Sujet : Re: More systemdCrap
De : nospam (at) *nospam* example.net (D)
Groupes : comp.os.linux.miscDate : 11. Mar 2025, 22:37:42
Autres entêtes
Organisation : i2pn2 (i2pn.org)
Message-ID : <bb6f1591-9a3b-2a5a-cec9-5762f62d0d8f@example.net>
References : 1 2 3 4 5 6 7 8 9 10 11
On Tue, 11 Mar 2025, Pancho wrote:
On 3/11/25 14:52, The Natural Philosopher wrote:
On 11/03/2025 12:33, David W. Hodgins wrote:
On Tue, 11 Mar 2025 03:58:44 -0400, The Natural Philosopher <tnp@invalid.invalid> wrote:
On 10/03/2025 22:28, John Ames wrote:
On Mon, 10 Mar 2025 23:14:19 +0100
"Carlos E.R." <robin_listas@es.invalid> wrote:
Nothing is broken, it has been intentionally designed this way
Okay, sure - but that design is stupid.
Exactly.
Journalctl should be able to take the One True Logfile and scan it,
rewriting items to be retained and discarding items to be deleted .
In other words make it as easy as possible for an inttruder to cover any trace of their
activities.
Great log that would be for determining what an intruder did.
Dont you think any intruder would not already have written a journalctl to do exactly that?
Sheesh
>
Carlos has already suggested that there might be a method to cryptographically sign the logs, making alterations very difficult, even to a privileged user.
>
The basic pattern for immutable audit logs is mature due to the requirements of financial systems. Whether systemd have implemented a reliable system or not, I don't know, but they could.
It is very simple. You write it to WORM storage, or burn it to a disc. That's it. It's not really rocket science.
In military intelligence circles, they work with data diods as well to limit traffic.
>
>
Regards, Dave Hodgins
>
>
More systemdCrap
Re: More systemdCrap