We have hundreds of workstations, tens of servers, sending logs to a
syslog server or Windows Event Collector server whether they come from Linux or Windows machines. At this point, logs integrity and confidentiality is managed by access rules and push to the log servers via
TCP. Authentication of assets sending logs is not performed but assets inventory is with a strict policy of what we have inside the information system.
As we have a
PKI, I would like to use it to secure logs to the next level. Ensuring security during transport is alright, but I don't feel comfortable with securing log storage before archiving since the log files are growing. That would mean:
Lock the log file before a new entry is added Check integrity by comparing the crypto signature Add the entry Compute the new signature Unlock the file
I can sign the log files when archived, but what about the current log files (the above pseudo code looks complex to implement unless some tool already cover it)?
I widen the question to: what are the best practices to secure logs integrity and ensure their authenticity?