0

I want to configure a machines rsyslogd (redhat OS7 in this case) to connect via TLS to a central log collector. The resyslogd needs to authenticate with a client certificate. I already have the key, certificate and the CA certificates (including intermediate CA) available.

But I do not find a decent configuration example to set this up. I got completely lost with StreamDriver. I want to use the rsyslogd as a syslog forwarder of its local configured log events over TLS to a central log collector. And certifcate-based authentication is required.

1 Answer 1

-1

With your question I understand that you already have all the required certificate and key files to use TLS authentication.

Below is a sample rsyslogd configuration to use TLS from Configure secure remote logging with rsyslog (TLS) on Linux

# make gtls driver the default
$DefaultNetstreamDriver gtls

# certificate files
$DefaultNetstreamDriverCAFile /etc/rsyslog-keys/ca.pem
$DefaultNetstreamDriverCertFile /etc/rsyslog-keys/node3-cert.pem
$DefaultNetstreamDriverKeyFile /etc/rsyslog-keys/node3-key.pem

$ModLoad imtcp  # TCP listener
$InputTCPServerStreamDriverMode 1  # run driver in TLS-only mode
$InputTCPServerStreamDriverAuthMode anon
$InputTCPServerRun 6514  # start up listener at port 10514

Here you can replace the certificate and key file locations based on your environment, if you are using a different port then change the same for InputTCPServerRun

The article uses GTLS as the default StreamDriver so you may have to install it manually if not already available $DefaultNetstreamDriver gtls

Also check SELinux and Firewall between the server and client to make sure they are not blocking the log transfer.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .