Adding rsyslog tls

serving/audit-collector/rsyslog.conf

@@ -1,19 +1,39 @@
-# Remote audit / syslog collector for the diskless fleet (LAB).
+# Remote audit / syslog collector for the diskless fleet.
 #
-# Receives logs forwarded by booted diskless hosts over plain TCP/514 and writes
-# them per-source-host. Diskless hosts have an immutable, RAM-only overlay root,
+# Receives logs forwarded by booted diskless hosts and writes them
+# per-source-host. Diskless hosts have an immutable, RAM-only overlay root,
 # so their local audit log dies on reboot — this gives auditd somewhere durable
 # to offload to (STIG remote-audit-offload, deviation #6 in docs/stig-deviations.md).
 #
-# Lab posture: PLAINTEXT TCP, mirroring the HTTP-boot/no-TLS lab stack. For
-# production switch to TLS (gtls driver) or RELP+TLS and restrict senders by
-# subnet — see README.md.
+# Primary intake is syslog-over-TLS on 6514 (gtls; server cert issued by the
+# fleet step-ca — see issue-cert.sh + README.md). Hosts authenticate the
+# collector via the fleet CA baked in the image (x509/name); the collector does
+# NOT require client certs (authMode "anon"): hosts are fleet-generic (no
+# per-host state, invariant #1) and a baked fleet-wide client key would be
+# shared secret material in the image. Sender access is instead constrained by
+# the isolated boot LAN + the serving-host firewall scoping :6514 to it.
 
-global(workDirectory="/var/spool/rsyslog")
+global(
+    workDirectory="/var/spool/rsyslog"
+    # TLS material for the 6514 listener, mounted from ./tls (issue-cert.sh).
+    # NOTE: deliberately NOT setting DefaultNetstreamDriver="gtls" here — that
+    # would flip every plain `protocol="tcp"` omfwd (the Wazuh relay below) to
+    # TLS and break it. TLS is enabled per-listener instead.
+    DefaultNetstreamDriverCAFile="/etc/rsyslog-tls/ca.crt"
+    DefaultNetstreamDriverCertFile="/etc/rsyslog-tls/server.crt"
+    DefaultNetstreamDriverKeyFile="/etc/rsyslog-tls/server.key"
+)
 
-# --- intake: plain TCP syslog ---
+# --- intake: syslog-over-TLS (the hardened image's 2f sender targets this) ---
 module(load="imtcp" maxSessions="1000")
-input(type="imtcp" port="514")
+input(type="imtcp" port="6514"
+      streamDriver.name="gtls" streamDriver.mode="1" streamDriver.authMode="anon")
+
+# --- intake: plain TCP syslog (LEGACY/migration) ---
+# Kept for already-released images that still forward plaintext to :514.
+# Disable (comment out + close the firewall port) once the fleet is on
+# TLS-sending images — production must not accept plaintext audit records.
+input(type="imtcp" port="514" streamDriver.name="ptcp")
 # Some senders only speak UDP; uncomment to also accept it (lossy, no queue).
 #module(load="imudp")
 #input(type="imudp" port="514")