Adaptations pour l’envoi des logs samba
This commit is contained in:
32
00-addc-forward_samba_logs
Normal file
32
00-addc-forward_samba_logs
Normal file
@ -0,0 +1,32 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
ADDC_PATH="/var/lib/lxc/addc/rootfs"
|
||||||
|
|
||||||
|
. /usr/lib/eole/utils.sh
|
||||||
|
|
||||||
|
InstallSSLFiles rsyslog_addc syslog syslog "$ADDC_PATH/etc/rsyslog.d/ssl/"
|
||||||
|
if [ $(CreoleGet samba_log_connexion_authentification_proxy non) == 'oui' ]
|
||||||
|
then
|
||||||
|
ca_path=$(CreoleGet samba_log_connexion_ca_chemin)
|
||||||
|
if [ -f $ca_path ]
|
||||||
|
then
|
||||||
|
cat /etc/ssl/certs/ca_local.crt $ca_path > "$ADDC_PATH/etc/ssl/certs/ca_rsyslog.crt"
|
||||||
|
else
|
||||||
|
EchoRouge "Le certificat racine pour le pair rsyslog n’a pas été trouvé"
|
||||||
|
EchoRouge "Utilisation du mode anonyme"
|
||||||
|
cp /etc/ssl/certs/ca_local.crt "$ADDC_PATH/etc/ssl/certs/ca_rsyslog.crt"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
cp /etc/ssl/certs/ca_local.crt "ADDC_PATH/etc/ssl/certs/ca_rsyslog.crt"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ ! -e "$ADDC_PATH/var/log/rsyslog/queues" ]
|
||||||
|
then
|
||||||
|
mkdir -p "$ADDC_PATH/var/log/rsyslog/queues"
|
||||||
|
lxc-attach -n addc chown syslog:adm /var/log/rsyslog/queues
|
||||||
|
fi
|
||||||
|
|
||||||
|
lxc-attach -n addc apt install rsyslog-gnutls
|
||||||
|
|
||||||
|
lxc-attach -n addc systemctl restart rsyslog
|
||||||
|
exit 0
|
||||||
42
60_forward_samba_logs.xml
Normal file
42
60_forward_samba_logs.xml
Normal file
@ -0,0 +1,42 @@
|
|||||||
|
<?xml version="1.0" encoding="utf-8"?>
|
||||||
|
<creole>
|
||||||
|
<files>
|
||||||
|
<file filelist='forward_samba_logs' name='/var/lib/lxc/addc/rootfs/etc/rsyslog.d/01-forward_samba.conf' source='addc-samba_logs_forward.conf' mkdir='True' rm='True'/>
|
||||||
|
</files>
|
||||||
|
<variables>
|
||||||
|
<family name='Samba'>
|
||||||
|
<variable name='activer_envoi_log_connexion' type='oui/non' description='Activer l’envoi des logs de connexion au proxy'>
|
||||||
|
<value>oui</value>
|
||||||
|
</variable>
|
||||||
|
<variable name="samba_log_connexion_proxy_ip" type='ip' description='Adresse IP du proxy traitant les logs' mandatory="True"/>
|
||||||
|
<variable name="samba_log_connexion_proxy_port" type='number' description='Port du proxy traitant les logs'>
|
||||||
|
<value>10514</value>
|
||||||
|
</variable>
|
||||||
|
<variable name="samba_log_connexion_authentification_proxy" type="oui/non" description="Authentifier le récepteur des logs">
|
||||||
|
<value>non</value>
|
||||||
|
</variable>
|
||||||
|
<variable name="samba_log_connexion_ca_chemin" type="filename" description="Chemin du certificat racine du proxy" mandatory="True"/>
|
||||||
|
<variable name="samba_log_connexion_proxy_nom" type="domain" description="Nom de domaine du proxy" mandatory="True"/>
|
||||||
|
</family>
|
||||||
|
</variables>
|
||||||
|
<constraints>
|
||||||
|
<condition name='disabled_if_in' source='activer_envoi_log_connexion'>
|
||||||
|
<param>non</param>
|
||||||
|
<target type='filelist'>forward_samba_logs</target>
|
||||||
|
<target type='variable'>samba_log_connexion_proxy_ip</target>
|
||||||
|
<target type='variable'>samba_log_connexion_proxy_port</target>
|
||||||
|
<target type='variable'>samba_log_connexion_authentification_proxy</target>
|
||||||
|
</condition>
|
||||||
|
<condition name='disabled_if_in' source='samba_log_connexion_authentification_proxy'>
|
||||||
|
<param>non</param>
|
||||||
|
<target type='variable'>samba_log_connexion_ca_chemin</target>
|
||||||
|
<target type='variable'>samba_log_connexion_proxy_nom</target>
|
||||||
|
</condition>
|
||||||
|
</constraints>
|
||||||
|
<help>
|
||||||
|
<variable name='activer_envoi_log_connexion'>Les logs de connexions sont utiles au proxy type Palo Alto pour en dériver les autorisations de flux réseau (relation IP/utilisateur pour déterminer les permissions).</variable>
|
||||||
|
<variable name="samba_log_connexion_authentification_proxy">L’authentification du récepeteur des logs nécessite la récupération du certificat racine de celui-ci pour pouvoir valider son certificat x509</variable>
|
||||||
|
<variable name="samba_log_connexion_ca_chemin">Le certificat racine ayant servi à signer le certificat présenté par le proxy.</variable>
|
||||||
|
<variable name="samba_log_connexion_proxy_nom">Nom FQDN apparaissant dans le certificat x509 présenté par le proxy.</variable>
|
||||||
|
</help>
|
||||||
|
</creole>
|
||||||
19
addc-samba_logs_forward.conf
Normal file
19
addc-samba_logs_forward.conf
Normal file
@ -0,0 +1,19 @@
|
|||||||
|
$DefaultNetstreamDriver gtls
|
||||||
|
$DefaultNetstreamDriverCAFile /etc/ssl/certs/ca_rsyslog.crt
|
||||||
|
$DefaultNetstreamDriverCertFile /etc/rsyslog.d/ssl/certs/rsyslog_addc.crt
|
||||||
|
$DefaultNetstreamDriverKeyFile /etc/rsyslog.d/ssl/private/rsyslog_addc.key
|
||||||
|
|
||||||
|
|
||||||
|
$WorkDirectory /var/log/rsyslog/queues
|
||||||
|
$ActionQueueType LinkedList
|
||||||
|
$ActionQueueFileName samba
|
||||||
|
$ActionQueueSaveOnShutdown on
|
||||||
|
|
||||||
|
%if %%samba_log_connexion_authentification_proxy == 'oui'
|
||||||
|
$ActionSendStreamDriverAuthMode x509/name
|
||||||
|
$ActionSendStreamDriverPermittedPeer %%samba_log_connexion_proxy_name
|
||||||
|
%else
|
||||||
|
$ActionSendStreamDriverAuthMode anon
|
||||||
|
%end if
|
||||||
|
$ActionSendStreamDriverMode 1
|
||||||
|
:programname, isequal, "samba" @@%%samba_log_connexion_proxy_ip:%%samba_log_connexion_proxy_port
|
||||||
11
smb-addc.conf.patch
Normal file
11
smb-addc.conf.patch
Normal file
@ -0,0 +1,11 @@
|
|||||||
|
--- distrib/smb-addc.conf 2025-02-18 09:29:25.000000000 +0100
|
||||||
|
+++ modif/smb-addc.conf 2025-06-16 10:31:57.625340810 +0200
|
||||||
|
@@ -21,6 +21,8 @@
|
||||||
|
usershare max shares = 0
|
||||||
|
restrict anonymous = 2
|
||||||
|
interfaces = %%ad_public_address
|
||||||
|
+ syslog = 4
|
||||||
|
+ log level = 0 auth_audit:4
|
||||||
|
|
||||||
|
[netlogon]
|
||||||
|
comment = Network Logon Service
|
||||||
Reference in New Issue
Block a user