From 07c0fcdfc8815ce6b82376d9d312b4e86ed29743 Mon Sep 17 00:00:00 2001 From: Peter Vrabec Date: Fri, 11 Apr 2008 16:02:04 +0200 Subject: added gssapi overview/howto thanks to Peter Vrabec Signed-off-by: Rainer Gerhards --- doc/gssapi.html | 118 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 118 insertions(+) create mode 100644 doc/gssapi.html (limited to 'doc/gssapi.html') diff --git a/doc/gssapi.html b/doc/gssapi.html new file mode 100644 index 00000000..400be4a3 --- /dev/null +++ b/doc/gssapi.html @@ -0,0 +1,118 @@ + +GSSAPI module support in rsyslog v3 + + + +

GSSAPI module support in rsyslog v3

What is it good for.

+client-serverauthentication
+Log +messages encryption

Requirements. +

Kerberos infrastructure
rsyslog, rsyslog-gssapi

Configuration. +

Let's assume there are 3 machines in kerberos Realm:

the +first is running KDC (Kerberos Authentication Service and Key +Distribution Center),
the second is a client sending its logs to the server,
the third is receiver, gathering all logs.

1. +KDC:

Kerberos +database must be properly set-up on KDC machine first. Use +kadmin/kadmin.local to do that. Two principals need to be add in our +case:

+
sender@REALM.ORG +
+

client must have ticket for pricipal sender
REALM.ORG is kerberos Realm

host/receiver.mydomain.com@REALM.ORG - service principal

Use ktadd to export service principal and transfer it to +/etc/krb5.keytab +on receiver

2. CLIENT: +

set-up rsyslog, in /etc/rsyslog.conf
$ModLoad omgssapi.so - load output gss module
$GSSForwardServiceName +otherThanHost - set the name of service principal, "host" is the +default one
*.* :omgssapi:receiver.mydomain.com - action line, forward +logs to receiver
kinit root - get the TGT ticket
service rsyslog start +

+

3. SERVER: +

+
set-up +rsyslog, in /etc/rsyslog.conf
+
+
$ModLoad +imgssapi.so - load input gss module
+
+
$InputGSSServerServiceName +otherThanHost - set the name of service principal, "host" is the +default one
+
+
$InputGSSServerPermitPlainTCP +on - accept GSS and TCP connections (not authenticated senders), off by +default
+
+
$InputGSSServerRun +514 - run server on port
+
+
service +rsyslog start
+

+The picture demonstrate +how things work. +

[rsyslog.conf overview] +[manual index] [rsyslog site]

+ \ No newline at end of file -- cgit v1.2.3 From 9b59581a6f7d161c7aafbc3300689337939bb382 Mon Sep 17 00:00:00 2001 From: Michael Biebl Date: Fri, 18 Jul 2008 16:41:52 +0200 Subject: use the $ModLoad syntax consistently. Update the documentation to use the new, preferred $ModLoad syntax: - no more MySQL - name of the in/output plugin without the trailing .so Signed-off-by: Rainer Gerhards --- doc/gssapi.html | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'doc/gssapi.html') diff --git a/doc/gssapi.html b/doc/gssapi.html index 400be4a3..3ad7d07b 100644 --- a/doc/gssapi.html +++ b/doc/gssapi.html @@ -61,7 +61,7 @@ on receiver

set-up rsyslog, in /etc/rsyslog.conf
$ModLoad omgssapi.so - load output gss module
$ModLoad omgssapi - load output gss module
$GSSForwardServiceName otherThanHost - set the name of service principal, "host" is the default one

$ModLoad -imgssapi.so - load input gss module
+imgssapi - load input gss module
$InputGSSServerServiceName @@ -115,4 +115,4 @@ Copyright Gerhards and Adiscon. Released under the GNU GPL version 3 or higher.
- \ No newline at end of file + -- cgit v1.2.3