Adding rsyslog tls

docs/TODO.md

@@ -32,7 +32,10 @@ flipped back for a secure/production build (consolidated as item #8):
   assigns a stable creative starship name per MAC (e.g. `nebula-vanguard-07`) via
   DHCP option 12 + DNS A/PTR. Host picks it up on next DHCP renewal/reboot.
 - **Serving `.env`:** must set `AUDIT_HOST=audit.fleet.lab` (+ `docker compose up
-  -d dnsmasq` to reload) for remote log offload to resolve/flow.
+  -d dnsmasq` to reload) for remote log offload to resolve/flow. Since the TLS
+  upgrade (#8, 2026-07-12) the collector also needs its server cert issued
+  (`audit-collector/issue-cert.sh`) + 6514/tcp open on the boot NIC, and the
+  image must be built with the real fleet CA (`fleet_ca`) or senders spool.
 
 What's working/verified vs awaiting bench is per-item below. Cross-cutting
 bench-verify checklist lives in `CLAUDE.md` → "Known bench-verify items".
@@ -152,7 +155,8 @@ was incomplete:**
   non-approved algo and would re-fail a STIG rule; prefer the ECDSA key.)
 - **rsyslog TLS-offload rules waived (lab):** `rsyslog_encrypt_offload_*` force
   gtls+x509+CA and broke the plaintext `2f` forward → unselected in the
-  tailoring; production TLS offload tracked under #8.
+  tailoring; production TLS offload tracked under #8. **(DONE 2026-07-12 — 2f is
+  now gtls/6514 and the three waivers are dropped; see #8.)**
 - Diagnosis tooling notes: SMBIOS cmdline-extra works only after a Proxmox VM
   **stop/start** (not `reset`); the debug-shell-on-tty2 never came up — the
   decisive diagnosis was **offline `rootfs.erofs` mount** + `ssh -vvv` +
@@ -205,8 +209,9 @@ Remaining (future hardening, currently waived — see the register): FIPS,
 firewall, per-host/rotatable admin access. **Remote audit offload — WIRED both
 ends** (2026-06-19): receiver `serving/audit-collector/` (rsyslog TCP/514,
 per-source-host files) + sender in the image (provisioner 2f, `audit_host` var:
-audisp-syslog→LOCAL6 + rsyslog `omfwd` to `audit.fleet.lab`). Lab is plaintext;
-TLS/RELP is the remaining hardening. **VERIFIED END-TO-END ON THE BENCH
+audisp-syslog→LOCAL6 + rsyslog `omfwd` to `audit.fleet.lab`). **UPGRADED TO TLS
+2026-07-12** (gtls/6514, fleet-CA x509/name; see #8 — BENCH-VERIFY pending; the
+plaintext-era notes below record the original bring-up). **VERIFIED END-TO-END ON THE BENCH
 2026-06-19** — booted host `cygnus-cruiser-99` (192.168.50.148) forwards to the
 collector, which writes `audit-collector/logs/192.168.50.148/{audit,messages}.log`.
 **Serving-host firewall gotcha hit + fixed:** the collector is host-networked so
@@ -218,7 +223,7 @@ sender's `action.resumeRetryCount="-1"` buffered the backlog and drained on
 reconnect — no records lost. Documented in
 [../serving/audit-collector/README.md](../serving/audit-collector/README.md).
 When the **workstation** firewall is re-enabled (#4 / register #4) it needs the
-reciprocal **egress** allow for 514/tcp to the collector.
+reciprocal **egress** allow for 6514/tcp (TLS; was 514/tcp) to the collector.
 
 **SIEM (Wazuh) added 2026-06-27 — [serving/siem/](../serving/siem/).** Upgrades the
 "Detect" pillar from file-collection-only to parse/search/correlate/alert.
@@ -241,7 +246,10 @@ and a live `sudo` on a booted host (`cygnus-cruiser-99`) surfaced `USER_CMD` →
 rule `100130` and `CRED_*`/`USER_ACCT` → rule `100110` (level 5) in the dashboard
 Threat Hunting view. Wazuh runs multi-node on `wazuh1.bitasylum.org`.
 **REMAINING (prod):** the relay→wazuh1 hop is **plaintext** — **TLS it** (gtls/6514,
-fleet CA; ISM protect-logs-in-transit) since it's now on the wire; rotate all Wazuh
+fleet CA; ISM protect-logs-in-transit) since it's now on the wire (NB: the
+host→collector hop is TLS since 2026-07-12, #8 — this is the separate
+collector→wazuh1 hop, and the collector-side `omfwd` must stay/`ptcp` until
+wazuh1 has a TLS listener); rotate all Wazuh
 creds; restrict dashboard/API to admin hosts; set `allowed-ips`→/32 of the serving
 host; ISM retention/archival; then update the SSP "Detect" + ISM event-logging
 controls.
@@ -917,28 +925,51 @@ smoke test.
   secure `nvme connect` as the test path has.
 - **Future hardening waived for now** (from the STIG register): FIPS, firewall,
   per-host/rotatable admin (SSH CA / config-agent).
-- **TLS-encrypted audit/log offload (production).** The lab forwards logs to
-  `serving/audit-collector` in **plaintext**, and the STIG TLS-offload rules
-  (`rsyslog_encrypt_offload_defaultnetstreamdriver`,
-  `..._actionsendstreamdrivermode`, `..._actionsendstreamdriverauthmode`) are
-  **waived** in the tailoring because applying them forces `gtls` + x509 peer
-  auth + a CA file and breaks the plaintext `2f` forward. For production, do it
-  properly and DROP the waivers:
-  1. Stand up a CA (or reuse the boot-infra CA); issue the collector a server
-     cert (CN/SAN = `audit.fleet.lab`).
-  2. Configure the collector's rsyslog for TLS: `imtcp` with
-     `StreamDriver.Name="gtls"`, `StreamDriver.Mode="1"`, server cert/key + CA;
-     listen on the syslog-TLS port (6514) — add a TLS receiver to
-     `serving/audit-collector/rsyslog.conf` + compose.
-  3. Bundle the CA into the image (host-generic, no per-host state — same model
-     as the RADIUS CA) and point `$DefaultNetstreamDriverCAFile` at it.
-  4. Set the `2f` `omfwd` action to `StreamDriver="gtls" StreamDriverMode="1"
-     StreamDriverAuthMode="x509/name"` + the CA file, target port 6514.
-  5. Re-select the three `rsyslog_encrypt_offload_*` rules (remove from
-     `files/stig/diskless-tailoring.xml`) — they should then PASS, and update
-     `docs/stig-deviations.md` #6 to reflect encrypted offload.
-  (RELP+TLS via `omrelp`/`imrelp` is the alternative if guaranteed delivery is
-  wanted alongside encryption.)
+- **[x] TLS-encrypted audit/log offload — IMPLEMENTED 2026-07-12 (awaiting
+  bench).** The host→collector hop is now syslog-over-TLS; the plaintext `2f`
+  forward and the three `rsyslog_encrypt_offload_*` waivers are gone. As built
+  (followed the original 5-step plan):
+  - **CA reused, not new:** the sender trusts the collector via the fleet CA
+    already baked at `/etc/dot1x/radius-ca.pem` (`var.fleet_ca` — now the trust
+    anchor for RADIUS EAP-TLS, fleet-agent AND log offload). Collector server
+    cert (SAN = `${AUDIT_HOST}`) issued from the bench step-ca by
+    `serving/audit-collector/issue-cert.sh` → `tls/` (gitignored), mounted at
+    `/etc/rsyslog-tls`; renew by re-running it (720h default — expiry shows as
+    handshake errors + senders spooling).
+  - **Collector** (`serving/audit-collector/`): gtls listener on **6514**
+    (per-listener `streamDriver.*` params; `authMode="anon"` — hosts carry NO
+    client cert: fleet-generic, invariant #1; client mTLS with the TPM identity
+    was CONSIDERED + DEFERRED 2026-07-12 — rationale + revisit trigger in
+    audit-collector/README.md "Decision: no client mTLS"). Plaintext :514 kept as a LEGACY
+    listener for pre-TLS images during migration — close it once the fleet is on
+    TLS images. Deliberately no global `DefaultNetstreamDriver="gtls"` (would
+    silently flip the plaintext wazuh1 relay `omfwd` to TLS and break it).
+    Alpine image needs `rsyslog-tls` (ships `lmnsd_gtls.so`; verified v3.20).
+  - **Sender (2f):** `omfwd` → `$AUDIT_HOST:6514`, `StreamDriver="gtls"` mode 1
+    `StreamDriverAuthMode="x509/name"` + `StreamDriverPermittedPeers=$AUDIT_HOST`,
+    CA via `global(DefaultNetstreamDriverCAFile="/etc/dot1x/radius-ca.pem")`.
+    With the placeholder CA the handshake can't succeed → action suspends and the
+    disk-assisted queue spools (same lab posture as RADIUS). `rsyslog` +
+    `rsyslog-gnutls` moved to the step-2 baseline install so they're present at
+    STIG-scan time.
+  - **STIG:** the three `rsyslog_encrypt_offload_*` selects removed from
+    `files/stig/diskless-tailoring.xml` (rules now evaluated; SSG remediation
+    writes the legacy gtls/x509 globals, eval of record should PASS);
+    register #6 rewritten (encrypted offload; audisp-remote rules +
+    `rsyslog_remote_loghost` stay waived — intent met via rsyslog).
+  - **Firewall:** serving host now needs **6514/tcp** open on the boot NIC
+    (same host-networking trap as 514 — see audit-collector/README.md); the
+    future workstation egress rule is 6514 too.
+  - **BENCH-VERIFY (the gate):** build with the real fleet CA + run
+    `issue-cert.sh` + `docker compose up -d --build audit`; on a booted host
+    confirm records land in `audit-collector/logs/<ip>/audit.log`, `ss -tnp`
+    on the serving host shows the sender ESTABLISHED to **:6514** (not :514),
+    a tcpdump of :6514 shows TLS (no cleartext syslog), a wrong/placeholder CA
+    is REJECTED (sender spools, `rsyslogd` logs a cert-validation error — proves
+    x509/name is actually enforced), and the STIG report shows the three
+    `rsyslog_encrypt_offload_*` rules PASS (0 new REVIEW rows).
+  (RELP+TLS via `omrelp`/`imrelp` remains the alternative if guaranteed delivery
+  is wanted alongside encryption.)
 - **fleet-hostapi: scope CORS to the kiosk origin.** The host-info agent ships
   with `FLEET_HOSTAPI_ALLOW_ORIGIN=*` (lab). For prod set it to the exact kiosk
   origin (default `http://boot.fleet.lab`) via the unit's commented