Open Source Summit + Embedded Linux Conference North America 2026

BusyBox is a go-to userspace stack for embedded routers, but BusyBox syslogd remote logging is often deployed without transport security—sending logs in plaintext across networks. In enterprise deployments, there exists a security and compliance gap when encrypted log transport, such as RFC 5425-style secure syslog, is expected.

This talk shares a production-driven approach: after evaluating syslog-ng/rsyslog and weighing their integration cost against embedded constraints, we added TLS 1.3 directly to BusyBox syslogd using OpenSSL APIs, reusing crypto already on the device. We’ll demo end-to-end secure logging (router → syslog server), including optional server certificate pinning to reduce MITM risk, and validate the improvement with a packet capture.

We’ll then cover embedded-specific engineering details: preserving UDP logging behavior for backwards compatibility, gating TLS behind a build-time feature flag, testing success/failure paths (handshake and pinning errors), and overnight memory monitoring of syslogd. We’ll close with upstream interest in syslog over TLS and next-step considerations.