11.1Schristos<html> 21.1Schristos<head> 31.1Schristos<title>NetBSD & Google's Summer of Code: Martin Schuette - Improve syslogd (syslogd)</title> 41.1Schristos</head> 51.1Schristos<body> 61.1Schristos 71.1Schristos<center> 81.1Schristos<table> 91.1Schristos<tr> 101.1Schristos <td><a href="http://www.NetBSD.org/"><img border=0 valign="top" src="../../NetBSD.png" alt="[NetBSD logo]" /></a></td> 111.1Schristos <td><font size="+5"> & </font></td> 121.1Schristos <td><a href="http://www.google.com/"><img border=0 valign="bottom" src="http://www.google.com/intl/en/images/logo.gif" alt="[Google logo]" /></a></td> 131.1Schristos</tr> 141.1Schristos</table> 151.1Schristos</center> 161.1Schristos 171.1Schristos<h1>NetBSD-SoC: Improve syslogd</h1> 181.1Schristos 191.1Schristos<h2>What is it?</h2> 201.1Schristos 211.1Schristos<p>The syslog daemon handles most log messages of a unixoid system. It receives messages from shell-scripts, applications, daemons, the kernel, or by network and then writes them into logfiles, on user's consoles or forwards them to some other logserver -- all depending on its configuration and the message properties.</p> 221.1Schristos 231.1Schristos<p>implemented the upcoming <a class="ext-link" href="http://tools.ietf.org/wg/syslog/">IETF 241.1Schristosstandards</a> for <a class="ext-link" href="http://www.netbsd.org/">NetBSD</a>'s syslog(3) 251.1Schristosand syslogd(8): 261.1Schristos</p> 271.1Schristos<ul><li><a class="ext-link" 281.1Schristos href="http://tools.ietf.org/html/draft-ietf-syslog-transport-tls"><span 291.1Schristos class="icon">transport-tls</span></a> defines the network protocol to send 301.1Schristos syslog data over TLS (instead of UDP), thus providing a reliable and 311.1Schristos authenticated transport. 321.1Schristos </li><li><a class="ext-link" 331.1Schristos href="http://tools.ietf.org/html/draft-ietf-syslog-protocol"><span 341.1Schristos class="icon">syslog-protocol</span></a> defines a new layout for syslog 351.1Schristoslines; the most important additions are full timestamps (with year and timezone) 361.1Schristosand structured data with name=value pairs. This enables all programs to declare 371.1Schristossemantic content (uid, client IP, return codes, etc), making automatic 381.1Schristoslog-monitoring (or at least parsing) much easier. 391.1Schristos</li><li><a class="ext-link" 401.1Schristoshref="http://tools.ietf.org/html/draft-ietf-syslog-sign"><span 411.1Schristos class="icon">syslog-sign</span></a> defines signature messages to assert 421.1Schristos authentication, integrity and correct sequencing of syslog messages. 431.1Schristos</li></ul><p> 441.1Schristos To my knowledge this is one of the first implementations of these 451.1Schristos protocols. It will provide NetBSD (and hopefully the other BSDs as well) with 461.1Schristos an advanced, reliable, and secure syslogd; thus saving admins the time and 471.1Schristos effort to install custom logging solutions just to get secure transport to 481.1Schristos their central logserver. 491.1Schristos</p> 501.1Schristos 511.1Schristos<h2>Current Status</h2> 521.1Schristos<h3>Functions</h3> 531.1Schristos<h4>TLS</h4> 541.1Schristos<p>The TLS support is now working (tested with RSA and DSA keys). 551.1SchristosIt will read its configuration from syslog.conf, accept incoming TLS connections 561.1Schristosto receive messages, establish connections to other TLS servers.</p> 571.1Schristos<p>If a TLS server is temporarily not available then its messages will be buffered 581.1Schristosand sent after reconnection.</p> 591.1Schristos 601.1Schristos<h4>syslog-protocol</h4> 611.1Schristos<p>A command line option determines whether syslogd output is in BSD Syslog or in syslog-protocol format. All received messages are converted accordingly.</p> 621.1Schristos<p>I also modified syslog(3) in libc to send syslog-protocol messages.</p> 631.1Schristos<p>While syslog(3) can only use the message field, a new syslogp(3) call is provided to add a MSGID and structured data to a message.</p> 641.1Schristos 651.1Schristos<h4>syslog-sign</h4> 661.1Schristos<p>syslogd(8) is now able to <a href="sign.html">digitally sign messages with syslog-sign.</a></p> 671.1Schristos 681.1Schristos<h3>syslog.conf</h3> 691.1Schristos<p>I extended the traditional configuration file format to support additionally fields for TLS. 701.1SchristosA syslog.conf for TLS currently looks like this:</p> 711.1Schristos<pre> 721.1Schristos# TLS options 731.1Schristostls_ca="/etc/my.cacert" 741.1Schristostls_cert="/etc/localhost.crt" 751.1Schristostls_key="/etc/localhost.key" 761.1Schristostls_verify="off" 771.1Schristostls_bindhost="127.0.0.1" 781.1Schristostls_bindport="13245" 791.1Schristostls_server=on 801.1Schristos 811.1Schristos# file destination 821.1Schristos*.* /home/mschuett/test.log 831.1Schristos# UDP destination 841.1Schristos*.* @192.168.178.5 851.1Schristos# TLS destination 861.1Schristos*.* @[127.0.0.1]:5555(fingerprint="SHA1:E4:E1:A6:1C:D4:31:D7:D4:9B:B8:DC:DF:DD:CE:30:71:46:00:92:C9") 871.1Schristos</pre> 881.1Schristos 891.1Schristos<h3>Source Code</h3> 901.1Schristos<p>To try syslogd fetch the latest <a href="http://mschuette.name/files/syslogd_080818.tar.gz">.tar.gz archive (2008-08-18)</a> (older versions: <a href="http://mschuette.name/files/syslogd_080805.tar.gz">2008-08-05</a>, <a href="http://mschuette.name/files/syslogd-tls.tar.gz">2008-08-05</a>).</p> 911.1Schristos 921.1Schristos<p>The sources for <a href="http://netbsd-soc.cvs.sourceforge.net/netbsd-soc/syslogd/src/">syslogd</a>, the <a href="http://netbsd-soc.cvs.sourceforge.net/netbsd-soc/syslogd/src-libc_gen/">libc functions</a>, <a href="http://netbsd-soc.cvs.sourceforge.net/netbsd-soc/syslogd/src-newsyslog/">newsyslog</a>, and <a href="http://netbsd-soc.cvs.sourceforge.net/netbsd-soc/syslogd/src-logger/">logger</a> are also available from the <a href="http://netbsd-soc.cvs.sourceforge.net/netbsd-soc/syslogd/">CVS on sourceforge</a>.</p> 931.1Schristos 941.1Schristos<p>For development I used an own <a href="https://anonymous:anonymous@barney.cs.uni-potsdam.de/svn/syslogd/trunk/src/">SVN</a>; a detailed timeline of code changes is available in the <a href="https://barney.cs.uni-potsdam.de/trac/syslogd/timeline">on my Trac</a>.</p> 951.1Schristos 961.1Schristos<p>The syslogd code needs <a href="http://www.openssl.org/ OpenSSL"></a> and <a href="http://www.monkey.org/~provos/libevent/">libevent</a>. The only system-dependent function is wallmsg() to write messages to users's terminals.<br/> 971.1SchristosIt was developed and tested on NetBSD and FreeBSD. I heard it does not compile on OpenBSD (I do not know about DragonflyBSD), probably due to different files under /usr/include. I would be interested if someone tried to compile on Linux; this will be some more work, because one will also need additional functions from BSDs libc that are not in glibc (most notably strlcat()).</p> 981.1Schristos 991.1Schristos<h2>Deliverables</h2> 1001.1Schristos<p> 1011.1SchristosI got all my <b>mandatory components</b>: 1021.1Schristos</p> 1031.1Schristos<ul> 1041.1Schristos <li>Implement transport-tls in syslogd(8)</li> 1051.1Schristos <li>Implement syslog-protocol in syslogd(8)</li> 1061.1Schristos <li>Implement syslog-protocol in syslog(3)</li> 1071.1Schristos <li>Implement syslog-sign in syslogd(8)</li> 1081.1Schristos</ul> 1091.1Schristos<p> 1101.1Schristos...and parts of my <b>optional components</b>: 1111.1Schristos</p> 1121.1Schristos<ul> 1131.1Schristos <li>interoperability with other implementations: so far I could only test TLS-transport with rsyslog</li> 1141.1Schristos <li>Extended API to use new functions: with syslogp() I wrote a new API; but it is not really the extended API I had in mind here.</li> 1151.1Schristos</ul> 1161.1Schristos 1171.1Schristos<h2>Documentation</h2> 1181.1Schristos 1191.1Schristos<p>New manpages and description:</p> 1201.1Schristos<ul> 1211.1Schristos <li>my <a href="./doc/syslogd.8.html">syslogd(8)</a></li> 1221.1Schristos <li>my <a href="./doc/syslog.conf.5.html">syslog.conf(5)</a></li> 1231.1Schristos <li>my <a href="./doc/syslog.3.html">syslog(3)/syslogp(3)</a></li> 1241.1Schristos <li><a href="howto.html">How-To configure a TLS transport</a></li> 1251.1Schristos <li><a href="sign.html">Overview of syslog-sign and its usage</a></li> 1261.1Schristos</ul> 1271.1Schristos 1281.1Schristos<p>Existing specifications and man-pages:</p> 1291.1Schristos<ul> 1301.1Schristos <li><a href="http://tools.ietf.org/html/rfc3164">RFC3164: The BSD syslog Protocol</a></li> 1311.1Schristos <li><a href="http://netbsd.gw.com/cgi-bin/man-cgi?syslogd++NetBSD-current">syslogd(8)</a></li> 1321.1Schristos <li><a href="http://netbsd.gw.com/cgi-bin/man-cgi?syslog.conf+5+NetBSD-current">syslog.conf(5)</a></li> 1331.1Schristos <li><a href="http://netbsd.gw.com/cgi-bin/man-cgi?syslog+3+NetBSD-current">syslog(3)</a></li> 1341.1Schristos <li><a href="http://www.opengroup.org/onlinepubs/009695399/basedefs/syslog.h.html">SUS on syslog.h</a></li> 1351.1Schristos <li><a href="http://www.opengroup.org/onlinepubs/009695399/functions/syslog.html">SUS on syslog()</a></li> 1361.1Schristos</ul> 1371.1Schristos 1381.1Schristos<p>IETF documents:</p> 1391.1Schristos<ul> 1401.1Schristos <li><a href="http://tools.ietf.org/html/draft-ietf-syslog-transport-udp">Transmission of syslog messages over UDP (draft-ietf-syslog-transport-udp)</a></li> 1411.1Schristos <li><a href="http://tools.ietf.org/html/draft-ietf-syslog-transport-tls">TLS Transport Mapping for Syslog (draft-ietf-syslog-transport-tls)</a></li> 1421.1Schristos <li><a href="http://tools.ietf.org/html/draft-ietf-syslog-protocol">The syslog Protocol (draft-ietf-syslog-protocol)</a></li> 1431.1Schristos <li><a href="http://tools.ietf.org/html/draft-ietf-syslog-sign">Signed syslog Messages (draft-ietf-syslog-sign)</a></li> 1441.1Schristos</ul> 1451.1Schristos 1461.1Schristos<hr> 1471.1Schristos 1481.1Schristos<table border=0> 1491.1Schristos<tr> 1501.1Schristos<td> 1511.1Schristos<a href="http://sourceforge.net"><img align="top" src="http://sourceforge.net/sflogo.php?group_id=141771&type=2" width="125" height="37" border="0" alt="SourceForge.net Logo" /></a> 1521.1Schristos<td> 1531.1Schristos <table> 1541.1Schristos <tr> <td> Martin Schütte <<tt>info@mschuette.name</tt>> </td> </tr> 1551.1Schristos <tr> <td> $Id: index.html,v 1.1 2008/10/31 16:12:19 christos Exp $ </td> </tr> 1561.1Schristos </table> 1571.1Schristos</tr> 1581.1Schristos</table> 1591.1Schristos 1601.1Schristos</body> 1611.1Schristos</html> 162
