Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 9 down vote favorite
4

So I've got a few servers which I'd like to log centrally but obviously I don't want to pass the data insecurely over the internet.

I've tried syslog-ng but can't make it work in a secure way, a normal ssh -L PORT:localhost:PORT user@host SSH tunnel won't work because I believe that makes the logs appear to come from the local machine, and a VPN seems a bit like overkill.

share|improve this question

6 Answers

up vote 17 down vote accepted

Have you tried syslog-ng and stunnel?

  1. Install Stunnel
  2. Create certificate files for syslog-ng over Stunnel
  3. Configure Stunnel for Use With syslog-ng
  4. Install syslog-ng
  5. Configure syslog-ng
  6. DONE!

NOTE:

Stunnel (http://www.stunnel.org) is a program that allows you to encrypt arbitrary TCP connections inside SSL (Secure Sockets Layer) available on both Unix and Windows. Stunnel can allow you to secure non-SSL aware daemons and protocols (like POP, IMAP, LDAP, etc) by having Stunnel provide the encryption, requiring no changes to the daemon's code.

share|improve this answer
This is what we use to send syslog from our DMZ to our internal network. Works well. – Kamil Kisiel Jun 5 '09 at 22:46
For what it's worth, syslog-ng 3.x supports TLS natively, so, no need to use stunnel anymore. – synthesizer Feb 6 '12 at 7:28
up vote 10 down vote

Short answer: VPN

It may seem overkill, but it is the right answer and not that complicated to set up.

share|improve this answer
right!; openvpn.net is really simple to set up and just works. – pQd Jun 5 '09 at 20:56
Not only that, but it also gives you a lot more flexibility to manage and monitor the remote machines securely. OpenVPN (or even IPSec) will be much better in the long run. – Christopher Cashell Jun 12 '09 at 19:28
up vote 6 down vote

Rsyslog can do this. Encrypting Syslog Traffic with TLS

share|improve this answer
Aren't you still opening a port to the internet with this solution? I'd still be loathe to do that for something like this. – Kevin Kuphal Jun 5 '09 at 21:17
1  
Kevin: It's assumed that your syslog server would be expecting traffic from certain predetermined IPs, which is easy to accomplish via iptables – Matt Simmons Jun 5 '09 at 21:58
up vote 2 down vote

You might also check out the free Kiwi Secure Tunnel http://www.solarwinds.com/products/kiwi_syslog_server/related_tools.aspx

share|improve this answer
up vote 1 down vote

Use syslog-ng or another syslog daemon that supports TCP.

Send the data over an encrypted tunnel. Don't use an ssh tunnel, it is too fiddly.

UDP syslog is a historical braindamaged protocol that should have been eliminated long ago. If your vendor provides it by default, please lean on them.

If your vendor does not provide a syslog solution that signs each message before sending it on, lean on them.

The software is easy, the algorithms are easy. The politics of getting it installed by default are not.

share|improve this answer
up vote 1 down vote

I probably wouldn't send log data over the internet in the first place, but install a centralized loghost at the location(s) where needed.

These days, I prefer rsyslog to syslog-ng. It is a near drop in replacement, and has a variety of papers and howtos, including one on sending encrypted data with TLS/SSL (as of v3.19.0), older versions can still use stunnel.

In my experience with both rsyslog and syslog-ng, rsyslog wins out in ease of configurability, especially since you can use your existing syslog.conf, and add onto that.

For what it's worth, Rsyslog is the default syslog daemon on Debian Lenny (5.0), Ubuntu and Fedora.

share|improve this answer
It's just too bad that rsyslog hasn't yet added the new (planned) config file syntax. Right now, configuring rsyslog for anything non-trivial is painful compared to syslog-ng. – Christopher Cashell Jun 12 '09 at 19:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.