rsyslogのTLS（SSL）暗号化

rsyslogからrsyslogへ、WANを通してログ転送しよっかなーと思い立ったので、暗号化してみることにしました。

rsyslogも何気にキューを使えるので、fluentd と迷いましたが、そもそもログがsyslog系であり、流量もさほど多くないモノだったので、全サーバにいらっしゃるrsyslogさんに気張ってもらうことにしました。

リンク

TLS (SSL) Encrypting syslog rsyslog

TCP Syslog Input Module rsyslog

$MaxOpenFiles – rsyslog.conf file rsyslog

ssl encryption in rsyslog – Stack Overflow

Configuring Rsyslog to Encrypt Syslog Traffic with TLS in Ubuntu

Advent Calendar 2012 » Blog Archive » RSyslogを使ったログのセキュアな転送と集積

黒ぶちメガネのblog » Blog Archiv » rsyslogの通信をTLS（SSL）化してみた

サーバ

インストール

サーバ側はWheezyでやっています。

apt-get install rsyslog-gnutls gnutls-bin

1	apt-get install rsyslog-gnutls gnutls-bin

鍵の作成

適当に鍵置き場を作成しておきます。

mkdir -m0700 /etc/rsyslog.pem
cd /etc/rsyslog.pem

1 2	mkdir -m0700 /etc/rsyslog.pem cd /etc/rsyslog.pem

CA証明書を作成します。
対話部分のみ記載しておきます。

certtool --generate-privkey --outfile ca-key.pem --bits 2048
certtool --generate-self-signed --load-privkey ca-key.pem --outfile ca.pem
	Generating a self signed certificate...
	Please enter the details of the certificate's distinguished name. Just press enter to ignore a field.
	Country name (2 chars): JP
	Organization name: DRECOM CO., LTD.
	Organizational unit name: TeamGedow
	Locality name: Tokyo
	State or province name: Meguro-ku
	Common name: rsyslog-collector
	UID:
	This field should not be used in new certificates.
	E-mail:
	Enter the certificate's serial number in decimal (default: 1375846957):

	Activation/Expiration time.
	The certificate will expire in (days): 7300

	Extensions.
	Does the certificate belong to an authority? (y/N): y
	Path length constraint (decimal, -1 for no constraint):
	Is this a TLS web client certificate? (y/N): N
	Will the certificate be used for IPsec IKE operations? (y/N): N
	Is this also a TLS web server certificate? (y/N): N
	Enter the e-mail of the subject of the certificate:
	Will the certificate be used to sign other certificates? (y/N): y
	Will the certificate be used to sign CRLs? (y/N): N
	Will the certificate be used to sign code? (y/N): N
	Will the certificate be used to sign OCSP requests? (y/N): N
	Will the certificate be used for time stamping? (y/N): N
	Enter the URI of the CRL distribution point:

	Is the above information ok? (y/N): y

	Signing certificate...

certtool --generate-privkey --outfile ca-key.pem --bits 2048

certtool --generate-self-signed --load-privkey ca-key.pem --outfile ca.pem

Generating a self signed certificate...

Please enter the details of the certificate's distinguished name. Just press enter to ignore a field.

Country name (2 chars): JP

Organization name: DRECOM CO., LTD.

Organizational unit name: TeamGedow

Locality name: Tokyo

State or province name: Meguro-ku

Common name: rsyslog-collector

UID:

This field should not be used in new certificates.

E-mail:

Enter the certificate's serial number in decimal (default: 1375846957):

Activation/Expiration time.

The certificate will expire in (days): 7300

Extensions.

Does the certificate belong to an authority? (y/N): y

Path length constraint (decimal, -1 for no constraint):

Is this a TLS web client certificate? (y/N): N

Will the certificate be used for IPsec IKE operations? (y/N): N

Is this also a TLS web server certificate? (y/N): N

Enter the e-mail of the subject of the certificate:

Will the certificate be used to sign other certificates? (y/N): y

Will the certificate be used to sign CRLs? (y/N): N

Will the certificate be used to sign code? (y/N): N

Will the certificate be used to sign OCSP requests? (y/N): N

Will the certificate be used for time stamping? (y/N): N

Enter the URI of the CRL distribution point:

Is the above information ok? (y/N): y

Signing certificate...

サーバ証明書を作成します。

certtool --generate-privkey --outfile key.pem --bits 2048
certtool --generate-request --load-privkey key.pem --outfile request.pem
	Generating a PKCS #10 certificate request...
	Country name (2 chars): JP
	Organization name: DRECOM CO., LTD.
	Organizational unit name: TeamGedow
	Locality name: Tokyo
	State or province name: Meguro-ku
	Common name: rsyslog-collector
	UID:
	Enter a dnsName of the subject of the certificate:
	Enter the IP address of the subject of the certificate:
	Enter the e-mail of the subject of the certificate:
	Enter a challenge password:
	Does the certificate belong to an authority? (y/N): N
	Will the certificate be used for signing (DHE and RSA-EXPORT ciphersuites)? (y/N): N
	Will the certificate be used for encryption (RSA ciphersuites)? (y/N): N
	Is this a TLS web client certificate? (y/N): y
	Is this also a TLS web server certificate? (y/N): y

certtool --generate-certificate \
         --load-request request.pem \
         --load-ca-certificate ca.pem --load-ca-privkey ca-key.pem \
         --outfile cert.pem

	Generating a signed certificate...
	Enter the certificate's serial number in decimal (default: 1375847390):

	Activation/Expiration time.
	The certificate will expire in (days): 7300

	Extensions.
	Do you want to honour the extensions from the request? (y/N): N
	Does the certificate belong to an authority? (y/N): N
	Is this a TLS web client certificate? (y/N): y
	Will the certificate be used for IPsec IKE operations? (y/N): N
	Is this also a TLS web server certificate? (y/N): y
	Enter a dnsName of the subject of the certificate:
	Enter the IP address of the subject of the certificate:
	Will the certificate be used for signing (DHE and RSA-EXPORT ciphersuites)? (y/N): N
	Will the certificate be used for encryption (RSA ciphersuites)? (y/N): N

	Is the above information ok? (y/N): y

	Signing certificate...

certtool --generate-privkey --outfile key.pem --bits 2048

certtool --generate-request --load-privkey key.pem --outfile request.pem

Generating a PKCS #10 certificate request...

Country name (2 chars): JP

Organization name: DRECOM CO., LTD.

Organizational unit name: TeamGedow

Locality name: Tokyo

State or province name: Meguro-ku

Common name: rsyslog-collector

UID:

Enter a dnsName of the subject of the certificate:

Enter the IP address of the subject of the certificate:

Enter the e-mail of the subject of the certificate:

Enter a challenge password:

Does the certificate belong to an authority? (y/N): N

Will the certificate be used for signing (DHE and RSA-EXPORT ciphersuites)? (y/N): N

Will the certificate be used for encryption (RSA ciphersuites)? (y/N): N

Is this a TLS web client certificate? (y/N): y

Is this also a TLS web server certificate? (y/N): y

certtool --generate-certificate \

--load-request request.pem \

--load-ca-certificate ca.pem --load-ca-privkey ca-key.pem \

--outfile cert.pem

Generating a signed certificate...

Enter the certificate's serial number in decimal (default: 1375847390):

Activation/Expiration time.

The certificate will expire in (days): 7300

Extensions.

Do you want to honour the extensions from the request? (y/N): N

Does the certificate belong to an authority? (y/N): N

Is this a TLS web client certificate? (y/N): y

Will the certificate be used for IPsec IKE operations? (y/N): N

Is this also a TLS web server certificate? (y/N): y

Enter a dnsName of the subject of the certificate:

Enter the IP address of the subject of the certificate:

Will the certificate be used for signing (DHE and RSA-EXPORT ciphersuites)? (y/N): N

Will the certificate be used for encryption (RSA ciphersuites)? (y/N): N

Is the above information ok? (y/N): y

Signing certificate...

設定

TLS

この設定で、鍵を持つクライアントからの暗号化通信しか受け付けなくなります。

/etc/rsyslog.d/00-tls-server.conf

#
# TLS Server
#

# TCPによる通信を実現するモジュールを読み込む
$ModLoad imtcp

# デフォルトの受信方式をGnuTLSにする
$DefaultNetstreamDriver gtls

# 秘密鍵・証明書を設定する
$DefaultNetstreamDriverCAFile   /etc/rsyslog.pem/ca.pem
$DefaultNetstreamDriverCertFile /etc/rsyslog.pem/cert.pem
$DefaultNetstreamDriverKeyFile  /etc/rsyslog.pem/key.pem
 
# TLSによる暗号化通信を実行する
$InputTCPServerStreamDriverMode 1

# anonは認証なし
$InputTCPServerStreamDriverAuthMode anon

# セッションの最大接続数
$InputTCPMaxSessions 4000

# TCPコネクション数の上限
$MaxOpenFiles 65536

# 10514/TCPのポートを指定して待ち受けを行う
# 最後に配置しないと正しく動作しない
$InputTCPServerRun 10514

# TLS Server

# TCPによる通信を実現するモジュールを読み込む

$ModLoad imtcp

# デフォルトの受信方式をGnuTLSにする

$DefaultNetstreamDriver gtls

# 秘密鍵・証明書を設定する

$DefaultNetstreamDriverCAFile /etc/rsyslog.pem/ca.pem

$DefaultNetstreamDriverCertFile /etc/rsyslog.pem/cert.pem

$DefaultNetstreamDriverKeyFile /etc/rsyslog.pem/key.pem

# TLSによる暗号化通信を実行する

$InputTCPServerStreamDriverMode 1

# anonは認証なし

$InputTCPServerStreamDriverAuthMode anon

# セッションの最大接続数

$InputTCPMaxSessions 4000

# TCPコネクション数の上限

$MaxOpenFiles 65536

# 10514/TCPのポートを指定して待ち受けを行う

# 最後に配置しないと正しく動作しない

$InputTCPServerRun 10514

保存

ここではいったん、FORWARDログは適当なところに保存して破棄します。

/etc/rsyslog.d/50-collector-file.conf

if \
	$fromhost-ip != '127.0.0.1' \
then -/var/log/remote.log
& ~

if \

$fromhost-ip != '127.0.0.1' \

then -/var/log/remote.log

& ~

動作確認

設定の確認をします。

rsyslogd -N1

1	rsyslogd -N1

問題なければ再起動します。

/etc/init.d/rsyslog restart

1	/etc/init.d/rsyslog restart

クライアントから受けるアドレスで接続確認をします。失敗する場合は、$InputTCPServerRun の記述が最後になっているか、などを確認します。

gnutls-cli -p 10514 172.30.4.55

1	gnutls-cli -p 10514 172.30.4.55

クライアント

インストール

バージョンは、4.6 以上にしておけば大丈夫みたいです。

Debian Wheezy / Squeeze

apt-get install rsyslog rsyslog-gnutls

1	apt-get install rsyslog rsyslog-gnutls

Debian Lenny

標準は rsyslog3 なので、バックポートから持ってきます。

apt-get install rsyslog=4.6.4-2~bpo50+1 rsyslog-gnutls

1	apt-get install rsyslog=4.6.4-2~bpo50+1 rsyslog-gnutls

CentOS 5

標準が rsyslog じゃないので、入れ替えになります。リポジトリ書いて…

/etc/yum.repos.d/rsyslog.repo

[rsyslog_v5]
name=Adiscon CentOS-$releasever - local packages for $basearch
baseurl=http://rpms.adiscon.com/v5-stable/epel-$releasever/$basearch
enabled=1
gpgcheck=0
gpgkey=http://rpms.adiscon.com/RPM-GPG-KEY-Adiscon
protect=1

[rsyslog_v5]

name=Adiscon CentOS-$releasever - local packages for $basearch

baseurl=http://rpms.adiscon.com/v5-stable/epel-$releasever/$basearch

enabled=1

gpgcheck=0

gpgkey=http://rpms.adiscon.com/RPM-GPG-KEY-Adiscon

protect=1

インストールします。

yum install rsyslog rsyslog-gnutls

1	yum install rsyslog rsyslog-gnutls

CA証明書

クライアントにはサーバで作成したCA証明書のみコピーしておきます。

mkdir -m0700 /etc/rsyslog.pem
cd /etc/rsyslog.pem
cat ca.pem

mkdir -m0700 /etc/rsyslog.pem

cd /etc/rsyslog.pem

cat ca.pem

設定

TLS

/etc/rsyslog.d/00-tls-client.conf

#
# TLS Client
#

# デフォルトのドライバをGnuTLSにする
$DefaultNetstreamDriver gtls

# CA証明書を設定する
#	- cert, key は不要
$DefaultNetstreamDriverCAFile /etc/rsyslog.pem/ca.pem

# TLSによる暗号化通信を実行する
$ActionSendStreamDriverMode 1

# anonは認証なし
$ActionSendStreamDriverAuthMode anon

# TLS Client

# デフォルトのドライバをGnuTLSにする

$DefaultNetstreamDriver gtls

# CA証明書を設定する

# - cert, key は不要

$DefaultNetstreamDriverCAFile /etc/rsyslog.pem/ca.pem

# TLSによる暗号化通信を実行する

$ActionSendStreamDriverMode 1

# anonは認証なし

$ActionSendStreamDriverAuthMode anon

FORWARD

サーバダウン対策としてキューを利用しつつ、ここではsshdログだけリモートサーバに転送しています。
/etc/rsyslog.d/50-forward.conf

#
# Queue
#

# Where to place spool and state files
$WorkDirectory /var/spool/rsyslog

# unique name prefix for spool files
$ActionQueueFileName queue

# Disk space limit
$ActionQueueMaxDiskSpace 100m

# save messages to disk on shutdown
$ActionQueueSaveOnShutdown on

# run asynchronously
$ActionQueueType LinkedList

# infinite retries if host is down
$ActionResumeRetryCount -1

#
# FORWARD
#

# Forward important logs
if \
	$programname == 'sshd' \
then @@172.30.4.55:10514

# Queue

# Where to place spool and state files

$WorkDirectory /var/spool/rsyslog

# unique name prefix for spool files

$ActionQueueFileName queue

# Disk space limit

$ActionQueueMaxDiskSpace 100m

# save messages to disk on shutdown

$ActionQueueSaveOnShutdown on

# run asynchronously

$ActionQueueType LinkedList

# infinite retries if host is down

$ActionResumeRetryCount -1

# FORWARD

# Forward important logs

if \

$programname == 'sshd' \

then @@172.30.4.55:10514

設定反映と動作確認

再起動します。

# 設定確認
rsyslogd -N1

# 再起動
/etc/init.d/rsyslog restart

# 設定確認

rsyslogd -N1

# 再起動

/etc/init.d/rsyslog restart

確認作業として、サーバ側で tailf /var/log/remote.log しておきつつ、適当なユーザでクライアント側にSSHログインしてみます。ログの転送が確認できればOKです。転送されなければ、鍵か設定が間違っているのでやり直します。

FORWARD条件によっては、コマンドベースでログを吐き出してもテストできます。

logger -p auth.info "test by logger"

1	logger -p auth.info "test by logger"

気が向いたら、サーバを落としてみて、その間にログを保存させて、サーバを復旧させてみます。キューが正しく動いていれば、ロストなく再送されるはずです。

rsyslog自体なかなか好きですが、使い古されてるだけあって、調べるのが楽でいいですね。

モジュールやら設定がいっぱいあるので、まだまだ楽しめそうです。