| 1 | # Forward Secure Sealing (FSS) in Systemd-Journal |
| 2 | |
| 3 | Forward Secure Sealing (FSS) is a feature in the systemd journal designed to detect log file tampering. |
| 4 | Given that attackers often try to hide their actions by modifying or deleting log file entries, |
| 5 | FSS provides administrators with a mechanism to identify any such unauthorized alterations. |
| 6 | |
| 7 | ## Importance |
| 8 | |
| 9 | Logs are a crucial component of system monitoring and auditing. Ensuring their integrity means administrators can trust |
| 10 | the data, detect potential breaches, and trace actions back to their origins. Traditional methods to maintain this |
| 11 | integrity involve writing logs to external systems or printing them out. While these methods are effective, they are |
| 12 | not foolproof. FSS offers a more streamlined approach, allowing for log verification directly on the local system. |
| 13 | |
| 14 | ## How FSS Works |
| 15 | |
| 16 | FSS operates by "sealing" binary logs at regular intervals. This seal is a cryptographic operation, ensuring that any |
| 17 | tampering with the logs prior to the sealing can be detected. If an attacker modifies logs before they are sealed, |
| 18 | these changes become a permanent part of the sealed record, highlighting any malicious activity. |
| 19 | |
| 20 | The technology behind FSS is based on "Forward Secure Pseudo Random Generators" (FSPRG), a concept stemming from |
| 21 | academic research. |
| 22 | |
| 23 | Two keys are central to FSS: |
| 24 | |
| 25 | - **Sealing Key**: Kept on the system, used to seal the logs. |
| 26 | - **Verification Key**: Stored securely off-system, used to verify the sealed logs. |
| 27 | |
| 28 | Every so often, the sealing key is regenerated in a non-reversible process, ensuring that old keys are obsolete and the |
| 29 | latest logs are sealed with a fresh key. The off-site verification key can regenerate any past sealing key, allowing |
| 30 | administrators to verify older seals. If logs are tampered with, verification will fail, alerting administrators to the |
| 31 | breach. |
| 32 | |
| 33 | ## Enabling FSS |
| 34 | |
| 35 | To enable FSS, use the following command: |
| 36 | |
| 37 | ```bash |
| 38 | journalctl --setup-keys |
| 39 | ``` |
| 40 | |
| 41 | By default, systemd will seal the logs every 15 minutes. However, this interval can be adjusted using a flag during key |
| 42 | generation. For example, to seal logs every 10 seconds: |
| 43 | |
| 44 | ```bash |
| 45 | journalctl --setup-keys --interval=10s |
| 46 | ``` |
| 47 | |
| 48 | ## Verifying Journals |
| 49 | |
| 50 | After enabling FSS, you can verify the integrity of your logs using the verification key: |
| 51 | |
| 52 | ```bash |
| 53 | journalctl --verify |
| 54 | ``` |
| 55 | |
| 56 | If any discrepancies are found, you'll be alerted, indicating potential tampering. |
| 57 | |
| 58 | ## Disabling FSS |
| 59 | |
| 60 | Should you wish to disable FSS: |
| 61 | |
| 62 | **Delete the Sealing Key**: This stops new log entries from being sealed. |
| 63 | |
| 64 | ```bash |
| 65 | journalctl --rotate |
| 66 | ``` |
| 67 | |
| 68 | **Rotate and Prune the Journals**: This will start a new unsealed journal and can remove old sealed journals. |
| 69 | |
| 70 | ```bash |
| 71 | journalctl --vacuum-time=1s |
| 72 | ``` |
| 73 | |
| 74 | **Adjust Systemd Configuration (Optional)**: If you've made changes to facilitate FSS in `/etc/systemd/journald.conf`, |
| 75 | consider reverting or adjusting those. Restart the systemd-journald service afterward: |
| 76 | |
| 77 | ```bash |
| 78 | systemctl restart systemd-journald |
| 79 | ``` |
| 80 | |
| 81 | ## Conclusion |
| 82 | |
| 83 | FSS is a significant advancement in maintaining log integrity. While not a replacement for all traditional integrity |
| 84 | methods, it offers a valuable tool in the battle against unauthorized log tampering. By integrating FSS into your log |
| 85 | management strategy, you ensure a more transparent, reliable, and tamper-evident logging system. |