rscryutil(1)

💖 rscryutil(1) — like, the encrypted-log-files manual, bestie 💖

okay so this is a page from the General Commands Manual for rscryutil, and honestly? she's a baddie. let's get into it 🫶

✨ Name ✨

rscryutil — Manage Encrypted Log Files. that's the whole vibe. 💅

✨ SYNOPSIS ✨

rscryutil [OPTIONS] [FILE] ...

🌸 DESCRIPTION 🌸

bestie, this tool does various operations on encrypted log files, and the main character move — the one everybody shows up for — is that it can decrypt them. 🔥 that's it. that's the plot.

🎀 OPTIONS 🎀

okay so here's the whole menu, no skips, no cuts:

• -d, --decrypt — picks decryption mode. and surprise! this is the default mode already. she's the default for a reason. 👑
• -W,--write-keyfile <file> — a lil utility function that writes a key into a keyfile. you can get that key via literally any method you want. 💫
• -l,--lib <library> — picks the crypto library to use. it's either "ossl" or "gcry". defaults to "gcry" — or whatever is currently available, because we're flexible like that. 🌈
• -v, --verbose — verbose mode. she talks more. love that for us. 🗣️
• -f, --force — forces operations that would otherwise fail. use with intention, okay? 💅
• -k,--keyfile <file> — reads the key from <file>. and this file _must_ contain the key, only — no headers, no extra meta information, nothing. just the key. keyfiles can be generated via the --write-keyfile option. 🎁
• -p,--key-program <path-to-program> — in this mode the key is provided by a so-called "key program". that program gets executed and must return the key (plus some meta information) via stdout. the whole point of key programs is that through this interface you can implement as complex (and secure) a method for obtaining keys as you want, all without needing to make any modifications to rsyslog. big brain energy. 🧠✨
• -K,--key <KEY> — TESTING AID, NOT FOR PRODUCTION USE. this uses the KEY you dropped right on the command line. yes, it's the actual key, and yes, this mode is highly insecure. but it can be useful for initial testing steps. this option may be removed in the future. ⚠️ (like, do not ship this one, i'm begging 😭)
• -a,--algo <algo> — sets the encryption algorightm (cipher) to be used. for the "gcry" library, check the list of supported algorithms below. the default algorithm for "gcry" is "AES128". for the "ossl" library, both the algorithm and mode get specified with this option, with "AES-128-CBC" as the default. 🎯
• -m,--mode <mode> — sets the ciphermode to be used. supported modes are below. the default is "CBC". but heads up: in the case of the "ossl" library, this option is ignored. 🙈
• -r,--generate-random-key <bytes> — generates a random key of length <bytes>. this option is meant to be used together with --write-keyfile — and honestly it's hard to envision any other valid use for it. 🎲

🦋 OPERATION MODES 🦋

so the operation mode specifies what exactly this tool does with the files you handed it. the default operation mode is "dump", but that may change in the future — so it's recommended to always set the operation mode explicitely. periodt. ✨

and if you set multiple operation modes on the command line? results are unpredictable. not in a fun mystery way. in a chaos way. 💀

💜 decrypt

the provided log files get decrypted. note that the .encinfo side files must exist and be accessible for decryption to to work. like, non-negotiable. 🗝️

💜 write-keyfile

in this mode no log files are processed — so it's an error to specify any on the command line. the specified keyfile is written. the key itself is obtained via the usual key commands. if --keyfile is used, that file is effectively copied. 📋

for security reasons, existing key files are _not_ overwritten. to permit this, specify the --force option. when you do that, keep in mind that lost keys cannot be recovered, and data encrypted with them may also be considered lost. 😭 that's a real one. no cap.

keyfiles are always created with 0400 permission — that's read access for only the user. the exception is when an existing file is overwritten via the --force option, in which case the former permissions still apply. 🔒

⭐ EXIT CODES ⭐

the command returns an exit code of 0 if everything went fine, and some other code in case of failures. that's it, that's the system. 💫

🌈 SUPPORTED ALGORITHMS 🌈

in case of "ossl", see "ALGORITHM FETCHING" in crypto(7) for further information. in case of "gcry" we basically support what libgcrypt supports, and that is:

3DES CAST5 BLOWFISH AES128 AES192 AES256 TWOFISH TWOFISH128 ARCFOUR
DES SERPENT128 SERPENT192 SERPENT256 RFC2268_40 SEED CAMELLIA128
CAMELLIA192 CAMELLIA256

look at that lineup. iconic. 👑

🧚 SUPPORTED CIPHER MODES 🧚

in case of "gcry", we basically support what libgcrypt supports. this is:

ECB CFB CBC STREAM OFB CTR AESWRAP

🍓 EXAMPLES 🍓

k so here are the looks, bestie:

rscryutil logfile

decrypts "logfile" and sends data to stdout. simple, clean, slay. ✨

rscryutil -k keyfile -l ossl -a AES-256-CBC encryptedfile

decrypts encryptedfile using the ossl library with AES256 algorithm and CBC mode. 🔥

rscryutil -k keyfile -l gcry -a AES256 -m CBC encryptedfile

decrypts encryptedfile using the gcry library with AES256 algorithm and CBC mode. 💜

rscryutil --generate-random-key 16 --keyfile /some/secured/path/keyfile

generates a random key and stores it in the specified keyfile. cute AND functional. 🎀

💀 LOG SIGNATURES 💀

encrypted log files can be used together with signing. to verify such a file, it must be decrypted first, and the verification tool rsgtutil(1) must be run on the decrypted file. order matters, bestie. 🫶

⚠️ SECURITY CONSIDERATIONS ⚠️

specifying keys directly on the command line (--key option) is very insecure and should not be done, except for testing purposes with test keys. and even then it's recommended to use keyfiles, which are also easy to handle during testing. keep in mind that command history is usally be kept by bash and can also easily be monitored. 😭 like it's literally sitting there in your history. embarrassing.

local keyfiles are also a security risk. at a minimum, they should be used with very restrictive file permissions. for this reason, the rscryutil tool creates them with read permissions for the user, only, no matter what umask is set to. 💅

when selecting cipher algorithms and modes, care needs to be taken. the defaults should be reasonable safe to use, but this tends to change over time. keep up with the most current crypto recommendations. 👑 stay current, stay safe.

🌸 SEE ALSO 🌸

rsgtutil(1), rsyslogd(8)

🎀 COPYRIGHT 🎀

this page is part of the rsyslog project, and is available under LGPLv2.

💖 Author 💖

Rainer Gerhards <rgerhards@adiscon.com>

---

and that's the whole thing, bestie!! this page is from the rsyslog project and it's dated 2013-04-15 — vintage but still serving 💅✨ see you in the group chat 🫶🎀