Re: Journald's qualities

From	Mariusz Gronczewski <xani@devrandom.pl>
Newsgroups	linux.debian.user
Subject	Re: Journald's qualities
Date	2024-02-24 11:00 +0100
Message-ID	<IaWZ3-chpY-13@gated-at.bofh.it> (permalink)
References	(4 earlier) <IaFER-c6mj-3@gated-at.bofh.it> <IaHnk-c7s9-7@gated-at.bofh.it> <IaKuR-c9na-9@gated-at.bofh.it> <IaNVL-cbMl-1@gated-at.bofh.it> <IaRwl-ce7z-9@gated-at.bofh.it>
Organization	Devrandom.pl

Show all headers | View raw

Dnia 2024-02-23, o godz. 23:02:49
Jeffrey Walton <noloader@gmail.com> napisał(a):

> 
> Systemd also provides tamper-resistant logs. The property is often
> desirable in the enterprise. See Forward Secure Sealing,
> <https://lwn.net/Articles/512895/>.
> 
> Jeff
> 

I had mentioned that feature. I haven't it seen in a wild or as an
requirement, ever, and we work with few of the local banks deploying
apps on their infrastructure.

It's *basically* always "send the logs to audit server". rm -rf
/var/log does not care about tamper proofing either.

IMO it's a feature that should be a separate plugin that the people
that need it can just load and use. There is no reason to have it in
default logging format or carry the burden of code for it in core.

Now, tamper-proof *wire* format, that could be useful (if enough other
software supported it). Rsyslog have RELP
(https://en.wikipedia.org/wiki/Reliable_Event_Logging_Protocol) that we
use as it fix few of the issues with sending logs via TCP/TLS
(interrupted connection can lose up to buffer's worth of logs), having
on top of that information "hey, some of the blocks of that log were
lost before being sent" would be useful. For that all it would be
needed is to FSS send queue of logger (which wouldn't be queried so it
could be nice and compressed), not entire on-disk format. 

Then again journald can't even send(AFAIK) using normal syslog protocol
as author decided to XKCD#927 that too...

-- 
Mariusz Gronczewski (XANi) <xani666@gmail.com>
GnuPG: 0xEA8ACE64
https://devrandom.eu

Thread

Selective rotation of journald logs Nicolas George <george@nsup.org> - 2024-02-23 11:20 +0100
  Re: Selective rotation of journald logs Mariusz Gronczewski <xani@devrandom.pl> - 2024-02-23 12:50 +0100
    Re: Selective rotation of journald logs Nicolas George <george@nsup.org> - 2024-02-23 13:10 +0100
      Re: Selective rotation of journald logs Mariusz Gronczewski <xani@devrandom.pl> - 2024-02-23 13:50 +0100
        Re: Selective rotation of journald logs Nicolas George <george@nsup.org> - 2024-02-23 13:50 +0100
          Re: Selective rotation of journald logs Greg Wooledge <greg@wooledge.org> - 2024-02-23 14:00 +0100
            Re: Selective rotation of journald logs Nicolas George <george@nsup.org> - 2024-02-23 14:10 +0100
              Re: Selective rotation of journald logs Greg Wooledge <greg@wooledge.org> - 2024-02-23 14:10 +0100
                Re: Selective rotation of journald logs Nicolas George <george@nsup.org> - 2024-02-23 14:20 +0100
                Re: Selective rotation of journald logs Mariusz Gronczewski <xani@devrandom.pl> - 2024-02-23 14:30 +0100
              Re: Selective rotation of journald logs Mariusz Gronczewski <xani@devrandom.pl> - 2024-02-23 14:20 +0100
                Re: Selective rotation of journald logs Nicolas George <george@nsup.org> - 2024-02-23 14:30 +0100
                Re: Selective rotation of journald logs Mariusz Gronczewski <xani@devrandom.pl> - 2024-02-23 14:40 +0100
          Re: Selective rotation of journald logs Mariusz Gronczewski <xani@devrandom.pl> - 2024-02-23 14:10 +0100
        Journald's qualities (was: Selective rotation of journald logs) Stefan Monnier <monnier@iro.umontreal.ca> - 2024-02-23 16:30 +0100
          Re: Journald's qualities (was: Selective rotation of journald logs) Mariusz Gronczewski <xani@devrandom.pl> - 2024-02-23 18:20 +0100
            Re: Journald's qualities Stefan Monnier <monnier@iro.umontreal.ca> - 2024-02-23 21:40 +0100
              Re: Journald's qualities The Wanderer <wanderer@fastmail.fm> - 2024-02-24 01:20 +0100
                Re: Journald's qualities Jeffrey Walton <noloader@gmail.com> - 2024-02-24 05:10 +0100
                Re: Journald's qualities Mariusz Gronczewski <xani@devrandom.pl> - 2024-02-24 11:00 +0100
                Re: Journald's qualities Stefan Monnier <monnier@iro.umontreal.ca> - 2024-02-24 05:20 +0100
          Re: Journald's qualities (was: Selective rotation of journald logs) Dan Ritter <dsr@randomstring.org> - 2024-02-23 19:00 +0100
            Re: Journald's qualities Stefan Monnier <monnier@iro.umontreal.ca> - 2024-02-23 21:50 +0100
            Re: Journald's qualities (was: Selective rotation of journald logs) Nicholas Geovanis <nickgeovanis@gmail.com> - 2024-02-23 22:10 +0100
              Re: Journald's qualities (was: Selective rotation of journald logs) Mariusz Gronczewski <xani@devrandom.pl> - 2024-02-24 11:10 +0100
            Re: Journald's qualities (was: Selective rotation of journald logs) Mariusz Gronczewski <xani@devrandom.pl> - 2024-02-24 10:40 +0100
              Re: Journald's qualities Anssi Saari <anssi.saari@debian-user.mail.kapsi.fi> - 2024-02-26 12:20 +0100
                Re: Journald's qualities Mariusz Gronczewski <xani@devrandom.pl> - 2024-02-26 12:40 +0100
                Re: Journald's qualities Jeffrey Walton <noloader@gmail.com> - 2024-02-26 17:10 +0100
                Re: Journald's qualities Anssi Saari <anssi.saari@debian-user.mail.kapsi.fi> - 2024-02-27 10:50 +0100
  Re: Selective rotation of journald logs Max Nikulin <manikulin@gmail.com> - 2024-02-23 16:40 +0100
    Re: Selective rotation of journald logs Max Nikulin <manikulin@gmail.com> - 2024-02-25 04:00 +0100
    Re: Selective rotation of journald logs Nicolas George <george@nsup.org> - 2024-02-26 15:50 +0100

csiph-web