Sujet : Re: More systemdCrap
De : tnp (at) *nospam* invalid.invalid (The Natural Philosopher)
Groupes : comp.os.linux.miscDate : 11. Mar 2025, 20:58:30
Autres entêtes
Organisation : A little, after lunch
Message-ID : <vqq4l7$253eo$2@dont-email.me>
References : 1 2 3 4 5 6 7 8 9 10 11
User-Agent : Mozilla Thunderbird
On 11/03/2025 15:50, Pancho wrote:
On 3/11/25 14:52, The Natural Philosopher wrote:
On 11/03/2025 12:33, David W. Hodgins wrote:
On Tue, 11 Mar 2025 03:58:44 -0400, The Natural Philosopher <tnp@invalid.invalid> wrote:
>
On 10/03/2025 22:28, John Ames wrote:
On Mon, 10 Mar 2025 23:14:19 +0100
"Carlos E.R." <robin_listas@es.invalid> wrote:
>
Nothing is broken, it has been intentionally designed this way
>
Okay, sure - but that design is stupid.
>
Exactly.
>
Journalctl should be able to take the One True Logfile and scan it,
rewriting items to be retained and discarding items to be deleted .
>
In other words make it as easy as possible for an inttruder to cover any trace of their
activities.
>
Great log that would be for determining what an intruder did.
>
Dont you think any intruder would not already have written a journalctl to do exactly that?
Sheesh
>
Carlos has already suggested that there might be a method to cryptographically sign the logs, making alterations very difficult, even to a privileged user.
Since journactl can delete huge chunks it cannot be that secure
Journactl selectivelely erases entries by time stamp, and by size. Why nt by user?
The basic pattern for immutable audit logs is mature due to the requirements of financial systems. Whether systemd have implemented a reliable system or not, I don't know, but they could.
Clearly they haven't since anyone with root access can delete the logs entirely
I mean really. Secure?
Regards, Dave Hodgins
>
-- "First, find out who are the people you can not criticise. They are your oppressors." - George Orwell
More systemdCrap
Re: More systemdCrap