1*3e07920fSDavid van Moolenbroek<html> 2*3e07920fSDavid van Moolenbroek<head> 3*3e07920fSDavid van Moolenbroek<title>NetBSD & Google's Summer of Code: Martin Schuette - Improve syslogd (syslogd)</title> 4*3e07920fSDavid van Moolenbroek</head> 5*3e07920fSDavid van Moolenbroek<body> 6*3e07920fSDavid van Moolenbroek 7*3e07920fSDavid van Moolenbroek<h1>Testing syslogd</h1> 8*3e07920fSDavid van Moolenbroek<h2>Compiling</h2> 9*3e07920fSDavid van Moolenbroek<p>A (hopefully) stable version for testing is available by <a href="http://netbsd-soc.cvs.sourceforge.net/netbsd-soc/syslogd/src/">CVS</a> and as a <a href="syslogd-tls.tar.gz">.tar.gz archive</a>. It contains syslogd itself and all necessary files to build on NetBSD and FreeBSD.</p> 10*3e07920fSDavid van Moolenbroek 11*3e07920fSDavid van Moolenbroek<p>To build just type <span style="font-family: monospace;">make</span>. Unless you have a complete NetBSD source tree -- then you can extract the files to <span style="font-family: monospace;">/usr/src/usr.sbin/syslogd</span> and replace the <span style="font-family: monospace;">Makefile</span> with <span style="font-family: monospace;">Makefile.NetBSD</span> and then type <span style="font-family: monospace;">make</span>. 12*3e07920fSDavid van Moolenbroek 13*3e07920fSDavid van Moolenbroek<h3>Note on other BSDs</h3> 14*3e07920fSDavid van Moolenbroek<p>I also tested syslogd on FreeBSD. There are just a few issues/differences:</p> 15*3e07920fSDavid van Moolenbroek<ul> 16*3e07920fSDavid van Moolenbroek <li>You have to install libevent first</li> 17*3e07920fSDavid van Moolenbroek <li>No pidfile is written</li> 18*3e07920fSDavid van Moolenbroek <li>The code for wallmsg() is only copied, not tested</li> 19*3e07920fSDavid van Moolenbroek</ul> 20*3e07920fSDavid van Moolenbroek<p>I assume the same holds for other BSDs but I have no live system to test them.</p> 21*3e07920fSDavid van Moolenbroek 22*3e07920fSDavid van Moolenbroek 23*3e07920fSDavid van Moolenbroek<h2>Command line options</h2> 24*3e07920fSDavid van Moolenbroek<p>syslogd has to be run as root (because it uses chroot()). You should start it with option "-u username" to drop privileges.</p> 25*3e07920fSDavid van Moolenbroek 26*3e07920fSDavid van Moolenbroek<p>By default messages are written in syslog Protocol format. To get the BSD Syslog output like from previous versions use the "-o" option.</p> 27*3e07920fSDavid van Moolenbroek 28*3e07920fSDavid van Moolenbroek<h2>syslog.conf</h2> 29*3e07920fSDavid van Moolenbroek 30*3e07920fSDavid van Moolenbroek<p>To use TLS some additional configuration is required.</p> 31*3e07920fSDavid van Moolenbroek 32*3e07920fSDavid van Moolenbroek<h3>X.509 certificates</h3> 33*3e07920fSDavid van Moolenbroek<p>Every syslogd using TLS needs an X.509 certificate. 34*3e07920fSDavid van MoolenbroekThe files containing the private key, certificate, and CA are configured with:</p> 35*3e07920fSDavid van Moolenbroek<pre> 36*3e07920fSDavid van Moolenbroektls_key="/etc/openssl/default.key" 37*3e07920fSDavid van Moolenbroektls_cert="/etc/openssl/default.crt" 38*3e07920fSDavid van Moolenbroektls_ca="/some/where/my.cacert" 39*3e07920fSDavid van Moolenbroek</pre> 40*3e07920fSDavid van Moolenbroek 41*3e07920fSDavid van Moolenbroek<p>If you do not already have a X.509 certificate then you can tell syslogd to generate one for you with</p> 42*3e07920fSDavid van Moolenbroek<pre> 43*3e07920fSDavid van Moolenbroektls_gen_cert=on 44*3e07920fSDavid van Moolenbroek</pre> 45*3e07920fSDavid van Moolenbroek 46*3e07920fSDavid van Moolenbroek<h3>TLS client</h3> 47*3e07920fSDavid van Moolenbroek<p>To send messages with configure a TLS destination. Here are three examples with different additional options required for authentication</p> 48*3e07920fSDavid van Moolenbroek<pre> 49*3e07920fSDavid van Moolenbroek# with CA 50*3e07920fSDavid van Moolenbroek*.* @[logserver.example.org]:13245 51*3e07920fSDavid van Moolenbroek*.* @[127.0.0.1]:13245(subject="logserver.example.org") 52*3e07920fSDavid van Moolenbroek# without CA 53*3e07920fSDavid van Moolenbroek*.* @[127.0.0.1]:13245(fingerprint="SHA1:E4:E1:A6:1C:D4:31:D7:D4:9B:B8:DC:DF:DD:CE:30:71:46:00:92:C9") 54*3e07920fSDavid van Moolenbroek</pre> 55*3e07920fSDavid van Moolenbroek 56*3e07920fSDavid van Moolenbroek<p>If using a CA then it is checked whether the server's certificate matches the hostname or a given subject. Assuming the logserver's certificate has "logserver.example.org" as its commonName or as a subjectAltName/dnsName the first line is sufficient. (Once a standard portnumber has been assigned the port becomes optional.) If we do not want to rely on DNS and configure the destination with "127.0.0.1" then the subject comparison will fail. The alternatives are either to configure the subject as an option (as in the example above) or to generate a new certificate with the server's IP as a commonName or subjectAltName/ipAddress.</p> 57*3e07920fSDavid van Moolenbroek 58*3e07920fSDavid van Moolenbroek<p>Without a CA the easiest way to authenticate the peer's certificate is its fingerprint as in the last line in the example. syslogd logs the fingerprints of all certificates it loads or tries to connect with, but it can also be read from the shell with "openssl x509 -in /etc/openssl/default.crt -noout -fingerprint".</p> 59*3e07920fSDavid van Moolenbroek 60*3e07920fSDavid van Moolenbroek<h3>TLS server</h3> 61*3e07920fSDavid van Moolenbroek<p>To enable TLS server mode use these lines.</p> 62*3e07920fSDavid van Moolenbroek<pre> 63*3e07920fSDavid van Moolenbroektls_server="on" 64*3e07920fSDavid van Moolenbroektls_bindhost="127.0.0.1" 65*3e07920fSDavid van Moolenbroektls_bindport="13245" 66*3e07920fSDavid van Moolenbroek</pre> 67*3e07920fSDavid van Moolenbroek<p>The bindhost is optional. The bindport is currently required (as long as there is no tcp port defined for the syslog service).</p> 68*3e07920fSDavid van Moolenbroek 69*3e07920fSDavid van Moolenbroek<p>With a CA that is all -- there is no additional hostname check for clients. 70*3e07920fSDavid van MoolenbroekWithout a CA the server needs to be told which certificates to trust:</p> 71*3e07920fSDavid van Moolenbroek<pre> 72*3e07920fSDavid van Moolenbroektls_allow_fingerprints = MD5:00:A2:A7:02:CA:A0:0E:00:DC:F1:91:BE:6A:AA:FF:27 "SHA1:E4:E1:A6:1C:D4:31:D7:D4:9B:B8:DC:DF:DD:CE:30:71:46:00:92:C9" 73*3e07920fSDavid van Moolenbroek</pre> 74*3e07920fSDavid van Moolenbroek 75*3e07920fSDavid van Moolenbroek<hr> 76*3e07920fSDavid van Moolenbroek<table border=0> 77*3e07920fSDavid van Moolenbroek<tr> 78*3e07920fSDavid van Moolenbroek<td> 79*3e07920fSDavid van Moolenbroek<a href="http://sourceforge.net"><img align="top" src="http://sourceforge.net/sflogo.php?group_id=141771&type=2" width="125" height="37" border="0" alt="SourceForge.net Logo" /></a> 80*3e07920fSDavid van Moolenbroek<td> 81*3e07920fSDavid van Moolenbroek <table> 82*3e07920fSDavid van Moolenbroek <tr> <td> Martin Schütte <<tt>info@mschuette.name</tt>> </td> </tr> 83*3e07920fSDavid van Moolenbroek <tr> <td> $Id: howto.html,v 1.1 2008/10/31 16:12:19 christos Exp $ </td> </tr> 84*3e07920fSDavid van Moolenbroek </table> 85*3e07920fSDavid van Moolenbroek</tr> 86*3e07920fSDavid van Moolenbroek</table> 87*3e07920fSDavid van Moolenbroek 88*3e07920fSDavid van Moolenbroek</body> 89*3e07920fSDavid van Moolenbroek</html> 90