Contributed by Peter N. M. Hansteen on from the unmuted, immutable dept.
rsadowski@) takes a deep dive into an infrequently mentioned feature of our favorite operating system: file immutability and the chflags command. From the article:
" ... anyone who’s ever had to investigate a security incident knows the harsh reality: logs are only as trustworthy as their protection against post-incident tampering. An attacker who gains root access isn’t going to politely leave their tracks in the log files – unless they physically can’t alter them anymore."
Read the whole thing, When Root Meets Immutable: OpenBSD chflags vs. Log Tampering, over at Rafael's site!
By anon (anonymouse) on
But then you need to make rc.securelevel itself immutable, and guard against having a kernel installed that ignores the flags (sure, immutable /bsd isn't too hard, but then you have a possibly-existing /bsd.upgrade to deal with, and it doesn't have to be an install kernel)
I took the view that the best way to meet this type of requirement is to log to a separate host, and lock that down as appropriate (either SSH open to a small set of users with fido+password 2fa, or turn off SSH if you're able to restrict it to physical access only).
Reply