Audit log of admin actions

FAQ › EUZOS Server › Audit log · Nederlands

What is it?

Every admin action that changes something on the server (firewall, packages, network, ports, File server, Web server, Backup, reboot, …) is written to a persistent audit log on the boot volume, together with its failure if it fails, and every change of the firewall and of the packages made by the server itself or from the console. The log survives a reboot and cannot be pushed out by junk requests, unlike the RAM log (log), which keeps only the last 200 lines.

Each record has a sequence number, the time, the admin account, the source address and the action. The records form a hash chain (each record carries the SHA-256 of the one before it) and each record has a MAC with a key only the server holds. Changing a record, deleting one in the middle, or cutting off the end and writing new records is therefore detected.

How do I…?

How do I view the audit log?

In Server Admin: the server › tab Log › Audit log of admin actions › Show log. Or with the CLI on the PC:

serveradmin <server-id> audit        the newest 50 records
serveradmin <server-id> audit 200    the newest 200 (at most 500)

The first line is the verdict, then the records, newest first:

audit: verified, 3 records (seq 1-3), chain and MACs intact
-- newest first: seq time account source text --
3 1793174400 admin@example.org 192.0.2.20 admin pakket-aan web (pc 3b6a 27bc)
2 1793174390 - server firewall: Server Admin opens 'allow tcp 443 anywhere' -> version 4: …
1 1793174000 - server boot: audit log opened; verified, no records yet

The time is in Unix seconds. - / server means the server itself or the console (no admin account).

What does "audit: BROKEN at …" mean?

The log does not check out from that record on, for example:

audit: BROKEN at AUDIT.TXT line 17 (seq 140): MAC wrong (record changed or forged); 139 records before it check out

Reason	Meaning
MAC wrong	the record was changed, or written without the server's key
sequence gap	a record was deleted or inserted
chain broken	the record before it was changed
unreadable or incomplete record	the line is damaged (also after a power cut while writing)
truncated	records are missing at the end (compared with what the running server knows)

The server keeps the log as it is (the evidence stays) and continues the chain after the last valid record. At boot a broken log gives a warning in the server's log. Treat it as a security incident: who had access to the disk?

Where is it stored?

On the boot volume: \EOS\AUDIT\AUDIT.TXT (current) and AUDIT1.TXT (previous), at most 256 KiB each (about 1000 records per file). When the current file is full it becomes AUDIT1.TXT and a new one starts; the chain continues across the two files. The MAC key is \EOS\AUDIT\AUDKEY.TXT, made at the first start; it never leaves the server.

Which actions are logged?

All admin actions that change something (Action::audited), including every terminal command (console, with the command; of a denied one only its first word) and console-set; views (status, log, firewall, packages, ports, audit, files usage, web status, web log, web cert, …) are not. Of a site upload the single files are not logged, but the web publish that puts the site live is; certificate uploads are logged. Refused requests before authentication are not in the audit log; they stay in the RAM log (log).

What does it not protect against?

Someone who can read the boot volume can also read AUDKEY.TXT and could then forge records. Rolling both files back to an older copy while the server is off is not detected either: that needs a copy of the log outside the server (not yet available).

Reference

Item	Value
Files	`\EOS\AUDIT\AUDIT.TXT`, `AUDIT1.TXT`, `AUDKEY.TXT`
Record	`<seq> <time> <account> <source> <prev-hash> <mac> <text>`
Hash, MAC	`SHA-256(prev-hash ‖ "<seq> <time> <account> <source> <text>")`, `HMAC-SHA256(key, "EUZOS-audit-v1\0" ‖ hash)`
Admin action	`audit [n]` (view; English wire name)
Code	`libs/workplace/src/audit_file.rs`, `kernel/src/audit.rs`