tech_documents:security:syslog-ng_centos8 [He holds the keys]

Install CentOS 8 minimal with a network card for each LAN/VLAN, set static IPs, have 100GB space available; 1-2GB RAM is fine for smaller networks (example PFSense and Untangle sending syslog on 120 user network used only 100MB RAM).
Install/enable epel repo
```
sudo dnf install epel-release
```
Install syslog-ng and vim (cause you know it's da BEST!)
```
sudo dnf install syslog-ng vim logrotate bzip2
```

Enable and start syslog-ng

sudo systemctl enable syslog-ng && sudo systemctl start syslog-ng

Disable the gateway on all but one of your ifcfg-ethX devices, probably leave the one that can route to multiple networks with the gateway enabled (e.g a management LAN will typically only be accessible by and have access to a single subnet so no routing is needed).

https://github.com/syslog-ng/syslog-ng/issues/2667
You may need to fix syslog-ng's systemd service file as it fails to start after a reboot because the network isn't ready.

sudo vim /usr/lib/systemd/system/syslog-ng.service

Add the following under [Unit]

Wants=network.target network-online.target
After=network.target network-online.target

Reload the deamon

sudo systemctl daemon-reload

https://www.linuxjournal.com/content/creating-centralized-syslog-server
https://community.spiceworks.com/topic/2084362-syslog-ng-for-multiple-sources
https://www.rfaircloth.com/tags/syslog-ng/
https://lists.balabit.hu/pipermail/syslog-ng/2014-March/021290.html
http://monitoringartist.github.io/community.zenoss.org/message/48987.html

Edit syslog-ng config file

 sudo vim /etc/syslog-ng/conf.d/remote.devices.conf

Add the content below (I prefer TCP since I want to make sure I have all logs files where UDP could miss a few). This accepts tcp/udp on the default ports and uses filters to output to different logs files based on hostname/ip address (note: some devices send IP address for some data and their hostname for other, PFSense has done this so I like both variables included).There is also a filter that will exclude all other filtered hosts so that any unknown items will get logged to the unknown log…

### Accept connections from tcp/upd
source s_network_a {
    udp(ip(0.0.0.0) port(514));
    tcp(ip(0.0.0.0) port(514) max-connections(5000));
};


### Filters to separate logs by ip/host and a filter to catch all that don't match
filter f_ht49_langw_haddentech_com { netmask("172.21.49.1/32"); or host("ht49-langw.haddentech.com"); };
filter f_ht49_wangw_haddentech_com { netmask("172.21.49.2/32"); or host("ht49-wangw.haddentech.com"); };
filter f_unknown { not ( netmask("172.21.49.1/32") or netmask("172.21.49.2/32") or host("ht49-langw.haddentech.com") or host("ht49-wangw.haddentech.com") ); };

### Destinations for to keep a local copy and send them on further. Note the SIEM/OSSIM destination has spoof_source(yes) otherwise the SIEM will log it under the syslog servers IP.
destination d_ossim { udp("172.18.18.40" spoof_source(yes)); };
destination d_ht49_langw_haddentech_com { file("/var/log/remote/ht49-langw.haddentech.com.log"); };
destination d_ht49_wangw_haddentech_com { file("/var/log/remote/ht49-wangw.haddentech.com.log"); };
destination d_unknown { file("/var/log/remote/unknown.log"); };

### And it all comes together...
log { source(s_network_a); filter(f_ht49_langw_haddentech_com); destination(d_ht49_langw_haddentech_com); destination(d_ossim); };
log { source(s_network_a); filter(f_ht49_wangw_haddentech_com); destination(d_ht49_wangw_haddentech_com); destination(d_ossim); };
log { source(s_network_a); filter(f_unknown); destination(d_unknown); destination(d_ossim); };

Add the remote folder to /var/log
```
sudo mkdir /var/log/remote
```
Restart syslog-ng
```
sudo systemctl restart syslog-ng
```

Add firewall rule to allow log traffic in and reload firewalld

sudo firewall-cmd --permanent --add-port=514/tcp
sudo firewall-cmd --permanent --add-port=514/udp
sudo firewall-cmd --reload

If you need to use non-standard ports or need to troubleshoot or use semanage to make a rule here is an example of what to do:

sudo dnf install policycoreutils-python
sudo semanage port -a -t syslogd_port_t -p tcp 8100
sudo semanage port -a -t syslogd_port_t -p udp 8100
sudo semanage fcontext -a -t var_log_t /var/splunk-syslog
sudo restorecon -v '/var/splunk-syslog'
sudo logger -d -P 8100 -n 127.0.0.1 -p 1 "test2"
sudo cd /root
sudo mkdir selinux
sudo cd selinux
sudo audit2allow -M syslog-ng-modified -l -i /var/log/audit/audit.log
#verify the file does not contain anything no related to syslog
sudo vim syslog-ng-modified.te
sudo semodule -i syslog-ng-modified.pp

http://danielsokolowski.blogspot.com/2012/09/maximum-logrotate-compression-with-bzip2.html

Create logrotate configuration
```
sudo vim /etc/logrotate.d/remote
```

Add the following to enable bzip2 compression since I plan on holding onto logs for 390 days, rotate 900 is so that if logs get big and are rotated more than once a day I'll still have them for over a year…

/var/log/remote/*.log {
    daily
    create 0644 root root
    rotate 900
    maxage 395
    maxsize 100M
    dateext
    dateformat -%Y-%m-%d_%s
    notifempty
    compress
    compresscmd /bin/bzip2
    uncompresscmd /bin/bunzip2
    compressoptions -9
    compressext .bz2
    copytruncate
}

Note: Logrotate runs once daily by default, if your logs are getting too big before days end then you'll want to increase the frequency that logrotate runs.

Install OS and Packages

Configure syslog-ng to receive logs

SELinux Steps

Logrotate

He holds the keys