Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm considering using a service from papertrailapp.com (other similar services are loggly and splunk), where you configure your syslog to echo events to it over udp. It involves adding this entry to /etc/rsyslog.conf

*.* @logs.papertrailapp.com:12345  (where 12345 is a port unique to my account)

So my question is, is this secure? Couldn't someone sniff the traffic and watch the log output from my server?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

No, it is not secure. Not only can they watch the log output if they can sniff the traffic, but they can spoof log messages coming from your systems too.

You should consider using a modern syslog implementation with RELP. I believe RELP is still not secure enough for what you are asking (though I might be wrong) but it is a lot better than the standard lightweight UDP syslog protocol. Also it is reliable (the "R" in "RELP") so it is a lot better for transmission over WANs.

share|improve this answer

Nothing is 100% "secure". You need to decide what is worth protecting against and what is an imaginary problem in your specific environment. For example, "hackers" rarely sit in the middle of the wired network sniffing traffic, only ISPs and governments do so.

If you want to protect your traffic against your government's and ISP's surveillance, then yes, UDP transport is insecure. If you don't care about those, then UDP is good enough.

Re spoofing messages - the same story - decide if it bothers you and then act accordingly.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.