Overview
Hardening is not only about prevention — it is also about being able to detect and investigate. Ensuring robust, protected logging is a key hardening measure that makes attacks visible and evidence durable. This lesson covers logging as a hardening concern.
Learning objectives
- Explain why logging is a hardening measure, not just an operational one.
- Describe protecting log integrity and centralizing logs.
- Identify what should be logged for security.
Core concept
From a hardening perspective, logging must be sufficient, protected, and durable:
- Log the right events — authentication, privilege use (
sudo), service activity, and system errors. - Protect log integrity — restrict permissions so ordinary users cannot alter logs, and consider append-only or protected storage.
- Centralize/forward logs — send them to a separate, secured log server so an attacker who compromises a host cannot easily erase the evidence.
- Retain logs long enough to investigate incidents discovered later.
How it works
Attackers commonly try to cover their tracks by clearing or editing local logs. Hardening counters this: by forwarding logs to a central, tamper-resistant system in real time, a copy survives even if the local host's logs are wiped. Ensuring key security events are actually logged (and at adequate verbosity) means an intrusion leaves a trail. Making the journal persistent (so it survives reboots) and protecting log file permissions further preserve evidence. Good logging turns a silent compromise into a detectable, investigable one.
Practical example
A hardened server logs authentication and sudo events, keeps a persistent systemd journal, and forwards all logs to a central log server the moment they are written. When an attacker later gains access and deletes /var/log/auth.log to hide their login, the forwarded copy on the central server still shows the intrusion — preserving the evidence the attacker tried to destroy and enabling a confident response.
Cybersecurity relevance
Logging is foundational to detection, incident response, and forensics — without it, compromises can go unnoticed and unexplained. Centralized, tamper-resistant logging is specifically a defense against attackers erasing local traces, a near-universal step in intrusions. Ensuring the right events are captured and retained is what makes later investigation possible. This hardening measure is the on-ramp to the SOC/Blue Team path, where centralized log analysis and alerting are core.
Common mistakes
- Keeping logs only locally, letting an attacker delete the sole copy.
- Under-logging (not capturing auth/privilege events), so intrusions leave no trail.
- Short or no retention, so incidents discovered later cannot be investigated.
Key takeaways
- Logging is a hardening measure: capture security-relevant events (auth, sudo, services, errors), protect log integrity, and retain logs.
- Centralize/forward logs to a separate secured system so evidence survives even if a host's local logs are wiped.
- Robust, tamper-resistant logging turns silent compromises into detectable, investigable ones and leads into SOC/blue-team work.
Check your understanding
- Why is forwarding logs to a central server an important hardening measure against attackers?
- Name two categories of events that should be logged for security purposes.