SoC: Improve syslogd

[Martin Schütte <lists%mschuette.name@localhost>]

Hello,
I am preparing a Summer of Code application and would like to introduce 
my project and myself, hoping for some feedback and advice.

I want to implement the upcoming IETF standards for Syslog 
(http://tools.ietf.org/wg/syslog/). In order of priority: 
syslog-transport-tls, syslog-protocol, and syslog-sign.

- transport-tls defines the network protocol to send syslog over TLS 
(instead of UDP), thus providing a reliable and authenticated transport.
In addition to reliable network transport I also consider a modified 
local log submission (from syslog(3) to syslogd) to use a stream instead 
of a datagram socket, thus providing reliable submission and possible 
rate limits.

- syslog-protocol defines a new layout for syslog lines; the most 
important additions are full timestamps (with year and timezone) and 
structured data with name=value pairs. This enables all programs to 
declare semantic content (uid, client IP, return codes, etc) so an 
automatic log-monitoring only has to know the used namespace instead of 
all possible messages.

- syslog-sign defines signature messages for authentication, integrity 
and correct sequencing of syslog messages. (For this part I am going to 
build upon the afaik only existing implementation by Albert Mietus.)

To my knowledge that would be one of the first implementations of these
protocols (which hopefully will be published as RFCs this summer). It 
will provide NetBSD (and probably the other BSDs as well) with an 
advanced, reliable, and secure syslogd, saving admins the time and 
effort to install packages and set up custom logging solutions just to 
get secure transport to their central logserver.

A little about myself: I study computer science at the University of 
Potsdam, Germany. Beside my studies I administer some FreeBSD servers 
and have already set up a logging infrastructure using syslog-ng and 
stunnel, resulting in a talk about Logging at the Chemnitzer Linuxtage 
2007 (german only).

Regards,
Martin