Skip to content

Commit e396c38

Browse files
J-C-BJ-C-B
committed
Create SC4S-Splunk-Connect-for-Syslog-centos8.sh
updated container pull for sc4s to version 2
1 parent 0a9a577 commit e396c38

File tree

1 file changed

+141
-0
lines changed

1 file changed

+141
-0
lines changed

‎SC4S-Splunk-Connect-for-Syslog-centos8.sh‎

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
#!/bin/bash
2+
# 14/03/2022 John Barnett
3+
# Script created on / for CentOS 8
4+
5+
# 21/07/2021 - Added TLS Remix, added TLS listener - note creates a default cert below so edit / remove as required
6+
# 14/03/2022 - Updated default container pull to version 2
7+
8+
### Based on quick start here - https://splunk.github.io/splunk-connect-for-syslog/main/gettingstarted/podman-systemd-general/
9+
10+
# Set URL and Tokens here
11+
12+
# SplunkCloud Example
13+
# HEC_URL="https://http-inputs-MYSTACKNAME.splunkcloud.com"
14+
15+
HEC_URL="https://127.0.0.1:8088"
16+
HEC_TOKEN="520b411a-3949-4c2c-948a-01eaf6a35f34"
17+
#hostnamectl
18+
#hostnamectl set-chassis server
19+
#hostnamectl set-location rack1
20+
#hostnamectl set-hostname sc4sbuilder
21+
hostnamectl
22+
23+
################################################################################
24+
########### Dont edit below here, unless you know what you are doing ###########
25+
################################################################################
26+
red=`tput setaf 1`
27+
green=`tput setaf 2`
28+
yellow=`tput setaf 3`
29+
reset=`tput sgr0`
30+
echo "${yellow}Check date and TZ below!${reset}"
31+
date
32+
echo "${yellow}Updating Firewall Rules${reset}"
33+
#Show original state
34+
firewall-cmd --list-all
35+
#Splunk ports
36+
firewall-cmd --zone=public --add-port=514/tcp --permanent # syslog TCP
37+
firewall-cmd --zone=public --add-port=514/udp --permanent # syslog UDP
38+
firewall-cmd --zone=public --add-port=6514/tcp --permanent # syslog TLS
39+
firewall-cmd --reload
40+
#Check applied
41+
firewall-cmd --list-all
42+
43+
dnf install -y conntrack podman
44+
echo "
45+
## Edited with JB Splunk Install script by magic
46+
net.core.rmem_default = 17039360
47+
net.core.rmem_max = 17039360
48+
" >> /etc/sysctl.conf
49+
50+
sysctl -p
51+
52+
53+
echo "
54+
## Created with JB Splunk Install script by magic
55+
[Unit]
56+
Description=SC4S Container
57+
Wants=NetworkManager.service network-online.target
58+
After=NetworkManager.service network-online.target
59+
60+
[Install]
61+
WantedBy=multi-user.target
62+
63+
[Service]
64+
Environment=\"SC4S_IMAGE=ghcr.io/splunk/splunk-connect-for-syslog/container2:2\"
65+
66+
# Required mount point for syslog-ng persist data (including disk buffer)
67+
Environment=\"SC4S_PERSIST_MOUNT=splunk-sc4s-var:/var/lib/syslog-ng\"
68+
69+
# Optional mount point for local overrides and configurations; see notes in docs
70+
Environment=\"SC4S_LOCAL_MOUNT=/opt/sc4s/local:/etc/syslog-ng/conf.d/local:z\"
71+
72+
# Optional mount point for local disk archive (EWMM output) files
73+
Environment=\"SC4S_ARCHIVE_MOUNT=/opt/sc4s/archive:/var/lib/syslog-ng/archive:z\"
74+
75+
# Uncomment the following line if custom TLS certs are provided
76+
Environment=\"SC4S_TLS_MOUNT=/opt/sc4s/tls:/etc/syslog-ng/tls:z\"
77+
78+
TimeoutStartSec=0
79+
80+
ExecStartPre=/usr/bin/podman pull \$SC4S_IMAGE
81+
ExecStartPre=/usr/bin/bash -c \"/usr/bin/systemctl set-environment SC4SHOST=$(hostname -s)\"
82+
83+
ExecStart=/usr/bin/podman run \\
84+
-e \"SC4S_CONTAINER_HOST=\${SC4SHOST}\" \\
85+
-v \$SC4S_PERSIST_MOUNT \\
86+
-v \$SC4S_LOCAL_MOUNT \\
87+
-v \$SC4S_ARCHIVE_MOUNT \\
88+
-v \$SC4S_TLS_MOUNT \\
89+
--env-file=/opt/sc4s/env_file \\
90+
--health-cmd="/healthcheck.sh" \\
91+
--health-interval=10s --health-retries=6 --health-timeout=6s \\
92+
--network host \\
93+
--name SC4S \\
94+
--rm \$SC4S_IMAGE
95+
96+
Restart=on-abnormal
97+
" > /lib/systemd/system/sc4s.service
98+
99+
100+
sudo podman volume create splunk-sc4s-var
101+
sudo mkdir /opt/sc4s/
102+
mkdir /opt/sc4s/local
103+
mkdir /opt/sc4s/archive
104+
mkdir /opt/sc4s/tls
105+
106+
echo "
107+
## Created with JB Splunk Install script by magic
108+
# Output config
109+
SC4S_DEST_SPLUNK_HEC_DEFAULT_URL=$HEC_URL
110+
SC4S_DEST_SPLUNK_HEC_DEFAULT_TOKEN=$HEC_TOKEN
111+
#Uncomment the following line if using untrusted SSL certificates
112+
SC4S_DEST_SPLUNK_HEC_TLS_VERIFY=no
113+
# TLS Config, for McAfee etc
114+
SC4S_SOURCE_TLS_ENABLE=yes
115+
SC4S_LISTEN_DEFAULT_TLS_PORT=6514
116+
#SC4S_SOURCE_TLS_OPTIONS=tls1.2
117+
#SC4S_SOURCE_TLS_CIPHER_SUITE=ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
118+
" > /opt/sc4s/env_file
119+
echo "${yellow}Generating Cert for TLS${reset}"
120+
openssl req -newkey rsa:2048 -new -nodes -x509 -days 3650 -subj "/C=NZ/ST=NI/L=Home/O=SC4S Name/OU=Org/CN=sc4sbuilder" -keyout /opt/sc4s/tls/server.key -out /opt/sc4s/tls/server.pem
121+
echo "${yellow}Your /opt/sc4s/env_file looks like this${reset}"
122+
cat /opt/sc4s/env_file
123+
echo "${yellow}Starting SC4S - This might take a while first time as the container is downloaded${reset}"
124+
sudo systemctl daemon-reload
125+
sudo systemctl enable --now sc4s
126+
127+
# Send a test event
128+
echo “Hello MYSC4S” > /dev/udp/127.0.0.1/514
129+
sleep 10
130+
sudo podman logs SC4S
131+
sudo podman ps
132+
133+
# Sleep to allow TLS to come up
134+
sleep 20
135+
netstat -tulpn | grep LISTEN
136+
137+
#### Use command below and then type to test
138+
#openssl s_client -connect localhost:6514
139+
140+
#### Use command below for full tls test if required (adjust as needed)
141+
#podman run -ti drwetter/testssl.sh --severity MEDIUM --ip 127.0.0.1 sc4sbuilder:6514

0 commit comments

Comments
 (0)