Dnia 2024-02-23, o godz. 23:02:49 Jeffrey Walton <noloa...@gmail.com> napisał(a):
> > Systemd also provides tamper-resistant logs. The property is often > desirable in the enterprise. See Forward Secure Sealing, > <https://lwn.net/Articles/512895/>. > > Jeff > I had mentioned that feature. I haven't it seen in a wild or as an requirement, ever, and we work with few of the local banks deploying apps on their infrastructure. It's *basically* always "send the logs to audit server". rm -rf /var/log does not care about tamper proofing either. IMO it's a feature that should be a separate plugin that the people that need it can just load and use. There is no reason to have it in default logging format or carry the burden of code for it in core. Now, tamper-proof *wire* format, that could be useful (if enough other software supported it). Rsyslog have RELP (https://en.wikipedia.org/wiki/Reliable_Event_Logging_Protocol) that we use as it fix few of the issues with sending logs via TCP/TLS (interrupted connection can lose up to buffer's worth of logs), having on top of that information "hey, some of the blocks of that log were lost before being sent" would be useful. For that all it would be needed is to FSS send queue of logger (which wouldn't be queried so it could be nice and compressed), not entire on-disk format. Then again journald can't even send(AFAIK) using normal syslog protocol as author decided to XKCD#927 that too... -- Mariusz Gronczewski (XANi) <xani...@gmail.com> GnuPG: 0xEA8ACE64 https://devrandom.eu
