10. Audit and Evidence
10. Audit and Evidence
← Previous: 9. Decommissioning | Index | Next: 11. Rollout →
10.1 The Honest Limit
RFC-PAM-0001 required full keystroke recording of every session, fail-closed (its INV-6). Arc SSH has no session recording. It gives strong login attribution — who, where, when, MFA — but not a replay of the shell. This design therefore builds evidence from the host outward and is explicit about what is and is not captured.
10.2 What Is Captured
| Evidence | Source → Sentinel | Answers |
|---|---|---|
| Who logged in where, when, with MFA | Entra sign-in logs; sshd auth log | Problem 1's attribution |
| Who became root, when, why, who approved | PIM activation logs | every root window is a justified event |
| Every privileged command, replayable | sudo I/O logging (input and output) for all Operator and Admin sudo; replayed with sudoreplay | what root actually did |
| Every deploy | pn-deploy log (UPN, project, verb, services, ref, result); #infra note | who shipped what |
| Who changed which file | auditd watches on /srv/pnats, /etc/sudoers*, /etc/passwd, /etc/group, /etc/pn-*, PAM — with the acting UPN | "X edited prod file Y at 14:02" — without keystroke recording |
| Attempts to exceed a tier | sudo/PAM denials (su, sudo -u, non-allow-listed command) | early warning; should be ~0 |
| Host vs. Entra drift; leaver actions | pn-access heartbeat | stale-account review, automated |
| Break-glass use | sshd root publickey acceptance + auditd | the one event that must never be quiet |
10.3 What Is Not Captured
An Editor's ordinary, non-sudo shell activity as themselves — reading files, running unprivileged tools. File changes are still evidenced by auditd; file reads and casual commands are not. That is the gap versus a Teleport-style broker, stated plainly.
10.4 Optional Level 2 — Full Shell Recording
Keystroke recording (pam_tty_audit) or a forced recording shell shipping to write-once storage, for Operator/Admin sessions. Closes the gap; costs storage, adds privacy considerations, and needs real-time shipping so an Admin cannot erase it locally. Decision deferred to 60 days after cutover, on real usage data (Section 13). Not promised here.
10.5 Tamper Resistance and Retention (Invariant 12)
| Aspect | Value |
|---|---|
| Transport | AMA/DCR to Sentinel in near-real time; Entra/PIM logs via diagnostic settings |
| Hot retention | 90 days in Log Analytics |
| Archive | 1 year in immutable blob storage (the retention RFC-PAM-0001 specified) |
| Local logs | root may delete them; the shipped copies are unaffected |
10.6 Alerts Added by This Design
| Alert | Severity | Destination |
|---|---|---|
| Break-glass root login on any host | P1 | on-call + #infra; retrospective incident required |
sudoers, PAM, /etc/pn-* modified outside an Ansible run | P1 | on-call |
Denied su / sudo -u / non-allow-listed sudo | P2 | Security owner |
pn-access heartbeat missing or drift detected | P2 | Platform Lead |
PIM activation on prod | Informational | #infra |
Deploy on prod outside working hours | Informational | #infra |
10.7 Reports
- Monthly access review — every person, every tier, every class, last login (a Sentinel workbook over the heartbeat and login data). Satisfies STD-IDENT-001's 30-day stale-account review.
- Leaver checklist — auto-generated per Section 9.
Neither is assembled by hand.
Document Navigation
| Previous | Index | Next |
|---|---|---|
| ← 9. Decommissioning | Table of Contents | 11. Rollout → |
End of Section 10