1 1.1 christos <html> 2 1.1 christos <head> 3 1.1 christos <title>NetBSD & Google's Summer of Code: Martin Schuette - Improve syslogd (syslogd)</title> 4 1.1 christos </head> 5 1.1 christos <body> 6 1.1 christos 7 1.1 christos <center> 8 1.1 christos <table> 9 1.1 christos <tr> 10 1.1 christos <td><a href="http://www.NetBSD.org/"><img border=0 valign="top" src="../../NetBSD.png" alt="[NetBSD logo]" /></a></td> 11 1.1 christos <td><font size="+5"> & </font></td> 12 1.1 christos <td><a href="http://www.google.com/"><img border=0 valign="bottom" src="http://www.google.com/intl/en/images/logo.gif" alt="[Google logo]" /></a></td> 13 1.1 christos </tr> 14 1.1 christos </table> 15 1.1 christos </center> 16 1.1 christos 17 1.1 christos <h1>NetBSD-SoC: Improve syslogd</h1> 18 1.1 christos 19 1.1 christos <h2>What is it?</h2> 20 1.1 christos 21 1.1 christos <p>The syslog daemon handles most log messages of a unixoid system. It receives messages from shell-scripts, applications, daemons, the kernel, or by network and then writes them into logfiles, on user's consoles or forwards them to some other logserver -- all depending on its configuration and the message properties.</p> 22 1.1 christos 23 1.1 christos <p>implemented the upcoming <a class="ext-link" href="http://tools.ietf.org/wg/syslog/">IETF 24 1.1 christos standards</a> for <a class="ext-link" href="http://www.netbsd.org/">NetBSD</a>'s syslog(3) 25 1.1 christos and syslogd(8): 26 1.1 christos </p> 27 1.1 christos <ul><li><a class="ext-link" 28 1.1 christos href="http://tools.ietf.org/html/draft-ietf-syslog-transport-tls"><span 29 1.1 christos class="icon">transport-tls</span></a> defines the network protocol to send 30 1.1 christos syslog data over TLS (instead of UDP), thus providing a reliable and 31 1.1 christos authenticated transport. 32 1.1 christos </li><li><a class="ext-link" 33 1.1 christos href="http://tools.ietf.org/html/draft-ietf-syslog-protocol"><span 34 1.1 christos class="icon">syslog-protocol</span></a> defines a new layout for syslog 35 1.1 christos lines; the most important additions are full timestamps (with year and timezone) 36 1.1 christos and structured data with name=value pairs. This enables all programs to declare 37 1.1 christos semantic content (uid, client IP, return codes, etc), making automatic 38 1.1 christos log-monitoring (or at least parsing) much easier. 39 1.1 christos </li><li><a class="ext-link" 40 1.1 christos href="http://tools.ietf.org/html/draft-ietf-syslog-sign"><span 41 1.1 christos class="icon">syslog-sign</span></a> defines signature messages to assert 42 1.1 christos authentication, integrity and correct sequencing of syslog messages. 43 1.1 christos </li></ul><p> 44 1.1 christos To my knowledge this is one of the first implementations of these 45 1.1 christos protocols. It will provide NetBSD (and hopefully the other BSDs as well) with 46 1.1 christos an advanced, reliable, and secure syslogd; thus saving admins the time and 47 1.1 christos effort to install custom logging solutions just to get secure transport to 48 1.1 christos their central logserver. 49 1.1 christos </p> 50 1.1 christos 51 1.1 christos <h2>Current Status</h2> 52 1.1 christos <h3>Functions</h3> 53 1.1 christos <h4>TLS</h4> 54 1.1 christos <p>The TLS support is now working (tested with RSA and DSA keys). 55 1.1 christos It will read its configuration from syslog.conf, accept incoming TLS connections 56 1.1 christos to receive messages, establish connections to other TLS servers.</p> 57 1.1 christos <p>If a TLS server is temporarily not available then its messages will be buffered 58 1.1 christos and sent after reconnection.</p> 59 1.1 christos 60 1.1 christos <h4>syslog-protocol</h4> 61 1.1 christos <p>A command line option determines whether syslogd output is in BSD Syslog or in syslog-protocol format. All received messages are converted accordingly.</p> 62 1.1 christos <p>I also modified syslog(3) in libc to send syslog-protocol messages.</p> 63 1.1 christos <p>While syslog(3) can only use the message field, a new syslogp(3) call is provided to add a MSGID and structured data to a message.</p> 64 1.1 christos 65 1.1 christos <h4>syslog-sign</h4> 66 1.1 christos <p>syslogd(8) is now able to <a href="sign.html">digitally sign messages with syslog-sign.</a></p> 67 1.1 christos 68 1.1 christos <h3>syslog.conf</h3> 69 1.1 christos <p>I extended the traditional configuration file format to support additionally fields for TLS. 70 1.1 christos A syslog.conf for TLS currently looks like this:</p> 71 1.1 christos <pre> 72 1.1 christos # TLS options 73 1.1 christos tls_ca="/etc/my.cacert" 74 1.1 christos tls_cert="/etc/localhost.crt" 75 1.1 christos tls_key="/etc/localhost.key" 76 1.1 christos tls_verify="off" 77 1.1 christos tls_bindhost="127.0.0.1" 78 1.1 christos tls_bindport="13245" 79 1.1 christos tls_server=on 80 1.1 christos 81 1.1 christos # file destination 82 1.1 christos *.* /home/mschuett/test.log 83 1.1 christos # UDP destination 84 1.1 christos *.* @192.168.178.5 85 1.1 christos # TLS destination 86 1.1 christos *.* @[127.0.0.1]:5555(fingerprint="SHA1:E4:E1:A6:1C:D4:31:D7:D4:9B:B8:DC:DF:DD:CE:30:71:46:00:92:C9") 87 1.1 christos </pre> 88 1.1 christos 89 1.1 christos <h3>Source Code</h3> 90 1.1 christos <p>To try syslogd fetch the latest <a href="http://mschuette.name/files/syslogd_080818.tar.gz">.tar.gz archive (2008-08-18)</a> (older versions: <a href="http://mschuette.name/files/syslogd_080805.tar.gz">2008-08-05</a>, <a href="http://mschuette.name/files/syslogd-tls.tar.gz">2008-08-05</a>).</p> 91 1.1 christos 92 1.1 christos <p>The sources for <a href="http://netbsd-soc.cvs.sourceforge.net/netbsd-soc/syslogd/src/">syslogd</a>, the <a href="http://netbsd-soc.cvs.sourceforge.net/netbsd-soc/syslogd/src-libc_gen/">libc functions</a>, <a href="http://netbsd-soc.cvs.sourceforge.net/netbsd-soc/syslogd/src-newsyslog/">newsyslog</a>, and <a href="http://netbsd-soc.cvs.sourceforge.net/netbsd-soc/syslogd/src-logger/">logger</a> are also available from the <a href="http://netbsd-soc.cvs.sourceforge.net/netbsd-soc/syslogd/">CVS on sourceforge</a>.</p> 93 1.1 christos 94 1.1 christos <p>For development I used an own <a href="https://anonymous:anonymous@barney.cs.uni-potsdam.de/svn/syslogd/trunk/src/">SVN</a>; a detailed timeline of code changes is available in the <a href="https://barney.cs.uni-potsdam.de/trac/syslogd/timeline">on my Trac</a>.</p> 95 1.1 christos 96 1.1 christos <p>The syslogd code needs <a href="http://www.openssl.org/ OpenSSL"></a> and <a href="http://www.monkey.org/~provos/libevent/">libevent</a>. The only system-dependent function is wallmsg() to write messages to users's terminals.<br/> 97 1.1 christos It was developed and tested on NetBSD and FreeBSD. I heard it does not compile on OpenBSD (I do not know about DragonflyBSD), probably due to different files under /usr/include. I would be interested if someone tried to compile on Linux; this will be some more work, because one will also need additional functions from BSDs libc that are not in glibc (most notably strlcat()).</p> 98 1.1 christos 99 1.1 christos <h2>Deliverables</h2> 100 1.1 christos <p> 101 1.1 christos I got all my <b>mandatory components</b>: 102 1.1 christos </p> 103 1.1 christos <ul> 104 1.1 christos <li>Implement transport-tls in syslogd(8)</li> 105 1.1 christos <li>Implement syslog-protocol in syslogd(8)</li> 106 1.1 christos <li>Implement syslog-protocol in syslog(3)</li> 107 1.1 christos <li>Implement syslog-sign in syslogd(8)</li> 108 1.1 christos </ul> 109 1.1 christos <p> 110 1.1 christos ...and parts of my <b>optional components</b>: 111 1.1 christos </p> 112 1.1 christos <ul> 113 1.1 christos <li>interoperability with other implementations: so far I could only test TLS-transport with rsyslog</li> 114 1.1 christos <li>Extended API to use new functions: with syslogp() I wrote a new API; but it is not really the extended API I had in mind here.</li> 115 1.1 christos </ul> 116 1.1 christos 117 1.1 christos <h2>Documentation</h2> 118 1.1 christos 119 1.1 christos <p>New manpages and description:</p> 120 1.1 christos <ul> 121 1.1 christos <li>my <a href="./doc/syslogd.8.html">syslogd(8)</a></li> 122 1.1 christos <li>my <a href="./doc/syslog.conf.5.html">syslog.conf(5)</a></li> 123 1.1 christos <li>my <a href="./doc/syslog.3.html">syslog(3)/syslogp(3)</a></li> 124 1.1 christos <li><a href="howto.html">How-To configure a TLS transport</a></li> 125 1.1 christos <li><a href="sign.html">Overview of syslog-sign and its usage</a></li> 126 1.1 christos </ul> 127 1.1 christos 128 1.1 christos <p>Existing specifications and man-pages:</p> 129 1.1 christos <ul> 130 1.1 christos <li><a href="http://tools.ietf.org/html/rfc3164">RFC3164: The BSD syslog Protocol</a></li> 131 1.1 christos <li><a href="http://netbsd.gw.com/cgi-bin/man-cgi?syslogd++NetBSD-current">syslogd(8)</a></li> 132 1.1 christos <li><a href="http://netbsd.gw.com/cgi-bin/man-cgi?syslog.conf+5+NetBSD-current">syslog.conf(5)</a></li> 133 1.1 christos <li><a href="http://netbsd.gw.com/cgi-bin/man-cgi?syslog+3+NetBSD-current">syslog(3)</a></li> 134 1.1 christos <li><a href="http://www.opengroup.org/onlinepubs/009695399/basedefs/syslog.h.html">SUS on syslog.h</a></li> 135 1.1 christos <li><a href="http://www.opengroup.org/onlinepubs/009695399/functions/syslog.html">SUS on syslog()</a></li> 136 1.1 christos </ul> 137 1.1 christos 138 1.1 christos <p>IETF documents:</p> 139 1.1 christos <ul> 140 1.1 christos <li><a href="http://tools.ietf.org/html/draft-ietf-syslog-transport-udp">Transmission of syslog messages over UDP (draft-ietf-syslog-transport-udp)</a></li> 141 1.1 christos <li><a href="http://tools.ietf.org/html/draft-ietf-syslog-transport-tls">TLS Transport Mapping for Syslog (draft-ietf-syslog-transport-tls)</a></li> 142 1.1 christos <li><a href="http://tools.ietf.org/html/draft-ietf-syslog-protocol">The syslog Protocol (draft-ietf-syslog-protocol)</a></li> 143 1.1 christos <li><a href="http://tools.ietf.org/html/draft-ietf-syslog-sign">Signed syslog Messages (draft-ietf-syslog-sign)</a></li> 144 1.1 christos </ul> 145 1.1 christos 146 1.1 christos <hr> 147 1.1 christos 148 1.1 christos <table border=0> 149 1.1 christos <tr> 150 1.1 christos <td> 151 1.1 christos <a href="http://sourceforge.net"><img align="top" src="http://sourceforge.net/sflogo.php?group_id=141771&type=2" width="125" height="37" border="0" alt="SourceForge.net Logo" /></a> 152 1.1 christos <td> 153 1.1 christos <table> 154 1.1 christos <tr> <td> Martin Schütte <<tt>info (a] mschuette.name</tt>> </td> </tr> 155 1.1 christos <tr> <td> $Id: index.html,v 1.1 2008/10/31 16:12:19 christos Exp $ </td> </tr> 156 1.1 christos </table> 157 1.1 christos </tr> 158 1.1 christos </table> 159 1.1 christos 160 1.1 christos </body> 161 1.1 christos </html> 162
Indexes created Sat Sep 20 22:09:52 GMT 2025