Adding rsyslog tls
This commit is contained in:
Audiobuzz
+38
-14
@@ -150,7 +150,7 @@ variable "boot_splash" {
|
||||
|
||||
variable "enable_stig" {
|
||||
type = bool
|
||||
description = "MUST be true (enforced). Applies DISA STIG hardening (OpenSCAP + SSG) with a diskless/UKI/kiosk tailoring (files/stig/diskless-tailoring.xml), bakes STIG kernel params into the UKI cmdline, and emits a deviations report. FIPS is OFF and audit offload is LOCAL-only regardless (see docs/stig-deviations.md). The former enable_stig=false escape hatch is removed for production hardening (POA&M P-03) — a build with enable_stig=false now fails validation. To debug a hardening regression, revert this validation on a throwaway branch, never on a release build."
|
||||
description = "MUST be true (enforced). Applies DISA STIG hardening (OpenSCAP + SSG) with a diskless/UKI/kiosk tailoring (files/stig/diskless-tailoring.xml), bakes STIG kernel params into the UKI cmdline, and emits a deviations report. FIPS is OFF (see docs/stig-deviations.md); audit offload is remote over syslog-TLS (2f, audit_host). The former enable_stig=false escape hatch is removed for production hardening (POA&M P-03) — a build with enable_stig=false now fails validation. To debug a hardening regression, revert this validation on a throwaway branch, never on a release build."
|
||||
default = true
|
||||
validation {
|
||||
condition = var.enable_stig
|
||||
@@ -160,7 +160,7 @@ variable "enable_stig" {
|
||||
|
||||
variable "audit_host" {
|
||||
type = string
|
||||
description = "Remote rsyslog/audit collector the image forwards auditd (via audisp-syslog) + the journal (rsyslog imjournal) to. Host-generic DNS name resolved per-environment by the serving dnsmasq to the collector (serving/audit-collector); matches serving/.env AUDIT_HOST. The diskless root is a RAM-only overlay, so local logs die on reboot — this ships them off-box. Empty = local-only (no remote offload)."
|
||||
description = "Remote rsyslog/audit collector the image forwards auditd (via audisp-syslog) + the journal (rsyslog imjournal) to, over syslog-TLS (gtls :6514, server verified x509/name against the baked fleet CA — the collector cert's SAN must be this name; see serving/audit-collector/issue-cert.sh). Host-generic DNS name resolved per-environment by the serving dnsmasq to the collector (serving/audit-collector); matches serving/.env AUDIT_HOST. The diskless root is a RAM-only overlay, so local logs die on reboot — this ships them off-box. Empty = local-only (no remote offload)."
|
||||
default = "audit.fleet.lab"
|
||||
}
|
||||
|
||||
@@ -179,7 +179,7 @@ variable "sb_cert" {
|
||||
|
||||
variable "fleet_ca" {
|
||||
type = string
|
||||
description = "Path on the BUILD HOST to the fleet CA PEM baked to /etc/dot1x/radius-ca.pem — the trust anchor wpa_supplicant uses for RADIUS EAP-TLS AND the fleet-agent uses to verify the fleet-manager. Defaults to the COMMITTED PLACEHOLDER (files/etc/dot1x/radius-ca.pem), which is NOT a usable CA (auth/telemetry can't succeed with it). Override per-environment (CI secret -> temp file) with your real step-ca root (or a root+intermediate bundle for robustness). Never commit real internal CA material (CLAUDE.md)."
|
||||
description = "Path on the BUILD HOST to the fleet CA PEM baked to /etc/dot1x/radius-ca.pem — the trust anchor wpa_supplicant uses for RADIUS EAP-TLS, the fleet-agent uses to verify the fleet-manager, AND rsyslog uses to verify the audit collector (TLS offload, 2f). Defaults to the COMMITTED PLACEHOLDER (files/etc/dot1x/radius-ca.pem), which is NOT a usable CA (auth/telemetry/log-offload can't succeed with it). Override per-environment (CI secret -> temp file) with your real step-ca root (or a root+intermediate bundle for robustness). Never commit real internal CA material (CLAUDE.md)."
|
||||
default = "files/etc/dot1x/radius-ca.pem"
|
||||
}
|
||||
|
||||
@@ -348,6 +348,14 @@ build {
|
||||
# talks to the TPM directly via go-tpm. So this list stays at the baseline.)
|
||||
"dnf -y install wpa_supplicant tpm2-tools tpm2-tss nvme-cli cryptsetup dracut-network NetworkManager zstd openssl",
|
||||
|
||||
# rsyslog + its gnutls netstream driver, installed HERE (not in 2f) so
|
||||
# they're present when the 2c-STIG scan runs: the re-selected
|
||||
# rsyslog_encrypt_offload_* rules need the rsyslog package installed to be
|
||||
# applicable, and their remediation writes the gtls/x509 globals that the
|
||||
# clean eval of record then passes. 2f (after STIG) writes the actual TLS
|
||||
# forward action; rsyslog-gnutls provides lmnsd_gtls.so it loads at runtime.
|
||||
"dnf -y install rsyslog rsyslog-gnutls",
|
||||
|
||||
# Locale trim: @^minimal-environment pulls glibc-all-langpacks — ~228 MB of
|
||||
# locale data for EVERY language (measured 2026-07-03, 3rd-largest package in
|
||||
# the whole image). This fleet is English-only (we also strip
|
||||
@@ -804,7 +812,7 @@ build {
|
||||
# tailoring (files/stig/diskless-tailoring.xml) unselects rules that are N/A to
|
||||
# this architecture or dangerous to auto-remediate (FIPS off, firewall off,
|
||||
# AIDE, partitions, smartcard, GRUB) — each justified in docs/stig-deviations.md.
|
||||
# FIPS=off, audit offload=local per decision. Gated by enable_stig.
|
||||
# FIPS=off per decision; audit offload is remote/TLS (2f). Gated by enable_stig.
|
||||
provisioner "file" {
|
||||
source = "files/stig"
|
||||
destination = "/tmp/"
|
||||
@@ -1085,25 +1093,41 @@ build {
|
||||
|
||||
# --- 2f. Remote log / audit offload (sender) -----------------------------
|
||||
# Forward auditd (via the audisp-syslog plugin, on LOCAL6) AND the journal
|
||||
# (rsyslog's stock imjournal) to the remote collector (serving/audit-collector).
|
||||
# The diskless root is a RAM-only overlay so local logs vanish on reboot; this
|
||||
# ships them off-box (and gives remote visibility into boot/login failures).
|
||||
# Host-generic: targets ${audit_host} (DNS, resolved per environment). Empty
|
||||
# audit_host => local-only. Implements the remote-offload half of TODO #2 /
|
||||
# docs/stig-deviations.md #6. Disk-assisted queue so a network blip won't drop
|
||||
# records (action.resumeRetryCount=-1 retries forever).
|
||||
# (rsyslog's stock imjournal) to the remote collector (serving/audit-collector)
|
||||
# over syslog-TLS (gtls, :6514). The diskless root is a RAM-only overlay so
|
||||
# local logs vanish on reboot; this ships them off-box (and gives remote
|
||||
# visibility into boot/login failures).
|
||||
# TLS trust: the sender verifies the collector x509/name against the FLEET CA
|
||||
# already baked at /etc/dot1x/radius-ca.pem (var.fleet_ca) — host-generic
|
||||
# public material, no per-host state (invariant #1). No client cert: hosts are
|
||||
# fleet-generic and a baked fleet-wide client key would be shared secret
|
||||
# material in the image; the collector's listener is authMode=anon and access
|
||||
# is constrained by the boot LAN + serving-host firewall. With the default
|
||||
# PLACEHOLDER CA the TLS handshake can't succeed (same posture as RADIUS) —
|
||||
# the action suspends/retries and the disk-assisted queue spools until a real
|
||||
# CA + collector cert exist.
|
||||
# Host-generic: targets ${audit_host} (DNS, resolved per environment; the
|
||||
# collector cert's SAN must match — issued by audit-collector/issue-cert.sh).
|
||||
# Empty audit_host => local-only. Implements the remote-offload half of TODO
|
||||
# #2 / docs/stig-deviations.md #6; satisfies the rsyslog_encrypt_offload_*
|
||||
# STIG rules (re-selected in the tailoring). Disk-assisted queue so a network
|
||||
# blip won't drop records (action.resumeRetryCount=-1 retries forever).
|
||||
# rsyslog + rsyslog-gnutls are installed in step 2 (before the STIG scan).
|
||||
provisioner "shell" {
|
||||
environment_vars = ["AUDIT_HOST=${var.audit_host}"]
|
||||
inline = [
|
||||
"set -eux",
|
||||
"if [ -z \"$AUDIT_HOST\" ]; then echo 'audit_host empty -> local-only logging, no remote offload.'; exit 0; fi",
|
||||
"dnf install -y rsyslog",
|
||||
"rpm -q rsyslog rsyslog-gnutls", # installed in step 2; fail loudly if not
|
||||
# auditd -> syslog on LOCAL6 (the collector routes LOCAL6 to a per-host
|
||||
# audit.log; see serving/audit-collector/rsyslog.conf).
|
||||
"if [ -f /etc/audit/plugins.d/syslog.conf ]; then sed -i -e 's/^active.*/active = yes/' -e 's/^args.*/args = LOG_INFO LOG_LOCAL6/' /etc/audit/plugins.d/syslog.conf; fi",
|
||||
# rsyslog -> collector over TCP, disk-assisted queue.
|
||||
# rsyslog -> collector over TLS (gtls), disk-assisted queue. The explicit
|
||||
# StreamDriver* action params take precedence over the legacy globals the
|
||||
# STIG remediation appended to /etc/rsyslog.conf (same values).
|
||||
"cat > /etc/rsyslog.d/60-fleet-remote.conf <<EOF",
|
||||
"*.* action(type=\"omfwd\" target=\"$AUDIT_HOST\" port=\"514\" protocol=\"tcp\" queue.type=\"LinkedList\" queue.fileName=\"fleetfwdq\" queue.maxDiskSpace=\"256m\" queue.saveOnShutdown=\"on\" action.resumeRetryCount=\"-1\")",
|
||||
"global(DefaultNetstreamDriverCAFile=\"/etc/dot1x/radius-ca.pem\")",
|
||||
"*.* action(type=\"omfwd\" target=\"$AUDIT_HOST\" port=\"6514\" protocol=\"tcp\" StreamDriver=\"gtls\" StreamDriverMode=\"1\" StreamDriverAuthMode=\"x509/name\" StreamDriverPermittedPeers=\"$AUDIT_HOST\" queue.type=\"LinkedList\" queue.fileName=\"fleetfwdq\" queue.maxDiskSpace=\"256m\" queue.saveOnShutdown=\"on\" action.resumeRetryCount=\"-1\")",
|
||||
"EOF",
|
||||
"chmod 0644 /etc/rsyslog.d/60-fleet-remote.conf",
|
||||
"rsyslogd -N1",
|
||||
|
||||
Reference in New Issue
Block a user