Unterschiede
Hier werden die Unterschiede zwischen zwei Versionen angezeigt.
| Beide Seiten der vorigen Revision Vorhergehende Überarbeitung Nächste Überarbeitung | Vorhergehende Überarbeitung | ||
| centos:web_c7:graylog2 [16.02.2017 10:59. ] – [elasticsearch.service] django | centos:web_c7:graylog2 [22.07.2019 14:42. ] (aktuell) – django | ||
|---|---|---|---|
| Zeile 64: | Zeile 64: | ||
| sub 2048R/ | sub 2048R/ | ||
| - | Diesen **Key fingerprint = 4609 5ACC 8548 582C 1A26 99A9 D27D 666C D88E 42B4** vergleichen wir nun mit den Angaben auf der [[https:// | + | Diesen **Key fingerprint = 4609 5ACC 8548 582C 1A26 99A9 D27D 666C D88E 42B4** vergleichen wir nun mit den Angaben auf der [[https:// |
| # rpm --import / | # rpm --import / | ||
| Zeile 70: | Zeile 70: | ||
| Graylog selbst werden wir später aus dem Repository von **graylog** installieren. So bleibt zum einen der Konfigurationsaufwand überschaubar und wir werden mit Updates versorgt, wenn Änderungen und/oder Erweiterungen am Programmcode von graylog notwendig werden. | Graylog selbst werden wir später aus dem Repository von **graylog** installieren. So bleibt zum einen der Konfigurationsaufwand überschaubar und wir werden mit Updates versorgt, wenn Änderungen und/oder Erweiterungen am Programmcode von graylog notwendig werden. | ||
| Die Integration des benötigten Repositories erfolgt direkt mit nachfolgendem Befehl: | Die Integration des benötigten Repositories erfolgt direkt mit nachfolgendem Befehl: | ||
| - | # yum localinstall https:// | + | # yum localinstall https:// |
| - | Anschließend | + | Anschliessend |
| # vim / | # vim / | ||
| <file bash / | <file bash / | ||
| name=graylog | name=graylog | ||
| - | baseurl=https:// | + | baseurl=https:// |
| gpgcheck=1 | gpgcheck=1 | ||
| gpgkey=file:/// | gpgkey=file:/// | ||
| Zeile 249: | Zeile 249: | ||
| Im nächsten Schritt installieren wir nun noch elasticsearch als Suchmaschine/ | Im nächsten Schritt installieren wir nun noch elasticsearch als Suchmaschine/ | ||
| # yum install elasticsearch -y | # yum install elasticsearch -y | ||
| - | |||
| - | Bei der Installation des RPMs werden unter anderem folgende Informationen angegeben: | ||
| - | < | ||
| - | |||
| - | Running transaction check | ||
| - | Running transaction test | ||
| - | Transaction test succeeded | ||
| - | Running transaction | ||
| - | Creating elasticsearch group... OK | ||
| - | Creating elasticsearch user... OK | ||
| - | Installing : elasticsearch-2.4.4-1.noarch | ||
| - | ### NOT starting on installation, | ||
| - | sudo systemctl daemon-reload | ||
| - | sudo systemctl enable elasticsearch.service | ||
| - | ### You can start elasticsearch service by executing | ||
| - | sudo systemctl start elasticsearch.service | ||
| - | Verifying | ||
| - | |||
| - | Installed: | ||
| - | elasticsearch.noarch 0: | ||
| - | </ | ||
| - | |||
| - | Bei dr späteren Konfiguration werden wir diese Schritte dann nachholen. | ||
| Wollen wir wissen, welche Dateien und Verzeichnisse das Paket auf unseren Server packte, benutzen wir folgenden Befehl. | Wollen wir wissen, welche Dateien und Verzeichnisse das Paket auf unseren Server packte, benutzen wir folgenden Befehl. | ||
| Zeile 370: | Zeile 347: | ||
| / | / | ||
| / | / | ||
| + | |||
| ==== graylog ==== | ==== graylog ==== | ||
| Zu guter letzt installieren wir nun noch Pakete **graylog** sowie das Zusatzprogramm **pwgen** zum Generieren von Passwörtern, | Zu guter letzt installieren wir nun noch Pakete **graylog** sowie das Zusatzprogramm **pwgen** zum Generieren von Passwörtern, | ||
| Zeile 378: | Zeile 356: | ||
| # rpm -qil graylog-server | # rpm -qil graylog-server | ||
| < | < | ||
| - | Version | + | Version |
| - | Release | + | Release |
| Architecture: | Architecture: | ||
| - | Install Date: Wed 15 Feb 2017 04:21:21 PM CET | + | Install Date: Wed 27 Sep 2017 11:26:28 AM CEST |
| Group : optional | Group : optional | ||
| - | Size : 106769271 | + | Size : 110416070 |
| License | License | ||
| - | Signature | + | Signature |
| - | Source RPM : graylog-server-2.2.0-11.src.rpm | + | Source RPM : graylog-server-2.3.1-1.src.rpm |
| - | Build Date : Thu 09 Feb 2017 12:42:54 PM CET | + | Build Date : Fri 25 Aug 2017 03:57:17 PM CEST |
| - | Build Host : f89729f86e48 | + | Build Host : 5ee9456006b4 |
| Relocations : / | Relocations : / | ||
| Packager | Packager | ||
| Zeile 407: | Zeile 385: | ||
| / | / | ||
| / | / | ||
| - | / | + | / |
| - | / | + | / |
| - | / | + | / |
| - | / | + | / |
| - | / | + | / |
| - | / | + | / |
| Zeile 473: | Zeile 451: | ||
| </ | </ | ||
| - | Der erfolgreiche Start des Servers wird auch in dessen Logdatei protokolliert. | + | Der erfolgreiche Start des Servers wird auch in dessen Logdatei protokolliert. |
| # less / | # less / | ||
| Zeile 603: | Zeile 581: | ||
| Created symlink from / | Created symlink from / | ||
| - | |||
| - | |||
| === automatischer Start des Daemon === | === automatischer Start des Daemon === | ||
| Zeile 738: | Zeile 714: | ||
| Geben wir ein falsches Passwort ein, wird natürlich der Zugang verwehrt. | Geben wir ein falsches Passwort ein, wird natürlich der Zugang verwehrt. | ||
| - | # mongo -u " | + | # mongo -u " |
| MongoDB shell version: 2.6.12 | MongoDB shell version: 2.6.12 | ||
| Zeile 1369: | Zeile 1345: | ||
| Anschließend informieren wir den **systemd** über unser " | Anschließend informieren wir den **systemd** über unser " | ||
| | | ||
| - | |||
| - | |||
| - | |||
| - | |||
| - | |||
| - | |||
| === Start des Daemon === | === Start des Daemon === | ||
| Zeile 1386: | Zeile 1356: | ||
| <font style=" | <font style=" | ||
| | | ||
| - | | + | |
| Docs: http:// | Docs: http:// | ||
| - | Process: | + | Process: |
| - | Main PID: 1556 (java) | + | Main PID: 1542 (java) |
| | | ||
| - | | + | |
| - | Feb 16 11:18:53 vml000117.dmz.nausch.org elasticsearch[1556]: [2017-02-16 11:18:53,412][INFO ][env ] [vml000117] using [1] data paths, mounts [[/ | + | Feb 16 11:51:02 vml000117.dmz.nausch.org elasticsearch[1542]: [2017-02-16 11:51:02,770][INFO ][env ] [vml000117] using [1] data paths, mounts [[/ |
| - | Feb 16 11:18:53 vml000117.dmz.nausch.org elasticsearch[1556]: [2017-02-16 11:18:53,412][INFO ][env ] [vml000117] heap size [3.9gb], compressed ordinary object pointers [true] | + | Feb 16 11:51:02 vml000117.dmz.nausch.org elasticsearch[1542]: [2017-02-16 11:51:02,771][INFO ][env ] [vml000117] heap size [3.9gb], compressed ordinary object pointers [true] |
| - | Feb 16 11:18:57 vml000117.dmz.nausch.org elasticsearch[1556]: [2017-02-16 11:18:57,520][INFO ][node | + | Feb 16 11:51:06 vml000117.dmz.nausch.org elasticsearch[1542]: [2017-02-16 11:51:06,974][INFO ][node |
| - | Feb 16 11:18:57 vml000117.dmz.nausch.org elasticsearch[1556]: [2017-02-16 11:18:57,520][INFO ][node | + | Feb 16 11:51:06 vml000117.dmz.nausch.org elasticsearch[1542]: [2017-02-16 11:51:06,974][INFO ][node |
| - | Feb 16 11:18:57 vml000117.dmz.nausch.org elasticsearch[1556]: [2017-02-16 11:18:57,936][INFO ][transport | + | Feb 16 11:51:07 vml000117.dmz.nausch.org elasticsearch[1542]: [2017-02-16 11:51:07,323][INFO ][transport |
| - | Feb 16 11:18:57 vml000117.dmz.nausch.org elasticsearch[1556]: [2017-02-16 11:18:57,943][INFO ][discovery | + | Feb 16 11:51:07 vml000117.dmz.nausch.org elasticsearch[1542]: [2017-02-16 11:51:07,357][INFO ][discovery |
| - | Feb 16 11:19:01 vml000117.dmz.nausch.org elasticsearch[1556]: [2017-02-16 11:19:01,095][INFO ][cluster.service | + | Feb 16 11:51:10 vml000117.dmz.nausch.org elasticsearch[1542]: [2017-02-16 11:51:10,658][INFO ][cluster.service |
| - | Feb 16 11:19:01 vml000117.dmz.nausch.org elasticsearch[1556]: [2017-02-16 11:19:01,127][INFO ][http | + | Feb 16 11:51:10 vml000117.dmz.nausch.org elasticsearch[1542]: [2017-02-16 11:51:10,737][INFO ][http |
| - | Feb 16 11:19:01 vml000117.dmz.nausch.org elasticsearch[1556]: [2017-02-16 11:19:01,127][INFO ][node | + | Feb 16 11:51:10 vml000117.dmz.nausch.org elasticsearch[1542]: [2017-02-16 11:51:10,738][INFO ][node |
| - | Feb 16 11:19:01 vml000117.dmz.nausch.org elasticsearch[1556]: [2017-02-16 11:19:01,214][INFO ][gateway | + | Feb 16 11:51:10 vml000117.dmz.nausch.org elasticsearch[1542]: [2017-02-16 11:51:10,777][INFO ][gateway |
| </ | </ | ||
| Zeile 1432: | Zeile 1402: | ||
| tcp6 | tcp6 | ||
| </ | </ | ||
| - | |||
| - | |||
| - | |||
| Der erfolgreiche Start des Servers wird auch in dessen Logdatei protokolliert. | Der erfolgreiche Start des Servers wird auch in dessen Logdatei protokolliert. | ||
| - | # less / | + | # less / |
| - | < | + | < |
| - | [2015-12-28 14:20:24,202][INFO ][node | + | [2017-02-16 11:51:01,460][INFO ][node |
| - | [2015-12-28 14:20:24,323][INFO ][plugins | + | [2017-02-16 11:51:02,738][INFO ][plugins |
| - | [2015-12-28 14:20:24,378][INFO ][env ] [vml000117] using [1] data paths, mounts [[/ | + | [2017-02-16 11:51:02,770][INFO ][env ] [vml000117] using [1] data paths, mounts [[/ |
| - | [2015-12-28 14:20:29,846][INFO ][node | + | [2017-02-16 11:51:02,771][INFO ][env ] [vml000117] heap size [3.9gb], compressed ordinary object pointers [true] |
| - | [2015-12-28 14:20:29,846][INFO ][node | + | [2017-02-16 11: |
| - | [2015-12-28 14:20:30,282][INFO ][transport | + | [2017-02-16 11:51:06,974][INFO ][node |
| - | [2015-12-28 14:20:30,352][INFO ][discovery | + | [2017-02-16 11:51:07,323][INFO ][transport |
| - | [2015-12-28 14:20:33,462][INFO ][cluster.service | + | [2017-02-16 11:51:07,357][INFO ][discovery |
| - | [2015-12-28 14:20:33,508][INFO ][http | + | [2017-02-16 11:51:10,658][INFO ][cluster.service |
| - | [2015-12-28 14:20:33,508][INFO ][node | + | [2017-02-16 11:51:10,737][INFO ][http |
| - | [2015-12-28 14:20:33,541][INFO ][gateway | + | [2017-02-16 11:51:10,738][INFO ][node |
| - | [2015-12-28 14: | + | [2017-02-16 11:51:10,777][INFO ][gateway |
| - | [2015-12-28 14: | + | |
| - | [2015-12-28 14: | + | |
| === automatischer Start des Daemon === | === automatischer Start des Daemon === | ||
| Zeile 1472: | Zeile 1437: | ||
| " | " | ||
| " | " | ||
| - | "EdAnadZuTiOjxFR7_Kvdrg" : { | + | "wmPD67gQQDmoSAoQblrrQQ" : { |
| " | " | ||
| - | " | + | " |
| - | " | + | " |
| - | " | + | " |
| - | " | + | " |
| - | " | + | " |
| - | " | + | " |
| " | " | ||
| " | " | ||
| - | " | + | " |
| - | " | + | |
| " | " | ||
| } | } | ||
| Zeile 1499: | Zeile 1463: | ||
| " | " | ||
| " | " | ||
| - | " | + | " |
| - | " | + | " |
| " | " | ||
| " | " | ||
| Zeile 1506: | Zeile 1470: | ||
| " | " | ||
| " | " | ||
| - | " | + | " |
| + | " | ||
| + | " | ||
| }</ | }</ | ||
| + | |||
| ==== graylog-server ==== | ==== graylog-server ==== | ||
| Nachdem wir alle Vorbereitungen erfolgreich abgeschlossen haben, können wir uns nun der Konfiguration des **graylog-server Daemons** widmen. | Nachdem wir alle Vorbereitungen erfolgreich abgeschlossen haben, können wir uns nun der Konfiguration des **graylog-server Daemons** widmen. | ||
| - | |||
| - | === / | ||
| - | Auf unserem System unter **CentOS 7.x** hatten wir als JAVA Runtime Enviroment das Paket **[[ | ||
| - | centos: | ||
| - | # vim / | ||
| - | |||
| - | <file bash / | ||
| - | JAVA=/ | ||
| - | |||
| - | # Default Java options for heap and garbage collection. | ||
| - | # | ||
| - | # Django : 2015-12-28 - PermSize und MaxPermSize werden ab openjdk-1.8.0 nicht mehr unterstützt | ||
| - | # default: GRAYLOG_SERVER_JAVA_OPTS=" | ||
| - | GRAYLOG_SERVER_JAVA_OPTS=" | ||
| - | |||
| - | # Pass some extra args to graylog-server. (i.e. " | ||
| - | GRAYLOG_SERVER_ARGS="" | ||
| - | |||
| - | # Program that will be used to wrap the graylog-server command. Useful to | ||
| - | # support programs like authbind. | ||
| - | GRAYLOG_COMMAND_WRAPPER=""</ | ||
| Zeile 1543: | Zeile 1489: | ||
| # vim / | # vim / | ||
| - | <file bash / | + | <file bash / |
| + | # GRAYLOG CONFIGURATION FILE | ||
| + | ############################ | ||
| + | # | ||
| + | # This is the Graylog configuration file. The file has to use ISO 8859-1/ | ||
| + | # Characters that cannot be directly represented in this encoding can be written using Unicode escapes | ||
| + | # as defined in https:// | ||
| + | # For example, \u002c. | ||
| + | # | ||
| + | # * Entries are generally expected to be a single line of the form, one of the following: | ||
| + | # | ||
| + | # propertyName=propertyValue | ||
| + | # propertyName: | ||
| + | # | ||
| + | # * White space that appears between the property name and property value is ignored, | ||
| + | # so the following are equivalent: | ||
| + | # | ||
| + | # name=Stephen | ||
| + | # name = Stephen | ||
| + | # | ||
| + | # * White space at the beginning of the line is also ignored. | ||
| + | # | ||
| + | # * Lines that start with the comment characters ! or # are ignored. Blank lines are also ignored. | ||
| + | # | ||
| + | # * The property value is generally terminated by the end of the line. White space following the | ||
| + | # | ||
| + | # | ||
| + | # * A property value can span several lines if each line is terminated by a backslash (‘\’) character. | ||
| + | # For example: | ||
| + | # | ||
| + | # targetCities=\ | ||
| + | # | ||
| + | # | ||
| + | # Los Angeles | ||
| + | # | ||
| + | # This is equivalent to targetCities=Detroit, | ||
| + | # | ||
| + | # * The characters newline, carriage return, and tab can be inserted with characters \n, \r, and \t, respectively. | ||
| + | # | ||
| + | # * The backslash character must be escaped as a double backslash. For example: | ||
| + | # | ||
| + | # path=c: | ||
| + | # | ||
| + | |||
| + | # If you are running more than one instances of Graylog | ||
| # instances as master. The master will perform some periodical tasks that non-masters won't perform. | # instances as master. The master will perform some periodical tasks that non-masters won't perform. | ||
| - | is_master = true | + | is_master = true |
| # The auto-generated node ID will be stored in this file and read after restarts. It is a good idea | # The auto-generated node ID will be stored in this file and read after restarts. It is a good idea | ||
| - | # to use an absolute file path here if you are starting | + | # to use an absolute file path here if you are starting |
| - | node_id_file = / | + | node_id_file = / |
| # You MUST set a secret to secure/ | # You MUST set a secret to secure/ | ||
| - | # Generate one by using for example: pwgen -N 1 -s 96 | + | # Generate one by using for example: pwgen -N 1 -s 96 |
| - | # Django : 2015-12-28 | + | # Django : 2017-02-14 |
| - | # default: password_secret = | + | # default: password_secret = |
| password_secret = yCWAd48fvOmR7xAmcKezZ2C0v3mtaXCJjA7NfhBlSf98PTxHrf9SrCQDX2xgjCzrHpxoV5UNOEfQZsOP1gkWkYlDarD75tbtztPhR59O70yZchaJcyQTeHBZllQc8RcT | password_secret = yCWAd48fvOmR7xAmcKezZ2C0v3mtaXCJjA7NfhBlSf98PTxHrf9SrCQDX2xgjCzrHpxoV5UNOEfQZsOP1gkWkYlDarD75tbtztPhR59O70yZchaJcyQTeHBZllQc8RcT | ||
| # The default root user is named ' | # The default root user is named ' | ||
| - | # Django : 2015-12-28 | + | # Django : 2017-02-14 |
| - | # default: # | + | # default: # |
| - | root_username = admin | + | root_username = graylog-admin |
| # You MUST specify a hash password for the root user (which you only need to initially set up the | # You MUST specify a hash password for the root user (which you only need to initially set up the | ||
| - | # system and in case you lose connectivity to your authentication backend) | + | # system and in case you lose connectivity to your authentication backend) |
| # This password cannot be changed using the API or via the web interface. If you need to change it, | # This password cannot be changed using the API or via the web interface. If you need to change it, | ||
| - | # modify it in this file. | + | # modify it in this file. |
| - | # Create one by using for example: echo -n yourpassword | shasum -a 256 | + | # Create one by using for example: echo -n yourpassword | shasum -a 256 |
| - | # and put the resulting hash value into the following line | + | # and put the resulting hash value into the following line |
| - | # Django : 2015-12-28 | + | # Django : 2017-02-14 |
| - | # default: root_password_sha2 = | + | # default: root_password_sha2 = |
| - | root_password_sha2 = 38337fd07fd4ee02548053d7bed3ee33e3e0c593c2802941e2349fc52e80b98d | + | root_password_sha2 = 38337fd07fd4ee02548053d7bed3ee33e3e0c593c2802941e2349fc52e80b98d |
| # The email address of the root user. | # The email address of the root user. | ||
| - | # Default is empty | + | # Default is empty |
| - | # Django : 2015-12-28 | + | # Django : 2017-02-14 |
| - | # default: #root_email = "" | + | # default: #root_email = "" |
| - | root_email = "graylog_admin@nausch.org" | + | root_email = "graylog-admin@nausch.org" |
| - | # The time zone setting of the root user. | + | # The time zone setting of the root user. See http:// |
| - | # The configured time zone must be parseable by http:// | + | # Default is UTC |
| - | # Default is UTC | + | # Django : 2017-02-14 |
| - | # Django : 2015-12-28 | + | # default: # |
| - | # default: # | + | root_timezone = Europe/ |
| - | root_timezone = Europe/ | + | |
| # Set plugin directory here (relative or absolute) | # Set plugin directory here (relative or absolute) | ||
| - | plugin_dir = / | + | plugin_dir = / |
| - | # REST API listen URI. Must be reachable by other graylog2-server nodes if you run a cluster. | + | # REST API listen URI. Must be reachable by other Graylog |
| - | rest_listen_uri = http:// | + | # When using Graylog Collectors, this URI will be used to receive heartbeat messages and must be accessible for all collectors. |
| + | # Django : 2017-02-14 | ||
| + | # default: | ||
| + | rest_listen_uri = http:// | ||
| # REST API transport address. Defaults to the value of rest_listen_uri. Exception: If rest_listen_uri | # REST API transport address. Defaults to the value of rest_listen_uri. Exception: If rest_listen_uri | ||
| - | # is set to a wildcard IP address (0.0.0.0) the first non-loopback IPv4 system address is used. | + | # is set to a wildcard IP address (0.0.0.0) the first non-loopback IPv4 system address is used. |
| - | # If set, his will be promoted in the cluster discovery APIs, so other nodes may try to connect on | + | # If set, this will be promoted in the cluster discovery APIs, so other nodes may try to connect on |
| # this address and it is used to generate URLs addressing entities in the REST API. (see rest_listen_uri) | # this address and it is used to generate URLs addressing entities in the REST API. (see rest_listen_uri) | ||
| - | # You will need to define this, if your Graylog server is running behind a HTTP proxy that is rewriting | + | # You will need to define this, if your Graylog server is running behind a HTTP proxy that is rewriting |
| - | # the scheme, host name or URI. | + | # the scheme, host name or URI. |
| - | # | + | # This must not contain a wildcard address (0.0.0.0). |
| - | # Django : 2015-12-28 | + | # Django : 2017-02.14 |
| - | # default: unset | + | # default: |
| - | rest_transport_uri = http://127.0.0.1:12900/ | + | rest_transport_uri = http://10.0.0.117:9000/api/ |
| # Enable CORS headers for REST API. This is necessary for JS-clients accessing the server directly. | # Enable CORS headers for REST API. This is necessary for JS-clients accessing the server directly. | ||
| - | # If these are disabled, modern browsers will not be able to retrieve resources from the server. | + | # If these are disabled, modern browsers will not be able to retrieve resources from the server. |
| - | # This is disabled | + | # This is enabled |
| - | # | + | # |
| - | # Django : 2015-12-28 | + | |
| - | # default: unset | + | |
| - | rest_enable_cors = true | + | |
| # Enable GZIP support for REST API. This compresses API responses and therefore helps to reduce | # Enable GZIP support for REST API. This compresses API responses and therefore helps to reduce | ||
| - | # overall round trip times. This is disabled | + | # overall round trip times. This is enabled |
| - | # | + | # |
| - | # Django : 2015-12-28 | + | |
| - | # default: unset | + | |
| - | rest_enable_gzip = true | + | |
| # Enable HTTPS support for the REST API. This secures the communication with the REST API with | # Enable HTTPS support for the REST API. This secures the communication with the REST API with | ||
| # TLS to prevent request forgery and eavesdropping. This is disabled by default. Uncomment the | # TLS to prevent request forgery and eavesdropping. This is disabled by default. Uncomment the | ||
| - | # next line to enable it. | + | # next line to enable it. |
| - | # | + | # |
| - | # The X.509 certificate file to use for securing the REST API. | + | # The X.509 certificate |
| - | # | + | # |
| - | # The private key to use for securing the REST API. | + | # The PKCS# |
| - | # | + | # |
| # The password to unlock the private key used for securing the REST API. | # The password to unlock the private key used for securing the REST API. | ||
| - | # | + | # |
| - | + | ||
| - | # The maximum size of a single HTTP chunk in bytes. | + | |
| - | # | + | |
| # The maximum size of the HTTP request headers in bytes. | # The maximum size of the HTTP request headers in bytes. | ||
| - | # | + | # |
| # The maximal length of the initial HTTP/1.1 line in bytes. | # The maximal length of the initial HTTP/1.1 line in bytes. | ||
| - | # | + | # |
| - | # The size of the execution handler | + | # The size of the thread pool used exclusively for serving the REST API. |
| - | # | + | # |
| - | # The size of the worker thread pool used exclusively for serving the REST API. | + | # Comma separated list of trusted proxies that are allowed to set the client address with X-Forwarded-For |
| - | #rest_worker_threads_max_pool_size | + | # header. May be subnets, or hosts. |
| + | #trusted_proxies | ||
| - | # Embedded Elasticsearch | + | # Enable the embedded Graylog web interface. |
| - | # pay attention to the working directory of the server, maybe use an absolute path here | + | # Default: true |
| - | # | + | #web_enable = false |
| + | |||
| + | # Web interface listen URI. | ||
| + | # Configuring a path for the URI here effectively prefixes all URIs in the web interface. This is a replacement | ||
| + | # for the application.context | ||
| + | # Django : 2017-02-14 | ||
| + | # default: # | ||
| + | web_listen_uri = http:// | ||
| + | |||
| + | # Web interface endpoint URI. This setting can be overriden on a per-request basis with the X-Graylog-Server-URL header. | ||
| + | # Default: $rest_transport_uri | ||
| + | # Django : 2017-02-16 | ||
| + | # default: # | ||
| + | |||
| + | # Enable CORS headers for the web interface. This is necessary for JS-clients accessing the server directly. | ||
| + | # If these are disabled, modern browsers will not be able to retrieve resources from the server. | ||
| + | # | ||
| + | |||
| + | # Enable/ | ||
| + | # overall round trip times. This is enabled by default. Uncomment the next line to disable it. | ||
| + | # Django : 2017-02-14 | ||
| + | # default: # | ||
| + | web_enable_gzip = true | ||
| + | |||
| + | # Enable HTTPS support for the web interface. This secures the communication of the web browser with the web interface | ||
| + | # using TLS to prevent request forgery and eavesdropping. | ||
| + | # This is disabled by default. Uncomment the next line to enable it and see the other related configuration settings. | ||
| + | # | ||
| + | |||
| + | # The X.509 certificate chain file in PEM format to use for securing the web interface. | ||
| + | #web_tls_cert_file = / | ||
| + | |||
| + | # The PKCS#8 private key file in PEM format to use for securing the web interface. | ||
| + | # | ||
| + | |||
| + | # The password to unlock the private key used for securing the web interface. | ||
| + | # | ||
| + | |||
| + | # The maximum size of the HTTP request headers in bytes. | ||
| + | # | ||
| + | |||
| + | # The maximal length of the initial HTTP/1.1 line in bytes. | ||
| + | # | ||
| + | |||
| + | # The size of the thread pool used exclusively for serving the web interface. | ||
| + | # | ||
| + | |||
| + | # Configuration file for the embedded Elasticsearch instance in Graylog. | ||
| + | # Pay attention to the working directory of the server, maybe use an absolute path here. | ||
| + | # Default: empty | ||
| + | # | ||
| # Graylog will use multiple indices to store documents in. You can configured the strategy it uses to determine | # Graylog will use multiple indices to store documents in. You can configured the strategy it uses to determine | ||
| - | # when to rotate the currently active write index. | + | # when to rotate the currently active write index. |
| - | # It supports multiple rotation strategies: | + | # It supports multiple rotation strategies: |
| - | # - " | + | # - " |
| - | # - " | + | # - " |
| - | # valid values are " | + | # valid values are " |
| - | # Django : 2015-12-28 | + | # |
| - | # default: rotation_strategy = count | + | # ATTENTION: These settings have been moved to the database in 2.0. When you upgrade, make sure to set these |
| - | rotation_strategy = time | + | # to your previous 1.x settings so they will be migrated to the database! |
| + | # Django : 2017-02-14 | ||
| + | # default: rotation_strategy = count | ||
| + | rotation_strategy = time | ||
| # (Approximate) maximum number of documents in an Elasticsearch index before a new index | # (Approximate) maximum number of documents in an Elasticsearch index before a new index | ||
| - | # is being created, also see no_retention and elasticsearch_max_number_of_indices. | + | # is being created, also see no_retention and elasticsearch_max_number_of_indices. |
| - | # Configure this if you used ' | + | # Configure this if you used ' |
| - | # Django : 2015-12-28 | + | # |
| - | # default: elasticsearch_max_docs_per_index = 20000000 | + | # ATTENTION: These settings have been moved to the database in 2.0. When you upgrade, make sure to set these |
| + | # to your previous 1.x settings so they will be migrated to the database! | ||
| + | elasticsearch_max_docs_per_index = 20000000 | ||
| # (Approximate) maximum size in bytes per Elasticsearch index on disk before a new index is being created, also see | # (Approximate) maximum size in bytes per Elasticsearch index on disk before a new index is being created, also see | ||
| - | # no_retention and elasticsearch_max_number_of_indices. Default is 1GB. | + | # no_retention and elasticsearch_max_number_of_indices. Default is 1GB. |
| - | # Configure this if you used ' | + | # Configure this if you used ' |
| - | # | + | # |
| + | # ATTENTION: These settings have been moved to the database in 2.0. When you upgrade, make sure to set these | ||
| + | # to your previous 1.x settings so they will be migrated to the database! | ||
| + | # | ||
| # (Approximate) maximum time before a new Elasticsearch index is being created, also see | # (Approximate) maximum time before a new Elasticsearch index is being created, also see | ||
| - | # no_retention and elasticsearch_max_number_of_indices. Default is 1 day. | + | # no_retention and elasticsearch_max_number_of_indices. Default is 1 day. |
| - | # Configure this if you used ' | + | # Configure this if you used ' |
| # Please note that this rotation period does not look at the time specified in the received messages, but is | # Please note that this rotation period does not look at the time specified in the received messages, but is | ||
| - | # using the real clock value to decide when to rotate the index! | + | # using the real clock value to decide when to rotate the index! |
| - | # Specify the time using a duration and a suffix indicating which unit you want: | + | # Specify the time using a duration and a suffix indicating which unit you want: |
| - | # 1w = 1 week | + | # 1w = 1 week |
| - | # 1d = 1 day | + | # 1d = 1 day |
| - | # 12h = 12 hours | + | # 12h = 12 hours |
| - | # Permitted suffixes are: d for day, h for hour, m for minute, s for second. | + | # Permitted suffixes are: d for day, h for hour, m for minute, s for second. |
| - | #elasticsearch_max_time_per_index = 1d | + | # |
| - | # Django | + | # ATTENTION: These settings have been moved to the database in 2.0. When you upgrade, make sure to set these |
| - | # default: unset | + | # to your previous 1.x settings so they will be migrated to the database! |
| - | elasticsearch_max_time_per_index = 1d | + | #elasticsearch_max_time_per_index = 1d |
| # Disable checking the version of Elasticsearch for being compatible with this Graylog release. | # Disable checking the version of Elasticsearch for being compatible with this Graylog release. | ||
| # WARNING: Using Graylog with unsupported and untested versions of Elasticsearch may lead to data loss! | # WARNING: Using Graylog with unsupported and untested versions of Elasticsearch may lead to data loss! | ||
| - | # | + | # |
| # Disable message retention on this node, i. e. disable Elasticsearch index rotation. | # Disable message retention on this node, i. e. disable Elasticsearch index rotation. | ||
| - | # | + | # |
| # How many indices do you want to keep? | # How many indices do you want to keep? | ||
| - | # Django | + | # |
| - | # default: | + | # ATTENTION: These settings have been moved to the database in 2.0. When you upgrade, make sure to set these |
| - | elasticsearch_max_number_of_indices = 30 | + | # to your previous 1.x settings so they will be migrated to the database! |
| + | elasticsearch_max_number_of_indices = 20 | ||
| # Decide what happens with the oldest indices when the maximum number of indices is reached. | # Decide what happens with the oldest indices when the maximum number of indices is reached. | ||
| - | # The following strategies are availble: | + | # The following strategies are availble: |
| - | # - delete # Deletes the index completely (Default) | + | # - delete # Deletes the index completely (Default) |
| - | # - close # Closes the index and hides it from the system. Can be re-opened later. | + | # - close # Closes the index and hides it from the system. Can be re-opened later. |
| - | retention_strategy = delete | + | # |
| + | # ATTENTION: These settings have been moved to the database in 2.0. When you upgrade, make sure to set these | ||
| + | # to your previous 1.x settings so they will be migrated to the database! | ||
| + | retention_strategy = delete | ||
| # How many Elasticsearch shards and replicas should be used per index? Note that this only applies to newly created indices. | # How many Elasticsearch shards and replicas should be used per index? Note that this only applies to newly created indices. | ||
| - | # Django | + | # ATTENTION: These settings have been moved to the database in Graylog 2.2.0. When you upgrade, make sure to set these |
| - | # default: | + | # to your previous settings so they will be migrated to the database! |
| - | elasticsearch_shards = 1 | + | elasticsearch_shards = 4 |
| - | elasticsearch_replicas = 0 | + | elasticsearch_replicas = 0 |
| # Prefix for all Elasticsearch indices and index aliases managed by Graylog. | # Prefix for all Elasticsearch indices and index aliases managed by Graylog. | ||
| - | # Django | + | # |
| - | # default: elasticsearch_index_prefix = graylog2 | + | # ATTENTION: These settings have been moved to the database in Graylog 2.2.0. When you upgrade, make sure to set these |
| - | elasticsearch_index_prefix = graylog | + | # to your previous settings so they will be migrated to the database! |
| + | elasticsearch_index_prefix = graylog | ||
| # Name of the Elasticsearch index template used by Graylog to apply the mandatory index mapping. | # Name of the Elasticsearch index template used by Graylog to apply the mandatory index mapping. | ||
| - | # # Default: graylog-internal | + | # Default: graylog-internal |
| - | # | + | # |
| + | # ATTENTION: These settings have been moved to the database in Graylog 2.2.0. When you upgrade, make sure to set these | ||
| + | # to your previous settings so they will be migrated to the database! | ||
| + | # | ||
| # Do you want to allow searches with leading wildcards? This can be extremely resource hungry and should only | # Do you want to allow searches with leading wildcards? This can be extremely resource hungry and should only | ||
| - | # be enabled with care. See also: https://www.graylog.org/ | + | # be enabled with care. See also: http://docs.graylog.org/ |
| - | allow_leading_wildcard_searches = false | + | allow_leading_wildcard_searches = false |
| # Do you want to allow searches to be highlighted? | # Do you want to allow searches to be highlighted? | ||
| - | # should only be enabled after making sure your Elasticsearch cluster has enough memory. | + | # should only be enabled after making sure your Elasticsearch cluster has enough memory. |
| - | allow_highlighting = false | + | allow_highlighting = false |
| # settings to be passed to elasticsearch' | # settings to be passed to elasticsearch' | ||
| - | # all these | + | # all these |
| - | # this must be the same as for your Elasticsearch cluster | + | # this must be the same as for your Elasticsearch cluster |
| - | # | + | # Django : 2017-02-14 |
| - | # Django : 2015-12-28 | + | # default: |
| - | # default: | + | elasticsearch_cluster_name = graylog |
| - | elasticsearch_cluster_name = graylog | + | |
| - | # you could also leave this out, but makes it easier to identify the graylog2 client instance | + | # The prefix being used to generate the Elasticsearch node name which makes it easier to identify the specific Graylog |
| - | #elasticsearch_node_name = graylog2-server | + | # server |
| - | # Django : 2015-12-28 | + | # and the Graylog node ID (see node_id_file), |
| - | # default: unset | + | # Default: graylog- |
| - | elasticsearch_node_name | + | # |
| - | # we don't want the graylog2 | + | # A comma-separated list of Elasticsearch nodes which Graylog is using to connect to the Elasticsearch cluster, |
| - | # Django : 2015-12-28 | + | # see https:// |
| - | # default: | + | # Default: 127.0.0.1 |
| - | # # | + | # |
| - | elasticsearch_node_master = false | + | |
| - | elasticsearch_node_data = false | + | # Use multiple Elasticsearch nodes as seed |
| + | # | ||
| + | |||
| + | # we don't want the Graylog | ||
| + | # | ||
| + | # | ||
| # use a different port if you run multiple Elasticsearch nodes on one machine | # use a different port if you run multiple Elasticsearch nodes on one machine | ||
| - | # | + | # |
| # we don't need to run the embedded HTTP server here | # we don't need to run the embedded HTTP server here | ||
| - | # Django : 2015-12-28 | + | # |
| - | # default: | + | |
| - | elasticsearch_http_enabled = false | + | |
| - | + | ||
| - | # Django : 2015-12-28 | + | |
| - | # default: # | + | |
| - | elasticsearch_discovery_zen_ping_multicast_enabled = false | + | |
| - | + | ||
| - | # Django : 2015-12-28 | + | |
| - | # default: # | + | |
| - | elasticsearch_discovery_zen_ping_unicast_hosts = 127.0.0.1: | + | |
| # Change the following setting if you are running into problems with timeouts during Elasticsearch cluster discovery. | # Change the following setting if you are running into problems with timeouts during Elasticsearch cluster discovery. | ||
| - | # The setting is specified in milliseconds, | + | # The setting is specified in milliseconds, |
| - | # | + | # |
| - | # the following settings allow to change the bind addresses for the Elasticsearch client in graylog2 | + | # the following settings allow to change the bind addresses for the Elasticsearch client in Graylog |
| - | # these settings are empty by default, letting Elasticsearch choose automatically, | + | # these settings are empty by default, letting Elasticsearch choose automatically, |
| - | # override them here or in the ' | + | # override them here or in the ' |
| - | # refer to http://www.elasticsearch.org/ | + | # refer to https://www.elastic.co/ |
| - | # for special values here | + | # for special values here |
| - | # | + | # |
| - | # | + | # |
| - | # | + | # |
| # The total amount of time discovery will look for other Elasticsearch nodes in the cluster | # The total amount of time discovery will look for other Elasticsearch nodes in the cluster | ||
| - | # before giving up and declaring the current node master. | + | # before giving up and declaring the current node master. |
| - | # | + | # |
| # Analyzer (tokenizer) to use for message and full_message field. The " | # Analyzer (tokenizer) to use for message and full_message field. The " | ||
| # All supported analyzers are: standard, simple, whitespace, stop, keyword, pattern, language, snowball, custom | # All supported analyzers are: standard, simple, whitespace, stop, keyword, pattern, language, snowball, custom | ||
| - | # Elasticsearch documentation: | + | # Elasticsearch documentation: |
| - | # Note that this setting only takes effect on newly created indices. | + | # Note that this setting only takes effect on newly created indices. |
| - | elasticsearch_analyzer = standard | + | # |
| + | # ATTENTION: These settings have been moved to the database in Graylog 2.2.0. When you upgrade, make sure to set these | ||
| + | # to your previous settings so they will be migrated to the database! | ||
| + | elasticsearch_analyzer = standard | ||
| # Global request timeout for Elasticsearch requests (e. g. during search, index creation, or index time-range | # Global request timeout for Elasticsearch requests (e. g. during search, index creation, or index time-range | ||
| - | # calculations) based on a best-effort to restrict the runtime of Elasticsearch operations. | + | # calculations) based on a best-effort to restrict the runtime of Elasticsearch operations. |
| - | # Default: 1m | + | # Default: 1m |
| - | # | + | # |
| + | |||
| + | # Global timeout for index optimization (force merge) requests. | ||
| + | # Default: 1h | ||
| + | # | ||
| + | |||
| + | # Maximum number of concurrently running index optimization (force merge) jobs. | ||
| + | # If you are using lots of different index sets, you might want to increase that number. | ||
| + | # Default: 20 | ||
| + | # | ||
| # Time interval for index range information cleanups. This setting defines how often stale index range information | # Time interval for index range information cleanups. This setting defines how often stale index range information | ||
| - | # is being purged from the database. | + | # is being purged from the database. |
| - | # Default: 1h | + | # Default: 1h |
| - | # | + | # |
| # Batch size for the Elasticsearch output. This is the maximum (!) number of messages the Elasticsearch output | # Batch size for the Elasticsearch output. This is the maximum (!) number of messages the Elasticsearch output | ||
| # module will get at once and write to Elasticsearch in a batch call. If the configured batch size has not been | # module will get at once and write to Elasticsearch in a batch call. If the configured batch size has not been | ||
| - | # reached within output_flush_interval seconds, everything that is available will be flushed at once. Remember | + | # reached within output_flush_interval seconds, everything that is available will be flushed at once. Remember |
| - | # that every outputbuffer processor manages its own batch and performs its own batch write calls. | + | # that every outputbuffer processor manages its own batch and performs its own batch write calls. |
| - | # (" | + | # (" |
| - | output_batch_size = 500 | + | output_batch_size = 500 |
| # Flush interval (in seconds) for the Elasticsearch output. This is the maximum amount of time between two | # Flush interval (in seconds) for the Elasticsearch output. This is the maximum amount of time between two | ||
| # batches of messages written to Elasticsearch. It is only effective at all if your minimum number of messages | # batches of messages written to Elasticsearch. It is only effective at all if your minimum number of messages | ||
| - | # for this time period is less than output_batch_size * outputbuffer_processors. | + | # for this time period is less than output_batch_size * outputbuffer_processors. |
| - | output_flush_interval = 1 | + | output_flush_interval = 1 |
| # As stream outputs are loaded only on demand, an output which is failing to initialize will be tried over and | # As stream outputs are loaded only on demand, an output which is failing to initialize will be tried over and | ||
| # over again. To prevent this, the following configuration options define after how many faults an output will | # over again. To prevent this, the following configuration options define after how many faults an output will | ||
| - | # not be tried again for an also configurable amount of seconds. | + | # not be tried again for an also configurable amount of seconds. |
| - | output_fault_count_threshold = 5 | + | output_fault_count_threshold = 5 |
| - | output_fault_penalty_seconds = 30 | + | output_fault_penalty_seconds = 30 |
| # The number of parallel running processors. | # The number of parallel running processors. | ||
| # Raise this number if your buffers are filling up. | # Raise this number if your buffers are filling up. | ||
| - | processbuffer_processors = 5 | + | processbuffer_processors = 5 |
| - | outputbuffer_processors = 3 | + | outputbuffer_processors = 3 |
| # | # | ||
| Zeile 1826: | Zeile 1881: | ||
| # UDP receive buffer size for all message inputs (e. g. SyslogUDPInput). | # UDP receive buffer size for all message inputs (e. g. SyslogUDPInput). | ||
| - | # | + | # |
| # Wait strategy describing how buffer processors wait on a cursor sequence. (default: sleeping) | # Wait strategy describing how buffer processors wait on a cursor sequence. (default: sleeping) | ||
| - | # Possible types: | + | # Possible types: |
| - | # - yielding | + | # - yielding |
| - | # | + | # |
| - | # - sleeping | + | # - sleeping |
| # | # | ||
| - | # - blocking | + | # - blocking |
| - | # High throughput, low latency, higher CPU usage. | + | # High throughput, low latency, higher CPU usage. |
| - | # - busy_spinning | + | # - busy_spinning |
| # | # | ||
| - | processor_wait_strategy = blocking | + | processor_wait_strategy = blocking |
| # Size of internal ring buffers. Raise this if raising outputbuffer_processors does not help anymore. | # Size of internal ring buffers. Raise this if raising outputbuffer_processors does not help anymore. | ||
| # For optimum performance your LogMessage objects in the ring buffer should fit in your CPU L3 cache. | # For optimum performance your LogMessage objects in the ring buffer should fit in your CPU L3 cache. | ||
| - | # Start server with --statistics flag to see buffer utilization. | + | # Must be a power of 2. (512, 1024, 2048, ...) |
| - | # Must be a power of 2. (512, 1024, 2048, ...) | + | ring_size = 65536 |
| - | ring_size = 65536 | + | |
| inputbuffer_ring_size = 65536 | inputbuffer_ring_size = 65536 | ||
| - | inputbuffer_processors = 2 | + | inputbuffer_processors = 2 |
| inputbuffer_wait_strategy = blocking | inputbuffer_wait_strategy = blocking | ||
| # Enable the disk based message journal. | # Enable the disk based message journal. | ||
| - | message_journal_enabled = true | + | message_journal_enabled = true |
| # The directory which will be used to store the message journal. The directory must me exclusively used by Graylog and | # The directory which will be used to store the message journal. The directory must me exclusively used by Graylog and | ||
| - | # must not contain any other files than the ones created by Graylog itself. | + | # must not contain any other files than the ones created by Graylog itself. |
| - | message_journal_dir = / | + | # |
| + | # ATTENTION: | ||
| + | # If you create a seperate partition for the journal files and use a file system creating directories like ' | ||
| + | # in the root directory, you need to create a sub directory for your journal. | ||
| + | # | ||
| + | message_journal_dir = / | ||
| # Journal hold messages before they could be written to Elasticsearch. | # Journal hold messages before they could be written to Elasticsearch. | ||
| - | # For a maximum of 12 hours or 5 GB whichever happens first. | + | # For a maximum of 12 hours or 5 GB whichever happens first. |
| - | # During normal operation the journal will be smaller. | + | # During normal operation the journal will be smaller. |
| - | # | + | # |
| - | # | + | # |
| # | # | ||
| # | # | ||
| - | # | + | # |
| - | # | + | # |
| # Number of threads used exclusively for dispatching internal events. Default is 2. | # Number of threads used exclusively for dispatching internal events. Default is 2. | ||
| - | # | + | # |
| - | + | ||
| - | # EXPERIMENTAL: | + | |
| - | # Every failed indexing attempt is logged by default and made visible in the web-interface. You can enable | + | |
| - | # the experimental dead letters feature to write every message that was not successfully indexed into the | + | |
| - | # MongoDB " | + | |
| - | # letter should work fine already but it is not heavily tested yet and will get more features in future | + | |
| - | # releases. | + | |
| - | dead_letters_enabled = false | + | |
| # How many seconds to wait between marking node as DEAD for possible load balancers and starting the actual | # How many seconds to wait between marking node as DEAD for possible load balancers and starting the actual | ||
| - | # shutdown process. Set to 0 if you have no status checking load balancers in front. | + | # shutdown process. Set to 0 if you have no status checking load balancers in front. |
| - | lb_recognition_period_seconds = 3 | + | lb_recognition_period_seconds = 3 |
| + | |||
| + | # Journal usage percentage that triggers requesting throttling for this server node from load balancers. The feature is | ||
| + | # disabled if not set. | ||
| + | # | ||
| # Every message is matched against the configured streams and it can happen that a stream contains rules which | # Every message is matched against the configured streams and it can happen that a stream contains rules which | ||
| # take an unusual amount of time to run, for example if its using regular expressions that perform excessive backtracking. | # take an unusual amount of time to run, for example if its using regular expressions that perform excessive backtracking. | ||
| - | # This will impact the processing of the entire server. To keep such misbehaving stream rules from impacting other | + | # This will impact the processing of the entire server. To keep such misbehaving stream rules from impacting other |
| - | # streams, Graylog limits the execution time for each stream. | + | # streams, Graylog limits the execution time for each stream. |
| - | # The default values are noted below, the timeout is in milliseconds. | + | # The default values are noted below, the timeout is in milliseconds. |
| # If the stream matching for one stream took longer than the timeout value, and this happened more than " | # If the stream matching for one stream took longer than the timeout value, and this happened more than " | ||
| - | # that stream is disabled and a notification is shown in the web interface. | + | # that stream is disabled and a notification is shown in the web interface. |
| - | # | + | # |
| - | # | + | # |
| # Length of the interval in seconds in which the alert conditions for all streams should be checked | # Length of the interval in seconds in which the alert conditions for all streams should be checked | ||
| - | # and alarms are being sent. | + | # and alarms are being sent. |
| - | # | + | # |
| - | # Since 0.21 the graylog2 | + | # Since 0.21 the Graylog |
| - | # outputs. The next setting defines the timeout for a single output module, including the default output module where all | + | # outputs. The next setting defines the timeout for a single output module, including the default output module where all |
| - | # messages end up. | + | # messages end up. |
| - | # | + | # |
| - | # Time in milliseconds to wait for all message outputs to finish writing a single message. | + | # Time in milliseconds to wait for all message outputs to finish writing a single message. |
| - | # | + | # |
| # Time in milliseconds after which a detected stale master node is being rechecked on startup. | # Time in milliseconds after which a detected stale master node is being rechecked on startup. | ||
| - | # | + | # |
| # Time in milliseconds which Graylog is waiting for all threads to stop on shutdown. | # Time in milliseconds which Graylog is waiting for all threads to stop on shutdown. | ||
| - | # | + | # |
| # MongoDB connection string | # MongoDB connection string | ||
| - | # See http:// | + | # See https:// |
| - | # Django : 2015-12-28 | + | # Django : 2017-02-14 |
| - | # default: mongodb_uri = mongodb:// | + | # default: mongodb_uri = mongodb:// |
| - | mongodb_uri = mongodb:// | + | mongodb_uri = mongodb:// |
| # Authenticate against the MongoDB server | # Authenticate against the MongoDB server | ||
| - | # | + | # |
| # Use a replica set instead of a single host | # Use a replica set instead of a single host | ||
| - | # | + | # |
| # Increase this value according to the maximum connections your MongoDB server can handle from a single client | # Increase this value according to the maximum connections your MongoDB server can handle from a single client | ||
| - | # if you encounter MongoDB connection problems. | + | # if you encounter MongoDB connection problems. |
| - | mongodb_max_connections = 100 | + | mongodb_max_connections = 1000 |
| # Number of threads allowed to be blocked by MongoDB connections multiplier. Default: 5 | # Number of threads allowed to be blocked by MongoDB connections multiplier. Default: 5 | ||
| # If mongodb_max_connections is 100, and mongodb_threads_allowed_to_block_multiplier is 5, | # If mongodb_max_connections is 100, and mongodb_threads_allowed_to_block_multiplier is 5, | ||
| - | # then 500 threads can block. More than that and an exception will be thrown. | + | # then 500 threads can block. More than that and an exception will be thrown. |
| - | # http:// | + | # http:// |
| - | mongodb_threads_allowed_to_block_multiplier = 5 | + | mongodb_threads_allowed_to_block_multiplier = 5 |
| # Drools Rule File (Use to rewrite incoming log messages) | # Drools Rule File (Use to rewrite incoming log messages) | ||
| - | # See: https://www.graylog.org/ | + | # See: http://docs.graylog.org/ |
| - | #rules_file = / | + | #rules_file = / |
| # Email transport | # Email transport | ||
| - | # | + | # Django : 2017-02-14 |
| - | # | + | # default: |
| - | # | + | # |
| - | # | + | # |
| - | # | + | # |
| - | # | + | # |
| - | # | + | # |
| - | # | + | # |
| - | # | + | # |
| - | # | + | # |
| - | # | + | # |
| - | # Django : 2015-12-28 | + | transport_email_enabled = true |
| - | # default: unset | + | transport_email_hostname = smtp.dmz.nausch.org |
| - | transport_email_enabled = true | + | transport_email_port = 587 |
| - | transport_email_hostname = smtp.dmz.nausch.org | + | transport_email_use_auth = true |
| - | transport_email_port = 25 | + | transport_email_use_tls = true |
| - | transport_email_use_auth = false | + | transport_email_use_ssl = false |
| - | transport_email_use_tls = false | + | |
| - | transport_email_use_ssl = false | + | |
| transport_email_auth_username = graylog-admin@nausch.org | transport_email_auth_username = graylog-admin@nausch.org | ||
| - | transport_email_auth_password = 6zmNsgdrD4x1! | + | transport_email_auth_password = -7h3FBI15n07ar0ckb4and! |
| transport_email_subject_prefix = [graylog] | transport_email_subject_prefix = [graylog] | ||
| - | transport_email_from_email = graylog-admin@nausch.org | + | transport_email_from_email = graylogadmin@nausch.org |
| # Specify and uncomment this if you want to include links to the stream in your stream alert mails. | # Specify and uncomment this if you want to include links to the stream in your stream alert mails. | ||
| # This should define the fully qualified base url to your web interface exactly the same way as it is accessed by your users. | # This should define the fully qualified base url to your web interface exactly the same way as it is accessed by your users. | ||
| - | # | + | # Django : 2017-02-14 |
| - | # Django : 2015-12-28 | + | # default: |
| - | # default: transport_email_web_interface_url = https://graylog2.example.com | + | transport_email_web_interface_url = https://graylog.nausch.org |
| - | transport_email_web_interface_url = https://panopticon.nausch.org | + | |
| # The default connect timeout for outgoing HTTP connections. | # The default connect timeout for outgoing HTTP connections. | ||
| Zeile 1989: | Zeile 2041: | ||
| # on heavily used systems with large indices, but it will decrease search performance. The default is to optimize | # on heavily used systems with large indices, but it will decrease search performance. The default is to optimize | ||
| # cycled indices. | # cycled indices. | ||
| + | # | ||
| + | # ATTENTION: These settings have been moved to the database in Graylog 2.2.0. When you upgrade, make sure to set these | ||
| + | # to your previous settings so they will be migrated to the database! | ||
| # | # | ||
| # Optimize the index down to <= index_optimization_max_num_segments. A higher number may take some load from Elasticsearch | # Optimize the index down to <= index_optimization_max_num_segments. A higher number may take some load from Elasticsearch | ||
| # on heavily used systems with large indices, but it will decrease search performance. The default is 1. | # on heavily used systems with large indices, but it will decrease search performance. The default is 1. | ||
| + | # | ||
| + | # ATTENTION: These settings have been moved to the database in Graylog 2.2.0. When you upgrade, make sure to set these | ||
| + | # to your previous settings so they will be migrated to the database! | ||
| # | # | ||
| Zeile 2001: | Zeile 2059: | ||
| # Connection timeout for a configured LDAP server (e. g. ActiveDirectory) in milliseconds. | # Connection timeout for a configured LDAP server (e. g. ActiveDirectory) in milliseconds. | ||
| # | # | ||
| - | |||
| - | # Enable collection of Graylog-related metrics into MongoDB | ||
| - | # WARNING: This will add *a lot* of data into your MongoDB database on a regular interval (1 second)! | ||
| - | # DEPRECATED: This setting and the respective feature will be removed in a future version of Graylog. | ||
| - | # | ||
| # Disable the use of SIGAR for collecting system stats | # Disable the use of SIGAR for collecting system stats | ||
| # | # | ||
| - | |||
| - | # Amount of time of inactivity after which collectors are flagged as inactive (Default: 1 minute) | ||
| - | # | ||
| - | |||
| - | # Amount of time after which inactive collectors are purged (Default: 14 days) | ||
| - | # | ||
| # The default cache time for dashboard widgets. (Default: 10 seconds, minimum: 1 second) | # The default cache time for dashboard widgets. (Default: 10 seconds, minimum: 1 second) | ||
| Zeile 2027: | Zeile 2074: | ||
| # A comma-separated list of content packs (files in " | # A comma-separated list of content packs (files in " | ||
| # the first start of Graylog. | # the first start of Graylog. | ||
| - | content_packs_auto_load = grok-patterns.json</ | + | # Default: empty |
| + | content_packs_auto_load = grok-patterns.json | ||
| + | |||
| + | # For some cluster-related REST requests, the node must query all other nodes in the cluster. This is the maximum number | ||
| + | # of threads available for this. Increase it, if '/ | ||
| + | # Should be rest_thread_pool_size * average_cluster_size if you have a high number of concurrent users. | ||
| + | proxied_requests_thread_pool_size = 32</ | ||
| === Start des Daemon === | === Start des Daemon === | ||
| Zeile 2039: | Zeile 2092: | ||
| <font style=" | <font style=" | ||
| | | ||
| - | | + | |
| Docs: http:// | Docs: http:// | ||
| - | Main PID: 5057 (graylog-server) | + | Main PID: 2832 (graylog-server) |
| | | ||
| - | | + | |
| - | | + | |
| - | Dec 28 14:27:40 vml000117.dmz.nausch.org systemd[1]: Started Graylog server. | + | Feb 17 12:11:05 vml000117.dmz.nausch.org systemd[1]: Started Graylog server. |
| - | Dec 28 14:27:40 vml000117.dmz.nausch.org systemd[1]: Starting Graylog server...</ | + | Feb 17 12:11:05 vml000117.dmz.nausch.org systemd[1]: Starting Graylog server...</ |
| </ | </ | ||
| Der erfolgreiche Start des Servers wird auch in dessen Logdatei protokolliert. | Der erfolgreiche Start des Servers wird auch in dessen Logdatei protokolliert. | ||
| - | # /var/log/elasticsearch/elasticsearch.log | + | # /var/log/graylog-server/server.log |
| - | < | + | < |
| - | Dec 28 14:27:40 vml000117.dmz.nausch.org systemd[1]: Starting Graylog server... | + | 2017-02-16T13: |
| - | [root@vml000117 yum.repos.d]# tailf /var/log/graylog-server/ | + | 2017-02-16T13:05:32.252+01:00 INFO [CmdLineTool] Loaded plugin: Enterprise Integration Plugin 2.2.0 [org.graylog.plugins.enterprise_integration.EnterpriseIntegrationPlugin] |
| - | 2015-12-28T14:27:55.595+01:00 INFO [discovery] [vml000117] graylog/ | + | 2017-02-16T13: |
| - | 2015-12-28T14:27:55.609+01:00 INFO [RestApiService] Enabling CORS for REST API | + | 2017-02-16T13: |
| - | 2015-12-28T14:27:58.627+01: | + | 2017-02-16T13: |
| - | 2015-12-28T14:27:58.627+01:00 INFO [node] [vml000117] started | + | 2017-02-16T13: |
| - | 2015-12-28T14:27:59.138+01:00 INFO [service] [vml000117] detected_master [vml000117][EdAnadZuTiOjxFR7_Kvdrg][vml000117.dmz.nausch.org][inet[/ | + | d -XX: |
| - | 2015-12-28T14:28:05.324+01:00 INFO [IndexRotationThread] Deflector index < | + | m |
| - | 2015-12-28T14:28:05.324+01:00 INFO [Deflector] Cycling deflector to next index now. | + | 2017-02-16T13:05:33.487+01:00 INFO [Version] HV000001: Hibernate Validator null |
| - | 2015-12-28T14:28:05.340+01:00 INFO [Deflector] Cycling from < | + | 2017-02-16T13:05:39.765+01:00 INFO [InputBufferImpl] Message journal is enabled. |
| - | 2015-12-28T14:28:05.340+01:00 INFO [Deflector] Creating index target < | + | 2017-02-16T13:05:39.899+01: |
| - | 2015-12-28T14:28:06.218+01:00 INFO [Deflector] Waiting for index allocation of < | + | 2017-02-16T13: |
| - | 2015-12-28T14:28:06.335+01:00 INFO [Deflector] Done! | + | 2017-02-16T13:05:40.727+01:00 INFO [LogManager] Logs loading complete. |
| - | 2015-12-28T14:28:06.335+01:00 INFO [Deflector] Pointing deflector | + | 2017-02-16T13:05:40.805+01:00 INFO [LogManager] Created log for partition |
| - | 2015-12-28T14:28:06.531+01:00 INFO [SystemJobManager] Submitted SystemJob < | + | age.bytes -> 104857600, min.insync.replicas -> 1, segment.jitter.ms -> 0, index.interval.bytes -> 4096, min.cleanable.dirty.ratio -> 0.5, unclean.leader.election.enable -> true, retention.bytes |
| - | 2015-12-28T14:28:06.537+01:00 INFO [CreateNewSingleIndexRangeJob] Calculating ranges for index graylog_1. | + | 9120, delete.retention.ms |
| - | 2015-12-28T14:28:06.610+01:00 INFO [SystemJobManager] Submitted SystemJob < | + | 2017-02-16T13:05:40.806+01:00 INFO [KafkaJournal] Initialized Kafka based journal at / |
| - | 2015-12-28T14:28:06.658+01:00 INFO [SystemJobManager] Submitted SystemJob < | + | 2017-02-16T13:05:41.219+01:00 INFO [InputBufferImpl] Initialized InputBufferImpl with ring size < |
| - | 2015-12-28T14:28:06.658+01:00 INFO [Deflector] Done! | + | 2017-02-16T13:05:41.271+01:00 INFO [cluster] Cluster created with settings {hosts=[127.0.01: |
| - | 2015-12-28T14:28:06.618+01:00 INFO [CreateNewSingleIndexRangeJob] Calculating ranges for index graylog_2. | + | 2017-02-16T13:05:41.394+01:00 INFO [cluster] No server chosen by ReadPreferenceServerSelector{readPreference=primary} from cluster description ClusterDescription{type=UNKNOWN, |
| - | 2015-12-28T14:28:06.720+01: | + | verDescriptions=[ServerDescription{address=127.0.01:27017, type=UNKNOWN, |
| - | 2015-12-28T14:28:06.807+01:00 INFO [CreateNewSingleIndexRangeJob] Created ranges for index graylog_1. | + | 2017-02-16T13:05:41.497+01:00 INFO [connection] Opened connection [connectionId{localValue: |
| - | 2015-12-28T14:28:06.807+01: | + | 2017-02-16T13:05:41.504+01:00 INFO [cluster] Monitor thread successfully connected to server with description ServerDescription{address=127.0.01: |
| - | 2015-12-28T14:28:06.879+01: | + | =ServerVersion{versionList=[2, |
| - | 2015-12-28T14:28:06.930+01: | + | 2017-02-16T13:05:41.527+01:00 INFO [connection] Opened connection [connectionId{localValue: |
| - | 2015-12-28T14:28:06.931+01:00 INFO [SystemJobManager] SystemJob < | + | 2017-02-16T13:05:42.486+01:00 INFO [node] [graylog-57cfc6d7-f241-4487-8661-f115d4f70fc8] version[2.4.4], pid[2500], build[fcbb46d/ |
| - | 2015-12-28T14:28:08.315+01:00 INFO [RestApiService] Adding security context factory: <org.graylog2.security.ShiroSecurityContextFactory@79ffbf1a> | + | 2017-02-16T13:05:42.486+01:00 INFO [node] [graylog-57cfc6d7-f241-4487-8661-f115d4f70fc8] initializing ... |
| - | 2015-12-28T14:28:08.354+01:00 INFO [RestApiService] Started REST API at <http://127.0.0.1:12900/> | + | 2017-02-16T13:05:42.498+01:00 INFO [plugins] [graylog-57cfc6d7-f241-4487-8661-f115d4f70fc8] modules [], plugins [graylog-monitor], |
| - | 2015-12-28T14:28:08.355+01:00 INFO [ServiceManagerListener] Services are healthy | + | 2017-02-16T13:05:46.715+01:00 INFO [node] [graylog-57cfc6d7-f241-4487-8661-f115d4f70fc8] initialized |
| - | 2015-12-28T14:28:08.357+01:00 INFO [ServerBootstrap] | + | 2017-02-16T13:05:46.885+01:00 INFO [ProcessBuffer] Initialized ProcessBuffer with ring size < |
| - | 2015-12-28T14:28:08.360+01:00 INFO [ServerBootstrap] | + | 2017-02-16T13:05:50.440+01:00 INFO [RulesEngineProvider] No static rules file loaded. |
| - | 2015-12-28T14:28:08.361+01: | + | 2017-02-16T13:05:50.926+01: |
| + | 2017-02-16T13:05:50.936+01:00 INFO [OutputBuffer] Initialized OutputBuffer with ring size < | ||
| + | 2017-02-16T13:05:51.353+01: | ||
| + | 2017-02-16T13:05:51.439+01:00 WARN [GeoIpResolverEngine] GeoIP database file does not exist: / | ||
| + | 2017-02-16T13:05:51.546+01: | ||
| + | 2017-02-16T13:05:51.686+01: | ||
| + | 2017-02-16T13:05:52.601+01:00 INFO [RoleServiceImpl] Admin role is missing or invalid, re-adding it as a built-in role. | ||
| + | 2017-02-16T13:05:52.779+01:00 INFO [RoleServiceImpl] Reader role is missing or invalid, re-adding it as a built-in role. | ||
| + | 2017-02-16T13:05:53.824+01:00 INFO [connection] Opened connection [connectionId{localValue:3, serverValue: | ||
| + | 2017-02-16T13: | ||
| + | 2017-02-16T13:05:54.031+01:00 INFO [ServerBootstrap] JRE: Oracle Corporation 1.8.0_121 on Linux 3.10.0-514.6.1.el7.x86_64 | ||
| + | 2017-02-16T13:05:54.031+01:00 INFO [ServerBootstrap] Deployment: rpm | ||
| + | 2017-02-16T13:05:54.031+01:00 INFO [ServerBootstrap] | ||
| + | 2017-02-16T13:05:54.032+01:00 INFO [ServerBootstrap] | ||
| + | 2017-02-16T13:05:54.050+01: | ||
| + | 2017-02-16T13:05: | ||
| + | Mit einer Abfrage der geöffneten Ports, sehen wir unsere neu definierten Ports, wie z.B. den Port **9000** des JAVA-Prozesses, | ||
| + | # netstat -tulpen | ||
| + | < | ||
| + | Proto Recv-Q Send-Q Local Address | ||
| + | tcp 0 0 127.0.0.1: | ||
| + | tcp 0 0 127.0.0.1: | ||
| + | tcp6 | ||
| + | tcp6 | ||
| + | tcp6 | ||
| + | tcp6 | ||
| + | tcp6 | ||
| + | tcp6 | ||
| + | tcp6 | ||
| + | udp6 | ||
| === automatischer Start des Daemon === | === automatischer Start des Daemon === | ||
| Damit der Daemon beim Hochfahren unseres Servers automatisch gestartet wird, nutzen wir folgenden Befehl. | Damit der Daemon beim Hochfahren unseres Servers automatisch gestartet wird, nutzen wir folgenden Befehl. | ||
| Zeile 2098: | Zeile 2180: | ||
| enabled | enabled | ||
| - | ==== graylog-web ==== | + | ==== Apache Reverse-Proxy ==== |
| - | Die Konfiguration des **graylog-server Daemons** haben wir im vorherigen Kapitel erfolgreich abgeschlossen. Was nun noch fehlt, ist die **graylog-web** GUI. Die Installation des zugehörigen RPM-Paketes **graylog-web** hatten wir bereits im Abschnitt **[[centos: | + | |
| - | + | ||
| - | === / | + | |
| - | Zunächst binden wir den Web-Server auf // | + | |
| - | # vim / | + | |
| - | + | ||
| - | <file bash / | + | |
| - | # Django : 2015-12-28 | + | |
| - | # default: GRAYLOG_WEB_HTTP_ADDRESS=" | + | |
| - | GRAYLOG_WEB_HTTP_ADDRESS=" | + | |
| - | GRAYLOG_WEB_HTTP_PORT=" | + | |
| - | + | ||
| - | # Might be used to adjust the Java heap size. (i.e. " | + | |
| - | GRAYLOG_WEB_JAVA_OPTS="" | + | |
| - | + | ||
| - | # Pass some extra args to graylog-web. (i.e. " | + | |
| - | GRAYLOG_WEB_ARGS="" | + | |
| - | # Program that will be used to wrap the graylog-web command. Useful to | ||
| - | # support programs like authbind. | ||
| - | GRAYLOG_COMMAND_WRAPPER=""</ | ||
| - | === Apache Reverse-Proxy === | ||
| Da der **graylog-web**-Daemon __ohne__ Root-Rechte gestartet wird, können wir nur unprivilegierte Ports (Ports größer als 1024) definieren. Da wir aber die Graylog-Web-GUI auch von außen, über einen TLS geschützten Transportkanal ansprechen wollen, nutzen wir einen Apache-vHOST als Reverse-Proxy. | Da der **graylog-web**-Daemon __ohne__ Root-Rechte gestartet wird, können wir nur unprivilegierte Ports (Ports größer als 1024) definieren. Da wir aber die Graylog-Web-GUI auch von außen, über einen TLS geschützten Transportkanal ansprechen wollen, nutzen wir einen Apache-vHOST als Reverse-Proxy. | ||
| Dazu legen wir uns folgende vHOST-Datei an. | Dazu legen wir uns folgende vHOST-Datei an. | ||
| # vim / | # vim / | ||
| - | <file apache / | + | <file apache / |
| - | # Django : 2015-12-28 | + | # Django : 2017-02-14 |
| - | # vHost graylog | + | # vHost graylog |
| - | # | + | # |
| + | |||
| + | # Variablen der Hostvariablen | ||
| + | Define vhost graylog | ||
| + | Define errors_log logs/ | ||
| + | Define access_log logs/ | ||
| + | Define ssl_log logs/ | ||
| - | < | + | < |
| ServerAdmin webmaster@nausch.org | ServerAdmin webmaster@nausch.org | ||
| - | ServerName | + | ServerName |
| RewriteEngine on | RewriteEngine on | ||
| Zeile 2140: | Zeile 2208: | ||
| # Welche Logdateien sollen beschrieben werden | # Welche Logdateien sollen beschrieben werden | ||
| - | | + | |
| - | ErrorLog | + | ErrorLog |
| - | </ | + | CustomLog ${access_log} combined env=!dontlog |
| - | < | + | </ |
| - | ServerAdmin webmaster@nausch.org | + | < |
| - | ServerName | + | ServerAdmin webmaster@nausch.org |
| - | ServerPath / | + | ServerName |
| + | ServerPath / | ||
| # Wer soll Zugriff auf die Webseite(n) bekommen? | # Wer soll Zugriff auf die Webseite(n) bekommen? | ||
| - | <Proxy *> | + | <Proxy *> |
| Options +FollowSymLinks +Multiviews -Indexes | Options +FollowSymLinks +Multiviews -Indexes | ||
| AllowOverride None | AllowOverride None | ||
| Zeile 2157: | Zeile 2226: | ||
| AuthLDAPUrl ldaps:// | AuthLDAPUrl ldaps:// | ||
| AuthLDAPBindDN cn=Technischer_User, | AuthLDAPBindDN cn=Technischer_User, | ||
| - | AuthLDAPBindPassword " | + | AuthLDAPBindPassword " |
| AuthLDAPBindAuthoritative on | AuthLDAPBindAuthoritative on | ||
| - | Require ldap-user | + | Require ldap-user |
| - | </ | + | </ |
| # Welcher Inhalt soll angezeigt bzw. auf welchen Server sollen die HTTP-Requests weitergeleitet werden? | # Welcher Inhalt soll angezeigt bzw. auf welchen Server sollen die HTTP-Requests weitergeleitet werden? | ||
| - | ProxyRequests Off | + | ProxyRequests Off |
| - | | + | |
| - | ProxyPass / http://127.0.0.1: | + | |
| - | | + | |
| + | < | ||
| + | RequestHeader set X-Graylog-Server-URL " | ||
| + | | ||
| + | ProxyPassReverse | ||
| + | | ||
| + | |||
| + | < | ||
| + | ProxyPass | ||
| + | ProxyPassReverse http:// | ||
| + | </ | ||
| # Welche Logdateien sollen beschrieben werden | # Welche Logdateien sollen beschrieben werden | ||
| - | | + | |
| - | ErrorLog | + | ErrorLog |
| + | CustomLog ${access_log} combined env=!dontlog | ||
| + | CustomLog ${ssl_log} "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \" | ||
| # Absicherung der Übertragung mit Hilfe von TLS | # Absicherung der Übertragung mit Hilfe von TLS | ||
| - | | + | # Django : 2015-10-04 - TLS-Verschlüsselung mit Hilfe von mod_ssl |
| - | < | + | |
| - | < | + | # Definition der anzubietenden Protokolle |
| - | | + | |
| - | | + | # Definition der Cipher |
| - | # Definition der anzubietenden Protokolle | + | SSLCipherSuite ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384 |
| - | | + | # Schlüsseldatei, |
| - | # Schlüsseldatei, | + | SSLCertificateKeyFile / |
| - | GnuTLSKeyFile / | + | # Zertifikatsdatei, |
| - | # Zertifikatsdatei inkl. ggf. notwendiger Zwischen- und Root-Zertifikaten | + | SSLCertificateFile / |
| - | # 1) Server-Zertifikat, 2) Intermediate-Root-Zertifikat und 3) Root-Zertifikat der CA | + | # Zertifikatsdatei des bzw. der Intermediate-Zertifikate(s) |
| - | GnuTLSCertificateFile / | + | SSLCertificateChainFile / |
| - | # Definition der Schlüssellänge für DHE und ECDHE | + | # Änderung der Cipherorder der Clients |
| - | # DHE Schlüssel mit einer Schlüssellänge von 4096 Bit verwenden; dieser wird 1x pro Tag via cronjob | + | SSLHonorCipherOrder on |
| - | # (/ | + | # TLS 1.0 Kompremmierung deaktivieren (CRIME attacks) |
| - | GnuTLSDHFile / | + | SSLCompression off |
| - | # Session-Tickets für Clients nicht anbieten (dieser könnte versuchen über Tickets die Session zu cachen). | + | # Online Certificate Status Protocol stapling zum Prüfen des Gültigkeitsstatus des Serverzertifikats. |
| - | GnuTLSSessionTickets off | + | |
| - | </ | + | |
| - | </ | + | |
| - | # Konfiguration bei Verwendung von mod_ssl | + | |
| - | < | + | |
| - | < | + | |
| - | # Django : 2015-10-04 - TLS-Verschlüsselung mit Hilfe von mod_ssl | + | |
| - | SSLEngine on | + | |
| - | # Definition der anzubietenden Protokolle | + | |
| - | SSLProtocol All -SSLv2 -SSLv3 | + | |
| - | # Definition der Cipher | + | |
| - | SSLCipherSuite " | + | |
| - | | + | |
| - | SSLCertificateKeyFile / | + | |
| - | # Zertifikatsdatei, | + | |
| - | SSLCertificateFile / | + | |
| - | # Zertifikatsdatei des bzw. der Intermediate-Zertifikate(s) | + | |
| - | SSLCertificateChainFile / | + | |
| - | # Änderung der Cipherorder der Clienets | + | |
| - | SSLHonorCipherOrder on | + | |
| - | # TLS 1.0 Kompremmierung deaktivieren (CRIME attacks) | + | |
| - | SSLCompression off | + | |
| - | </ | + | |
| - | | + | |
| - | + | ||
| - | | + | |
| # HTTP Strict Transport Security (HSTS), bei dem der Server dem Client im HTTP-Header mitteilt, | # HTTP Strict Transport Security (HSTS), bei dem der Server dem Client im HTTP-Header mitteilt, | ||
| # dass dieser nur noch verschlüsselt mit dem Server kommunizieren soll. | # dass dieser nur noch verschlüsselt mit dem Server kommunizieren soll. | ||
| - | Header always set Strict-Transport-Security " | + | Header always set Strict-Transport-Security " |
| # This header enables the Cross-site scripting (XSS) filter built into most recent web browsers. | # This header enables the Cross-site scripting (XSS) filter built into most recent web browsers. | ||
| Zeile 2225: | Zeile 2283: | ||
| # this particular website if it was disabled by the user. | # this particular website if it was disabled by the user. | ||
| # https:// | # https:// | ||
| - | Header set X-XSS-Protection "1; mode=block" | + | Header |
| # when serving user-supplied content, include a X-Content-Type-Options: | # when serving user-supplied content, include a X-Content-Type-Options: | ||
| Zeile 2233: | Zeile 2291: | ||
| # http:// | # http:// | ||
| # ' | # ' | ||
| - | Header set X-Content-Type-Options nosniff | + | |
| + | # CSS-Dateien nur als CSS interprätieren. | ||
| + | | ||
| # config to don't allow the browser to render the page inside an frame or iframe | # config to don't allow the browser to render the page inside an frame or iframe | ||
| Zeile 2239: | Zeile 2299: | ||
| # if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri | # if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri | ||
| # https:// | # https:// | ||
| - | header set X-Frame-Options | + | header |
| + | # hide server header (apache and php version) | ||
| + | Header always unset Server | ||
| + | |||
| + | # Only allow JavaScript from the same domain to be run. | ||
| + | # don't allow inline JavaScript to run. | ||
| + | Header always set X-Content-Security-Policy "allow ' | ||
| + | |||
| + | # Add Secure and HTTP only attributes to cookies | ||
| + | Header edit Set-Cookie ^(.*)$ $1; | ||
| + | |||
| + | # prevent Clickjacking Attack | ||
| + | Header always set X-Frame-Options " | ||
| + | |||
| + | # hkpk-stuff | ||
| + | Header always set Public-Key-Pins " | ||
| </ | </ | ||
| </ | </ | ||
| Zeile 2252: | Zeile 2327: | ||
| # systemctl restart httpd.service | # systemctl restart httpd.service | ||
| - | === / | ||
| - | Die installationsspezifische kundenindividuelle Konfiguration der **graylog-web GUI** wird über dessen Konfigurationsdatei // | ||
| - | Wie schon bei der Konfiguration des **[[centos: | ||
| - | # pwgen -N 1 -s 128 | ||
| - | |||
| - | KM2OhCgRuTJe9f7bOr0uOtGcX45TB5kmF4L4Ty44bRUlu1y2qh0eDbs613Bv4QFk0ftGzuASpSW5DDBqpSKIlcdI39WdVHBSo33AoPZgKiABd7G7FduhKIMZVjiE7lod | ||
| - | |||
| - | Diese beiden Werte hinterlegen wir nun in der Konfigurationsdatei unseres **graylog-web**-Daemon und passen anschließend die Konfigurationsoptionen unserer Umgebung an. Änderungen an den Default-Werten sind mit **Django : < | ||
| - | # vim / | ||
| - | |||
| - | <file bash / | ||
| - | # Django : 2015-12-28 | ||
| - | # default: graylog2-server.uris="" | ||
| - | graylog2-server.uris=" | ||
| - | |||
| - | # Learn how to configure custom logging in the documentation: | ||
| - | # http:// | ||
| - | |||
| - | # Secret key | ||
| - | # ~~~~~ | ||
| - | # The secret key is used to secure cryptographics functions. Set this to a long and randomly generated string. | ||
| - | # If you deploy your application to several instances be sure to use the same key! | ||
| - | # Generate for example with: pwgen -N 1 -s 96 | ||
| - | # Django : 2015-12-28 | ||
| - | # default: application.secret="" | ||
| - | application.secret=" | ||
| - | |||
| - | # Web interface timezone | ||
| - | # Graylog stores all timestamps in UTC. To properly display times, set the default timezone of the interface. | ||
| - | # If you leave this out, Graylog will pick your system default as the timezone. Usually you will want to configure it explicitly. | ||
| - | # timezone=" | ||
| - | # Django : 2015-12-28 | ||
| - | # default: unset | ||
| - | timezone=" | ||
| - | |||
| - | # Message field limit | ||
| - | # Your web interface can cause high load in your browser when you have a lot of different message fields. The default | ||
| - | # limit of message fields is 100. Set it to 0 if you always want to get all fields. They are for example used in the | ||
| - | # search result sidebar or for autocompletion of field names. | ||
| - | field_list_limit=100 | ||
| - | |||
| - | # Use this to run Graylog with a path prefix | ||
| - | # | ||
| - | |||
| - | # You usually do not want to change this. | ||
| - | application.global=lib.Global | ||
| - | |||
| - | # Global timeout for communication with Graylog server nodes; default: 5s | ||
| - | # | ||
| - | |||
| - | # Accept any server certificate without checking for validity; required if using self-signed certificates. | ||
| - | # Default: true | ||
| - | # graylog2.client.accept-any-certificate=true | ||
| - | </ | ||
| - | |||
| - | === Start des Daemon === | ||
| - | Nun ist es an der Zeit den die Web-GUI **graylog-web** zu starten. | ||
| - | # systemctl start graylog-web.service | ||
| - | |||
| - | Den Serverstatus können wir wie folgt abfragen. | ||
| - | # systemctl status graylog-web.service | ||
| - | |||
| - | < | ||
| - | <font style=" | ||
| - | | ||
| - | | ||
| - | Docs: http:// | ||
| - | Main PID: 8767 (graylog-web) | ||
| - | | ||
| - | | ||
| - | | ||
| - | |||
| - | Dec 28 15:21:52 vml000117.dmz.nausch.org systemd[1]: Started Graylog web interface. | ||
| - | Dec 28 15:21:52 vml000117.dmz.nausch.org systemd[1]: Starting Graylog web interface... | ||
| - | Dec 28 15:21:53 vml000117.dmz.nausch.org graylog-web[8767]: | ||
| - | </ | ||
| - | |||
| - | Der erfolgreiche Start des Servers wird auch in dessen Logdatei protokolliert. | ||
| - | # / | ||
| - | |||
| - | < | ||
| - | Application started (Prod) | ||
| - | |||
| - | 2015-12-28T15: | ||
| - | Listening for HTTP on / | ||
| - | |||
| - | === automatischer Start des Daemon === | ||
| - | Damit der Daemon beim Hochfahren unseres Servers automatisch gestartet wird, nutzen wir folgenden Befehl. | ||
| - | # systemctl enable graylog-web.service | ||
| - | |||
| - | Created symlink from / | ||
| - | |||
| - | Wollen wir wissen, ob die Autostartfunktion bereits gesetzt ist, verwenden wir diesen Aufruf. | ||
| - | # systemctl is-enabled graylog-web.service | ||
| - | |||
| - | enabled | ||
| ==== Paketfilter/ | ==== Paketfilter/ | ||
| - | === graylog-web === | + | === graylog |
| Unter **CentOS 7** wird als Standard-Firewall die dynamische **firewalld** verwendet. Ein großer Vorteil der dynamischen Paketfilterregeln ist unter anderem, dass zur Aktivierung der neuen Firewall-Regel(n) nicht der Daemon durchgestartet werden muss und somit alle aktiven Verbindungen kurz getrennt werden. Sondern unsere Änderungen können **// | Unter **CentOS 7** wird als Standard-Firewall die dynamische **firewalld** verwendet. Ein großer Vorteil der dynamischen Paketfilterregeln ist unter anderem, dass zur Aktivierung der neuen Firewall-Regel(n) nicht der Daemon durchgestartet werden muss und somit alle aktiven Verbindungen kurz getrennt werden. Sondern unsere Änderungen können **// | ||
| Zeile 2377: | Zeile 2356: | ||
| # ps aux | grep graylog-server | # ps aux | grep graylog-server | ||
| - | <code bash> | + | <code bash> |
| - | graylog | + | graylog |
| + | root 3965 0.0 0.0 112648 | ||
| Somit können wir keine bei der Definition von **[[https:// | Somit können wir keine bei der Definition von **[[https:// | ||
| Zeile 2412: | Zeile 2392: | ||
| Nachdem wir unseren graylog-Server erfolgreich vorbereitet haben, werden wir nun unsere Linux-Hosts so konfigurieren, | Nachdem wir unseren graylog-Server erfolgreich vorbereitet haben, werden wir nun unsere Linux-Hosts so konfigurieren, | ||
| - | Das Weiterleiten der Syslogmeldungen ist nicht sonderlich schwer zu konfigurieren. Das Wichtigste das es zu beachten gibt, ist, dass die Meldungen | + | Das Weiterleiten der Syslogmeldungen ist nicht sonderlich schwer zu konfigurieren. Das Wichtigste das es zu beachten gibt, ist, dass die Meldungen |
| ==== UDP ==== | ==== UDP ==== | ||
| Zeile 2435: | Zeile 2415: | ||
| #*.* @@remote-host: | #*.* @@remote-host: | ||
| # | # | ||
| - | # Django : 2015-06-12 | + | # Django : 2017-02-14 |
| $template GRAYLOGRFC5424,"< | $template GRAYLOGRFC5424,"< | ||
| - | *.* @10.0.0.117: | + | *.* @10.0.0.117: |
| # | # | ||
| # ### end of the forwarding rule ###</ | # ### end of the forwarding rule ###</ | ||
| Zeile 2465: | Zeile 2445: | ||
| #*.* @@remote-host: | #*.* @@remote-host: | ||
| # | # | ||
| - | # Django : 2015-06-12 | + | # Django : 2017-02-14 |
| $template GRAYLOGRFC5424,"< | $template GRAYLOGRFC5424,"< | ||
| - | *.* @@10.0.0.117: | + | *.* @@10.0.0.117: |
| # | # | ||
| # ### end of the forwarding rule ###</ | # ### end of the forwarding rule ###</ | ||
| Zeile 2636: | Zeile 2616: | ||
| -rw-r--r--. 1 root root 3 Jan 3 19:40 serial</ | -rw-r--r--. 1 root root 3 Jan 3 19:40 serial</ | ||
| + | < | ||
| + | ├── certs | ||
| + | ├── crl | ||
| + | ├── csrs | ||
| + | ├── index.txt | ||
| + | ├── newcerts | ||
| + | ├── private | ||
| + | └── serial</ | ||
| + | |||
| + | Die CA-Konfigurationsdatei passen wir noch unseren Wünschen entsprechend an. | ||
| + | # vim / | ||
| + | |||
| + | <file bash / | ||
| + | # OpenSSL example configuration file. | ||
| + | # This is mostly being used for generation of certificate requests. | ||
| + | # | ||
| + | |||
| + | # This definition stops the following lines choking if HOME isn't | ||
| + | # defined. | ||
| + | HOME = . | ||
| + | RANDFILE = $ENV:: | ||
| + | |||
| + | # Extra OBJECT IDENTIFIER info: | ||
| + | # | ||
| + | oid_section = new_oids | ||
| + | |||
| + | # To use this configuration file with the " | ||
| + | # " | ||
| + | # X.509v3 extensions to use: | ||
| + | # extensions = | ||
| + | # (Alternatively, | ||
| + | # X.509v3 extensions in its main [= default] section.) | ||
| + | |||
| + | [ new_oids ] | ||
| + | |||
| + | # We can add new OIDs in here for use by ' | ||
| + | # Add a simple OID like this: | ||
| + | # testoid1=1.2.3.4 | ||
| + | # Or use config file substitution like this: | ||
| + | # testoid2=${testoid1}.5.6 | ||
| + | |||
| + | # Policies used by the TSA examples. | ||
| + | tsa_policy1 = 1.2.3.4.1 | ||
| + | tsa_policy2 = 1.2.3.4.5.6 | ||
| + | tsa_policy3 = 1.2.3.4.5.7 | ||
| + | |||
| + | #################################################################### | ||
| + | [ ca ] | ||
| + | default_ca = CA_default # | ||
| + | |||
| + | #################################################################### | ||
| + | [ CA_default ] | ||
| + | |||
| + | dir = / | ||
| + | certs = $dir/ | ||
| + | crl_dir = $dir/crl # Where the issued crl are kept | ||
| + | database = $dir/ | ||
| + | # | ||
| + | # several ctificates with same subject. | ||
| + | new_certs_dir = $dir/ | ||
| + | |||
| + | # Django : 2017-02-14 | ||
| + | # default: certificate | ||
| + | certificate | ||
| + | serial = $dir/serial # The current serial number | ||
| + | crlnumber = $dir/ | ||
| + | # must be commented out to leave a V1 CRL | ||
| + | crl = $dir/ | ||
| + | # Django : 2017-02-14 | ||
| + | # default: private_key = $dir/ | ||
| + | private_key = $dir/ | ||
| + | RANDFILE = $dir/ | ||
| + | |||
| + | x509_extensions = usr_cert # The extentions to add to the cert | ||
| + | |||
| + | # Comment out the following two lines for the " | ||
| + | # (and highly broken) format. | ||
| + | name_opt = ca_default # | ||
| + | cert_opt = ca_default # | ||
| + | |||
| + | # Extension copying option: use with caution. | ||
| + | # copy_extensions = copy | ||
| + | |||
| + | # Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs | ||
| + | # so this is commented out by default to leave a V1 CRL. | ||
| + | # crlnumber must also be commented out to leave a V1 CRL. | ||
| + | # crl_extensions = crl_ext | ||
| + | |||
| + | default_days = 365 # how long to certify for | ||
| + | default_crl_days= 30 # how long before next CRL | ||
| + | default_md = sha256 # use SHA-256 by default | ||
| + | preserve = no # keep passed DN ordering | ||
| + | |||
| + | # A few difference way of specifying how similar the request should look | ||
| + | # For type CA, the listed attributes must be the same, and the optional | ||
| + | # and supplied fields are just that :-) | ||
| + | policy = policy_match | ||
| + | |||
| + | # For the CA policy | ||
| + | [ policy_match ] | ||
| + | countryName = match | ||
| + | stateOrProvinceName = match | ||
| + | organizationName = match | ||
| + | organizationalUnitName = optional | ||
| + | commonName = supplied | ||
| + | emailAddress = optional | ||
| + | |||
| + | # For the ' | ||
| + | # At this point in time, you must list all acceptable ' | ||
| + | # types. | ||
| + | [ policy_anything ] | ||
| + | countryName = optional | ||
| + | stateOrProvinceName = optional | ||
| + | localityName = optional | ||
| + | organizationName = optional | ||
| + | organizationalUnitName = optional | ||
| + | commonName = supplied | ||
| + | emailAddress = optional | ||
| + | |||
| + | #################################################################### | ||
| + | [ req ] | ||
| + | default_bits = 2048 | ||
| + | default_md = sha256 | ||
| + | default_keyfile = privkey.pem | ||
| + | distinguished_name = req_distinguished_name | ||
| + | attributes = req_attributes | ||
| + | x509_extensions = v3_ca # The extentions to add to the self signed cert | ||
| + | |||
| + | # Passwords for private keys if not present they will be prompted for | ||
| + | # input_password = secret | ||
| + | # output_password = secret | ||
| + | |||
| + | # This sets a mask for permitted string types. There are several options. | ||
| + | # default: PrintableString, | ||
| + | # pkix : PrintableString, | ||
| + | # utf8only: only UTF8Strings (PKIX recommendation after 2004). | ||
| + | # nombstr : PrintableString, | ||
| + | # MASK:XXXX a literal mask value. | ||
| + | # WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings. | ||
| + | string_mask = utf8only | ||
| + | |||
| + | # req_extensions = v3_req # The extensions to add to a certificate request | ||
| + | |||
| + | [ req_distinguished_name ] | ||
| + | countryName = Country Name (2 letter code) | ||
| + | countryName_default = XX | ||
| + | countryName_min = 2 | ||
| + | countryName_max = 2 | ||
| + | |||
| + | stateOrProvinceName = State or Province Name (full name) | ||
| + | # | ||
| + | |||
| + | localityName = Locality Name (eg, city) | ||
| + | localityName_default = Default City | ||
| + | |||
| + | 0.organizationName = Organization Name (eg, company) | ||
| + | 0.organizationName_default = Default Company Ltd | ||
| + | |||
| + | # we can do this but it is not needed normally :-) | ||
| + | # | ||
| + | # | ||
| + | |||
| + | organizationalUnitName = Organizational Unit Name (eg, section) | ||
| + | # | ||
| + | |||
| + | commonName = Common Name (eg, your name or your server\' | ||
| + | commonName_max = 64 | ||
| + | |||
| + | emailAddress = Email Address | ||
| + | emailAddress_max = 64 | ||
| + | |||
| + | # SET-ex3 = SET extension number 3 | ||
| + | |||
| + | [ req_attributes ] | ||
| + | challengePassword = A challenge password | ||
| + | challengePassword_min = 4 | ||
| + | challengePassword_max = 20 | ||
| + | |||
| + | unstructuredName = An optional company name | ||
| + | |||
| + | [ usr_cert ] | ||
| + | |||
| + | # These extensions are added when ' | ||
| + | |||
| + | # This goes against PKIX guidelines but some CAs do it and some software | ||
| + | # requires this to avoid interpreting an end user certificate as a CA. | ||
| + | |||
| + | basicConstraints=CA: | ||
| + | |||
| + | # Here are some examples of the usage of nsCertType. If it is omitted | ||
| + | # the certificate can be used for anything *except* object signing. | ||
| + | |||
| + | # This is OK for an SSL server. | ||
| + | # nsCertType = server | ||
| + | |||
| + | # For an object signing certificate this would be used. | ||
| + | # nsCertType = objsign | ||
| + | |||
| + | # For normal client use this is typical | ||
| + | # nsCertType = client, email | ||
| + | |||
| + | # and for everything including object signing: | ||
| + | # nsCertType = client, email, objsign | ||
| + | |||
| + | # This is typical in keyUsage for a client certificate. | ||
| + | # keyUsage = nonRepudiation, | ||
| + | |||
| + | # This will be displayed in Netscape' | ||
| + | nsComment = " | ||
| + | |||
| + | # PKIX recommendations harmless if included in all certificates. | ||
| + | subjectKeyIdentifier=hash | ||
| + | authorityKeyIdentifier=keyid, | ||
| + | |||
| + | # This stuff is for subjectAltName and issuerAltname. | ||
| + | # Import the email address. | ||
| + | # subjectAltName=email: | ||
| + | # An alternative to produce certificates that aren't | ||
| + | # deprecated according to PKIX. | ||
| + | # subjectAltName=email: | ||
| + | |||
| + | # Copy subject details | ||
| + | # issuerAltName=issuer: | ||
| + | |||
| + | # | ||
| + | #nsBaseUrl | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # This is required for TSA certificates. | ||
| + | # extendedKeyUsage = critical, | ||
| + | |||
| + | [ v3_req ] | ||
| + | |||
| + | # Extensions to add to a certificate request | ||
| + | |||
| + | basicConstraints = CA:FALSE | ||
| + | keyUsage = nonRepudiation, | ||
| + | |||
| + | [ v3_ca ] | ||
| + | |||
| + | |||
| + | # Extensions for a typical CA | ||
| + | |||
| + | |||
| + | # PKIX recommendation. | ||
| + | |||
| + | subjectKeyIdentifier=hash | ||
| + | |||
| + | authorityKeyIdentifier=keyid: | ||
| + | |||
| + | # This is what PKIX recommends but some broken software chokes on critical | ||
| + | # extensions. | ||
| + | # | ||
| + | # So we do this instead. | ||
| + | basicConstraints = CA:true | ||
| + | |||
| + | # Key usage: this is typical for a CA certificate. However since it will | ||
| + | # prevent it being used as an test self-signed certificate it is best | ||
| + | # left out by default. | ||
| + | # keyUsage = cRLSign, keyCertSign | ||
| + | |||
| + | # Some might want this also | ||
| + | # nsCertType = sslCA, emailCA | ||
| + | |||
| + | # Include email address in subject alt name: another PKIX recommendation | ||
| + | # subjectAltName=email: | ||
| + | # Copy issuer details | ||
| + | # issuerAltName=issuer: | ||
| + | |||
| + | # DER hex encoding of an extension: beware experts only! | ||
| + | # obj=DER: | ||
| + | # Where ' | ||
| + | # You can even override a supported extension: | ||
| + | # basicConstraints= critical, DER: | ||
| + | |||
| + | [ crl_ext ] | ||
| + | |||
| + | # CRL extensions. | ||
| + | # Only issuerAltName and authorityKeyIdentifier make any sense in a CRL. | ||
| + | |||
| + | # issuerAltName=issuer: | ||
| + | authorityKeyIdentifier=keyid: | ||
| + | |||
| + | [ proxy_cert_ext ] | ||
| + | # These extensions should be added when creating a proxy certificate | ||
| + | |||
| + | # This goes against PKIX guidelines but some CAs do it and some software | ||
| + | # requires this to avoid interpreting an end user certificate as a CA. | ||
| + | |||
| + | basicConstraints=CA: | ||
| + | |||
| + | # Here are some examples of the usage of nsCertType. If it is omitted | ||
| + | # the certificate can be used for anything *except* object signing. | ||
| + | |||
| + | # This is OK for an SSL server. | ||
| + | # nsCertType = server | ||
| + | |||
| + | # For an object signing certificate this would be used. | ||
| + | # nsCertType = objsign | ||
| + | |||
| + | # For normal client use this is typical | ||
| + | # nsCertType = client, email | ||
| + | |||
| + | # and for everything including object signing: | ||
| + | # nsCertType = client, email, objsign | ||
| + | |||
| + | # This is typical in keyUsage for a client certificate. | ||
| + | # keyUsage = nonRepudiation, | ||
| + | |||
| + | # This will be displayed in Netscape' | ||
| + | nsComment = " | ||
| + | |||
| + | # PKIX recommendations harmless if included in all certificates. | ||
| + | subjectKeyIdentifier=hash | ||
| + | authorityKeyIdentifier=keyid, | ||
| + | |||
| + | # This stuff is for subjectAltName and issuerAltname. | ||
| + | # Import the email address. | ||
| + | # subjectAltName=email: | ||
| + | # An alternative to produce certificates that aren't | ||
| + | # deprecated according to PKIX. | ||
| + | # subjectAltName=email: | ||
| + | |||
| + | # Copy subject details | ||
| + | # issuerAltName=issuer: | ||
| + | |||
| + | # | ||
| + | #nsBaseUrl | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # This really needs to be in place for it to be a proxy certificate. | ||
| + | proxyCertInfo=critical, | ||
| + | |||
| + | #################################################################### | ||
| + | [ tsa ] | ||
| + | |||
| + | default_tsa = tsa_config1 # | ||
| + | |||
| + | [ tsa_config1 ] | ||
| + | |||
| + | # These are used by the TSA reply generation only. | ||
| + | dir = ./demoCA # TSA root directory | ||
| + | serial = $dir/ | ||
| + | crypto_device = builtin # OpenSSL engine to use for signing | ||
| + | signer_cert = $dir/ | ||
| + | # (optional) | ||
| + | certs = $dir/ | ||
| + | # (optional) | ||
| + | signer_key = $dir/ | ||
| + | |||
| + | default_policy = tsa_policy1 # | ||
| + | # (optional) | ||
| + | other_policies = tsa_policy2, | ||
| + | digests = sha1, sha256, sha384, sha512 # Acceptable message digests (mandatory) | ||
| + | accuracy = secs:1, millisecs: | ||
| + | clock_precision_digits | ||
| + | ordering = yes # Is ordering defined for timestamps? | ||
| + | # (optional, default: no) | ||
| + | tsa_name = yes # Must the TSA name be included in the reply? | ||
| + | # (optional, default: no) | ||
| + | ess_cert_id_chain = no # Must the ESS cert id chain be included? | ||
| + | # (optional, default: no)</ | ||
| === privaten Schlüssel und selbstsigniertes Root CA Zertifikat erstellen === | === privaten Schlüssel und selbstsigniertes Root CA Zertifikat erstellen === | ||
| Als erstes werden wir uns nun den privaten Schlüssel unserer Root CA generieren, in zugehöriges Zertifikat erzeugen und dieses mit dem privaten Schlüssel der CA unterschreiben; | Als erstes werden wir uns nun den privaten Schlüssel unserer Root CA generieren, in zugehöriges Zertifikat erzeugen und dieses mit dem privaten Schlüssel der CA unterschreiben; | ||
| Zeile 2667: | Zeile 3015: | ||
| <font style=" | <font style=" | ||
| </ | </ | ||
| + | |||
| + | Sowohl Zertifikat und der Schlüssel des gerade erzeugten Root Zertifikates liegen nun in unserem CA-Systemverzeichnis. | ||
| + | < | ||
| + | ├── certs | ||
| + | │ └── root-ca.certifikate.pem | ||
| + | ├── crl | ||
| + | ├── csrs | ||
| + | ├── index.txt | ||
| + | ├── newcerts | ||
| + | ├── private | ||
| + | │ └── root-ca.key.pem | ||
| + | └── serial</ | ||
| === privaten Schlüssel der Root CA schützen === | === privaten Schlüssel der Root CA schützen === | ||
| Zeile 2892: | Zeile 3252: | ||
| < | < | ||
| <font style=" | <font style=" | ||
| - | -inform pem -out / | + | -inform pem -out / |
| + | | ||
| </ | </ | ||
| Zeile 3094: | Zeile 3455: | ||
| </ | </ | ||
| - | === erstellte Zertifikat dem gralog-server zur Verfügung stellen === | + | === erstellte Zertifikat dem graylog-server zur Verfügung stellen === |
| Als letzten Schritt stellen wir nun das gerade erzeugte Server-Zertifikat dem graylog-server zur Verfügung. Hierzu kopieren wir einfach das gerade generierte Zertifikat an Ort und Stelle. | Als letzten Schritt stellen wir nun das gerade erzeugte Server-Zertifikat dem graylog-server zur Verfügung. Hierzu kopieren wir einfach das gerade generierte Zertifikat an Ort und Stelle. | ||
| # cp / | # cp / | ||
| Zeile 3589: | Zeile 3950: | ||
| kY+Z9s9+By5IVw== | kY+Z9s9+By5IVw== | ||
| -----END CERTIFICATE-----</ | -----END CERTIFICATE-----</ | ||
| + | |||
| === erstellte Zertifikat dem rsyslog-Daemon auf dem Clientrechner zur Verfügung stellen === | === erstellte Zertifikat dem rsyslog-Daemon auf dem Clientrechner zur Verfügung stellen === | ||
| - | Als letzten Schritt stellen wir nun das gerade erzeugte Server-Zertifikat dem graylog-server | + | Als letzten Schritt stellen wir nun das gerade erzeugte Server-Zertifikat dem rsyslog-Daemon auf dem Client-Rechner |
| # vim / | # vim / | ||
| Zeile 3631: | Zeile 3993: | ||
| kY+Z9s9+By5IVw== | kY+Z9s9+By5IVw== | ||
| -----END CERTIFICATE-----</ | -----END CERTIFICATE-----</ | ||
| + | |||
| + | === Ein Zertifikat revoken === | ||
| + | Will man ein ausgestelltes Zertifikat zurückziehen (revoken) nutzen wir ebenfalls das Programm **openssl**. | ||
| + | # openssl ca -revoke / | ||
| + | |||
| + | Using configuration from / | ||
| + | Enter pass phrase for / | ||
| + | Revoking Certificate 02. | ||
| + | Data Base Updated | ||
| + | |||
| ===== Konfiguration graylog-server ===== | ===== Konfiguration graylog-server ===== | ||
| Zeile 3777: | Zeile 4149: | ||
| # The imjournal module bellow is now used as a message source instead of imuxsock. | # The imjournal module bellow is now used as a message source instead of imuxsock. | ||
| $ModLoad imuxsock # provides support for local system logging (e.g. via logger command) | $ModLoad imuxsock # provides support for local system logging (e.g. via logger command) | ||
| - | $ModLoad imjournal # provides access to the systemd journal | + | # Django : 2017-09-26 |
| + | # default: | ||
| #$ModLoad imklog # reads kernel messages (the same are read from journald) | #$ModLoad imklog # reads kernel messages (the same are read from journald) | ||
| #$ModLoad immark | #$ModLoad immark | ||
| Zeile 3807: | Zeile 4180: | ||
| # Turn off message reception via local log socket; | # Turn off message reception via local log socket; | ||
| # local messages are retrieved through imjournal now. | # local messages are retrieved through imjournal now. | ||
| - | $OmitLocalLogging on | + | # Django : 2017-09-26 |
| + | # default: | ||
| # File to store the position in the journal | # File to store the position in the journal | ||
| - | $IMJournalStateFile imjournal.state | + | # Django : 2017-09-26 |
| + | # default: | ||
| # Django : 2016-01-03 - certificate files for TLS | # Django : 2016-01-03 - certificate files for TLS | ||
| Zeile 3877: | Zeile 4252: | ||
| # Django : 2016-01-03 | # Django : 2016-01-03 | ||
| $template GRAYLOGRFC5424,"< | $template GRAYLOGRFC5424,"< | ||
| - | *.* @@10.0.0.117: | + | *.* @@10.0.0.117: |
| # | # | ||
| # ### end of the forwarding rule ###</ | # ### end of the forwarding rule ###</ | ||
| Zeile 3897: | Zeile 4272: | ||
| Alles in allem können wir feststellen, | Alles in allem können wir feststellen, | ||
| + | |||
| + | ==== Zertifikatsgenerierung und Clientkonfiguration ==== | ||
| + | ==== Zertifikatserstellung optimieren ==== | ||
| + | Um nun bei der Generierung der Zertifikats-Requests und der Erstellung der zugehörigen Zertifikate nicht jedesmal die benötigten Angaben erneut eintippen zu müssen werden wir nun die wiederkehrenden Informationen in der Konfigurationsdatei // | ||
| + | # vim / | ||
| + | |||
| + | <file bash / | ||
| + | # OpenSSL example configuration file. | ||
| + | # This is mostly being used for generation of certificate requests. | ||
| + | # | ||
| + | |||
| + | # This definition stops the following lines choking if HOME isn't | ||
| + | # defined. | ||
| + | HOME = . | ||
| + | RANDFILE = $ENV:: | ||
| + | |||
| + | # Extra OBJECT IDENTIFIER info: | ||
| + | # | ||
| + | oid_section = new_oids | ||
| + | |||
| + | # To use this configuration file with the " | ||
| + | # " | ||
| + | # X.509v3 extensions to use: | ||
| + | # extensions = | ||
| + | # (Alternatively, | ||
| + | # X.509v3 extensions in its main [= default] section.) | ||
| + | |||
| + | [ new_oids ] | ||
| + | |||
| + | # We can add new OIDs in here for use by ' | ||
| + | # Add a simple OID like this: | ||
| + | # testoid1=1.2.3.4 | ||
| + | # Or use config file substitution like this: | ||
| + | # testoid2=${testoid1}.5.6 | ||
| + | |||
| + | # Policies used by the TSA examples. | ||
| + | tsa_policy1 = 1.2.3.4.1 | ||
| + | tsa_policy2 = 1.2.3.4.5.6 | ||
| + | tsa_policy3 = 1.2.3.4.5.7 | ||
| + | |||
| + | #################################################################### | ||
| + | [ ca ] | ||
| + | default_ca = CA_default # | ||
| + | |||
| + | #################################################################### | ||
| + | [ CA_default ] | ||
| + | |||
| + | dir = / | ||
| + | certs = $dir/ | ||
| + | crl_dir = $dir/crl # Where the issued crl are kept | ||
| + | database = $dir/ | ||
| + | # | ||
| + | # several ctificates with same subject. | ||
| + | new_certs_dir = $dir/ | ||
| + | |||
| + | # Django : 2017-02-14 | ||
| + | # default: certificate = $dir/ | ||
| + | certificate = $dir/ | ||
| + | serial = $dir/serial # The current serial number | ||
| + | crlnumber = $dir/ | ||
| + | # must be commented out to leave a V1 CRL | ||
| + | crl = $dir/ | ||
| + | # Django : 2017-02-14 | ||
| + | # default: private_key = $dir/ | ||
| + | private_key = $dir/ | ||
| + | RANDFILE = $dir/ | ||
| + | |||
| + | x509_extensions = usr_cert # The extentions to add to the cert | ||
| + | |||
| + | # Comment out the following two lines for the " | ||
| + | # (and highly broken) format. | ||
| + | name_opt = ca_default # | ||
| + | cert_opt = ca_default # | ||
| + | |||
| + | # Extension copying option: use with caution. | ||
| + | # copy_extensions = copy | ||
| + | |||
| + | # Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs | ||
| + | # so this is commented out by default to leave a V1 CRL. | ||
| + | # crlnumber must also be commented out to leave a V1 CRL. | ||
| + | # crl_extensions = crl_ext | ||
| + | |||
| + | # Django : 2017-02-14 | ||
| + | # default: default_days = 365 # how long to certify for | ||
| + | default_days = 10950 | ||
| + | default_crl_days= 30 # how long before next CRL | ||
| + | default_md = sha256 # use SHA-256 by default | ||
| + | preserve = no # keep passed DN ordering | ||
| + | |||
| + | # A few difference way of specifying how similar the request should look | ||
| + | # For type CA, the listed attributes must be the same, and the optional | ||
| + | # and supplied fields are just that :-) | ||
| + | policy = policy_match | ||
| + | |||
| + | # For the CA policy | ||
| + | [ policy_match ] | ||
| + | countryName = match | ||
| + | stateOrProvinceName = match | ||
| + | organizationName = match | ||
| + | organizationalUnitName = optional | ||
| + | commonName = supplied | ||
| + | emailAddress = optional | ||
| + | |||
| + | # For the ' | ||
| + | # At this point in time, you must list all acceptable ' | ||
| + | # types. | ||
| + | [ policy_anything ] | ||
| + | countryName = optional | ||
| + | stateOrProvinceName = optional | ||
| + | localityName = optional | ||
| + | organizationName = optional | ||
| + | organizationalUnitName = optional | ||
| + | commonName = supplied | ||
| + | emailAddress = optional | ||
| + | |||
| + | #################################################################### | ||
| + | [ req ] | ||
| + | # Django : 2017-02-14 | ||
| + | # default: default_bits = 2048 | ||
| + | default_bits = 4096 | ||
| + | default_md = sha256 | ||
| + | default_keyfile = privkey.pem | ||
| + | distinguished_name = req_distinguished_name | ||
| + | attributes = req_attributes | ||
| + | x509_extensions = v3_ca # The extentions to add to the self signed cert | ||
| + | |||
| + | # Passwords for private keys if not present they will be prompted for | ||
| + | # input_password = secret | ||
| + | # output_password = secret | ||
| + | |||
| + | # This sets a mask for permitted string types. There are several options. | ||
| + | # default: PrintableString, | ||
| + | # pkix : PrintableString, | ||
| + | # utf8only: only UTF8Strings (PKIX recommendation after 2004). | ||
| + | # nombstr : PrintableString, | ||
| + | # MASK:XXXX a literal mask value. | ||
| + | # WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings. | ||
| + | string_mask = utf8only | ||
| + | |||
| + | # req_extensions = v3_req # The extensions to add to a certificate request | ||
| + | |||
| + | [ req_distinguished_name ] | ||
| + | countryName = Country Name (2 letter code) | ||
| + | # Django : 2017-02-14 | ||
| + | # default: countryName_default = XX | ||
| + | countryName_default = DE | ||
| + | countryName_min = 2 | ||
| + | countryName_max = 2 | ||
| + | |||
| + | stateOrProvinceName = State or Province Name (full name) | ||
| + | # Django : 2017-02-14 | ||
| + | # default: # | ||
| + | stateOrProvinceName_default = Bayern | ||
| + | |||
| + | localityName = Locality Name (eg, city) | ||
| + | # Django : 2017-02-14 | ||
| + | # default: localityName_default = Default City | ||
| + | localityName_default = Pliening | ||
| + | |||
| + | 0.organizationName = Organization Name (eg, company) | ||
| + | # Django : 2017-02-14 | ||
| + | # default: 0.organizationName_default = Default Company Ltd | ||
| + | 0.organizationName_default = nausch.org | ||
| + | |||
| + | # we can do this but it is not needed normally :-) | ||
| + | # | ||
| + | # | ||
| + | |||
| + | organizationalUnitName = Organizational Unit Name (eg, section) | ||
| + | # Django : 2017-02-14 | ||
| + | # default: # | ||
| + | organizationalUnitName_default = IT-Monitoring | ||
| + | |||
| + | commonName = Common Name (eg, your name or your server\' | ||
| + | commonName_max = 64 | ||
| + | |||
| + | emailAddress = Email Address | ||
| + | emailAddress_max = 64 | ||
| + | # Django : 2017-02-14 | ||
| + | # default: unset | ||
| + | emailAddress_default = graylog-admin@nausch.org | ||
| + | |||
| + | # SET-ex3 = SET extension number 3 | ||
| + | |||
| + | [ req_attributes ] | ||
| + | challengePassword = A challenge password | ||
| + | challengePassword_min = 4 | ||
| + | challengePassword_max = 20 | ||
| + | |||
| + | unstructuredName = An optional company name | ||
| + | |||
| + | [ usr_cert ] | ||
| + | |||
| + | # These extensions are added when ' | ||
| + | |||
| + | # This goes against PKIX guidelines but some CAs do it and some software | ||
| + | # requires this to avoid interpreting an end user certificate as a CA. | ||
| + | |||
| + | basicConstraints=CA: | ||
| + | |||
| + | # Here are some examples of the usage of nsCertType. If it is omitted | ||
| + | # the certificate can be used for anything *except* object signing. | ||
| + | |||
| + | # This is OK for an SSL server. | ||
| + | # nsCertType = server | ||
| + | |||
| + | # For an object signing certificate this would be used. | ||
| + | # nsCertType = objsign | ||
| + | |||
| + | # For normal client use this is typical | ||
| + | # nsCertType = client, email | ||
| + | |||
| + | # and for everything including object signing: | ||
| + | # nsCertType = client, email, objsign | ||
| + | |||
| + | # This is typical in keyUsage for a client certificate. | ||
| + | # keyUsage = nonRepudiation, | ||
| + | |||
| + | # This will be displayed in Netscape' | ||
| + | nsComment = " | ||
| + | |||
| + | # PKIX recommendations harmless if included in all certificates. | ||
| + | subjectKeyIdentifier=hash | ||
| + | authorityKeyIdentifier=keyid, | ||
| + | |||
| + | # This stuff is for subjectAltName and issuerAltname. | ||
| + | # Import the email address. | ||
| + | # subjectAltName=email: | ||
| + | # An alternative to produce certificates that aren't | ||
| + | # deprecated according to PKIX. | ||
| + | # subjectAltName=email: | ||
| + | |||
| + | # Copy subject details | ||
| + | # issuerAltName=issuer: | ||
| + | |||
| + | # | ||
| + | #nsBaseUrl | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # This is required for TSA certificates. | ||
| + | # extendedKeyUsage = critical, | ||
| + | |||
| + | [ v3_req ] | ||
| + | |||
| + | # Extensions to add to a certificate request | ||
| + | |||
| + | basicConstraints = CA:FALSE | ||
| + | keyUsage = nonRepudiation, | ||
| + | |||
| + | [ v3_ca ] | ||
| + | |||
| + | |||
| + | # Extensions for a typical CA | ||
| + | |||
| + | |||
| + | # PKIX recommendation. | ||
| + | |||
| + | subjectKeyIdentifier=hash | ||
| + | |||
| + | authorityKeyIdentifier=keyid: | ||
| + | |||
| + | # This is what PKIX recommends but some broken software chokes on critical | ||
| + | # extensions. | ||
| + | # | ||
| + | # So we do this instead. | ||
| + | basicConstraints = CA:true | ||
| + | |||
| + | # Key usage: this is typical for a CA certificate. However since it will | ||
| + | # prevent it being used as an test self-signed certificate it is best | ||
| + | # left out by default. | ||
| + | # keyUsage = cRLSign, keyCertSign | ||
| + | |||
| + | # Some might want this also | ||
| + | # nsCertType = sslCA, emailCA | ||
| + | |||
| + | # Include email address in subject alt name: another PKIX recommendation | ||
| + | # subjectAltName=email: | ||
| + | # Copy issuer details | ||
| + | # issuerAltName=issuer: | ||
| + | |||
| + | # DER hex encoding of an extension: beware experts only! | ||
| + | # obj=DER: | ||
| + | # Where ' | ||
| + | # You can even override a supported extension: | ||
| + | # basicConstraints= critical, DER: | ||
| + | |||
| + | [ crl_ext ] | ||
| + | |||
| + | # CRL extensions. | ||
| + | # Only issuerAltName and authorityKeyIdentifier make any sense in a CRL. | ||
| + | |||
| + | # issuerAltName=issuer: | ||
| + | authorityKeyIdentifier=keyid: | ||
| + | |||
| + | [ proxy_cert_ext ] | ||
| + | # These extensions should be added when creating a proxy certificate | ||
| + | |||
| + | # This goes against PKIX guidelines but some CAs do it and some software | ||
| + | # requires this to avoid interpreting an end user certificate as a CA. | ||
| + | |||
| + | basicConstraints=CA: | ||
| + | |||
| + | # Here are some examples of the usage of nsCertType. If it is omitted | ||
| + | # the certificate can be used for anything *except* object signing. | ||
| + | |||
| + | # This is OK for an SSL server. | ||
| + | # nsCertType = server | ||
| + | |||
| + | # For an object signing certificate this would be used. | ||
| + | # nsCertType = objsign | ||
| + | |||
| + | # For normal client use this is typical | ||
| + | # nsCertType = client, email | ||
| + | |||
| + | # and for everything including object signing: | ||
| + | # nsCertType = client, email, objsign | ||
| + | |||
| + | # This is typical in keyUsage for a client certificate. | ||
| + | # keyUsage = nonRepudiation, | ||
| + | |||
| + | # This will be displayed in Netscape' | ||
| + | nsComment = " | ||
| + | |||
| + | # PKIX recommendations harmless if included in all certificates. | ||
| + | subjectKeyIdentifier=hash | ||
| + | authorityKeyIdentifier=keyid, | ||
| + | |||
| + | # This stuff is for subjectAltName and issuerAltname. | ||
| + | # Import the email address. | ||
| + | # subjectAltName=email: | ||
| + | # An alternative to produce certificates that aren't | ||
| + | # deprecated according to PKIX. | ||
| + | # subjectAltName=email: | ||
| + | |||
| + | # Copy subject details | ||
| + | # issuerAltName=issuer: | ||
| + | |||
| + | # | ||
| + | #nsBaseUrl | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # This really needs to be in place for it to be a proxy certificate. | ||
| + | proxyCertInfo=critical, | ||
| + | |||
| + | #################################################################### | ||
| + | [ tsa ] | ||
| + | |||
| + | default_tsa = tsa_config1 # | ||
| + | |||
| + | [ tsa_config1 ] | ||
| + | |||
| + | # These are used by the TSA reply generation only. | ||
| + | dir = ./demoCA # TSA root directory | ||
| + | serial = $dir/ | ||
| + | crypto_device = builtin # OpenSSL engine to use for signing | ||
| + | signer_cert = $dir/ | ||
| + | # (optional) | ||
| + | certs = $dir/ | ||
| + | # (optional) | ||
| + | signer_key = $dir/ | ||
| + | |||
| + | default_policy = tsa_policy1 # | ||
| + | # (optional) | ||
| + | other_policies = tsa_policy2, | ||
| + | digests = sha1, sha256, sha384, sha512 # Acceptable message digests (mandatory) | ||
| + | accuracy = secs:1, millisecs: | ||
| + | clock_precision_digits | ||
| + | ordering = yes # Is ordering defined for timestamps? | ||
| + | # (optional, default: no) | ||
| + | tsa_name = yes # Must the TSA name be included in the reply? | ||
| + | # (optional, default: no) | ||
| + | ess_cert_id_chain = no # Must the ESS cert id chain be included? | ||
| + | # (optional, default: no)</ | ||
| + | |||
| + | ==== Bearbeitungsschritte bei neunen rsyslog Clients ==== | ||
| + | Bei einem neune Client, den wir an unseren graylog Server anbinden wollen, sind nun zusammengefasst folgende Schritte nötig (im nachfolgenden Beispiel für Host vml000137): | ||
| + | |||
| + | * auf dem **graylog** Server: | ||
| + | - Schlüssel für den rsyslog-Client erzeugen < | ||
| + | - Passphrase des gerade erzeiugten Client-Schlüssels entfernen < | ||
| + | - Schlüssel mit passphrase vernichten < | ||
| + | - Schlüssel auf den Clientrechner transferieren < | ||
| + | - Zertificatsrequest erzeugen < | ||
| + | -out / | ||
| + | - Zertifikatsrequest der eigenen CA vorlegen. < | ||
| + | / | ||
| + | - Zertifikatsrequest durch die CA bearbeiten und Zertifikat erzeugen. < | ||
| + | -out / | ||
| + | - Zertifikat ausgeben und auf den Client-/ | ||
| + | - Clientzertifikat dem graylog Server bekannt machden. < | ||
| + | / | ||
| + | - Root CA Zertifikat dem Client zur Verfügung stellen. < | ||
| + | - **rsyslog-gnutls** auf dem Client installieren. < | ||
| + | - originale rsyslog-Konfigurationsdatei sichern. < | ||
| + | - rsyslog konfigurieren. < | ||
| + | |||
| + | # For more information see / | ||
| + | # If you experience problems, see http:// | ||
| + | |||
| + | #### MODULES #### | ||
| + | |||
| + | # Django : 2017-2-14 | ||
| + | # default: unset | ||
| + | $DefaultNetstreamDriver gtls #make gtls driver the default | ||
| + | |||
| + | # The imjournal module bellow is now used as a message source instead of imuxsock. | ||
| + | $ModLoad imuxsock # provides support for local system logging (e.g. via logger command) | ||
| + | # Django : 2017-09-26 | ||
| + | # default: $ModLoad imjournal # provides access to the systemd journal | ||
| + | #$ModLoad imklog # reads kernel messages (the same are read from journald) | ||
| + | #$ModLoad immark | ||
| + | |||
| + | # Provides UDP syslog reception | ||
| + | #$ModLoad imudp | ||
| + | # | ||
| + | |||
| + | # Provides TCP syslog reception | ||
| + | #$ModLoad imtcp | ||
| + | # | ||
| + | |||
| + | |||
| + | #### GLOBAL DIRECTIVES #### | ||
| + | |||
| + | # Where to place auxiliary files | ||
| + | $WorkDirectory / | ||
| + | |||
| + | # Use default timestamp format | ||
| + | $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat | ||
| + | |||
| + | # File syncing capability is disabled by default. This feature is usually not required, | ||
| + | # not useful and an extreme performance hit | ||
| + | # | ||
| + | |||
| + | # Include all config files in / | ||
| + | $IncludeConfig / | ||
| + | |||
| + | # Turn off message reception via local log socket; | ||
| + | # local messages are retrieved through imjournal now. | ||
| + | # Django : 2017-09-26 | ||
| + | # default: $OmitLocalLogging on | ||
| + | |||
| + | # File to store the position in the journal | ||
| + | # Django : 2017-09-26 | ||
| + | # default: $IMJournalStateFile imjournal.state | ||
| + | |||
| + | # Django : 2017-02-14 - certificate files for TLS | ||
| + | # default: unset | ||
| + | $DefaultNetstreamDriverCAFile | ||
| + | $DefaultNetstreamDriverCertFile / | ||
| + | $DefaultNetstreamDriverKeyFile | ||
| + | |||
| + | $ActionSendStreamDriverAuthMode x509/name | ||
| + | $ActionSendStreamDriverPermittedPeer graylog-server.dmz.nausch.org | ||
| + | # run driver in TLS-only mode | ||
| + | $ActionSendStreamDriverMode 1 | ||
| + | |||
| + | #### RULES #### | ||
| + | |||
| + | # Log all kernel messages to the console. | ||
| + | # Logging much else clutters up the screen. | ||
| + | # | ||
| + | |||
| + | # Log anything (except mail) of level info or higher. | ||
| + | # Don't log private authentication messages! | ||
| + | *.info; | ||
| + | |||
| + | # The authpriv file has restricted access. | ||
| + | authpriv.* | ||
| + | |||
| + | # Log all the mail messages in one place. | ||
| + | mail.* | ||
| + | |||
| + | |||
| + | # Log cron stuff | ||
| + | cron.* | ||
| + | |||
| + | # Everybody gets emergency messages | ||
| + | *.emerg | ||
| + | |||
| + | # Save news errors of level crit and higher in a special file. | ||
| + | uucp, | ||
| + | |||
| + | # Save boot messages also to boot.log | ||
| + | local7.* | ||
| + | |||
| + | |||
| + | # ### begin forwarding rule ### | ||
| + | # The statement between the begin ... end define a SINGLE forwarding | ||
| + | # rule. They belong together, do NOT split them. If you create multiple | ||
| + | # forwarding rules, duplicate the whole block! | ||
| + | # Remote Logging (we use TCP for reliable delivery) | ||
| + | # | ||
| + | # An on-disk queue is created for this action. If the remote host is | ||
| + | # down, messages are spooled to disk and sent when it is up again. | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # remote host is: name/ | ||
| + | #*.* @@remote-host: | ||
| + | # | ||
| + | # Django : 2017-02-14 | ||
| + | $template GRAYLOGRFC5424,"< | ||
| + | *.* @10.0.0.117: | ||
| + | # | ||
| + | # ### end of the forwarding rule ###</ | ||
| + | - rsyslog-Daemon neu starten zum Aktivieren der Konfigurationsänderung.< | ||
| + | |||
| + | <WRAP center round important 90%> | ||
| + | **FAZIT**: | ||
| + | |||
| + | Mit Hilfe dieser 14 Bearbeitungsschritte kann nicht nur der Übertragungsweg zwischen rsyslog-client und graylog-server abgesichert und sondern auch der Zugriff des Clients auf den zentralen syslog-server geregelt werden. | ||
| + | |||
| + | Mit einfachen Boardmitteln unseres CentOS 7 Servers kann somit ein wesentlicher Beitrag zur Vertraulichkeit und Integrität von syslog-informationen geleistet werden und ein ungesicherte und ungeschützte Übertragung von sensitiven syslog-Informationen sollten der Vergangenheit angehören. Auch wenn der ungeübten Admin diesen Umstand bis jetzt erfolgreich verdrängte! | ||
| + | </ | ||
| ====== Links ====== | ====== Links ====== | ||
| Zeile 3903: | Zeile 4800: | ||
| * **[[http:// | * **[[http:// | ||
| - | ~~DISCUSSION~~ | + | |
django