Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
It is said in the systemd-journald.service man page:
The daemon will implicitly collect numerous metadata fields for each log messages in a secure and unfakeable way. See systemd.journal-fields(7) for more information about the collected metadata.
What exactly does it mean to receive message in unfakeable way?
Journald supports Forward secure sealing (FSS).
When enabled, it cryptographically signs the logs periodically. You can then validate journald logs to check if someone has tampered with the logs after they were signed.
Note that this mechanism does not detect changes done before that log blob is signed, but the idea is to narrow the window of opportunity for an attacker to tamper logs in a non-detectable way.
Example:
journalctl --interval=10s --setup-keys >> journalctl-fss-setupkeys
journalctl --rotate
journalctl --verify --verify-key=`cat journalctl-fss-setupkeys`
