GSSAPI module support in rsyslog v3
What is it good for.
-
client-serverauthentication
-
Log
messages encryption
Requirements.
- Kerberos infrastructure
- rsyslog, rsyslog-gssapi
Configuration.
Let's assume there are 3 machines in kerberos Realm:
- the
first is running KDC (Kerberos Authentication Service and Key
Distribution Center),
- the second is a client sending its logs to the server,
- the third is receiver, gathering all logs.
1.
KDC:
- Kerberos
database must be properly set-up on KDC machine first. Use
kadmin/kadmin.local to do that. Two principals need to be add in our
case:
-
sender@REALM.ORG
- client must have ticket for pricipal sender
- REALM.ORG is kerberos Realm
- host/receiver.mydomain.com@REALM.ORG - service principal
- Use ktadd to export service principal and transfer it to
/etc/krb5.keytab
on receiver
2. CLIENT:
- set-up rsyslog, in /etc/rsyslog.conf
- $ModLoad omgssapi - load output gss module
- $GSSForwardServiceName
otherThanHost - set the name of service principal, "host" is the
default one
- *.* :omgssapi:receiver.mydomain.com - action line, forward
logs to receiver
- kinit root - get the TGT ticket
- service rsyslog start
3. SERVER:
-
set-up
rsyslog, in /etc/rsyslog.conf
-
$ModLoad
imgssapi - load input gss module
-
$InputGSSServerServiceName
otherThanHost - set the name of service principal, "host" is the
default one
-
$InputGSSServerPermitPlainTCP
on - accept GSS and TCP connections (not authenticated senders), off by
default
-
$InputGSSServerRun
514 - run server on port
-
service
rsyslog start
The picture demonstrate
how things work.
[rsyslog.conf overview]
[manual index] [rsyslog site]
This documentation is part of the
rsyslog
project.
Copyright © 2008 by Rainer
Gerhards and
Adiscon.
Released under the GNU GPL version 3 or higher.