From 07c0fcdfc8815ce6b82376d9d312b4e86ed29743 Mon Sep 17 00:00:00 2001 From: Peter Vrabec Date: Fri, 11 Apr 2008 16:02:04 +0200 Subject: added gssapi overview/howto thanks to Peter Vrabec Signed-off-by: Rainer Gerhards --- ChangeLog | 1 + doc/gssapi.html | 118 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ doc/gssapi.png | Bin 0 -> 35638 bytes doc/manual.html | 11 +++--- 4 files changed, 124 insertions(+), 6 deletions(-) create mode 100644 doc/gssapi.html create mode 100644 doc/gssapi.png diff --git a/ChangeLog b/ChangeLog index 9b3e6233..24718766 100644 --- a/ChangeLog +++ b/ChangeLog @@ -4,6 +4,7 @@ Version 3.14.3 (rgerhards), 2008-04-?? could not lead to a segfault, as snprintf() was used, but could cause some trouble with extensively long hostnames. - applied patch from Tiziano MĂźller to remove some compiler warnings +- added gssapi overview/howto thanks to Peter Vrabec --------------------------------------------------------------------------- Version 3.14.2 (rgerhards), 2008-04-09 - bugfix: segfault with expression-based filters diff --git a/doc/gssapi.html b/doc/gssapi.html new file mode 100644 index 00000000..400be4a3 --- /dev/null +++ b/doc/gssapi.html @@ -0,0 +1,118 @@ + +GSSAPI module support in rsyslog v3 + + + +

GSSAPI module support in rsyslog v3

What is it good for.

+client-serverauthentication
+Log +messages encryption

Requirements. +

Kerberos infrastructure
rsyslog, rsyslog-gssapi

Configuration. +

Let's assume there are 3 machines in kerberos Realm:

the +first is running KDC (Kerberos Authentication Service and Key +Distribution Center),
the second is a client sending its logs to the server,
the third is receiver, gathering all logs.

1. +KDC:

Kerberos +database must be properly set-up on KDC machine first. Use +kadmin/kadmin.local to do that. Two principals need to be add in our +case:

+
sender@REALM.ORG +
+

client must have ticket for pricipal sender
REALM.ORG is kerberos Realm

host/receiver.mydomain.com@REALM.ORG - service principal

Use ktadd to export service principal and transfer it to +/etc/krb5.keytab +on receiver

2. CLIENT: +

set-up rsyslog, in /etc/rsyslog.conf
$ModLoad omgssapi.so - load output gss module
$GSSForwardServiceName +otherThanHost - set the name of service principal, "host" is the +default one
*.* :omgssapi:receiver.mydomain.com - action line, forward +logs to receiver
kinit root - get the TGT ticket
service rsyslog start +

+

3. SERVER: +

+
set-up +rsyslog, in /etc/rsyslog.conf
+
+
$ModLoad +imgssapi.so - load input gss module
+
+
$InputGSSServerServiceName +otherThanHost - set the name of service principal, "host" is the +default one
+
+
$InputGSSServerPermitPlainTCP +on - accept GSS and TCP connections (not authenticated senders), off by +default
+
+
$InputGSSServerRun +514 - run server on port
+
+
service +rsyslog start
+

+The picture demonstrate +how things work. +

[rsyslog.conf overview] +[manual index] [rsyslog site]

This documentation is part of the +rsyslog +project.
+Copyright Š 2008 by Rainer +Gerhards and +Adiscon. +Released under the GNU GPL version 3 or higher.

+ \ No newline at end of file diff --git a/doc/gssapi.png b/doc/gssapi.png new file mode 100644 index 00000000..c82baa52 Binary files /dev/null and b/doc/gssapi.png differ diff --git a/doc/manual.html b/doc/manual.html index 9d4dbefd..8bdee8b7 100644 --- a/doc/manual.html +++ b/doc/manual.html @@ -1,6 +1,5 @@ -rsyslog documentation - +rsyslog documentation

RSyslog - Documentation

Rsyslog @@ -18,9 +17,9 @@ novice user. And as we know what enterprise users really need, there is also professional rsyslog support available directly from the source!

This documentation is for version 3.14.2 of rsyslog. -Visit the rsyslog status page to obtain current +Visit the rsyslog status page to obtain current version information and project status. -

If you like rsyslog, you might +

If you like rsyslog, you might want to lend us a helping hand. It doesn't require a lot of time - even a single mouse click helps. Learn how to help the rsyslog project. Due to popular demand, there is now a side-by-side comparison @@ -64,7 +63,7 @@ php-syslog-ng with rsyslog

recording the syslog priority (severity and facility) to the log file

preserving -syslog sender over NAT (online only)
+syslog sender over NAT (online only)
an overview and howto of rsyslog gssapi support

debug support in rsyslog

the rsyslog message queue object
@@ -100,4 +99,4 @@ may find Rainer's blog an interesting read (filter on syslog and rsyslog tags).
- + \ No newline at end of file -- cgit v1.2.3