只追加属性与哈希
只追加属性与哈希
chattr +a /var/log/audit/audit.log # 仅允许追加
lsattr /var/log/audit/audit.log
sha256sum /var/log/audit/audit.log > /secure/audit-$(date +%F).sha256哈希签名验签
哈希签名验签
openssl dgst -sha256 -sign /etc/pki/log-sign.key -out audit.sig /var/log/audit/audit.log
openssl dgst -sha256 -verify /etc/pki/log-sign.pub -signature audit.sig /var/log/audit/audit.log哈希与签名文件异地留存：攻击者改掉日志后难以同步改掉异地的校验记录。