From 9374a46543e9c43c009f80def8c3b2506b0b377e Mon Sep 17 00:00:00 2001 From: Michael Biebl Date: Thu, 3 Apr 2014 03:08:50 +0200 Subject: Imported Upstream version 8.2.0 --- doc/gssapi.html | 118 -------------------------------------------------------- 1 file changed, 118 deletions(-) delete mode 100644 doc/gssapi.html (limited to 'doc/gssapi.html') diff --git a/doc/gssapi.html b/doc/gssapi.html deleted file mode 100644 index 3ad7d07..0000000 --- a/doc/gssapi.html +++ /dev/null @@ -1,118 +0,0 @@ - -GSSAPI module support in rsyslog v3 - - - -

GSSAPI module support in rsyslog v3

What is it good for.

-client-serverauthentication
-Log -messages encryption

Requirements. -

Kerberos infrastructure
rsyslog, rsyslog-gssapi

Configuration. -

Let's assume there are 3 machines in kerberos Realm:

the -first is running KDC (Kerberos Authentication Service and Key -Distribution Center),
the second is a client sending its logs to the server,
the third is receiver, gathering all logs.

1. -KDC:

Kerberos -database must be properly set-up on KDC machine first. Use -kadmin/kadmin.local to do that. Two principals need to be add in our -case:

-
sender@REALM.ORG -
-

client must have ticket for pricipal sender
REALM.ORG is kerberos Realm

host/receiver.mydomain.com@REALM.ORG - service principal

Use ktadd to export service principal and transfer it to -/etc/krb5.keytab -on receiver

2. CLIENT: -

set-up rsyslog, in /etc/rsyslog.conf
$ModLoad omgssapi - load output gss module
$GSSForwardServiceName -otherThanHost - set the name of service principal, "host" is the -default one
*.* :omgssapi:receiver.mydomain.com - action line, forward -logs to receiver
kinit root - get the TGT ticket
service rsyslog start -

-

3. SERVER: -

-
set-up -rsyslog, in /etc/rsyslog.conf
-
-
$ModLoad -imgssapi - load input gss module
-
-
$InputGSSServerServiceName -otherThanHost - set the name of service principal, "host" is the -default one
-
-
$InputGSSServerPermitPlainTCP -on - accept GSS and TCP connections (not authenticated senders), off by -default
-
-
$InputGSSServerRun -514 - run server on port
-
-
service -rsyslog start
-

-The picture demonstrate -how things work. -

[rsyslog.conf overview] -[manual index] [rsyslog site]

- -- cgit v1.2.3