Somewhat OT: Is Full Command Logging Possible?

[Fleuriot Damien]

On Dec 6, 2012, at 9:20 PM, Paul Schmehl <pschmehl_lists at tx.rr.com> wrote:

> --On December 6, 2012 1:19:00 PM -0600 Tim Daneliuk <tundra at tundraware.com> wrote:
>> 
>> I understand this.  Even the organization in question understands
>> this.  They are not trying to *prevent* any kind of access.  All
>> they're trying to do *log* it.  Why?  To meet some obscure
>> compliance requirement they have to adhere to in order to
>> remain in business.
>> 
>> <rant>
>> I know all of this is silly but that's our future when you
>> let Our Fine Government regulate pretty much anything.
>> </rant>
>> 
> 
> I sent this last night, but for some reason it never showed up.
> 
> /usr/ports/security/sudoscript
> 
> I believe this will meet your requirements.


I'm sorry to say it won't.
Nothing will prevent a user from removing sudoscript's FIFO once he gets root privileges.


Basically, what Tim wants to do sounds very akin to the PCI DSS requirements that every user's action be logged.
The bad news is _this is not achievable on MS/nux/bsd_ systems.
The kind of logging and security required can only be attained on mainframes (read: i/Series , z/Series) using RACF and other absolutely awesome features.


The only thing Tim can do is try to approach the level of security that's required.

Devin's suggestion of a kernel module is what comes closest to achieving the goal, provided that:
- the functionnality is compiled in-kernel to prevent kldunload'ing the module
- the system runs at a secure level high enough to prevent kldunloads , if it can't be compiled in-kernel
- the functions used by the module cannot be overriden by another module (for example redeclare this module's sendlog() function with another dummy module, making sendlog() basically do a NOOP)

Another contestant that comes a close second is the use of the AUDIT framework, however one would need to ensure:
- audit trails cannot be tampered (chflags sappend)
- the audit daemon cannot be killed