Front cover - IBM Redbooks

9.4.9 Remote log server
One of the many techniques would-be attackers use to cover their presence is to
wipe clean any logging facilities that may (or rather should) have been enabled.
This includes: account logging, system messages, error logs, traffic logs, and so
forth.
One way to circumvent this problem is to log all of the organization’s servers to a
remote logging machine. The remote logging machine should only accept
logging traffic from those servers. That way, even if a server is compromised, the
logs will still be available to perform the forensic analysis of what went on.
The appropriate packet filter should be configured on the logging server to drop
all traffic except UDP/514. The logs on the logging server can additionally be
archived to media such as CD-R, WORM, or tape.
UNIX has very strong centralized logging facilities. It is true that some
applications use their own log files and do not use syslog. However, the file
system hierarchy is designed with support for a centralized location, /var/log.
Additionally, most UNIX systems and GNU/Linux distributions come with an
automated log rotation and management facility. The logs are automatically
rotated, based on criteria such as size or age; and can automatically be
compressed, renamed, and even archived.
To further enhance the logging capabilities of the UNIX or GNU/Linux server, the
normal syslogd should be replaced with a more robust, configurable, and secure
alternative known as syslog-ng. It has several enhancements over the normal
syslogd, including the ability to filter messages on message content, not just
facility.priority pairs.
Using regular expressions, host information could be logged into individual logs.
syslog-ng might already come with the UNIX operating system or GNU/Linux
distribution, but if it does not, it can be found at the following URL:
http://www.balabit.hu/en/products/syslog-ng/
This concludes the discussion on hardening UNIX operating systems and
GNU/Linux distributions. While this material applies to AIX as well, AIX has some
unique traits, which are covered separately in the next section.
9.5 Hardening the AIX operating system
AIX is an open UNIX operating environment that provides increased levels of
integration, flexibility, and reliability that are essential for meeting the high
Chapter 9. Server hardening 399