Unterschiede
Hier werden die Unterschiede zwischen zwei Versionen angezeigt.
| Vorhergehende Überarbeitung | |||
| — | centos:web_c7:graylog [22.07.2019 14:59. ] (aktuell) – Externe Bearbeitung 127.0.0.1 | ||
|---|---|---|---|
| Zeile 1: | Zeile 1: | ||
| + | ====== Logdatenanalyse mit graylog unter CentOS 7.x ====== | ||
| + | {{: | ||
| + | |||
| + | ===== Vorbereitungen ===== | ||
| + | Für den produktiven Einsatz von **graylog** müssen wir noch ein paar Vorbereitungen treffen; nähere Hinweise dazu findet man in der [[http:// | ||
| + | |||
| + | Bevor wir nun mit der Installation von **graylog** beginnen, müssen wir noch nachfolgende Voraussetzungen schaffen. | ||
| + | |||
| + | ==== JAVA/ | ||
| + | Hier installieren wir die benötige Java Umgebung (min. 1.7) aus dem **//CentOS Base Repository// | ||
| + | |||
| + | ==== MongoDB ==== | ||
| + | **graylog** nutzt als Datenbank-Server die NoSQL-Datenbank **[[https:// | ||
| + | |||
| + | ==== Elastcsearch ==== | ||
| + | **graylog** nutzt als Suchmaschine/ | ||
| + | |||
| + | <WRAP center round alert 80%> | ||
| + | **ACHTUNG**: | ||
| + | Graylog 1.x doesn' | ||
| + | </ | ||
| + | |||
| + | |||
| + | Zur Installation des Repositories selbst wir uns kein RPM angeboten. Daher werden wir kurzer Hand die benötigte Konfigurationsdatei für das Repository **elasticsearch ** selbst anlegen. | ||
| + | # vim / | ||
| + | <file bash / | ||
| + | [elasticsearch-2.x] | ||
| + | name=Elasticsearch repository for 2.x packages | ||
| + | baseurl=http:// | ||
| + | gpgcheck=1 | ||
| + | gpgkey=file:/// | ||
| + | priority = 20 | ||
| + | enabled=0 | ||
| + | |||
| + | # Django : 2015-12-28 - Repository elasticsearch für graylog-Installation | ||
| + | [elasticsearch-1.7] | ||
| + | name=Elasticsearch repository for 1.7.x packages | ||
| + | baseurl=http:// | ||
| + | gpgcheck=1 | ||
| + | gpgkey=http:// | ||
| + | enabled=1 | ||
| + | |||
| + | |||
| + | </ | ||
| + | |||
| + | Damit später nur verifizierte, | ||
| + | # wget https:// | ||
| + | |||
| + | Bevor wir diesen aber importieren, | ||
| + | # gpg --with-fingerprint / | ||
| + | |||
| + | pub 2048R/ | ||
| + | Key fingerprint = 4609 5ACC 8548 582C 1A26 99A9 D27D 666C D88E 42B4 | ||
| + | sub 2048R/ | ||
| + | |||
| + | Diesen **Key fingerprint = 4609 5ACC 8548 582C 1A26 99A9 D27D 666C D88E 42B4** vergleichen wir nun mit den Angaben auf der [[https:// | ||
| + | # rpm --import / | ||
| + | |||
| + | ==== graylog ==== | ||
| + | Graylog selbst werden wir später aus dem Repository von **graylog** installieren. So bleibt zum einen der Konfigurationsaufwand überschaubar und wir werden mit Updates versorgt, wenn Änderungen und/oder Erweiterungen am Programmcode von graylog notwendig werden. | ||
| + | Die Integration des benötigten Repositories erfolgt direkt mit nachfolgendem Befehl: | ||
| + | # yum localinstall https:// | ||
| + | |||
| + | Leider bietet uns graylog selbst keine Möglichkeit, | ||
| + | # gpg --with-fingerprint / | ||
| + | |||
| + | pub 2048R/ | ||
| + | Key fingerprint = 28AB 6EB5 7277 9C2A D196 BE22 D44C 1D8D B160 6F22 | ||
| + | |||
| + | Sind beide Werte gleich, können wir auch diesen PGP-Key wie gewohnt importieren. | ||
| + | # rpm --import / | ||
| + | |||
| + | ===== Installation ===== | ||
| + | Da nun alle Voraussetzungen geschaffen sind, können wir uns an die Installation der einzelnen RPM-Pakete machen. | ||
| + | |||
| + | ==== OpenJDK ==== | ||
| + | Als erstes installieren wir nun die **OpenJDK Runtime Environment** mit Hilfe von **YUM**. | ||
| + | # yum install java-1.8.0-openjdk -y | ||
| + | |||
| + | Haben wir bereits eine installierte Java Umgebung installiert können wir mit folgendem Befehl abfragen ob die benötigte Version den Installationsvoraussetzungen (installiertes JAVA oder OpenJDK ab Version 1.7.0) von graylog genügt. | ||
| + | # java -version | ||
| + | |||
| + | openjdk version " | ||
| + | OpenJDK Runtime Environment (build 1.8.0_65-b17) | ||
| + | OpenJDK 64-Bit Server VM (build 25.65-b01, mixed mode) | ||
| + | |||
| + | Wollen wir wissen, welche Dateien und Verzeichnisse das Paket auf unseren Server packte, benutzen wir folgenden Befehl. | ||
| + | # rpm -qil java-1.8.0-openjdk | ||
| + | |||
| + | < | ||
| + | Epoch : 1 | ||
| + | Version | ||
| + | Release | ||
| + | Architecture: | ||
| + | Install Date: Mon 21 Dec 2015 12:46:44 PM CET | ||
| + | Group : Development/ | ||
| + | Size : 512633 | ||
| + | License | ||
| + | Signature | ||
| + | Source RPM : java-1.8.0-openjdk-1.8.0.65-3.b17.el7.src.rpm | ||
| + | Build Date : Sat 21 Nov 2015 04:29:16 AM CET | ||
| + | Build Host : worker1.bsys.centos.org | ||
| + | Relocations : (not relocatable) | ||
| + | Packager | ||
| + | Vendor | ||
| + | URL : http:// | ||
| + | Summary | ||
| + | Description : | ||
| + | The OpenJDK runtime environment. | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | |||
| + | ==== MongoDB ==== | ||
| + | Als nächstes erfolgt die Installation unserer **MongoDB**. Dank dem eingebundenen zugehörigen Repository erfolgt dies mit Hilfe von **YUM**. | ||
| + | # yum install mongodb mongodb-server -y | ||
| + | |||
| + | Auch hier können wir uns einen Überblick verschaffen, | ||
| + | |||
| + | # rpm -qil mongodb | ||
| + | < | ||
| + | Version | ||
| + | Release | ||
| + | Architecture: | ||
| + | Install Date: Wed 23 Dec 2015 10:19:36 AM CET | ||
| + | Group : Applications/ | ||
| + | Size : 137519320 | ||
| + | License | ||
| + | Signature | ||
| + | Source RPM : mongodb-2.6.11-1.el7.src.rpm | ||
| + | Build Date : Wed 19 Aug 2015 01:57:11 PM CEST | ||
| + | Build Host : buildvm-08.phx2.fedoraproject.org | ||
| + | Relocations : (not relocatable) | ||
| + | Packager | ||
| + | Vendor | ||
| + | URL : http:// | ||
| + | Summary | ||
| + | Description : | ||
| + | Mongo (from " | ||
| + | document-oriented database. MongoDB is written in C++ and offers the following | ||
| + | features: | ||
| + | * Collection oriented storage: easy storage of object/ | ||
| + | * Dynamic queries | ||
| + | * Full index support, including on inner objects and embedded arrays | ||
| + | * Query profiling | ||
| + | * Replication and fail-over support | ||
| + | * Efficient storage of binary data including large objects (e.g. photos | ||
| + | and videos) | ||
| + | * Auto-sharding for cloud-level scalability (currently in early alpha) | ||
| + | * Commercial Support Available | ||
| + | |||
| + | A key goal of MongoDB is to bridge the gap between key/value stores (which are | ||
| + | fast and highly scalable) and traditional RDBMS systems (which are deep in | ||
| + | functionality). | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | |||
| + | # rpm -qil mongodb-server | ||
| + | < | ||
| + | Version | ||
| + | Release | ||
| + | Architecture: | ||
| + | Install Date: Wed 23 Dec 2015 10:19:25 AM CET | ||
| + | Group : Applications/ | ||
| + | Size : 20949371 | ||
| + | License | ||
| + | Signature | ||
| + | Source RPM : mongodb-2.6.11-1.el7.src.rpm | ||
| + | Build Date : Wed 19 Aug 2015 01:57:11 PM CEST | ||
| + | Build Host : buildvm-08.phx2.fedoraproject.org | ||
| + | Relocations : (not relocatable) | ||
| + | Packager | ||
| + | Vendor | ||
| + | URL : http:// | ||
| + | Summary | ||
| + | Description : | ||
| + | This package provides the mongo server software, mongo sharding server | ||
| + | software, default configuration files, and init scripts. | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | |||
| + | ==== Elasticsearch ==== | ||
| + | Im nächsten Schritt installieren wir nun noch elasticsearch als Suchmaschine/ | ||
| + | # yum install elasticsearch -y | ||
| + | |||
| + | Wollen wir wissen, welche Dateien und Verzeichnisse das Paket auf unseren Server packte, benutzen wir folgenden Befehl. | ||
| + | # rpm -qil elasticsearch | ||
| + | < | ||
| + | Version | ||
| + | Release | ||
| + | Architecture: | ||
| + | Install Date: Mon 28 Dec 2015 02:05:49 PM CET | ||
| + | Group : Application/ | ||
| + | Size : 31336448 | ||
| + | License | ||
| + | Signature | ||
| + | Source RPM : elasticsearch-1.7.4-1.src.rpm | ||
| + | Build Date : Tue 15 Dec 2015 05:53:15 PM CET | ||
| + | Build Host : monster | ||
| + | Relocations : /usr | ||
| + | Packager | ||
| + | Summary | ||
| + | Description : | ||
| + | Elasticsearch - Open Source, Distributed, | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | ==== graylog ==== | ||
| + | Zu guter letzt installieren wir nun noch Pakete **graylog** sowie das Zusatzprogramm **pwgen** zum Generieren von Passwörtern, | ||
| + | # yum install graylog-server graylog-web pwgen -y | ||
| + | |||
| + | Auch hier können wir uns einen Überblick verschaffen, | ||
| + | |||
| + | # rpm -qil graylog-server | ||
| + | < | ||
| + | Version | ||
| + | Release | ||
| + | Architecture: | ||
| + | Install Date: Wed 23 Dec 2015 10:41:06 AM CET | ||
| + | Group : optional | ||
| + | Size : 76865791 | ||
| + | License | ||
| + | Signature | ||
| + | Source RPM : graylog-server-1.3.2-1.src.rpm | ||
| + | Build Date : Fri 18 Dec 2015 04:37:25 PM CET | ||
| + | Build Host : 861e2c96c63a | ||
| + | Relocations : / | ||
| + | Packager | ||
| + | Vendor | ||
| + | URL : https:// | ||
| + | Summary | ||
| + | Description : | ||
| + | Graylog server | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | |||
| + | # rpm -qil graylog-web | ||
| + | < | ||
| + | Version | ||
| + | Release | ||
| + | Architecture: | ||
| + | Install Date: Wed 23 Dec 2015 10:41:08 AM CET | ||
| + | Group : optional | ||
| + | Size : 46487307 | ||
| + | License | ||
| + | Signature | ||
| + | Source RPM : graylog-web-1.3.2-1.src.rpm | ||
| + | Build Date : Fri 18 Dec 2015 04:38:50 PM CET | ||
| + | Build Host : e1ea7e6dc62a | ||
| + | Relocations : / | ||
| + | Packager | ||
| + | Vendor | ||
| + | URL : https:// | ||
| + | Summary | ||
| + | Description : | ||
| + | Graylog web | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | |||
| + | # rpm -qil pwgen | ||
| + | < | ||
| + | Version | ||
| + | Release | ||
| + | Architecture: | ||
| + | Install Date: Mon 28 Dec 2015 09:54:47 AM CET | ||
| + | Group : Applications/ | ||
| + | Size : 37925 | ||
| + | License | ||
| + | Signature | ||
| + | Source RPM : pwgen-2.07-1.el7.src.rpm | ||
| + | Build Date : Fri 05 Dec 2014 06:56:18 PM CET | ||
| + | Build Host : buildvm-08.phx2.fedoraproject.org | ||
| + | Relocations : (not relocatable) | ||
| + | Packager | ||
| + | Vendor | ||
| + | URL : http:// | ||
| + | Summary | ||
| + | Description : | ||
| + | pwgen generates random, meaningless but pronounceable passwords. These | ||
| + | passwords contain either only lowercase letters, or upper and lower case, or | ||
| + | upper case, lower case and numeric digits. Upper case letters and numeric | ||
| + | digits are placed in a way that eases memorizing the password. | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | |||
| + | |||
| + | ===== Konfiguration ===== | ||
| + | Nachdem wir die Installation aller benötigten Programmpakete erfolgreich abgeschlossen haben, können wir uns nun an die Installation der einzelnen Komponenten wagen. | ||
| + | |||
| + | ==== MongoDB ==== | ||
| + | Obwohl in der **MongoDB** nur Metainformationen gespeichert und vorgehalten werden, wollen wir diese NoSQL-Datenbank absichern, indem wir einen Datenbankbenutzer mit Passwort anlegen. Somit ist sichergestellt, | ||
| + | |||
| + | === Start des Daemon === | ||
| + | Unsere Konfigurationsänderungen werden mit Hilfe von **mongo** der MongoDB Shell vorgenommen. Dieses JavaScript stellt die Benutzerschnittstelle zum eigentlichen MongoDN-Daemon zur Verfügung. Damit sich der Client mit dem Server auch verbinden kann, muss der Server natürlich laufen; wir starten also nun unsere NoSQL-Datenbank mit folgendem Befehl. | ||
| + | # systemctl start mongod.service | ||
| + | |||
| + | Den Serverstatus können wir wie folgt abfragen. | ||
| + | # systemctl status mongod.service | ||
| + | |||
| + | < | ||
| + | <font style=" | ||
| + | | ||
| + | | ||
| + | Main PID: 23784 (mongod) | ||
| + | | ||
| + | | ||
| + | |||
| + | Dec 23 11:05:52 vml000117.dmz.nausch.org systemd[1]: Starting High-performance, | ||
| + | Dec 23 11:05:52 vml000117.dmz.nausch.org mongod[23782]: | ||
| + | Dec 23 11:05:52 vml000117.dmz.nausch.org mongod[23782]: | ||
| + | Dec 23 11:05:55 vml000117.dmz.nausch.org systemd[1]: Started High-performance, | ||
| + | </ | ||
| + | |||
| + | Der erfolgreiche Start des Servers wird auch in dessen Logdatei protokolliert. | ||
| + | # less / | ||
| + | |||
| + | < | ||
| + | 2015-12-23T11: | ||
| + | 2015-12-23T11: | ||
| + | 2015-12-23T11: | ||
| + | 2015-12-23T11: | ||
| + | 2015-12-23T11: | ||
| + | 2015-12-23T11: | ||
| + | 2015-12-23T11: | ||
| + | 2015-12-23T11: | ||
| + | 2015-12-23T11: | ||
| + | 2015-12-23T11: | ||
| + | 2015-12-23T11: | ||
| + | 2015-12-23T11: | ||
| + | 2015-12-23T11: | ||
| + | 2015-12-23T11: | ||
| + | 2015-12-23T11: | ||
| + | 2015-12-23T11: | ||
| + | 2015-12-23T11: | ||
| + | 2015-12-23T11: | ||
| + | 2015-12-23T11: | ||
| + | 2015-12-23T11: | ||
| + | 2015-12-23T11: | ||
| + | |||
| + | Standardmäßig öffnet der MongoDB-Daemon den Port **27017**. Dies können wir wie folgt auch überprüfen: | ||
| + | # netstat -tulpen | ||
| + | |||
| + | Active Internet connections (only servers) | ||
| + | Proto Recv-Q Send-Q Local Address | ||
| + | tcp 0 0 127.0.0.1: | ||
| + | |||
| + | |||
| + | === Anpassung des Readahead-Parameters === | ||
| + | Im Logfile finden wir eine **[[http:// | ||
| + | |||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | Zunächst suchen wir, auf welchem Blockdevice das Verzeichnis // | ||
| + | # mount | grep / | ||
| + | |||
| + | /dev/vdc1 on / | ||
| + | |||
| + | Fragen wir die Einstellungen unserer Blockdevices ab erhalten wir zunächst: | ||
| + | # blockdev --report | ||
| + | |||
| + | < | ||
| + | rw 8192 | ||
| + | rw 8192 | ||
| + | rw 8192 | ||
| + | rw 8192 | ||
| + | rw 8192 | ||
| + | rw 8192 | ||
| + | rw 8192 | ||
| + | rw 8192 | ||
| + | rw 8192 | ||
| + | rw 8192 | ||
| + | |||
| + | Wir setzen nunmehr den Wert **RA** auf die empfohlene Größe von **256KB (512 sectors)** für das Blockdevice // | ||
| + | # blockdev --setra 256 /dev/vdc1 | ||
| + | |||
| + | Fragen wir erneut die Einstellungen für // | ||
| + | # blockdev --report | grep /dev/vdc1 | ||
| + | |||
| + | rw | ||
| + | |||
| + | Wenn abschließend starten wir nun den MongoDB-Daemon einmal durch, damit unsere Änderung auch wirksam werden kann. | ||
| + | # systemctl restart mongod.service | ||
| + | |||
| + | Die Warnmeldung ist nunmehr verschwunden. | ||
| + | # less / | ||
| + | |||
| + | < | ||
| + | 2015-12-23T12: | ||
| + | 2015-12-23T12: | ||
| + | 2015-12-23T12: | ||
| + | 2015-12-23T12: | ||
| + | 2015-12-23T12: | ||
| + | 2015-12-23T12: | ||
| + | 2015-12-23T12: | ||
| + | 2015-12-23T12: | ||
| + | 2015-12-23T12: | ||
| + | 2015-12-23T12: | ||
| + | </ | ||
| + | |||
| + | Die eben gemachte Konfigurationsberichtigung wird aber bei einem Reboot des Servers wieder verworfen. Wir müssen also dafür sorgen, dass der readahead-Wert bei einem Neustart des Systems auf den gewünschten Wert **256** gesetzt wird. Hierzu legen wir uns ein kleines Bash-Script an. | ||
| + | # | ||
| + | |||
| + | <file bash / | ||
| + | # Django : 2015-12-28 | ||
| + | # Setzen des readahead Wertes auf 256KB (512 Sektoren) | ||
| + | / | ||
| + | |||
| + | Nun müssen wir nur noch dafür sorgen, dass dieses Script bei einem Neustart gestartet wird. Dazu legen wir uns einen eigenen " | ||
| + | # vim / | ||
| + | |||
| + | <file bash / | ||
| + | Description=Initialize hardware monitoring sensors | ||
| + | After=syslog.target network.target | ||
| + | Before=mongod.service | ||
| + | |||
| + | [Service] | ||
| + | Type=oneshot | ||
| + | ExecStart=/ | ||
| + | |||
| + | [Install] | ||
| + | WantedBy=multi-user.target</ | ||
| + | |||
| + | Zu guter letzt führen wir noch einen Reload des Systemd-Daemon durch und wir haben künftig immer den richtig gesetzten **readahead** von **256** gesetzt. | ||
| + | # systemctl daemon-reload | ||
| + | |||
| + | === automatischer Start des Daemon === | ||
| + | Damit der Daemon beim Hochfahren unseres Servers automatisch gestartet wird, nutzen wir folgenden Befehl. | ||
| + | # systemctl enable mongod.service | ||
| + | |||
| + | Created symlink from / | ||
| + | |||
| + | Wollen wir wissen, ob die Autostartfunktion bereits gesetzt ist, verwenden wir diesen Aufruf. | ||
| + | # systemctl is-enabled mongod.service | ||
| + | |||
| + | enabled | ||
| + | |||
| + | === Datenbanknutzer anlegen === | ||
| + | Wie bereits kurz erwähnt wollen wir unsere MongoDB absichern, indem wir einen Datenbakbenutzer mit Passwort anlegen. Dazu verbinden wir uns erst einmal mit der MongoDB Shell **mongo**. | ||
| + | # mongo | ||
| + | |||
| + | < | ||
| + | connecting to: test | ||
| + | Welcome to the MongoDB shell. | ||
| + | For interactive help, type " | ||
| + | For more comprehensive documentation, | ||
| + | http:// | ||
| + | Questions? Try the support group | ||
| + | http:// | ||
| + | > </ | ||
| + | |||
| + | Zunächst wechseln wir zur Datenbank **admin** mit folgendem Aufruf. | ||
| + | > use admin | ||
| + | |||
| + | switched to db admin | ||
| + | > | ||
| + | |||
| + | Anschließend legen wir den Datenbankadministrator **admin** mit dem Passwort **5y510953rv3r53cr37** an. | ||
| + | > db.createUser({user:" | ||
| + | |||
| + | < | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | ] | ||
| + | } | ||
| + | > </ | ||
| + | |||
| + | Für den Zugriff von graylog auf die NoSQL-Datenbang MongoDB erstellen wir uns nun noch einen separaten Nutzer **// | ||
| + | |||
| + | > use graylog | ||
| + | |||
| + | switched to db graylog | ||
| + | |||
| + | Nun können wir auch unseren User **// | ||
| + | |||
| + | > db.createUser({user:" | ||
| + | |||
| + | Successfully added user: { " | ||
| + | > | ||
| + | |||
| + | Wir haben die nötigen Definitionen erfolgreich zu Ende gebracht und nun können wir die MongoDB Shell **mongo** wieder verlassen. | ||
| + | > exit | ||
| + | |||
| + | bye | ||
| + | |||
| + | Zum Testen, ob unser Datenbanknutzer **// | ||
| + | # mongo -u " | ||
| + | |||
| + | MongoDB shell version: 2.6.11 | ||
| + | connecting to: 127.0.0.1: | ||
| + | > | ||
| + | |||
| + | Die Tabellen der gewählten Datenbank kann man sich mit dem Befehl '' | ||
| + | > show collections | ||
| + | < | ||
| + | alarmcallbackhistory | ||
| + | alerts | ||
| + | cluster_config | ||
| + | cluster_events | ||
| + | collectors | ||
| + | content_packs | ||
| + | dashboards | ||
| + | dead_letters | ||
| + | grok_patterns | ||
| + | index_failures | ||
| + | index_ranges | ||
| + | inputs | ||
| + | ldap_settings | ||
| + | nodes | ||
| + | notifications | ||
| + | roles | ||
| + | sessions | ||
| + | streamrules | ||
| + | streams | ||
| + | system.indexes | ||
| + | system_messages | ||
| + | users | ||
| + | ></ | ||
| + | |||
| + | Da der Zugriff klappte, können wir die Datenbankverbindung wieder beenden. | ||
| + | > exit | ||
| + | |||
| + | bye | ||
| + | |||
| + | Geben wir ein falsches Passwort ein, wird natürlich der Zugang verwehrt. | ||
| + | # mongo -u " | ||
| + | |||
| + | MongoDB shell version: 2.6.11 | ||
| + | connecting to: 127.0.0.1: | ||
| + | 2015-12-23T13: | ||
| + | exception: login failed | ||
| + | |||
| + | Zum Abschluss unterbinden wir nun noch den Passwortlosen Zugang zur MongoDB. Der Parameter **auth** im Abschnitt **//General options//** der Konfigurationsdatei // | ||
| + | # vim / | ||
| + | |||
| + | <file bash / | ||
| + | ### Basic Defaults | ||
| + | ## | ||
| + | |||
| + | # Comma separated list of ip addresses to listen on (all local ips by default) | ||
| + | bind_ip = 127.0.0.1 | ||
| + | |||
| + | # Specify port number (27017 by default) | ||
| + | #port = 27017 | ||
| + | |||
| + | # Fork server process (false by default) | ||
| + | fork = true | ||
| + | |||
| + | # Full path to pidfile (if not set, no pidfile is created) | ||
| + | pidfilepath = / | ||
| + | |||
| + | # Log file to send write to instead of stdout - has to be a file, not directory | ||
| + | logpath = / | ||
| + | |||
| + | # Alternative directory for UNIX domain sockets (defaults to /tmp) | ||
| + | unixSocketPrefix = / | ||
| + | |||
| + | # Directory for datafiles (defaults to /data/db/) | ||
| + | dbpath = / | ||
| + | |||
| + | # Enable/ | ||
| + | #journal = true | ||
| + | #nojournal = true | ||
| + | |||
| + | |||
| + | |||
| + | ## | ||
| + | ### General options | ||
| + | ## | ||
| + | |||
| + | # Be more verbose (include multiple times for more verbosity e.g. -vvvvv) (v by default) | ||
| + | #verbose = v | ||
| + | |||
| + | # Max number of simultaneous connections (1000000 by default) | ||
| + | #maxConns = 1000000 | ||
| + | |||
| + | # Log to system' | ||
| + | #syslog = true | ||
| + | |||
| + | # Syslog facility used for monogdb syslog message (user by defautl) | ||
| + | # | ||
| + | |||
| + | # Append to logpath instead of over-writing (false by default) | ||
| + | #logappend = true | ||
| + | |||
| + | # Desired format for timestamps in log messages (One of ctime, iso8601-utc or iso8601-local) (iso8601-local by default) | ||
| + | # | ||
| + | |||
| + | # Private key for cluster authentication | ||
| + | #keyFile = arg | ||
| + | |||
| + | # Set a configurable parameter | ||
| + | # | ||
| + | |||
| + | # Enable http interface (false by default) | ||
| + | # | ||
| + | |||
| + | # Authentication mode used for cluster authentication. Alternatives are (keyFile|sendKeyFile|sendX509|x509) (keyFile by default) | ||
| + | # | ||
| + | |||
| + | # Disable listening on unix sockets (false by default) | ||
| + | # | ||
| + | |||
| + | # Run with/ | ||
| + | #auth = true | ||
| + | #noauth = true | ||
| + | # Django : 2015-12-23 - Passwortlose logins unterbinden | ||
| + | # default: #auth = true | ||
| + | # #noauth = true | ||
| + | auth = true | ||
| + | |||
| + | # Enable IPv6 support (disabled by default) | ||
| + | #ipv6 = true | ||
| + | |||
| + | # Allow JSONP access via http (has security implications) (false by default) | ||
| + | #jsonp = true | ||
| + | |||
| + | # Turn on simple rest api (false by default) | ||
| + | #rest = true | ||
| + | |||
| + | # Value of slow for profile and console log (100 by default) | ||
| + | #slowms = 100 | ||
| + | |||
| + | # 0=off 1=slow, 2=all (0 by default) | ||
| + | #profile = 0 | ||
| + | |||
| + | # Periodically show cpu and iowait utilization (false by default) | ||
| + | #cpu = true | ||
| + | |||
| + | # Print some diagnostic system information (false by default) | ||
| + | #sysinfo = true | ||
| + | |||
| + | # Each database will be stored in a separate directory (false by default) | ||
| + | # | ||
| + | |||
| + | # Don't retry any index builds that were interrupted by shutdown (false by default) | ||
| + | # | ||
| + | |||
| + | # Disable data file preallocation - will often hurt performance (false by default) | ||
| + | #noprealloc = true | ||
| + | |||
| + | # .ns file size (in MB) for new databases (16 MB by default) | ||
| + | #nssize = 16 | ||
| + | |||
| + | # Limits each database to a certain number of files (8 default) | ||
| + | # | ||
| + | |||
| + | # Number of files allowed per db, implies --quota (8 by default) | ||
| + | #quotaFiles = 8 | ||
| + | |||
| + | # Use a smaller default file size (false by default) | ||
| + | #smallfiles = true | ||
| + | |||
| + | # Seconds between disk syncs (0=never, but not recommended) (60 by default) | ||
| + | #syncdelay = 60 | ||
| + | |||
| + | # Upgrade db if needed (false by default) | ||
| + | #upgrade = true | ||
| + | |||
| + | # Run repair on all dbs (false by default) | ||
| + | #repair = true | ||
| + | |||
| + | # Root directory for repair files (defaults to dbpath) | ||
| + | #repairpath = arg | ||
| + | |||
| + | # Disable scripting engine (false by default) | ||
| + | # | ||
| + | |||
| + | # Do not allow table scans (false by default) | ||
| + | # | ||
| + | |||
| + | # Journal diagnostic options (0 by default) | ||
| + | # | ||
| + | |||
| + | # How often to group/batch commit (ms) (100 or 30 by default) | ||
| + | # | ||
| + | |||
| + | |||
| + | |||
| + | ## | ||
| + | ### Replication options | ||
| + | ## | ||
| + | |||
| + | # Size to use (in MB) for replication op log (default 5% of disk space - i.e. large is good) | ||
| + | #oplogSize = arg | ||
| + | |||
| + | |||
| + | |||
| + | ## | ||
| + | ### Master/ | ||
| + | ## | ||
| + | |||
| + | # Master mode | ||
| + | #master = true | ||
| + | |||
| + | # Slave mode | ||
| + | #slave = true | ||
| + | |||
| + | # When slave: specify master as < | ||
| + | #source = arg | ||
| + | |||
| + | # When slave: specify a single database to replicate | ||
| + | #only = arg | ||
| + | |||
| + | # Specify delay (in seconds) to be used when applying master ops to slave | ||
| + | #slavedelay = arg | ||
| + | |||
| + | # Automatically resync if slave data is stale | ||
| + | #autoresync = true | ||
| + | |||
| + | |||
| + | |||
| + | ## | ||
| + | ### Replica set options | ||
| + | ## | ||
| + | |||
| + | # Arg is < | ||
| + | #replSet = arg | ||
| + | |||
| + | # Specify index prefetching behavior (if secondary) [none|_id_only|all] (all by default) | ||
| + | # | ||
| + | |||
| + | |||
| + | |||
| + | ## | ||
| + | ### Sharding options | ||
| + | ## | ||
| + | |||
| + | # Declare this is a config db of a cluster (default port 27019; default dir / | ||
| + | #configsvr = true | ||
| + | |||
| + | # Declare this is a shard db of a cluster (default port 27018) | ||
| + | #shardsvr = true | ||
| + | |||
| + | |||
| + | |||
| + | ## | ||
| + | ### SSL options | ||
| + | ## | ||
| + | |||
| + | # Use ssl on configured ports | ||
| + | # | ||
| + | |||
| + | # Set the SSL operation mode (disabled|allowSSL|preferSSL|requireSSL) | ||
| + | # sslMode = arg | ||
| + | |||
| + | # PEM file for ssl | ||
| + | # | ||
| + | |||
| + | # PEM file password | ||
| + | # | ||
| + | |||
| + | # Key file for internal SSL authentication | ||
| + | # | ||
| + | |||
| + | # Internal authentication key file password | ||
| + | # | ||
| + | |||
| + | # Certificate Authority file for SSL | ||
| + | #sslCAFile = arg | ||
| + | |||
| + | # Certificate Revocation List file for SSL | ||
| + | #sslCRLFile = arg | ||
| + | |||
| + | # Allow client to connect without presenting a certificate | ||
| + | # | ||
| + | |||
| + | # Allow server certificates to provide non-matching hostnames | ||
| + | # | ||
| + | |||
| + | # Allow connections to servers with invalid certificates | ||
| + | # | ||
| + | |||
| + | # Activate FIPS 140-2 mode at startup | ||
| + | # | ||
| + | |||
| + | </ | ||
| + | |||
| + | Nun werden wir den MongoDB-Daemon einaml noch durchstarten, | ||
| + | # systemctl restart mongod.service | ||
| + | |||
| + | Ein Anmeldeversuch ohne Benutzerkennung samt Passwort ist ab sofort nicht mehr möglich. | ||
| + | |||
| + | ==== Elasticsearch ==== | ||
| + | In diesem Abschnitt werden wir nun den Suchserver **elasticsearch**, | ||
| + | |||
| + | In der Dokumentation von graylog im Abschnitt **[[http:// | ||
| + | <WRAP center round tip 80%> | ||
| + | **// | ||
| + | </ | ||
| + | |||
| + | Diesem Vorschlag wollen wir nun in die Tat umsetzen. Beim Blockdevice haben wir in unserem Konfigurationsbeispiel bereits ein RAID aus schnellen Server-SSD' | ||
| + | Zunächst aber fragen wird den aktuellen Wert von **vm.max_map_count** erst einmal ab. | ||
| + | # sysctl vm.max_map_count | ||
| + | |||
| + | vm.max_map_count = 65530 | ||
| + | |||
| + | In der Dokumentation von [[https:// | ||
| + | # sysctl -w vm.max_map_count=262144 | ||
| + | |||
| + | vm.max_map_count = 262144 | ||
| + | |||
| + | Damit die Werteanpassung resetfest, also bei jedem Neustart des Servers auf den gewünschten Wert gesetzt wird, bearbeiten wir die Datei // | ||
| + | # vim / | ||
| + | |||
| + | <file bash / | ||
| + | # To override those settings, enter new settings here, or in an / | ||
| + | # | ||
| + | # For more information, | ||
| + | # | ||
| + | # Django : 2015-12-23 - den virtuellen Speicherverbrauch von elasticsearch anpassen | ||
| + | vm.max_map_count=262144</ | ||
| + | |||
| + | === elasticsearch.yml === | ||
| + | Laut der **[[http:// | ||
| + | |||
| + | <WRAP center round tip 80%> | ||
| + | **The only important thing for Elasticsearch is that you set the exactly same cluster name (e. g. ``cluster.name: | ||
| + | </ | ||
| + | |||
| + | Da aber in der Dokumentation **[[https:// | ||
| + | # vim / | ||
| + | |||
| + | <file bash / | ||
| + | |||
| + | # This file contains an overview of various configuration settings, | ||
| + | # targeted at operations staff. Application developers should | ||
| + | # consult the guide at < | ||
| + | # | ||
| + | # The installation procedure is covered at | ||
| + | # < | ||
| + | # | ||
| + | # Elasticsearch comes with reasonable defaults for most settings, | ||
| + | # so you can try it out without bothering with configuration. | ||
| + | # | ||
| + | # Most of the time, these defaults are just fine for running a production | ||
| + | # cluster. If you're fine-tuning your cluster, or wondering about the | ||
| + | # effect of certain configuration option, please _do ask_ on the | ||
| + | # mailing list or IRC channel [http:// | ||
| + | |||
| + | # Any element in the configuration can be replaced with environment variables | ||
| + | # by placing them in ${...} notation. For example: | ||
| + | # | ||
| + | #node.rack: ${RACK_ENV_VAR} | ||
| + | |||
| + | # For information on supported formats and syntax for the config file, see | ||
| + | # < | ||
| + | |||
| + | |||
| + | ################################### | ||
| + | |||
| + | # Cluster name identifies your cluster for auto-discovery. If you're running | ||
| + | # multiple clusters on the same network, make sure you're using unique names. | ||
| + | # | ||
| + | # Django : 2015-12-28 | ||
| + | # default: # | ||
| + | cluster.name: | ||
| + | |||
| + | |||
| + | #################################### | ||
| + | |||
| + | # Node names are generated dynamically on startup, so you're relieved | ||
| + | # from configuring them manually. You can tie this node to a specific name: | ||
| + | # | ||
| + | # Django : 2015-12-28 | ||
| + | # default: #node.name: "Franz Kafka" | ||
| + | node.name: vml000117 | ||
| + | |||
| + | # Every node can be configured to allow or deny being eligible as the master, | ||
| + | # and to allow or deny to store the data. | ||
| + | # | ||
| + | # Allow this node to be eligible as a master node (enabled by default): | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # Allow this node to store data (enabled by default): | ||
| + | # | ||
| + | #node.data: true | ||
| + | |||
| + | # You can exploit these settings to design advanced cluster topologies. | ||
| + | # | ||
| + | # 1. You want this node to never become a master node, only to hold data. | ||
| + | # This will be the " | ||
| + | # | ||
| + | # | ||
| + | #node.data: true | ||
| + | # | ||
| + | # 2. You want this node to only serve as a master: to not store any data and | ||
| + | # to have free resources. This will be the " | ||
| + | # | ||
| + | # | ||
| + | #node.data: false | ||
| + | # | ||
| + | # 3. You want this node to be neither master nor data node, but | ||
| + | # to act as a " | ||
| + | # aggregating results, etc.) | ||
| + | # | ||
| + | # | ||
| + | #node.data: false | ||
| + | |||
| + | # Use the Cluster Health API [http:// | ||
| + | # Node Info API [http:// | ||
| + | # such as < | ||
| + | # < | ||
| + | # < | ||
| + | # < | ||
| + | |||
| + | # A node can have generic attributes associated with it, which can later be used | ||
| + | # for customized shard allocation filtering, or allocation awareness. An attribute | ||
| + | # is a simple key value pair, similar to node.key: value, here is an example: | ||
| + | # | ||
| + | #node.rack: rack314 | ||
| + | |||
| + | # By default, multiple nodes are allowed to start from the same installation location | ||
| + | # to disable it, set the following: | ||
| + | # | ||
| + | |||
| + | |||
| + | #################################### | ||
| + | |||
| + | # You can set a number of options (such as shard/ | ||
| + | # or analyzer definitions, | ||
| + | # in this file. | ||
| + | # | ||
| + | # Note, that it makes more sense to configure index settings specifically for | ||
| + | # a certain index, either when creating it or by using the index templates API. | ||
| + | # | ||
| + | # See < | ||
| + | # < | ||
| + | # for more information. | ||
| + | |||
| + | # Set the number of shards (splits) of an index (5 by default): | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Set the number of replicas (additional copies) of an index (1 by default): | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Note, that for development on a local machine, with small indices, it usually | ||
| + | # makes sense to " | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # These settings directly affect the performance of index and search operations | ||
| + | # in your cluster. Assuming you have enough machines to hold shards and | ||
| + | # replicas, the rule of thumb is: | ||
| + | # | ||
| + | # 1. Having more *shards* enhances the _indexing_ performance and allows to | ||
| + | # _distribute_ a big index across machines. | ||
| + | # 2. Having more *replicas* enhances the _search_ performance and improves the | ||
| + | # cluster _availability_. | ||
| + | # | ||
| + | # The " | ||
| + | # | ||
| + | # The " | ||
| + | # by using the Index Update Settings API. | ||
| + | # | ||
| + | # Elasticsearch takes care about load balancing, relocating, gathering the | ||
| + | # results from nodes, etc. Experiment with different settings to fine-tune | ||
| + | # your setup. | ||
| + | |||
| + | # Use the Index Status API (< | ||
| + | # the index status. | ||
| + | |||
| + | |||
| + | #################################### | ||
| + | |||
| + | # Path to directory containing configuration (this file and logging.yml): | ||
| + | # | ||
| + | #path.conf: / | ||
| + | |||
| + | # Path to directory where to store index data allocated for this node. | ||
| + | # | ||
| + | #path.data: / | ||
| + | # | ||
| + | # Can optionally include more than one location, causing data to be striped across | ||
| + | # the locations (a la RAID 0) on a file level, favouring locations with most free | ||
| + | # space on creation. For example: | ||
| + | # | ||
| + | #path.data: / | ||
| + | |||
| + | # Path to temporary files: | ||
| + | # | ||
| + | #path.work: / | ||
| + | |||
| + | # Path to log files: | ||
| + | # | ||
| + | #path.logs: / | ||
| + | |||
| + | # Path to where plugins are installed: | ||
| + | # | ||
| + | # | ||
| + | |||
| + | |||
| + | #################################### | ||
| + | |||
| + | # If a plugin listed here is not installed for current node, the node will not start. | ||
| + | # | ||
| + | # | ||
| + | |||
| + | |||
| + | ################################### | ||
| + | |||
| + | # Elasticsearch performs poorly when JVM starts swapping: you should ensure that | ||
| + | # it _never_ swaps. | ||
| + | # | ||
| + | # Set this property to true to lock the memory: | ||
| + | # | ||
| + | # Django : 2015-12-28 | ||
| + | # default: unset | ||
| + | bootstrap.mlockall: | ||
| + | |||
| + | |||
| + | # Make sure that the ES_MIN_MEM and ES_MAX_MEM environment variables are set | ||
| + | # to the same value, and that the machine has enough memory to allocate | ||
| + | # for Elasticsearch, | ||
| + | # | ||
| + | # You should also make sure that the Elasticsearch process is allowed to lock | ||
| + | # the memory, eg. by using `ulimit -l unlimited`. | ||
| + | |||
| + | |||
| + | ############################## | ||
| + | |||
| + | # Elasticsearch, | ||
| + | # on port [9200-9300] for HTTP traffic and on port [9300-9400] for node-to-node | ||
| + | # communication. (the range means that if the port is busy, it will automatically | ||
| + | # try the next port). | ||
| + | |||
| + | # Set the bind address specifically (IPv4 or IPv6): | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Set the address other nodes will use to communicate with this node. If not | ||
| + | # set, it is automatically derived. It must point to an actual IP address. | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Set both ' | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Set a custom port for the node to node communication (9300 by default): | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Enable compression for all communication between nodes (disabled by default): | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Set a custom port to listen for HTTP traffic: | ||
| + | # | ||
| + | #http.port: 9200 | ||
| + | |||
| + | # Set a custom allowed content length: | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Disable HTTP completely: | ||
| + | # | ||
| + | # | ||
| + | |||
| + | |||
| + | ################################### | ||
| + | |||
| + | # The gateway allows for persisting the cluster state between full cluster | ||
| + | # restarts. Every change to the state (such as adding an index) will be stored | ||
| + | # in the gateway, and when the cluster starts up for the first time, | ||
| + | # it will read its state from the gateway. | ||
| + | |||
| + | # There are several types of gateway implementations. For more information, | ||
| + | # < | ||
| + | |||
| + | # The default gateway type is the " | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Settings below control how and when to start the initial recovery process on | ||
| + | # a full cluster restart (to reuse as much local data as possible when using shared | ||
| + | # gateway). | ||
| + | |||
| + | # Allow recovery process after N nodes in a cluster are up: | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Set the timeout to initiate the recovery process, once the N nodes | ||
| + | # from previous setting are up (accepts time value): | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Set how many nodes are expected in this cluster. Once these N nodes | ||
| + | # are up (and recover_after_nodes is met), begin recovery process immediately | ||
| + | # (without waiting for recover_after_time to expire): | ||
| + | # | ||
| + | # | ||
| + | |||
| + | |||
| + | ############################# | ||
| + | |||
| + | # These settings allow to control the process of shards allocation between | ||
| + | # nodes during initial recovery, replica allocation, rebalancing, | ||
| + | # or when adding and removing nodes. | ||
| + | |||
| + | # Set the number of concurrent recoveries happening on a node: | ||
| + | # | ||
| + | # 1. During the initial recovery | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # 2. During adding/ | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Set to throttle throughput when recovering (eg. 100mb, by default 20mb): | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Set to limit the number of open concurrent streams when | ||
| + | # recovering a shard from a peer: | ||
| + | # | ||
| + | # | ||
| + | |||
| + | |||
| + | ################################## | ||
| + | |||
| + | # Discovery infrastructure ensures nodes can be found within a cluster | ||
| + | # and master node is elected. Multicast discovery is the default. | ||
| + | |||
| + | # Set to ensure a node sees N other master eligible nodes to be considered | ||
| + | # operational within the cluster. This should be set to a quorum/ | ||
| + | # the master-eligible nodes in the cluster. | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Set the time to wait for ping responses from other nodes when discovering. | ||
| + | # Set this option to a higher value on a slow or congested network | ||
| + | # to minimize discovery failures: | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # For more information, | ||
| + | # < | ||
| + | |||
| + | # Unicast discovery allows to explicitly control which nodes will be used | ||
| + | # to discover the cluster. It can be used when multicast is not present, | ||
| + | # or to restrict the cluster communication-wise. | ||
| + | # | ||
| + | # 1. Disable multicast discovery (enabled by default): | ||
| + | # | ||
| + | # | ||
| + | # Django : 2015-12-28 | ||
| + | # default: " | ||
| + | discovery.zen.ping.multicast.enabled: | ||
| + | |||
| + | # | ||
| + | # 2. Configure an initial list of master nodes in the cluster | ||
| + | # to perform discovery when new nodes (master or data) are started: | ||
| + | # | ||
| + | # | ||
| + | # Django : 2015-12-28 | ||
| + | # default: unset | ||
| + | discovery.zen.ping.unicast.hosts: | ||
| + | |||
| + | |||
| + | # EC2 discovery allows to use AWS EC2 API in order to perform discovery. | ||
| + | # | ||
| + | # You have to install the cloud-aws plugin for enabling the EC2 discovery. | ||
| + | # | ||
| + | # For more information, | ||
| + | # < | ||
| + | # | ||
| + | # See < | ||
| + | # for a step-by-step tutorial. | ||
| + | |||
| + | # GCE discovery allows to use Google Compute Engine API in order to perform discovery. | ||
| + | # | ||
| + | # You have to install the cloud-gce plugin for enabling the GCE discovery. | ||
| + | # | ||
| + | # For more information, | ||
| + | |||
| + | # Azure discovery allows to use Azure API in order to perform discovery. | ||
| + | # | ||
| + | # You have to install the cloud-azure plugin for enabling the Azure discovery. | ||
| + | # | ||
| + | # For more information, | ||
| + | |||
| + | ################################## | ||
| + | |||
| + | # Shard level query and fetch threshold logging. | ||
| + | |||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | ################################## | ||
| + | |||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | ################################## | ||
| + | |||
| + | # Uncomment if you want to enable JSONP as a valid return transport on the | ||
| + | # http server. With this enabled, it may pose a security risk, so disabling | ||
| + | # it unless you need it is recommended (it is disabled by default). | ||
| + | # | ||
| + | # | ||
| + | |||
| + | === elasticsearch.service === | ||
| + | Damit Parameter **bootstrap.mlockall** auch richtig gesetzt werden kann, ist noch eine Änderung an dem Systemd-Startscript notwendig! Dieses werden wir nun noch anpassen; hierzu kopieren wir uns nun das entsprechende Script nach // | ||
| + | # cp -a / | ||
| + | |||
| + | In dieser Datei setzen wir den Parameter **LimitMEMLOCK** auf **infinity**. | ||
| + | # vim / | ||
| + | |||
| + | <file bash / | ||
| + | Description=Elasticsearch | ||
| + | Documentation=http:// | ||
| + | Wants=network-online.target | ||
| + | After=network-online.target | ||
| + | |||
| + | [Service] | ||
| + | Environment=ES_HOME=/ | ||
| + | Environment=CONF_DIR=/ | ||
| + | Environment=CONF_FILE=/ | ||
| + | Environment=DATA_DIR=/ | ||
| + | Environment=LOG_DIR=/ | ||
| + | Environment=PID_DIR=/ | ||
| + | EnvironmentFile=-/ | ||
| + | |||
| + | User=elasticsearch | ||
| + | Group=elasticsearch | ||
| + | |||
| + | ExecStart=/ | ||
| + | -Des.pidfile=$PID_DIR/ | ||
| + | -Des.default.path.home=$ES_HOME \ | ||
| + | -Des.default.path.logs=$LOG_DIR \ | ||
| + | -Des.default.path.data=$DATA_DIR \ | ||
| + | -Des.default.config=$CONF_FILE \ | ||
| + | -Des.default.path.conf=$CONF_DIR | ||
| + | |||
| + | # Connects standard output to /dev/null | ||
| + | StandardOutput=null | ||
| + | |||
| + | # Connects standard error to journal | ||
| + | StandardError=journal | ||
| + | |||
| + | # When a JVM receives a SIGTERM signal it exits with code 143 | ||
| + | SuccessExitStatus=143 | ||
| + | |||
| + | # Specifies the maximum file descriptor number that can be opened by this process | ||
| + | LimitNOFILE=65535 | ||
| + | |||
| + | # Specifies the maximum number of bytes of memory that may be locked into RAM | ||
| + | # Set to " | ||
| + | # in elasticsearch.yml and ' | ||
| + | # Django : 2015-12-28 | ||
| + | # default: # LimitMEMLOCK=infinity | ||
| + | LimitMEMLOCK=infinity | ||
| + | |||
| + | # Shutdown delay in seconds, before process is tried to be killed with KILL (if configured) | ||
| + | TimeoutStopSec=20 | ||
| + | |||
| + | [Install] | ||
| + | WantedBy=multi-user.target | ||
| + | |||
| + | # Built for elasticsearch-1.7.4 (rpm)</ | ||
| + | |||
| + | Anschließend informieren wir den **systemd** über unser " | ||
| + | | ||
| + | |||
| + | |||
| + | === Start des Daemon === | ||
| + | Unsere Konfigurationsänderungen werden mit Hilfe von **mongo** der MongoDB Shell vorgenommen. Dieses JavaScript stellt die Benutzerschnittstelle zum eigentlichen MongoDN-Daemon zur Verfügung. Damit sich der Client mit dem Server auch verbinden kann, muss der Server natürlich laufen; wir starten also nun unsere NoSQL-Datenbank mit folgendem Befehl. | ||
| + | # systemctl start mongod.service | ||
| + | |||
| + | Den Serverstatus können wir wie folgt abfragen. | ||
| + | # systemctl status elasticsearch.service | ||
| + | |||
| + | < | ||
| + | <font style=" | ||
| + | | ||
| + | | ||
| + | Docs: http:// | ||
| + | Main PID: 32221 (java) | ||
| + | | ||
| + | | ||
| + | |||
| + | Dec 28 14:20:23 vml000117.dmz.nausch.org systemd[1]: Started Elasticsearch. | ||
| + | Dec 28 14:20:23 vml000117.dmz.nausch.org systemd[1]: Starting Elasticsearch...</ | ||
| + | </ | ||
| + | |||
| + | Der erfolgreiche Start des Servers wird auch in dessen Logdatei protokolliert. | ||
| + | # / | ||
| + | |||
| + | < | ||
| + | [2015-12-28 14: | ||
| + | [2015-12-28 14: | ||
| + | [2015-12-28 14: | ||
| + | [2015-12-28 14: | ||
| + | [2015-12-28 14: | ||
| + | [2015-12-28 14: | ||
| + | [2015-12-28 14: | ||
| + | [2015-12-28 14: | ||
| + | [2015-12-28 14: | ||
| + | [2015-12-28 14: | ||
| + | [2015-12-28 14: | ||
| + | [2015-12-28 14: | ||
| + | [2015-12-28 14: | ||
| + | [2015-12-28 14: | ||
| + | |||
| + | === automatischer Start des Daemon === | ||
| + | Damit der Daemon beim Hochfahren unseres Servers automatisch gestartet wird, nutzen wir folgenden Befehl. | ||
| + | # systemctl enable elasticsearch.service | ||
| + | |||
| + | Created symlink from / | ||
| + | |||
| + | Wollen wir wissen, ob die Autostartfunktion bereits gesetzt ist, verwenden wir diesen Aufruf. | ||
| + | # systemctl is-enabled elasticsearch.service | ||
| + | |||
| + | enabled | ||
| + | |||
| + | === Test === | ||
| + | Zum Testen unserer Konfigurationseinstellungen nutzen wir die **[[https:// | ||
| + | # curl localhost: | ||
| + | < | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | } | ||
| + | } | ||
| + | }</ | ||
| + | |||
| + | Den Zustand des elastic-Servers kann man sich mit folgendem Aufruf anzeigen lassen. | ||
| + | # curl localhost: | ||
| + | |||
| + | < | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }</ | ||
| + | ==== graylog-server ==== | ||
| + | Nachdem wir alle Vorbereitungen erfolgreich abgeschlossen haben, können wir uns nun der Konfiguration des **graylog-server Daemons** widmen. | ||
| + | |||
| + | === / | ||
| + | Auf unserem System unter **CentOS 7.x** hatten wir als JAVA Runtime Enviroment das Paket **[[ | ||
| + | centos: | ||
| + | # vim / | ||
| + | |||
| + | <file bash / | ||
| + | JAVA=/ | ||
| + | |||
| + | # Default Java options for heap and garbage collection. | ||
| + | # | ||
| + | # Django : 2015-12-28 - PermSize und MaxPermSize werden ab openjdk-1.8.0 nicht mehr unterstützt | ||
| + | # default: GRAYLOG_SERVER_JAVA_OPTS=" | ||
| + | GRAYLOG_SERVER_JAVA_OPTS=" | ||
| + | |||
| + | # Pass some extra args to graylog-server. (i.e. " | ||
| + | GRAYLOG_SERVER_ARGS="" | ||
| + | |||
| + | # Program that will be used to wrap the graylog-server command. Useful to | ||
| + | # support programs like authbind. | ||
| + | GRAYLOG_COMMAND_WRAPPER=""</ | ||
| + | |||
| + | |||
| + | === / | ||
| + | Die eigentliche Konfiguration unseres **// | ||
| + | |||
| + | Bevor wir diese öffnen und bearbeiten, erstellen wir uns noch zwei Dinge: | ||
| + | - **Passwort-Hash** \\ Mit Hilfe des Passwort-Hash werden die Nutzerpassworte verschlüsselt. Diesen hash-Wert erstellen wir wie folgt: < | ||
| + | - **Admin-Passwort** \\ Der administrative Benutzer **admin** benötigt noch ein zugehöriges Passwort, erzeugen wir nun mit folgendem Befehl. < | ||
| + | |||
| + | Diese beiden Werte hinterlegen wir nun in der Konfigurationsdatei unseres **graylog**-Daemon und passen anschließend die Konfigurationsoptionen unserer Umgebung an. Änderungen an den Default-Werten sind mit **Django : < | ||
| + | # vim / | ||
| + | |||
| + | <file bash / | ||
| + | # instances as master. The master will perform some periodical tasks that non-masters won't perform. | ||
| + | is_master = true | ||
| + | |||
| + | # The auto-generated node ID will be stored in this file and read after restarts. It is a good idea | ||
| + | # to use an absolute file path here if you are starting graylog2-server from init scripts or similar. | ||
| + | node_id_file = / | ||
| + | |||
| + | # You MUST set a secret to secure/ | ||
| + | # Generate one by using for example: pwgen -N 1 -s 96 | ||
| + | # Django : 2015-12-28 | ||
| + | # default: password_secret = | ||
| + | password_secret = yCWAd48fvOmR7xAmcKezZ2C0v3mtaXCJjA7NfhBlSf98PTxHrf9SrCQDX2xgjCzrHpxoV5UNOEfQZsOP1gkWkYlDarD75tbtztPhR59O70yZchaJcyQTeHBZllQc8RcT | ||
| + | |||
| + | # The default root user is named ' | ||
| + | # Django : 2015-12-28 | ||
| + | # default: # | ||
| + | root_username = admin | ||
| + | |||
| + | # You MUST specify a hash password for the root user (which you only need to initially set up the | ||
| + | # system and in case you lose connectivity to your authentication backend) | ||
| + | # This password cannot be changed using the API or via the web interface. If you need to change it, | ||
| + | # modify it in this file. | ||
| + | # Create one by using for example: echo -n yourpassword | shasum -a 256 | ||
| + | # and put the resulting hash value into the following line | ||
| + | # Django : 2015-12-28 | ||
| + | # default: root_password_sha2 = | ||
| + | root_password_sha2 = 38337fd07fd4ee02548053d7bed3ee33e3e0c593c2802941e2349fc52e80b98d | ||
| + | |||
| + | # The email address of the root user. | ||
| + | # Default is empty | ||
| + | # Django : 2015-12-28 | ||
| + | # default: #root_email = "" | ||
| + | root_email = " | ||
| + | |||
| + | # The time zone setting of the root user. | ||
| + | # The configured time zone must be parseable by http:// | ||
| + | # Default is UTC | ||
| + | # Django : 2015-12-28 | ||
| + | # default: # | ||
| + | root_timezone = Europe/ | ||
| + | |||
| + | # Set plugin directory here (relative or absolute) | ||
| + | plugin_dir = / | ||
| + | |||
| + | # REST API listen URI. Must be reachable by other graylog2-server nodes if you run a cluster. | ||
| + | rest_listen_uri = http:// | ||
| + | |||
| + | # REST API transport address. Defaults to the value of rest_listen_uri. Exception: If rest_listen_uri | ||
| + | # is set to a wildcard IP address (0.0.0.0) the first non-loopback IPv4 system address is used. | ||
| + | # If set, his will be promoted in the cluster discovery APIs, so other nodes may try to connect on | ||
| + | # this address and it is used to generate URLs addressing entities in the REST API. (see rest_listen_uri) | ||
| + | # You will need to define this, if your Graylog server is running behind a HTTP proxy that is rewriting | ||
| + | # the scheme, host name or URI. | ||
| + | # | ||
| + | # Django : 2015-12-28 | ||
| + | # default: unset | ||
| + | rest_transport_uri = http:// | ||
| + | |||
| + | # Enable CORS headers for REST API. This is necessary for JS-clients accessing the server directly. | ||
| + | # If these are disabled, modern browsers will not be able to retrieve resources from the server. | ||
| + | # This is disabled by default. Uncomment the next line to enable it. | ||
| + | # | ||
| + | # Django : 2015-12-28 | ||
| + | # default: unset | ||
| + | rest_enable_cors = true | ||
| + | |||
| + | # Enable GZIP support for REST API. This compresses API responses and therefore helps to reduce | ||
| + | # overall round trip times. This is disabled by default. Uncomment the next line to enable it. | ||
| + | # | ||
| + | # Django : 2015-12-28 | ||
| + | # default: unset | ||
| + | rest_enable_gzip = true | ||
| + | |||
| + | # Enable HTTPS support for the REST API. This secures the communication with the REST API with | ||
| + | # TLS to prevent request forgery and eavesdropping. This is disabled by default. Uncomment the | ||
| + | # next line to enable it. | ||
| + | # | ||
| + | |||
| + | # The X.509 certificate file to use for securing the REST API. | ||
| + | # | ||
| + | |||
| + | # The private key to use for securing the REST API. | ||
| + | # | ||
| + | |||
| + | # The password to unlock the private key used for securing the REST API. | ||
| + | # | ||
| + | |||
| + | # The maximum size of a single HTTP chunk in bytes. | ||
| + | # | ||
| + | |||
| + | # The maximum size of the HTTP request headers in bytes. | ||
| + | # | ||
| + | |||
| + | # The maximal length of the initial HTTP/1.1 line in bytes. | ||
| + | # | ||
| + | |||
| + | # The size of the execution handler thread pool used exclusively for serving the REST API. | ||
| + | # | ||
| + | |||
| + | # The size of the worker thread pool used exclusively for serving the REST API. | ||
| + | # | ||
| + | |||
| + | # Embedded Elasticsearch configuration file | ||
| + | # pay attention to the working directory of the server, maybe use an absolute path here | ||
| + | # | ||
| + | |||
| + | # Graylog will use multiple indices to store documents in. You can configured the strategy it uses to determine | ||
| + | # when to rotate the currently active write index. | ||
| + | # It supports multiple rotation strategies: | ||
| + | # - " | ||
| + | # - " | ||
| + | # valid values are " | ||
| + | # Django : 2015-12-28 | ||
| + | # default: rotation_strategy = count | ||
| + | rotation_strategy = time | ||
| + | |||
| + | # (Approximate) maximum number of documents in an Elasticsearch index before a new index | ||
| + | # is being created, also see no_retention and elasticsearch_max_number_of_indices. | ||
| + | # Configure this if you used ' | ||
| + | # Django : 2015-12-28 | ||
| + | # default: elasticsearch_max_docs_per_index = 20000000 | ||
| + | |||
| + | # (Approximate) maximum size in bytes per Elasticsearch index on disk before a new index is being created, also see | ||
| + | # no_retention and elasticsearch_max_number_of_indices. Default is 1GB. | ||
| + | # Configure this if you used ' | ||
| + | # | ||
| + | |||
| + | # (Approximate) maximum time before a new Elasticsearch index is being created, also see | ||
| + | # no_retention and elasticsearch_max_number_of_indices. Default is 1 day. | ||
| + | # Configure this if you used ' | ||
| + | # Please note that this rotation period does not look at the time specified in the received messages, but is | ||
| + | # using the real clock value to decide when to rotate the index! | ||
| + | # Specify the time using a duration and a suffix indicating which unit you want: | ||
| + | # 1w = 1 week | ||
| + | # 1d = 1 day | ||
| + | # 12h = 12 hours | ||
| + | # Permitted suffixes are: d for day, h for hour, m for minute, s for second. | ||
| + | # | ||
| + | # Django : 2015-12-28 | ||
| + | # default: unset | ||
| + | elasticsearch_max_time_per_index = 1d | ||
| + | |||
| + | # Disable checking the version of Elasticsearch for being compatible with this Graylog release. | ||
| + | # WARNING: Using Graylog with unsupported and untested versions of Elasticsearch may lead to data loss! | ||
| + | # | ||
| + | |||
| + | # Disable message retention on this node, i. e. disable Elasticsearch index rotation. | ||
| + | # | ||
| + | |||
| + | # How many indices do you want to keep? | ||
| + | # Django : 2015-12-28 | ||
| + | # default: elasticsearch_max_number_of_indices = 20 | ||
| + | elasticsearch_max_number_of_indices = 30 | ||
| + | |||
| + | # Decide what happens with the oldest indices when the maximum number of indices is reached. | ||
| + | # The following strategies are availble: | ||
| + | # - delete # Deletes the index completely (Default) | ||
| + | # - close # Closes the index and hides it from the system. Can be re-opened later. | ||
| + | retention_strategy = delete | ||
| + | |||
| + | # How many Elasticsearch shards and replicas should be used per index? Note that this only applies to newly created indices. | ||
| + | # Django : 2015-12-28 | ||
| + | # default: elasticsearch_shards = 4 | ||
| + | elasticsearch_shards = 1 | ||
| + | elasticsearch_replicas = 0 | ||
| + | |||
| + | |||
| + | # Prefix for all Elasticsearch indices and index aliases managed by Graylog. | ||
| + | # Django : 2015-12-28 | ||
| + | # default: elasticsearch_index_prefix = graylog2 | ||
| + | elasticsearch_index_prefix = graylog | ||
| + | |||
| + | # Name of the Elasticsearch index template used by Graylog to apply the mandatory index mapping. | ||
| + | # # Default: graylog-internal | ||
| + | # | ||
| + | |||
| + | # Do you want to allow searches with leading wildcards? This can be extremely resource hungry and should only | ||
| + | # be enabled with care. See also: https:// | ||
| + | allow_leading_wildcard_searches = false | ||
| + | |||
| + | # Do you want to allow searches to be highlighted? | ||
| + | # should only be enabled after making sure your Elasticsearch cluster has enough memory. | ||
| + | allow_highlighting = false | ||
| + | |||
| + | # settings to be passed to elasticsearch' | ||
| + | # all these | ||
| + | # this must be the same as for your Elasticsearch cluster | ||
| + | # | ||
| + | # Django : 2015-12-28 | ||
| + | # default: unset | ||
| + | elasticsearch_cluster_name = graylog | ||
| + | |||
| + | # you could also leave this out, but makes it easier to identify the graylog2 client instance | ||
| + | # | ||
| + | # Django : 2015-12-28 | ||
| + | # default: unset | ||
| + | elasticsearch_node_name = vml000117 | ||
| + | |||
| + | # we don't want the graylog2 server to store any data, or be master node | ||
| + | # Django : 2015-12-28 | ||
| + | # default: # | ||
| + | # # | ||
| + | elasticsearch_node_master = false | ||
| + | elasticsearch_node_data = false | ||
| + | |||
| + | # use a different port if you run multiple Elasticsearch nodes on one machine | ||
| + | # | ||
| + | |||
| + | # we don't need to run the embedded HTTP server here | ||
| + | # Django : 2015-12-28 | ||
| + | # default: # | ||
| + | elasticsearch_http_enabled = false | ||
| + | |||
| + | # Django : 2015-12-28 | ||
| + | # default: # | ||
| + | elasticsearch_discovery_zen_ping_multicast_enabled = false | ||
| + | |||
| + | # Django : 2015-12-28 | ||
| + | # default: # | ||
| + | elasticsearch_discovery_zen_ping_unicast_hosts = 127.0.0.1: | ||
| + | |||
| + | # Change the following setting if you are running into problems with timeouts during Elasticsearch cluster discovery. | ||
| + | # The setting is specified in milliseconds, | ||
| + | # | ||
| + | |||
| + | # the following settings allow to change the bind addresses for the Elasticsearch client in graylog2 | ||
| + | # these settings are empty by default, letting Elasticsearch choose automatically, | ||
| + | # override them here or in the ' | ||
| + | # refer to http:// | ||
| + | # for special values here | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # The total amount of time discovery will look for other Elasticsearch nodes in the cluster | ||
| + | # before giving up and declaring the current node master. | ||
| + | # | ||
| + | |||
| + | # Analyzer (tokenizer) to use for message and full_message field. The " | ||
| + | # All supported analyzers are: standard, simple, whitespace, stop, keyword, pattern, language, snowball, custom | ||
| + | # Elasticsearch documentation: | ||
| + | # Note that this setting only takes effect on newly created indices. | ||
| + | elasticsearch_analyzer = standard | ||
| + | |||
| + | # Global request timeout for Elasticsearch requests (e. g. during search, index creation, or index time-range | ||
| + | # calculations) based on a best-effort to restrict the runtime of Elasticsearch operations. | ||
| + | # Default: 1m | ||
| + | # | ||
| + | |||
| + | # Time interval for index range information cleanups. This setting defines how often stale index range information | ||
| + | # is being purged from the database. | ||
| + | # Default: 1h | ||
| + | # | ||
| + | |||
| + | # Batch size for the Elasticsearch output. This is the maximum (!) number of messages the Elasticsearch output | ||
| + | # module will get at once and write to Elasticsearch in a batch call. If the configured batch size has not been | ||
| + | # reached within output_flush_interval seconds, everything that is available will be flushed at once. Remember | ||
| + | # that every outputbuffer processor manages its own batch and performs its own batch write calls. | ||
| + | # (" | ||
| + | output_batch_size = 500 | ||
| + | |||
| + | # Flush interval (in seconds) for the Elasticsearch output. This is the maximum amount of time between two | ||
| + | # batches of messages written to Elasticsearch. It is only effective at all if your minimum number of messages | ||
| + | # for this time period is less than output_batch_size * outputbuffer_processors. | ||
| + | output_flush_interval = 1 | ||
| + | |||
| + | # As stream outputs are loaded only on demand, an output which is failing to initialize will be tried over and | ||
| + | # over again. To prevent this, the following configuration options define after how many faults an output will | ||
| + | # not be tried again for an also configurable amount of seconds. | ||
| + | output_fault_count_threshold = 5 | ||
| + | output_fault_penalty_seconds = 30 | ||
| + | |||
| + | # The number of parallel running processors. | ||
| + | # Raise this number if your buffers are filling up. | ||
| + | processbuffer_processors = 5 | ||
| + | outputbuffer_processors = 3 | ||
| + | |||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # UDP receive buffer size for all message inputs (e. g. SyslogUDPInput). | ||
| + | # | ||
| + | |||
| + | # Wait strategy describing how buffer processors wait on a cursor sequence. (default: sleeping) | ||
| + | # Possible types: | ||
| + | # - yielding | ||
| + | # | ||
| + | # - sleeping | ||
| + | # | ||
| + | # - blocking | ||
| + | # High throughput, low latency, higher CPU usage. | ||
| + | # - busy_spinning | ||
| + | # | ||
| + | processor_wait_strategy = blocking | ||
| + | |||
| + | # Size of internal ring buffers. Raise this if raising outputbuffer_processors does not help anymore. | ||
| + | # For optimum performance your LogMessage objects in the ring buffer should fit in your CPU L3 cache. | ||
| + | # Start server with --statistics flag to see buffer utilization. | ||
| + | # Must be a power of 2. (512, 1024, 2048, ...) | ||
| + | ring_size = 65536 | ||
| + | |||
| + | inputbuffer_ring_size = 65536 | ||
| + | inputbuffer_processors = 2 | ||
| + | inputbuffer_wait_strategy = blocking | ||
| + | |||
| + | # Enable the disk based message journal. | ||
| + | message_journal_enabled = true | ||
| + | |||
| + | # The directory which will be used to store the message journal. The directory must me exclusively used by Graylog and | ||
| + | # must not contain any other files than the ones created by Graylog itself. | ||
| + | message_journal_dir = / | ||
| + | |||
| + | # Journal hold messages before they could be written to Elasticsearch. | ||
| + | # For a maximum of 12 hours or 5 GB whichever happens first. | ||
| + | # During normal operation the journal will be smaller. | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Number of threads used exclusively for dispatching internal events. Default is 2. | ||
| + | # | ||
| + | |||
| + | # EXPERIMENTAL: | ||
| + | # Every failed indexing attempt is logged by default and made visible in the web-interface. You can enable | ||
| + | # the experimental dead letters feature to write every message that was not successfully indexed into the | ||
| + | # MongoDB " | ||
| + | # letter should work fine already but it is not heavily tested yet and will get more features in future | ||
| + | # releases. | ||
| + | dead_letters_enabled = false | ||
| + | |||
| + | # How many seconds to wait between marking node as DEAD for possible load balancers and starting the actual | ||
| + | # shutdown process. Set to 0 if you have no status checking load balancers in front. | ||
| + | lb_recognition_period_seconds = 3 | ||
| + | |||
| + | # Every message is matched against the configured streams and it can happen that a stream contains rules which | ||
| + | # take an unusual amount of time to run, for example if its using regular expressions that perform excessive backtracking. | ||
| + | # This will impact the processing of the entire server. To keep such misbehaving stream rules from impacting other | ||
| + | # streams, Graylog limits the execution time for each stream. | ||
| + | # The default values are noted below, the timeout is in milliseconds. | ||
| + | # If the stream matching for one stream took longer than the timeout value, and this happened more than " | ||
| + | # that stream is disabled and a notification is shown in the web interface. | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Length of the interval in seconds in which the alert conditions for all streams should be checked | ||
| + | # and alarms are being sent. | ||
| + | # | ||
| + | |||
| + | # Since 0.21 the graylog2 server supports pluggable output modules. This means a single message can be written to multiple | ||
| + | # outputs. The next setting defines the timeout for a single output module, including the default output module where all | ||
| + | # messages end up. | ||
| + | # | ||
| + | # Time in milliseconds to wait for all message outputs to finish writing a single message. | ||
| + | # | ||
| + | |||
| + | # Time in milliseconds after which a detected stale master node is being rechecked on startup. | ||
| + | # | ||
| + | |||
| + | # Time in milliseconds which Graylog is waiting for all threads to stop on shutdown. | ||
| + | # | ||
| + | |||
| + | # MongoDB connection string | ||
| + | # See http:// | ||
| + | # Django : 2015-12-28 | ||
| + | # default: mongodb_uri = mongodb:// | ||
| + | mongodb_uri = mongodb:// | ||
| + | |||
| + | # Authenticate against the MongoDB server | ||
| + | # | ||
| + | |||
| + | # Use a replica set instead of a single host | ||
| + | # | ||
| + | |||
| + | # Increase this value according to the maximum connections your MongoDB server can handle from a single client | ||
| + | # if you encounter MongoDB connection problems. | ||
| + | mongodb_max_connections = 100 | ||
| + | |||
| + | # Number of threads allowed to be blocked by MongoDB connections multiplier. Default: 5 | ||
| + | # If mongodb_max_connections is 100, and mongodb_threads_allowed_to_block_multiplier is 5, | ||
| + | # then 500 threads can block. More than that and an exception will be thrown. | ||
| + | # http:// | ||
| + | mongodb_threads_allowed_to_block_multiplier = 5 | ||
| + | |||
| + | # Drools Rule File (Use to rewrite incoming log messages) | ||
| + | # See: https:// | ||
| + | #rules_file = / | ||
| + | |||
| + | # Email transport | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # Django : 2015-12-28 | ||
| + | # default: unset | ||
| + | transport_email_enabled = true | ||
| + | transport_email_hostname = smtp.dmz.nausch.org | ||
| + | transport_email_port = 25 | ||
| + | transport_email_use_auth = false | ||
| + | transport_email_use_tls = false | ||
| + | transport_email_use_ssl = false | ||
| + | transport_email_auth_username = graylog-admin@nausch.org | ||
| + | transport_email_auth_password = 6zmNsgdrD4x1! | ||
| + | transport_email_subject_prefix = [graylog] | ||
| + | transport_email_from_email = graylog-admin@nausch.org | ||
| + | |||
| + | # Specify and uncomment this if you want to include links to the stream in your stream alert mails. | ||
| + | # This should define the fully qualified base url to your web interface exactly the same way as it is accessed by your users. | ||
| + | # | ||
| + | # Django : 2015-12-28 | ||
| + | # default: transport_email_web_interface_url = https:// | ||
| + | transport_email_web_interface_url = https:// | ||
| + | |||
| + | # The default connect timeout for outgoing HTTP connections. | ||
| + | # Values must be a positive duration (and between 1 and 2147483647 when converted to milliseconds). | ||
| + | # Default: 5s | ||
| + | # | ||
| + | |||
| + | # The default read timeout for outgoing HTTP connections. | ||
| + | # Values must be a positive duration (and between 1 and 2147483647 when converted to milliseconds). | ||
| + | # Default: 10s | ||
| + | # | ||
| + | |||
| + | # The default write timeout for outgoing HTTP connections. | ||
| + | # Values must be a positive duration (and between 1 and 2147483647 when converted to milliseconds). | ||
| + | # Default: 10s | ||
| + | # | ||
| + | |||
| + | # HTTP proxy for outgoing HTTP connections | ||
| + | # | ||
| + | |||
| + | # Disable the optimization of Elasticsearch indices after index cycling. This may take some load from Elasticsearch | ||
| + | # on heavily used systems with large indices, but it will decrease search performance. The default is to optimize | ||
| + | # cycled indices. | ||
| + | # | ||
| + | |||
| + | # Optimize the index down to <= index_optimization_max_num_segments. A higher number may take some load from Elasticsearch | ||
| + | # on heavily used systems with large indices, but it will decrease search performance. The default is 1. | ||
| + | # | ||
| + | |||
| + | # The threshold of the garbage collection runs. If GC runs take longer than this threshold, a system notification | ||
| + | # will be generated to warn the administrator about possible problems with the system. Default is 1 second. | ||
| + | # | ||
| + | |||
| + | # Connection timeout for a configured LDAP server (e. g. ActiveDirectory) in milliseconds. | ||
| + | # | ||
| + | |||
| + | # Enable collection of Graylog-related metrics into MongoDB | ||
| + | # WARNING: This will add *a lot* of data into your MongoDB database on a regular interval (1 second)! | ||
| + | # DEPRECATED: This setting and the respective feature will be removed in a future version of Graylog. | ||
| + | # | ||
| + | |||
| + | # Disable the use of SIGAR for collecting system stats | ||
| + | # | ||
| + | |||
| + | # Amount of time of inactivity after which collectors are flagged as inactive (Default: 1 minute) | ||
| + | # | ||
| + | |||
| + | # Amount of time after which inactive collectors are purged (Default: 14 days) | ||
| + | # | ||
| + | |||
| + | # The default cache time for dashboard widgets. (Default: 10 seconds, minimum: 1 second) | ||
| + | # | ||
| + | |||
| + | # Automatically load content packs in " | ||
| + | # | ||
| + | |||
| + | # The directory which contains content packs which should be loaded on the first start of Graylog. | ||
| + | content_packs_dir = / | ||
| + | |||
| + | # A comma-separated list of content packs (files in " | ||
| + | # the first start of Graylog. | ||
| + | content_packs_auto_load = grok-patterns.json</ | ||
| + | |||
| + | === Start des Daemon === | ||
| + | Unsere Konfigurationsänderungen werden mit Hilfe von **mongo** der MongoDB Shell vorgenommen. Dieses JavaScript stellt die Benutzerschnittstelle zum eigentlichen MongoDN-Daemon zur Verfügung. Damit sich der Client mit dem Server auch verbinden kann, muss der Server natürlich laufen; wir starten also nun unsere NoSQL-Datenbank mit folgendem Befehl. | ||
| + | # systemctl start graylog-server.service | ||
| + | |||
| + | Den Serverstatus können wir wie folgt abfragen. | ||
| + | # systemctl status graylog-server.service | ||
| + | |||
| + | < | ||
| + | <font style=" | ||
| + | | ||
| + | | ||
| + | Docs: http:// | ||
| + | Main PID: 5057 (graylog-server) | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | Dec 28 14:27:40 vml000117.dmz.nausch.org systemd[1]: Started Graylog server. | ||
| + | Dec 28 14:27:40 vml000117.dmz.nausch.org systemd[1]: Starting Graylog server...</ | ||
| + | </ | ||
| + | |||
| + | Der erfolgreiche Start des Servers wird auch in dessen Logdatei protokolliert. | ||
| + | # / | ||
| + | |||
| + | < | ||
| + | Dec 28 14:27:40 vml000117.dmz.nausch.org systemd[1]: Starting Graylog server... | ||
| + | [root@vml000117 yum.repos.d]# | ||
| + | 2015-12-28T14: | ||
| + | 2015-12-28T14: | ||
| + | 2015-12-28T14: | ||
| + | 2015-12-28T14: | ||
| + | 2015-12-28T14: | ||
| + | 2015-12-28T14: | ||
| + | 2015-12-28T14: | ||
| + | 2015-12-28T14: | ||
| + | 2015-12-28T14: | ||
| + | 2015-12-28T14: | ||
| + | 2015-12-28T14: | ||
| + | 2015-12-28T14: | ||
| + | 2015-12-28T14: | ||
| + | 2015-12-28T14: | ||
| + | 2015-12-28T14: | ||
| + | 2015-12-28T14: | ||
| + | 2015-12-28T14: | ||
| + | 2015-12-28T14: | ||
| + | 2015-12-28T14: | ||
| + | 2015-12-28T14: | ||
| + | 2015-12-28T14: | ||
| + | 2015-12-28T14: | ||
| + | 2015-12-28T14: | ||
| + | 2015-12-28T14: | ||
| + | 2015-12-28T14: | ||
| + | 2015-12-28T14: | ||
| + | 2015-12-28T14: | ||
| + | 2015-12-28T14: | ||
| + | 2015-12-28T14: | ||
| + | 2015-12-28T14: | ||
| + | |||
| + | === automatischer Start des Daemon === | ||
| + | Damit der Daemon beim Hochfahren unseres Servers automatisch gestartet wird, nutzen wir folgenden Befehl. | ||
| + | # systemctl enable graylog-server.service | ||
| + | |||
| + | Created symlink from / | ||
| + | |||
| + | Wollen wir wissen, ob die Autostartfunktion bereits gesetzt ist, verwenden wir diesen Aufruf. | ||
| + | # systemctl is-enabled graylog-server.service | ||
| + | |||
| + | enabled | ||
| + | |||
| + | ==== graylog-web ==== | ||
| + | Die Konfiguration des **graylog-server Daemons** haben wir im vorherigen Kapitel erfolgreich abgeschlossen. Was nun noch fehlt, ist die **graylog-web** GUI. Die Installation des zugehörigen RPM-Paketes **graylog-web** hatten wir bereits im Abschnitt **[[centos: | ||
| + | |||
| + | === / | ||
| + | Zunächst binden wir den Web-Server auf // | ||
| + | # vim / | ||
| + | |||
| + | <file bash / | ||
| + | # Django : 2015-12-28 | ||
| + | # default: GRAYLOG_WEB_HTTP_ADDRESS=" | ||
| + | GRAYLOG_WEB_HTTP_ADDRESS=" | ||
| + | GRAYLOG_WEB_HTTP_PORT=" | ||
| + | |||
| + | # Might be used to adjust the Java heap size. (i.e. " | ||
| + | GRAYLOG_WEB_JAVA_OPTS="" | ||
| + | |||
| + | # Pass some extra args to graylog-web. (i.e. " | ||
| + | GRAYLOG_WEB_ARGS="" | ||
| + | |||
| + | # Program that will be used to wrap the graylog-web command. Useful to | ||
| + | # support programs like authbind. | ||
| + | GRAYLOG_COMMAND_WRAPPER=""</ | ||
| + | |||
| + | === Apache Reverse-Proxy === | ||
| + | Da der **graylog-web**-Daemon __ohne__ Root-Rechte gestartet wird, können wir nur unprivilegierte Ports (Ports größer als 1024) definieren. Da wir aber die Graylog-Web-GUI auch von außen, über einen TLS geschützten Transportkanal ansprechen wollen, nutzen wir einen Apache-vHOST als Reverse-Proxy. | ||
| + | |||
| + | Dazu legen wir uns folgende vHOST-Datei an. | ||
| + | # vim / | ||
| + | <file apache / | ||
| + | # Django : 2015-12-28 | ||
| + | # vHost graylog | ||
| + | # | ||
| + | |||
| + | < | ||
| + | ServerAdmin webmaster@nausch.org | ||
| + | ServerName graylog.nausch.org | ||
| + | |||
| + | RewriteEngine on | ||
| + | RewriteCond %{HTTPS} off | ||
| + | RewriteRule (.*) https:// | ||
| + | |||
| + | # Welche Logdateien sollen beschrieben werden | ||
| + | CustomLog logs/ | ||
| + | ErrorLog | ||
| + | </ | ||
| + | < | ||
| + | ServerAdmin webmaster@nausch.org | ||
| + | ServerName graylog.nausch.org | ||
| + | ServerPath / | ||
| + | |||
| + | # Wer soll Zugriff auf die Webseite(n) bekommen? | ||
| + | <Proxy *> | ||
| + | Options +FollowSymLinks +Multiviews -Indexes | ||
| + | AllowOverride None | ||
| + | AuthType Basic | ||
| + | AuthName "Fuer den Zugriff auf den Webserver bitte Anmeldedaten eingeben!" | ||
| + | AuthBasicProvider ldap | ||
| + | AuthLDAPUrl ldaps:// | ||
| + | AuthLDAPBindDN cn=Technischer_User, | ||
| + | AuthLDAPBindPassword " | ||
| + | AuthLDAPBindAuthoritative on | ||
| + | Require ldap-user django icinga2 | ||
| + | </ | ||
| + | |||
| + | # Welcher Inhalt soll angezeigt bzw. auf welchen Server sollen die HTTP-Requests weitergeleitet werden? | ||
| + | ProxyRequests Off | ||
| + | ProxyPreserveHost On | ||
| + | ProxyPass / http:// | ||
| + | ProxyPassReverse / http:// | ||
| + | |||
| + | # Welche Logdateien sollen beschrieben werden | ||
| + | CustomLog logs/ | ||
| + | ErrorLog | ||
| + | |||
| + | # Absicherung der Übertragung mit Hilfe von TLS | ||
| + | # Konfiguration bei Verwendung von mod_gnutls | ||
| + | < | ||
| + | < | ||
| + | # Django : 2015-10-29 - TLS-Verschlüsselung mit Hilfe von mod_gnutls | ||
| + | GnuTLSEnable on | ||
| + | # Definition der anzubietenden Protokolle und Ciphers | ||
| + | GnuTLSPriorities PFS: | ||
| + | # Schlüsseldatei, | ||
| + | GnuTLSKeyFile / | ||
| + | # Zertifikatsdatei inkl. ggf. notwendiger Zwischen- und Root-Zertifikaten | ||
| + | # 1) Server-Zertifikat, | ||
| + | GnuTLSCertificateFile / | ||
| + | # Definition der Schlüssellänge für DHE und ECDHE | ||
| + | # DHE Schlüssel mit einer Schlüssellänge von 4096 Bit verwenden; dieser wird 1x pro Tag via cronjob | ||
| + | # (/ | ||
| + | GnuTLSDHFile / | ||
| + | # Session-Tickets für Clients nicht anbieten (dieser könnte versuchen über Tickets die Session zu cachen). | ||
| + | GnuTLSSessionTickets off | ||
| + | </ | ||
| + | </ | ||
| + | # Konfiguration bei Verwendung von mod_ssl | ||
| + | < | ||
| + | < | ||
| + | # Django : 2015-10-04 - TLS-Verschlüsselung mit Hilfe von mod_ssl | ||
| + | SSLEngine on | ||
| + | # Definition der anzubietenden Protokolle | ||
| + | SSLProtocol All -SSLv2 -SSLv3 | ||
| + | # Definition der Cipher | ||
| + | SSLCipherSuite " | ||
| + | # Schlüsseldatei, | ||
| + | SSLCertificateKeyFile / | ||
| + | # Zertifikatsdatei, | ||
| + | SSLCertificateFile / | ||
| + | # Zertifikatsdatei des bzw. der Intermediate-Zertifikate(s) | ||
| + | SSLCertificateChainFile / | ||
| + | # Änderung der Cipherorder der Clienets verneinen | ||
| + | SSLHonorCipherOrder on | ||
| + | # TLS 1.0 Kompremmierung deaktivieren (CRIME attacks) | ||
| + | SSLCompression off | ||
| + | </ | ||
| + | </ | ||
| + | |||
| + | # special stuff ### | ||
| + | |||
| + | # HTTP Strict Transport Security (HSTS), bei dem der Server dem Client im HTTP-Header mitteilt, | ||
| + | # dass dieser nur noch verschlüsselt mit dem Server kommunizieren soll. | ||
| + | Header always set Strict-Transport-Security " | ||
| + | |||
| + | # This header enables the Cross-site scripting (XSS) filter built into most recent web browsers. | ||
| + | # It's usually enabled by default anyway, so the role of this header is to re-enable the filter for | ||
| + | # this particular website if it was disabled by the user. | ||
| + | # https:// | ||
| + | Header set X-XSS-Protection "1; mode=block" | ||
| + | |||
| + | # when serving user-supplied content, include a X-Content-Type-Options: | ||
| + | # to disable content-type sniffing on some browsers. | ||
| + | # https:// | ||
| + | # currently suppoorted in IE > 8 http:// | ||
| + | # http:// | ||
| + | # ' | ||
| + | Header set X-Content-Type-Options nosniff | ||
| + | |||
| + | # config to don't allow the browser to render the page inside an frame or iframe | ||
| + | # and avoid clickjacking http:// | ||
| + | # if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri | ||
| + | # https:// | ||
| + | header set X-Frame-Options SAMEORIGIN | ||
| + | |||
| + | </ | ||
| + | </ | ||
| + | |||
| + | Bevor wir die Änderungen am Apache Webseerver scharf schalten, testen wir unsere Konfiguration noch auf syntaktische Fehler. | ||
| + | # apachectl -t | ||
| + | |||
| + | Syntax OK | ||
| + | |||
| + | Ist alles O.K. brauchen wir nur noch den Apache-Webserver einmal durchstarten. | ||
| + | # systemctl restart httpd.service | ||
| + | |||
| + | === / | ||
| + | Die installationsspezifische kundenindividuelle Konfiguration der **graylog-web GUI** wird über dessen Konfigurationsdatei // | ||
| + | |||
| + | Wie schon bei der Konfiguration des **[[centos: | ||
| + | # pwgen -N 1 -s 128 | ||
| + | |||
| + | KM2OhCgRuTJe9f7bOr0uOtGcX45TB5kmF4L4Ty44bRUlu1y2qh0eDbs613Bv4QFk0ftGzuASpSW5DDBqpSKIlcdI39WdVHBSo33AoPZgKiABd7G7FduhKIMZVjiE7lod | ||
| + | |||
| + | Diese beiden Werte hinterlegen wir nun in der Konfigurationsdatei unseres **graylog-web**-Daemon und passen anschließend die Konfigurationsoptionen unserer Umgebung an. Änderungen an den Default-Werten sind mit **Django : < | ||
| + | # vim / | ||
| + | |||
| + | <file bash / | ||
| + | # Django : 2015-12-28 | ||
| + | # default: graylog2-server.uris="" | ||
| + | graylog2-server.uris=" | ||
| + | |||
| + | # Learn how to configure custom logging in the documentation: | ||
| + | # http:// | ||
| + | |||
| + | # Secret key | ||
| + | # ~~~~~ | ||
| + | # The secret key is used to secure cryptographics functions. Set this to a long and randomly generated string. | ||
| + | # If you deploy your application to several instances be sure to use the same key! | ||
| + | # Generate for example with: pwgen -N 1 -s 96 | ||
| + | # Django : 2015-12-28 | ||
| + | # default: application.secret="" | ||
| + | application.secret=" | ||
| + | |||
| + | # Web interface timezone | ||
| + | # Graylog stores all timestamps in UTC. To properly display times, set the default timezone of the interface. | ||
| + | # If you leave this out, Graylog will pick your system default as the timezone. Usually you will want to configure it explicitly. | ||
| + | # timezone=" | ||
| + | # Django : 2015-12-28 | ||
| + | # default: unset | ||
| + | timezone=" | ||
| + | |||
| + | # Message field limit | ||
| + | # Your web interface can cause high load in your browser when you have a lot of different message fields. The default | ||
| + | # limit of message fields is 100. Set it to 0 if you always want to get all fields. They are for example used in the | ||
| + | # search result sidebar or for autocompletion of field names. | ||
| + | field_list_limit=100 | ||
| + | |||
| + | # Use this to run Graylog with a path prefix | ||
| + | # | ||
| + | |||
| + | # You usually do not want to change this. | ||
| + | application.global=lib.Global | ||
| + | |||
| + | # Global timeout for communication with Graylog server nodes; default: 5s | ||
| + | # | ||
| + | |||
| + | # Accept any server certificate without checking for validity; required if using self-signed certificates. | ||
| + | # Default: true | ||
| + | # graylog2.client.accept-any-certificate=true | ||
| + | </ | ||
| + | |||
| + | === Start des Daemon === | ||
| + | Nun ist es an der Zeit den die Web-GUI **graylog-web** zu starten. | ||
| + | # systemctl start graylog-web.service | ||
| + | |||
| + | Den Serverstatus können wir wie folgt abfragen. | ||
| + | # systemctl status graylog-web.service | ||
| + | |||
| + | < | ||
| + | <font style=" | ||
| + | | ||
| + | | ||
| + | Docs: http:// | ||
| + | Main PID: 8767 (graylog-web) | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | Dec 28 15:21:52 vml000117.dmz.nausch.org systemd[1]: Started Graylog web interface. | ||
| + | Dec 28 15:21:52 vml000117.dmz.nausch.org systemd[1]: Starting Graylog web interface... | ||
| + | Dec 28 15:21:53 vml000117.dmz.nausch.org graylog-web[8767]: | ||
| + | </ | ||
| + | |||
| + | Der erfolgreiche Start des Servers wird auch in dessen Logdatei protokolliert. | ||
| + | # / | ||
| + | |||
| + | < | ||
| + | Application started (Prod) | ||
| + | |||
| + | 2015-12-28T15: | ||
| + | Listening for HTTP on / | ||
| + | |||
| + | === automatischer Start des Daemon === | ||
| + | Damit der Daemon beim Hochfahren unseres Servers automatisch gestartet wird, nutzen wir folgenden Befehl. | ||
| + | # systemctl enable graylog-web.service | ||
| + | |||
| + | Created symlink from / | ||
| + | |||
| + | Wollen wir wissen, ob die Autostartfunktion bereits gesetzt ist, verwenden wir diesen Aufruf. | ||
| + | # systemctl is-enabled graylog-web.service | ||
| + | |||
| + | enabled | ||
| + | |||
| + | ==== Paketfilter/ | ||
| + | === graylog-web === | ||
| + | Unter **CentOS 7** wird als Standard-Firewall die dynamische **firewalld** verwendet. Ein großer Vorteil der dynamischen Paketfilterregeln ist unter anderem, dass zur Aktivierung der neuen Firewall-Regel(n) nicht der Daemon durchgestartet werden muss und somit alle aktiven Verbindungen kurz getrennt werden. Sondern unsere Änderungen können **// | ||
| + | |||
| + | Laufen der **Apache-Reverse-Proxy** und der **Graylog-Servers** nicht auf dem gleichen Host, benötigen wir noch eine Firewall-Definition die diesen Kommunkikationsweg definiert. Dabei soll in unserem Konfigurationsbeispiel die **Source-IP** die **10.0.0.97** und die **Destination-IP** die Ip-Adresse **10.0.0.117** sein. | ||
| + | |||
| + | Mit Hilfe des Programms **firewall-cmd** legen wir nun eine **permanente** Regel in der Zone **public**, dies entspricht in unserem Beispiel das Netzwerk-Interface **eth0** mit der IP **10.0.0.117** an. Als Source-IP geben wir die beiden IP-Adressen der Apache-Webservers, | ||
| + | |||
| + | # firewall-cmd --permanent --zone=public --add-rich-rule=" | ||
| + | |||
| + | success | ||
| + | |||
| + | Zum Aktivieren brauchen wir nun nur einen reload des Firewall-Daemon vornehmen. | ||
| + | # firewall-cmd --reload | ||
| + | |||
| + | Fragen wir nun den Regelsatz unserer **iptables**-basieten Firewall ab, finden wir in der Chain **IN_public_allow** unsere aktivierten Regeln. | ||
| + | |||
| + | # iptables -nvL IN_public_allow | ||
| + | < | ||
| + | pkts bytes target | ||
| + | 0 0 ACCEPT | ||
| + | |||
| + | === syslog (Port 514) === | ||
| + | Der **graylog-server** Daemon läuft mit den Rechten des Users **graylog**; | ||
| + | |||
| + | # ps aux | grep graylog-server | ||
| + | |||
| + | <code bash> | ||
| + | graylog | ||
| + | |||
| + | Somit können wir keine bei der Definition von **[[https:// | ||
| + | |||
| + | Da wir aber aus Sicherheitsgründen **keinenfalls** den graylog Daemon mit root-Rechten wollen, müssen wir uns anders behelfen. Zunächst definieren wir uns einen input-Kanal und weisen diesem dem Port **10514**. | ||
| + | |||
| + | {{ : | ||
| + | |||
| + | Nun werden wir mit Hilfe von **iptables** den Port **514** auf den zuvor definierten **10514** mappen. Dazu brauchen wir zwei Dinge: | ||
| + | - **Masquerading** \\ Mit Hilfe des zugehörigen Kernel-Moduls werden ankommende Pakete auf Port 514 auf Port 10514 " | ||
| + | - **DNAT**-Regel \\ Aus Sicht unseres **iptables**-Filter wollen wir das Pakete auf den Ziel-Port **514** den der Client verwendet hat, auf auf den Port **10514** unseres graylog INPUTs umschreiben; | ||
| + | |||
| + | Zum Schluß führen wir nun noch einen Reload des Daemon **firewalld** durch. | ||
| + | # firewall-cmd --reload | ||
| + | |||
| + | success | ||
| + | |||
| + | Wenn wir jetzt einen Blick in die definierten INPUTs unseres graylog-Servers werfen, werden wir die angekommenen und verarbeiteten syslog-Meldungen unserer " | ||
| + | |||
| + | {{ : | ||
| + | |||
| + | |||
| + | ===== LOGIN ===== | ||
| + | Die Web-GUI unseres graylog-Servers erreichen wir über die URL, die wir bei der Konfiguration des **[[centos: | ||
| + | |||
| + | {{ : | ||
| + | |||
| + | Nach erfolgter Erstanmeldung befinden wir uns im ""// | ||
| + | |||
| + | {{ : | ||
| + | |||
| + | ===== rsyslog ===== | ||
| + | Nachdem wir unseren graylog-Server erfolgreich vorbereitet haben, werden wir nun unsere Linux-Hosts so konfigurieren, | ||
| + | |||
| + | Das Weiterleiten der Syslogmeldungen ist nicht sonderlich schwer zu konfigurieren. Das Wichtigste das es zu beachten gibt, ist, dass die Meldungen gemäß dem **[[https:// | ||
| + | |||
| + | ==== UDP ==== | ||
| + | Im ersten Konfigurationsbeispiel wollen wir die Syslog-Meldungen an den Port 514 per **[[https:// | ||
| + | Dazu tragen wir am Ende der Konfigurationsdatei des **rsyslog**-Daemon folgende Zeile ein. | ||
| + | # vim / | ||
| + | |||
| + | <code bash># ### begin forwarding rule ### | ||
| + | # The statement between the begin ... end define a SINGLE forwarding | ||
| + | # rule. They belong together, do NOT split them. If you create multiple | ||
| + | # forwarding rules, duplicate the whole block! | ||
| + | # Remote Logging (we use TCP for reliable delivery) | ||
| + | # | ||
| + | # An on-disk queue is created for this action. If the remote host is | ||
| + | # down, messages are spooled to disk and sent when it is up again. | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # remote host is: name/ | ||
| + | #*.* @@remote-host: | ||
| + | # | ||
| + | # Django : 2015-06-12 | ||
| + | $template GRAYLOGRFC5424,"< | ||
| + | *.* @10.0.0.117: | ||
| + | # | ||
| + | # ### end of the forwarding rule ###</ | ||
| + | |||
| + | Zum Aktivieren der Konfigurationsänderung starten wir den rsyslog-Daemon einmal durch. | ||
| + | # systemctl restart rsyslog.service | ||
| + | |||
| + | ==== TCP ==== | ||
| + | Möchte man die die Syslog-Meldungen an den Port 514 per **[[https:// | ||
| + | Am Ende der Konfigurationsdatei des **rsyslog**-Daemon tragen wir folgende Zeile ein. | ||
| + | # vim / | ||
| + | |||
| + | <code bash># ### begin forwarding rule ### | ||
| + | # The statement between the begin ... end define a SINGLE forwarding | ||
| + | # rule. They belong together, do NOT split them. If you create multiple | ||
| + | # forwarding rules, duplicate the whole block! | ||
| + | # Remote Logging (we use TCP for reliable delivery) | ||
| + | # | ||
| + | # An on-disk queue is created for this action. If the remote host is | ||
| + | # down, messages are spooled to disk and sent when it is up again. | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # remote host is: name/ | ||
| + | #*.* @@remote-host: | ||
| + | # | ||
| + | # Django : 2015-06-12 | ||
| + | $template GRAYLOGRFC5424,"< | ||
| + | *.* @@10.0.0.117: | ||
| + | # | ||
| + | # ### end of the forwarding rule ###</ | ||
| + | |||
| + | Zum Aktivieren der Konfigurationsänderung starten wir den rsyslog-Daemon einmal durch. | ||
| + | # systemctl restart rsyslog.service | ||
| + | |||
| + | ===== TLS-Absicherung des rsyslog-/ | ||
| + | An zwei wesentlichen Stellen läuft in unserem Konfigurationsbeispiel noch völlig ungeschützt ab. Der erste Punkt den es zu bemängeln gilt, ist die Autorisierung der Datenquellen; | ||
| + | |||
| + | Zur Lösung dieser beiden unstrittigen Schwachstellen werden wir uns nun mit der Absicherung durch **TLS**((**T**ransport **L**ayer **S**ecurity)) näher beschäftigen. Die für die TLS-Verschlüsselung notwendigen // | ||
| + | |||
| + | ==== OpenSSL ==== | ||
| + | Bei der Standardinstallation unseres Systems wurde in der Regel bereits das Paket **openssl** installiert. Ein kurzer Blick in die RPM-Datenbank schafft hierzu Gewissheit. | ||
| + | # yum list openssl | ||
| + | |||
| + | | ||
| + | | ||
| + | |||
| + | Sollte das Paket noch fehlen, installieren wir dies einfach via: | ||
| + | # yum install openssl | ||
| + | Was uns das Paket **// | ||
| + | # rpm -qil openssl | ||
| + | < | ||
| + | Epoch : 1 | ||
| + | Version | ||
| + | Release | ||
| + | Architecture: | ||
| + | Install Date: Tue 15 Dec 2015 09:59:48 AM CET | ||
| + | Group : System Environment/ | ||
| + | Size : 1611101 | ||
| + | License | ||
| + | Signature | ||
| + | Source RPM : openssl-1.0.1e-51.el7_2.1.src.rpm | ||
| + | Build Date : Mon 14 Dec 2015 06:19:50 AM CET | ||
| + | Build Host : worker1.bsys.centos.org | ||
| + | Relocations : (not relocatable) | ||
| + | Packager | ||
| + | Vendor | ||
| + | URL : http:// | ||
| + | Summary | ||
| + | Description : | ||
| + | The OpenSSL toolkit provides support for secure communications between | ||
| + | machines. OpenSSL includes a certificate management tool and shared | ||
| + | libraries which provide various cryptographic algorithms and | ||
| + | protocols. | ||
| + | /etc/pki/CA | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | |||
| + | ==== Zertifikatserstellung ==== | ||
| + | Wie bereits erwähnt benötigen wir für die TLS-Verschlüsselung // | ||
| + | |||
| + | Technisch gesehen unterscheiden sich Zertifikate einer " | ||
| + | |||
| + | Leider bietet uns weder **graylog** noch **rsyslog** so eine komfortable scriptgesteuerte Unterstützung, | ||
| + | * **CA** | ||
| + | * **Serverzertifikat** für den graylog-Server | ||
| + | * **Clientzertifikate** für die rsyslog-Clients | ||
| + | |||
| + | Die jeweils benötigten Arbeitsschritte sind bei allen drei Stellen jeweils die gleichen: | ||
| + | * Generieren eines // | ||
| + | * Erstellen unseres //**Public Key mit zusätzlichen Daten**//, auch bekannt als **[[http:// | ||
| + | * Unterschreiben des //**CSR**// mit dem privaten Schlüssel unserer **CA**((**C**ertification **A**uthority)); | ||
| + | * Verteilen der erzeugten Zertifikate. | ||
| + | |||
| + | Sowohl bei der Laufzeit des Root-Zertifikates unserer **CA** wie auch bei den Client- und Server-Zertifikaten orientieren wir uns am Beispiel von **[[centos: | ||
| + | |||
| + | ==== Root CA - Zertifizierungsstelle ==== | ||
| + | Als erstes werden wir uns nun unsere Zertifizierungsstelle mit besagtem 30-jährigen Root CA Zertifikats erstellen. | ||
| + | |||
| + | === Vorbereitung === | ||
| + | Anlegen fehlender Dateien: | ||
| + | # echo " | ||
| + | |||
| + | # touch / | ||
| + | |||
| + | # mkdir / | ||
| + | |||
| + | Somit befindet sich in unserem Pfad **/ | ||
| + | # ll /etc/pki/CA | ||
| + | |||
| + | < | ||
| + | drwxr-xr-x. 2 root root 6 Dec 14 06:18 certs | ||
| + | drwxr-xr-x. 2 root root 6 Dec 14 06:18 crl | ||
| + | drwxr-xr-x. 2 root root 3 Jan 3 19:40 csrs | ||
| + | -rw-r--r--. 1 root root 0 Jan 3 19:40 index.txt | ||
| + | drwxr-xr-x. 2 root root 6 Dec 14 06:18 newcerts | ||
| + | drwx------. 2 root root 6 Dec 14 06:18 private | ||
| + | -rw-r--r--. 1 root root 3 Jan 3 19:40 serial</ | ||
| + | |||
| + | === privaten Schlüssel und selbstsigniertes Root CA Zertifikat erstellen === | ||
| + | Als erstes werden wir uns nun den privaten Schlüssel unserer Root CA generieren, in zugehöriges Zertifikat erzeugen und dieses mit dem privaten Schlüssel der CA unterschreiben; | ||
| + | |||
| + | < | ||
| + | <font style=" | ||
| + | -keyout / | ||
| + | -out / | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | <font style=" | ||
| + | ..................................................................................................................................................................++ | ||
| + | .......................++ | ||
| + | writing new private key to '/ | ||
| + | Enter PEM pass phrase: </ | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | into your certificate request. | ||
| + | What you are about to enter is what is called a Distinguished Name or a DN. | ||
| + | There are quite a few fields but you can leave some blank | ||
| + | For some fields there will be a default value, | ||
| + | If you enter ' | ||
| + | ----- | ||
| + | Country Name (2 letter code) [XX]:</ | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | </ | ||
| + | |||
| + | === privaten Schlüssel der Root CA schützen === | ||
| + | Damit nun __ausschließlich__ der Benuter **root** die Schlüsseldatei mit dem privaten Schlüssel unserer CA lesen kann, passen wir die Dateirechte entsprechend an. | ||
| + | # chmod 400 / | ||
| + | |||
| + | === Root CA Zertifikat ausgeben === | ||
| + | Möchten wir den Inhalt unseres Root Ca Zertifikates ausgeben und ansehen, verwenden wir den folgenden **openssl**-Aufruf. | ||
| + | # openssl x509 -noout -text -in / | ||
| + | |||
| + | < | ||
| + | Data: | ||
| + | Version: 3 (0x2) | ||
| + | Serial Number: 10930264216988842831 (0x97b01964f2c87b4f) | ||
| + | Signature Algorithm: sha512WithRSAEncryption | ||
| + | Issuer: C=DE, ST=Bayern, L=Pliening, O=nausch.org, | ||
| + | Validity | ||
| + | Not Before: Jan 3 22:57:12 2016 GMT | ||
| + | Not After : Dec 26 22:57:12 2045 GMT | ||
| + | Subject: C=DE, ST=Bayern, L=Pliening, O=nausch.org, | ||
| + | Subject Public Key Info: | ||
| + | Public Key Algorithm: rsaEncryption | ||
| + | Public-Key: (4096 bit) | ||
| + | Modulus: | ||
| + | 00: | ||
| + | ed: | ||
| + | 0c: | ||
| + | 2a: | ||
| + | b6: | ||
| + | 84: | ||
| + | b2: | ||
| + | 8f: | ||
| + | cc: | ||
| + | 20: | ||
| + | a7: | ||
| + | 80: | ||
| + | fe: | ||
| + | 84: | ||
| + | 54: | ||
| + | 44: | ||
| + | b5: | ||
| + | eb: | ||
| + | 96: | ||
| + | be: | ||
| + | 2c: | ||
| + | 67: | ||
| + | 50: | ||
| + | d7: | ||
| + | af: | ||
| + | 7b: | ||
| + | c7: | ||
| + | 71: | ||
| + | 71: | ||
| + | 5d: | ||
| + | c5: | ||
| + | af: | ||
| + | ea: | ||
| + | f5: | ||
| + | 69:4e:97 | ||
| + | Exponent: 65537 (0x10001) | ||
| + | X509v3 extensions: | ||
| + | X509v3 Subject Key Identifier: | ||
| + | F7: | ||
| + | X509v3 Authority Key Identifier: | ||
| + | keyid: | ||
| + | |||
| + | X509v3 Basic Constraints: | ||
| + | CA:TRUE | ||
| + | Signature Algorithm: sha512WithRSAEncryption | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | Das Zertifikat im **PEM**-Format (Base64-kodiertes Zertifikat) können wir uns ganz einfach ausgeben lassen um es so z.B. auf einem Clientrechner abzulegen. | ||
| + | # cat / | ||
| + | |||
| + | < | ||
| + | MIIGEzCCA/ | ||
| + | VQQGEwJERTEPMA0GA1UECAwGQmF5ZXJuMREwDwYDVQQHDAhQbGllbmluZzETMBEG | ||
| + | A1UECgwKbmF1c2NoLm9yZzEeMBwGA1UECwwVWmVydGlmaXppZXJ1bmdzc3RlbGxl | ||
| + | MRMwEQYDVQQDDApncmF5bG9nIENBMSIwIAYJKoZIhvcNAQkBFhNjYS1hZG1pbkBu | ||
| + | YXVzY2gub3JnMB4XDTE2MDEwMzIyNTcxMloXDTQ1MTIyNjIyNTcxMlowgZ8xCzAJ | ||
| + | BgNVBAYTAkRFMQ8wDQYDVQQIDAZCYXllcm4xETAPBgNVBAcMCFBsaWVuaW5nMRMw | ||
| + | EQYDVQQKDApuYXVzY2gub3JnMR4wHAYDVQQLDBVaZXJ0aWZpemllcnVuZ3NzdGVs | ||
| + | bGUxEzARBgNVBAMMCmdyYXlsb2cgQ0ExIjAgBgkqhkiG9w0BCQEWE2NhLWFkbWlu | ||
| + | QG5hdXNjaC5vcmcwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDK9Lwr | ||
| + | DUNqY/ | ||
| + | tobNG9SdTLas/ | ||
| + | Bj/ | ||
| + | ZKc9hCLZRfj4AXA7KrLdGIBlgWFmwp0axUtM4IkFKP5ABgCHwROsrtx++wDnlYQ9 | ||
| + | g+l+SK5apcDWrnW5nlSWS4uGSGeetzHQsAalKUQIVAVILA2Nmb8xWUj0PbW9S8ZW | ||
| + | 0FmQb7gSl4Gt2OsB9EFMs1nAJmfpS+VZXpZ7wt/ | ||
| + | x22xNbPq5Sxlft/ | ||
| + | poADM9dk2NKDOfQ9lBz0aMGov6/ | ||
| + | 5sfTCFADP0uy/ | ||
| + | 1y40viRBgO5bERNOBcX/ | ||
| + | 6EGD64+I6qIDLPUWDe+ylxCgC34Nl+EN1GlOlwIDAQABo1AwTjAdBgNVHQ4EFgQU | ||
| + | 98MEcCU4LwKCXV8vfxtml0Of2A4wHwYDVR0jBBgwFoAU98MEcCU4LwKCXV8vfxtm | ||
| + | l0Of2A4wDAYDVR0TBAUwAwEB/ | ||
| + | +HQuSVcL/ | ||
| + | rMAlDRcC7v3FDUgSznwJZ3JqRwx79EgKHQVteHoESVC3K/ | ||
| + | Ftb5+WS4qdNtnw6BZx86xTm8Xdlz8Y2c2h70Ingo1tLvKgeFV/ | ||
| + | EH76Jl5qzbrxA2z78dnNhmUyGEbKJCjx6EfY1zAMt0pdGQ+dnFlAFWAeU3Ui0ZlO | ||
| + | wcfw1ZLQQ40qnIumXBiIWnMKdfKzRt6kAg4S4+dCebXJIKjassoeQrj16rU8t27e | ||
| + | FSkRLr0NUJPlGYWyevNIBlB9utTzOmQ1C2x0Om8CxX1MLXhwQ/ | ||
| + | li7uBI9xmnSmgChBGbSwRtAd0DyP050CY35dOPW0KblmevyhlCQNOLsx9RzL1ROi | ||
| + | DfpZnC9jaKnuAtdFaEd+ELm8WHV+j0zYL3L4punoM9cfbEQ1CQTyloxpFqnze1Bt | ||
| + | GvwI43c9PMRaRTOBJchzTurhxSxeDDRIm37s+rGCdWp9gF8HMFyBN9vhohdSMZt/ | ||
| + | zgtVUbTgAw189mA/ | ||
| + | MH57rU8Qj6XjV0L6BKn2WX1peJKvfys= | ||
| + | -----END CERTIFICATE-----</ | ||
| + | |||
| + | === Root CA Zertifikat beim Client abspeichern === | ||
| + | Nun müssen wir nur noch dafür sorgen, dass unser //**Root CA Zertifikat**// | ||
| + | # vim / | ||
| + | |||
| + | < | ||
| + | MIIGEzCCA/ | ||
| + | VQQGEwJERTEPMA0GA1UECAwGQmF5ZXJuMREwDwYDVQQHDAhQbGllbmluZzETMBEG | ||
| + | A1UECgwKbmF1c2NoLm9yZzEeMBwGA1UECwwVWmVydGlmaXppZXJ1bmdzc3RlbGxl | ||
| + | MRMwEQYDVQQDDApncmF5bG9nIENBMSIwIAYJKoZIhvcNAQkBFhNjYS1hZG1pbkBu | ||
| + | YXVzY2gub3JnMB4XDTE2MDEwMzIyNTcxMloXDTQ1MTIyNjIyNTcxMlowgZ8xCzAJ | ||
| + | BgNVBAYTAkRFMQ8wDQYDVQQIDAZCYXllcm4xETAPBgNVBAcMCFBsaWVuaW5nMRMw | ||
| + | EQYDVQQKDApuYXVzY2gub3JnMR4wHAYDVQQLDBVaZXJ0aWZpemllcnVuZ3NzdGVs | ||
| + | bGUxEzARBgNVBAMMCmdyYXlsb2cgQ0ExIjAgBgkqhkiG9w0BCQEWE2NhLWFkbWlu | ||
| + | QG5hdXNjaC5vcmcwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDK9Lwr | ||
| + | DUNqY/ | ||
| + | tobNG9SdTLas/ | ||
| + | Bj/ | ||
| + | ZKc9hCLZRfj4AXA7KrLdGIBlgWFmwp0axUtM4IkFKP5ABgCHwROsrtx++wDnlYQ9 | ||
| + | g+l+SK5apcDWrnW5nlSWS4uGSGeetzHQsAalKUQIVAVILA2Nmb8xWUj0PbW9S8ZW | ||
| + | 0FmQb7gSl4Gt2OsB9EFMs1nAJmfpS+VZXpZ7wt/ | ||
| + | x22xNbPq5Sxlft/ | ||
| + | poADM9dk2NKDOfQ9lBz0aMGov6/ | ||
| + | 5sfTCFADP0uy/ | ||
| + | 1y40viRBgO5bERNOBcX/ | ||
| + | 6EGD64+I6qIDLPUWDe+ylxCgC34Nl+EN1GlOlwIDAQABo1AwTjAdBgNVHQ4EFgQU | ||
| + | 98MEcCU4LwKCXV8vfxtml0Of2A4wHwYDVR0jBBgwFoAU98MEcCU4LwKCXV8vfxtm | ||
| + | l0Of2A4wDAYDVR0TBAUwAwEB/ | ||
| + | +HQuSVcL/ | ||
| + | rMAlDRcC7v3FDUgSznwJZ3JqRwx79EgKHQVteHoESVC3K/ | ||
| + | Ftb5+WS4qdNtnw6BZx86xTm8Xdlz8Y2c2h70Ingo1tLvKgeFV/ | ||
| + | EH76Jl5qzbrxA2z78dnNhmUyGEbKJCjx6EfY1zAMt0pdGQ+dnFlAFWAeU3Ui0ZlO | ||
| + | wcfw1ZLQQ40qnIumXBiIWnMKdfKzRt6kAg4S4+dCebXJIKjassoeQrj16rU8t27e | ||
| + | FSkRLr0NUJPlGYWyevNIBlB9utTzOmQ1C2x0Om8CxX1MLXhwQ/ | ||
| + | li7uBI9xmnSmgChBGbSwRtAd0DyP050CY35dOPW0KblmevyhlCQNOLsx9RzL1ROi | ||
| + | DfpZnC9jaKnuAtdFaEd+ELm8WHV+j0zYL3L4punoM9cfbEQ1CQTyloxpFqnze1Bt | ||
| + | GvwI43c9PMRaRTOBJchzTurhxSxeDDRIm37s+rGCdWp9gF8HMFyBN9vhohdSMZt/ | ||
| + | zgtVUbTgAw189mA/ | ||
| + | MH57rU8Qj6XjV0L6BKn2WX1peJKvfys= | ||
| + | -----END CERTIFICATE-----</ | ||
| + | |||
| + | ==== graylog-server Zertifikat erzeugen ==== | ||
| + | Nachdem wir den ersten wichtigen Schritt - Erstellen unserer eigenen CA erfolgreich abgeschlossen haben, können wir uns nun dem zweiten Punkt, der Generierung des **[[centos: | ||
| + | |||
| + | === Schlüssel für das Serverzertifikat erzeugen === | ||
| + | Nachdem wir nun unsere eigene CA erstellt haben, machen wir uns daran, endlich für unseren Server ein Zertifikat herausgeben. Hierzu erzeugen wir uns wieder als erstes einen 4096 Bit langen RSA Schlüssel, den wir mit AES 256 verschlüsselt auf der Platte abgelegt lassen. Da OpenSSL keine leere Passphrase zulässt braucht die Passphrase diesmal nicht sonderlich geheim sein, da wir diese im Anschluss ohnehin sofort wieder entfernen werden. | ||
| + | |||
| + | Die Eingaben sind auch hier zur besseren Unterscheidung fett und kursiv in der Farbe < | ||
| + | |||
| + | < | ||
| + | <font style=" | ||
| + | </ | ||
| + | < | ||
| + | <font style=" | ||
| + | .......................................................................................................................................................................................................................++ | ||
| + | ........................................................................................................................................................................................++ | ||
| + | e is 65537 (0x10001) | ||
| + | Enter pass phrase for serverkey.pem: | ||
| + | <font style=" | ||
| + | </ | ||
| + | |||
| + | Wie schon erwähnt, entfernen wir die Passphrase nun wieder, in dem wir bei der Frage **Enter pass phrase:** einfach die Taste **[ENTER]** drücken. | ||
| + | < | ||
| + | <font style=" | ||
| + | </ | ||
| + | < | ||
| + | <font style=" | ||
| + | writing RSA key</ | ||
| + | </ | ||
| + | |||
| + | Wie schon zuvor schützen wir auch hier den Serverschlüssel über die Dateirechte. | ||
| + | < | ||
| + | <font style=" | ||
| + | </ | ||
| + | |||
| + | Da wir die Schlüsseldatei mit der unsicheren Passphrase nicht mehr benötigen, vernichten wir die zugehörige Datei. | ||
| + | < | ||
| + | <font style=" | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 90%> | ||
| + | **Wichtig**: | ||
| + | Damit **graylog** den soeben erzeugten Schlüssel später auch laden kann, müssen wir diesen erst noch in das passende **[[https:// | ||
| + | java.lang.IllegalArgumentException: | ||
| + | </ | ||
| + | |||
| + | Wir konvertieren also noch den Schlüssel in das passende Format mit folgendem **openssl** Kommando. | ||
| + | < | ||
| + | <font style=" | ||
| + | -inform pem -out / | ||
| + | </ | ||
| + | |||
| + | Graylog selbst läuft mit den Nutzerrechten des Users **graylog**; | ||
| + | < | ||
| + | <font style=" | ||
| + | </ | ||
| + | |||
| + | |||
| + | === CSR erstellen === | ||
| + | Nachdem wir unseren privaten Schlüssel erzeugt haben, können wir uns nun unserem **CSR**((**C**ertificate **S**igning **R**equest)) widmen. Wie schon zuvor, sind die Eingaben auch hier zur besseren Unterscheidung fett und kursiv in der Farbe < | ||
| + | |||
| + | < | ||
| + | <font style=" | ||
| + | -out / | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | <font style=" | ||
| + | into your certificate request. | ||
| + | What you are about to enter is what is called a Distinguished Name or a DN. | ||
| + | There are quite a few fields but you can leave some blank | ||
| + | For some fields there will be a default value, | ||
| + | If you enter ' | ||
| + | ----- | ||
| + | Country Name (2 letter code) [XX]:</ | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | Please enter the following ' | ||
| + | to be sent with your certificate request | ||
| + | A challenge password []: | ||
| + | An optional company name []:</ | ||
| + | </ | ||
| + | |||
| + | === CSR ausgeben === | ||
| + | Möchten wir den Inhalt unseres Certificate Signing Request ausgeben und ansehen, verwenden wir den folgenden openssl-Aufruf. | ||
| + | # openssl req -noout -text -in / | ||
| + | < | ||
| + | Data: | ||
| + | Version: 0 (0x0) | ||
| + | Subject: C=DE, ST=Bayern, L=Pliening, O=nausch.org, | ||
| + | Subject Public Key Info: | ||
| + | Public Key Algorithm: rsaEncryption | ||
| + | Public-Key: (4096 bit) | ||
| + | Modulus: | ||
| + | 00: | ||
| + | 6a: | ||
| + | 19: | ||
| + | f5: | ||
| + | 9b: | ||
| + | 47: | ||
| + | 60: | ||
| + | cb: | ||
| + | 1f: | ||
| + | 58: | ||
| + | 03: | ||
| + | 44: | ||
| + | bd: | ||
| + | 2b: | ||
| + | 45: | ||
| + | e3: | ||
| + | 21: | ||
| + | 9b: | ||
| + | 8f: | ||
| + | 74: | ||
| + | 8c: | ||
| + | d7: | ||
| + | 7b: | ||
| + | 09: | ||
| + | 94: | ||
| + | 4f: | ||
| + | 5c: | ||
| + | 53: | ||
| + | 99: | ||
| + | fc: | ||
| + | ac: | ||
| + | d3: | ||
| + | 20: | ||
| + | c8: | ||
| + | 18:88:79 | ||
| + | Exponent: 65537 (0x10001) | ||
| + | Attributes: | ||
| + | a0:00 | ||
| + | Signature Algorithm: sha512WithRSAEncryption | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | Wie auch schon beim Root CA Zertifikat können wir uns auch den CSR BASE64 kodiert ausgeben lassen. | ||
| + | # cat / | ||
| + | |||
| + | < | ||
| + | MIIE9TCCAt0CAQAwga8xCzAJBgNVBAYTAkRFMQ8wDQYDVQQIDAZCYXllcm4xETAP | ||
| + | BgNVBAcMCFBsaWVuaW5nMRMwEQYDVQQKDApuYXVzY2gub3JnMRYwFAYDVQQLDA1J | ||
| + | VC1Nb25pdG9yaW5nMSYwJAYDVQQDDB1ncmF5bG9nLXNlcnZlci5kbXoubmF1c2No | ||
| + | Lm9yZzEnMCUGCSqGSIb3DQEJARYYZ3JheWxvZy1hZG1pbkBuYXVzY2gub3JnMIIC | ||
| + | IjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEApIliha9WswQMNIZK47hq9CNs | ||
| + | f7xMpk7NLv44rXQZod7LNvrEtIUxHmIFpfX18HuUaSGzSK4nHL29Ui+b7q3PX/ | ||
| + | D6SMCpHgdf1H6RE1lL2GtZ5HHPi3E8RgaLWPLo8Ndf56QdjnKx7L1/ | ||
| + | BzsL5M0fwws5ehU4Cd+oKTxzxeFYUB5L78s8Y+a+0qtUt84DaTsf1YBavpivo8k/ | ||
| + | qIREIV31NugRrj99USmAUWS9lv8yNpxmH5yLSvD0DVArO+oyLxwiD8qHeNUf3kxF | ||
| + | ZMRCrtO8R5jFGRUX29PjHU6EdtK6q9uXA/ | ||
| + | N3BmqrK+8q/ | ||
| + | NYuX2JR4+tfXxb0mbzAorAwIXpuY90x7SIyoPCqaAdBRf52Lo1sJomBCgfwYwVNW | ||
| + | n3jVO5aUWXC3RKH5j4giVZ7mZ+RPtYvd4nynCblSkSMrfxNcK/ | ||
| + | b5ZTKgHk+q8tPq+TxAWI1L6ZdNG+ty3kvCA9NDbkDjX803FYYOyRtys1dk2u6kms | ||
| + | S2STAc46OOo4jC9ajq/ | ||
| + | jw1CdxyPMYqxZkwYiHkCAwEAAaAAMA0GCSqGSIb3DQEBDQUAA4ICAQArNcYetNbW | ||
| + | PZFgGuEF+ADcguZbTHHcOkbyjni6O2wv9/ | ||
| + | wbpVWdUTGMGIAuGxgsnedwhB0R1y4mchJeVD3jwuE+28pdGN0uVxN7PRTZKQT3Gx | ||
| + | H+cBwGaMenspXy2W9p67d1YjPV52VhPbH4hUzljxS7+zsjN/ | ||
| + | 2gXPB4ZD329YVvf8p2ywM5UzBb5v2MDMMy89oKB+ClsnmEerRCwquylP3nAnJFm0 | ||
| + | 0JgIqMgi8/ | ||
| + | fuzobV39ZgQ/ | ||
| + | 06qcY9XkCeAcQ5Y6lWBiadI4Ra3iJgqDPBMW4VONvOGeb4ql/ | ||
| + | wYJ8K2AJvhJyi6f3KeSV8AIX+Go9gqLo8lLVrC0U8vljBOHgGi+YTpUxNkPUsiJ5 | ||
| + | LH4KqN33S4YsE9TFho/ | ||
| + | oFiopp09WyZcfMQNq4BbFe5h2aVjy+pr+xZBAWTcs/ | ||
| + | 25DUgkHeOsXPG1KMWQpqbrZ+fe3qRW2OEQ== | ||
| + | -----END CERTIFICATE REQUEST-----</ | ||
| + | |||
| + | === CSR bei CA zum Signieren vorlegen === | ||
| + | Damit unsere CA den gerade erstellten CSR prüfen und signieren kann, müssen wir den Certificate Signing Request der CA vorlegen. Im Fall unsere graylog-Server Zertificates können wir die CSR-Datei einfach an Ort und Stelle kopieren. | ||
| + | # cp / | ||
| + | |||
| + | === CSR durch die CA prüfen und signieren === | ||
| + | Nun prüfen wir die Angaben des CSR und signieren den öffentlichen Schlüssel des CSRs mit dem privaten Schlüssel unserer CA; dies wir auch als Zertifikatsgenerierung bezeichnet. Diese Arbeit erledigen wir mit Hilfe des folgenden **openssl**-Aufrufs. Auch hier sind die Eingaben zur besseren Unterscheidung fett und kursiv in der Farbe < | ||
| + | |||
| + | < | ||
| + | <font style=" | ||
| + | -out / | ||
| + | </ | ||
| + | |||
| + | Die Option **days** setzen wir dabei auf die bereits erwähnten 30 Jahre, was 10950 Tage entspricht. Bei der Frage nach der Passphrase des privaten Schlüssels geben wir das Passwort an, welches wir bei der **[[centos: | ||
| + | |||
| + | < | ||
| + | <font style=" | ||
| + | Enter pass phrase for / | ||
| + | <font style=" | ||
| + | Signature ok | ||
| + | Certificate Details: | ||
| + | Serial Number: 0 (0x0) | ||
| + | Validity | ||
| + | Not Before: Jan 3 23:24:25 2016 GMT | ||
| + | Not After : Dec 26 23:24:25 2045 GMT | ||
| + | Subject: | ||
| + | countryName | ||
| + | stateOrProvinceName | ||
| + | organizationName | ||
| + | organizationalUnitName | ||
| + | commonName | ||
| + | emailAddress | ||
| + | X509v3 extensions: | ||
| + | X509v3 Basic Constraints: | ||
| + | CA:FALSE | ||
| + | Netscape Comment: | ||
| + | OpenSSL Generated Certificate | ||
| + | X509v3 Subject Key Identifier: | ||
| + | 7A: | ||
| + | X509v3 Authority Key Identifier: | ||
| + | keyid: | ||
| + | |||
| + | Certificate is to be certified until Dec 26 23:24:25 2045 GMT (10950 days) | ||
| + | Sign the certificate? | ||
| + | <font style=" | ||
| + | |||
| + | 1 out of 1 certificate requests certified, commit? [y/ | ||
| + | <font style=" | ||
| + | Data Base Updated</ | ||
| + | </ | ||
| + | |||
| + | === erstellte Zertifikat dem gralog-server zur Verfügung stellen === | ||
| + | Als letzten Schritt stellen wir nun das gerade erzeugte Server-Zertifikat dem graylog-server zur Verfügung. Hierzu kopieren wir einfach das gerade generierte Zertifikat an Ort und Stelle. | ||
| + | # cp / | ||
| + | |||
| + | === Zertifikat ausgeben === | ||
| + | Wollen wir den Inhalt unseres gerade erstellten Zertifikates ausgeben, können wir folgenden **openssl**-Aufruf verwenden. | ||
| + | # openssl x509 -noout -text -in / | ||
| + | |||
| + | < | ||
| + | Data: | ||
| + | Version: 3 (0x2) | ||
| + | Serial Number: 0 (0x0) | ||
| + | Signature Algorithm: sha512WithRSAEncryption | ||
| + | Issuer: C=DE, ST=Bayern, L=Pliening, O=nausch.org, | ||
| + | Validity | ||
| + | Not Before: Jan 3 23:24:25 2016 GMT | ||
| + | Not After : Dec 26 23:24:25 2045 GMT | ||
| + | Subject: C=DE, ST=Bayern, O=nausch.org, | ||
| + | Subject Public Key Info: | ||
| + | Public Key Algorithm: rsaEncryption | ||
| + | Public-Key: (4096 bit) | ||
| + | Modulus: | ||
| + | 00: | ||
| + | 6a: | ||
| + | 19: | ||
| + | f5: | ||
| + | 9b: | ||
| + | 47: | ||
| + | 60: | ||
| + | cb: | ||
| + | 1f: | ||
| + | 58: | ||
| + | 03: | ||
| + | 44: | ||
| + | bd: | ||
| + | 2b: | ||
| + | 45: | ||
| + | e3: | ||
| + | 21: | ||
| + | 9b: | ||
| + | 8f: | ||
| + | 74: | ||
| + | 8c: | ||
| + | d7: | ||
| + | 7b: | ||
| + | 09: | ||
| + | 94: | ||
| + | 4f: | ||
| + | 5c: | ||
| + | 53: | ||
| + | 99: | ||
| + | fc: | ||
| + | ac: | ||
| + | d3: | ||
| + | 20: | ||
| + | c8: | ||
| + | 18:88:79 | ||
| + | Exponent: 65537 (0x10001) | ||
| + | X509v3 extensions: | ||
| + | X509v3 Basic Constraints: | ||
| + | CA:FALSE | ||
| + | Netscape Comment: | ||
| + | OpenSSL Generated Certificate | ||
| + | X509v3 Subject Key Identifier: | ||
| + | 7A: | ||
| + | X509v3 Authority Key Identifier: | ||
| + | keyid: | ||
| + | |||
| + | Signature Algorithm: sha512WithRSAEncryption | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | ==== rsyslog Client-Zertifikate ==== | ||
| + | Was uns nun noch für unser Glück fehlt, ist ein Server-Zertifikat für den **[[centos: | ||
| + | |||
| + | Im folgenden Konfigurationsbeispiel werden wir für den Host **vml.dmz.nausch.org** ein Clientzertifikat erstellen. | ||
| + | === Schlüssel für das Clientzertifikat erzeugen === | ||
| + | Wie auch schon beim graylog-server Zertifikat erzeugen wir uns zunächst einen 4096 Bit langen RSA Schlüssel, den wir mit AES 256 verschlüsselt auf der Platte abgelegt lassen. Da OpenSSL keine leere Passphrase zulässt braucht die Passphrase diesmal nicht sonderlich geheim sein, da wir diese im Anschluss ohnehin sofort wieder entfernen werden. | ||
| + | |||
| + | Die Eingaben sind auch hier zur besseren Unterscheidung fett und kursiv in der Farbe < | ||
| + | |||
| + | < | ||
| + | <font style=" | ||
| + | </ | ||
| + | < | ||
| + | <font style=" | ||
| + | .......................................................................................................................................................................................................................++ | ||
| + | ........................................................................................................................................................................................++ | ||
| + | e is 65537 (0x10001) | ||
| + | Enter pass phrase for clientkey.pem: | ||
| + | <font style=" | ||
| + | </ | ||
| + | |||
| + | Anschließend entfernen wir die Passphrase nun wieder, in dem wir bei der Frage **Enter pass phrase:** einfach die Taste **[ENTER]** drücken. | ||
| + | < | ||
| + | <font style=" | ||
| + | </ | ||
| + | < | ||
| + | <font style=" | ||
| + | writing RSA key</ | ||
| + | </ | ||
| + | |||
| + | Wie schon zuvor schützen wir auch hier den Serverschlüssel über die Dateirechte. | ||
| + | < | ||
| + | <font style=" | ||
| + | </ | ||
| + | |||
| + | Da wir die Schlüsseldatei mit der unsicheren Passphrase nicht mehr benötigen, vernichten wir die zugehörige Datei. | ||
| + | < | ||
| + | <font style=" | ||
| + | </ | ||
| + | |||
| + | === CSR erstellen === | ||
| + | Nachdem wir unseren privaten Schlüssel erzeugt haben, können wir uns nun unserem **CSR**((**C**ertificate **S**igning **R**equest)) widmen. Wie schon zuvor, sind die Eingaben auch hier zur besseren Unterscheidung fett und kursiv in der Farbe < | ||
| + | |||
| + | < | ||
| + | <font style=" | ||
| + | -out / | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | <font style=" | ||
| + | into your certificate request. | ||
| + | What you are about to enter is what is called a Distinguished Name or a DN. | ||
| + | There are quite a few fields but you can leave some blank | ||
| + | For some fields there will be a default value, | ||
| + | If you enter ' | ||
| + | ----- | ||
| + | Country Name (2 letter code) [XX]:</ | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | <font style=" | ||
| + | Please enter the following ' | ||
| + | to be sent with your certificate request | ||
| + | A challenge password []: | ||
| + | An optional company name []:</ | ||
| + | </ | ||
| + | |||
| + | === CSR ausgeben === | ||
| + | Möchten wir den Inhalt unseres Certificate Signing Request ausgeben und ansehen, verwenden wir den folgenden openssl-Aufruf. | ||
| + | # openssl req -noout -text -in / | ||
| + | |||
| + | < | ||
| + | Data: | ||
| + | Version: 0 (0x0) | ||
| + | Subject: C=DE, ST=Bayern, L=Pliening, O=nausch.org, | ||
| + | Subject Public Key Info: | ||
| + | Public Key Algorithm: rsaEncryption | ||
| + | Public-Key: (4096 bit) | ||
| + | Modulus: | ||
| + | 00: | ||
| + | cd: | ||
| + | ea: | ||
| + | 7a: | ||
| + | a6: | ||
| + | 6e: | ||
| + | a4: | ||
| + | e6: | ||
| + | 0f: | ||
| + | 2e: | ||
| + | 35: | ||
| + | 06: | ||
| + | 40: | ||
| + | e9: | ||
| + | 56: | ||
| + | e5: | ||
| + | 09: | ||
| + | cc: | ||
| + | 85: | ||
| + | 0f: | ||
| + | 57: | ||
| + | a9: | ||
| + | c3: | ||
| + | 3c: | ||
| + | 93: | ||
| + | aa: | ||
| + | 4d: | ||
| + | 4e: | ||
| + | 02: | ||
| + | ba: | ||
| + | 59: | ||
| + | cf: | ||
| + | 9c: | ||
| + | 40: | ||
| + | b7:b3:39 | ||
| + | Exponent: 65537 (0x10001) | ||
| + | Attributes: | ||
| + | a0:00 | ||
| + | Signature Algorithm: sha256WithRSAEncryption | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | Wie auch schon beim graylog-server Zertifikat können wir uns auch den CSR BASE64 kodiert ausgeben lassen. | ||
| + | # cat / | ||
| + | |||
| + | < | ||
| + | MIIE+DCCAuACAQAwgbIxCzAJBgNVBAYTAkRFMQ8wDQYDVQQIDAZCYXllcm4xETAP | ||
| + | BgNVBAcMCFBsaWVuaW5nMRMwEQYDVQQKDApuYXVzY2gub3JnMRYwFAYDVQQLDA1J | ||
| + | VC1Nb25pdG9yaW5nMSkwJwYDVQQDDCByc3lzbG9nLnZtbDAwMDAzNy5kbXoubmF1 | ||
| + | c2NoLm9yZzEnMCUGCSqGSIb3DQEJARYYZ3JheWxvZy1hZG1pbkBuYXVzY2gub3Jn | ||
| + | MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA6mVcmjs+qS1/ | ||
| + | pFP7cDD9yL4A/ | ||
| + | KzaH6YXxG/ | ||
| + | WFoYBvFhIJgP3EwwTu/ | ||
| + | evIuq/ | ||
| + | 0c1WdkGLQ/ | ||
| + | 8sVBTBe3dcqtdjd+pvKFEMXj7pWUstJRzFmWyuQPlsF7iUJQYQFsMzIznXJXokWS | ||
| + | 8L33R2/ | ||
| + | lu7pOLmSdImTMaZeyt342fjq/ | ||
| + | V7eDs7FOSDYeV5RlHqk/ | ||
| + | SEdZeGlbaWypyqEjVnpH90nPJbUdN4OE/ | ||
| + | z/ | ||
| + | lK59JJpeTYTovBI3IKJk+f0Vg5qhWXL+Kivf+PMR8ArguQ6uuJPtozxIBlpadG1i | ||
| + | yZ34It6bXjm9ogn6n70+HYc38y+fNZpesMZ6ZgyGT/ | ||
| + | 6/ | ||
| + | tH0lGjHsodjHMbz7RB0vaZEaEY4CY7/ | ||
| + | n3OYuhJhHpTRkoqLk7D2dFg5+JYmerr8SGMJlSHujjZfx85bYRxr7XWhsZp0ZClt | ||
| + | A2R7boq1XYNizlSWxUdoemMqjDw8X1Q6T1GnrknopDFuWDSXdJ9tcsFVI+p1fyOL | ||
| + | Dsv3caARZFDHHj8PG81N2Tt5bKQ5ipRyM2Fa+weKDAJzd3LCnWym1Lky4ppu3P8z | ||
| + | 3+51/ | ||
| + | jxU3wJhu6Q8NlsuHQ8Uefih+ytfrWOgyNIUpTLFWsVfG5XKmCjsmZK+8Hy9y7sdQ | ||
| + | xQmYV+aSWzCL+AXljFkbUxWW3ErestDbmmzOYDiclA88IWP/ | ||
| + | eCfI2XQcMd3CtcmCSC3l4PPpUZYawNNYGzyRsA== | ||
| + | -----END CERTIFICATE REQUEST-----</ | ||
| + | |||
| + | === CSR bei CA zum Signieren vorlegen === | ||
| + | Damit unsere CA den gerade erstellten CSR prüfen und signieren kann, müssen wir den Certificate Signing Request der CA vorlegen. Wir kopieren entweder den gerade erstellten **CSR** via **scp** zum Server auf dem unsere **CA** erstellt hatten, oder wir legen die CSR-Datei mit dem Editor direkt auf dem Server ab. | ||
| + | # vim / | ||
| + | |||
| + | < | ||
| + | MIIE+DCCAuACAQAwgbIxCzAJBgNVBAYTAkRFMQ8wDQYDVQQIDAZCYXllcm4xETAP | ||
| + | BgNVBAcMCFBsaWVuaW5nMRMwEQYDVQQKDApuYXVzY2gub3JnMRYwFAYDVQQLDA1J | ||
| + | VC1Nb25pdG9yaW5nMSkwJwYDVQQDDCByc3lzbG9nLnZtbDAwMDAzNy5kbXoubmF1 | ||
| + | c2NoLm9yZzEnMCUGCSqGSIb3DQEJARYYZ3JheWxvZy1hZG1pbkBuYXVzY2gub3Jn | ||
| + | MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA6mVcmjs+qS1/ | ||
| + | pFP7cDD9yL4A/ | ||
| + | KzaH6YXxG/ | ||
| + | WFoYBvFhIJgP3EwwTu/ | ||
| + | evIuq/ | ||
| + | 0c1WdkGLQ/ | ||
| + | 8sVBTBe3dcqtdjd+pvKFEMXj7pWUstJRzFmWyuQPlsF7iUJQYQFsMzIznXJXokWS | ||
| + | 8L33R2/ | ||
| + | lu7pOLmSdImTMaZeyt342fjq/ | ||
| + | V7eDs7FOSDYeV5RlHqk/ | ||
| + | SEdZeGlbaWypyqEjVnpH90nPJbUdN4OE/ | ||
| + | z/ | ||
| + | lK59JJpeTYTovBI3IKJk+f0Vg5qhWXL+Kivf+PMR8ArguQ6uuJPtozxIBlpadG1i | ||
| + | yZ34It6bXjm9ogn6n70+HYc38y+fNZpesMZ6ZgyGT/ | ||
| + | 6/ | ||
| + | tH0lGjHsodjHMbz7RB0vaZEaEY4CY7/ | ||
| + | n3OYuhJhHpTRkoqLk7D2dFg5+JYmerr8SGMJlSHujjZfx85bYRxr7XWhsZp0ZClt | ||
| + | A2R7boq1XYNizlSWxUdoemMqjDw8X1Q6T1GnrknopDFuWDSXdJ9tcsFVI+p1fyOL | ||
| + | Dsv3caARZFDHHj8PG81N2Tt5bKQ5ipRyM2Fa+weKDAJzd3LCnWym1Lky4ppu3P8z | ||
| + | 3+51/ | ||
| + | jxU3wJhu6Q8NlsuHQ8Uefih+ytfrWOgyNIUpTLFWsVfG5XKmCjsmZK+8Hy9y7sdQ | ||
| + | xQmYV+aSWzCL+AXljFkbUxWW3ErestDbmmzOYDiclA88IWP/ | ||
| + | eCfI2XQcMd3CtcmCSC3l4PPpUZYawNNYGzyRsA== | ||
| + | -----END CERTIFICATE REQUEST-----</ | ||
| + | |||
| + | === CSR durch die CA prüfen und signieren === | ||
| + | Nun prüfen wir die Angaben des CSR und signieren den öffentlichen Schlüssel des CSRs mit dem privaten Schlüssel unserer CA; dies wir auch als Zertifikatsgenerierung bezeichnet. Diese Arbeit erledigen wir mit Hilfe des folgenden **openssl**-Aufrufs. Auch hier sind die Eingaben zur besseren Unterscheidung fett und kursiv in der Farbe < | ||
| + | |||
| + | < | ||
| + | <font style=" | ||
| + | -out / | ||
| + | </ | ||
| + | |||
| + | Die Option **days** setzen wir dabei wieder auf 30 Jahre, was 10950 Tage entspricht. Bei der Frage nach der Passphrase des privaten Schlüssels geben wir das Passwort an, welches wir bei der **[[centos: | ||
| + | |||
| + | < | ||
| + | <font style=" | ||
| + | Enter pass phrase for / | ||
| + | <font style=" | ||
| + | Signature ok | ||
| + | Certificate Details: | ||
| + | Serial Number: 1 (0x1) | ||
| + | Validity | ||
| + | Not Before: Jan 4 10:08:53 2016 GMT | ||
| + | Not After : Dec 27 10:08:53 2045 GMT | ||
| + | Subject: | ||
| + | countryName | ||
| + | stateOrProvinceName | ||
| + | organizationName | ||
| + | organizationalUnitName | ||
| + | commonName | ||
| + | emailAddress | ||
| + | X509v3 extensions: | ||
| + | X509v3 Basic Constraints: | ||
| + | CA:FALSE | ||
| + | Netscape Comment: | ||
| + | OpenSSL Generated Certificate | ||
| + | X509v3 Subject Key Identifier: | ||
| + | 93: | ||
| + | X509v3 Authority Key Identifier: | ||
| + | keyid: | ||
| + | |||
| + | Certificate is to be certified until Dec 27 10:08:53 2045 GMT (10950 days) | ||
| + | Sign the certificate? | ||
| + | <font style=" | ||
| + | |||
| + | 1 out of 1 certificate requests certified, commit? [y/ | ||
| + | <font style=" | ||
| + | Data Base Updated</ | ||
| + | </ | ||
| + | |||
| + | === Zertifikat ausgeben === | ||
| + | # openssl x509 -noout -text -in / | ||
| + | |||
| + | < | ||
| + | Data: | ||
| + | Version: 3 (0x2) | ||
| + | Serial Number: 1 (0x1) | ||
| + | Signature Algorithm: sha512WithRSAEncryption | ||
| + | Issuer: C=DE, ST=Bayern, L=Pliening, O=nausch.org, | ||
| + | Validity | ||
| + | Not Before: Jan 4 10:08:53 2016 GMT | ||
| + | Not After : Dec 27 10:08:53 2045 GMT | ||
| + | Subject: C=DE, ST=Bayern, O=nausch.org, | ||
| + | Subject Public Key Info: | ||
| + | Public Key Algorithm: rsaEncryption | ||
| + | Public-Key: (4096 bit) | ||
| + | Modulus: | ||
| + | 00: | ||
| + | cd: | ||
| + | ea: | ||
| + | 7a: | ||
| + | a6: | ||
| + | 6e: | ||
| + | a4: | ||
| + | e6: | ||
| + | 0f: | ||
| + | 2e: | ||
| + | 35: | ||
| + | 06: | ||
| + | 40: | ||
| + | e9: | ||
| + | 56: | ||
| + | e5: | ||
| + | 09: | ||
| + | cc: | ||
| + | 85: | ||
| + | 0f: | ||
| + | 57: | ||
| + | a9: | ||
| + | c3: | ||
| + | 3c: | ||
| + | 93: | ||
| + | aa: | ||
| + | 4d: | ||
| + | 4e: | ||
| + | 02: | ||
| + | ba: | ||
| + | 59: | ||
| + | cf: | ||
| + | 9c: | ||
| + | 40: | ||
| + | b7:b3:39 | ||
| + | Exponent: 65537 (0x10001) | ||
| + | X509v3 extensions: | ||
| + | X509v3 Basic Constraints: | ||
| + | CA:FALSE | ||
| + | Netscape Comment: | ||
| + | OpenSSL Generated Certificate | ||
| + | X509v3 Subject Key Identifier: | ||
| + | 93: | ||
| + | X509v3 Authority Key Identifier: | ||
| + | keyid: | ||
| + | |||
| + | Signature Algorithm: sha512WithRSAEncryption | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | # cat / | ||
| + | |||
| + | < | ||
| + | MIIGNjCCBB6gAwIBAgIBATANBgkqhkiG9w0BAQ0FADCBnzELMAkGA1UEBhMCREUx | ||
| + | DzANBgNVBAgMBkJheWVybjERMA8GA1UEBwwIUGxpZW5pbmcxEzARBgNVBAoMCm5h | ||
| + | dXNjaC5vcmcxHjAcBgNVBAsMFVplcnRpZml6aWVydW5nc3N0ZWxsZTETMBEGA1UE | ||
| + | AwwKZ3JheWxvZyBDQTEiMCAGCSqGSIb3DQEJARYTY2EtYWRtaW5AbmF1c2NoLm9y | ||
| + | ZzAeFw0xNjAxMDQxMDA4NTNaFw00NTEyMjcxMDA4NTNaMIGfMQswCQYDVQQGEwJE | ||
| + | RTEPMA0GA1UECAwGQmF5ZXJuMRMwEQYDVQQKDApuYXVzY2gub3JnMRYwFAYDVQQL | ||
| + | DA1JVC1Nb25pdG9yaW5nMSkwJwYDVQQDDCByc3lzbG9nLnZtbDAwMDAzNy5kbXou | ||
| + | bmF1c2NoLm9yZzEnMCUGCSqGSIb3DQEJARYYZ3JheWxvZy1hZG1pbkBuYXVzY2gu | ||
| + | b3JnMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA6mVcmjs+qS1/ | ||
| + | s+PNpFP7cDD9yL4A/ | ||
| + | IV6WKzaH6YXxG/ | ||
| + | 9k7UWFoYBvFhIJgP3EwwTu/ | ||
| + | DJ+devIuq/ | ||
| + | tAri0c1WdkGLQ/ | ||
| + | mnPM8sVBTBe3dcqtdjd+pvKFEMXj7pWUstJRzFmWyuQPlsF7iUJQYQFsMzIznXJX | ||
| + | okWS8L33R2/ | ||
| + | 6aWXlu7pOLmSdImTMaZeyt342fjq/ | ||
| + | 9uH5V7eDs7FOSDYeV5RlHqk/ | ||
| + | ZrD7SEdZeGlbaWypyqEjVnpH90nPJbUdN4OE/ | ||
| + | peNAz/ | ||
| + | hvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYE | ||
| + | FJMunPuznVtVigmBtPvCyoYonuqIMB8GA1UdIwQYMBaAFPfDBHAlOC8Cgl1fL38b | ||
| + | ZpdDn9gOMA0GCSqGSIb3DQEBDQUAA4ICAQBaVF0IUx0574XAr46Fv8m0A0m33EpC | ||
| + | q0YfVNeObMxwALDawYzYktHx2U3Zj4qtjttWG4zCYx3EBkHyB83jCUpoBp1Cy+cF | ||
| + | hpMmiqoR/ | ||
| + | ZcMuOTSL/ | ||
| + | fDF1COlJqSNgIkm4JhF0AKkeDCVbDeIeMGEHymx+EJLRGXPZEVOMzFAtIiOd3q8C | ||
| + | yMAH0y5CFRp4dgOTjNE6UBkF4sBrWK5YlhCTbgh/ | ||
| + | pqtpsMi5Uii+H98vtuTi4rWxweiyza4BfO6hrg3iWPXP02HZSOKwLppszii/ | ||
| + | SO4lKAFL5UiXiIBmginPVdpnG7FumYglkvb8vG+J4KHOs1WOOVpSEsoGt5rDiomh | ||
| + | Q1PPcIqUhy9CJDwS6Yf6057eMyhVjJvxqrRNun3etzO8a+KKgtTYroR4kCc94hXa | ||
| + | / | ||
| + | oIbrwlGiDKORtdjLcBvwQshxGWAfXmpPZi1CddLCP4KxPMFeZ3uZ+bE1FgD/ | ||
| + | kY+Z9s9+By5IVw== | ||
| + | -----END CERTIFICATE-----</ | ||
| + | |||
| + | |||
| + | === erstellte Zertifikat dem rsyslog-Daemon auf dem Clientrechner zur Verfügung stellen === | ||
| + | Als letzten Schritt stellen wir nun das gerade erzeugte Server-Zertifikat dem graylog-server zur Verfügung. Entweder kopieren wir das Zertifikat via **scp** auf den Clientrechner oder wir legen das BASE64 kodierte Zertifikat direkt mit dem Editor unserer Wahl auf dem Client Host ab. | ||
| + | # vim / | ||
| + | |||
| + | < | ||
| + | MIIGNjCCBB6gAwIBAgIBATANBgkqhkiG9w0BAQ0FADCBnzELMAkGA1UEBhMCREUx | ||
| + | DzANBgNVBAgMBkJheWVybjERMA8GA1UEBwwIUGxpZW5pbmcxEzARBgNVBAoMCm5h | ||
| + | dXNjaC5vcmcxHjAcBgNVBAsMFVplcnRpZml6aWVydW5nc3N0ZWxsZTETMBEGA1UE | ||
| + | AwwKZ3JheWxvZyBDQTEiMCAGCSqGSIb3DQEJARYTY2EtYWRtaW5AbmF1c2NoLm9y | ||
| + | ZzAeFw0xNjAxMDQxMDA4NTNaFw00NTEyMjcxMDA4NTNaMIGfMQswCQYDVQQGEwJE | ||
| + | RTEPMA0GA1UECAwGQmF5ZXJuMRMwEQYDVQQKDApuYXVzY2gub3JnMRYwFAYDVQQL | ||
| + | DA1JVC1Nb25pdG9yaW5nMSkwJwYDVQQDDCByc3lzbG9nLnZtbDAwMDAzNy5kbXou | ||
| + | bmF1c2NoLm9yZzEnMCUGCSqGSIb3DQEJARYYZ3JheWxvZy1hZG1pbkBuYXVzY2gu | ||
| + | b3JnMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA6mVcmjs+qS1/ | ||
| + | s+PNpFP7cDD9yL4A/ | ||
| + | IV6WKzaH6YXxG/ | ||
| + | 9k7UWFoYBvFhIJgP3EwwTu/ | ||
| + | DJ+devIuq/ | ||
| + | tAri0c1WdkGLQ/ | ||
| + | mnPM8sVBTBe3dcqtdjd+pvKFEMXj7pWUstJRzFmWyuQPlsF7iUJQYQFsMzIznXJX | ||
| + | okWS8L33R2/ | ||
| + | 6aWXlu7pOLmSdImTMaZeyt342fjq/ | ||
| + | 9uH5V7eDs7FOSDYeV5RlHqk/ | ||
| + | ZrD7SEdZeGlbaWypyqEjVnpH90nPJbUdN4OE/ | ||
| + | peNAz/ | ||
| + | hvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYE | ||
| + | FJMunPuznVtVigmBtPvCyoYonuqIMB8GA1UdIwQYMBaAFPfDBHAlOC8Cgl1fL38b | ||
| + | ZpdDn9gOMA0GCSqGSIb3DQEBDQUAA4ICAQBaVF0IUx0574XAr46Fv8m0A0m33EpC | ||
| + | q0YfVNeObMxwALDawYzYktHx2U3Zj4qtjttWG4zCYx3EBkHyB83jCUpoBp1Cy+cF | ||
| + | hpMmiqoR/ | ||
| + | ZcMuOTSL/ | ||
| + | fDF1COlJqSNgIkm4JhF0AKkeDCVbDeIeMGEHymx+EJLRGXPZEVOMzFAtIiOd3q8C | ||
| + | yMAH0y5CFRp4dgOTjNE6UBkF4sBrWK5YlhCTbgh/ | ||
| + | pqtpsMi5Uii+H98vtuTi4rWxweiyza4BfO6hrg3iWPXP02HZSOKwLppszii/ | ||
| + | SO4lKAFL5UiXiIBmginPVdpnG7FumYglkvb8vG+J4KHOs1WOOVpSEsoGt5rDiomh | ||
| + | Q1PPcIqUhy9CJDwS6Yf6057eMyhVjJvxqrRNun3etzO8a+KKgtTYroR4kCc94hXa | ||
| + | / | ||
| + | oIbrwlGiDKORtdjLcBvwQshxGWAfXmpPZi1CddLCP4KxPMFeZ3uZ+bE1FgD/ | ||
| + | kY+Z9s9+By5IVw== | ||
| + | -----END CERTIFICATE-----</ | ||
| + | |||
| + | ===== Konfiguration graylog-server ===== | ||
| + | Nachdem wir die benötigten Schlüssel und Zertifikate erfolgreich erstellt haben, machen wir uns nun an die Konfiguration des **graylog-server**. | ||
| + | |||
| + | ==== Speicherort für Client-Zertifikate ==== | ||
| + | Damit der **graylog-server** die zur Einlieferung von syslog-Daten berechtigten Clients prüfen kann, benötigt dieser ein Verzeichnis, | ||
| + | |||
| + | Zunächst erstellen wir uns ein Verzeichnis. | ||
| + | # mkdir / | ||
| + | |||
| + | Anschließend kopieren wir das Clientzertifikat unseres Clientrechners **vml000037** in das Clientverzeichnis. | ||
| + | # cp / | ||
| + | |||
| + | ==== X.509 Dateien ==== | ||
| + | Bevor wir die Konfiguration über die WEB-GUI unseres **graylog**-Webservers vornehmen, rufen wir uns die benötigten Zertifikate und Schlüssel noch einmal kurz in Erinnerung. So können wir später die Pfadangaben einfach via **cut ' | ||
| + | |||
| + | === CA Root-Zertifikat === | ||
| + | # ll / | ||
| + | |||
| + | < | ||
| + | |||
| + | === private Schlüssel zum Zertifikat === | ||
| + | # ll / | ||
| + | |||
| + | < | ||
| + | |||
| + | === Server-Zertifikat === | ||
| + | # ll / | ||
| + | |||
| + | < | ||
| + | |||
| + | ==== graylog Input ==== | ||
| + | Nun öffnen wir den zu konfigurierenden **Input** in der WEB-GUI mit dem Browser unserer Wahl. | ||
| + | $ firefox https:// | ||
| + | |||
| + | Folgende Optionen sind für die TLS-Aktivierung wichtig: | ||
| + | |||
| + | * **Port** = 6514 | ||
| + | * **TLS cert file (optional)** = / | ||
| + | * **TLS private key file (optional)** = / | ||
| + | * **TLS client authentication (optional)** = required | ||
| + | * **TLS Client Auth Trusted Certs (optional)** = / | ||
| + | * **Enable TLS (optional) | ||
| + | * **TCP keepalive (optional) | ||
| + | |||
| + | {{ : | ||
| + | |||
| + | Über die Schaltfläche **[ Update input ]** verlassen und speichern wir unsere Änderungen. | ||
| + | |||
| + | Mit dem Update des Inputs wird auch der Port **6514** geöffnet; dies können wir mit Hilfe von **netstat** auch abfragen. | ||
| + | # netstat -tulpen | grep 6514 | ||
| + | |||
| + | tcp6 | ||
| + | |||
| + | ==== iptables Paketfilter ==== | ||
| + | Damit sich unsere Clients auch mit dem Port **6514** verbinden können, benötigen wir eine passende Firewall-Regel, | ||
| + | # firewall-cmd --permanent --zone=public --add-rich-rule=" | ||
| + | |||
| + | success | ||
| + | |||
| + | Zum Aktivieren führen wir einen reload des **firewalld** Daemon durch. | ||
| + | # firewall-cmd --reload | ||
| + | |||
| + | Zu guter letzt prüfen wir nun mit Hilfe von **telnet**, ob wir uns vom client **vml000037** mit dem Port **6514** unseres graylog-servers **vml000117** verbinden können | ||
| + | # telnet vml000117 6514 | ||
| + | |||
| + | Trying 10.0.0.117... | ||
| + | Connected to 10.0.0.117. | ||
| + | Escape character is ' | ||
| + | | ||
| + | Connection closed by foreign host. | ||
| + | |||
| + | ===== Konfiguration des rsyslog client ===== | ||
| + | Damit der rsyslog-Daemon TLS-gesicherte Verbindungen aufbauen kann, muss dieser über das Modul **lmnsd_gtls** verfügen. Dieses Modul ist Bestandteil des RPM-Paketes **rsyslog-gnutls**. | ||
| + | |||
| + | ==== rsyslog-gnutls Modul installieren ==== | ||
| + | In aller Regel wird das RPM **rsyslog-gnutls**noch nicht installiert sein, so dass wir dieses nun mit Hilfe von **yum** noch nachholen müssen. | ||
| + | # yum install rsyslog-gnutls -y | ||
| + | |||
| + | Den Inhalt dieses Paketes können wir wir folgt bei Bedarf ermitteln. | ||
| + | # rpm -qil rsyslog-gnutls | ||
| + | < | ||
| + | Version | ||
| + | Release | ||
| + | Architecture: | ||
| + | Install Date: Sun 03 Jan 2016 02:12:09 PM CET | ||
| + | Group : System Environment/ | ||
| + | Size : 33480 | ||
| + | License | ||
| + | Signature | ||
| + | Source RPM : rsyslog-7.4.7-12.el7.src.rpm | ||
| + | Build Date : Fri 20 Nov 2015 12:34:35 PM CET | ||
| + | Build Host : worker1.bsys.centos.org | ||
| + | Relocations : (not relocatable) | ||
| + | Packager | ||
| + | Vendor | ||
| + | URL : http:// | ||
| + | Summary | ||
| + | Description : | ||
| + | The rsyslog-gnutls package contains the rsyslog plugins that provide the | ||
| + | ability to receive syslog messages via upcoming syslog-transport-tls | ||
| + | IETF standard protocol. | ||
| + | / | ||
| + | |||
| + | ==== X.509 Dateien ==== | ||
| + | Wie schon bei der Konfiguration des **graylog-server**' | ||
| + | |||
| + | === Root CA Zertifikat === | ||
| + | # ll / | ||
| + | < | ||
| + | |||
| + | === Client-Zertifikat === | ||
| + | # ll / | ||
| + | < | ||
| + | |||
| + | === Schlüssel zum Client-Zertifikat === | ||
| + | # ll / | ||
| + | < | ||
| + | |||
| + | ==== rsyslog konfigurieren ==== | ||
| + | Nun bearbeiten wir die Konfigurationsdatei unseres **rsyslog**-Daemon und hinterlegen dort die entsprechenden Pfadangaben zu dem lmnsd_gtls-Modul, | ||
| + | Die wichtigsten Änderungen sind hier noch einmal zusammengefasst: | ||
| + | * **$DefaultNetstreamDriver //gtls//** | ||
| + | * **$DefaultNetstreamDriverCAFile // / | ||
| + | * **$DefaultNetstreamDriverCertFile // / | ||
| + | * **$DefaultNetstreamDriverKeyFile // / | ||
| + | * **$ActionSendStreamDriverAuthMode // | ||
| + | * **$ActionSendStreamDriverPermittedPeer // | ||
| + | * **$ActionSendStreamDriverMode //1//** | ||
| + | |||
| + | Alle Änderungen in der Konfigurationsdatei sind mit dem Namen **Django : < | ||
| + | # vim / | ||
| + | |||
| + | <file bash / | ||
| + | |||
| + | # For more information see / | ||
| + | # If you experience problems, see http:// | ||
| + | |||
| + | #### MODULES #### | ||
| + | |||
| + | # Django : 2016-01-03 | ||
| + | # default: unset | ||
| + | $DefaultNetstreamDriver gtls #make gtls driver the default | ||
| + | |||
| + | # The imjournal module bellow is now used as a message source instead of imuxsock. | ||
| + | $ModLoad imuxsock # provides support for local system logging (e.g. via logger command) | ||
| + | $ModLoad imjournal # provides access to the systemd journal | ||
| + | #$ModLoad imklog # reads kernel messages (the same are read from journald) | ||
| + | #$ModLoad immark | ||
| + | |||
| + | # Provides UDP syslog reception | ||
| + | #$ModLoad imudp | ||
| + | # | ||
| + | |||
| + | # Provides TCP syslog reception | ||
| + | #$ModLoad imtcp | ||
| + | # | ||
| + | |||
| + | |||
| + | #### GLOBAL DIRECTIVES #### | ||
| + | |||
| + | # Where to place auxiliary files | ||
| + | $WorkDirectory / | ||
| + | |||
| + | # Use default timestamp format | ||
| + | $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat | ||
| + | |||
| + | # File syncing capability is disabled by default. This feature is usually not required, | ||
| + | # not useful and an extreme performance hit | ||
| + | # | ||
| + | |||
| + | # Include all config files in / | ||
| + | $IncludeConfig / | ||
| + | |||
| + | # Turn off message reception via local log socket; | ||
| + | # local messages are retrieved through imjournal now. | ||
| + | $OmitLocalLogging on | ||
| + | |||
| + | # File to store the position in the journal | ||
| + | $IMJournalStateFile imjournal.state | ||
| + | |||
| + | # Django : 2016-01-03 - certificate files for TLS | ||
| + | # default: unset | ||
| + | $DefaultNetstreamDriverCAFile | ||
| + | $DefaultNetstreamDriverCertFile / | ||
| + | $DefaultNetstreamDriverKeyFile | ||
| + | |||
| + | $ActionSendStreamDriverAuthMode x509/name | ||
| + | $ActionSendStreamDriverPermittedPeer graylog-server.dmz.nausch.org | ||
| + | # run driver in TLS-only mode | ||
| + | $ActionSendStreamDriverMode 1 | ||
| + | |||
| + | #### RULES #### | ||
| + | |||
| + | # Log all kernel messages to the console. | ||
| + | # Logging much else clutters up the screen. | ||
| + | # | ||
| + | |||
| + | # Log anything (except mail) of level info or higher. | ||
| + | # Don't log private authentication messages! | ||
| + | *.info; | ||
| + | |||
| + | # The authpriv file has restricted access. | ||
| + | authpriv.* | ||
| + | |||
| + | # Log all the mail messages in one place. | ||
| + | mail.* | ||
| + | |||
| + | |||
| + | # Log cron stuff | ||
| + | cron.* | ||
| + | |||
| + | # Everybody gets emergency messages | ||
| + | *.emerg | ||
| + | |||
| + | # Save news errors of level crit and higher in a special file. | ||
| + | uucp, | ||
| + | |||
| + | # Save boot messages also to boot.log | ||
| + | local7.* | ||
| + | |||
| + | # Django : 2015-07-14 Logging für OpenLDAP-Server aktiviert | ||
| + | local4.* | ||
| + | # | ||
| + | |||
| + | # ### begin forwarding rule ### | ||
| + | # The statement between the begin ... end define a SINGLE forwarding | ||
| + | # rule. They belong together, do NOT split them. If you create multiple | ||
| + | # forwarding rules, duplicate the whole block! | ||
| + | # Remote Logging (we use TCP for reliable delivery) | ||
| + | # | ||
| + | # An on-disk queue is created for this action. If the remote host is | ||
| + | # down, messages are spooled to disk and sent when it is up again. | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # remote host is: name/ | ||
| + | #*.* @@remote-host: | ||
| + | # | ||
| + | # Django : 2015-06-12 | ||
| + | #$template GRAYLOGRFC5424,"< | ||
| + | #*.* @@10.0.0.117: | ||
| + | # Django : 2016-01-03 | ||
| + | $template GRAYLOGRFC5424,"< | ||
| + | *.* @@10.0.0.117: | ||
| + | # | ||
| + | # ### end of the forwarding rule ###</ | ||
| + | |||
| + | Zum Aktivieren der Änderungen führen wir nun einmal einen Reboot des rsyslog-Daemon durch. | ||
| + | # systemctl restart rsyslog.service | ||
| + | |||
| + | Im Syslog unseres Servers wir der erfolgreiche Neustart des rsyslog-Daemon entsprechend positiv vermerkt. | ||
| + | # tailf / | ||
| + | |||
| + | Jan 4 12:34:45 vml000037 rsyslogd: [origin software=" | ||
| + | Jan 4 12:34:45 vml000037 rsyslogd: [origin software=" | ||
| + | |||
| + | Rufen wir nun wieder die Web-GUI unseres **graylog**-Webservers auf, wird sowohl die aktive Verbindung wie auch die bereits übertragenen Daten angezeigt. | ||
| + | |||
| + | $ firefox https:// | ||
| + | |||
| + | {{ : | ||
| + | |||
| + | Alles in allem können wir feststellen, | ||
| + | |||
| + | ====== Links ====== | ||
| + | * **[[centos: | ||
| + | * **[[wiki: | ||
| + | * **[[http:// | ||
| + | |||
127.0.0.1