KarkomaOnline

The syslog daemon is a utility that provides logging of events (messages) received from programs. It can log events from your local machine as well as from remote machines.

Logging to a remote log server is a good practice to improve the security of your system. This tip will show how to configure a host to send messages to a remote log server through an encrypted connection using stunnel.

First of all let’s start by installing and minimally configuring stunnel on the server and client machines:

In my Linux Gentoo system to download and install stunnel, I simply type:

emerge stunnel

Proceed accordingly to your system: urpmi stunnel (Linux Mandrake), etc.

Note: As syslog is present in almost every Unix system, I assume your syslog daemon is properly configured and running.

Now edit or create /etc/stunnel/stunnel.conf in both the server and the client to look like this:

# stunnel.conf
pid = /var/run/stunnel.pid
setuid = nobody
setgid = nogroup

Configure syslog on the client side to send all the events to the log server by changing /etc/syslog.conf:

# syslog.conf – client side
*.* @logserver

Note that there has to be a TAB character between both fields, syslog does not like spaces.

Then start stunnel and restart syslog as follows :

stunnel /etc/stunnel/stunnel.conf -c -r 192.168.10.11:5140 -d 514
/etc/init.d/syslog restart

First line instructs stunnel to connect as a client to remote log server 192.168.10.11 at port 5140.

Now it is necessary to instruct syslog in the log server to accept messages from the network using an internet domain socket. This is achieved by passing to syslogd the -r option. In Linux Gentoo, edit /etc/conf/sysklogd and change it to look like this:

# Config file for /etc/init.d/sysklogd
SYSLOGD=”-r -m 0″
# send warnings and above to the console
KLOGD=”-c 3 -2″

Change your system accordingly. For example, in some Red Hat based distros, edit and change /etc/sysconfig/syslog.

And now start stunnel on the server:

stunnel /etc/stunnel/stunnel.conf -d 5140 -r localhost:514

Will start stunnel, telling it to run in daemon mode and listen on port 5140 for the incoming connections and forward them to localhost at port 514 where syslog listens.

References:

• sysklogd man pages
• Stunnel homepage

This entry was posted on Saturday, January 17th, 2004 at 4:35 pm and is filed under Security. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.