Re: More systemdCrap

On 3/11/25 15:59, John Ames wrote:

On Tue, 11 Mar 2025 15:50:25 +0000
Pancho <Pancho.Jones@protonmail.com> wrote:
 

Carlos has already suggested that there might be a method to
cryptographically sign the logs, making alterations very difficult,
even to a privileged user.

 Perhaps there is - but, as has already been pointed out, if journalctl
can delete records by date, it is certainly *possible* to delete
records by source. Any encryption that does not prevent the former
cannot prevent the latter.
 

Yes cryptography doesn't stop you deleting records, it does allow people to see when records have been deleted. When there is data missing, data they would expect to see.
Throwing a hand grenade in the server would "delete" records, but it would leave traces of evidence that something suspicious had occurred. Evidence that the server should no longer be relied upon.