I have a Linux server equipped with some security apparatus to prevent unauthorized access. Hopefully, this will prevent intrusions, but the possibility always exists.
Naturally I keep logs so that if I am compromised, I will at least know and can try to contain the damage. However, a clever intruder will also modify these logs.
However, if the logs are recorded to a medium that does not allow modification, the attacker has only a few moments after the intrusion to stop the logging mechanism, otherwise their IP will be irreversibly recorded. How can I set up such an irreversible log mechanism?
One simple solution I can see would be to have a script constantly copy every relevant log entry to pastebin. Unless the intruder compromises both me and the pastebin, the moment I check the pastebin log I will know something's up. That said, I'd like to avoid supplying pastebin with a detailed log of my activities.
Another possibility would be to send an SMS to my phone every time a new IP connects. This strategy is safe so long as my phone is not compromised also. It does have the same problem giving the cell company a log of my activity, and it also seems a bit inconvenient.
A third example: Set up a physical printer and have log entries be also printed out as soon as they are generated. Unless the attacker can come to the printer, steal the print out and replace it with a fake version, this will be safe. However, it's a bit costly, and I would have to then enter IPs by hand into a computer to check them.