Solaris/BSM Logging

Introducing BSM

BSM is included with Solaris 2.3 and above. It provides the ability to monitor files, devices, user interaction, process actions, system calls, and most anything that occurs in Solaris. Ever had a user delete a file and deny they deleted it? BSM can provide the ability to store a user's actions in a way they can't edit, unlike the shell history.

Installing and Configuring BSM

Installing BSM is fairly easy. It requires the following Solaris Packages:

Introducing Stunnel

Stunnel provides the ability to tunnel TCP traffic through an SSL encrypted transport. It provides authentication using SSL certificates, and does not require a user account that can be remotely accessed like SSH tunnelling would. Compiling Stunnel is easily accomplished using OpenSSL and the GCC compiler. Simply follow the directions that come with Stunnel to compile and install it.

To configure Stunnel with the 4.x version, edit the stunnel.conf file. For our purpose, we will have one central repository server that is accepting inbound connections, and numerous clients that will initiate connections. Current versions of Stunnel allow you to specify either client or server mode, not both. To get around this limitation, simply start two Stunnel processes, specifying a specific configuration file for each.

The client will have a configuration similar to the following:

# Based on Sample stunnel configuration file
# Copyright by Michal Trojnara 2002

cert = /stunnel/etc/stunnel/stunnel.pem
chroot = /stunnel/var/run/stunnel/
# PID is created inside chroot jail
pid = /stunnel.pid
setuid = nobody
setgid = nogroup

#Verify = 3 requires the peer certificate to be distributed
verify = 3
CApath = /certs

# Use it for client mode
client = yes

# Accept only from the loopback interface and direct traffic to 
# the logserver's stunnel listening on 1514.
[syslog]
accept = 127.0.0.1:1514
connect = logserver:1514

# Based on Sample stunnel configuration file
# Copyright by Michal Trojnara 2002

cert = /stunnel/etc/stunnel/stunnel.pem
chroot = /stunnel/var/run/stunnel/
# PID is created inside chroot jail
pid = /stunnel.pid
setuid = nobody
setgid = nogroup

#Verify = 3 requires the peer certificate to be distributed
verify = 3
CApath = /certs

# Use it in server mode
client = no

# Accept only from the loopback interface and direct traffic to 
# the logserver's stunnel listening on 1514.
[syslog]
accept = 1514
connect = 127.0.0.1:514

Next, generate the certificates using OpenSSH. This process is just like any SSL certificate. The certificate can be self-signed, or signed by a third party, depending on your security policy. In general, the command is:

openssl req -x509 -newkey rsa:1024 -keyout stunnel.pem -out stunnel.pem

Once you have a PEM file, put the public key from the each client into the server's /stunnel/var/run/stunnel/certs directory. Run ca_rehash from the Openssl suite. Make sure the public certificate is chmod 444, since it will be read as the user specified in the configuration file, nobody/nogroup in the files shown above.

Introducing Syslog-NG

Syslog-NG is a replacement for the standard, plain Syslog. It runs on a variety of different Unix systems, including Solaris. It can be compiled for Solaris using GCC with only very minor changes to the configuration file in the version I have used. Follow the instructions that come with the current version of Syslog-NG to compile it.