1SUDO_LOGSRVD(8) BSD System Manager's Manual SUDO_LOGSRVD(8)
2
4 sudo_logsrvd — sudo event and I/O log server
5
7 sudo_logsrvd [-hnV] [-f file] [-R percentage]
8
10 sudo_logsrvd is a high-performance log server that accepts event and I/O
11 logs from sudo. It can be used to implement centralized logging of sudo
12 logs. Event log entries may be logged either via syslog(3) or to a file.
13 I/O Logs created by sudo_logsrvd can be replayed via the sudoreplay(8)
14 utility in the same way as logs generated directly by the sudoers plugin.
15 The server also supports restarting interrupted log transfers. To dis‐
17 tinguish completed I/O logs from incomplete ones, the I/O log timing file
18 is set to be read-only when the log is complete.
19 Configuration parameters for sudo_logsrvd may be specified in the
21 sudo_logsrvd.conf(5) file.
22 The options are as follows:
24 -f, --file Read configuration from file instead of the default,
26 /etc/sudo_logsrvd.conf.
27 -h, --help Display a short help message to the standard output and exit.
29 -n, --no-fork
31 Run sudo_logsrvd in the foreground instead of detaching from
32 the terminal and becoming a daemon.
33 -R, --random-drop
35 For each message, there is a percentage chance that the
36 server will drop the connection. This is only intended for
37 debugging the ability of a client to restart a connection.
38 -V, --version
40 Print the sudo_logsrvd version and exit.
41 Securing server connections
43 The I/O log data sent to sudo_logsrvd may contain sensitive information
44 such as passwords and should be secured using Transport Layer Security
45 (TLS). Doing so requires having a signed certificate on the server and,
46 if tls_checkpeer is enabled in sudo_logsrvd.conf(5), a signed certificate
47 on the client as well.
48 The certificates can either be signed by a well-known Certificate Author‐
50 ity (CA), or a private CA can be used. Instructions for creating a pri‐
51 vate CA are included below in the EXAMPLES section.
52 Debugging sudo_logsrvd
54 sudo_logsrvd supports a flexible debugging framework that is configured
55 via Debug lines in the sudo.conf(5) file.
56 For more information on configuring sudo.conf(5), please refer to its
58 manual.
59
61 /etc/sudo.conf Sudo front end configuration
62 /etc/sudo_logsrvd.conf Sudo log server configuration file
64 /var/log/sudo-io Default I/O log file location
66
68 Creating self-signed certificates
69 Unless you are using certificates signed by a well-known Certificate
70 Authority (or a local enterprise CA), you will need to create your own CA
71 that can sign the certificates used by sudo_logsrvd, sudo_sendlog, and
72 the sudoers plugin. The following steps use the openssl(1) command to
73 create keys and certificates.
74 Initial setup
76 First, we need to create a directory structure to store the files for the
77 CA. We'll create a new directory hierarchy in /etc/ssl/sudo for this
78 purpose.
79 # mkdir /etc/ssl/sudo
81 # cd /etc/ssl/sudo
82 # mkdir certs csr newcerts private
83 # chmod 700 private
84 # touch index.txt
85 # echo 1000 > serial
86 The serial and index.txt files are used to keep track of signed certifi‐
88 cates.
89 Next, we need to make a copy of the openssl.conf file and customize it
91 for our new CA. The path to openssl.cnf is system-dependent but
92 /etc/ssl/openssl.cnf is the most common location. You will need to
93 adjust the example below if it has a different location on your system.
94 # cp /etc/ssl/openssl.cnf .
96 Now edit the openssl.cnf file in the current directory and make sure it
98 contains “ca” and “CA_default” sections. Those sections should include
99 the following settings:
100 [ ca ]
102 default_ca = CA_default
103 [ CA_default ]
105 dir = /etc/ssl/sudo
106 certs = $dir/certs
107 database = $dir/index.txt
108 certificate = $dir/cacert.pem
109 serial = $dir/serial
110 If your openssl.conf file already has a “CA_default” section, you may
112 only need to modify the “dir” setting.
113 Creating the CA key and certificate
115 In order to create and sign our own certificates, we need to create a
116 private key and a certificate for the root of the CA. First, create the
117 private key and protect it with a pass phrase:
118 # openssl genrsa -aes256 -out private/cakey.pem 4096
120 # chmod 400 private/cakey.pem
121 Next, generate the root certificate, using appropriate values for the
123 site-specific fields:
124 # openssl req -config openssl.cnf -key private/cakey.pem \
126 -new -x509 -days 7300 -sha256 -extensions v3_ca \
127 -out cacert.pem
128 Enter pass phrase for private/cakey.pem:
130 You are about to be asked to enter information that will be
131 incorporated into your certificate request.
132 What you are about to enter is what is called a Distinguished Name
133 or a DN.
134 There are quite a few fields but you can leave some blank.
135 For some fields there will be a default value,
136 If you enter '.', the field will be left blank.
137 -----
138 Country Name (2 letter code) [AU]:US
139 State or Province Name (full name) [Some-State]:Colorado
140 Locality Name (eg, city) []:
141 Organization Name (eg, company) [Internet Widgits Pty Ltd]:sudo
142 Organizational Unit Name (eg, section) []:sudo Certificate Authority
143 Common Name (e.g., server FQDN or YOUR name) []:sudo Root CA
144 Email Address []:
145 # chmod 444 cacert.pem
147 Finally, verify the root certificate:
149 # openssl x509 -noout -text -in cacert.pem
151 Creating and signing certificates
153 The server and client certificates will be signed by the previously cre‐
154 ated root CA. Usually, the root CA is not used to sign server/client
155 certificates directly. Instead, intermediate certificates are created
156 and signed with the root CA and the intermediate certs are used to sign
157 CSRs (Certificate Signing Request). In this example we'll skip this part
158 for simplicity's sake and sign the CSRs with the root CA.
159 First, generate the private key without a pass phrase.
161 # openssl genrsa -out private/logsrvd_key.pem 2048
163 # chmod 400 private/logsrvd_key.pem
164 Next, create a certificate signing request (CSR) for the server's cer‐
166 tificate. The organization name must match the name given in the root
167 certificate. The common name should be either the server's IP address or
168 a fully qualified domain name.
169 # openssl req -config openssl.cnf -key private/logsrvd_key.pem -new \
171 -sha256 -out csr/logsrvd_csr.pem
172 Enter pass phrase for private/logsrvd_key.pem:
174 You are about to be asked to enter information that will be
175 incorporated into your certificate request.
176 What you are about to enter is what is called a Distinguished Name
177 or a DN.
178 There are quite a few fields but you can leave some blank.
179 For some fields there will be a default value,
180 If you enter '.', the field will be left blank.
181 -----
182 Country Name (2 letter code) [AU]:US
183 State or Province Name (full name) [Some-State]:Colorado
184 Locality Name (eg, city) []:
185 Organization Name (eg, company) [Internet Widgits Pty Ltd]:sudo
186 Organizational Unit Name (eg, section) []:sudo log server
187 Common Name (e.g., server FQDN or YOUR name) []:logserver.example.com
188 Email Address []:
189 Please enter the following 'extra' attributes
191 to be sent with your certificate request
192 A challenge password []:
193 An optional company name []:
194 Now sign the CSR that was just created:
196 # openssl ca -config openssl.cnf -days 375 -notext -md sha256 \
198 -in csr/logsrvd_csr.pem -out certs/logsrvd_cert.pem
199 Using configuration from openssl.cnf
201 Enter pass phrase for ./private/cakey.pem:
202 Check that the request matches the signature
203 Signature ok
204 Certificate Details:
205 Serial Number: 4096 (0x1000)
206 Validity
207 Not Before: Nov 11 14:05:05 2019 GMT
208 Not After : Nov 20 14:05:05 2020 GMT
209 Subject:
210 countryName = US
211 stateOrProvinceName = Colorado
212 organizationName = sudo
213 organizationalUnitName = sudo log server
214 commonName = logserve.example.com
215 X509v3 extensions:
216 X509v3 Basic Constraints:
217 CA:FALSE
218 Netscape Comment:
219 OpenSSL Generated Certificate
220 X509v3 Subject Key Identifier:
221 4C:50:F9:D0:BE:1A:4C:B2:AC:90:76:56:C7:9E:16:AE:E6:9E:E5:B5
222 X509v3 Authority Key Identifier:
223 keyid:D7:91:24:16:B1:03:06:65:1A:7A:6E:CF:51:E9:5C:CB:7A:95:3E:0C
224 Certificate is to be certified until Nov 20 14:05:05 2020 GMT (375 days)
226 Sign the certificate? [y/n]:y
227 1 out of 1 certificate requests certified, commit? [y/n]y
229 Write out database with 1 new entries
230 Data Base Updated
231 Finally, verify the new certificate:
233 # openssl verify -CAfile cacert.pem certs/logsrvd_cert.pem
235 certs/logsrvd_cert.pem: OK
236 The /etc/ssl/sudo/certs directory now contains a signed and verified cer‐
238 tificate for use with sudo_logsrvd.
239 To generate a client certificate, repeat the process above using a dif‐
241 ferent file name.
242 Configuring sudo_logsrvd to use TLS
244 To use TLS for client/server communication, both sudo_logsrvd and the
245 sudoers plugin need to be configured to use TLS. Configuring
246 sudo_logsrvd for TLS requires the following settings, assuming the same
247 path names used earlier:
248 # If set, secure connections with TLS 1.2 or 1.3.
250 tls = true
251 # Path to the certificate authority bundle file in PEM format.
253 tls_cacert = /etc/ssl/sudo/cacert.pem
254 # Path to the server's certificate file in PEM format.
256 tls_cert = /etc/ssl/sudo/certs/logsrvd_cert.pem
257 # Path to the server's private key file in PEM format.
259 tls_key = /etc/ssl/sudo/private/logsrvd_key.pem
260 The root CA cert (cacert.pem) must be installed on the system running
262 sudo_logsrvd. If peer authentication is enabled on the client, a copy of
263 cacert.pem must be present on the client system too.
264
266 sudo.conf(5), sudo_logsrvd.conf(5), sudoers(5), sudo(8), sudo_sendlog(8),
267 sudoreplay(8)
268
270 Many people have worked on sudo over the years; this version consists of
271 code written primarily by:
272 Todd C. Miller
274 See the CONTRIBUTORS file in the sudo distribution
276 (https://www.sudo.ws/contributors.html) for an exhaustive list of people
277 who have contributed to sudo.
278
280 If you feel you have found a bug in sudo_logsrvd, please submit a bug
281 report at https://bugzilla.sudo.ws/
282
284 Limited free support is available via the sudo-users mailing list, see
285 https://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or search
286 the archives.
287
289 sudo_logsrvd is provided “AS IS” and any express or implied warranties,
290 including, but not limited to, the implied warranties of merchantability
291 and fitness for a particular purpose are disclaimed. See the LICENSE
292 file distributed with sudo or https://www.sudo.ws/license.html for com‐
293 plete details.
294Sudo 1.9.0b4 October 16, 2019 Sudo 1.9.0b4