7.10.4. Procedure – Digitally signing audit trails

Purpose: 

PSM can digitally sign the audit trails to prevent the manipulation of the audit trail files. This requires an X.509 certificate and also the private key of the certificate. Note that PSM can generate a private key that you can use to create a certificate, but PSM itself cannot create the certificate used to sign the audit trails.

Steps: 

  1. Configure the signing interval. You have to repeat these steps for each protocol (HTTP, ICA, RDP, SSH, Telnet, and VNC) you want to configure:

    Figure 7.16. <Protocol name> Control > Global Options — Configuring the signing interval

    <Protocol name> Control > Global Options — Configuring the signing interval
    1. In the protocol control settings, navigate to Global Options > Timestamping (for example, SSH Control > Global Options > Timestamping).

    2. Set the Signing interval. You can choose any value between 10 and 100 000 seconds.

      Note

      The same interval setting applies to timestamping and signing.

    3. Click .

  2. Navigate to Policies > Audit Policies and select the audit policy you will use in your connections.

    Figure 7.17. Policies > Audit Policies — Signing audit trails

    Policies > Audit Policies — Signing audit trails
    Tip

    By default, every connection uses the built-in default audit policy. Unless you use a custom audit policy, modifying the default audit policy will affect every audited channel of the connections passing through PSM.

  3. Select the Enable signing option.

  4. Upload a certificate and the corresponding private key to PSM.

  5. Click . PSM will automatically sign the audit trails of every connection that is audited and uses this audit policy.

  6. Repeat the above steps for other audit policies if needed.