Lion Cipher Lab
Make logs tamper-evident: append-only and immutable files even root can't quietly edit
- Cyber / Security Engineer
- Intermediate
- Free · no account required
Why it matters
An attacker who lands root almost always tries to erase their trail — delete the auth log, blank out a shell history, edit a line out of the middle of a file. Standard Unix permissions can't stop root from doing any of that. Linux ext filesystems have a second, separate layer of file attributes that CAN: the append-only flag lets new lines be added but blocks truncation, in-place edits, deletion, and renaming; the immutable flag freezes a file completely. Setting them on your logs and critical configs turns a silent wipe into a loud, failed operation — a speed bump and a tripwire. Knowing…
What you'll learn
- ext2/3/4 file attributes (chattr, lsattr)
- append-only (+a) vs immutable (+i)
- log tamper-resistance on Linux
- reasoning about the limits of on-box integrity controls
- planning log rotation around locked files
Steps in this lab
- The idea: a second lock that even root obeys
- Confirm you're on ext4 and set up a target
- MEASURE the 'before': as root, you can wipe the log freely
- Set append-only on the log, immutable on the config
- Inspect with lsattr — see the flags
- MEASURE the 'after': prove the lock holds — even as root
- The logrotate gotcha — and how to handle it
- The honest limit: root can undo this — so this is a tripwire, not a vault
- Clean up