Encrypting, sanitizing, and signing log files
Log files are useful for understanding server usage patterns and troubleshooting problems, but they can also contain sensitive data like attribute values that might appear in entry DNs or search filters. To protect against this, the server can log to encrypted files.
File-based loggers include the following configuration properties to control this.
Property | Description |
---|---|
|
Indicates whether the log file should be encrypted. |
|
Specifies the ID of the encryption settings definition that should be used to obtain the encryption key. If this is not specified, then the preferred definition is used. |
If you need to access data in an encrypted log file, then the encrypt-file
tool can be used to decrypt its content. This tool is discussed in more detail in the encrypt-file tool section. However, it might not be necessary to decrypt log files to be able to use them. Both the search-logs
and summarize-access-log
tools both provide support for operating on encrypted and compressed log files.
In most cases, no special handling is needed, because the log data is encrypted with a definition from the server’s encryption settings database, and the tool can obtain the appropriate definition from that database. However, if the encryption settings database is not available, such as if the tool is run from a system other than the one on which the server is running, or no longer contains the definition that was used to encrypt the log file, then the --encryptionPassphraseFile
argument can be used to specify the passphrase used to generate that definition.
For additional information, see the config/sample-dsconfig-batch-files/create-encrypted-loggers.dsconfig
batch file.