NLog - how decrypt the log file

Question

I have logging on my website and I want to have log file encrypted. To have log file encrypted I just add attribute fileAttributes="Encrypted" to config file, how you can see here:

    <target name="file" xsi:type="File"
        layout="${longdate} | ${pad:padding=-5:inner=${level:uppercase=true}} | ${message} ${onexception:inner=${newline}   ${exception:format=ToString}}"
        fileName="${basedir}/Log/log_info.log"
        fileAttributes="Encrypted"
        archiveFileName="${basedir}/Log/log_info_{#}.log"
        archiveAboveSize="1048576"
        archiveNumbering="Rolling"
        maxArchiveFiles="2"
        concurrentWrites="true"
        keepFileOpen="false" />

Problem: How can I decrypt the file to see logging?

There is a dearth of detail on the NLog documentation page about this, and I would be interested to know how to properly encrypt and decrypt log files. ref: github.com/nlog/NLog/wiki/File-target I'd appreciate both a config and programmatic example in c# if possible. — Mister Epic, Aug 13 '15 at 13:24

score 5 · Accepted Answer · edited May 23 '17 at 12:06

NLog does not encrypt the file itself, it simply asks the operating system to take care of it. Exposed in .NET with the FileOptions.Encrypted enum value. Whose comment describes well what it does:

Indicates that a file is encrypted and can be decrypted only by using the same user account used for encryption.

"Same user account" being the most typical hangup, IIS normally runs with it own account, details are covered well in this existing Q+A. The operating system implementation is covered in detail in this MSDN page.

Use of this option on a web server should give a little pause. The only person that has an easy time reading the log file is the attacker that compromises the machine from the outside. He has no trouble reading the file, its content is readily available in cleartext since he's using the IIS account. The people that need the log file to stop such an attacker will have a pretty hard time reading the file since they'll use their own account to access the machine.

This is not an ideal security practice.

That's what I was afraid of, but was hoping that there might be another answer. Thanks for the input. — Mister Epic, Aug 13 '15 at 20:10

score 3 · Answer 2 · answered Aug 13 '15 at 14:00

fileAttributes="Encrypted" means that the file will have NTFS attribute Encrypted. https://github.com/nlog/NLog/wiki/File-target

To decrypt it - go to file properties -> attributes -> advanced and uncheck "Encrypt content to secure data".

It works on the same computer where the file was encrypted. So copy of the file can not be decrypted on another computer.

NLog - how decrypt the log file

2 Answers2