logging file names with sftp
|
View:
New views
9 Messages
—
Rating Filter:
Alert me
|
 |
logging file names with sftp
by Agile Aspect
::
Rate this Message:
|
|
|
Re: logging file names with sftp
by Darren Tucker
::
Rate this Message:
|
|
|
Re: logging file names with sftp
by Agile Aspect
::
Rate this Message:
|
|
|
Re: logging file names with sftp
by Derek Martin
::
Rate this Message:
On Wed, Sep 02, 2009 at 10:34:18PM -0700, Agile Aspect wrote:
> The so-called "normal" logging is working - the problem is it's > tragically incomplete. > > We store IP information on the server. In addition, it's not > possible to have security without accountability. The logging of individual file transfers arguably buys you very little though, because the users are legitimate users who are authenticated. This is generally quite a different situation from FTP installations, where often the users are anonymous, and tracking downloads of files may be interesting from a purely statistical point of view (e.g. how many downloads of a particular game, application, etc., to determine its popularity). An individual FTP site may not fall into this category, but FTP software generally needs to cope with this very common usage. With sftp sites, the users are (in some sense) people that you know, and access to data can and should be carefully regulated via file system permissions. Users should not be physically able to access anything they shouldn't have access to, and logging file transfers of files they legitimately should have access to is in most cases little more than spying on them. If your site is *especially* security sensitive, this may be called for (though, if that's the case, you might also want to re-evaluate whether you really should be providing file access this way), but most of the time it probably isn't warranted, and may be considered by some as an unnecessary invasion of privacy. -- Derek D. Martin http://www.pizzashack.org/ GPG Key ID: 0x81CFE75D |
|
|
Re: logging file names with sftp
by Darren Tucker
::
Rate this Message:
|
|
|
Re: logging file names with sftp
by Greg Wooledge
::
Rate this Message:
|
|
|
RE: logging file names with sftp
by Dennis Taylor-2
::
Rate this Message:
|
|
|
Re: logging file names with sftp
by Derek Martin
::
Rate this Message:
On Fri, Sep 04, 2009 at 12:12:33PM -0400, Greg Wooledge wrote:
> On Thu, Sep 03, 2009 at 11:26:57AM -0500, Derek Martin wrote: > > The logging of individual file transfers arguably buys you very little > > though, because the users are legitimate users who are authenticated. > > This is generally quite a different situation from FTP installations, > > where often the users are anonymous > > If I understand correctly, many people run an sftp service which is > essentially an encrypted, NAT-capable version of anonymous FTP. They > offer files (or file hosting space) to a large group of barely-trusted > people, and want to limit or track abuse of the service. exist cases where the logging is more useful than in others. When the OP posted, he did not describe his intended purpose; all we knew was that he wanted to log the file names. I was simply trying to point out that, depending on his use case, this may be unnecessary, unwarranted, and un-useful. I would also point out that even in the case you describe, the situation is different from an actual anonymous FTP server, and I think that it's worth pointing out what is available without tracking individual file transfers. In general with OpenSSH, for determining abuse, without logging file names, one already knows the identity of the user, where they logged in from, and how long they were connected. If the user uses up the available space on the storage device, you know who they are, and you can find the files. If you enable system accounting (if the server has those facilities -- devices based on any of the free unix kernels generally at least have the possibility) then you can identify when the user downloads more data then they should be allowed to. All without logging individual file names. Though admittedly, logging file names may more efficient in terms of space consumed, and it's easier to count log lines than process the system accounting file. But you could certainly build a tool that processes the accounting for you, and if this is a product, include that as part of your management tools. On Fri, Sep 04, 2009 at 06:10:37PM -0400, Dennis Taylor wrote: > When one of our technicians or engineers accesses one of our > embedded systems in the field, we have no reasonable expectation of > privacy. Clearly this is for support purposes, and in that case such a policy makes sense; you don't own the data, and are not an agent of the person who owns the data -- you have no right to it. But in general I'm philosophically opposed to the idea of "no reasonable expectation of privacy." As you might have guessed. ;-) It's become the modus operandi of the day, but I think that's wrong, from both a moral and practical standpoint. People tend to feel somewhat stifled if they know they are being watched. And we have a variety of laws against watching people without their knowledge not without reason, though of late they have been lessened and weakened, sadly. Honestly, what I personally would like to see is more software with logic that automatically starts logging but only when a behavior surpasses some configured notion of what's acceptable. This has multiple benefits (including reducing disk usage of logs). I like my privacy, and I think we should all generally have more of it than we typically do today, at the hands of technology. > We need to be trusted, but also accountable. Above, I'm trying to point out that not logging individual file transfers does not necessarily prevent accountability. In many cases, all it does is provide additional detail that's not strictly necessary or even especially useful. In your case, it may be particularly useful, or even required. > We have gone to great lengths to make it impractical for even an > authorized user to steal others' information. Having logs that we > cannot tamper with is one more layer of security, mostly to help > track who compromised the system if they do find away around the > other layers. Sure. Of course, if they find a way around the other layers, most likely they've managed to escalate their privileges, in which case your logging is suspect (unless it's to some sort of write-only media). > It is also an industry requirement, and our products are audited by > independent firms to verify that we do in fact log accesses. You can log *access* without necessarily logging individual file transfers. Though again, in your case it may be appropriate or required. To be clear, I'm not trying to suggest that one should never log file transfers, or that it is never useful. I'm simply saying that it is not always clear that it is necessary, and it is clear that it is not always necessary. :) Just because you can do something, doesn't mean you should. I think all of us as technologists should take the time to consider if what we are doing is ethical and necessary. From a purely philosophical point of view, I think it is better not to log individual file transfers unless you can determine that you have a justifiable need for the data so obtained that you can not obtain another way. A legal requirement would certainly qualify as a justifiable need... And (obviously), I think we should apply this philosophy everywhere, not just to file transfers. Of course, if you have a bonifide need for a high level of security, then you do what you have to do. But you ought to at least make sure that the parties involved have appropriate notice. If you're going to log transfers of legitimate users, you should notify the users that you do so. Just my $.00002 -- Derek D. Martin http://www.pizzashack.org/ GPG Key ID: 0x81CFE75D |
|
|
RE: logging file names with sftp
by Dennis Taylor-2
::
Rate this Message:
|
attachment0 (196 bytes) | Free embeddable forum powered by Nabble | Forum Help |
