Audit Logging about boulder HOT 4 CLOSED

Notes from conversation with jcjones:

• Software Error Conditions: Probably just have log.Error() marked as audit, and make sure we log something
• Software Integrity: Probably part of the deployment system, vs. boulder
• Improper messages: Log in RPC code
• Certificate requests, etc: Log when any of the *Authorities handles such an object, not just in CA

from boulder.

This issue should be mostly addressed in PR #136. That PR needs review, and it omits the following:

• Any audit logging of revocation (since we don't support revocation yet)
• The various deployment-related audit events noted above

from boulder.

These two have been moved to Project Management for OS / Deployment level audit logging:

Software check integrity failures – Date and time of event, and description of event are automatically logged by the application reporting the event or by the operating system.

Any security-relevant changes to the configuration of a component – Date and time of modification, name of modifier, description of modification, build information (i.e. size, version number) of any modified files and the reason for modification are manually logged during change management processes.

Everything else is getting implemented in #175 and #204.

from boulder.

Sub-issues #204 and #175 are closed. The remaining issues are outside of Boulder, so I'm closing this issue too.

from boulder.