1 <!DOCTYPE html PUBLIC
"-//W3C//DTD XHTML 1.0 Strict//EN"
2 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
3 <html xmlns=
"http://www.w3.org/1999/xhtml" dir=
"ltr">
5 <meta http-equiv=
"Content-Type" content=
"text/html;charset=utf-8" />
6 <title>Petter Reinholdtsen: entries from April
2016</title>
7 <link rel=
"stylesheet" type=
"text/css" media=
"screen" href=
"http://people.skolelinux.org/pere/blog/style.css" />
8 <link rel=
"stylesheet" type=
"text/css" media=
"screen" href=
"http://people.skolelinux.org/pere/blog/vim.css" />
9 <link rel=
"alternate" title=
"RSS Feed" href=
"04.rss" type=
"application/rss+xml" />
15 <a href=
"http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen
</a>
22 <h3>Entries from April
2016.
</h3>
26 <a href=
"http://people.skolelinux.org/pere/blog/syslog_trusted_timestamp___chain_of_trusted_timestamps_for_your_syslog.html">syslog-trusted-timestamp - chain of trusted timestamps for your syslog
</a>
32 <p>Two years ago, I had
33 <a href=
"http://people.skolelinux.org/pere/blog/Public_Trusted_Timestamping_services_for_everyone.html">a
34 look at trusted timestamping options available
</a>, and among
35 other things noted a still open
36 <a href=
"https://bugs.debian.org/742553">bug in the tsget script
</a>
37 included in openssl that made it harder than necessary to use openssl
38 as a trusted timestamping client. A few days ago I was told
39 <a href=
"https::/www.difi.no/">the Norwegian government office DIFI
</a> is
40 close to releasing their own trusted timestamp service, and in the
41 process I was happy to learn about a replacement for the tsget script
45 openssl ts -query -data "/etc/shells" -cert -sha256 -no_nonce \
46 | curl -s -H "Content-Type: application/timestamp-query" \
47 --data-binary "@-" http://zeitstempel.dfn.de
> etc-shells.tsr
48 openssl ts -reply -text -in etc-shells.tsr
51 <p>This produces a binary timestamp file (etc-shells.tsr) which can be
52 used to verify that the content of the file /etc/shell with the
53 calculated sha256 hash existed at the point in time when the request
54 was made. The last command extract the content of the etc-shells.tsr
55 in human readable form. The idea behind such timestamp is to be able
56 to prove using cryptography that the content of a file have not
57 changed since the file was stamped.
</p>
59 <p>To verify that the file on disk match the public key signature in
60 the timestamp file, run the following commands. It make sure you have
61 the required certificate for the trusted timestamp service available
62 and use it to compare the file content with the timestamp. In
63 production, one should of course use a better method to verify the
64 service certificate.
</p>
67 wget -O ca-cert.txt https://pki.pca.dfn.de/global-services-ca/pub/cacert/chain.txt
68 openssl ts -verify -data /etc/shells -in etc-shells.tsr -CAfile ca-cert.txt -text
71 <p>Wikipedia have a lot more information about
72 <a href=
"https://en.wikipedia.org/wiki/Trusted_timestamping">trusted
74 <a href=
"https://en.wikipedia.org/wiki/Linked_timestamping">linked
75 timestamping
</a>, and there are several trusted timestamping services
76 around, both as commercial services and as free and public services.
78 <a href=
"https://www.pki.dfn.de/zeitstempeldienst/">the
79 zeitstempel.dfn.de service
</a> mentioned above and
80 <a href=
"https://freetsa.org/">freetsa.org service
</a> linked to from the
81 wikipedia web site. I believe the DIFI service should show up on
82 https://tsa.difi.no, but it is not available to the public at the
83 moment. I hope this will change when it is into production. The
84 <a href=
"https://tools.ietf.org/html/rfc3161">RFC
3161</a> trusted
85 timestamping protocol standard is even implemented in LibreOffice,
86 Microsoft Office and Adobe Acrobat, making it possible to verify when
87 a document was created.
</p>
89 <p>I would find it useful to be able to use such trusted timestamp
90 service to make it possible to verify that my stored syslog files have
91 not been tampered with. This is not a new idea. I found one example
92 implemented on the Endian network appliances where
93 <a href=
"http://help.endian.com/entries/21518508-Enabling-Timestamping-on-log-files-">the
94 configuration of such feature was described in
2012</a>.
</p>
96 <p>But I could not find any free implementation of such feature when I
97 searched, so I decided to try to
98 <a href=
"https://github.com/petterreinholdtsen/syslog-trusted-timestamp">build
99 a prototype named syslog-trusted-timestamp
</a>. My idea is to
100 generate a timestamp of the old log files after they are rotated, and
101 store the timestamp in the new log file just after rotation. This
102 will form a chain that would make it possible to see if any old log
103 files are tampered with. But syslog is bad at handling kilobytes of
104 binary data, so I decided to base64 encode the timestamp and add an ID
105 and line sequence numbers to the base64 data to make it possible to
106 reassemble the timestamp file again. To use it, simply run it like
110 syslog-trusted-timestamp /path/to/list-of-log-files
113 <p>This will send a timestamp from one or more timestamp services (not
114 yet decided nor implemented) for each listed file to the syslog using
115 logger(
1). To verify the timestamp, the same program is used with the
119 syslog-trusted-timestamp --verify /path/to/log-file /path/to/log-with-timestamp
122 <p>The verification step is not yet well designed. The current
123 implementation depend on the file path being unique and unchanging,
124 and this is not a solid assumption. It also uses process number as
125 timestamp ID, and this is bound to create ID collisions. I hope to
126 have time to come up with a better way to handle timestamp IDs and
127 verification later.
</p>
130 <a href=
"https://github.com/petterreinholdtsen/syslog-trusted-timestamp">the
131 prototype for syslog-trusted-timestamp on github
</a> and send
132 suggestions and improvement, or let me know if there already exist a
133 similar system for timestamping logs already to allow me to join
134 forces with others with the same interest.
</p>
136 <p>As usual, if you use Bitcoin and want to show your support of my
137 activities, please send Bitcoin donations to my address
138 <b><a href=
"bitcoin:15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b">15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b
</a></b>.
</p>
144 Tags:
<a href=
"http://people.skolelinux.org/pere/blog/tags/english">english
</a>,
<a href=
"http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet
</a>.
149 <div class=
"padding"></div>
151 <p style=
"text-align: right;"><a href=
"04.rss"><img src=
"http://people.skolelinux.org/pere/blog/xml.gif" alt=
"RSS Feed" width=
"36" height=
"14" /></a></p>
162 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2016/01/">January (
3)
</a></li>
164 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2016/02/">February (
2)
</a></li>
166 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2016/03/">March (
3)
</a></li>
168 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2016/04/">April (
1)
</a></li>
175 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2015/01/">January (
7)
</a></li>
177 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2015/02/">February (
6)
</a></li>
179 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2015/03/">March (
1)
</a></li>
181 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2015/04/">April (
4)
</a></li>
183 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2015/05/">May (
3)
</a></li>
185 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2015/06/">June (
4)
</a></li>
187 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2015/07/">July (
6)
</a></li>
189 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2015/08/">August (
2)
</a></li>
191 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2015/09/">September (
2)
</a></li>
193 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2015/10/">October (
9)
</a></li>
195 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2015/11/">November (
6)
</a></li>
197 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2015/12/">December (
3)
</a></li>
204 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2014/01/">January (
2)
</a></li>
206 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2014/02/">February (
3)
</a></li>
208 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2014/03/">March (
8)
</a></li>
210 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2014/04/">April (
7)
</a></li>
212 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2014/05/">May (
1)
</a></li>
214 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2014/06/">June (
2)
</a></li>
216 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2014/07/">July (
2)
</a></li>
218 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2014/08/">August (
2)
</a></li>
220 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2014/09/">September (
5)
</a></li>
222 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2014/10/">October (
6)
</a></li>
224 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2014/11/">November (
3)
</a></li>
226 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2014/12/">December (
5)
</a></li>
233 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2013/01/">January (
11)
</a></li>
235 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2013/02/">February (
9)
</a></li>
237 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2013/03/">March (
9)
</a></li>
239 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2013/04/">April (
6)
</a></li>
241 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2013/05/">May (
9)
</a></li>
243 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2013/06/">June (
10)
</a></li>
245 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2013/07/">July (
7)
</a></li>
247 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2013/08/">August (
3)
</a></li>
249 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2013/09/">September (
5)
</a></li>
251 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2013/10/">October (
7)
</a></li>
253 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2013/11/">November (
9)
</a></li>
255 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2013/12/">December (
3)
</a></li>
262 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2012/01/">January (
7)
</a></li>
264 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2012/02/">February (
10)
</a></li>
266 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2012/03/">March (
17)
</a></li>
268 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2012/04/">April (
12)
</a></li>
270 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2012/05/">May (
12)
</a></li>
272 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2012/06/">June (
20)
</a></li>
274 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2012/07/">July (
17)
</a></li>
276 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2012/08/">August (
6)
</a></li>
278 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2012/09/">September (
9)
</a></li>
280 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2012/10/">October (
17)
</a></li>
282 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2012/11/">November (
10)
</a></li>
284 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2012/12/">December (
7)
</a></li>
291 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2011/01/">January (
16)
</a></li>
293 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2011/02/">February (
6)
</a></li>
295 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2011/03/">March (
6)
</a></li>
297 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2011/04/">April (
7)
</a></li>
299 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2011/05/">May (
3)
</a></li>
301 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2011/06/">June (
2)
</a></li>
303 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2011/07/">July (
7)
</a></li>
305 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2011/08/">August (
6)
</a></li>
307 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2011/09/">September (
4)
</a></li>
309 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2011/10/">October (
2)
</a></li>
311 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2011/11/">November (
3)
</a></li>
313 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2011/12/">December (
1)
</a></li>
320 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2010/01/">January (
2)
</a></li>
322 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2010/02/">February (
1)
</a></li>
324 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2010/03/">March (
3)
</a></li>
326 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2010/04/">April (
3)
</a></li>
328 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2010/05/">May (
9)
</a></li>
330 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2010/06/">June (
14)
</a></li>
332 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2010/07/">July (
12)
</a></li>
334 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2010/08/">August (
13)
</a></li>
336 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2010/09/">September (
7)
</a></li>
338 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2010/10/">October (
9)
</a></li>
340 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2010/11/">November (
13)
</a></li>
342 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2010/12/">December (
12)
</a></li>
349 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2009/01/">January (
8)
</a></li>
351 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2009/02/">February (
8)
</a></li>
353 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2009/03/">March (
12)
</a></li>
355 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2009/04/">April (
10)
</a></li>
357 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2009/05/">May (
9)
</a></li>
359 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2009/06/">June (
3)
</a></li>
361 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2009/07/">July (
4)
</a></li>
363 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2009/08/">August (
3)
</a></li>
365 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2009/09/">September (
1)
</a></li>
367 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2009/10/">October (
2)
</a></li>
369 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2009/11/">November (
3)
</a></li>
371 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2009/12/">December (
3)
</a></li>
378 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2008/11/">November (
5)
</a></li>
380 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2008/12/">December (
7)
</a></li>
391 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (
13)
</a></li>
393 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/amiga">amiga (
1)
</a></li>
395 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/aros">aros (
1)
</a></li>
397 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/bankid">bankid (
4)
</a></li>
399 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/bitcoin">bitcoin (
9)
</a></li>
401 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (
15)
</a></li>
403 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/bsa">bsa (
2)
</a></li>
405 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/chrpath">chrpath (
2)
</a></li>
407 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/debian">debian (
122)
</a></li>
409 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (
154)
</a></li>
411 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/digistan">digistan (
10)
</a></li>
413 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/dld">dld (
15)
</a></li>
415 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/docbook">docbook (
20)
</a></li>
417 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/drivstoffpriser">drivstoffpriser (
4)
</a></li>
419 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/english">english (
306)
</a></li>
421 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (
23)
</a></li>
423 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (
12)
</a></li>
425 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/freeculture">freeculture (
25)
</a></li>
427 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/freedombox">freedombox (
9)
</a></li>
429 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/frikanalen">frikanalen (
16)
</a></li>
431 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/h264">h264 (
20)
</a></li>
433 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/intervju">intervju (
42)
</a></li>
435 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/isenkram">isenkram (
11)
</a></li>
437 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/kart">kart (
19)
</a></li>
439 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/ldap">ldap (
9)
</a></li>
441 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/lenker">lenker (
8)
</a></li>
443 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/lsdvd">lsdvd (
2)
</a></li>
445 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (
1)
</a></li>
447 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/mesh network">mesh network (
8)
</a></li>
449 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (
37)
</a></li>
451 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/nice free software">nice free software (
7)
</a></li>
453 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/norsk">norsk (
273)
</a></li>
455 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/nuug">nuug (
177)
</a></li>
457 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/offentlig innsyn">offentlig innsyn (
22)
</a></li>
459 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/open311">open311 (
2)
</a></li>
461 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (
58)
</a></li>
463 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/personvern">personvern (
92)
</a></li>
465 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/raid">raid (
1)
</a></li>
467 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/reactos">reactos (
1)
</a></li>
469 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/reprap">reprap (
11)
</a></li>
471 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/rfid">rfid (
3)
</a></li>
473 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/robot">robot (
9)
</a></li>
475 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/rss">rss (
1)
</a></li>
477 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/ruter">ruter (
4)
</a></li>
479 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/scraperwiki">scraperwiki (
2)
</a></li>
481 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (
46)
</a></li>
483 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (
4)
</a></li>
485 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/skepsis">skepsis (
4)
</a></li>
487 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/standard">standard (
49)
</a></li>
489 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (
3)
</a></li>
491 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/stortinget">stortinget (
10)
</a></li>
493 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/surveillance">surveillance (
36)
</a></li>
495 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/sysadmin">sysadmin (
2)
</a></li>
497 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/usenix">usenix (
2)
</a></li>
499 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/valg">valg (
8)
</a></li>
501 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/video">video (
55)
</a></li>
503 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (
4)
</a></li>
505 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/web">web (
38)
</a></li>
511 <p style=
"text-align: right">
512 Created by
<a href=
"http://steve.org.uk/Software/chronicle">Chronicle v4.6
</a>