14

I have an Ubuntu 18.04 server that is running a service I'm developing. The output is being sent to the system journal for logging.

I accidentally failed to sanitize some logging and a plaintext password (for my own user) was accidentally leaked in the logs.

I have fixed the service's logging behavior. Now I simply want to edit the journal files to remove the lines with the plaintext password.

How do I edit a journalctl file?

11
  • Related unix.stackexchange.com/q/139513/7453
    – slm
    Jul 10, 2018 at 22:48
  • Possible dup unix.stackexchange.com/q/272662/7453
    – slm
    Jul 10, 2018 at 22:52
  • askubuntu.com/q/864722/17531 shows the paths where logs are stored. I'd look there for your line and use an editor to delete what you want.
    – slm
    Jul 10, 2018 at 23:00
  • 4
    It must be possible. It should at least be possible to scan the entire journal, grep -v out whatever I don't need, and then write all of the results to a new journal file. There is nothing technically preventing that from happening. It's just that there doesn't appear to be an existing tool to do the job.
    – Ashoat
    Jul 12, 2018 at 3:00
  • 1
    Regardless whether you can solve your question or not. Better simply change the password.
    – rudimeier
    May 27, 2020 at 11:33

2 Answers 2

3

systemd's journal is designed to prevent this kind of tampering.

The journal file format is documented here and it describes its support for in-line Forward Secure Sealing:

Tag objects are used to seal off the journal for alteration. In regular intervals a tag object is appended to the file. The tag object consists of a SHA-256 HMAC tag that is calculated from the objects stored in the file since the last tag was written, or from the beginning if no tag was written yet. The key for the HMAC is calculated via the externally maintained FSPRG logic for the epoch that is written into epoch. The sequence number seqnum is increased with each tag. [..]

see Tag Object

What you can do is clear the journal with the log entries from the time before you fixed the service (e.g. you fixed it two days ago):

journalctl --rotate --vacuum-time=2d

Source: How To Clear The systemd journal Logs

2
  • 1
    According to the man page, --vacuum-time will only "Remove the oldest archived journal files until ...". If the entry in question is not archived (as it is in my case now), even journalctl --vacuum-time=1m won't remove it. I edited the answer to point this out.
    – 3VYZkz7t
    May 11, 2021 at 14:20
  • @3VYZkz7t Thanks, you can actually do this in a single command.
    – laktak
    May 11, 2021 at 18:28
-2
strings "$file" | grep "xxxxx"

will show your additions. However, that are binary files, I am not sure when manually editing, what consequences this might have. I use them only for reading.

1
  • 2
    "I am not sure when manually editing, what consequences this might have." While in general it is always a bad idea to edit binary files specially when you don't understand the format, for systemd journal files it is even a worst idea, as it uses Forward Secure Sealing, see lwn.net/Articles/512895 Aug 24, 2020 at 17:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .