In this lesson, you will learn how to use file attributes to prevent even root-level administrators from modifying or deleting existing security logs.
The Problem with Standard Permissions
Usually, a system administrator (root) has the power to modify or delete any file on the system. If an attacker gains administrative access, their first move is often to delete logs to cover their tracks. While standard POSIX permissions (chmod) control access, they do not stop the root user from changing those permissions or simply erasing the file content.
Implementing Append-Only Mode
To prevent tampering, we use the chattr (change attribute) command. Specifically, we can apply the +a attribute to a file. When a file is marked as "append-only," it can only be opened for writing in append mode. This means data can be added to the end of the file, but existing data cannot be overwritten, modified, or truncated. Furthermore, the file cannot be deleted or renamed while this attribute is set.
Practical Application
Imagine you have a critical security log file at /var/log/secure_audit.log. To secure it, you would execute the following command:
# Apply the append-only attribute to the log file
sudo chattr +a /var/log/secure_audit.log
Once this is set, even a user with full root privileges will receive a Permission denied error if they try to edit the file or remove it. To verify the attribute has been applied, use lsattr:
lsattr /var/log/secure_audit.log
# Output: ----a---------e---- /var/log/secure_audit.log
If you ever need to perform log rotation or maintenance, you must first remove the attribute using sudo chattr -a /var/log/secure_audit.log.
Security Considerations
While this is a powerful defense, remember that the chattr attribute itself can be removed by anyone with the power to run chattr. Therefore, this technique is most effective when combined with "4. Advanced Access Control Models" and "12. Auditing Administrative Privilege Delegation," where you restrict which users are allowed to manage file attributes or execute administrative binaries, ensuring that even the root user’s actions are logged to a remote, immutable location.
Key Takeaway: By setting the append-only attribute with chattr +a, you ensure that system logs can grow but cannot be altered or destroyed, forcing attackers to leave a permanent trail of their activities.