Samhain | ||
---|---|---|
<<< Previous | Next >>> |
yule is the log server within the samhain file integrity monitoring system. yule is part of the distribution package. It is only required if you intend to use the client/server capability of the samhain system for centralized logging to yule.
![]() | NOTE |
---|---|
To compile yule, you must use ./configure --enable-network=server. To compile a samhain client, you must use ./configure --enable-network=client. |
yule is a non-forking server. Instead of forking a new process for each incoming logging request, it multiplexes connections internally. Apart from samhain client reports (see below), yule (version 1.2.8+) can also collect syslog reports by listening on port 514/udp, if compiled with this option enabled (see also man syslogd.
Each potential client must be registered with yule to make a connection (see the Section called Basic usage instructions in the chapter called Configuration — samhain, the file monitor> and the example below). The client tells its host name to the server, and the server verifies it against the peer of the connecting socket. On the first connection made by a client, an authentication protocol is performed. This protocol provides mutual authentication of client and server, as well as a fresh session key .
By default, all messages are encrypted using Rijndael (selected as the Advanced Encryption Standard algorithms). The 192-bit key version of the algorithm is used. There is a compile-time option to switch off encryption, if your local lawmakers don't allow to use it (see Appendix).
yule keeps track of all clients and their session keys. As connections are dropped after successful completion of message delivery, there is no limit on the total number of clients. There is, however, a limit on the maximum number of simultaneous connections. This limit depends on the operating system, but may be of order 1000.
Session key expire after two hours. If its session key is expired, the client is forced to repeat the authentication protocol to set up a fresh session key.
Incoming messages are signed by the client. On receipt, yule will:
check the signature,
accept the message if the signature can be verified, otherwise discard it and issue an error message,
discard the clients signature,
log the message, and the client's hostname, to the console and the log file, and
add its own signature to the log file entry.
It is possible to set a time limit for the maximum time between two consecutive messages of a client (option SetClientTimeLimit in the configuration file). If the time limit is exceeded without a message from the client, the server will issue a warning. The default is 86400 seconds (one day); specifying a value of 0 will switch off this option.
By default, client messages have the severity inet, and are logged only to the console and the log file (and to database/external, if threshold is properly set). It is possible to override this behavior by setting the option UseClientSeverity=yes in the Misc section of the configuration file. In that case, the client message severity is used, and client messages are treated just like local messages (i.e. like those from the server itself).
All client messages are recorded in the main log file by default. However, it is possible to use separate log files for individual clients. This can be enabled with UseSeparateLogs=yes/no in the Misc section of the server configuration file. No locking will be performed for such separate client log files (only one instance of the server can listen on the TCP port, thus there will be no concurrent access).
<<< Previous | Home | Next >>> |
Performance tuning | Important installation notes |