sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Adding rsyslog tls

Browse Source
This commit is contained in:
Audiobuzz
2026-07-12 14:04:19 +09:30
parent 28d31e436c
commit 5bc6d27f77
13 changed files with 542 additions and 135 deletions
Download Patch File Download Diff File Expand all files Collapse all files
serving/README.md
+6 -3
View File
@@ -74,9 +74,12 @@ sudo nvme discover -t tcp -a ${SERVER_IP} -s 4420 # lists the
# DNS: discovery name resolves to the serving host
dig +short @${SERVER_IP} nvme.fleet.lab # -> ${SERVER_IP}
# Audit collector: rsyslog receiver is listening on :514 (booted hosts offload
# auditd here; records land in audit-collector/logs/<sender-ip>/)
ss -lntp | grep ':514'
# Audit collector: syslog-TLS receiver on :6514 (booted hosts offload auditd
# here; records land in audit-collector/logs/<sender-ip>/). Needs the server
# cert issued first: audit-collector/issue-cert.sh (fleet step-ca).
ss -lntp | grep ':6514'
openssl s_client -connect ${SERVER_IP}:6514 -CAfile audit-collector/tls/ca.crt </dev/null # Verify return code: 0
# End-to-end record via the LEGACY plaintext :514 intake (kept for pre-TLS images)
logger -n ${SERVER_IP} -P 514 -T -t audispd "collector smoke test" # -> logs/<ip>/audit.log
# DHCP/boot: watch leases + bootfile handout