Add app

2026-06-18 12:03:45 +00:00
parent ada4aa4b18
commit 3b776dd970
47 changed files with 3416 additions and 110 deletions
@@ -0,0 +1,46 @@
+# Remote audit / syslog collector for the diskless fleet (LAB).
+#
+# Receives logs forwarded by booted diskless hosts over plain TCP/514 and writes
+# them per-source-host. Diskless hosts have an immutable, RAM-only overlay root,
+# so their local audit log dies on reboot — this gives auditd somewhere durable
+# to offload to (STIG remote-audit-offload, deviation #6 in docs/stig-deviations.md).
+#
+# Lab posture: PLAINTEXT TCP, mirroring the HTTP-boot/no-TLS lab stack. For
+# production switch to TLS (gtls driver) or RELP+TLS and restrict senders by
+# subnet — see README.md.
+
+global(workDirectory="/var/spool/rsyslog")
+
+# --- intake: plain TCP syslog ---
+module(load="imtcp" maxSessions="1000")
+input(type="imtcp" port="514")
+# Some senders only speak UDP; uncomment to also accept it (lossy, no queue).
+#module(load="imudp")
+#input(type="imudp" port="514")
+
+# Disk-assisted main queue so a brief disk stall or a burst of records doesn't
+# drop audit events (the records keep flowing to spool, then drain to disk).
+main_queue(
+    queue.type="LinkedList"
+    queue.filename="mainq"
+    queue.maxdiskspace="1g"
+    queue.saveOnShutdown="on"
+)
+
+# --- per-source-host files (keyed by SENDER IP, not the claimed hostname) ---
+template(name="HostAudit"    type="string" string="/var/log/remote/%FROMHOST-IP%/audit.log")
+template(name="HostMessages" type="string" string="/var/log/remote/%FROMHOST-IP%/messages.log")
+
+# Audit records (audisp-syslog tags them 'audispd'/'audit', or forwards on the
+# local6 facility) go to a dedicated per-host audit.log; everything else to
+# messages.log. Files/dirs are created 0640/0750 (audit logs aren't world-read).
+if ($programname == 'audispd')
+   or ($programname startswith 'audit')
+   or ($syslogfacility-text == 'local6') then {
+    action(type="omfile" dynaFile="HostAudit"
+           dirCreateMode="0750" fileCreateMode="0640")
+    stop
+}
+
+action(type="omfile" dynaFile="HostMessages"
+       dirCreateMode="0750" fileCreateMode="0640")