Problem - Kevin Tafuro

access to the machine. This makes it significantly more difficult for an attacker to
gain access to your logs. If you need remote access to view your log files, a service
like ssh is reasonably safe to enable as long as it is properly configured, * but it does
increase the risk of the log files being compromised.
One final point regarding logging to a remote server using syslog: syslog sends log
entries to the server over a UDP port without any kind of encryption or authentication.
As a side effect of using a connectionless protocol, syslog is also notorious for
losing log entries, particularly on heavily loaded systems.
Ideally, syslog would support making entries using an SSL-enabled TCP connection
with authentication, but because it does not, system administrators should take steps
to protect the log entries in transit to the logging server. One possible way to do this
is to use a virtual private network (VPN) between the logging server and all network
hosts that will be using it. Other possibilities include signing and encrypting the log
entries in your programs before sending the entries to syslog, but this can be very
difficult to do correctly. In an ideal world, the syslog daemon would handle encryption
and signatures for you.
An alternative to using the stock syslog implementation that is included as part of
most Unix distributions is to use syslog-ng, produced by Balabit IT Security LTD in
Budapest, available under the GPLfrom http://www.balabit.com/products/syslog_ng/.
It provides support for a variety of different network protocols, including both UDP
and TCP; however, it does not support any kind of encryption or authentication.
Before making the decision to use syslog-ng, you should be aware that it has had a
few security vulnerabilities in recent history.
The audit logging service that is a part of Windows makes no provision for network
logging. Every system stores its logs locally. In addition, log files are stored in a proprietary
binary format that is not documented. At least in theory, it is possible to
make the Windows logging service relay log entries to a centralized server, but to do
so would require a program external to the logging service that listens for logging
notifications and forwards them to the logging server. Logging to a remote server in
this manner would cause a record to be kept in two locations: one on the local
machine, and the other on the remote server.
Unfortunately, this solution is not likely to work very well in practice, because the
Windows logging service depends upon local DLLs to supply the messages that you
see when you view the logs. When a program wants to make log entries using the
Windows logging service, it must first register a DLL that contains logging informa-
* In particular, protocol 1, root logins, and password authentication should be disabled. Any user accounts on
the machine should not share their names with any other names on your network, making it more difficult
for an attacker to guess an account name and password if he has compromised the rest of your network and
has access to your password files. In general, your logging machine should share as little in common as possible
with all other systems on your network.
Following Best Practices for Audit Logging | 735
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.