1SUDO_LOGSRVD(8)           BSD System Manager's Manual          SUDO_LOGSRVD(8)
2

NAME

4     sudo_logsrvd — sudo event and I/O log server
5

SYNOPSIS

7     sudo_logsrvd [-hnV] [-f file] [-R percentage]
8

DESCRIPTION

10     sudo_logsrvd is a high-performance log server that accepts event and I/O
11     logs from sudo.  It can be used to implement centralized logging of sudo
12     logs.  Event log entries may be logged either via syslog(3) or to a file.
13     I/O Logs created by sudo_logsrvd can be replayed via the sudoreplay(8)
14     utility in the same way as logs generated directly by the sudoers plugin.
15
16     The server also supports restarting interrupted log transfers.  To dis‐
17     tinguish completed I/O logs from incomplete ones, the I/O log timing file
18     is set to be read-only when the log is complete.
19
20     Configuration parameters for sudo_logsrvd may be specified in the
21     sudo_logsrvd.conf(5) file.
22
23     The options are as follows:
24
25     -f, --file  Read configuration from file instead of the default,
26                 /etc/sudo_logsrvd.conf.
27
28     -h, --help  Display a short help message to the standard output and exit.
29
30     -n, --no-fork
31                 Run sudo_logsrvd in the foreground instead of detaching from
32                 the terminal and becoming a daemon.
33
34     -R, --random-drop
35                 For each message, there is a percentage chance that the
36                 server will drop the connection.  This is only intended for
37                 debugging the ability of a client to restart a connection.
38
39     -V, --version
40                 Print the sudo_logsrvd version and exit.
41
42   Securing server connections
43     The I/O log data sent to sudo_logsrvd may contain sensitive information
44     such as passwords and should be secured using Transport Layer Security
45     (TLS).  Doing so requires having a signed certificate on the server and,
46     if tls_checkpeer is enabled in sudo_logsrvd.conf(5), a signed certificate
47     on the client as well.
48
49     The certificates can either be signed by a well-known Certificate Author‐
50     ity (CA), or a private CA can be used.  Instructions for creating a pri‐
51     vate CA are included below in the EXAMPLES section.
52
53   Debugging sudo_logsrvd
54     sudo_logsrvd supports a flexible debugging framework that is configured
55     via Debug lines in the sudo.conf(5) file.
56
57     For more information on configuring sudo.conf(5), please refer to its
58     manual.
59

FILES

61     /etc/sudo.conf            Sudo front end configuration
62
63     /etc/sudo_logsrvd.conf    Sudo log server configuration file
64
65     /var/log/sudo-io          Default I/O log file location
66

EXAMPLES

68   Creating self-signed certificates
69     Unless you are using certificates signed by a well-known Certificate
70     Authority (or a local enterprise CA), you will need to create your own CA
71     that can sign the certificates used by sudo_logsrvd, sudo_sendlog, and
72     the sudoers plugin.  The following steps use the openssl(1) command to
73     create keys and certificates.
74
75   Initial setup
76     First, we need to create a directory structure to store the files for the
77     CA.  We'll create a new directory hierarchy in /etc/ssl/sudo for this
78     purpose.
79
80           # mkdir /etc/ssl/sudo
81           # cd /etc/ssl/sudo
82           # mkdir certs csr newcerts private
83           # chmod 700 private
84           # touch index.txt
85           # echo 1000 > serial
86
87     The serial and index.txt files are used to keep track of signed certifi‐
88     cates.
89
90     Next, we need to make a copy of the openssl.conf file and customize it
91     for our new CA.  The path to openssl.cnf is system-dependent but
92     /etc/ssl/openssl.cnf is the most common location.  You will need to
93     adjust the example below if it has a different location on your system.
94
95           # cp /etc/ssl/openssl.cnf .
96
97     Now edit the openssl.cnf file in the current directory and make sure it
98     contains “ca” and “CA_default” sections.  Those sections should include
99     the following settings:
100
101           [ ca ]
102           default_ca      = CA_default
103
104           [ CA_default ]
105           dir             = /etc/ssl/sudo
106           certs           = $dir/certs
107           database        = $dir/index.txt
108           certificate     = $dir/cacert.pem
109           serial          = $dir/serial
110
111     If your openssl.conf file already has a “CA_default” section, you may
112     only need to modify the “dir” setting.
113
114   Creating the CA key and certificate
115     In order to create and sign our own certificates, we need to create a
116     private key and a certificate for the root of the CA.  First, create the
117     private key and protect it with a pass phrase:
118
119           # openssl genrsa -aes256 -out private/cakey.pem 4096
120           # chmod 400 private/cakey.pem
121
122     Next, generate the root certificate, using appropriate values for the
123     site-specific fields:
124
125           # openssl req -config openssl.cnf -key private/cakey.pem \
126               -new -x509 -days 7300 -sha256 -extensions v3_ca \
127               -out cacert.pem
128
129           Enter pass phrase for private/cakey.pem:
130           You are about to be asked to enter information that will be
131           incorporated into your certificate request.
132           What you are about to enter is what is called a Distinguished Name
133           or a DN.
134           There are quite a few fields but you can leave some blank.
135           For some fields there will be a default value,
136           If you enter '.', the field will be left blank.
137           -----
138           Country Name (2 letter code) [AU]:US
139           State or Province Name (full name) [Some-State]:Colorado
140           Locality Name (eg, city) []:
141           Organization Name (eg, company) [Internet Widgits Pty Ltd]:sudo
142           Organizational Unit Name (eg, section) []:sudo Certificate Authority
143           Common Name (e.g., server FQDN or YOUR name) []:sudo Root CA
144           Email Address []:
145
146           # chmod 444 cacert.pem
147
148     Finally, verify the root certificate:
149
150           # openssl x509 -noout -text -in cacert.pem
151
152   Creating and signing certificates
153     The server and client certificates will be signed by the previously cre‐
154     ated root CA.  Usually, the root CA is not used to sign server/client
155     certificates directly.  Instead, intermediate certificates are created
156     and signed with the root CA and the intermediate certs are used to sign
157     CSRs (Certificate Signing Request).  In this example we'll skip this part
158     for simplicity's sake and sign the CSRs with the root CA.
159
160     First, generate the private key without a pass phrase.
161
162           # openssl genrsa -out private/logsrvd_key.pem 2048
163           # chmod 400 private/logsrvd_key.pem
164
165     Next, create a certificate signing request (CSR) for the server's cer‐
166     tificate.  The organization name must match the name given in the root
167     certificate.  The common name should be either the server's IP address or
168     a fully qualified domain name.
169
170           # openssl req -config openssl.cnf -key private/logsrvd_key.pem -new \
171               -sha256 -out csr/logsrvd_csr.pem
172
173           Enter pass phrase for private/logsrvd_key.pem:
174           You are about to be asked to enter information that will be
175           incorporated into your certificate request.
176           What you are about to enter is what is called a Distinguished Name
177           or a DN.
178           There are quite a few fields but you can leave some blank.
179           For some fields there will be a default value,
180           If you enter '.', the field will be left blank.
181           -----
182           Country Name (2 letter code) [AU]:US
183           State or Province Name (full name) [Some-State]:Colorado
184           Locality Name (eg, city) []:
185           Organization Name (eg, company) [Internet Widgits Pty Ltd]:sudo
186           Organizational Unit Name (eg, section) []:sudo log server
187           Common Name (e.g., server FQDN or YOUR name) []:logserver.example.com
188           Email Address []:
189
190           Please enter the following 'extra' attributes
191           to be sent with your certificate request
192           A challenge password []:
193           An optional company name []:
194
195     Now sign the CSR that was just created:
196
197           # openssl ca -config openssl.cnf -days 375 -notext -md sha256 \
198               -in csr/logsrvd_csr.pem -out certs/logsrvd_cert.pem
199
200           Using configuration from openssl.cnf
201           Enter pass phrase for ./private/cakey.pem:
202           Check that the request matches the signature
203           Signature ok
204           Certificate Details:
205                   Serial Number: 4096 (0x1000)
206                   Validity
207                       Not Before: Nov 11 14:05:05 2019 GMT
208                       Not After : Nov 20 14:05:05 2020 GMT
209                   Subject:
210                       countryName               = US
211                       stateOrProvinceName       = Colorado
212                       organizationName          = sudo
213                       organizationalUnitName    = sudo log server
214                       commonName                = logserve.example.com
215                   X509v3 extensions:
216                       X509v3 Basic Constraints:
217                           CA:FALSE
218                       Netscape Comment:
219                           OpenSSL Generated Certificate
220                       X509v3 Subject Key Identifier:
221                           4C:50:F9:D0:BE:1A:4C:B2:AC:90:76:56:C7:9E:16:AE:E6:9E:E5:B5
222                       X509v3 Authority Key Identifier:
223                           keyid:D7:91:24:16:B1:03:06:65:1A:7A:6E:CF:51:E9:5C:CB:7A:95:3E:0C
224
225           Certificate is to be certified until Nov 20 14:05:05 2020 GMT (375 days)
226           Sign the certificate? [y/n]:y
227
228           1 out of 1 certificate requests certified, commit? [y/n]y
229           Write out database with 1 new entries
230           Data Base Updated
231
232     Finally, verify the new certificate:
233
234           # openssl verify -CAfile cacert.pem certs/logsrvd_cert.pem
235           certs/logsrvd_cert.pem: OK
236
237     The /etc/ssl/sudo/certs directory now contains a signed and verified cer‐
238     tificate for use with sudo_logsrvd.
239
240     To generate a client certificate, repeat the process above using a dif‐
241     ferent file name.
242
243   Configuring sudo_logsrvd to use TLS
244     To use TLS for client/server communication, both sudo_logsrvd and the
245     sudoers plugin need to be configured to use TLS.  Configuring
246     sudo_logsrvd for TLS requires the following settings, assuming the same
247     path names used earlier:
248
249           # If set, secure connections with TLS 1.2 or 1.3.
250           tls = true
251
252           # Path to the certificate authority bundle file in PEM format.
253           tls_cacert = /etc/ssl/sudo/cacert.pem
254
255           # Path to the server's certificate file in PEM format.
256           tls_cert = /etc/ssl/sudo/certs/logsrvd_cert.pem
257
258           # Path to the server's private key file in PEM format.
259           tls_key = /etc/ssl/sudo/private/logsrvd_key.pem
260
261     The root CA cert (cacert.pem) must be installed on the system running
262     sudo_logsrvd.  If peer authentication is enabled on the client, a copy of
263     cacert.pem must be present on the client system too.
264

SEE ALSO

266     sudo.conf(5), sudo_logsrvd.conf(5), sudoers(5), sudo(8), sudo_sendlog(8),
267     sudoreplay(8)
268

AUTHORS

270     Many people have worked on sudo over the years; this version consists of
271     code written primarily by:
272
273           Todd C. Miller
274
275     See the CONTRIBUTORS file in the sudo distribution
276     (https://www.sudo.ws/contributors.html) for an exhaustive list of people
277     who have contributed to sudo.
278

BUGS

280     If you feel you have found a bug in sudo_logsrvd, please submit a bug
281     report at https://bugzilla.sudo.ws/
282

SUPPORT

284     Limited free support is available via the sudo-users mailing list, see
285     https://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or search
286     the archives.
287

DISCLAIMER

289     sudo_logsrvd is provided “AS IS” and any express or implied warranties,
290     including, but not limited to, the implied warranties of merchantability
291     and fitness for a particular purpose are disclaimed.  See the LICENSE
292     file distributed with sudo or https://www.sudo.ws/license.html for com‐
293     plete details.
294
295Sudo 1.9.0b4                   October 16, 2019                   Sudo 1.9.0b4
Impressum