In this lesson, you will learn how to maintain immutable records of firewall policy changes directly at the kernel level to satisfy strict compliance requirements.
The Problem with User-Space Logs
When you manage a firewall using nftables or iptables, standard administrative logs (like shell history) are unreliable. They can be deleted or modified by a compromised account. To meet compliance standards like PCI-DSS or SOC2, you need an immutable audit trail that captures the exact moment the kernel’s rule set changes, preventing unauthorized "silent" modifications.
Implementing Kernel-Level Auditing
Linux provides the auditd framework, which hooks into the kernel’s system call interface. By monitoring the netlink messages sent to the kernel to modify firewall rules, you can ensure that every change—whether made by a script or an administrator—is captured in a secure, read-only log file.
To track policy changes, you must audit the netlink subsystem. You can add a rule to audit.rules that watches for modifications to the nftables or xtables configuration space:
# Audit any write operation to the netlink subsystem (where rule changes occur)
-a always,exit -F arch=b64 -S sendto -k firewall_change
When an administrator runs nft add rule ..., the kernel generates an audit event. Because auditd operates at the kernel level and writes to /var/log/audit/audit.log (which can be streamed to a remote, write-only logging server), the entry is tamper-evident.
Ensuring Immutability
For true compliance, the audit logs should be shipped in real-time to a remote log aggregator. If a system is compromised, the attacker may try to delete local logs; however, because the audit trail is generated by the kernel the moment the rule changes, the remote log server will already hold the definitive proof of the unauthorized policy modification. By strictly monitoring the netlink channel, you create a "source of truth" that proves exactly who changed the firewall, when, and what the previous state was, satisfying the most rigorous regulatory requirements.
Key Takeaway: Maintaining compliance requires offloading firewall change logs to an immutable kernel-level audit system, ensuring that every modification to the netfilter rule set is recorded and tamper-proof.