1

I'm trying setup osquery logging as a Kafka producer w/ SASL-plain authentication. But not sure is it possible or not.

According to this page https://osquery.readthedocs.io/en/stable/deployment/logging/#logging-as-a-kafka-producer

There are 3 Kafka configurations are exposed as option: a comma delimited list of brokers with or without the port; a default topic [default value: ""], and acks... See official documentation for more details.

Does it mean that authentication settings not supported by osquery?

Here is piece of config:

{
  "options": {
    "logger_kafka_brokers": "some.example1.com:9092,some.example2.com:9092",
    "logger_kafka_topic": "base_topic",
    "logger_kafka_compression": "gzip",
    "logger_kafka_acks": "1"
  }

In Kafka official documentation available 'JAAS configuration property' only: https://kafka.apache.org/documentation/#security_sasl_plain_clientconfig

sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required \
    username="alice" \
    password="alice-secret";

Is there any way to use this properties for osquery?

0 Answers0