1SUDO_LOGSRVD(8) BSD System Manager's Manual SUDO_LOGSRVD(8)
2
4 sudo_logsrvd — sudo event and I/O log server
5
7 sudo_logsrvd [-hnV] [-f file] [-R percentage]
8
10 sudo_logsrvd is a high-performance log server that accepts event and I/O
11 logs from sudo. It can be used to implement centralized logging of sudo
12 logs. The server has two modes of operation: local and relay. By de‐
13 fault, sudo_logsrvd stores the logs locally but it can also be configured
14 to relay them to another server that supports the sudo_logsrv.proto(5)
15 protocol.
16 When not relaying, event log entries may be logged either via syslog(3)
18 or to a local file. I/O Logs stored locally by sudo_logsrvd can be re‐
19 played via the sudoreplay(8) utility in the same way as logs generated
20 directly by the sudoers plugin.
21 The server also supports restarting interrupted log transfers. To dis‐
23 tinguish completed I/O logs from incomplete ones, the I/O log timing file
24 is set to be read-only when the log is complete.
25 Configuration parameters for sudo_logsrvd may be specified in the
27 sudo_logsrvd.conf(5) file or the file specified via the -f option.
28 sudo_logsrvd rereads its configuration file when it receives SIGHUP and
30 writes server state to the debug file (if one is configured) when it re‐
31 ceives SIGUSR1.
32 The options are as follows:
34 -f file, --file=file
36 Read configuration from file instead of the default,
37 /etc/sudo_logsrvd.conf.
38 -h, --help Display a short help message to the standard output and exit.
40 -n, --no-fork
42 Run sudo_logsrvd in the foreground instead of detaching from
43 the terminal and becoming a daemon.
44 -R percentage, --random-drop=percentage
46 For each message, there is a percentage chance that the
47 server will drop the connection. This is only intended for
48 debugging the ability of a client to restart a connection.
49 -V, --version
51 Print the sudo_logsrvd version and exit.
52 Securing server connections
54 The I/O log data sent to sudo_logsrvd may contain sensitive information
55 such as passwords and should be secured using Transport Layer Security
56 (TLS). Doing so requires having a signed certificate on the server and,
57 if tls_checkpeer is enabled in sudo_logsrvd.conf(5), a signed certificate
58 on the client as well.
59 The certificates can either be signed by a well-known Certificate Author‐
61 ity (CA), or a private CA can be used. Instructions for creating a pri‐
62 vate CA are included below in the EXAMPLES section.
63 Debugging sudo_logsrvd
65 sudo_logsrvd supports a flexible debugging framework that is configured
66 via Debug lines in the sudo.conf(5) file.
67 For more information on configuring sudo.conf(5), refer to its manual.
69
71 /etc/sudo.conf Sudo front-end configuration
72 /etc/sudo_logsrvd.conf Sudo log server configuration file
74 /var/log/sudo_logsrvd/incoming
76 Directory where new journals are stored when
77 the store_first relay setting is enabled.
78 /var/log/sudo_logsrvd/outgoing
80 Directory where completed journals are stored
81 when the store_first relay setting is enabled.
82 /var/log/sudo-io Default I/O log file location
84 /run/sudo/sudo_logsrvd.pid
86 Process ID file for sudo_logsrvd
87
89 Creating self-signed certificates
90 Unless you are using certificates signed by a well-known Certificate Au‐
91 thority (or a local enterprise CA), you will need to create your own CA
92 that can sign the certificates used by sudo_logsrvd, sudo_sendlog, and
93 the sudoers plugin. The following steps use the openssl(1) command to
94 create keys and certificates.
95 Initial setup
97 First, we need to create a directory structure to store the files for the
98 CA. We'll create a new directory hierarchy in /etc/ssl/sudo for this
99 purpose.
100 # mkdir /etc/ssl/sudo
102 # cd /etc/ssl/sudo
103 # mkdir certs csr newcerts private
104 # chmod 700 private
105 # touch index.txt
106 # echo 1000 > serial
107 The serial and index.txt files are used to keep track of signed certifi‐
109 cates.
110 Next, we need to make a copy of the openssl.conf file and customize it
112 for our new CA. The path to openssl.cnf is system-dependent but
113 /etc/ssl/openssl.cnf is the most common location. You will need to ad‐
114 just the example below if it has a different location on your system.
115 # cp /etc/ssl/openssl.cnf .
117 Now edit the openssl.cnf file in the current directory and make sure it
119 contains “ca”, “CA_default”, “v3_ca”, and “usr_cert” sections. Those
120 sections should include at least the following settings:
121 [ ca ]
123 default_ca = CA_default
124 [ CA_default ]
126 dir = /etc/ssl/sudo
127 certs = $dir/certs
128 database = $dir/index.txt
129 certificate = $dir/cacert.pem
130 serial = $dir/serial
131 [ v3_ca ]
133 subjectKeyIdentifier = hash
134 authorityKeyIdentifier = keyid:always,issuer
135 basicConstraints = critical,CA:true
136 keyUsage = cRLSign, keyCertSign
137 [ usr_cert ]
139 basicConstraints = CA:FALSE
140 keyUsage = nonRepudiation, digitalSignature, \
141 keyEncipherment
142 subjectKeyIdentifier = hash
143 authorityKeyIdentifier = keyid,issuer
144 If your openssl.conf file already has a “CA_default” section, you may
146 only need to modify the “dir” setting and enable the “keyUsage” settings
147 if they are commented out.
148 Creating the CA key and certificate
150 In order to create and sign our own certificates, we need to create a
151 private key and a certificate for the root of the CA. First, create the
152 private key and protect it with a pass phrase:
153 # openssl genrsa -aes256 -out private/cakey.pem 4096
155 # chmod 400 private/cakey.pem
156 Next, generate the root certificate, using appropriate values for the
158 site-specific fields:
159 # openssl req -config openssl.cnf -key private/cakey.pem \
161 -new -x509 -days 7300 -sha256 -extensions v3_ca \
162 -out cacert.pem
163 Enter pass phrase for private/cakey.pem:
165 You are about to be asked to enter information that will be
166 incorporated into your certificate request.
167 What you are about to enter is what is called a Distinguished Name
168 or a DN.
169 There are quite a few fields but you can leave some blank.
170 For some fields there will be a default value,
171 If you enter '.', the field will be left blank.
172 -----
173 Country Name (2 letter code) [AU]:US
174 State or Province Name (full name) [Some-State]:Colorado
175 Locality Name (eg, city) []:
176 Organization Name (eg, company) [Internet Widgits Pty Ltd]:sudo
177 Organizational Unit Name (eg, section) []:sudo Certificate Authority
178 Common Name (e.g., server FQDN or YOUR name) []:sudo Root CA
179 Email Address []:
180 # chmod 444 cacert.pem
182 Finally, verify the root certificate:
184 # openssl x509 -noout -text -in cacert.pem
186 Creating and signing certificates
188 The server and client certificates will be signed by the previously cre‐
189 ated root CA. Usually, the root CA is not used to sign server/client
190 certificates directly. Instead, intermediate certificates are created
191 and signed with the root CA and the intermediate certs are used to sign
192 CSRs (Certificate Signing Request). In this example we'll skip this part
193 for simplicity's sake and sign the CSRs with the root CA.
194 First, generate the private key without a pass phrase.
196 # openssl genrsa -out private/logsrvd_key.pem 2048
198 # chmod 400 private/logsrvd_key.pem
199 Next, create a certificate signing request (CSR) for the server's cer‐
201 tificate. The organization name must match the name given in the root
202 certificate. The common name should be either the server's IP address or
203 a fully qualified domain name.
204 # openssl req -config openssl.cnf -key private/logsrvd_key.pem -new \
206 -sha256 -out csr/logsrvd_csr.pem
207 Enter pass phrase for private/logsrvd_key.pem:
209 You are about to be asked to enter information that will be
210 incorporated into your certificate request.
211 What you are about to enter is what is called a Distinguished Name
212 or a DN.
213 There are quite a few fields but you can leave some blank.
214 For some fields there will be a default value,
215 If you enter '.', the field will be left blank.
216 -----
217 Country Name (2 letter code) [AU]:US
218 State or Province Name (full name) [Some-State]:Colorado
219 Locality Name (eg, city) []:
220 Organization Name (eg, company) [Internet Widgits Pty Ltd]:sudo
221 Organizational Unit Name (eg, section) []:sudo log server
222 Common Name (e.g., server FQDN or YOUR name) []:logserver.example.com
223 Email Address []:
224 Please enter the following 'extra' attributes
226 to be sent with your certificate request
227 A challenge password []:
228 An optional company name []:
229 Now sign the CSR that was just created:
231 # openssl ca -config openssl.cnf -days 375 -notext -md sha256 \
233 -in csr/logsrvd_csr.pem -out certs/logsrvd_cert.pem
234 Using configuration from openssl.cnf
236 Enter pass phrase for ./private/cakey.pem:
237 Check that the request matches the signature
238 Signature ok
239 Certificate Details:
240 Serial Number: 4096 (0x1000)
241 Validity
242 Not Before: Nov 11 14:05:05 2019 GMT
243 Not After : Nov 20 14:05:05 2020 GMT
244 Subject:
245 countryName = US
246 stateOrProvinceName = Colorado
247 organizationName = sudo
248 organizationalUnitName = sudo log server
249 commonName = logserve.example.com
250 X509v3 extensions:
251 X509v3 Basic Constraints:
252 CA:FALSE
253 X509v3 Key Usage:
254 Digital Signature, Non Repudiation, Key Encipherment
255 X509v3 Subject Key Identifier:
256 4C:50:F9:D0:BE:1A:4C:B2:AC:90:76:56:C7:9E:16:AE:E6:9E:E5:B5
257 X509v3 Authority Key Identifier:
258 keyid:D7:91:24:16:B1:03:06:65:1A:7A:6E:CF:51:E9:5C:CB:7A:95:3E:0C
259 Certificate is to be certified until Nov 20 14:05:05 2020 GMT (375 days)
261 Sign the certificate? [y/n]:y
262 1 out of 1 certificate requests certified, commit? [y/n]y
264 Write out database with 1 new entries
265 Data Base Updated
266 Finally, verify the new certificate:
268 # openssl verify -CAfile cacert.pem certs/logsrvd_cert.pem
270 certs/logsrvd_cert.pem: OK
271 The /etc/ssl/sudo/certs directory now contains a signed and verified cer‐
273 tificate for use with sudo_logsrvd.
274 To generate a client certificate, repeat the process above using a dif‐
276 ferent file name.
277 Configuring sudo_logsrvd to use TLS
279 To use TLS for client/server communication, both sudo_logsrvd and the
280 sudoers plugin need to be configured to use TLS. Configuring
281 sudo_logsrvd for TLS requires the following settings, assuming the same
282 path names used earlier:
283 # Listen on port 30344 for TLS connections to any address.
285 listen_address = *:30344(tls)
286 # Path to the certificate authority bundle file in PEM format.
288 tls_cacert = /etc/ssl/sudo/cacert.pem
289 # Path to the server's certificate file in PEM format.
291 tls_cert = /etc/ssl/sudo/certs/logsrvd_cert.pem
292 # Path to the server's private key file in PEM format.
294 tls_key = /etc/ssl/sudo/private/logsrvd_key.pem
295 The root CA cert (cacert.pem) must be installed on the system running
297 sudo_logsrvd. If peer authentication is enabled on the client, a copy of
298 cacert.pem must be present on the client system too.
299
301 sudo.conf(5), sudo_logsrvd.conf(5), sudoers(5), sudo(8), sudo_sendlog(8),
302 sudoreplay(8)
303
305 Many people have worked on sudo over the years; this version consists of
306 code written primarily by:
307 Todd C. Miller
309 See the CONTRIBUTORS.md file in the sudo distribution
311 (https://www.sudo.ws/about/contributors/) for an exhaustive list of peo‐
312 ple who have contributed to sudo.
313
315 If you believe you have found a bug in sudo_logsrvd, you can submit a bug
316 report at https://bugzilla.sudo.ws/
317
319 Limited free support is available via the sudo-users mailing list, see
320 https://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or search
321 the archives.
322
324 sudo_logsrvd is provided “AS IS” and any express or implied warranties,
325 including, but not limited to, the implied warranties of merchantability
326 and fitness for a particular purpose are disclaimed. See the LICENSE.md
327 file distributed with sudo or https://www.sudo.ws/about/license/ for com‐
328 plete details.
329Sudo 1.9.12p2 May 17, 2022 Sudo 1.9.12p2