diff options
Diffstat (limited to '')
-rw-r--r-- | source/configuration/modules/sigprov_ksi.rst | 99 |
1 files changed, 99 insertions, 0 deletions
diff --git a/source/configuration/modules/sigprov_ksi.rst b/source/configuration/modules/sigprov_ksi.rst new file mode 100644 index 0000000..99193cb --- /dev/null +++ b/source/configuration/modules/sigprov_ksi.rst @@ -0,0 +1,99 @@ +Keyless Signature Infrastructure Provider (ksi) +=============================================== + +**Signature Provider Name: ksi** + +**Author:** Rainer Gerhards <rgerhards@adiscon.com> + +**Supported:** from 8.11.0 to 8.26.0 + +**Description**: + +Provides the ability to sign syslog messages via the GuardTime KSI +signature services. + +**Configuration Parameters**: + +Note: parameter names are case-insensitive. + +Signature providers are loaded by omfile, when the provider is selected +in its "sig.providerName" parameter. Parameters for the provider are +given in the omfile action instance line. + +This provider creates a signature file with the same base name but the +extension ".ksisig" for each log file (both for fixed-name files as well +as dynafiles). Both files together form a set. So you need to archive +both in order to prove integrity. + +- **sig.hashFunction** <Hash Algorithm> + The following hash algorithms are currently supported: + + - SHA1 + - SHA2-256 + - RIPEMD-160 + - SHA2-224 + - SHA2-384 + - SHA2-512 + - RIPEMD-256 + - SHA3-244 + - SHA3-256 + - SHA3-384 + - SHA3-512 + - SM3 + +- **sig.aggregator.uri** <KSI Aggregator URL> + This provides the URL of the KSI Aggregator service provided by + guardtime and looks like this: + + ksi+tcp://[ip/dnsname]:3332 + +- **sig.aggregator.user** <KSI UserID> + Set your username provided by Guardtime here. + +- **sig.aggregator.key** <KSI Key / Password> + Set your key provided by Guardtime here. + +- **sig.block.sizeLimit** <nbr-records> + The maximum number of records inside a single signature block. By + default, there is no size limit, so the signature is only written on + file closure. Note that a signature request typically takes between + one and two seconds. So signing to frequently is probably not a good + idea. + +- **sig.keepRecordHashes** <on/**off**> + Controls if record hashes are written to the .gtsig file. This + enhances the ability to spot the location of a signature breach, but + costs considerable disk space (65 bytes for each log record for + SHA2-512 hashes, for example). + +- **sig.keepTreeHashes** <on/**off**> + Controls if tree (intermediate) hashes are written to the .gtsig + file. This enhances the ability to spot the location of a signature + breach, but costs considerable disk space (a bit mire than the amount + sig.keepRecordHashes requries). Note that both Tree and Record hashes + can be kept inside the signature file. + +**See Also** + + +**Caveats/Known Bugs:** + +- currently none known + +**Samples:** + +This writes a log file with it's associated signature file. Default +parameters are used. + +:: + + action(type="omfile" file="/var/log/somelog" sig.provider="ksi") + +In the next sample, we use the more secure SHA2-512 hash function, sign +every 10,000 records and Tree and Record hashes are kept. + +:: + + action(type="omfile" file="/var/log/somelog" sig.provider="ksi" + sig.hashfunction="SHA2-512" sig.block.sizelimit="10000" + sig.keepTreeHashes="on" sig.keepRecordHashes="on") |