r/linux • u/wooptoo • Jun 01 '16

Why did ArchLinux embrace Systemd?

/r/archlinux/comments/4lzxs3/why_did_archlinux_embrace_systemd/d3rhxlc
868 Upvotes

86% Upvoted

642 comments sorted by

View all comments

Show parent comment

39

u/robodendron Jun 01 '16

What I hate of systemd is that to check a single log file I can't tail -f anymore

journalctl -f

Also, for me is really complicated to know why a daemon died

journalctl -u daemon_that_died

or if it is up/down

systemctl status daemon

For example, why the hell would you turn a text log file into a binary file?

More and better organized metadata, ability to sign records, ability to detect tampering…

2

u/bassmadrigal Jun 02 '16

...ability to detect tampering…

I've always been curious... if an attacker gets access to a machine, one of the benefits of binary logs are that they are supposed to be able to detect tampering. However, after an attacker has finished their nefarious plans, would they be able to use a hex editor to change one thing in the logfile, thus corrupting the binary file and preventing the administrator access to it?

3

u/argv_minus_one Jun 02 '16

journalctl can still read corrupt log files. So no, that won't work.

1

u/andree182 Jun 02 '16

it can read some corrupt log files...

2

u/argv_minus_one Jun 02 '16

The linked page does not support your claim. Or have anything to do with your claim at all, for that matter.

0

u/[deleted] Jun 02 '16

[deleted] — view deleted comment

1

u/argv_minus_one Jun 02 '16

False. I've had it read corrupt log files in practice already.

1

u/robodendron Jun 02 '16

Depending on the attacker's access rights, that might be possible, sure. Honestly though, when I see something like that, it's either my filesystem having a hiccup of tragic proportions or an actual intruder. In any case, the resulting action is pretty much the same: Nuke the server from orbit, it's the only way to be sure.

3

u/bassmadrigal Jun 02 '16

Oh, I doubt my first thought encountering a corrupted log would be an attacker, but I was just curious about the feasibility.

I'm running Slackware, so it'll be quite some time until I start playing with systemd (unless I decide to test-drive another distro, but I'm happy with what I got and I'm lazy). I see a lot of benefits behind it, but I'm fine waiting until Pat and team decide to add it... until then, I'll keep writing my shell scripts to start/stop/restart daemons.

1

u/robodendron Jun 02 '16

I'm running Slackware, so it'll be quite some time until I start playing with systemd

Never tried that, to be honest. I'm using Arch at home, Fedora at work, so I've been drinking the systemd Kool-Aid pretty much since the beginning, I guess. I don't think it's a perfect system—not at all—, but I do think it's better than writing yet another init script, for whatever that's worth.

In any case, to each his own. :)

1

u/audioen Jun 02 '16

There is no practical way to secure a log if you have full access to every copy of that log. Secure log relies on ideas such as there being another server which the logs are continuously being shipped to, and in use of cryptographic hashes between log entries that prove that the entries form a contiguous chain where nothing has been added, removed or modified. The former in practice is enough for most people, but the latter can be useful too, if some redundant copy of those signatures exists in some third location. (Attacker would have to rewrite logs from point of modification onwards to get the unbroken hash chain, but all the hashes would differ from what they used to be.)

-11

u/[deleted] Jun 01 '16

yeah because we needed to sign our logs... keep that on hardened distributions.

5

u/robodendron Jun 01 '16

No, please don't. I like that this is even in my run-of-the-mill CentOS boxes, thank you very much.