Chapter 7: Logs that forget

Why

Your resolver already keeps no record of the names you look up (chapter 4). But the server itself writes logs: every SSH attempt, every service start, often with IP addresses. Ubuntu keeps those on disk with no time limit by default. A "no logs" promise is only true if it's true on the server, so this chapter makes the system log live in memory only, and forget within a day.

What you need

• The server from chapter 3.
• About 15 minutes (our estimate).

Steps

All on the server.

1. The system log in memory only, under 24 hours

sudo install -d -m 0755 /etc/systemd/journald.conf.d
sudo nano /etc/systemd/journald.conf.d/zz-privacy.conf

Paste:

[Journal]
Storage=volatile
RuntimeMaxUse=64M
MaxRetentionSec=22h
MaxFileSec=1h
ForwardToSyslog=no

What each line does:

• Storage=volatile: the log lives in memory (/run/log/journal) and is gone after a restart.
• RuntimeMaxUse=64M: at most 64 MB of memory for it.
• MaxRetentionSec=22h, MaxFileSec=1h: the log is cut into one-hour pieces, and pieces older than 22 hours are deleted. So nothing is older than about a day.
• ForwardToSyslog=no: nothing is passed on to the classic log files.

Why the name starts with zz-: settings files are read in alphabetical order, and the last one wins. Ubuntu ships its own file, syslog.conf, that turns ForwardToSyslog back on. Yours must sort after it.

2. Switch off the classic log files

rsyslog writes /var/log/syslog and /var/log/auth.log, which keep growing on disk. Switch it off for good:

sudo systemctl disable --now rsyslog.service || true
sudo systemctl stop syslog.socket || true
sudo systemctl mask rsyslog.service syslog.socket
sudo systemctl restart systemd-journald

• mask makes sure no update or other program can start it again.
• || true: if your Ubuntu doesn't have rsyslog installed, the first two lines print an error. That's fine; carry on.

3. Delete what was written before

This can't be undone:

sudo rm -rf /var/log/journal
sudo rm -f /var/log/syslog /var/log/syslog.* /var/log/auth.log /var/log/auth.log.* \
           /var/log/kern.log /var/log/kern.log.*

How you know it worked

1. Your setting wins:

   systemd-analyze cat-config systemd/journald.conf | grep -E '^ForwardToSyslog='

   The last line shows ForwardToSyslog=no.

2. The log is in memory, not on disk: /run/log/journal exists, /var/log/journal doesn't:

   ls -d /run/log/journal /var/log/journal

   shows the first, and "No such file or directory" for the second.

3. No classic log files come back:

   ls /var/log | grep -E 'syslog|auth.log'

   shows nothing, also after a day.

4. The log still works:

   logger -t privacy-check "test" && journalctl -t privacy-check -n 1

   shows your test line.

5. After a day, nothing is older than a day:

   journalctl --no-pager -o short-iso | head -3

   The first entries shown are the oldest, and their time is less than 24 hours ago.

Pitfalls

• Ubuntu's own syslog.conf turns forwarding back on, and is read after a file named 90-…. Our first file was named that way and lost. Always check which setting wins (check 1).
• sshd logs every scanner, if it can see them. Bots try to log in to every server on the internet, and each attempt is logged with its address. The firewall from chapter 3 keeps them out, but only if it's attached. Before ours was, the log filled up within hours.
• No Fail2ban. It's a popular tool against those bots, but it keeps lists of IP addresses. The firewall already keeps SSH closed to everyone but you.
• Login records are kept separately. Ubuntu also keeps a record of logins (the last command shows it), outside this log. With the firewall in place it holds only your own SSH logins.

Time and cost

• About 15 minutes (our estimate).
• Free.

---

Previous: Chapter 6: Block lists that update themselves · Next: Chapter 8: Your iPhone and Mac

Text: CC BY-SA 4.0 · Commands and configs: CC0