Secure syslog (432 Views)
Reply
Regular Advisor
coollllllllllll
Posts: 140
Registered: ‎12-28-2012
Message 1 of 7 (432 Views)
Accepted Solution

Secure syslog

Hi ,

 

How can i secure my syslog , apart from permissions.

I want to track if any sysadmin does not tamper with it ?

I s there any software to track the same ?

 

os hpux 11i v2 .

Honored Contributor
Matti_Kurkela
Posts: 6,271
Registered: ‎12-02-2001
Message 2 of 7 (423 Views)

Re: Secure syslog

If "sysadmin" means "someone with root privileges", then the sysadmin can stop or uninstall any tamper-detection software you can install, or edit its files to make it say "nope, nothing has been modified" even if it's not true.

 

I think the only real solution is to send the syslog messages directly to a line printer in a secure location, or to another system that is not accessible by that sysadmin, and have the logs archived there.

 

Such a log archive server should be configured to be as simple as possible (simpler = less things to go wrong), and accessible only to a small group of very trusted people. Even then, it might be wise to lock it down so that two people are needed to make any changes to it. For example, one person might be allowed to know only one half of the root password, and another person might be allowed to know the other half. Then the two people must be together to make changes to the archive system.

MK
Honored Contributor
Patrick Wallek
Posts: 13,776
Registered: ‎06-21-2000
Message 3 of 7 (404 Views)

Re: Secure syslog

Another way to secure syslog messages is to employ a "syslog server" to which you forward syslog  messages from all of your other servers.  The "syslog server" should have very limited access.  This way even if messages are modified in syslog.log an individual server, those messages will still be in the original format on the syslog server.

 

 

Regular Advisor
coollllllllllll
Posts: 140
Registered: ‎12-28-2012
Message 4 of 7 (335 Views)

Re: Secure syslog

Hi ,

 

Is there anything like parity bit which is to be set on syslog.log  , which will ensure there is no tampering .

Acclaimed Contributor
Dennis Handly
Posts: 25,188
Registered: ‎03-06-2006
Message 5 of 7 (331 Views)

Re: Secure syslog

>Is there anything like parity bit which is to be set on syslog.log

 

You mean a digital signature?  Not that I know of.

Honored Contributor
Matti_Kurkela
Posts: 6,271
Registered: ‎12-02-2001
Message 6 of 7 (326 Views)

Re: Secure syslog

Parity bits can protect against data transmission errors, but not against intentional tampering, because it would be too easy to modify the parity bits along with the data.

 

This is the Distributed System Administration Utilities package (DSAU):

https://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=DSAUtilities

 

It contains (among other things) syslog-ng, a replacement syslog daemon, which can use SSL/TLS encryption to protect log messages while transmitting them to a secure location. In addition, it can use a special RELP protocol, which is designed to reveal any tampering of the log datastream.

 

But even the best encryption is useless if you store the logs on the system with a malicious root user.

Remember, root can debug every process: even if the encryption key is protected with a password, s/he can "debug" the process that is encrypting the logs to read the active encryption key directly from the memory of the running process, bypassing the password requirement. Then s/he can encrypt a set of fake logs with the real encryption key, and use that to overwrite the real logs.

MK
Regular Advisor
coollllllllllll
Posts: 140
Registered: ‎12-28-2012
Message 7 of 7 (300 Views)

Re: Secure syslog

Thanks Matti
The opinions expressed above are the personal opinions of the authors, not of HP. By using this site, you accept the Terms of Use and Rules of Participation.