365 lines
9.3 KiB
Groff
365 lines
9.3 KiB
Groff
.\" Copyright (c) 2012 The FreeBSD Foundation
|
|
.\" All rights reserved.
|
|
.\"
|
|
.\" This documentation was written by Pawel Jakub Dawidek under sponsorship
|
|
.\" from the FreeBSD Foundation.
|
|
.\"
|
|
.\" Redistribution and use in source and binary forms, with or without
|
|
.\" modification, are permitted provided that the following conditions
|
|
.\" are met:
|
|
.\" 1. Redistributions of source code must retain the above copyright
|
|
.\" notice, this list of conditions and the following disclaimer.
|
|
.\" 2. Redistributions in binary form must reproduce the above copyright
|
|
.\" notice, this list of conditions and the following disclaimer in the
|
|
.\" documentation and/or other materials provided with the distribution.
|
|
.\"
|
|
.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
|
|
.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
|
|
.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
.\" SUCH DAMAGE.
|
|
.\"
|
|
.\" $FreeBSD$
|
|
.\"
|
|
.Dd July 1, 2015
|
|
.Dt AUDITDISTD.CONF 5
|
|
.Os
|
|
.Sh NAME
|
|
.Nm auditdistd.conf
|
|
.Nd configuration file for the
|
|
.Xr auditdistd 8
|
|
daemon.
|
|
.Sh DESCRIPTION
|
|
Note: the configuration file may contain passwords.
|
|
Care should be taken to configure proper permissions for this file
|
|
.Li ( e.g., 0600 ) .
|
|
.Pp
|
|
Every line starting with
|
|
.Li #
|
|
gets treated as a comment and is ignored.
|
|
.Sh CONFIGURATION FILE SYNTAX
|
|
The general syntax of the
|
|
.Nm
|
|
file is as follows:
|
|
.Bd -literal
|
|
## Global section.
|
|
|
|
# Our name.
|
|
# The default is the first part of the hostname.
|
|
name "<name>"
|
|
|
|
# Connection timeout.
|
|
# The default is 5.
|
|
timeout <seconds>
|
|
|
|
# Path to pidfile.
|
|
# The default is "/var/run/auditdistd.pid".
|
|
pidfile "<path>"
|
|
|
|
sender {
|
|
## Sender section.
|
|
|
|
# Source address for connections.
|
|
# Optional.
|
|
source "<addr>"
|
|
|
|
# Directory with audit trail files managed by auditdistd.
|
|
# The default is /var/audit/dist.
|
|
directory "<dir>"
|
|
.\"
|
|
.\" # Checksum algorithm for data sent over the wire.
|
|
.\" # The default is none.
|
|
.\" checksum "<algorithm>"
|
|
.\"
|
|
.\" # Compression algorithm for data sent over the wire.
|
|
.\" # The default is none.
|
|
.\" compression "<algorithm>"
|
|
|
|
# Configuration for the target system we want to send audit trail
|
|
# files to.
|
|
host "<name>" {
|
|
# Source address for connections.
|
|
# Optional.
|
|
source "<addr>"
|
|
|
|
# Address of the auditdistd receiver.
|
|
# No default. Obligatory.
|
|
remote "<addr>"
|
|
|
|
# Directory with audit trail files managed by auditdistd.
|
|
# The default is /var/audit/dist.
|
|
directory "<dir>"
|
|
|
|
# Fingerprint of the receiver's public key when using TLS
|
|
# for connections.
|
|
# Example fingerprint:
|
|
# SHA256=8F:0A:FC:8A:3D:09:80:AF:D9:AA:38:CC:8A:86:53:E6:8F:B6:1C:55:30:14:D7:F9:AA:8B:3E:73:CD:F5:76:2B
|
|
fingerprint "<algorithm=hash>"
|
|
|
|
# Password used to authenticate in front of the receiver.
|
|
password "<password>"
|
|
.\"
|
|
.\" # Checksum algorithm for data sent over the wire.
|
|
.\" # The default is none.
|
|
.\" checksum "<algorithm>"
|
|
.\"
|
|
.\" # Compression algorithm for data sent over the wire.
|
|
.\" # The default is none.
|
|
.\" compression "<algorithm>"
|
|
}
|
|
|
|
# Currently local audit trail files can be sent only to one remote
|
|
# auditdistd receiver, but this can change in the future.
|
|
}
|
|
|
|
receiver {
|
|
## Receiver section.
|
|
|
|
# Address to listen on. Multiple listen addresses may be specified.
|
|
# The defaults are "tcp4://0.0.0.0:7878" and "tcp6://[::]:7878".
|
|
listen "<addr>"
|
|
|
|
# Base directory.
|
|
# If the directory in the host section is not absolute, it will be
|
|
# concatenated with this base directory.
|
|
# The default is "/var/audit/remote".
|
|
directory "<basedir>"
|
|
|
|
# Path to the receiver's certificate file.
|
|
# The default is "/etc/security/auditdistd.cert.pem".
|
|
certfile "<path>"
|
|
|
|
# Path to the receiver's private key file.
|
|
# The default is "/etc/security/auditdistd.key.pem".
|
|
keyfile "<path>"
|
|
|
|
# Configuration for a source system we want to receive audit trail
|
|
# files from.
|
|
host "<name>" {
|
|
# Sender address.
|
|
# No default. Obligatory.
|
|
remote "<addr>"
|
|
|
|
# Directory where to store audit trail files received
|
|
# from system <name>.
|
|
# The default is "<basedir>/<name>".
|
|
directory "<dir>"
|
|
|
|
# Password used by the sender to authenticate.
|
|
password "<password>"
|
|
}
|
|
|
|
# Multiple hosts to receive from can be configured.
|
|
}
|
|
.Ed
|
|
.Pp
|
|
Most of the various available configuration parameters are optional.
|
|
If a parameter is not defined in the particular section, it will be
|
|
inherited from the parent section if possible.
|
|
For example, if the
|
|
.Ic source
|
|
parameter is not defined in the
|
|
.Ic host
|
|
section, it will be inherited from the
|
|
.Ic sender
|
|
section.
|
|
In case the
|
|
.Ic global
|
|
section does not define the
|
|
.Ic source
|
|
parameter at all, the default value will be used.
|
|
.Sh CONFIGURATION OPTION DESCRIPTION
|
|
The following statements are available:
|
|
.Bl -tag -width ".Ic xxxx"
|
|
.It Ic name Aq name
|
|
.Pp
|
|
This host's name.
|
|
It is sent to the receiver, so it can properly recognize us if there are
|
|
multiple senders coming from the same IP address.
|
|
.It Ic timeout Aq seconds
|
|
.Pp
|
|
Connection timeout in seconds.
|
|
The default value is
|
|
.Va 5 .
|
|
.It Ic pidfile Aq path
|
|
.Pp
|
|
File in which to store the process ID of the main
|
|
.Xr auditdistd 8
|
|
process.
|
|
.Pp
|
|
The default value is
|
|
.Pa /var/run/auditdistd.pid .
|
|
.It Ic source Aq addr
|
|
.Pp
|
|
Local address to bind to before connecting to the remote
|
|
.Nm auditdistd
|
|
daemon.
|
|
The format is the same as for the
|
|
.Ic listen
|
|
statement.
|
|
.It Ic directory Aq path
|
|
.Pp
|
|
The directory where to look for audit trail files in case of sender mode, or
|
|
the directory where to store received audit trail files.
|
|
The provided path has to be an absolute path.
|
|
The only exception is when the directory is provided in the
|
|
.Ic receiver
|
|
section; then the path provided in the
|
|
.Ic host
|
|
subsections can be relative to the directory in the
|
|
.Ic receiver
|
|
section.
|
|
The default value is
|
|
.Pa /var/audit/dist
|
|
for the entire
|
|
.Ic sender
|
|
section,
|
|
.Pa /var/audit/remote
|
|
for the non-host
|
|
.Ic receiver
|
|
section and
|
|
.Pa /var/audit/remote/<name>
|
|
for the
|
|
.Ic host
|
|
subsections in the
|
|
.Ic receiver
|
|
section where
|
|
.Aq name
|
|
is the host's name.
|
|
.\".It Ic checksum Aq algorithm
|
|
.\".Pp
|
|
.\"Checksum algorithm should be one of the following:
|
|
.\".Bl -tag -width ".Ic sha256"
|
|
.\".It Ic none
|
|
.\"No checksum will be calculated for the data being sent over the network.
|
|
.\"This is the default setting.
|
|
.\".It Ic crc32
|
|
.\"CRC32 checksum will be calculated.
|
|
.\".It Ic sha256
|
|
.\"SHA256 checksum will be calculated.
|
|
.\".El
|
|
.\".It Ic compression Aq algorithm
|
|
.\".Pp
|
|
.\"Compression algorithm should be one of the following:
|
|
.\".Bl -tag -width ".Ic none"
|
|
.\".It Ic none
|
|
.\"Data sent over the network will not be compressed.
|
|
.\"This is the default setting.
|
|
.\".It Ic lzf
|
|
.\"The
|
|
.\".Nm LZF
|
|
.\"algorithm by
|
|
.\".An Marc Alexander Lehmann
|
|
.\"will be used to compress the data sent over the network.
|
|
.\".Nm LZF
|
|
.\"is a very fast, general purpose compression algorithm.
|
|
.\".El
|
|
.It Ic remote Aq addr
|
|
.Pp
|
|
Address of the remote
|
|
.Nm auditdistd
|
|
daemon.
|
|
The format is the same as for the
|
|
.Ic listen
|
|
statement.
|
|
When operating in
|
|
.Ic sender
|
|
mode this address will be used to connect to the
|
|
.Ic receiver .
|
|
When operating in
|
|
.Ic receiver
|
|
mode only connections from this address will be accepted.
|
|
.It Ic listen Aq addr
|
|
.Pp
|
|
Address to listen on in form of:
|
|
.Bd -literal -offset indent
|
|
protocol://protocol-specific-address
|
|
.Ed
|
|
.Pp
|
|
Each of the following examples defines the same listen address:
|
|
.Bd -literal -offset indent
|
|
0.0.0.0
|
|
0.0.0.0:7878
|
|
tcp://0.0.0.0
|
|
tcp://0.0.0.0:7878
|
|
tcp4://0.0.0.0
|
|
tcp4://0.0.0.0:7878
|
|
.Ed
|
|
.Pp
|
|
Multiple listen addresses can be specified.
|
|
By default
|
|
.Nm auditdistd
|
|
listens on
|
|
.Pa tcp4://0.0.0.0:7878
|
|
and
|
|
.Pa tcp6://[::]:7878 ,
|
|
if the kernel supports IPv4 and IPv6 respectively.
|
|
.It Ic keyfile Aq path
|
|
.Pp
|
|
Path to a file that contains the private key for TLS communication.
|
|
.It Ic certfile Aq path
|
|
.Pp
|
|
Path to a file that contains the certificate for TLS communication.
|
|
.It Ic fingerprint Aq algo=hash
|
|
.Pp
|
|
Fingerprint of the receiver's public key.
|
|
Currently only the SHA256 algorithm is supported.
|
|
The certificate public key's fingerprint ready to be pasted into the
|
|
.Nm auditdistd
|
|
configuration file can be obtained by running:
|
|
.Bd -literal
|
|
# openssl x509 -in /etc/security/auditdistd.cert.pem -noout -fingerprint -sha256 | awk -F '[ =]' '{printf("%s=%s\\n", $1, $3)}'
|
|
.Ed
|
|
.It Ic password Aq password
|
|
.Pp
|
|
Password used to authenticate the sender in front of the receiver.
|
|
.El
|
|
.Sh FILES
|
|
.Bl -tag -width ".Pa /etc/security/auditdistd.conf" -compact
|
|
.It Pa /etc/security/auditdistd.conf
|
|
The default
|
|
.Nm auditdistd
|
|
configuration file.
|
|
.El
|
|
.Sh EXAMPLES
|
|
The example configuration files can look as follows.
|
|
.Pp
|
|
Web server:
|
|
.Bd -literal -offset indent
|
|
sender {
|
|
host backup {
|
|
remote 10.0.0.4
|
|
}
|
|
}
|
|
.Ed
|
|
.Pp
|
|
Audit backup server:
|
|
.Bd -literal -offset indent
|
|
receiver {
|
|
host webserv {
|
|
remote 10.0.0.1
|
|
}
|
|
host mailserv {
|
|
remote 10.0.0.2
|
|
}
|
|
host dnsserv {
|
|
remote 10.0.0.3
|
|
}
|
|
}
|
|
.Ed
|
|
.Sh SEE ALSO
|
|
.Xr audit 4 ,
|
|
.Xr auditdistd 8
|
|
.Sh AUTHORS
|
|
The
|
|
.Nm auditdistd
|
|
daemon was developed by
|
|
.An Pawel Jakub Dawidek Aq pawel@dawidek.net
|
|
under sponsorship of the FreeBSD Foundation.
|