On Fri, Sep 04, 2009 at 12:12:33PM -0400, Greg Wooledge wrote:
> On Thu, Sep 03, 2009 at 11:26:57AM -0500, Derek Martin wrote:
> > The logging of individual file transfers arguably buys you very little
> > though, because the users are legitimate users who are authenticated.
> > This is generally quite a different situation from FTP installations,
> > where often the users are anonymous
>
> If I understand correctly, many people run an sftp service which is
> essentially an encrypted, NAT-capable version of anonymous FTP. They
> offer files (or file hosting space) to a large group of barely-trusted
> people, and want to limit or track abuse of the service.
Absolutely; of course I was generalizing, and acknowledged that there
exist cases where the logging is more useful than in others. When the
OP posted, he did not describe his intended purpose; all we knew was
that he wanted to log the file names. I was simply trying to point
out that, depending on his use case, this may be unnecessary,
unwarranted, and un-useful.
I would also point out that even in the case you describe, the
situation is different from an actual anonymous FTP server, and I
think that it's worth pointing out what is available without tracking
individual file transfers.
In general with OpenSSH, for determining abuse, without logging file
names, one already knows the identity of the user, where they logged
in from, and how long they were connected. If the user uses up the
available space on the storage device, you know who they are, and you
can find the files. If you enable system accounting (if the server
has those facilities -- devices based on any of the free unix kernels
generally at least have the possibility) then you can identify when
the user downloads more data then they should be allowed to. All
without logging individual file names. Though admittedly, logging
file names may more efficient in terms of space consumed, and it's
easier to count log lines than process the system accounting file.
But you could certainly build a tool that processes the accounting for
you, and if this is a product, include that as part of your management
tools.
On Fri, Sep 04, 2009 at 06:10:37PM -0400, Dennis Taylor wrote:
> When one of our technicians or engineers accesses one of our
> embedded systems in the field, we have no reasonable expectation of
> privacy.
Clearly this is for support purposes, and in that case such a policy
makes sense; you don't own the data, and are not an agent of the
person who owns the data -- you have no right to it. But in general
I'm philosophically opposed to the idea of "no reasonable expectation
of privacy." As you might have guessed. ;-) It's become the modus
operandi of the day, but I think that's wrong, from both a moral and
practical standpoint. People tend to feel somewhat stifled if they
know they are being watched. And we have a variety of laws against
watching people without their knowledge not without reason, though of
late they have been lessened and weakened, sadly.
Honestly, what I personally would like to see is more software with
logic that automatically starts logging but only when a behavior
surpasses some configured notion of what's acceptable. This has
multiple benefits (including reducing disk usage of logs). I like my
privacy, and I think we should all generally have more of it than we
typically do today, at the hands of technology.
> We need to be trusted, but also accountable.
Above, I'm trying to point out that not logging individual file
transfers does not necessarily prevent accountability. In many cases,
all it does is provide additional detail that's not strictly
necessary or even especially useful. In your case, it may be
particularly useful, or even required.
> We have gone to great lengths to make it impractical for even an
> authorized user to steal others' information. Having logs that we
> cannot tamper with is one more layer of security, mostly to help
> track who compromised the system if they do find away around the
> other layers.
Sure. Of course, if they find a way around the other layers, most
likely they've managed to escalate their privileges, in which case
your logging is suspect (unless it's to some sort of write-only
media).
> It is also an industry requirement, and our products are audited by
> independent firms to verify that we do in fact log accesses.
You can log *access* without necessarily logging individual file
transfers. Though again, in your case it may be appropriate or
required.
To be clear, I'm not trying to suggest that one should never log file
transfers, or that it is never useful. I'm simply saying that it is
not always clear that it is necessary, and it is clear that it is not
always necessary. :) Just because you can do something, doesn't mean
you should. I think all of us as technologists should take the time
to consider if what we are doing is ethical and necessary. From a
purely philosophical point of view, I think it is better not to log
individual file transfers unless you can determine that you have a
justifiable need for the data so obtained that you can not obtain
another way. A legal requirement would certainly qualify as a
justifiable need... And (obviously), I think we should apply this
philosophy everywhere, not just to file transfers.
Of course, if you have a bonifide need for a high level of security,
then you do what you have to do. But you ought to at least make sure
that the parties involved have appropriate notice. If you're going to
log transfers of legitimate users, you should notify the users that
you do so.
Just my $.00002
--
Derek D. Martin
http://www.pizzashack.org/ GPG Key ID: 0x81CFE75D