NAME

SYNOPSIS

$(slog --key-file <host key file> --mac-file <MAC file> $RAWMSG)

DESCRIPTION

The main objective of the secure logging module is to provide tamper evident logging, i.e. to adequately protect log records of an information system and to provide a sensor indicating attack attempts. The secure logging module achieves this by authentically encrypting each log record with an individual cryptographic key used only once and protecting the integrity of the whole log archive by a cryptographic authentication code. Each attempt to tamper with either an individual log record or the log archive itself will be immediately detected during log archive verification. Therefore, an attacker can no longer tamper with log records without being detected.

In order to use the log file created by the secure logging module for analysis, the log file must first be decrypted and its integrity verified. This is achieved with a command line utility that is part of the secure logging module and is installed as part of the syslog-ng package. This utility can easily be integrated into the import module of existing analysis environments.

The secure logging environment uses a cryptographic key for encrypting log entries. Each individual log entry is encrypted with its own key which is immediately discarded after successful encryption in order to provide forward integrity. An efficient algorithm generates the key for the next log entry based the key used for encrypting the previous log entry. The resulting chain of keys preserves forward integrity, i.e. a potential attacker cannot deduce the previous key from the current key.

In order to ease log verification and analysis, a sequence number is added to each log entry. This sequence number is also added to the encryption key creating a one-to-one correspondence of the encryption key with the log entry. In order to prevent truncation attacks or deletion of individual log entries, a message authentication code (MAC) is iteratively applied to the complete log archive and stored in a separate file. It is used upon verification to check the integrity of the whole log archive.

Here is an example of three short original log messages that will be sent to a destination with secure logging enabled:

This is a log message
And here comes another log message
This is a log message with a longer text that is processed without any problems                
         

In order to inspect the status of the secure logging environment, one can check the sequence counter by querying the key file with the slogkey utility like this:

user@host:~> slogkey --counter /etc/syslog-ng/host.key 
counter=3
        

Counting starts at zero. This is why the counter is set to three after processing three messages.

The output of the secure logging template for the three example messages is shown below. One clearly sees the sequence number that was prepended to each message. The colon indicates the end of the sequence number and the start of the original message. As three message were processed, the sequence counter of the key will be three.

AAAAAAAAAAA=:k3/dYpLsgO2tUJKSauo6dycIBzW6OTC3pyA9TP+7AnqFgEojBzgC2rcK4OPfRtr8yg==
AQAAAAAAAAA=:smw0ATISVgN+BYEu5d7OLBE7aQhHpK9Ro4MndmNgSVrqhcmRCBCj6DUnD6ku0Z29CKJ0N6LAJUgByX4Ev+g=
AgAAAAAAAAA=:5UVybnKL1EAbgC4CLfd8HpgurjREf4LEN61/yWHSD2hbXjRD4QmQdtbwguT1chzdItKSQASps9QRIvR5Jd4AHzHfqxI4aRgdUBcNbAq26nwUCg5vPWygjmbtQaxZgCJYkry8slxCigmbTVs=
         

The output of a successful verification run is shown below.

0000000000000000: This is a log message
0000000000000001: And here comes another log message
0000000000000002: This is a log message with a longer text that is processed without any problems
         

The original log messages have been successfully restored. Additionally, the sequence counter is also prepended to the clear text messages. This helps when in analyzing problems with a particular log entry. As real log files will contain thousands of entries. the sequence counter eases identification of erroneous entries.

Before the secure logging module can be used as part of an existing syslog-ng installation, several preparatory activities need to be performed.

KEY GENERATION

The newly created host key k0 has its counter set to 0 indicating that it represents the initial host key k0. This host key k0 must be kept secret and not be disclosed to third parties. It will be required to successfully decrypt and verify log archives processed by the secure logging environment. As each log entry will be encrypted with its own key, a new host key will be created after successful processing of a log entry and will replace the previous key. Therefore, the initial host key needs to be stored in a safe place before starting the secure logging environment, as it will be deleted from the log host after processing of the first log entry. The following steps must be done before starting the secure logging environment. Steps 1 and 2 are performed with the slogkey utility. See slogkey(1) for details on how to generate a master key and to derive a host key from it. Step 3 and 4 depend on the actual deployment in a target environment.

CONFIGURATION

Secure logging is implemented as a template and is configured accordingly. Apart from the actual template configuration, no other settings are required in order to activate secure logging. The secure logging is activated by placing the following statement in the configuration file

template("$(slog --key-file <host key file> --mac-file <MAC file> $RAWMSG)\n");

where

slog

--key-file or -k

--mac-file or -m

$RAWMSG

\n

The secure logging template can be combined with any source or destination within the following limitations:

The following example configuration shows the use of the secure logging template on a file destination.

#############################################################################
# Minimal syslog-ng.conf file with secure logging enabled. Encrypted log
# entries will be logged to a single file called /var/log/messages.slog
#
@version: 3.36
@include "scl.conf"
source s_local {
    system();
    internal();
};
source s_network {
    network(
        transport("udp")
        port(514)
        flags(store-raw-message)
    );
};
# Secure logging template definition
template secure_logging { 
    template("$(slog --key-file /etc/syslog-ng/host.key --mac-file /etc/syslog-ng/mac.dat $RAWMSG)\n");
};
# This configures a secure logging destination
destination d_local {
	file("/var/log/messages.slog" template(secure_logging));
};
log {
    source(s_local);
    # This source has the raw message flag set
    source(s_network);
    # This statement activates secure logging for this destination
    destination(d_local);
};
        

LOG VERIFICATION

FILES

/usr/bin/slogencrypt

/usr/bin/slogverify

/etc/syslog-ng.conf

SEE ALSO

slogkey(1)

slogencrypt(1)

slogverify(1)

AUTHOR

COPYRIGHT

NOTES

1.

The syslog-ng Administrator Guide

2.

syslog-ng mailing list

3.

syslog-ng blogs