added systemd-journal forward_secure_sealing (#16247)
added forward_secure_sealing
Costa Tsaousis committed
Oct 19, 2023 at 02:43 UTC
b12b7a23145dabffe98f64d3af40e6248c45395b
2 files changed
+82
collectors/systemd-journal.plugin/Makefile.am
+2
@@ -6,6 +6,8 @@ MAINTAINERCLEANFILES = $(srcdir)/Makefile.in
6
dist_noinst_DATA = \
7
README.md \
8
systemd-journal-self-signed-certs.sh \
9
+ forward_secure_sealing.md \
10
+ active_journal_centralization_guide_no_encryption.md \
11
passive_journal_centralization_guide_no_encryption.md \
12
passive_journal_centralization_guide_self_signed_certs.md \
13
$(NULL)
collectors/systemd-journal.plugin/forward_secure_sealing.md
new
+80
@@ -0,0 +1,80 @@
1
+# Forward Secure Sealing (FSS) in Systemd-Journal
2
+
3
+Forward Secure Sealing (FSS) is a feature in the systemd journal designed to detect log file tampering.
4
+Given that attackers often try to hide their actions by modifying or deleting log file entries,
5
+FSS provides administrators with a mechanism to identify any such unauthorized alterations.
6
+
7
+## Importance
8
+Logs are a crucial component of system monitoring and auditing. Ensuring their integrity means administrators can trust
9
+the data, detect potential breaches, and trace actions back to their origins. Traditional methods to maintain this
10
+integrity involve writing logs to external systems or printing them out. While these methods are effective, they are
11
+not foolproof. FSS offers a more streamlined approach, allowing for log verification directly on the local system.
12
+
13
+## How FSS Works
14
+FSS operates by "sealing" binary logs at regular intervals. This seal is a cryptographic operation, ensuring that any
15
+tampering with the logs prior to the sealing can be detected. If an attacker modifies logs before they are sealed,
16
+these changes become a permanent part of the sealed record, highlighting any malicious activity.
17
+
18
+The technology behind FSS is based on "Forward Secure Pseudo Random Generators" (FSPRG), a concept stemming from
19
+academic research.
20
+
21
+Two keys are central to FSS:
22
+
23
+- **Sealing Key**: Kept on the system, used to seal the logs.
24
+- **Verification Key**: Stored securely off-system, used to verify the sealed logs.
25
+
26
+Every so often, the sealing key is regenerated in a non-reversible process, ensuring that old keys are obsolete and the
27
+latest logs are sealed with a fresh key. The off-site verification key can regenerate any past sealing key, allowing
28
+administrators to verify older seals. If logs are tampered with, verification will fail, alerting administrators to the
29
+breach.
30
+
31
+## Enabling FSS
32
+To enable FSS, use the following command:
33
+
34
+```bash
35
+journalctl --setup-keys
36
+```
37
+
38
+By default, systemd will seal the logs every 15 minutes. However, this interval can be adjusted using a flag during key
39
+generation. For example, to seal logs every 10 seconds:
40
+
41
+```bash
42
+journalctl --setup-keys --interval=10s
43
+```
44
+
45
+## Verifying Journals
46
+After enabling FSS, you can verify the integrity of your logs using the verification key:
47
+
48
+```bash
49
+journalctl --verify
50
+```
51
+
52
+If any discrepancies are found, you'll be alerted, indicating potential tampering.
53
+
54
+## Disabling FSS
55
+Should you wish to disable FSS:
56
+
57
+**Delete the Sealing Key**: This stops new log entries from being sealed.
58
+
59
+```bash
60
+journalctl --rotate
61
+```
62
+
63
+**Rotate and Prune the Journals**: This will start a new unsealed journal and can remove old sealed journals.
64
+
65
+```bash
66
+journalctl --vacuum-time=1s
67
+```
68
+
69
+
70
+**Adjust Systemd Configuration (Optional)**: If you've made changes to facilitate FSS in `/etc/systemd/journald.conf`,
71
+consider reverting or adjusting those. Restart the systemd-journald service afterward:
72
+
73
+```bash
74
+systemctl restart systemd-journald
75
+```
76
+
77
+## Conclusion
78
+FSS is a significant advancement in maintaining log integrity. While not a replacement for all traditional integrity
79
+methods, it offers a valuable tool in the battle against unauthorized log tampering. By integrating FSS into your log
80
+management strategy, you ensure a more transparent, reliable, and tamper-evident logging system.