Problem - Kevin Tafuro

tion with the logging service. When log entries are made, only a small amount of
information is stored; this information includes a timestamp, an integer value representing
the log message, and possibly some additional “metadata” that makes up the
variable portion of the log message. The full textual message is never stored; instead,
the DLLs that have been registered with the logging service provide the message on
demand when the logs are viewed.
Logging to CD-R
On the surface, the idea of logging to read-only media sounds like a good idea, but in
practice, it does not usually work out very well. There are a surprising number of
serious problems with logging to CD-R. In fact, we recommend against it; we feel
that the problems greatly outweigh the benefits.
One of the primary problems with logging to CD-R is the lack of hardware and software
support for doing so. In order to write log entries out to CD-R in real time,
writing must be done in what is known as packet-writing mode. Packet-writing mode
allows data to be written to the CD-R incrementally instead of all at once. Most
available hardware does not support packet-writing mode for CD-R. As a direct consequence
of this, most operating systems do not have support for it either.
Perhaps the most obvious problem with logging to CD-R is that it requires constant
monitoring and manual intervention. CD-R media is small, holding only roughly
660MB. A busy system could fill this up quite quickly, so someone must keep a close
eye on the logging system, being prepared to swap media when necessary. In most
environments, having someone around to swap CDs is not an effective use of
resources. More importantly, if a busy system can fill up the media quickly under
normal conditions, imagine what an attacker could do!
Other problems with packet-writing mode are performance and reliability. Because
operating in packet-writing mode is slow, a busy system is very likely going to fall well
behind the activity that is going on in real time. Reliability is also an issue. If an error
of some kind occurs, there is a high probability that any data written to the CD-R will
be lost. In addition, if an attacker were to reboot the system before the CD-R was
finalized, all of the data on that CD-R would be lost.
If you still want to log to CD-R in “real time,” be sure that you don’t rely solely on
CD-R copies. You should also keep local copies on the system’s hard drive and log to
a network server if you can.
Signing and encrypting log entries
Signing and encrypting entries made to log files can help ensure the integrity of the
logs that are generated. Ideally, the logging server would be responsible for performing
the cryptographic operations on all entries submitted to it, but neither syslog nor
the Windows logging service provide built-in support for either signing or encrypt-
736 | Chapter 13: Other Topics
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.