1 files changed, 73 insertions, 0 deletions
diff --git a/source/configuration/modules/gssapi.rst b/source/configuration/modules/gssapi.rst
new file mode 100644
index 0000000..157f5a3
--- /dev/null
+++ b/source/configuration/modules/gssapi.rst
@@ -0,0 +1,73 @@
+GSSAPI module support in rsyslog v3
+===================================
+
+What is it good for.
+
+-  client-serverauthentication
+-  Log messages encryption
+
+Requirements.
+
+-  Kerberos infrastructure
+-  rsyslog, rsyslog-gssapi
+
+Configuration.
+
+Let's assume there are 3 machines in Kerberos Realm:
+
+-  the first is running KDC (Kerberos Authentication Service and Key
+   Distribution Center),
+-  the second is a client sending its logs to the server,
+-  the third is receiver, gathering all logs.
+
+1. KDC:
+
+-  Kerberos database must be properly set-up on KDC machine first. Use
+   kadmin/kadmin.local to do that. Two principals need to be add in our
+   case:
+
+#. sender@REALM.ORG
+
+-  client must have ticket for principal sender
+-  REALM.ORG is kerberos Realm
+
+#. host/receiver.mydomain.com@REALM.ORG - service principal
+
+-  Use ktadd to export service principal and transfer it to
+   /etc/krb5.keytab on receiver
+
+2. CLIENT:
+
+-  set-up rsyslog, in /etc/rsyslog.conf
+-  $ModLoad omgssapi - load output gss module
+-  $GSSForwardServiceName otherThanHost - set the name of service
+   principal, "host" is the default one
+-  \*.\* :omgssapi:receiver.mydomain.com - action line, forward logs to
+   receiver
+-  kinit root - get the TGT ticket
+-  service rsyslog start
+
+3. SERVER:
+
+-  set-up rsyslog, in /etc/rsyslog.conf
+
+-  $ModLoad `imgssapi <imgssapi.html>`_ - load input gss module
+
+-  $InputGSSServerServiceName otherThanHost - set the name of service
+   principal, "host" is the default one
+
+-  $InputGSSServerPermitPlainTCP on - accept GSS and TCP connections
+   (not authenticated senders), off by default
+
+-  $InputGSSServerRun 514 - run server on port
+
+-  service rsyslog start
+
+The picture demonstrate how things work.
+
+.. figure:: gssapi.png
+   :align: center
+   :alt: rsyslog gssapi support
+
+   rsyslog gssapi support
+