3 ms·

RFC 5848, "Signed Syslog Messages": > This document describes a mechanism to add origin authentication, message integrity, replay resistance, message sequencin

RFC 5848, "Signed Syslog Messages": > This document describes a mechanism to add origin authentication, message integrity, replay resistance, message sequencing, and detection of missing messages to the transmitted syslog messages. This specification is intended to be used in conjunction with the work defined in RFC 5424, "The Syslog Protocol". * https://tools.ietf.org/html/rfc5848 https://tools.ietf.org/html/rfc5848

deathanatos 6y ago
Every time I've seen syslog in the wild, it's been the old "BSD" version (RFC 3164), not the newer RFC 5424 version. And pretty much any newer format, even something basic like JSON-lines over TCP, is going to be nicer to work with, IMO. (Though I admit, I have no idea how I'd even begin to start signing messages with JSON-lines.)
- peteretep 6y ago
  Got to believe most JSON parsers can be set to permissive mode to allow comments, and then you could just append `//signature` on to the end of each JSON line?
  - throw0101a 6y ago
    Or you can simply STRUCTURED-DATA of RFC 5424 (§6.3) and put the signature into JSON proper as outlined in RFC 5428 § 4.2.9 (example): 2009-05-03T14:00:39.529966+02:00 host.example.org syslogd 2138 - [ssign VER="0111" RSID="1" SG="0" SPRI="0" GBC="2" FMN="1" CNT="7" HB="K6wzcombEvKJ+UTMcn9bPryAeaU= zrkDcIeaDluypaPCY8WWzwHpPok= zgrWOdpx16ADc7UmckyIFY53icE= XfopJ+S8/hODapiBBCgVQaLqBKg= J67gKMFl/OauTC20ibbydwIlJC8= M5GziVgB6KPY3ERU1HXdSi2vtdw= Wxd/lU7uG/ipEYT9xeqnsfohyH0=" SIGN="AKBbX4J7QkrwuwdbV7Taujk2lvOf8gCgC62We1QYfnrNHz7FzAvdySuMyfM="] You're trying to re-invent the wheel. Look at the prior art.
- throw0101a 6y ago
  The STRUCTURED-DATA of RFC 5424 is basically JSON: > [exampleSDID@32473 iut="3" eventSource="Application" eventID="1011"][examplePriority@32473 class="high"] * https://tools.ietf.org/html/rfc5424#section-6.3 https://tools.ietf.org/html/rfc5424#section-6.3

deathanatos 6y ago

Every time I've seen syslog in the wild, it's been the old "BSD" version (RFC 3164), not the newer RFC 5424 version. And pretty much any newer format, even something basic like JSON-lines over TCP, is going to be nicer to work with, IMO. (Though I admit, I have no idea how I'd even begin to start signing messages with JSON-lines.)

peteretep 6y ago
Got to believe most JSON parsers can be set to permissive mode to allow comments, and then you could just append `//signature` on to the end of each JSON line?
- throw0101a 6y ago
  Or you can simply STRUCTURED-DATA of RFC 5424 (§6.3) and put the signature into JSON proper as outlined in RFC 5428 § 4.2.9 (example): 2009-05-03T14:00:39.529966+02:00 host.example.org syslogd 2138 - [ssign VER="0111" RSID="1" SG="0" SPRI="0" GBC="2" FMN="1" CNT="7" HB="K6wzcombEvKJ+UTMcn9bPryAeaU= zrkDcIeaDluypaPCY8WWzwHpPok= zgrWOdpx16ADc7UmckyIFY53icE= XfopJ+S8/hODapiBBCgVQaLqBKg= J67gKMFl/OauTC20ibbydwIlJC8= M5GziVgB6KPY3ERU1HXdSi2vtdw= Wxd/lU7uG/ipEYT9xeqnsfohyH0=" SIGN="AKBbX4J7QkrwuwdbV7Taujk2lvOf8gCgC62We1QYfnrNHz7FzAvdySuMyfM="] You're trying to re-invent the wheel. Look at the prior art.
throw0101a 6y ago
The STRUCTURED-DATA of RFC 5424 is basically JSON: > [exampleSDID@32473 iut="3" eventSource="Application" eventID="1011"][examplePriority@32473 class="high"] * https://tools.ietf.org/html/rfc5424#section-6.3 https://tools.ietf.org/html/rfc5424#section-6.3