3 ms·

I feel like there should be some way to verify that logs have not been tampered with. For example, including a checksum of the file up until that point on each

I feel like there should be some way to verify that logs have not been tampered with. For example, including a checksum of the file up until that point on each line. Unfortunately they could just be rewritten after the log has changed. The only real solution I can see is a dedicated logging server, giving true write-only or append-only access.

fragmede 12y ago
> The only real solution I can see is a dedicated logging server, giving true write-only or append-only access. Yup. It's not that hard to setup, and while running it in a VM isn't as secure as can be, it's still a step in the right direction.
eeZi 12y ago
systemd's journal does this: https://lwn.net/Articles/512895/ https://lwn.net/Articles/512895/ But only every ~15 minutes or so.
segmondy 12y ago
As far back as the 90's, I remember the log cleaners would only clean what they touched, so say utmp, read the structure and find all the time the user logged in and remove only this records. This one is wiping everything, you will know your logs have been tampered with, you won't have any logs. lol