslog...
More informationInformation Systems Application Administration Manual Request Tracker
Information Systems Application Administration Manual Request Tracker Abstract : Describes all administration- and operationsrelated information for the DigitalGlobe implementation of Request Tracker V3.
More informationLogging with syslog-ng, Part One
Logging with syslog-ng, Part One By Line Forrest Hoffman Used properly, system logs are like the pulse of a system. A log can often explain sources of configuration problems or foretell of impending hardware
More informationNixu SNS Security White Paper May 2007 Version 1.2
1 Nixu SNS Security White Paper May 2007 Version 1.2 Nixu Software Limited Nixu Group 2 Contents 1 Security Design Principles... 3 1.1 Defense in Depth... 4 1.2 Principle of Least Privilege... 4 1.3 Principle
More informationLoad-Balancing Introduction (with examples...)
Load-Balancing Introduction (with examples...) For AFNOG 2015 By Frank Kuse (Rework of slides from Joel Jaeggli and Laban Mwangi) 1 Load-Balancing Introduction (with examples...) For AFNOG 2015 By Frank
More informationInstalling Virtual Coordinator (VC) in Linux Systems that use RPM (Red Hat, Fedora, CentOS) Document # 15807A1-103 Date: Aug 06, 2012
Installing Virtual Coordinator (VC) in Linux Systems that use RPM (Red Hat, Fedora, CentOS) Document # 15807A1-103 Date: Aug 06, 2012 1 The person installing the VC is knowledgeable of the Linux file system
More informationEnterprise SysLog Manager (ESM)
Enterprise SysLog Manager (ESM) ESM is a managed network security appliance (scalable HP server) with database for the collection, management and reporting of syslog messages, from critical hosts and network
More informationKiwi SyslogGen. A Freeware Syslog message generator for Windows. by SolarWinds, Inc.
Kiwi SyslogGen A Freeware Syslog message generator for Windows by SolarWinds, Inc. Kiwi SyslogGen is a free Windows Syslog message generator which sends Unix type Syslog messages to any PC or Unix Syslog
More informationDistributed syslog architectures with syslog-ng Premium Edition
Distributed syslog architectures with syslog-ng Premium Edition May 12, 2011 The advantages of using syslog-ng Premium Edition to create distributed system logging architectures. Copyright 1996-2011 BalaBit
More informationSyslog Collection Cartridge Pack User Guide Release 6.0
[1]Oracle Communications Offline Mediation Controller Syslog Collection Cartridge Pack User Guide Release 6.0 E36382-01 June 2015 Oracle Communications Offline Mediation Controller Syslog Collection Cartridge
More informationLogging and Log Analysis - The Essential. kamal hilmi othman NISER
Logging and Log Analysis - The Essential kamal hilmi othman NISER Series 1. Logging and Log Analysis - The Essential 2. TCP/IP - Packet Analysis 3. Network Security Monitoring - Using Snort 4. Honeypot
More informationSSL VPN. Virtual Appliance Installation Guide. Virtual Private Networks
SSL VPN Virtual Appliance Installation Guide Virtual Private Networks C ONTENTS Introduction... 2 Installing the Virtual Appliance... 2 Configuring Appliance Operating System Settings... 3 Setting up the
More informationSecurity Correlation Server Quick Installation Guide
orrelogtm Security Correlation Server Quick Installation Guide This guide provides brief information on how to install the CorreLog Server system on a Microsoft Windows platform. This information can also
More informationEventSentry Overview. Part I About This Guide 1. Part II Overview 2. Part III Installation & Deployment 4. Part IV Monitoring Architecture 13
Contents I Part I About This Guide 1 Part II Overview 2 Part III Installation & Deployment 4 1 Installation... with Setup 5 2 Management... Console 6 3 Configuration... 7 4 Remote... Update 10 Part IV
More informationLog Management with Open-Source Tools. Risto Vaarandi SEB Estonia
Log Management with Open-Source Tools Risto Vaarandi SEB Estonia Outline Why use open source tools for log management? Widely used logging protocols and recently introduced new standards Open-source syslog
More informationFILECLOUD HIGH AVAILABILITY
FILECLOUD HIGH AVAILABILITY ARCHITECTURE VERSION 1.0 FileCloud HA Architecture... 2 Load Balancers... 3 FileCloud Component: App server node... 3 FileCloud Component: Mongo DB Replica set... 3 Instructions
More informationOracle Database Firewall
Oracle Database Firewall Administration Guide Release 5.1 E22686-04 May 2012 Oracle Database Firewall Administration Guide Release 5.1 E22686-04 Copyright 2003, 2012, Oracle and/or its affiliates. All
More informationSecret Server Splunk Integration Guide
Secret Server Splunk Integration Guide Table of Contents Meeting Information Security Compliance Mandates: Secret Server and Splunk SIEM Integration and Configuration... 1 The Secret Server Approach to
More informationConfiguring System Message Logging
CHAPTER 5 This chapter describes how to configure system message logging on Cisco NX-OS devices. This chapter includes the following sections: Information About System Message Logging, page 5-1 Licensing
More informationConfiguring Logging. Information About Logging CHAPTER
52 CHAPTER This chapter describes how to configure and manage logs for the ASASM/ASASM and includes the following sections: Information About Logging, page 52-1 Licensing Requirements for Logging, page
More informationNative SSL support was implemented in HAProxy 1.5.x, which was released as a stable version in June 2014.
Introduction HAProxy, which stands for High Availability Proxy, is a popular open source software TCP/HTTP Load Balancer and proxying solution which can be run on Linux, Solaris, and FreeBSD. Its most
More informationDetermine the process of extracting monitoring information in Sun ONE Application Server
Table of Contents AboutMonitoring1 Sun ONE Application Server 7 Statistics 2 What Can Be Monitored? 2 Extracting Monitored Information. 3 SNMPMonitoring..3 Quality of Service 4 Setting QoS Parameters..
More informationPassive Logging. Intrusion Detection System (IDS): Software that automates this process
Passive Logging Intrusion Detection: Monitor events, analyze for signs of incidents Look for violations or imminent violations of security policies accepted use policies standard security practices Intrusion
More informationURL: http://crosswire.org/~jmarsden/talks/hardening-ubuntu/hardening-ubuntu.html
Hardening Ubuntu Date: 12 Mar 2011 Author: Jonathan Marsden jmarsden@fastmail.fm URL: http://crosswire.org/~jmarsden/talks/hardening-ubuntu/hardening-ubuntu.html Contents Introduction The BASICS (the bare
More informationWeb Server using Apache. Heng Sovannarith heng_sovannarith@yahoo.com
Web Server using Apache Heng Sovannarith heng_sovannarith@yahoo.com Introduction The term web server can refer to either the hardware (the computer) or the software (the computer application) that helps
More informationLinux System Administration on Red Hat
Linux System Administration on Red Hat Kenneth Ingham September 29, 2009 1 Course overview This class is for people who are familiar with Linux or Unix systems as a user (i.e., they know file manipulation,
More informationLAMP Quickstart for Red Hat Enterprise Linux 4
LAMP Quickstart for Red Hat Enterprise Linux 4 Dave Jaffe Dell Enterprise Marketing December 2005 Introduction A very common way to build web applications with a database backend is called a LAMP Stack,
More informationDeploy the ExtraHop Discover Appliance with Hyper-V
Deploy the ExtraHop Discover Appliance with Hyper-V 2016 ExtraHop Networks, Inc. All rights reserved. This manual, in whole or in part, may not be reproduced, translated, or reduced to any machine-readable
More informationSecurity Correlation Server Quick Installation Guide
orrelog Security Correlation Server Quick Installation Guide This guide provides brief information on how to install the CorreLog Server system on a Microsoft Windows platform. This information can also
More informationCA VM:Operator r3. Product Overview. Business Value. Delivery Approach
PRODUCT SHEET: CA VM:OPERATOR CA VM:Operator r3 CA VM:Operator is an automated console message management system for z/vm and mainframe Linux environments. It allows you to minimize human intervention
More informationHow To Set Up A Network Map In Linux On A Ubuntu 2.5 (Amd64) On A Raspberry Mobi) On An Ubuntu 3.5.2 (Amd66) On Ubuntu 4.5 On A Windows Box
CSC-NETLAB Packet filtering with Iptables Group Nr Name1 Name2 Name3 Date Instructor s Signature Table of Contents 1 Goals...2 2 Introduction...3 3 Getting started...3 4 Connecting to the virtual hosts...3
More informationBF2CC Daemon Linux Installation Guide
BF2CC Daemon Linux Installation Guide Battlefield 2 + BF2CC Installation Guide (Linux) 1 Table of contents 1. Introduction... 3 2. Opening ports in your firewall... 4 3. Creating a new user account...
More informationSimplified Forwarder Deployment and Deployment Server Techniques
Copyright 2015 Splunk Inc. Simplified Forwarder Deployment and Deployment Server Techniques Cary Pe;erborg Sr. Monitoring Eng., LDS Church Disclaimer During the course of this presentalon, we may make
More information