From 07c0fcdfc8815ce6b82376d9d312b4e86ed29743 Mon Sep 17 00:00:00 2001 From: Peter Vrabec Date: Fri, 11 Apr 2008 16:02:04 +0200 Subject: added gssapi overview/howto thanks to Peter Vrabec Signed-off-by: Rainer Gerhards --- doc/gssapi.html | 118 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 118 insertions(+) create mode 100644 doc/gssapi.html (limited to 'doc/gssapi.html') diff --git a/doc/gssapi.html b/doc/gssapi.html new file mode 100644 index 00000000..400be4a3 --- /dev/null +++ b/doc/gssapi.html @@ -0,0 +1,118 @@ + +GSSAPI module support in rsyslog v3 + + + +

GSSAPI module support in rsyslog v3

What is it good for.

+client-serverauthentication
+Log +messages encryption

Requirements. +

Kerberos infrastructure
rsyslog, rsyslog-gssapi

Configuration. +

Let's assume there are 3 machines in kerberos Realm:

the +first is running KDC (Kerberos Authentication Service and Key +Distribution Center),
the second is a client sending its logs to the server,
the third is receiver, gathering all logs.

1. +KDC:

Kerberos +database must be properly set-up on KDC machine first. Use +kadmin/kadmin.local to do that. Two principals need to be add in our +case:

+
sender@REALM.ORG +
+

client must have ticket for pricipal sender
REALM.ORG is kerberos Realm

host/receiver.mydomain.com@REALM.ORG - service principal

Use ktadd to export service principal and transfer it to +/etc/krb5.keytab +on receiver

2. CLIENT: +

set-up rsyslog, in /etc/rsyslog.conf
$ModLoad omgssapi.so - load output gss module
$GSSForwardServiceName +otherThanHost - set the name of service principal, "host" is the +default one
*.* :omgssapi:receiver.mydomain.com - action line, forward +logs to receiver
kinit root - get the TGT ticket
service rsyslog start +

+

3. SERVER: +

+
set-up +rsyslog, in /etc/rsyslog.conf
+
+
$ModLoad +imgssapi.so - load input gss module
+
+
$InputGSSServerServiceName +otherThanHost - set the name of service principal, "host" is the +default one
+
+
$InputGSSServerPermitPlainTCP +on - accept GSS and TCP connections (not authenticated senders), off by +default
+
+
$InputGSSServerRun +514 - run server on port
+
+
service +rsyslog start
+

+The picture demonstrate +how things work. +

[rsyslog.conf overview] +[manual index] [rsyslog site]

+ \ No newline at end of file -- cgit