When root meets immutable: OpenBSD chflags vs. log tampering

If you want immutable logs, you log to an external log server. Anything else seems security theater to me.

That log server is properly firewalled/hardened so a hacked server can’t be used as a stepping stone to compromise the log server.

Maybe you even have access restrictions in place for the log server so people can’t wipe their own misdeeds (4-eyes principle).

This is how it’s been done for 35+ years, nothing special about this.

Yes, so much this. It used to be that important logs (filtered by severity and keywords) were even continuously live-printed by a line printer, so that there was always a current paper copy of the really important stuff for forensics.

See e.g. https://www.youtube.com/watch?v=FiEGoVzmyvs but dot-matrix was also used and at least a little less noisy.

Exactly the right approach.

tsch! tsch! tsch! tsch! "Ah, someone is trying to login as root again"