GuardTime Log Signature Provider (gt)

From d1b8821be796694f123f3e469eaaedbe228fde66 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Tue, 26 Mar 2013 18:39:28 +0100 Subject: logsig: minimal end-user doc --- ChangeLog | 3 +- configure.ac | 2 +- doc/Makefile.am | 1 + doc/manual.html | 2 +- doc/omfile.html | 9 +++-- doc/sigprov_gt.html | 100 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 6 files changed, 112 insertions(+), 5 deletions(-) create mode 100644 doc/sigprov_gt.html diff --git a/ChangeLog b/ChangeLog index 6f258fa9..c64fe0f9 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,6 @@ --------------------------------------------------------------------------- -Version 7.3.9 [devel] 2013-03-?? +Version 7.3.9 [devel] 2013-03-27 +- support for signing logs added - imudp: now supports user-selectable inputname - omlibdbi: now supports transaction interface if recent enough lbdbi is present diff --git a/configure.ac b/configure.ac index 96a9e80f..0c877eea 100644 --- a/configure.ac +++ b/configure.ac @@ -2,7 +2,7 @@ # Process this file with autoconf to produce a configure script. AC_PREREQ(2.61) -AC_INIT([rsyslog],[7.3.8],[rsyslog@lists.adiscon.com]) +AC_INIT([rsyslog],[7.3.9],[rsyslog@lists.adiscon.com]) AM_INIT_AUTOMAKE m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])]) diff --git a/doc/Makefile.am b/doc/Makefile.am index de2e1df5..46afd900 100644 --- a/doc/Makefile.am +++ b/doc/Makefile.am @@ -41,6 +41,7 @@ html_files = \ omudpspoof.html \ omruleset.html \ omsnmp.html \ + sigprov_gt.html \ ommysql.html \ omoracle.html \ omlibdbi.html \ diff --git a/doc/manual.html b/doc/manual.html index ca54a04a..6fba9a05 100644 --- a/doc/manual.html +++ b/doc/manual.html @@ -19,7 +19,7 @@ professional services available directly from the source!

Please visit the rsyslog sponsor's page to honor the project sponsors or become one yourself! We are very grateful for any help towards the project goals.

This documentation is for version 7.3.8 (devel branch) of rsyslog. +

This documentation is for version 7.3.9 (devel branch) of rsyslog. Visit the rsyslog status page to obtain current version information and project status.

If you like rsyslog, you might diff --git a/doc/omfile.html b/doc/omfile.html index 2c5ab97a..a980d37f 100644 --- a/doc/omfile.html +++ b/doc/omfile.html @@ -13,14 +13,14 @@

The omfile plug-in provides the core functionality of writing messages to files residing inside the local file system (which may actually be remote if methods like NFS are used). Both files named with static names as well files with names based on message content are supported by this module. It is a built-in module that does not need to be loaded.

-
Module Configuration Parameters:
+
Module Parameters:

Template [templateName]
sets a new default template for file actions.

-
Action Confguration Parameters:
+
Action Parameters:

DynaFileCacheSize (not mandatory, default will be used)
Defines a template to be used for the output.

@@ -83,6 +83,11 @@
DynaFile
For each message, the file name is generated based on the given template. Then, this file is opened. As with the ``file'' property, data is appended if the file already exists. If the file does not exist, a new file is created. A cache of recent files is kept. Note that this cache can consume quite some memory (especially if large buffer sizes are used). Files are kept open as long as they stay inside the cache. Currently, files are only evicted from the cache when there is need to do so (due to insufficient cache size). To force-close (and evict) a dynafile from cache, send a HUP signal to rsyslogd.

+
Sig.Provider [ProviderName]
+ Selects a signature provider for log signing. Currently, + there only is one provider called + "gt".

+
Template [templateName]
sets a new default template for file actions.

diff --git a/doc/sigprov_gt.html b/doc/sigprov_gt.html new file mode 100644 index 00000000..18b0ed10 --- /dev/null +++ b/doc/sigprov_gt.html @@ -0,0 +1,100 @@ + + + + +GuardTime Log Signature Provider (gt) + + + +back to rsyslog module overview + +
GuardTime Log Signature Provider (gt)
+
Signature Provider Name: gt
+
Author: Rainer Gerhards <rgerhards@adiscon.com>
+
Multi-Ruleset Support: since 7.3.9 +
Description:
+
Provides the ability to sign syslog messages via the +GuardTime signature services. +
+ +
Configuration Parameters:
+
Signature providers are loaded by omfile, when the +provider is selected in its "sig.providerName" parameter. +Parameters for the provider are given in the omfile action instance +line. +
This provider creates a signature file with the same base name but +the extension ".gtsig" for each log file (both for fixed-name files +as well as dynafiles). Both files together form a set. So you need to +archive both in order to prove integrity. +
+
sig.hashFunction <Hash Algorithm>
+The following hash algorithms are currently supported: +
+
SHA1 +
RIPEMD-160 +
SHA2-224 +
SHA2-256 +
SHA2-384 +
SHA2-512 +
+
+
sig.timestampService <timestamper URL>
+This provides the URL of the timestamper service. If not selected, +a default server is selected. This may not necessarily be a good +one for your region. +
+
sig.block.sizeLimit <nbr-records>
+The maximum number of records inside a single signature block. By +default, there is no size limit, so the signature is only written +on file closure. Note that a signature request typically takes between +one and two seconds. So signing to frequently is probably not a good +idea. +
+
sig.keepRecordHashes <on/off>
+Controls if record hashes are written to the .gtsig file. This +enhances the ability to spot the location of a signature breach, +but costs considerable disk space (65 bytes for each log record +for SHA2-512 hashes, for example). +
+
sig.keepTreeHashes <on/off>
+Controls if tree (intermediate) hashes are written to the .gtsig file. This +enhances the ability to spot the location of a signature breach, +but costs considerable disk space (a bit mire than the amount +sig.keepRecordHashes requries). Note that both Tree and Record +hashes can be kept inside the signature file. +
+
+Caveats/Known Bugs: +
+
currently none known +
+
+
Samples:
+
This writes a log file with it's associated signature file. Default +parameters are used. +
++action(type="omfile" file="/var/log/somelog" + sig.provider="gt") + + +
In the next sample, we use the more secure SHA2-512 hash function, +sign every 10,000 records and Tree and Record hashes are kept. ++action(type="omfile" file="/var/log/somelog" + sig.provider="gt" sig.hashfunction="SHA2-512" + sig.block.sizelimit="10000" + sig.keepTreeHashes="on" sig.keepRecordHashes="on") + + + +
[rsyslog.conf overview] +[manual index] [rsyslog site]
+
This documentation is part of the +rsyslog +project.
+Copyright © 2013 by +Rainer Gerhards and +Adiscon. +Released under the GNU GPL version 3 or higher.
+ -- cgit v1.2.3