Re: audisp-prelude problems
On the same topic, I sow that audisp-remote plugin can send events remote
using a secure connection(transport = ssl in audisp-remote.conf file).
When using tcp as a transport method events arrive to the a aggregation
auditd but when using ssl no event arrive?
How can I use a secure connection to transmit events?
On Thursday 04 December 2008 09:57:54 Loredan Stancu wrote:
> Now I'll have to user audisp-remote plugin to centralize events.
One further refinement to what I said yesterday about remote logging. You
probably want to set the local_port value to something < 1024 in the
remote
configuration files. Then in the aggregating auditd, set the
tcp_client_ports to
the same thing.
This is a security feature to prevent random user space apps from trying
audit
log injection attacks. For experimenting or casual use you don't need to
set
these up, but for production use you must.
If you use kerberos authentication, then you have even more protection.
But
setting up kerberos for this is a little more than I want to explain.
-Steve