RSyslog with stunnel

From Proxmox VE
Jump to: navigation, search

RSyslog with stunnel

This will show you a secure, guaranteed client logging server setup using RSyslog with RELP (Reliable Event Logging Protocol) and Stunnel.


Background

References (listed below) from the RSyslog site and Stunnel site have been put together in this quick and easy setup for getting it all to work together. Make sure you do this exactly, do not mix "localhost" with "127.0.0.1" or it will not work.


Here are the main portions we will be working with:

  • RSyslog using the RELP protocol provides the means of guaranteeing delivery of system log messages (REF3).
  • RSyslog using RELP does not at this time support encryption (REF4), we will add this with Stunnel. Stunnel has many more options for authentication then we will be using here. Please explore the Stunnel faq (REF5) for more information. As it stands this configuration will allow any number of clients to connect to the server, and in uncontrolled environments is not good. It will be left as an exercise to the reader to enforce a limit, so read the Stunnel faq (REF5) for a better understanding how.
  • Using the power of RSyslog templates we will separate all log-files out on a client by client, and day by day basis for anyone that reports to the server (REF6).


The chain of communication looks like this:

client_rsyslog_send(127.0.0.1:60514) 
<-client-> client_accept_from(127.0.0.1:60514)|client_connect_to(<server_address>:60000) 
<-network-> 
server_accept_from(:60000)|server_connect_to(127.0.0.1:60001) 
<-server-> 
server_rsyslog_listen(127.0.0.1:60001)

Stunnel4 - Client Setup

Install Stunnel4

%aptitude install stunnel4 

Edit the /etc/default/stunnel4 to start the service on system startup

ENABLED=1 

Edit the /etc/stunnel/stunnel.conf, Make the following changes:

  • Comment the line cert = xxxxx
  • Remove comment for client = yes
  • Comment out the [pop3s], [ssmtp], and [imaps] sections.
  • Add the following section, substitute your server address:
# Will accept connections to ports on local 
# host and forward them to server 
[rsyslog] 
accept = 127.0.0.1:60514 
# Server the stunnel client will connect to 
connect = <server-address>:60000 

Restart the Stunnel service:

%/etc/init.d/stunnel4 restart 

Check the configuration was successful:

%netstat -aln 

This should list 127.0.0.1:60514


Stunnel - Server Setup

Install Stunnel

%aptitude install stunnel4 

Edit the /etc/default/stunnel4 to start the service on system startup

ENABLED=1 

Edit the /etc/stunnel/stunnel.conf, Make the following changes:

  • Comment out the [pop3s], [ssmtp], and [imaps] sections.
  • Change cert=/etc/stunnel/mail.pem to cert=/etc/stunnel/stunnel.pem
  • Add the following
# Will accept external connections and forward them to the localhost 
[ssyslog] 
accept = 60000 
connect = 127.0.0.1:60001 

See the Stunnel faq (mentioned above) for a more detailed explanation of this file. For this EXAMPLE the following will suffice. Execute the following to create the /etc/stunnel/stunnel.pem file:

openssl req -new -x509 -days 365 -nodes -out stunnel.pem -keyout /etc/stunnel/stunnel.pem 


Restart the Stunnel service:

%/etc/init.d/stunnel4 restart 

Check the configuration was successful:

%netstat -aln 

This should list 0.0.0.0:60001, and 0.0.0.0:60000

RSyslog - Client Configuration

To get RELP support we need to add the backports repository for lenny In /etc/apt/sources.list, add the following:

deb http://www.backports.org/debian lenny-backports main 

Update apt:

%aptitude update 

Install rsyslog-relp

%aptitude install rsyslog-relp 

In /etc/rsyslog.conf add the following lines in the MODULES section:

# Load the relp module 
$ModLoad omrelp 

In /etc/rsyslog.conf add the following lines in the RULES section:

# Dump all messages to the remote logging server through the localport 
*.* :omrelp:127.0.0.1:60514 

Restart the RSyslog service

/etc/init.d/rsyslog restart

RSyslog - Server Configuration

To get RELP support we need to add the backports repository for lenny In /etc/apt/sources.list, add the following:

deb http://www.backports.org/debian lenny-backports main 

Update apt:

%aptitude update 

Install rsyslog-relp

%aptitude install rsyslog-relp 

In /etc/rsyslog.conf add the following lines in the MODULES section:

#Setup the Relp server config 
$ModLoad imrelp.so 
$InputRELPServerRun 60001 

In /etc/rsyslog.conf add the following lines in the RULES section:

# Receive Logs from the clients 
# put them in respective directories in a long format. 
$template HostAudit, "/var/log/rsyslog/%HOSTNAME%_%$MONTH%_%$DAY%_%$YEAR%-audit_log" 
*.* ?HostAudit"

Restart the RSyslog service

/etc/init.d/rsyslog restart 

To test the setup on the client send a log message:

%logger testing the stunnel-rsyslogrelp setup 

On the server in /var/log/rsyslog/ should be a file with your server name and the current date. Tail it with tail -f <file_name> and watch the log messages populate.

References

RSyslog | stunnel v3, v4 | certs