Other ports are sometimes used in examples, however SELinux is only configured to allow sending and receiving on the following ports by default:

~]# semanage port -l | grep syslogsyslogd_port_t tcp 6514, 601syslogd_port_t udp 514, 6514, 601

The semanage utility is provided as part of the policycoreutils-python package. If required, install the package as follows:

~]# yum install policycoreutils-python

In addition, by default the SELinux type for rsyslog, rsyslogd_t, is configured to permit sending and receiving to the remote shell (rsh) port with SELinux type rsh_port_t, which defaults to TCP on port 514. Therefore it is not necessary to use semanage to explicitly permit TCP on port 514. For example, to check what SELinux is set to permit on port 514, enter a command as follows:

~]# semanage port -l | grep 514output omittedrsh_port_t tcp 514syslogd_port_t tcp 6514, 601syslogd_port_t udp 514, 6514, 601

For more information on SELinux, see RedHat EnterpriseLinux6 SELinux User Guide.

Procedure25.5.Configure SELinux to Permit rsyslog Traffic on a Port

If required to use a new port for rsyslog traffic, follow this procedure on the logging server and the clients. For example, to send and receive TCP traffic on port 10514, proceed as follows:

1. ~]# semanage port -a -t syslogd_port_t -p tcp 10514

2. Review the SELinux ports by entering the following command:

   ~]# semanage port -l | grep syslog

3. If the new port was already configured in /etc/rsyslog.conf, restart rsyslog now for the change to take effect:

   ~]# service rsyslog restart

4. Verify which ports rsyslog is now listening to:

   ~]# netstat -tnlp | grep rsyslogtcp 0 0 0.0.0.0:10514 0.0.0.0:* LISTEN 2528/rsyslogdtcp 0 0 :::10514 :::* LISTEN 2528/rsyslogd

Procedure25.6.Configuring The iptables Firewall

Configure the iptables firewall to allow incoming rsyslog traffic. For example, to allow TCP traffic on port 10514, proceed as follows:

1. Open the /etc/sysconfig/iptables file in a text editor.

2. Add an INPUT rule allowing TCP traffic on port 10514 to the file. The new rule must appear before any INPUT rules that REJECT traffic.

   -A INPUT -m state --state NEW -m tcp -p tcp --dport 10514 -j ACCEPT

3. Save the changes to the /etc/sysconfig/iptables file.

4. Restart the iptables service for the firewall changes to take effect.

   ~]#service iptables restart

Procedure25.7.Configuring rsyslog to Receive and Sort Remote Log Messages

1. Open the /etc/rsyslog.conf file in a text editor and proceed as follows:

   1. Add these lines below the modules section but above the Provides UDP syslog reception section:

      # Define templates before the rules that use them### Per-Host Templates for Remote Systems ###$template TmplAuthpriv, "/var/log/remote/auth/%HOSTNAME%/%PROGRAMNAME:::secpath-replace%.log"$template TmplMsg, "/var/log/remote/msg/%HOSTNAME%/%PROGRAMNAME:::secpath-replace%.log"

   2. Replace the default Provides TCP syslog reception section with the following:

      # Provides TCP syslog reception$ModLoad imtcp# Adding this ruleset to process remote messages$RuleSet remote1authpriv.* ?TmplAuthpriv*.info;mail.none;authpriv.none;cron.none ?TmplMsg$RuleSet RSYSLOG_DefaultRuleset #End the rule set by switching back to the default rule set$InputTCPServerBindRuleset remote1 #Define a new input and bind it to the "remote1" rule set$InputTCPServerRun 10514

   Save the changes to the /etc/rsyslog.conf file.

2. The rsyslog service must be running on both the logging server and the systems attempting to log to it.

   1. Use the service command to start the rsyslog service.

      ~]#service rsyslog start

   2. To ensure the rsyslog service starts automatically in future, enter the following command as root:

      ~]#chkconfig rsyslog on

template(name="TmplAuthpriv" type="string" string="/var/log/remote/auth/%HOSTNAME%/%PROGRAMNAME:::secpath-replace%.log" )template(name="TmplMsg" type="string" string="/var/log/remote/msg/%HOSTNAME%/%PROGRAMNAME:::secpath-replace%.log" )

template(name="TmplAuthpriv" type="list") { constant(value="/var/log/remote/auth/") property(name="hostname") constant(value="/") property(name="programname" SecurePath="replace") constant(value=".log") }template(name="TmplMsg" type="list") { constant(value="/var/log/remote/msg/") property(name="hostname") constant(value="/") property(name="programname" SecurePath="replace") constant(value=".log") }

To complete the change to the new syntax, we need to reproduce the module load command, add a rule set, and then bind the rule set to the protocol, port, and ruleset:

module(load="imtcp")ruleset(name="remote1"){ authpriv.* action(type="omfile" DynaFile="TmplAuthpriv") *.info;mail.none;authpriv.none;cron.none action(type="omfile" DynaFile="TmplMsg")}input(type="imtcp" port="10514" ruleset="remote1")