Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow configuration of SyslogFacility in sshd_config #232

Open
djessich opened this issue Jan 30, 2021 · 0 comments
Open

Allow configuration of SyslogFacility in sshd_config #232

djessich opened this issue Jan 30, 2021 · 0 comments

Comments

@djessich
Copy link

djessich commented Jan 30, 2021

Is your feature request related to a problem? Please describe.
Set by this cookbook, on CentOS 7 there is no syslog facility named AUTH available by default causing all logging to be redirected to /var/log/messages. CentOS 7 defines syslog facility AUTHPRIV in SSH daemon configuration by default, that references /var/log/secure, but it cannot be configured using this cookbook.

Describe the solution you'd like
Please add node attribute to allow configuration of syslog facility in SSH daemon config which should be set to AUTHPRIV on RHEL and AUTH for other platforms by default. This node attribute should be rendered into SSH daemon config file to option SyslogFacility.

Describe alternatives you've considered
It is possible to override the template of this cookbook in a wrapper cookbook and use that one to render the SSH daemon config file. However this is problematic when the configuration file of this cookbook changes, as these changes must be manually be applied to the configuration file template in the wrapper cookbook.

Apart from that, it is also possible to workaround the problem by adding an additional facility with name AUTH to syslog configuration. However, it affects the whole system, any package that uses AUTH will be affected. By default, CentOS 7 does not include AUTH and defines AUTHPRIV instead which should be followed (see above).

Additional context
Due to use of AUTH by default in SSH daemon config, services as fail2ban parse the wrong log file without any actions taken on wrong user authentication. By default, fail2ban defines SSH logs to be AUTHPRIV (so /var/log/secure) on RHEL platform families.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant