Server Auditing

[controlfreak]

I have a customer who I have setup auditing for anyone who deletes a file in a file share (have a problem with people deleting files accidentally apparently) on the server by enabling object access in group policy and within the security properties of the shared folder for deletion of sub folders and files.

The problem I have is when this is enabled the event log gets full quick making it difficult to manage these logs.

Is there any third party software that can perform this job better or at least pull out file system delete events and save them elsewhere? or perhaps you know a better way to do this?

 

[NETWizz]

Just tell it to save the logs longer and search through more records.

Also, adjust the permissions to help prevent this. This kind of problem normally means the NTFS permissions are wrong.


**************************************

How we do it:

1. Keep a minimal number of ACLs (Access Control Lists) on folders leaving inheritance turned on... we always give rights via AD Group, and we never use Deny.

2. To give rights to all users, use "Domain Users," to give rights to all Computers, use "Domain Computers," and to give rights to all users and computers use "Authenticated Users." NEVER use "Everyone." The problem with "EVERYONE" is that the users/computers do not even have to be authenticated against the domain.

3. In order to map a drive you need these two permissions (and only on the folder you wish to map):

4. Active Directory likes to give users "Full Control" in NTFS permissions to such places as their Home Directory... so do other admins. What you don't want is to give people "Take Ownership" or "Change Permissions" even on their own stuff, or somebody WILL create you a security problem.

What's Interesting is that "Full Control" (in NTFS) WITH THE "Change" + "Read" (Share Permissions) will NOT allow them to change permissions or take ownership (though they probably already own their home directory).

Like This for Share Permissions:

*You can make your own Active Directory group for "Server Admins" or something like that and assign them "Full Control," so they can change permissions while your other users cannot.


5. Turn on Shadow Copies... here is a server I did a couple of days ago... This will help you get deleted stuff back:

You can "open" and pull stuff out, "copy" the restore elsewhere, or "Restore" to totally revert.
This is what shadow copies looks like on the client:

On Windows Vista & Later (i.e. 7), you have native support. With Windows XP, you need to install the "Shadow Copy Client"; here it is:
http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=16220 (You can push it out)


6. Last but not least, let's say you secure a location and you have separate shared locations for Teachers, Students, Human Resources Development...

Obviously, the default behavior is to allow everybody to see the beginning folders for the other areas but then give an "Access Denied" message when they double-click that folder. That is typically fine, but you will sometimes have a teacher or staff member who wants access to some other location and asks only because they see a place they don't have access to and get "Access Denied." The solution is ABE (Access Baed Enumeration):

Looking on a 2008 R2 Server...
Server Manager > Roles > File Services > Share and Storage Management > Properties (of the share) > Advanced (button):

I have more users and don't have this problem in the first place.


I hope this all helps a little bit... most people have things way too open. Sure, to run an application from the network, the user most likely needs Read & Execute to the location with executable files and Full-Control to any location with a database or data-files... Hence, you kind of have to give users the rights to destroy data.

 

[controlfreak]

Thanks for that quite a bit of information to rummage through yeah I always make a habit of using inheritance and avoid using the everyone group due to security reasons but enabling auditing on file system seem too cumbersome as the amount of logs that come with it to find if someone accidently deletes something seems unreasonable. I am hoping to be more specific but I will have a read through what you posted and see if I can't improve on my permissions and change max log size.

Thanks again for your extensive reply

 

[NETWizz]

List Folder/Read Data & Read Attributes are required to MAP a network drive to the location. Hence, I go ahead and grant those permissions to the root of where I am going to map a drive.

That is the ONE thing I set to "Apply to this folder only."


Authenticated Users is ONLY better than Everyone because at least it doesn't mean: outside contractors, neighbors, and people who plug into the network from the outside... By the way, I have a special VLAN for them

 

[dbdawn]

Authenticated Users is ONLY better than Everyone because at least it doesn't mean: outside contractors, neighbors, and people who plug into the network from the outside... By the way, I have a special VLAN for them

How do you have your network access control setup? Do you only have certain ports that they can plug into which are on that VLAN, or do you have a specific software or hardware solution?

 

[NETWizz]

How do you have your network access control setup? Do you only have certain ports that they can plug into which are on that VLAN, or do you have a specific software or hardware solution?

I enabled 802.1X authentication on ALL the computers and on the switches.

Background: My sites are connected together via WAN links. Each site is its own Subnet & its own VLAN. My core-switch routes all these VLANs together and routes the traffic between them.

The Guest VLAN is isolated in that it is NOT routed to/from any of the other VLANS.

I have a Couple Windows 2008 R2 Network Policy Servers (NPS) running RADIUS against Active Directory. The computers themselves logon to Active Directory AND authenticate via 802.1x if they are our computers (joined to our domain)... That connects them to their VLAN. When a user logs on, he or she is also authenticated via 802.1x.

If a rogue device (i.e. an outside computer) gets plugged into our network, it will NOT be able to authenticate its computer account in Active Directory via RADIUS by way of 802.1x. Any one of our 237 network switches that it is plugged into will stick that device in a separated (isolated guest) VLAN automatically.



The Guest VLAN allows:
1. Access to certain printers for use by outside contractors
2. Access to the Internet (unfiltered for content)
3. Access to PXE Boot & Scripted Installs of Operating Systems (i.e. If one of our machines is broken it won't be able to authenticate to its own VLAN).
4. Access to be able to Join our Domain. (This facility has to be allowed to get computers to authenticate).
5. Monitored by IPS (Intrusion Protection System). If failure occurs, network port computer is connected to goes into blocking mode until the link is re-established or 24 hours.


The Regular VLANS:
1. Printing to their site printers (they can't see other site printers)
2. Servers, Other Computers regardless of VLAN/Site
3. Lightly filtered Internet
4. No rights to the management IP addresses of Switches
5. No ability to get into iSCSI or the back-end of the SANs
6. No Ability to get into VMWare Management of ESX
7. Cannot see Guest VLAN
8. Cannot see IT/Managmeent VLAN
8. Monitored by IPS (Intrusion protection System... If failure occurs, drops computer to the Guest VLAN).

Management VLAN (for IT):
1. Any printers, servers, computers regardless of VLAN
2. Lightly Filtered Internet with a button to override any blocked content.
3. Can manage VMWare, Switches, Network Devices
4. Can see ALL VLANs
5. Can even connect to the iSCSI VLAN of the SANs
6. Can Manage VMWare
7. Intrusion Protection System does logging only.


iSCSI VLAN (for SAN):
1. Connects the VMWAre Physical Hosts to the LUNs on the SANs
2. ALL data to storage/from storage in vCenter goes from/to the SAN via iSCSI
3. Prevents anyone with an iSCSI client from being able to attempt to connect to iSCSI. Without this VLAN, with proper credentials, you could mount a drive via the built-in iSCSI client.


OUTSIDE VLAN:
1. This VLAN is connected directly to totally unfiltered Internet. There is no firewall at all. In fact, you could ping it from home (if I assigned it an IP address).

Our Firewall, a Cisco ASA, has an INSIDE and an OUTSIDE port. Most people connect the inside to their switch and the outside to the Internet and call it good.

What I did is connect the ASA INSIDE to the switch, and I connected the ASA OUTSIDE to this special VLAN that is totally isolated even from the IT VLAN. Another port on this OUTSIDE VLAN actually does go to the outside world. If I ever want to assign to the outside VLAN (I never have), they would be connected directly to the Internet without the firewall. They would not be able to access anything at all except the Internet. In fact, they would be given an Internet IP to Gigabit Internet. Yeah, that's 1000 mbps to the Intenet.

 

[dbdawn]

Thanks for taking the time to explain in detail how you have your network setup!

 

[NETWizz]

I just finished changing the Folder Redirection policies & setting up our DFS (Distributed File System) root & Server 2008 R2 Fail-Over clustering.

All of our File-Servers are now also in VMWare ESX too...

Of course, our users never knew it happened, which is the sign of great success. I can now, migrate any of the Virtual File Servers to any ESX host with VMotion without interrupting any transfers!

I can migrate any Virtual Server to a different LUN on the same or different SAN with SVMotion... i.e. I can change the storage location of an entire server...

I can reboot either virtual server & the fail-over clustering will keep things right in the world!

 

[teksquad]

Yeah we have our ESX servers running all our exchange roles and a few other vm's. Will be moving citrix over to a vm as well.

If your ESX servers support it, I highly recommend enabling the ILO ports (Integrated Lights Out) ILO has saved me a few times if the esx servers wouldn't respond. Saved me a few trips to our colo on a weekend.

 

[NETWizz]

Yeah we have our ESX servers running all our exchange roles and a few other vm's. Will be moving citrix over to a vm as well.

If your ESX servers support it, I highly recommend enabling the ILO ports (Integrated Lights Out) ILO has saved me a few times if the esx servers wouldn't respond. Saved me a few trips to our colo on a weekend.

They are all Dell Blades, so they have the DRAC built into the chassis. Yeah, it is configured..., but unless you have an actual ESX Kernel Panic though, there should be no reason to need that.

Restarting a stuck VM can be easily done via VCenter. I currently have 6 (of 8) blades. Four (4) of them have 48 GB of RAM and run at most 12 Guests each. The last two have 96 GB of RAM, which IS enough to support about 24 Guests each. Just figure you can load about 3 to 5 Guests per CPU core... This means 24 is comfortable, 32 is fully loaded, and 40 is asking for trouble.

I have the capacity to run 96 Virtual Servers... I am running half that many. VCenter reports it can fail-over up to two (2) blades and Vmotion the guests off. Should something go wrong with a blade i.e. Kernel Panic OR hardware problem, High Availability or Fault Tolerance will take over. I won't need to go to my Data Center on the weekend.

I can also loose one (1) of two (2) Fiber Channel (Fabric Connect) switches. I can loose one (1) of two (2) HP EVA (Enterprise Virtual Array) Controllers (the SAN Brains), and I can loose any 1 of my 3 Drive shelves (I have leveling turned on). Each shelf can loose up to four (4) drives. I can loose one (1) of two (2) of the 48KV APC UPSes...

I won't be going in on the weekend.

 

[basic]

Depending on what these files are, have you considered source control? If there enough users and shared documents I'd recommend something like SharePoint with its document version control. Mercurial, Subversion, Git might be able to do the trick and are free.

 

[NETWizz]

Depending on what these files are, have you considered source control? If there enough users and shared documents I'd recommend something like SharePoint with its document version control. Mercurial, Subversion, Git might be able to do the trick and are free.

We do run SharePoint 2010.

As for source control of File Shares, Shadow Copy is enabled, and everything is backed up with Data Protection Manager. Heck, even the SAN has snapshots.

 

[basic]

We do run SharePoint 2010.

As for source control of File Shares, Shadow Copy is enabled, and everything is backed up with Data Protection Manager. Heck, even the SAN has snapshots.

The post was meant for OP, but that's a good set up if it accomplishes what you need. I just thought he might need a mechanism to prevent/manage concurrent access, merge capability, track changes, revert, undo specific activities, etc.