Metadata-Version: 2.4
Name: Delinea_Syslog
Version: 1.1.0
Summary: Parse centrify syslogs
Author: Delinea
Requires-Python: >=3.11
Description-Content-Type: text/markdown
Requires-Dist: requests
Requires-Dist: cachetools

# pas_syslog
PAS syslog tool. Please go into the config file located in the config dir. Please enter in the necessary data.  After, run the program like: ./delinea_syslog_writer.py. Must be done with root priv. List cronjob it made with sudo crontab -l.  Please install the 3 libraries:  1. centrify.dmc  2. requests  3. cachetools  This is done with pip. Enrolling the host into the tenant is a prereq. You must note:  1. Scope of machine  2. Enrollment code/owner has to have RO sysadmin  3. A valid query (i.e. "select * From Events")
setup is run in setup dir. EX: ./setup.py -t <tenant> -s <scope> -q "<query>" -dep <bool> -off <bool> -f <int> -p <proxyip:port> [--ca-bundle <path>]
run as a one liner after setup:
/opt/delinea/pas/reporting_tool/setup/setup.py -t 2.my.centrify.net -f 5 -q "Select * FROM Event WHERE WhenOccurred > DateFunc('now','-00:06') ORDER BY WhenOccurred" -s "all" && /opt/delinea/pas/reporting_tool/delinea_syslog/delinea_syslog_writer.py && tail --f /var/log/messages

## TLS / CA bundle

The plugin connects to the tenant over HTTPS and verifies the tenant's TLS
certificate. If the host's default trust store does not include the issuer
of the tenant's certificate, pass `--ca-bundle /path/to/ca-bundle.pem` to
setup. The path is persisted as the `ca_bundle` field in `config.json`.

The most common reason this is needed is a **corporate proxy that does TLS
interception**: outbound HTTPS is decrypted and re-signed by an internal
proxy using a private root CA. The tenant's cert then appears to be signed
by that internal CA, which Python's default trust store does not know
about. Point `--ca-bundle` at the corporate root CA bundle (often
`/etc/pki/ca-trust/source/anchors/<corp>.pem` or similar). Other cases
that require `--ca-bundle`: minimal Linux containers without
`ca-certificates` installed, and self-signed staging tenants.

The path **must be absolute**. The plugin runs from cron with a different
working directory than setup, so a relative path that resolves correctly
during setup would not resolve at runtime. Setup aborts immediately if
`--ca-bundle` is relative or points at a path that does not exist; the
runtime startup check (`ca_bundle_check`) refuses the same.

If TLS verification fails at runtime, the syslog will contain a `TLS
verification failed when calling <tenant>` line that names the configured
bundle and lists the common causes.

