SSYSLOGD(8)

NAME
ssyslogd - log systems messages securely

SYNOPSIS
ssyslogd [-d] [-f config_file] [-m mark_interval] [-p log_socket] [-u]

DESCRIPTION
Ssyslogd reads and logs messages to the system console, log files, other machines and/or users as specified by its configuration file. Ssyslogd supports the remote auditing of system logs from a trusted auditor, logs are transfered securely using symmetric cryptography (Blowfish only in this version) and the auditor is authenticated using a challenge-response protocol. Logs can be authenticated using a cryptographic protocol called PEO-1. The options are as follows:

-d  Enable debugging to the standard output, and do not disassociate from the controlling terminal.

-f  Specify the pathname of an alternate configuration file; the default is /etc/syslog.conf.

-m  Select the number of minutes between ``mark'' messages; the default is 20 minutes.

-u  Select the historical ``insecure'' mode, in which syslogd will accept input from the UDP port. Some software wants this, but you can be subjected to a variety of attacks over the network, including attackers remotely filling logs. In its default behaviour, ssyslogd will silently drop connections to this port.

-p  Specify the pathname of an alternate log socket; the default is /dev/log.

Ssyslogd reads its configuration file when it starts up and whenever it receives a hangup signal. For information on the format of the configuration file, see ssyslog.conf(5).

Ssyslogd opens an Internet domain socket as specified in /etc/services. Normally ssyslogd will only use this socket to send messages outwards, but in `insecure'' mode it will also read messages from this socket. Ssyslogd also opens and reads messages from the UNIX domain socket /dev/log, and from the special device /dev/klog (to read kernel messages).

Ssyslogd listens for TCP connections on port 8096 (default), this port is used by the auditor in a remote trusted machine to verify the authenticity of the logs writen by ssyslogd using PEO-1, this connection is authenticated and encrypted using Blowfish.

Ssyslogd creates the file /var/run/syslog.pid, and stores its process id there. This can be used to kill or reconfigure syslogd.

The message sent to ssyslogd should consist of a single line. The message can contain a priority code, which should be a preceding decimal number in angle braces, for example, ‘<5.>’ This priority code should map into the priorities defined in the include file <sys/syslog.h>.

SECURE LOGGING
The protocol PEO-1 used for log authentication allows an auditor to securely determinate if the logs stored into local files have been modified, erased, or in any way adulterated. For details on installing and using ssyslogd with PEO-1 authentication, refer to ssyslog.conf(5)

FILES

/etc/syslog.conf
    The configuration file.

/var/run/syslog.pid
    The process id of current ssyslogd.

/dev/log
    Name of the UNIX domain datagram log socket.

/dev/klog
    The kernel log device.

/var/ssyslog
    The directory where PEO states for the logs are mantained.

/var/ssyslog/.key
    The symmetric key used for the challenge-response protocol with the auditor.

/var/ssyslog/.rand
    The randpool file

BUGS
This is a pre-release beta version of ssyslog v1.2, we expect to see a lot of bugs being reported to us.

AUTHORS

Secure syslog is a modification of syslog daemons done by Emiliano Kargieman <ek@core-sdi.com>

Ariel Futoransky <futo@core-sdi.com>

Send comments and suggestions, (bug reports also) to the authors. For the last version of the code and links to the papers describing PEO and PEO-1 refer to www.core-sdi.com.

ACKNOWLEDGEMENTS
Lucio Torre, Enrique Chaparro, M.V., and all those little green men.

SEE ALSO
logger(1), syslog(3), services(5), ssyslog(5), syslog.conf(5), audlog(8)

HISTORY
The ssyslogd command is a modification of syslog(8) that first appear in BSD 4.3