SSYSLOG(5)

NAME
ssyslog - Secure Logging on untrusted machines

SYNOPSIS
/etc/syslog.conf

DESCRIPTION
/etc/syslog.conf is the configuration file historically used for syslog. Actually Ssyslog supports two kind of configuration files depending on the operating system. In the future the configuration files will be unified. for more details on this refer to syslog.conf(5)

the modifications to /etc/syslog.conf needed to run Secure syslog are minimum. You have to insert the name of the authentication protocol between brackets just before the name of the file. for example:

#sample configuration file for ssyslogd # *.info [peo] /var/log/messages *.error [none] console says that all the messages with priority info should be logged to /var/log/messages using PEO-1 as authentication protocol, and the messages with priority error should be logged to the console without any authentication.

if no authentication protocol is defined, it defaults to none (just as old plain syslog). the last example could be rewritten like:

#sample configuration file for ssyslogd # *.info [peo] /var/log/messages *.error console

Since the authentication is done on the files, the same authentication protocol should be defined for every line in syslog.conf logging to a particular file. This will not work:

# wrong configuration file # *.info [peo] /var/log/messages *.debug [none] /var/log/messages

AUTHORS

Emiliano Kargieman <ek@core-sdi.com>

Ariel Futoransky <futo@core-sdi.com>

Send comments and suggestions, (bug reports also) to the authors For the last version of the code and links to the papers describing PEO and PEO-1 refer to www.core-sdi.com.

SEE ALSO
ssyslogd(8), syslog.conf(5), audlog(8)