up vote 0 down vote favorite
share [g+] share [fb]

Just out of curiosity, what if the root user by mistakenly stops/starts any service and tried to remove those traces from the log files and save those log files. Then how can we ensure that our log file is trusted. Is there any way where even the root(superuser) also cant edit/modify the contents of the /var/log/* files.

link|improve this question
89% accept rate
feedback

2 Answers

up vote 3 down vote accepted

No, there isn't. root can do everything.

You can set up syslogd to log to a different machine in addition to /var/log, or set up a cron job on that other machine to regularly copy the log files over (e.g. by issuing an rsync every minute).

You can also limit the rights you hand out to different users in your sudo configuration, but that doesn't protect against cases where restricting access is too cumbersome or people who manage to work around the restrictions anyway.

link|improve this answer
1  
Actually with SELinux you can prevent root from modifying files inside /var/log. Of course root can disable SELinux on next reboot. – Olli Feb 10 '11 at 17:23
1  
You can use chattr to make certain files appendable only, but root can also undo this. More useful on FreeBSD, where even root is prevented from doing some things unless in single user mode. – Rich Homolka Feb 10 '11 at 17:46
Many Thanks --Maneesh – maneeshshetty Feb 11 '11 at 19:08
feedback
up vote 1 down vote

As a historical note, way back in the dark ages, before fast networks and large amounts of storage, we used an analogue, write-once, tamper-evident storage system. This was a dedicated dot-matrix printer with a box of green-bar fan-fold paper behind a locked door. The boot sequence of | / - \, interspersed with the backspace character, left some interesting holes on the paper.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.