Syslog daemon that implements RFC 5848 “Signed Syslog Messages”

Securitysyslog

I was looking at the Syslog standards and found RFC 5848 "Signed Syslog Messages". I then tried to find out which syslog daemons supported this standard. But to my surprise syslog-ng and rsyslog both don't support it.

I only found an old presentation from 2002 for FreeBSD, but to my knowledge FreeBSD doesn't support this.

So my questions:

which Syslog implementation(s) do support RFC 5848?
It would also be nice to know why it is not implemented?

Best Answer

Although there is no official support in syslog-ng, giova23 needed the same feature and wrote a plugin called syslog-sign. It's on github, please follow the link. Installation instructions are provided.

Related Solutions

Receiving Syslog messages with a systemd Arch Linux

You can write a poor man's syslog server quite easily with socat. You just need a service unit like this:

[Service]
Restart=on-success
ExecStart=/usr/bin/socat -u UDP-RECV:514 STDOUT

It will blindly send anything received on the syslog service port to the systemd journal. Save the above as, say, /etc/systemd/system/syslog.service and then

# systemctl daemon-reload
# systemctl start syslog

You then just need your source to send messages to UDP port 514 on your listening server.

You may want to enhance this to actually parse the received data and format it but it isn't necessary if all you want to do is journal what's received.

(socat is in the Arch Linux Extra repository: pacman -S socat)

Ssh – Separate messages of multiple sshds in syslog-ng

Change the name of the executable (note that that also affects PAM configuration).

ln /path/to/sshd /path/to/sshd-whatever

Start as /path/to/sshd-whatever. And define PAM configuration in /etc/pam.d/sshd-whatever. Log entries will show as sshd-whatever instead of sshd.

Best Answer

Related Solutions

Receiving Syslog messages with a systemd Arch Linux

Ssh – Separate messages of multiple sshds in syslog-ng

Related Question