1SUDO_LOGSRVD(8) BSD System Manager's Manual SUDO_LOGSRVD(8)
2
4 sudo_logsrvd — sudo event and I/O log server
5
7 sudo_logsrvd [-hnV] [-f file] [-R percentage]
8
10 sudo_logsrvd is a high-performance log server that accepts event and I/O
11 logs from sudo. It can be used to implement centralized logging of sudo
12 logs. Event log entries may be logged either via syslog(3) or to a file.
13 I/O Logs created by sudo_logsrvd can be replayed via the sudoreplay(8)
14 utility in the same way as logs generated directly by the sudoers plugin.
15 The server also supports restarting interrupted log transfers. To dis‐
17 tinguish completed I/O logs from incomplete ones, the I/O log timing file
18 is set to be read-only when the log is complete.
19 Configuration parameters for sudo_logsrvd may be specified in the
21 sudo_logsrvd.conf(5) file.
22 The options are as follows:
24 -f, --file Read configuration from file instead of the default,
26 /etc/sudo_logsrvd.conf.
27 -h, --help Display a short help message to the standard output and exit.
29 -n, --no-fork
31 Run sudo_logsrvd in the foreground instead of detaching from
32 the terminal and becoming a daemon.
33 -R, --random-drop
35 For each message, there is a percentage chance that the
36 server will drop the connection. This is only intended for
37 debugging the ability of a client to restart a connection.
38 -V, --version
40 Print the sudo_logsrvd version and exit.
41 Securing server connections
43 The I/O log data sent to sudo_logsrvd may contain sensitive information
44 such as passwords and should be secured using Transport Layer Security
45 (TLS). Doing so requires having a signed certificate on the server and,
46 if tls_checkpeer is enabled in sudo_logsrvd.conf(5), a signed certificate
47 on the client as well.
48 The certificates can either be signed by a well-known Certificate Author‐
50 ity (CA), or a private CA can be used. Instructions for creating a pri‐
51 vate CA are included below in the EXAMPLES section.
52 Debugging sudo_logsrvd
54 sudo_logsrvd supports a flexible debugging framework that is configured
55 via Debug lines in the sudo.conf(5) file.
56 For more information on configuring sudo.conf(5), please refer to its
58 manual.
59
61 /etc/sudo.conf Sudo front end configuration
62 /etc/sudo_logsrvd.conf Sudo log server configuration file
64 /var/log/sudo-io Default I/O log file location
66 /run/sudo/sudo_logsrvd.pid
68 Process ID file for sudo_logsrvd
69
71 Creating self-signed certificates
72 Unless you are using certificates signed by a well-known Certificate
73 Authority (or a local enterprise CA), you will need to create your own CA
74 that can sign the certificates used by sudo_logsrvd, sudo_sendlog, and
75 the sudoers plugin. The following steps use the openssl(1) command to
76 create keys and certificates.
77 Initial setup
79 First, we need to create a directory structure to store the files for the
80 CA. We'll create a new directory hierarchy in /etc/ssl/sudo for this
81 purpose.
82 # mkdir /etc/ssl/sudo
84 # cd /etc/ssl/sudo
85 # mkdir certs csr newcerts private
86 # chmod 700 private
87 # touch index.txt
88 # echo 1000 > serial
89 The serial and index.txt files are used to keep track of signed certifi‐
91 cates.
92 Next, we need to make a copy of the openssl.conf file and customize it
94 for our new CA. The path to openssl.cnf is system-dependent but
95 /etc/ssl/openssl.cnf is the most common location. You will need to
96 adjust the example below if it has a different location on your system.
97 # cp /etc/ssl/openssl.cnf .
99 Now edit the openssl.cnf file in the current directory and make sure it
101 contains “ca” and “CA_default” sections. Those sections should include
102 the following settings:
103 [ ca ]
105 default_ca = CA_default
106 [ CA_default ]
108 dir = /etc/ssl/sudo
109 certs = $dir/certs
110 database = $dir/index.txt
111 certificate = $dir/cacert.pem
112 serial = $dir/serial
113 If your openssl.conf file already has a “CA_default” section, you may
115 only need to modify the “dir” setting.
116 Creating the CA key and certificate
118 In order to create and sign our own certificates, we need to create a
119 private key and a certificate for the root of the CA. First, create the
120 private key and protect it with a pass phrase:
121 # openssl genrsa -aes256 -out private/cakey.pem 4096
123 # chmod 400 private/cakey.pem
124 Next, generate the root certificate, using appropriate values for the
126 site-specific fields:
127 # openssl req -config openssl.cnf -key private/cakey.pem \
129 -new -x509 -days 7300 -sha256 -extensions v3_ca \
130 -out cacert.pem
131 Enter pass phrase for private/cakey.pem:
133 You are about to be asked to enter information that will be
134 incorporated into your certificate request.
135 What you are about to enter is what is called a Distinguished Name
136 or a DN.
137 There are quite a few fields but you can leave some blank.
138 For some fields there will be a default value,
139 If you enter '.', the field will be left blank.
140 -----
141 Country Name (2 letter code) [AU]:US
142 State or Province Name (full name) [Some-State]:Colorado
143 Locality Name (eg, city) []:
144 Organization Name (eg, company) [Internet Widgits Pty Ltd]:sudo
145 Organizational Unit Name (eg, section) []:sudo Certificate Authority
146 Common Name (e.g., server FQDN or YOUR name) []:sudo Root CA
147 Email Address []:
148 # chmod 444 cacert.pem
150 Finally, verify the root certificate:
152 # openssl x509 -noout -text -in cacert.pem
154 Creating and signing certificates
156 The server and client certificates will be signed by the previously cre‐
157 ated root CA. Usually, the root CA is not used to sign server/client
158 certificates directly. Instead, intermediate certificates are created
159 and signed with the root CA and the intermediate certs are used to sign
160 CSRs (Certificate Signing Request). In this example we'll skip this part
161 for simplicity's sake and sign the CSRs with the root CA.
162 First, generate the private key without a pass phrase.
164 # openssl genrsa -out private/logsrvd_key.pem 2048
166 # chmod 400 private/logsrvd_key.pem
167 Next, create a certificate signing request (CSR) for the server's cer‐
169 tificate. The organization name must match the name given in the root
170 certificate. The common name should be either the server's IP address or
171 a fully qualified domain name.
172 # openssl req -config openssl.cnf -key private/logsrvd_key.pem -new \
174 -sha256 -out csr/logsrvd_csr.pem
175 Enter pass phrase for private/logsrvd_key.pem:
177 You are about to be asked to enter information that will be
178 incorporated into your certificate request.
179 What you are about to enter is what is called a Distinguished Name
180 or a DN.
181 There are quite a few fields but you can leave some blank.
182 For some fields there will be a default value,
183 If you enter '.', the field will be left blank.
184 -----
185 Country Name (2 letter code) [AU]:US
186 State or Province Name (full name) [Some-State]:Colorado
187 Locality Name (eg, city) []:
188 Organization Name (eg, company) [Internet Widgits Pty Ltd]:sudo
189 Organizational Unit Name (eg, section) []:sudo log server
190 Common Name (e.g., server FQDN or YOUR name) []:logserver.example.com
191 Email Address []:
192 Please enter the following 'extra' attributes
194 to be sent with your certificate request
195 A challenge password []:
196 An optional company name []:
197 Now sign the CSR that was just created:
199 # openssl ca -config openssl.cnf -days 375 -notext -md sha256 \
201 -in csr/logsrvd_csr.pem -out certs/logsrvd_cert.pem
202 Using configuration from openssl.cnf
204 Enter pass phrase for ./private/cakey.pem:
205 Check that the request matches the signature
206 Signature ok
207 Certificate Details:
208 Serial Number: 4096 (0x1000)
209 Validity
210 Not Before: Nov 11 14:05:05 2019 GMT
211 Not After : Nov 20 14:05:05 2020 GMT
212 Subject:
213 countryName = US
214 stateOrProvinceName = Colorado
215 organizationName = sudo
216 organizationalUnitName = sudo log server
217 commonName = logserve.example.com
218 X509v3 extensions:
219 X509v3 Basic Constraints:
220 CA:FALSE
221 Netscape Comment:
222 OpenSSL Generated Certificate
223 X509v3 Subject Key Identifier:
224 4C:50:F9:D0:BE:1A:4C:B2:AC:90:76:56:C7:9E:16:AE:E6:9E:E5:B5
225 X509v3 Authority Key Identifier:
226 keyid:D7:91:24:16:B1:03:06:65:1A:7A:6E:CF:51:E9:5C:CB:7A:95:3E:0C
227 Certificate is to be certified until Nov 20 14:05:05 2020 GMT (375 days)
229 Sign the certificate? [y/n]:y
230 1 out of 1 certificate requests certified, commit? [y/n]y
232 Write out database with 1 new entries
233 Data Base Updated
234 Finally, verify the new certificate:
236 # openssl verify -CAfile cacert.pem certs/logsrvd_cert.pem
238 certs/logsrvd_cert.pem: OK
239 The /etc/ssl/sudo/certs directory now contains a signed and verified cer‐
241 tificate for use with sudo_logsrvd.
242 To generate a client certificate, repeat the process above using a dif‐
244 ferent file name.
245 Configuring sudo_logsrvd to use TLS
247 To use TLS for client/server communication, both sudo_logsrvd and the
248 sudoers plugin need to be configured to use TLS. Configuring
249 sudo_logsrvd for TLS requires the following settings, assuming the same
250 path names used earlier:
251 # If set, secure connections with TLS 1.2 or 1.3.
253 tls = true
254 # Path to the certificate authority bundle file in PEM format.
256 tls_cacert = /etc/ssl/sudo/cacert.pem
257 # Path to the server's certificate file in PEM format.
259 tls_cert = /etc/ssl/sudo/certs/logsrvd_cert.pem
260 # Path to the server's private key file in PEM format.
262 tls_key = /etc/ssl/sudo/private/logsrvd_key.pem
263 The root CA cert (cacert.pem) must be installed on the system running
265 sudo_logsrvd. If peer authentication is enabled on the client, a copy of
266 cacert.pem must be present on the client system too.
267
269 sudo.conf(5), sudo_logsrvd.conf(5), sudoers(5), sudo(8), sudo_sendlog(8),
270 sudoreplay(8)
271
273 Many people have worked on sudo over the years; this version consists of
274 code written primarily by:
275 Todd C. Miller
277 See the CONTRIBUTORS file in the sudo distribution
279 (https://www.sudo.ws/contributors.html) for an exhaustive list of people
280 who have contributed to sudo.
281
283 If you feel you have found a bug in sudo_logsrvd, please submit a bug
284 report at https://bugzilla.sudo.ws/
285
287 Limited free support is available via the sudo-users mailing list, see
288 https://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or search
289 the archives.
290
292 sudo_logsrvd is provided “AS IS” and any express or implied warranties,
293 including, but not limited to, the implied warranties of merchantability
294 and fitness for a particular purpose are disclaimed. See the LICENSE
295 file distributed with sudo or https://www.sudo.ws/license.html for com‐
296 plete details.
297Sudo 1.9.5p2 March 28, 2020 Sudo 1.9.5p2