The omgssapi output module forwards syslog messages over GSSAPI-secured sessions. Configure it with legacy directives and the :omgssapi: selector action.

omgssapi: GSSAPI Syslog Output Module¶

Purpose¶

What is it good for¶

Client-server authentication
Log messages encryption

Requirements¶

Kerberos infrastructure
rsyslog, rsyslog-gssapi

Configuration¶

Let’s assume there are 3 machines in Kerberos Realm:

The first is running KDC (Kerberos Authentication Service and Key Distribution Center),
The second is a client sending its logs to the server,
The third is receiver, gathering all logs.

KDC:
- Kerberos database must be properly set-up on KDC machine first. Use kadmin/kadmin.local to do that. Two principals need to be added in our case:
  1. sender@REALM.ORG
    - client must have ticket for principal sender
    - REALM.ORG is Kerberos Realm
  2. host/receiver.mydomain.com@REALM.ORG - service principal
- Use ktadd to export service principal and transfer it to /etc/krb5.keytab on receiver
CLIENT:
- set-up rsyslog, in /etc/rsyslog.conf:
  - $ModLoad omgssapi - load output GSS module
  - $GSSForwardServiceName otherThanHost - set the name of service principal, “host” is the default one
  - *.* :omgssapi:receiver.mydomain.com - action line, forward logs to receiver
- kinit root - get the TGT ticket
- service rsyslog start
SERVER:
- set-up rsyslog, in /etc/rsyslog.conf:
  - $ModLoad imgssapi - load input GSS module
  - $InputGSSServerServiceName otherThanHost - set the name of service principal, “host” is the default one
  - $InputGSSServerPermitPlainTCP on - accept GSS and TCP connections (not authenticated senders), off by default
  - $InputGSSServerRun 514 - run server on port
- service rsyslog start

The picture demonstrate how things work.

rsyslog gssapi support — rsyslog GSSAPI support¶

Configuration Parameters¶

Note

Parameter names are case-insensitive; camelCase is recommended for readability.

Legacy Configuration Directives¶

Parameter	Summary
GssForwardServiceName	Sets the Kerberos service principal base name used when omgssapi establishes a GSSAPI-secured forwarding session.
GssMode	Chooses whether omgssapi requests integrity-only or encrypted message protection for GSSAPI sessions.
GssTokenIOTimeout	Sets the deadline in seconds for reading a full GSSAPI handshake token while omgssapi establishes a session.
ActionGSSForwardDefaultTemplate	Sets the default output template omgssapi applies when a forwarding action omits an explicit template.

Action Syntax¶

The module supports legacy directives and :omgssapi: selector actions. Modern module parameters and action(type="omgssapi" ...) are not supported. Load the module with module(load="omgssapi") or $ModLoad omgssapi before setting its directives. Append ;TemplateName to a selector action to choose an explicit template.

The selector syntax also includes options for compression and TCP framing. These are specified in parentheses after the selector, for example :omgssapi:(z5,o)hostname.

z[0-9]: Enables zlib compression. The optional digit specifies the compression level (0-9). Defaults to 9 if no digit is given.
o: Enables octet-counted TCP framing.

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project