GSSAPI module support in rsyslog v3 — rsyslog 8.2412.0 documentation

# GSSAPI module support in rsyslog v3

What is it good for.

- client-serverauthentication

- Log messages encryption

Requirements.

- Kerberos infrastructure

- rsyslog, rsyslog-gssapi

Configuration.

Let’s assume there are 3 machines in Kerberos Realm:

- the first is running KDC (Kerberos Authentication Service and Key Distribution Center),

- the second is a client sending its logs to the server,

- the third is receiver, gathering all logs.

1. KDC:

- Kerberos database must be properly set-up on KDC machine first. Use kadmin/kadmin.local to do that. Two principals need to be add in our case:

1. sender@REALM.ORG

- client must have ticket for principal sender

- REALM.ORG is kerberos Realm

1. host/receiver.mydomain.com@REALM.ORG - service principal

- Use ktadd to export service principal and transfer it to /etc/krb5.keytab on receiver

2. CLIENT:

- set-up rsyslog, in /etc/rsyslog.conf

- $ModLoad omgssapi - load output gss module

- $GSSForwardServiceName otherThanHost - set the name of service principal, “host” is the default one

- *.* :omgssapi:receiver.mydomain.com - action line, forward logs to receiver

- kinit root - get the TGT ticket

- service rsyslog start

3. SERVER:

- set-up rsyslog, in /etc/rsyslog.conf

- $ModLoad imgssapi - load input gss module

- $InputGSSServerServiceName otherThanHost - set the name of service principal, “host” is the default one

- $InputGSSServerPermitPlainTCP on - accept GSS and TCP connections (not authenticated senders), off by default

- $InputGSSServerRun 514 - run server on port

- service rsyslog start

The picture demonstrate how things work.

rsyslog gssapi support

See also

Help with configuring/using `Rsyslog`:

- Mailing list - best route for general questions

- GitHub: rsyslog source project - detailed questions, reporting issues that are believed to be bugs with `Rsyslog`

See also

Contributing to `Rsyslog`:

- Source project: rsyslog project README.

- Documentation: rsyslog-doc project README

Copyright 2008-2023 Rainer Gerhards (Großrinderfeld), and Others.