Re:How often should I rotate my SSH keys?
by viraptor on Friday February 26, 2021 @02:02AM
(#26272052)
> You can't assume your logs are trustworthy if you are compromised.
It's not that simple. In a larger/mature environment you'll have log aggregation where the initial login is close to certain to be forwarded before it can be messed with. (Unless someone can log in, escalate, kill the right daemon, and somehow prevent monitoring from noticing a missing endpoint - all before the log gets forwarded)
And that's just host logs, without the networking, potential forwarding, etc.
It's not that simple. In a larger/mature environment you'll have log aggregation where the initial login is close to certain to be forwarded before it can be messed with. (Unless someone can log in, escalate, kill the right daemon, and somehow prevent monitoring from noticing a missing endpoint - all before the log gets forwarded)
And that's just host logs, without the networking, potential forwarding, etc.