
Secure logs
The SKM allows yo
u to sign your log files before moving them to another machine or downloading them,
which makes you
rlogfiles more secure than unsigned log files.
ALogSigningCe
rtificate is created the first time the SKM is run and when the machine is restored to the
factory defaul
ts. If the Sign Log option is selected, a log file is signed with the Log Signing Certificate
right before i
t is downloaded or moved off of the SKM. The signed log file is then sent to the specified
host in multip
art S/MIME E-mail format. The first part of the signed log file contains the clear text
log; the seco
nd part of the signed log file contains the signature in PEM encoded PKCS7 format. The
certificate u
sed to verify the signed log file is embedded within the signature, but it is insecure to simply
rely on this
embedded certificate for verification.
Signed logs do not appear in plaintext when downloaded.
IMPORTANT:
If you decide to recreate a Log Signing Certificate, it is very important to make a backup of the existing
certificate so that old log files signed with the existing certificate can still be properly verified.
TIP:
You should store your Log Signing Certificate separately from the signed logs files.
Log Configu
ration page
The Log Con
figuration page enables you to configure rotation schedules, syslog settings, create signed
logs, and s
pecify log levels. This page contains the following sections:
•RotationSchedule
• Log Rotation Properties
•SyslogSe
ttings
•LogSigning
• Log Signing Certificate Information
•Activit
yLogSettings
Rotation Schedule
The Rotation Schedule provides a summary view of the properties of the logs on an SKM.
Figure 135 Viewing the Rotation Schedule section
The following table describes the components of the Rotation Schedule section.
224
Using the Management Console
Commenti su questo manuale