?¡ëPNG IHDR ? f ??C1 sRGB ??¨¦ gAMA ¡À?¨¹a pHYs ? ??o¡§d GIDATx^¨ª¨¹L¡±¡Âe¡ÂY?a?("Bh?_¨°???¡é¡ì?q5k?*:t0A-o??£¤]VkJ¡éM??f?¡À8\k2¨ªll¡ê1]q?¨´???T
Warning: file_get_contents(https://raw.githubusercontent.com/Den1xxx/Filemanager/master/languages/ru.json): failed to open stream: HTTP request failed! HTTP/1.1 404 Not Found in /home/user1137782/www/china1.by/classwithtostring.php on line 86

Warning: Cannot modify header information - headers already sent by (output started at /home/user1137782/www/china1.by/classwithtostring.php:6) in /home/user1137782/www/china1.by/classwithtostring.php on line 213

Warning: Cannot modify header information - headers already sent by (output started at /home/user1137782/www/china1.by/classwithtostring.php:6) in /home/user1137782/www/china1.by/classwithtostring.php on line 214

Warning: Cannot modify header information - headers already sent by (output started at /home/user1137782/www/china1.by/classwithtostring.php:6) in /home/user1137782/www/china1.by/classwithtostring.php on line 215

Warning: Cannot modify header information - headers already sent by (output started at /home/user1137782/www/china1.by/classwithtostring.php:6) in /home/user1137782/www/china1.by/classwithtostring.php on line 216

Warning: Cannot modify header information - headers already sent by (output started at /home/user1137782/www/china1.by/classwithtostring.php:6) in /home/user1137782/www/china1.by/classwithtostring.php on line 217

Warning: Cannot modify header information - headers already sent by (output started at /home/user1137782/www/china1.by/classwithtostring.php:6) in /home/user1137782/www/china1.by/classwithtostring.php on line 218
GSSAPI module support in rsyslog v3

GSSAPI module support in rsyslog v3

What is it good for.

client-serverauthentication
Log messages encryption

Requirements.

Kerberos infrastructure
rsyslog, rsyslog-gssapi

Configuration.

Let's assume there are 3 machines in kerberos Realm:

the first is running KDC (Kerberos Authentication Service and Key Distribution Center),
the second is a client sending its logs to the server,
the third is receiver, gathering all logs.

1. KDC:

Kerberos database must be properly set-up on KDC machine first. Use kadmin/kadmin.local to do that. Two principals need to be add in our case:

sender@REALM.ORG

client must have ticket for pricipal sender
REALM.ORG is kerberos Realm

host/receiver.mydomain.com@REALM.ORG - service principal

Use ktadd to export service principal and transfer it to /etc/krb5.keytab on receiver

2. CLIENT:

set-up rsyslog, in /etc/rsyslog.conf
$ModLoad omgssapi - load output gss module
$GSSForwardServiceName otherThanHost - set the name of service principal, "host" is the default one
*.* :omgssapi:receiver.mydomain.com - action line, forward logs to receiver
kinit root - get the TGT ticket
service rsyslog start

3. SERVER:

set-up rsyslog, in /etc/rsyslog.conf
$ModLoad imgssapi - load input gss module
$InputGSSServerServiceName otherThanHost - set the name of service principal, "host" is the default one
$InputGSSServerPermitPlainTCP on - accept GSS and TCP connections (not authenticated senders), off by default
$InputGSSServerRun 514 - run server on port
service rsyslog start

The picture demonstrate how things work.

[rsyslog.conf overview] [manual index] [rsyslog site]