Creating A Secure Linux Logging System

The purpose of this paper is to identify and demonstrate methods that can be used to create a secure Linux logging system that can be expanded to other types of systems for secure logging. Using logs, data can be collected to figure out why a server crashed. If the server is unrecoverable, remote logs allow you to be able to see what happened prior to the crash, even without the system running. If the crash was related to an intrusion, any information that can describe how the system was compromised can help determine the cause of the problem. After reading this paper, the reader should have a basic understanding of how to prevent intrusions of the logging server and detect them if they occur. I will explain methods to prevent unauthorized logins to administrative accounts, control which clients are allowed to remotely log to the server, and prevent and detect intrusions to the log server. In the demonstrations, various types of free software will be used, all of which are included with the version of Linux to be installed. This ensures compatibility and ease of installation of all needed software.