Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm looking into monitoring a Windows VPS by sending Syslog messages to a Synology NAS, which can generate email alerts and such. I also would like to use SNMP to generate health stats, and see trends over time. Its supposed to provide intrusion detection as well as health monitoring.

After evaluating many Syslog Windows agents, I have not yet found a single freeware agent that supports TCP over HTTPS (while the Synology server does support it). They're almost all hardcoded to UDP port 514 (well, I can change the port on some, but I don't consider that helpful).

Since I'm planning to send converted windows eventlog messages over, I don't feel comfortable sending them unencrypted (they can contain full stacktraces and stuff like that).

I have looked into ways to limit the risk, and the only thing I can find is setting up the firewall to limit the sending of Syslog messages to my IP address. For SNMP the firewall can be limited to only accept requests from my client. An alternative is a commercial product with some hacks (which I'm not feeling really comfertable with).

The strange thing is that it seems like UDP 514 is the standard and even recommended looking at the answers in this thread, just like SNMP.

Am I too careful? It seems like the rest of the world has no problem with UDP? Do hosting providers of VPS servers prevent sniffing software on the internal (virtual) network? Or is it just safe to use UDP after all?

share|improve this question
    
There is an answer here for secure syslog messages over internet. –  AdnanG Aug 19 '13 at 10:21
1  
VPN between the sites? That would encrypt the tunnel and provide point-to-point security. –  schroeder Aug 19 '13 at 14:40
    
I got it working with a VPN, had to set up a scheduled task that would check the status of the VPN and reconnect if disconnected every hour or so. –  Louis Somers Sep 19 '13 at 18:39
add comment

2 Answers

You have a few options:

  1. First one that comes to mind is creating an SSH tunnel from your Windows Server to your Syslog Server and sending your syslogs to localhost:1514 which would tunnel to logserver:514. This would encrypt your Syslog data in an SSH tunnel. You can do this several ways, like a batch script on startup to invoke PuTTy, like this http://howto.ccs.neu.edu/howto/windows/ssh-port-tunneling-with-putty/

  2. Secondly, which is what I do, is use a tool like Logstash to receive syslogs and read log files locally, and set up an output over HTTPS. Logstash requires Java Runtime, but is very powerful, uses very little resources, and is extremely customizable.

  3. You can pay for syslog-ng professional which will do TCP over 514 and you can apply TLS/SSL to it.

share|improve this answer
add comment

You can use OSSEC agent which is an open source host based intrusion detection agent that not only can monitor log files but have an extensive list of rules for detecting other attacks such as port scanning and reconnaissance. You have to configure a separate server for the OSSEC agent on your network and then transfer the alerts from the OSSEC server to your syslog server. The reason for the separate server is because OSSEC encrypts all the traffic using the blowfish encryption algorithm and the OSSEC server needs to first decrypt the traffic before transferring it to the syslog server. All the traffic can be securely transferred from your VPS to your network using open source solution that have an active mailing list support as well.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.