mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-07-23 01:05:40 +02:00
Mike Reeves
ad78e84ccd
PostgreSQL's log_min_error_statement defaults to 'error', so whenever a CREATE/ALTER ROLE ... PASSWORD statement errored, the full statement text -- including the plaintext password -- was written to /opt/so/log/postgres/postgres.log. The role-provisioning paths (init-db.sh for so_postgres, so-telegraf-postgres for per-minion telegraf roles) both dispatch such DDL, the latter on every state.apply. - init-db.sh / so-telegraf-postgres: SET log_min_error_statement = panic before the password-bearing DDL so an error no longer emits the STATEMENT line. The ERROR message itself (no password) still logs, preserving debuggability. - logrotate: add a postgres stanza (daily, keep 14, copytruncate, compress) so postgres.log is rotated like every other service and leaked content can't persist indefinitely. copytruncate is required because the container holds the log open via redirected stderr. - soup: scrub any already-logged PASSWORD lines from postgres.log during post_to_3.2.0, rewriting in place to preserve the inode postgres is writing to.
269 lines
5.2 KiB
YAML
269 lines
5.2 KiB
YAML
logrotate:
|
|
config:
|
|
/opt/so/log/nginx/*_x_log:
|
|
- daily
|
|
- rotate 14
|
|
- missingok
|
|
- copytruncate
|
|
- compress
|
|
- create
|
|
- extension .log
|
|
- dateext
|
|
- dateyesterday
|
|
/opt/so/log/soc/*_x_log:
|
|
- daily
|
|
- rotate 14
|
|
- missingok
|
|
- copytruncate
|
|
- compress
|
|
- create
|
|
- extension .log
|
|
- dateext
|
|
- dateyesterday
|
|
/opt/so/log/kratos/*_x_log:
|
|
- daily
|
|
- rotate 14
|
|
- missingok
|
|
- copytruncate
|
|
- compress
|
|
- create
|
|
- extension .log
|
|
- dateext
|
|
- dateyesterday
|
|
/opt/so/log/hydra/*_x_log:
|
|
- daily
|
|
- rotate 14
|
|
- missingok
|
|
- copytruncate
|
|
- compress
|
|
- create
|
|
- extension .log
|
|
- dateext
|
|
- dateyesterday
|
|
/opt/so/log/kibana/*_x_log:
|
|
- daily
|
|
- rotate 14
|
|
- missingok
|
|
- copytruncate
|
|
- compress
|
|
- create
|
|
- extension .log
|
|
- dateext
|
|
- dateyesterday
|
|
/opt/so/log/influxdb/*_x_log:
|
|
- daily
|
|
- rotate 14
|
|
- missingok
|
|
- copytruncate
|
|
- compress
|
|
- create
|
|
- extension .log
|
|
- dateext
|
|
- dateyesterday
|
|
/opt/so/log/elastalert/*_x_log:
|
|
- daily
|
|
- rotate 14
|
|
- missingok
|
|
- copytruncate
|
|
- compress
|
|
- create
|
|
- extension .log
|
|
- dateext
|
|
- dateyesterday
|
|
/opt/so/log/soctopus/*_x_log:
|
|
- daily
|
|
- rotate 14
|
|
- missingok
|
|
- copytruncate
|
|
- compress
|
|
- create
|
|
- extension .log
|
|
- dateext
|
|
- dateyesterday
|
|
/opt/so/log/elasticsearch/*indices-delete*_x_log:
|
|
- daily
|
|
- rotate 14
|
|
- missingok
|
|
- copytruncate
|
|
- compress
|
|
- create
|
|
- extension .log
|
|
- dateext
|
|
- dateyesterday
|
|
/opt/so/log/elasticagent/*_x_log:
|
|
- daily
|
|
- rotate 14
|
|
- missingok
|
|
- copytruncate
|
|
- compress
|
|
- create
|
|
- extension .log
|
|
- dateext
|
|
- dateyesterday
|
|
/opt/so/log/elasticagent/*_x_ndjson:
|
|
- daily
|
|
- rotate 14
|
|
- missingok
|
|
- copytruncate
|
|
- compress
|
|
- create
|
|
- extension .ndjson
|
|
- dateext
|
|
- dateyesterday
|
|
/opt/so/log/elasticfleet/*_x_log:
|
|
- daily
|
|
- rotate 14
|
|
- missingok
|
|
- copytruncate
|
|
- compress
|
|
- create
|
|
- extension .log
|
|
- dateext
|
|
- dateyesterday
|
|
/opt/so/log/elasticfleet/*_x_ndjson:
|
|
- daily
|
|
- rotate 14
|
|
- missingok
|
|
- copytruncate
|
|
- compress
|
|
- create
|
|
- extension .ndjson
|
|
- dateext
|
|
- dateyesterday
|
|
/opt/so/log/suricata/*_x_log:
|
|
- daily
|
|
- rotate 14
|
|
- missingok
|
|
- copytruncate
|
|
- compress
|
|
- create
|
|
- extension .log
|
|
- dateext
|
|
- dateyesterday
|
|
/opt/so/log/mysql/*_x_log:
|
|
- daily
|
|
- rotate 14
|
|
- missingok
|
|
- copytruncate
|
|
- compress
|
|
- create
|
|
- extension .log
|
|
- dateext
|
|
- dateyesterday
|
|
/opt/so/log/postgres/*_x_log:
|
|
- daily
|
|
- rotate 14
|
|
- missingok
|
|
- copytruncate
|
|
- compress
|
|
- create
|
|
- extension .log
|
|
- dateext
|
|
- dateyesterday
|
|
/opt/so/log/telegraf/*_x_log:
|
|
- daily
|
|
- rotate 14
|
|
- missingok
|
|
- copytruncate
|
|
- compress
|
|
- create
|
|
- extension .log
|
|
- dateext
|
|
- dateyesterday
|
|
/opt/so/log/redis/*_x_log:
|
|
- daily
|
|
- rotate 14
|
|
- missingok
|
|
- copytruncate
|
|
- compress
|
|
- create
|
|
- extension .log
|
|
- dateext
|
|
- dateyesterday
|
|
/opt/so/log/sensoroni/*_x_log:
|
|
- daily
|
|
- rotate 14
|
|
- missingok
|
|
- copytruncate
|
|
- compress
|
|
- create
|
|
- extension .log
|
|
- dateext
|
|
- dateyesterday
|
|
/opt/so/log/salt/so-salt-minion-check:
|
|
- daily
|
|
- rotate 14
|
|
- missingok
|
|
- copytruncate
|
|
- compress
|
|
- create
|
|
- extension .log
|
|
- dateext
|
|
- dateyesterday
|
|
/opt/so/log/salt/minion:
|
|
- daily
|
|
- rotate 14
|
|
- missingok
|
|
- copytruncate
|
|
- compress
|
|
- create
|
|
- extension .log
|
|
- dateext
|
|
- dateyesterday
|
|
/opt/so/log/salt/master:
|
|
- daily
|
|
- rotate 14
|
|
- missingok
|
|
- copytruncate
|
|
- compress
|
|
- create
|
|
- extension .log
|
|
- dateext
|
|
- dateyesterday
|
|
/nsm/idh/*_x_log:
|
|
- daily
|
|
- rotate 14
|
|
- missingok
|
|
- copytruncate
|
|
- compress
|
|
- create
|
|
- extension .log
|
|
- dateext
|
|
- dateyesterday
|
|
/opt/so/log/playbook/*_x_log:
|
|
- daily
|
|
- rotate 14
|
|
- missingok
|
|
- copytruncate
|
|
- compress
|
|
- create
|
|
- extension .log
|
|
- dateext
|
|
- dateyesterday
|
|
- su root socore
|
|
/nsm/strelka/log/strelka_x_log:
|
|
- daily
|
|
- rotate 14
|
|
- missingok
|
|
- copytruncate
|
|
- compress
|
|
- create
|
|
- extension .log
|
|
- dateext
|
|
- dateyesterday
|
|
/opt/so/log/sensor_clean_x_log:
|
|
- daily
|
|
- rotate 2
|
|
- missingok
|
|
- nocompress
|
|
- create
|
|
- sharedscripts
|
|
/opt/so/log/agents/agent-monitor*_x_log:
|
|
- daily
|
|
- rotate 14
|
|
- missingok
|
|
- compress
|
|
- create
|
|
- extension .log
|
|
- dateext
|
|
- dateyesterday |