The first half of the year was a network security audit with a client, and WiFi's logs were almost gone. The auditors turned it so thin that even some NAT logs from a point in time a month ago could be checked out. That experience made me realize that if the logs were just to keep it,"On the functional."I'm not serious."How can you stand the test?"The check came mostly with a busy hand.
The logs are stored but incomplete, the most common problem.
Many WiFi certification systems are written in promotional material."Full Record Web Log""Support for retroactive audits"But when you do, it's called"Complete"Not exactly what you understand.
The most typical missing is the NAT log. The WiFi certification system needs to be able to trace it back to the compliance requirements."What account number, when, which IP and port of the Internet, what target was visited?"The Radius certification log only records when the user has certified it and what IP is assigned. What you need is a conversion log on the export of NAT equipment.——The IP-to-public IP and port mapping relationships.
But many WiFi certification systems have decoupled from NAT equipment, which does not know the conversion records of NAT and whose IP is behind it. To connect them, either by installing Syslog on the NAT device to the HLB platform or by doing a correlation analysis of Radius Accoutring’s message in the authentication system.
Is it long enough to keep the log?
Different settings require different lengths of time to keep a log. If it is just an internal WiFi, it usually requires six months; if Internet access is involved, such as hotels and cafes, the requirements for local netting are stricter, some requiring 12 months or more.
The pits are stored costs. Assuming that a million logs are generated every day, an average of 500 bytes per log is five trillion by one day or about 180 G/year. Not much sounds to be said, but with NAT logs, certification logs, billing logs, Portal access logs, and management operations audit logs, the actual amount of data produced may be three to five times as many. If you use cloud servers, the cost of hard disk expansion needs to be factored in early.
The bigger problem is the ability to log queries."Last month, at 15th, between 3 p.m. and 4 p.m., IP addresses were accessed by users of a certain section of the network.". If the logs are too big and not indexed, this query may not be able to run for ten minutes. Once we checked the site, it was stuck and an emergency time-based search optimization script was written to get out of hand. Then I added the log queries performance to the system acceptance criteria.
Log anti-reflection chain of proof
If you have not made a proper log, or if there are any suspicious changes in the format, or if you do not match the time frame, or if there is any suspicious signs of change during storage, the audit will be judged to be directly incorrect.
Our approach is to add a Hashi chain to the WiFi certification system log. Each log is written in addition to its own content, and it also contains the Hashi value of the previous log, forming a chain of anti-false changes.——Like every morning.——A summary of all log files on the day is calculated at a time by SHA256 and the summary values are written in an independent, uncut audit form. If someone tries to modify a journal on a given day, the document on the day changes and the records on the audit form do not match.
There is also a point that can easily be ignored: time synchronization of logs. All devices that generate logs——Authentication server, Radius server, NAT device, Portal server——The same time source must be synchronized with NTP. If an audit reveals that the same event on different equipment is missing for more than a dozen seconds or even minutes, the auditor will question the integrity and credibility of the log.
These details are not mentioned in normal dimensions, but one of them is always a question when checked. Instead of being busy at the moment, the log system should be carefully designed as a separate module when deploying WiFi certification systems.——The last three months.——There is fast-tracking in Elasticsearch, and cold data are stored in objects more than three months after compressed data and recovered from cold storage when searching. This cold thermal stratification programme not only reduces storage costs but also ensures the speed of daily queries. Another detail that can be ignored is the standardization of log formats. The logs for equipment output by different manufacturers vary widely, with Syslog, SNMP Trap, NetFlow field definitions being very different. If no uniform formatting and standardized library is done, the log analysis platform will be less efficient if it is manually compared to cross-equipment audits. Therefore, at the design stage of the WiFi certification system log programme, a uniform log field specification should be defined that requires all access devices to report as such or convert to storage after conversion.