3

I have a Linux server equipped with some security apparatus to prevent unauthorized access. Hopefully, this will prevent intrusions, but the possibility always exists.

Naturally I keep logs so that if I am compromised, I will at least know and can try to contain the damage. However, a clever intruder will also modify these logs.

However, if the logs are recorded to a medium that does not allow modification, the attacker has only a few moments after the intrusion to stop the logging mechanism, otherwise their IP will be irreversibly recorded. How can I set up such an irreversible log mechanism?

One simple solution I can see would be to have a script constantly copy every relevant log entry to pastebin. Unless the intruder compromises both me and the pastebin, the moment I check the pastebin log I will know something's up. That said, I'd like to avoid supplying pastebin with a detailed log of my activities.

Another possibility would be to send an SMS to my phone every time a new IP connects. This strategy is safe so long as my phone is not compromised also. It does have the same problem giving the cell company a log of my activity, and it also seems a bit inconvenient.

A third example: Set up a physical printer and have log entries be also printed out as soon as they are generated. Unless the attacker can come to the printer, steal the print out and replace it with a fake version, this will be safe. However, it's a bit costly, and I would have to then enter IPs by hand into a computer to check them.

  • 1
    Sounds like you need a SIEM. – k1DBLITZ Apr 21 '15 at 13:22
  • For privacy you can encrypt the IPs before sending them off your system. Just keep a copy of the key on a secured device so the attacker can't clobber it. – Neil Smithline Apr 21 '15 at 15:55
  • 1
    The printer method is certainly a "golden oldie," going back (at least?) to Cliff Stoll in 1986 en.wikipedia.org/wiki/The_Cuckoo%27s_Egg . – dave_thompson_085 Apr 22 '15 at 5:12
  • A printer will not be that useful if the attacker discovers it and floods the logs. – ThoriumBR May 21 '15 at 14:31
  • @ThoriumBR why not ? The attacker will DoS the printer after he connected, so his connection will already be logged and printed. – user42178 May 21 '15 at 16:23
5

To meet this requirement, I think you'll want to look into a dedicated log server.

  • No remote access, not even SSH.
  • Syslog is the only service.
  • Credentials are unique to the logging server.

That's pretty reliable. Depending on your case, it could be anything from a pimped-out, highly reliable commercial chassis to a RaspberryPi hanging on a nail.

0

the only way to really do this is to have a log record that actually "leaves" your system. and the more copies there are the better.

A simple example setup could be: - Main Server with login. - secondary 'Logging' server that receives all Syslog events from the main server (and possibly others) - A separate Mail server. - An external mail server (like gmail or alike)

than you have a script for every time someone connects to your server that email you not only on your own Mail server, but also to your Gmail (or other) mail provider.

If all system log messaged are than also present on another system it will become very hard for the attacker to leave no trace (just stopping the log service should trigger an alert from your logging server and because you mail not only yourself in your own systems but also mailed yourself all the relevant login information (user / IP / time / Machine / Etc.) the attacker has to intercept the mail from a non compromised system. (quite hard to do)

The appropriate place for such a logging function would be the sshrc file that is fired when someone connects BEFORE someone gets a tty or any other output. (its commenly used for stuff like mounting a home drive)

0

You don't have to overthink this problem. If someone is willing to physically change the printout on the on-site printer, it's easy to just steal the computer and go away. Or force shutdown the server, create a image of the disk, backdoor the image, and put it back.

And this is highly improbable, unless you are a very important target, and I think you are not, otherwise you would have a whole team taking care of security, with lots of certifications and so.

In your case, you are target of hackers trying here and there to catch an unprotected server and launch DoS attacks, host C&C servers and so on. Some are sophisticated attackers, but not enough to hack into your cell phone to change the SMS sent by the IDS.

Using an external host as the log server is the best bet here. If you put another host in bridge mode, without IP, you can set a script using pcap to intercept and log data sent from syslog. So the logs will go from the protected server to the remote log server, passing by an invisible server. You will end up with 3 copies of the log.

      Protected server   -------> Bridged server -------> Remote Syslog
        10.20.30.40               NO IP, local             10.20.30.40
                                  console only 

Using a bridged server (and not a common networked server) prevents the attacker of even knowing that you have a backup log server in betweeen. The attacker will know that you have a remote logging server on 10.20.30.40, and probably will try to compromise it, but it will not know you have a bridge in between.

For more security, have the bridge server run OpenBSD, in security mode 2, and configure the log files as append only. The only way to change your logs will be the attacker removing the local logs, compromise the remote syslog and remove the logs there, and discovering the bridged server, restarting OpenBSD in a lower security mode from the local console, and changing the files.

This way you will not depend on any internet service (Pastebin, email, etc), not expensive solutions (print out of logs) or privacy issues (sending SMS).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.