0

I want to configure a machines rsyslogd (redhat OS7 in this case) to connect via TLS to a central log collector. The resyslogd needs to authenticate with a client certificate. I already have the key, certificate and the CA certificates (including intermediate CA) available.

But I do not find a decent configuration example to set this up. I got completely lost with StreamDriver. I want to use the rsyslogd as a syslog forwarder of its local configured log events over TLS to a central log collector. And certifcate-based authentication is required.

1 Answer 1

-1

With your question I understand that you already have all the required certificate and key files to use TLS authentication.

Below is a sample rsyslogd configuration to use TLS from Configure secure remote logging with rsyslog (TLS) on Linux

# make gtls driver the default
$DefaultNetstreamDriver gtls

# certificate files
$DefaultNetstreamDriverCAFile /etc/rsyslog-keys/ca.pem
$DefaultNetstreamDriverCertFile /etc/rsyslog-keys/node3-cert.pem
$DefaultNetstreamDriverKeyFile /etc/rsyslog-keys/node3-key.pem

$ModLoad imtcp  # TCP listener
$InputTCPServerStreamDriverMode 1  # run driver in TLS-only mode
$InputTCPServerStreamDriverAuthMode anon
$InputTCPServerRun 6514  # start up listener at port 10514

Here you can replace the certificate and key file locations based on your environment, if you are using a different port then change the same for InputTCPServerRun

The article uses GTLS as the default StreamDriver so you may have to install it manually if not already available $DefaultNetstreamDriver gtls

Also check SELinux and Firewall between the server and client to make sure they are not blocking the log transfer.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.