om_peo.8

MSyslog是一个允许在Linux下运行的网络系统日志程序

.\"	$CoreSDI: om_peo.8,v 1.22 2001/11/17 00:41:19 alejo Exp $
.\"
.\" Copyright (c) 2001
.\"	Core-SDI SA. All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\" 1. Redistributions of source code must retain the above copyright
.\"    notice, this list of conditions and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\"    notice, this list of conditions and the following disclaimer in the
.\"    documentation and/or other materials provided with the distribution.
.\" 3. Neither the name of Core-SDI SA nor the names of its contributors
.\"    may be used to endorse or promote products derived from this software
.\"    without specific prior written permission.
.\"
.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
.Dd May 10, 2000
.Dt OM_PEO 8
.Os Core-SDI
.Sh NAME
.Nm peo output module
.Nd
.Xr syslogd 8
output module used to protect log files
.Sh SYNOPSIS
.Nm peo
.Op Fl k Ar keyfile
.Op Fl l
.Op Fl m Ar hash_method
.Sh DESCRIPTION
.Nm peo
output module receives a message as an ascii string and calculates its 
.Em hash
key based on the last one generated for the previous message; the
module removes the last key and writes the new one into
.Ar keyfile .
This module's options are as follows:
.Bl -tag -width Ds
.It Fl k Ar keyfile
Specify the key file pathname; the default is
.Pa /var/ssyslog/.var.log.messages.key
.It Fl l
This option enables the line corrupted detection mode;
the module generates two keys, the first explained above and a second
key using a 
.Em mac
method based on two consecutive
.Em hash
functions, this new key is added into the 
.Em mac
file whose pathname is the same as
.Ar keyfile
with a ".mac" string added at the end (if this file does not exists,
is created automatically).
.It Fl m Ar hash_method
Specifies the hash method used to generate the key to put into the
.Ar keyfile, hash_method
should be one of 
.Cm md5, sha1,
or
.Cm rmd160;
the default is 
.Cm sha1.
.El
.Sh EXAMPLES
If you want to protect the
.Pa /var/log/authlog
file you should edit the
.Pa /etc/syslog.conf
file (see
.Xr syslog.conf 5
) and add a line with something like this:
.Pp
.Dl auth.info	%peo -l -k /var/ssyslog/.var.log.authlog.key %classic /var/log/authlog
.Pp
You should generate the initial key with
.Xr peochk 8
program, then rotate the logfile(s) and restart msyslog. Afterwards
you can check the logfile integrity with the same program.
.Sh SEE ALSO
.Li Vcr and Peo Revised documentation - http://www.corest.com/papers/peo.ps
.Xr syslog 3 ,
.Xr syslog.conf 5 ,
.Xr om_classic 8 ,
.Xr om_mysql 8 ,
.Xr om_pgsql 8 ,
.Xr om_regex 8 ,
.Xr om_tcp 8 ,
.Xr om_udp 8 ,
.Xr peochk 8 ,
.Xr syslogd 8
.Sh BUGS
.Bl -bullet
.It
Since the peo module is used to determine if a logfile is corrupted, care
must be taken on the configuration file, the following is not correct:
.Pp
.Dl *.err	/var/log/messages
.Pp
.Dl *.err	%peo -k /var/ssyslog/.var.log.messages.key
.Pp
the following is wrong either:
.Pp
.Dl *.err	%classic /var/log/messages
.Pp
.Dl *.err	%peo -k /var/ssyslog/.var.log.messages.key
.Pp
The correct line is:
.Pp
.Dl *.err	%classic /var/log/messages  %peo -k /var/ssyslog/.var.log.messages.key
.Pp
or
.Pp
.Dl *.err	%peo -k /var/ssyslog/.var.log.messages.key  %classic /var/log/messages
.It
Submit bugs at this project's Sourceforge Bug reporting system at:
http://sourceforge.net/tracker/?func=add&group_id=25741&atid=385117
You may also report them directly to the authors; send an email to
[e-mail], describing the problem the most you can,
containing also machine description, hardware description, the
configuration file (/etc/syslog.conf), the OS description, and the
invoking command line.
The more you describe the bug, the faster we can fix it.
.El