It is very important that the information that comes from syslog
not be compromised. Making the files in /var/log
readable and
writable by only a limited number of users is a good start.
Be sure to keep an eye on what gets written there, especially under
the auth
facility. Multiple login failures, for example, can
indicate an attempted break-in.
Where to look for your log file will depend on your distribution. In a
Linux system that conforms to the "Linux Filesystem Standard", such as
Red Hat, you will want to look in /var/log
and check messages
,
mail.log
, and others.
You can find out where your distribution is logging to by looking at
your /etc/syslog.conf
file. This is the file that tells
syslogd
(the system logging daemon) where to log various messages.
You might also want to configure your log-rotating script or daemon to
keep logs around longer so you have time to examine them. Take a look
at the logrotate
package on recent Red Hat distributions. Other
distributions likely have a similar process.
If your log files have been tampered with, see if you can determine when the tampering started, and what sort of things appeared to be tampered with. Are there large periods of time that cannot be accounted for? Checking backup tapes (if you have any) for untampered log files is a good idea.
Intruders typically modify log files in order to cover their tracks, but they should still be checked for strange happenings. You may notice the intruder attempting to gain entrance, or exploit a program in order to obtain the root account. You might see log entries before the intruder has time to modify them.
You should also be sure to separate the auth
facility from other log
data, including attempts to switch users using su
, login attempts,
and other user accounting information.
If possible, configure syslog
to send a copy of the most important
data to a secure system. This will prevent an intruder from covering
his tracks by deleting his login/su/ftp/etc attempts. See the
syslog.conf
man page, and refer to the @
option.
There are several more advanced syslogd
programs out
there. Take a look at http://www.core-sdi.com/ssyslog/ for Secure Syslog. Secure
Syslog allows you to encrypt your syslog entries and make sure no one
has tampered with them.
Another syslogd
with more features is syslog-ng. It allows you a lot more flexibility in your
logging and also can has your remote syslog streams to prevent
tampering.
Finally, log files are much less useful when no one is reading them. Take some time out every once in a while to look over your log files, and get a feeling for what they look like on a normal day. Knowing this can help make unusual things stand out.