1

It is said in the systemd-journald.service man page:

The daemon will implicitly collect numerous metadata fields for each log messages in a secure and unfakeable way. See systemd.journal-fields(7) for more information about the collected metadata.

What exactly does it mean to receive message in unfakeable way?

Improve this question

1 Answer 1

Reset to default
0

Journald supports Forward secure sealing (FSS).

When enabled, it cryptographically signs the logs periodically. You can then validate journald logs to check if someone has tampered with the logs after they were signed.

Note that this mechanism does not detect changes done before that log blob is signed, but the idea is to narrow the window of opportunity for an attacker to tamper logs in a non-detectable way.

Example:

journalctl --interval=10s --setup-keys >> journalctl-fss-setupkeys
journalctl --rotate
journalctl --verify --verify-key=`cat journalctl-fss-setupkeys`
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .