rsyslog, A Receiver For Other Hosts' Logs, Over TLS

rsyslog-remote

A log receiver, and the proof that it receives. The role turns the rsyslog EL 10 already ships into a collector: a plaintext port for senders that cannot do TLS, RFC 5425's TLS port for those that can, and one file per sending host under /var/log/remote. The live test sends a message to each port and finds both, in the right file, with the right mode.

No download, and no version to pin. EL 10 packages rsyslog and the OpenSSL netstream driver it needs, so the role installs them by name and takes what the distribution ships: a security update arrives through dnf, not through a new release of this role. What the role owns is the receiver's configuration and the proof that it receives.

A self-signed pair, once, or your own. A receiver with no certificate cannot open its TLS port at all, so the role creates a self-signed pair the first time and never touches it again. Point rsyslog_remote_tls_cert/_key/_ca at a CA-issued pair and the role leaves them alone; set rsyslog_remote_tls_auth_mode: x509/name and give the senders certificates to make the trust mutual rather than one-way.

The distribution's unit, our configuration. The role installs rsyslog, rsyslog-openssl and openssl, writes one drop-in under /etc/rsyslog.d, and enables the unit the package already ships: systemctl cat rsyslog shows the distribution's own unit, not one this role invented.

The default listen address is loopback, and a receiver has to change it. Unlike the other roles in this catalogue, this one exists to be reached from other hosts, so 127.0.0.1 is a starting point rather than a destination: set rsyslog_remote_listen_address to the address the senders can reach, and open the port to them and to nobody else. The default is there so that installing the role never silently exposes a new port, and so the live test can prove the receiver works before anything is exposed at all.

The ruleset ends with stop, and the live test proves it. A receiver that also writes other hosts' messages into its own /var/log/messages makes every local alert ambiguous. The verify sends both messages and then asserts the count in the local log is zero.

The TLS port refuses a plaintext client. The verify pushes a bare syslog line at 6514 and asserts nothing was written, which is the half of a TLS claim that a successful handshake does not cover.

The packaged unit's UMask=0066 beats fileCreateMode. A received log asked for at 0640 is created 0600, because the mask is applied after rsyslog chooses the mode. The result is tighter than asked for, which is why it is easy to miss: the role asks for 0600 so that the file and the configuration say the same thing, and the live test reads the mode off the file rather than the config.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.