AUDLOG(8)

NAME
audlog - Secure syslog auditor v1.2

SYNOPSIS
audlog [-c host[:logfile]] [-r host] [-R host] [-n host] [-a] [-q]

DESCRIPTION
audlog implements the auditing facility for secure syslog, it can connect to the ssyslog daemons on different machines to audit and retrieve system logs. It supports the PEO-1 authentication protocol to grant the authenticity of the logs retrieved. The options are as follows:

-c  Downloads a given logfile from the specified host, if no logfile is specified, all the files being maintained by ssyslog using PEO-1 are downloaded. If ssyslog is using PEO-1 authentication for a file, the file is processed and authentication information is displayed. If the logfile being checked has been adulterated, a warning message will be shown.

    When audlog connects to a given host to download any of the logs, it automatically checks the configuration of ssyslog and compares it with the previous configuration of that host. If any changes are detected WARNINGS are issued.

-a  When used with -c hostname causes audlog to download all the files rather than only the files using PEO-1.

-r  Prints the data in the configuration file of a host in a readable way.

    audlog keeps the ssyslog configuration of the hosts being audited in a file, usually /audit/hostname/syslog-config.data This data-file is used to verify if changes are made to the configuration of a given ssyslog daemon.

-R  Prints the data in the old configuration file of a host

    When the configuration of a host is retrieved and stored into disk, a backup of the last configuration is saved, the -R options reads the data from this backup, usually /audit/hostname/syslog-config.data.old

-n  Adds a new host to the hosts being audited.

    This option creates the directory structure for the new host and the symmetric key that will be used for authentication with the new host. The key is stored in the file /audit/hostname/.key and have to be transfered in a secure way to the host and installed in /var/ssyslog to complete the installation procedure.

-q  Runs audlog in quiet mode, displaying only very relevant information or WARNINGS.

NAME TRANSLATION
When audlog downloads a file from a host, it stores it under the auditor directory structure for that host (/audit/hostname) with all the slashes replaced by dots, for example:

/var/log/messages of a host named remote will be downloaded to /audit/remote/.var.log.messages

Following downloads of a given remote file are appended to the same local file. A line is added for each download, stating the result of the authentication.

SECURITY
The protocol PEO-1 used for log authentication allows the auditor to securely determinate if the logs stored into files on remote machines via ssyslog have been modified, erased, or in any way adulterated. audlog communicates to ssyslog daemons on remote hosts authenticating itself with a challenge-response protocol using symmetric cryptography (Blowfish in the current version), and a session key is negotiated. All the rest of the communication since then is encrypted using that key.

EXAMPLES

audlog -n ambush

Creates the directory structure and the files needed to start auditing a new host named ambush.

audlog -c ambush

Downloads and checks the authenticity of all the logfiles maintained by ssyslogd on the host ambush using PEO-1.

audlog -q -a -c ambush

Download all the logfiles maintained by the ssyslogd at ambush, checks the authenticity of those using PEO-1 and does all this quietly.

audlog -R ambush

Shows the previous configuration of the ssyslogd in the host ambush, obtained from the data-file /audit/ambush/syslog-config.data.old

FILES

/audit
    The directory used by audlog to store all its files.

/audit/.rand
    The randpool file

/audit/hostname
    The directory used for store auditing information for hostname.

/audit/hostname/.key
    The key of the symmetric cryptography algorithm used for authentication and encryption.

/audit/hostname/syslog-config.data
    The data-file containing the configuration data of ssyslogd on the remote host.

/audit/hostname/filename.k0
    Initial PEO-1 state for the remote file pointed by filename.

BUGS
This is a pre-release beta version of audlog, we expect to see a lot of bugs being reported to us.

AUTHORS

Emiliano Kargieman <ek@core-sdi.com>

Ariel Futoransky <futo@core-sdi.com>

Send comments and suggestions, (bug reports also) to the authors. For the last version of the code and links to the papers describing PEO and PEO-1 refer to www.core-sdi.com.

ACKNOWLEDGEMENTS
Lucio Torre, Enrique Chaparro, M.V., and all those little green men.

SEE ALSO
logger(1), syslog(3), services(5), ssyslog(5), syslog.conf(5), ssyslogd(8)