Syslog sign

PlatinumX · 01-24-2010, 10:28 AM

Hey all,

In order to mitigate risks linked to the use of the classic syslog protcol (spoof, replay, tampering, lost messages...) I am looking for a product implementing the syslog-sign capability:
http://tools.ietf.org/html/draft-ietf-syslog-sign-29
which is still a draft in the IETF for the moment.

On NetBSD, the sylog daemon is able to run this feature:
http://netbsd-soc.sourceforge.net/pr...logd/sign.html

Did anybody tried this feature on a Linux system?

Thanks

unSpawn · 02-10-2010, 08:13 AM

Looking at http://www.loganalysis.org/syslog-replacements-unix/ some promising tools like nsyslogd aren't developed anymore (2000) or simply gone (Core SDI Secure syslog), the only ways that provide some form of security (meaning not addressing everything in the IETF draft) are SSL Encrypting Syslog with Stunnel and Encrypting log messages with TLS in syslog-ng. FWIW there's central Syslog nfo at http://www.syslog.org/ in case anyone needs it.

//NTLB