For any Linux user, it's a circular to be no knowledgeable in the use of the look files here.
So look was store information about events that occurred when the operating system and applications
are run, so including any errors and security errors, of course.
So your system will log information automatically based on the series of rules that I will show show
you how to configure in this elections.
So I think this lecture will know this section of our Udemy course will be to lecture sexually.
So as a hacker, the log files can be a trail to your target activities and identify identity.
So but it can also be a trail to your own activities on someone else's system.
So a hacker training for needs to know what information they can gather, as well as what can be gathered
about their own actions and the methods in order to hide that evidence here.
So on the other side, an insecure and an annual securing the new systems needs to know how to manage
the logging functions to determine whether a system has been attacked and then decipher what actually
happened and who did it so well.
This, therefore, shows you how to fix a mine and configure log files, as well as how to remove evidence
of your activity and even disable Loading all together.
So first, we will look at the damage that, uh, doesn't uh, does the logging.
So there are six log logging down, so Linux is a Linux user that Diamond called us.
See, you say, look, they're here.
So to automatically log in once on your computer simulation of cease logging coding since launching
here, including our seas, look here and our seas look.
Actually, since log energy here, we have actually so are used on different distributions of Linux,
so were thought they operate very similarly.
And some minor differences exist, of course.
So since color Linux is built on Debian and Debian comes with RCC, look here.
By default, we focus on that to achieve this lecture here.
So if you want to use other distributions, it's what, uh, doing a little research on the old logging
systems.
So let's take a look at our, uh uh, our system, a log on our system here.
We will search for all files related to our seas.
Look here first, open a terminal in Cali and enter here.
Locate our c c look here.
So as you can see, numerous files can contain the key word cease.
Look here.
So, uh, some of which are more useful than others.
Uh, the one we want to examine is the configuration file.
Our seas look confused, so they are this low configuration file.
Like nearly every application in Linux, our log is managed and configured by a plaintext configuration
file located as a as is generally the case on Linux.
So in the ATC Here directory, in the case of, uh, our seas look here.
The configuration file is located at ATC Arceus.
Look that conf uh, and open that file in with any text editor here.
For example, mousepad, um, mousepad ATC.
Uh, our our c c log here that can fill.
And as you can see here, we opened this file, so it's read on, as you can see here, if we want to
change, you should use this system for us was using pseudo command for root right here.
So.
You shall see a text file like that.
Uh, so as you can see there, you see here, then our seats look, uh, that configuration file comes
well documented with, uh, numerous, uh, numerous comments explaining its use.
So much of this information will not be useful to you at this moment, but if you navigate down, believe,
uh, to line here, uh, fifty one.
Or 49 here, you will find the rules here.
As you can see here, uh, so this is where you can set the rules for what your system will automatically
look for you.
So our um, sea slug, uh, logging groups here, then artists, uh, log in their rules, determine
what kind of information is logged.
So you know what programs have their messages logged and where that log is stored as a hacker?
This allows you to find out what is being logged and varied.
Dos logs are written so you can delete or upskill them.
Scroll it, align to.
56 here, and you should see something like this here.
So each line is a separate looking role here.
Uh, that that says what messages are locked and where where, uh, they are locked here.
The basic format for these rules is, for example, um, facility priority here.
And the action here like that.
So the physiologically word references the programs such as such as meal here, as you can see here,
male like Colonel or Ielpi are like this here.
Colonel Ielpi are here.
Uh, so.
And the priority queue, what determines what kind of messages to look for that program?
So the action keyword here.
As you can see here, action and priority, um.
Uh, on the far right here, as you can see here, action keyword here, uh, references the location
where, uh, the log vehicle was sent here.
As you can see, there is there where our logs will be sent.
Let's look at each section more closely beginning there, no course.
So beginning the UM facility, the key word here, as you can see, there is a specific keywords here
and which refers to whatever software is generating the look, whether that's criminal, the mail system
or the user here.
So the following here, as you can see here, is a, for example.
Uh, out of here is, uh, security authorization messages, for example, a Quran here is cloak diamonds
and colonel.
Here is colonel messages.
Uh, diamond.
Here is other diamonds, which stores as you can see.
What a long time I'll look here and I'll pair is means, um, printing system here.
Uh, mail is, as you know, mail, uh, use their mail system here and this is them their generic user
level, uh, here.
So.
You can select more than one facility by listing them separately by coming here.
So the two terms the system, what kinds of messages to lock you?
So.
For example, cuts are listed from lowest priorities starting at the back to highest priority ending
panic here.
So if it's a priority here is, uh, like that messages of our priorities are logged.
So when you specify your priority messages of that priority and hires are logged, for instance, if
you specify a priority code alert, the system will log messages classified as alert and a higher priority.
But it won't look messages marked as Crete or any, uh, any prior to lower than the alert here.
So first thing, I want to show you how priorities here and priority names here.
So, um.
And here is 12 priorities, I think so.
The first is Denmark.
Yes, there is a.
Um, actually.
Nine.
Yes, they bark here.
Uh, info notice here.
Uh, warning the barn and roof air.
Create alert, merge panic element here.
So the court's warning?
One.
So there is the not most priorities here, for example.
The bug is the motivator.
Priorities in for little would be enforce priorities bigger than in the bank and not his priority is
bigger than info.
Priority priorities bigger than not is like that and the most prioritized.
Um, this message we're looking at is panic.
So.
For example, there is the burning barn here where some barn.
Oops!
Warning, uh, one morning.
Uh.
Actually not warning, you know, one.
Raw.
Air and emerge here, um.
And panic here have all been deprecated and shall not be used, so if you want to use it, the action
is usually a file name and the location where the looks should be sent.
So.
Don't save, so we don't want to save.
It's just a note here.
So not at the general outlook for us are sent to VAR look directory.
So um.
With a file name, of course, that describes the facility that generated them, such as that out here,
like that?
Yeah, out.
Or Colonel meal like that.
As you can see here.
Uh, this means, for example, that looks generated by the old facility will be sent to VAR, log out
that lock here.
So, uh, we can, uh, see the worm our mail looks cause, uh, VAR log mail that work here.
Uh, so like that, for example.
Actually, let's look out here, so.
Yeah, we can clean automatically, upload speed logo, look, rotate here, so look, look files takes
up space, so if you don't delete them, so actually, I um forgot to mention you are so you can change
this look was the direction here.
For example, if you want to save your mail, look uh, to your home directory.
You can change it here, but I will not change any of it.
So.
Now you can also automatically clean up looks with a local road to.
The log rotate command to look fires takes take up space, so if you don't delete them periodically,
they will eventually fill your entire hard drive.
On the other hand, if you delete your log fast or frequently, you won't have logs to investigate at
some future point in time so you can use log, but rotate.
A little later to determine the balance between the opposing requirements, by opposing the requirements,
by rotating your blocks, so log rotation is the process of recovery archiving look fast by moving them
to some other location.
So leaving you with a fresh look, find that archive now.
Location will get cleaned up after a specific, specific specified period of time, so your system is
already rotating log files using your current job.
So that employs the local state utility so you can configure the log rotate utility to choose the regularity
of your log rotation with ATC Log Rotate Call Mantgem.
It's um, so let's open it with a text editor sudo mousepad ATC log rotate here call.
And you can see here we can see our little rate configuration file.
So now let's talk about them.
So first is virtually as quickly as you can see these comments here so quickly.
What is very clear, first, you can see that the unit or unit of time you wrote it, numbers refer
to this here.
For example, the default here is weekly.
Meaning any number after the rotate keyword always referred to weeks.
So I'm further down, you can see the settings.
How often rotate locks, locks here.
Uh, the default setting is to rotate logs every four weeks.
Um, here.
So this default configuration will work for most people.
But if you want to keep your locks longer for investigative purposes or, uh, shorter to clean, uh,
them out quicker, this is the setting you should change so you can so you can change its here.
So, for instance, if you check your log files every week and want to save storage space, you could
change the setting to rotate one here.
But I will leave it as it is.
So if you have a plenty of storage for your looks and want to keep semi-permanent or record for forensic
analysis later, you could change the setting to rotate, for example, to save to keep your logs for
six months or rotate it to to keep them for one year.
Yeah.
So by default, the same plan and you look file is created when old ones are rotated out here, as you
can see, create here.
So as the comments in the configuration file advice.
Uh, you can also choose the competition, uh, route rotated, uh, rotated, look, file, see it
as you can see your compass, but it's common here and this means there's, uh, uncompressed look fancier
at the end of the rotation period.
The log files are named and pushed, uh, towards the end of the chain of logs as a new look file is
created, uh, replacing the current look for, for instance, VAR log out will become, uh, VAR log
out one, then VAR log out too.
And so if you rotate logs every four weeks and keep keep for a set of backups, you will have VAR log
out for about no VAR log out five, meaning that VAR log out four will be deleted rather than being
pushed to look out five.
So you can see this by using the look at common to find, um, out log log files with the wildcard here,
for example.
Let's find.
Locate, as we a layer of our law clear out that log and then quiet, as you can see here, we have
to outlook one and outlook to hear.
So for more details on the many ways to customize and use the log rotate, utilities say the MEN and
log will rotate while the log rotate page here, as you can see here.
So, uh, as you know, man, is there help, uh, documentation for every couple months in links?
Uh, so we discussed that in previous elections so far.
So this is an excellent resource to learn about the functions you can use and the variables we can change
to customize how your looks are handled.
So I once you become more familiar with Linux, you will get a better sense of how often you need to
log and what options you prefer.
So it's worth revisiting the logo.
Rotate that configuration file.
Remaining still, Tim, actually, I won't look at home, I mean, spend time, OK, remaining Stilton,
once you have compromised the learning system, it's useful to disable logging and remove any evidence
of your intrusion into look files to reduce the chances chances of detection.
So there are many ways to do this, and each carrier's its own risks and level of reliability so we
can remove evidence and others here.
So first, you will want to remove any locks offshore activity so you can't simply open the log files
and press a slim remove annual looks that healing your activity line by line using the file, the deletions
techniques you learned in previously the previous lectures.
So which will look, however, in here this could be time consuming, all the time gaps in the workforce,
which would look suspicious.
Also, deleted files can generally be recorded by a skilled forensics investigator.
A better and more secure solution is to shred the log facts with other file deletion systems.
A skilled investigator is still able to recover the deleted files.
But suppose the way, uh, was a way to delete the file and override as several times making it much
harder to recover.
Lucky for us, Linux has built in command, appropriately named, uh, right here for justice purpose.
So to understand how the red command's work.
Take a quick look at help screen here red.
Should help.
So as you can see here, shreds once on file.
So when it sounds credible, will delete the file and overwrite it several times by default or shred
by default, shred all rights four times.
So general, the more times the file is overwritten, the harder it is to recover.
But keep in mind that each override takes time.
So for very large files, shredding may become time-consuming.
Uh, so two useful options to include are the if option, which means the permissions on the files to
everything if a permission change is necessary and in an option here in, uh, in option.
Which lets you choose how many times all right fails as an example with a shred log files ten times
or using, for example, shred, uh, pseudo read.
Um, if and in ten times so VAR log out will look.
It.
So we need the option to give us a permission to spread out fast and be full of the an option, which
is desired number of number of times to operate.
So after the head of the file, we want to shred being called the Volcker SSX, so we are shredding
not just about that look file.
We are also shredding and look for that have been created with low grade such as Outlook one, Outlook
two, outlook and so on.
So now.
Once shredded, a valuable said that, um.
Contents are in desperate and gibberish, yeah, I saw Mouse Pad Bar long hair out, long one.
It's permissions denied pseudo here, so you can see here there's nothing to see because it's silly
to know.
So no, the security engineer or forensics investigator examines the look files and they will find nothing
of use because none of its of its recoverable.
So now we can.
I want less last limb.
Let's disable logging here, and there are options for recovering or tracks is too simple disable logging,
uh, when a hiker takes control of the system and they could immediately disable logging to prevent
system from keeping track of their activities.
This, of course, requires route closures.
So this to disable all logging.
Uh, the hacker called simplicity of the Irish Sea SEAL Log Diamond Um and stopping and servicing Linux
uses the same syntax here.
Service here I will write syntax here.
Cell service name and start.
Stop or restart it.
So to stop the looking down on you called simply enter here service, so it's, uh, Cecil, look,
stop here.
And it is need, uh, root privileges here.
Enter your account password.
Um, and as you can see here, we just stopped, uh, see smoke.
Yeah.
Now, nukes will stop generating and look fires under the services restarted, enabling you to operate
without leaving behind any evidence in the low profile, so start there.
So and here you can start and serious like that, log files track nearly everything that happens when
your learning system.
They can be invaluable resource in trying to analyze what has occurred, whether it be malfunction or
heck.
So for the hacker, look files can be evidence of their activities and their identity.
So how we were and as true to Hacker, can remove and shred these files and disable logging entirely.
So just leaving no evidence behind.