Cet article montrera comment configurer un système CentOS/RHEL pour accepter les messages de journal à distance en utilisant TLS et non TLS uniquement. Disons que nous avons les serveurs suivants.
- Serveur Rsyslog avec TLS et non TLS :syslog-server.geeklab.com
- TLS client :syslog-tls.geeklab.com
- Client non TLS :syslog-non-tls.geeklab.com
1. Utilisez le guide suivant pour configurer le TLS sur le serveur rsyslog et le client :
Comment configurer le serveur rsyslog pour accepter les journaux via SSL/TLS2. Testez le bon fonctionnement de TLS avant de continuer.
3. Sur le serveur Rsyslog, modifiez /etc/rsyslog.conf avec les options suivantes :
TLS connection will use port 1514 Non TLS connection will use por 514
Veuillez vous référer à la doc suivante sur le module imptcp :http://www.rsyslog.com/doc/v8-stable/configuration/modules/imptcp.html
Fournit la possibilité de recevoir des messages syslog via syslog TCP ordinaire. Il s'agit d'un plugin d'entrée spécialisé conçu pour des performances élevées sous Linux. Il ne fonctionnera probablement sur aucune autre plate-forme. De plus, il ne fournit pas de services TLS. Le cryptage peut être fourni en utilisant stunnel.Ce module n'a pas de limite sur le nombre d'auditeurs et de sessions pouvant être utilisés.
# vi /etc/rsyslog.conf #### MODULES #### $ModLoad imuxsock # provides support for local system logging (e.g. via logger command) $ModLoad imklog # reads kernel messages (the same are read from journald) module( load="imptcp" Threads="2" ) input( type="imptcp" port="514" ) # Provides TCP syslog reception $ModLoad imtcp #Make gtls driver the default $DefaultNetstreamDriver gtls # certificate files $DefaultNetstreamDriverCAFile /etc/pki/tls/private/ca-cert.pem $DefaultNetstreamDriverCertFile /etc/pki/tls/private/collector-cert.pem $DefaultNetstreamDriverKeyFile /etc/pki/tls/private/collector-key.pem $ActionSendStreamDriverAuthMode x509/name $ActionSendStreamDriverPermittedPeer *.geeklab.com $ActionSendStreamDriverMode 1 $InputTCPServerRun 10514 #### GLOBAL DIRECTIVES #### # Where to place auxiliary files $WorkDirectory /var/lib/rsyslog # Use default timestamp format $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat # Include all config files in /etc/rsyslog.d/ $IncludeConfig /etc/rsyslog.d/*.conf # Turn off message reception via local log socket; # local messages are retrieved through imjournal now. $OmitLocalLogging on # File to store the position in the journal $IMJournalStateFile imjournal.state $template RemoteLogsTesting,"/var/log//%HOSTNAME%/syslog.log" if $fromhost-ip != '127.0.0.1' then -?RemoteLogsTesting & stop #Set the maximum number of files that the rsyslog process can have open at any given time $MaxOpenFiles 2048 #### RULES #### *.info;mail.none;authpriv.none;cron.none /var/log/messages authpriv.* /var/log/secure mail.* -/var/log/maillog cron.* /var/log/cron *.emerg :omusrmsg:* uucp,news.crit /var/log/spooler local7.* /var/log/boot.log
Redémarrez les services rsyslog pour que les modifications prennent effet :
# systemctl rsyslog restart
4. Sur le client Rsyslog utilisant TLS, modifiez /etc/rsyslog.conf
# vi /etc/rsyslog.conf #### MODULES #### # The imjournal module bellow is now used as a message source instead of imuxsock. $ModLoad imuxsock # provides support for local system logging (e.g. via logger command) $ModLoad imjournal # provides access to the systemd journal # make gtls driver the default $DefaultNetstreamDriver gtls # certificate files $DefaultNetstreamDriverCAFile /etc/pki/tls/private/ca-cert.pem $DefaultNetstreamDriverCertFile /etc/pki/tls/private/sender-cert.pem $DefaultNetstreamDriverKeyFile /etc/pki/tls/private/sender-key.pem $ActionSendStreamDriverAuthMode x509/name $ActionSendStreamDriverPermittedPeer * $ActionSendStreamDriverMode 1 # run driver in TLS-only mode #### GLOBAL DIRECTIVES #### # Where to place auxiliary files $WorkDirectory /var/lib/rsyslog # Use default timestamp format $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat # Include all config files in /etc/rsyslog.d/ $IncludeConfig /etc/rsyslog.d/*.conf # Turn off message reception via local log socket; # local messages are retrieved through imjournal now. $OmitLocalLogging on # File to store the position in the journal $IMJournalStateFile imjournal.state #### RULES #### *.info;mail.none;authpriv.none;cron.none /var/log/messages authpriv.* /var/log/secure mail.* -/var/log/maillog cron.* /var/log/cron *.emerg :omusrmsg:* uucp,news.crit /var/log/spooler local7.* /var/log/boot.log # remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional *.* @@10.157.193.9:10514
Redémarrez les services rsyslog pour que les modifications prennent effet :
# systemctl rsyslog restart
5. Sur le client Rsyslog NON TLS, modifiez /etc/rsyslog.conf :
# vi /etc/rsyslog.conf #### MODULES #### # The imjournal module bellow is now used as a message source instead of imuxsock. $ModLoad imuxsock # provides support for local system logging (e.g. via logger command) $ModLoad imjournal # provides access to the systemd journal #### GLOBAL DIRECTIVES #### # Where to place auxiliary files $WorkDirectory /var/lib/rsyslog # Use default timestamp format $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat # Include all config files in /etc/rsyslog.d/ $IncludeConfig /etc/rsyslog.d/*.conf # Turn off message reception via local log socket; # local messages are retrieved through imjournal now. $OmitLocalLogging on # File to store the position in the journal $IMJournalStateFile imjournal.state #### RULES #### *.info;mail.none;authpriv.none;cron.none /var/log/messages authpriv.* /var/log/secure mail.* -/var/log/maillog cron.* /var/log/cron *.emerg :omusrmsg:* uucp,news.crit /var/log/spooler local7.* /var/log/boot.log # remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional *.*@@10.157.193.9:514
Redémarrez les services rsyslog pour que les modifications prennent effet :
# systemctl rsyslog restart
Test :
Client TLS :
[root@syslog-tls ~]# logger geeklab TEST [root@syslog-tls ~]# logger geeklab TEST
Client NON TLS :
[root@syslog-non-tls ~]# logger geeklab test [root@syslog-non-tls ~]# logger geeklab test
Serveur Rsyslog :
[root@syslog-server ]# ls syslog-non-tls syslogtest [root@syslog-server ]#
root@syslog-server syslog-non-tls]# tail -2 syslog.log Sep 21 18:07:19 syslog-non-tls root: geeklab test Sep 21 18:07:20 syslog-non-tls root: geeklab test
[root@syslog-server syslog-tls]# cat syslog.log Stop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) (disconnected from bus) Sep 21 18:22:02 syslog-tls root: geeklab TEST Sep 21 18:22:03 syslog-tls root: geeklab TEST Sep 21 18:22:03 syslog-tls root: geeklab TEST
[root@syslog-server ]# netstat -tulpan | grep -i 514 tcp 0 0 0.0.0.0:514 0.0.0.0:* LISTEN 2460/rsyslogd tcp 0 0 0.0.0.0:10514 0.0.0.0:* LISTEN 2460/rsyslogd tcp 0 0 10.157.193.9:514 10.157.193.131:14178 ESTABLISHED 2460/rsyslogd Non tls server tcp 0 0 10.157.193.9:10514 10.157.193.159:47027 ESTABLISHED 2460/rsyslogd tls server tcp6 0 0 :::514 :::* LISTEN 2460/rsyslogd tcp6 0 0 :::10514 :::* LISTEN 2460/rsyslogd udp 0 0 0.0.0.0:514 0.0.0.0:* 2460/rsyslogd udp6 0 0 :::514 :::* 2460/rsyslogd [root@syslog-server ]#