logstash logo

How bind logstash on port 514 on CentOS 8

I know the situation, you need to send logs from an old piece of equipment to logstash running on a CentOS 8.
The problem is the following: the device is old and doesn’t support changing the default syslog port from 514/udp to something different, like port 5140/udp.
Unfortunately this can happen, for example on virtual appliances like ZeroShell, where there’s no way to change the syslog port from the default one, but there’s a quick solution to this!

What I’m going to show you is how bind logstash on port 514 or any privileged port with a non-root user.

Why you cannot run logstash as non-privileged user and at the same time bind it on a privileged port?
This is a security feature, in that if you connect to a service on one of these ports you can be fairly sure that you have the real thing, and not a fake which some hacker has put up for you. It would be really dangerous to allow system-wide to any service to bind to a non privileged port, because ports from 1 to 1023 are indeed privileged!

BTW, this is not a guide on how to set the listening port of logstash, but rather to allow java to bind to a port < 1024.

The procedure is very easy. First of all we need to find the path of the java process bundled with logstash, and the path of the libjli.so library.

The 2 paths should looks like this:

/usr/share/logstash/jdk/bin/java
/usr/share/logstash/jdk/lib/jli

Once you have the path of the 2 files, you can start.
Enter the following commands as root.

setcap CAP_NET_BIND_SERVICE=+eip /usr/share/logstash/jdk/bin/java; getcap /usr/share/logstash/jdk/bin/java #this allows java to bind to port < 1024
echo "/usr/share/logstash/jdk/lib/jli" > /etc/ld.so.conf.d/java.conf # this will be used by ldconfig
ldconfig; ldconfig -v -p | grep libjli # checking if the library we need is found in the cache
reboot

When the system is loaded, start the service and check the status and if it bounded to the right port.

systemctl start logstash; journalctl -xef -u logstash # start the service and check the logs
systemctl status logstash # check the status of the service
ss -tlnp | grep 514 # check if logstash succesfully bound to 514

At this point you shoud have your logstash up and running, and most important listening to port 514.
And this was how bind logstash on port 514, thank you for reading.

Quanto è stato utile questo post?

Clicca su una stella per votare!

Mi dispiace che questo post non ti sia stato utile!

Permettimi di migliorare questo post!

Dimmi come posso migliorare questo post!

Lascia un commento