|
|
92fbf8 |
From 79e4e43bcadb0fb520240c655f529874f305f786 Mon Sep 17 00:00:00 2001
|
|
|
92fbf8 |
From: Tomas Heinrich <theinric@redhat.com>
|
|
|
92fbf8 |
Date: Thu, 14 Nov 2013 15:14:08 +0100
|
|
|
92fbf8 |
Subject: [PATCH] Remove references to Google ads from html documentation
|
|
|
92fbf8 |
|
|
|
92fbf8 |
---
|
|
|
92fbf8 |
doc/rsyslog_secure_tls.html | 13 -------------
|
|
|
92fbf8 |
doc/tls_cert_ca.html | 13 -------------
|
|
|
92fbf8 |
doc/tls_cert_client.html | 13 -------------
|
|
|
92fbf8 |
doc/tls_cert_errmsgs.html | 13 -------------
|
|
|
92fbf8 |
doc/tls_cert_machine.html | 13 -------------
|
|
|
92fbf8 |
doc/tls_cert_scenario.html | 13 -------------
|
|
|
92fbf8 |
doc/tls_cert_server.html | 13 -------------
|
|
|
92fbf8 |
doc/tls_cert_summary.html | 13 -------------
|
|
|
92fbf8 |
doc/tls_cert_udp_relay.html | 13 -------------
|
|
|
92fbf8 |
9 files changed, 117 deletions(-)
|
|
|
92fbf8 |
|
|
|
92fbf8 |
diff --git a/doc/rsyslog_secure_tls.html b/doc/rsyslog_secure_tls.html
|
|
|
92fbf8 |
index b15e5a4..0bef2b3 100644
|
|
|
92fbf8 |
--- a/doc/rsyslog_secure_tls.html
|
|
|
92fbf8 |
+++ b/doc/rsyslog_secure_tls.html
|
|
|
92fbf8 |
@@ -38,19 +38,6 @@ below. Do not blame us if it doesn't provide what you need ;)
|
|
|
92fbf8 |
|
|
|
92fbf8 |
Our secrity goals are achived via public/private key security. As such, it is
|
|
|
92fbf8 |
vital that private keys are well protected and not accessible to third parties.
|
|
|
92fbf8 |
-
|
|
|
92fbf8 |
-<script type="text/javascript">
|
|
|
92fbf8 |
-google_ad_client = "pub-3204610807458280";
|
|
|
92fbf8 |
-/* rsyslog doc inline */
|
|
|
92fbf8 |
-google_ad_slot = "5958614527";
|
|
|
92fbf8 |
-google_ad_width = 125;
|
|
|
92fbf8 |
-google_ad_height = 125;
|
|
|
92fbf8 |
-//-->
|
|
|
92fbf8 |
-</script>
|
|
|
92fbf8 |
-
|
|
|
92fbf8 |
-src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
|
|
|
92fbf8 |
-</script>
|
|
|
92fbf8 |
-
|
|
|
92fbf8 |
If private keys have become known to third parties, the system does not provide
|
|
|
92fbf8 |
any security at all. Also, our solution bases on X.509 certificates and a (very
|
|
|
92fbf8 |
limited) chain of trust. We have one instance (the CA) that issues all machine
|
|
|
92fbf8 |
diff --git a/doc/tls_cert_ca.html b/doc/tls_cert_ca.html
|
|
|
92fbf8 |
index 2cae404..f366462 100644
|
|
|
92fbf8 |
--- a/doc/tls_cert_ca.html
|
|
|
92fbf8 |
+++ b/doc/tls_cert_ca.html
|
|
|
92fbf8 |
@@ -23,19 +23,6 @@ Gerhards (2008-06-17)</small>
|
|
|
92fbf8 |
maintained by a trustworthy person (or group) and approves the indentities of
|
|
|
92fbf8 |
all machines. It does so by issuing their certificates. In a small setup, the
|
|
|
92fbf8 |
administrator can provide the CA function. What is important is the the CA's
|
|
|
92fbf8 |
-
|
|
|
92fbf8 |
-<script type="text/javascript">
|
|
|
92fbf8 |
-google_ad_client = "pub-3204610807458280";
|
|
|
92fbf8 |
-/* rsyslog doc inline */
|
|
|
92fbf8 |
-google_ad_slot = "5958614527";
|
|
|
92fbf8 |
-google_ad_width = 125;
|
|
|
92fbf8 |
-google_ad_height = 125;
|
|
|
92fbf8 |
-//-->
|
|
|
92fbf8 |
-</script>
|
|
|
92fbf8 |
-
|
|
|
92fbf8 |
-src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
|
|
|
92fbf8 |
-</script>
|
|
|
92fbf8 |
-
|
|
|
92fbf8 |
private key is well-protocted and machine certificates are only issued if it is
|
|
|
92fbf8 |
know they are valid (in a single-admin case that means the admin should not
|
|
|
92fbf8 |
issue certificates to anyone else except himself).
|
|
|
92fbf8 |
diff --git a/doc/tls_cert_client.html b/doc/tls_cert_client.html
|
|
|
92fbf8 |
index dbe7961..53596fc 100644
|
|
|
92fbf8 |
--- a/doc/tls_cert_client.html
|
|
|
92fbf8 |
+++ b/doc/tls_cert_client.html
|
|
|
92fbf8 |
@@ -25,19 +25,6 @@ example, that meanst turng.example.net). The client check's the server's identit
|
|
|
92fbf8 |
talks to it only if it is the expected server. This is a very important step.
|
|
|
92fbf8 |
Without it, you would not detect man-in-the-middle attacks or simple malicious servers
|
|
|
92fbf8 |
who try to get hold of your valuable log data.
|
|
|
92fbf8 |
-
|
|
|
92fbf8 |
-<script type="text/javascript">
|
|
|
92fbf8 |
-google_ad_client = "pub-3204610807458280";
|
|
|
92fbf8 |
-/* rsyslog doc inline */
|
|
|
92fbf8 |
-google_ad_slot = "5958614527";
|
|
|
92fbf8 |
-google_ad_width = 125;
|
|
|
92fbf8 |
-google_ad_height = 125;
|
|
|
92fbf8 |
-//-->
|
|
|
92fbf8 |
-</script>
|
|
|
92fbf8 |
-
|
|
|
92fbf8 |
-src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
|
|
|
92fbf8 |
-</script>
|
|
|
92fbf8 |
-
|
|
|
92fbf8 |
<center></center>
|
|
|
92fbf8 |
Steps to do:
|
|
|
92fbf8 |
|
|
|
92fbf8 |
diff --git a/doc/tls_cert_errmsgs.html b/doc/tls_cert_errmsgs.html
|
|
|
92fbf8 |
index d002174..2943efc 100644
|
|
|
92fbf8 |
--- a/doc/tls_cert_errmsgs.html
|
|
|
92fbf8 |
+++ b/doc/tls_cert_errmsgs.html
|
|
|
92fbf8 |
@@ -21,19 +21,6 @@ Gerhards (2008-06-17)</small>
|
|
|
92fbf8 |
|
|
|
92fbf8 |
Error Messages
|
|
|
92fbf8 |
This page covers error message you may see when setting up
|
|
|
92fbf8 |
-
|
|
|
92fbf8 |
-<script type="text/javascript">
|
|
|
92fbf8 |
-google_ad_client = "pub-3204610807458280";
|
|
|
92fbf8 |
-/* rsyslog doc inline */
|
|
|
92fbf8 |
-google_ad_slot = "5958614527";
|
|
|
92fbf8 |
-google_ad_width = 125;
|
|
|
92fbf8 |
-google_ad_height = 125;
|
|
|
92fbf8 |
-//-->
|
|
|
92fbf8 |
-</script>
|
|
|
92fbf8 |
-
|
|
|
92fbf8 |
-src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
|
|
|
92fbf8 |
-</script>
|
|
|
92fbf8 |
-
|
|
|
92fbf8 |
rsyslog with TLS. Please note that many
|
|
|
92fbf8 |
of the message stem back to the TLS library being used. In those cases, there is
|
|
|
92fbf8 |
not always a good explanation available in rsyslog alone.
|
|
|
92fbf8 |
diff --git a/doc/tls_cert_machine.html b/doc/tls_cert_machine.html
|
|
|
92fbf8 |
index 095e15c..fe2ee90 100644
|
|
|
92fbf8 |
--- a/doc/tls_cert_machine.html
|
|
|
92fbf8 |
+++ b/doc/tls_cert_machine.html
|
|
|
92fbf8 |
@@ -22,19 +22,6 @@ Gerhards (2008-06-18)</small>
|
|
|
92fbf8 |
In this step, we generate certificates for each of the machines. Please note
|
|
|
92fbf8 |
that both clients and servers need certificates. The certificate identifies each
|
|
|
92fbf8 |
machine to the remote peer. The DNSName specified inside the certificate can
|
|
|
92fbf8 |
-
|
|
|
92fbf8 |
-<script type="text/javascript">
|
|
|
92fbf8 |
-google_ad_client = "pub-3204610807458280";
|
|
|
92fbf8 |
-/* rsyslog doc inline */
|
|
|
92fbf8 |
-google_ad_slot = "5958614527";
|
|
|
92fbf8 |
-google_ad_width = 125;
|
|
|
92fbf8 |
-google_ad_height = 125;
|
|
|
92fbf8 |
-//-->
|
|
|
92fbf8 |
-</script>
|
|
|
92fbf8 |
-
|
|
|
92fbf8 |
-src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
|
|
|
92fbf8 |
-</script>
|
|
|
92fbf8 |
-
|
|
|
92fbf8 |
be specified inside the $<object>PermittedPeer config statements.
|
|
|
92fbf8 |
For now, we assume that a single person (or group) is responsible for the whole
|
|
|
92fbf8 |
rsyslog system and thus it is OK if that single person is in posession of all
|
|
|
92fbf8 |
diff --git a/doc/tls_cert_scenario.html b/doc/tls_cert_scenario.html
|
|
|
92fbf8 |
index 7973532..88c7657 100644
|
|
|
92fbf8 |
--- a/doc/tls_cert_scenario.html
|
|
|
92fbf8 |
+++ b/doc/tls_cert_scenario.html
|
|
|
92fbf8 |
@@ -21,19 +21,6 @@ Gerhards (2008-06-17)</small>
|
|
|
92fbf8 |
|
|
|
92fbf8 |
Sample Scenario
|
|
|
92fbf8 |
We have a quite simple scenario. There is one central syslog server,
|
|
|
92fbf8 |
-
|
|
|
92fbf8 |
-<script type="text/javascript">
|
|
|
92fbf8 |
-google_ad_client = "pub-3204610807458280";
|
|
|
92fbf8 |
-/* rsyslog doc inline */
|
|
|
92fbf8 |
-google_ad_slot = "5958614527";
|
|
|
92fbf8 |
-google_ad_width = 125;
|
|
|
92fbf8 |
-google_ad_height = 125;
|
|
|
92fbf8 |
-//-->
|
|
|
92fbf8 |
-</script>
|
|
|
92fbf8 |
-
|
|
|
92fbf8 |
-src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
|
|
|
92fbf8 |
-</script>
|
|
|
92fbf8 |
-
|
|
|
92fbf8 |
named central.example.net. These server is being reported to by two Linux
|
|
|
92fbf8 |
machines with name zuse.example.net and turing.example.net. Also, there is a
|
|
|
92fbf8 |
third client - ada.example.net - which send both its own messages to the central
|
|
|
92fbf8 |
diff --git a/doc/tls_cert_server.html b/doc/tls_cert_server.html
|
|
|
92fbf8 |
index 9c024bc..b784be1 100644
|
|
|
92fbf8 |
--- a/doc/tls_cert_server.html
|
|
|
92fbf8 |
+++ b/doc/tls_cert_server.html
|
|
|
92fbf8 |
@@ -23,19 +23,6 @@ Gerhards (2008-06-18)</small>
|
|
|
92fbf8 |
via TLS protected plain tcp based syslog from those peers that are explicitely permitted
|
|
|
92fbf8 |
to send to it. The picture below show our configuration. This step configures
|
|
|
92fbf8 |
the server central.example.net.
|
|
|
92fbf8 |
-
|
|
|
92fbf8 |
-<script type="text/javascript">
|
|
|
92fbf8 |
-google_ad_client = "pub-3204610807458280";
|
|
|
92fbf8 |
-/* rsyslog doc inline */
|
|
|
92fbf8 |
-google_ad_slot = "5958614527";
|
|
|
92fbf8 |
-google_ad_width = 125;
|
|
|
92fbf8 |
-google_ad_height = 125;
|
|
|
92fbf8 |
-//-->
|
|
|
92fbf8 |
-</script>
|
|
|
92fbf8 |
-
|
|
|
92fbf8 |
-src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
|
|
|
92fbf8 |
-</script>
|
|
|
92fbf8 |
-
|
|
|
92fbf8 |
<center></center>
|
|
|
92fbf8 |
<font color="red">Important: Keep in mind that the order of configuration directives
|
|
|
92fbf8 |
is very important in rsyslog. As such, the samples given below do only work if the given
|
|
|
92fbf8 |
diff --git a/doc/tls_cert_summary.html b/doc/tls_cert_summary.html
|
|
|
92fbf8 |
index 8e003bc..95844a8 100644
|
|
|
92fbf8 |
--- a/doc/tls_cert_summary.html
|
|
|
92fbf8 |
+++ b/doc/tls_cert_summary.html
|
|
|
92fbf8 |
@@ -20,19 +20,6 @@ Gerhards (2008-07-03)</small>
|
|
|
92fbf8 |
|
|
|
92fbf8 |
Summary
|
|
|
92fbf8 |
If you followed the steps outlined in this documentation set, you now have
|
|
|
92fbf8 |
-
|
|
|
92fbf8 |
-<script type="text/javascript">
|
|
|
92fbf8 |
-google_ad_client = "pub-3204610807458280";
|
|
|
92fbf8 |
-/* rsyslog doc inline */
|
|
|
92fbf8 |
-google_ad_slot = "5958614527";
|
|
|
92fbf8 |
-google_ad_width = 125;
|
|
|
92fbf8 |
-google_ad_height = 125;
|
|
|
92fbf8 |
-//-->
|
|
|
92fbf8 |
-</script>
|
|
|
92fbf8 |
-
|
|
|
92fbf8 |
-src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
|
|
|
92fbf8 |
-</script>
|
|
|
92fbf8 |
-
|
|
|
92fbf8 |
a reasonable (for most needs) secure setup for the following environment:
|
|
|
92fbf8 |
<center></center>
|
|
|
92fbf8 |
You have learned about the security decisions involved and which we
|
|
|
92fbf8 |
diff --git a/doc/tls_cert_udp_relay.html b/doc/tls_cert_udp_relay.html
|
|
|
92fbf8 |
index f4740ce..d44689c 100644
|
|
|
92fbf8 |
--- a/doc/tls_cert_udp_relay.html
|
|
|
92fbf8 |
+++ b/doc/tls_cert_udp_relay.html
|
|
|
92fbf8 |
@@ -26,19 +26,6 @@ directly to it, because we would like to have TLS protection for its sensitve
|
|
|
92fbf8 |
logs. If the router and the syslog relay are on a sufficiently secure private
|
|
|
92fbf8 |
network, this setup can be considered reasonable secure. In any case, it is the
|
|
|
92fbf8 |
best alternative among the possible configuration scenarios.
|
|
|
92fbf8 |
-
|
|
|
92fbf8 |
-<script type="text/javascript">
|
|
|
92fbf8 |
-google_ad_client = "pub-3204610807458280";
|
|
|
92fbf8 |
-/* rsyslog doc inline */
|
|
|
92fbf8 |
-google_ad_slot = "5958614527";
|
|
|
92fbf8 |
-google_ad_width = 125;
|
|
|
92fbf8 |
-google_ad_height = 125;
|
|
|
92fbf8 |
-//-->
|
|
|
92fbf8 |
-</script>
|
|
|
92fbf8 |
-
|
|
|
92fbf8 |
-src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
|
|
|
92fbf8 |
-</script>
|
|
|
92fbf8 |
-
|
|
|
92fbf8 |
<center></center>
|
|
|
92fbf8 |
Steps to do:
|
|
|
92fbf8 |
|
|
|
92fbf8 |
--
|
|
|
92fbf8 |
1.8.4.3
|
|
|
92fbf8 |
|