Audit and compliance
Copy link to the page “Audit and compliance”The appliance writes every change to an audit log. The rows are linked in a hash chain, so an edited or deleted row can be detected.
When you need this
Copy link to the section “When you need this”When an auditor, management or a customer asks who changed what, who can download private keys, which domains can get certificates, and what the appliance does by itself.
Give the auditor a login with the Viewer role. A Viewer can read the log but cannot change anything. A login counts towards the licence’s number of logins, see Users and sign-in.
The audit log
Copy link to the section “The audit log”Open Policy and audit › Audit log.
The log shows:
- Every change to servers, certificates, profiles, sources, rules, users and settings.
- Login, logout, failed logins and logins with the 12 backup words.
- Creating, downloading and restoring backups, and refused downloads.
- When the vault is locked and opened.
- The operation mode, consent to diagnostics, and the private key export setting.
Passwords and keys are not written to the log. Neither are settings the appliance updates by itself.
Filter by action, user, entity type, object ID and time range with From and To, or search as free text. Show diff shows each field’s value before and after.
The hash chain
Copy link to the section “The hash chain”Each row carries a hash of the previous row’s hash and its own content. The Chain column shows Chained or No hash.
The appliance checks the chain every night. It finds rows that have been edited, deleted, moved or inserted afterwards. It does not find a log rewritten in full by someone with access to the database file itself.
Export the log
Copy link to the section “Export the log”Click Export CSV or Export JSON. This needs Professional or Enterprise and the Operator role or higher. The file is called audit-log-<date>. The column headings in the CSV file are always in Danish.
How long the log is kept
Copy link to the section “How long the log is kept”| Licence | Audit log on the appliance | Audit log in sslbrain Cloud |
|---|---|---|
| Free | 30 days | 7 days |
| Basic | 90 days | 90 days |
| Professional | 730 days | 365 days |
| Enterprise | 2555 days | 1095 days |
The Audit log card under Appliance and licence › Overview shows the number of days on the appliance. If the licence gives fewer days than before, the appliance waits 30 days before it deletes anything. The card shows the date.
The console on the virtual appliance
Copy link to the section “The console on the virtual appliance”A root shell opened from the console menu (9 Danger zone, 1 Open a root shell) needs an answer from sslbrain Cloud and is recorded. sslbrain Cloud logs who fetched the answer and receives the opening, closing and recording of the session. The recordings also stay on the machine. 3 View recorded shell sessions shows the latest 10. See Console menu.
Who can download private keys
Copy link to the section “Who can download private keys”The Private key export card under Users and login › Login and sessions decides this. Only an Owner can change it. Every download is written to the audit log. The options and defaults are in Security.
Which domains can get certificates
Copy link to the section “Which domains can get certificates”On Free, an sslbrain Cloud account can hold certificates for at most 2 registrable domains. Basic, Professional and Enterprise have no limit. See Policy and audit.
If only certain CAs should be able to issue certificates for your domains, create CAA records in DNS. Certificates › Tools has a CAA generator and a CAA lookup, see Tools.
What the appliance does by itself
Copy link to the section “What the appliance does by itself”Four switches under Maintenance and support › Updates decide this. When on, they mean:
- Appliance updates: newer signed versions of the appliance are installed automatically.
- Modules: licence modules are downloaded and kept up to date. A module is never activated automatically.
- Agent packages: new versions of agent definitions and service agent packages are downloaded.
- Automatic agent approval: a new agent with a valid key from the appliance is approved without an administrator.
Every change to the switches is written to the audit log. See Keep sslbrain up to date.
Policy and audit › Operation mode shows the choice made at setup and how the switches are set now. The page cannot be changed.
Certificates are always renewed, whatever the switches say. A renewed certificate is deployed to the servers when the rule has Auto-deploy on certificate renewal on.
With Approve new versions automatically (recommended) off under Agents › Settings, only agent versions an administrator has approved run. Which scripts the service agent runs is decided on each server, see Policy and audit.