Security concern??

[AndyE45]

I recently saw the following entries in a Tripwire report from one of our servers:

Added object name: C:\Winnt\security\edb.chk
Added object name: C:\Winnt\security\edb.log
Added object name: C:\Winnt\security\edb00001.log
Added object name: C:\Winnt\security\res1.log
Added object name: C:\Winnt\security\res2.log

I know that these files are bound to change but this indicates that they are newly created files which doesn't make sense for a server that's been up for over a year.

I haven't been able to find anything on this, can anybody shed any light on this? Has somebody tried to hack the system and tried to hide their tracks or is this expected behaviour?

 

[sioxley]

These file look like they're part of an Exchange email database so they'd get altered everytime Exchange is started. I think that might explain what's going on.

Assuming you have Exchange setup I wouldn't be to concerned

 

[AndyE45]

Sioxley,

Thanks for the input but Exchange is definitely not loaded on this server.

I believe these are data files for the local security database, no doubt using JET much as Exchange does. I expect to see them change constantly but I don't expect to see the wholesale change that seems to be indicated.

 

[sioxley]

Hi Andye45

You're right. I should've read your post a bit better. Exchange logs definitely wouldn't be kept in the winnt\security folder.

I still don't think I'd be too concerned tho. Maybe someone else can shed some light on this??

 

[Marcs41]

Would you not contact Tripwire on this, as it is THEIR software report!

Marc
_{If 'something' 'somewhere' gives 'some' error, expect random guesses or no replies at all. Please specify details.
Free Tip: The F1 Key does NOT destroy your PC!}
How Do I Get Great Answers To my Tek-Tips Questions? See faq222-2244

 

[AndyE45]

Marcs41,

I did indeed contact them as I have before and I get the same answer. They're great at working with the functionality of their own software but they can't really tell you what the reports mean. They think that's for Microsoft to tell you.

 

[Marcs41]

Really?
Are they telling you that Microsoft should explain a Tripwire Report?
Jee, what a crap service!
And you payed them? I would complain, A LOT !

Marc
_{If 'something' 'somewhere' gives 'some' error, expect random guesses or no replies at all. Please specify details.
Free Tip: The F1 Key does NOT destroy your PC!}
How Do I Get Great Answers To my Tek-Tips Questions? See faq222-2244

 

[AndyE45]

According to their support people their software is meant to detect changes, not to decipher what they mean.

I'm in complete agreement with you. They should be providing a complete service, they should be able to tell me what changes mean.

 

[Marcs41]

Well, some change in your AD was logged, maybe the date stamp reminds you about such a change?

What I did read somewhere was to exclude that directory from capturing changes.


Marc
_{If 'something' 'somewhere' gives 'some' error, expect random guesses or no replies at all. Please specify details.
Free Tip: The F1 Key does NOT destroy your PC!}
How Do I Get Great Answers To my Tek-Tips Questions? See faq222-2244

 

[AndyE45]

Marc,

I see daily notifications that these files have changed - no surprise there. What I'm concerned about is that I've never seen all these files changed over at once like this in the year+ since this server has been up. It's almost as if somebody deleted the existing files and the system then created new ones - is somebody trying to hide their tracks? This is a standalone server out in one of our DMZ's that is normally fairly quiet. The only thing that happened around that time is that we added the terminal server service onto the box. I wouldn't think that would cause this change but then again you never know.

I haven't noticed any other unusual activity on this box but I can't find any reference anywhere to suggest what I've seen is normal.

Ah well, I'll have to keep looking.

Thanks for your input.

 

[Marcs41]

Sorry I cannot provide more info, there is nothing to find about it, just a few people asking the same question, since 2002 already, without an answer.

Marc
_{If 'something' 'somewhere' gives 'some' error, expect random guesses or no replies at all. Please specify details.
Free Tip: The F1 Key does NOT destroy your PC!}
How Do I Get Great Answers To my Tek-Tips Questions? See faq222-2244