Trying to set up rsyslog encrypted with tls

F

fribse

Hi All

I'm trying to configure encrypted tls logs.
I have an ubuntu rsyslog server, that works with encrypted rsyslog messages.
It has been tested with openssl s_client -connect hostname: port and that can connect.

Under /usr/local/etc/ryslog.d/
I have created a conf file that reads like this:
Code: 
$DefaultNetstreamDriverCAFile /usr/local/etc/rsyslog.d/rsyslog.crt

auth.*;authpriv.* @@hostname:port

$ActionQueueFileName queue
$ActionQueueMaxDiskSpace 5g
$ActionQueueSaveOnShutdown on
$ActionQueueType LinkedList
$ActionResumeRetryCount -1

The crt file is the CA file from the rsyslog server.

I have copied the ca file to /usr/local/etc/ssl/certs and have done a certctl rehash.

But I get
Code: 
syslog-proxy rsyslogd: tcpsrv listener (inputname: 'imtcp') failed to process incoming connection with error -2083
on the receiving server, which as far as I see says it is failing SSL negotiation

What am I doing wrong?
 
fribse said:
Code: 
auth.*;authpriv.* @@hostname:port
Click to expand...
This is a "plain" TCP connection, without SSL/TLS.

Code: 
  To  forward messages to another host via	UDP, prepend the hostname with
       the at sign ("@").  To forward it via plain tcp,	prepend	two  at	 signs
       ("@@").	To forward via RELP, prepend the string	":omrelp:" in front of
       the hostname.

www.rsyslog.com

RSyslog Documentation - rsyslog

www.rsyslog.com www.rsyslog.com
 
fribse said:
Code: 
$DefaultNetstreamDriverCAFile /usr/local/etc/rsyslog.d/rsyslog.crt

auth.*;authpriv.* @@hostname:port

$ActionQueueFileName queue
$ActionQueueMaxDiskSpace 5g
$ActionQueueSaveOnShutdown on
$ActionQueueType LinkedList
$ActionResumeRetryCount -1
Click to expand...
You seem to be missing the TLS part. Not sure how it would look in the old format, but in Rainer script this works:
Code: 
action(type="omfwd"
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.

queue.filename="fwdRule1"       # unique name prefix for spool files
queue.maxdiskspace="1g"         # 1gb space limit (use as much as possible)
queue.saveonshutdown="on"       # save messages to disk on shutdown
queue.type="LinkedList"         # run asynchronously
action.resumeRetryCount="-1"    # infinite retries if host is down

StreamDriver="gtls"
StreamDriverMode="1"
StreamDriverAuthMode="x509/certvalid"
Target="name-of-syslog-server" Port="syslogport-on-syslog-server" Protocol="tcp")
Also note, that when using TLS you are also sending messages using TCP as opposed to UDP. This might create issues when the log server is down, hence the need for local queue files.
 
Thankyou both for explaining it. I was suspiscius of the explanation about the @@ doing the tls (I was told this by another person).
Ok, Rainier script, I'm really moving into unknown territory for me 🙃

I tried adding the script. And now I don't see any error about tls when starting, but I do get a message that it can't create a disk queue.
I havent't changed the rsyslog.conf, only added the config to a new file in rsyslog.d
service rsyslogd start
Starting rsyslogd.
rsyslogd: error starting up disk queue, using pure in-memory mode [v8.2412.0 try https://www.rsyslog.com/e/2036 ]
rsyslogd: action-9-builtin:omfwd queue: error creating disk queue - giving up. [v8.2412.0 try https://www.rsyslog.com/e/2036 ]
So where does it want to write the queue, and with what user and group?

Oh, I just noticed this message in 'messages'
Code: 
2025-02-12T11:37:50.654534+01:00 zp-gw-sacit-VLAN1501 rsyslogd[85297] could not load module 'lmnsd_gtls', errors: trying to load module /usr/local/lib/rsyslog/lmnsd_gtls.so: Cannot open "/usr/local/lib/rsyslog/lmnsd_gtls.so" [v8.2412.0 try https://www.rsyslog.com/e/2066 ]
And the file is not in the folder.
 
I have not tried rsyslog on freebsd, but you will need gnutls. I can see gnutls is a build option for sysutils/rsyslog8 and is not built by default, but you will also need to install security/gnutls as well.
 
Oh, and when testing, run rsyslog in the foreground with: rsyslog -n -d -f <config-file>
That will show you what is going on.

And the queue files are stored in the work directory, unless specified otherwise.
The work directory can be specified as :

Code: 
global(workDirectory="/var/lib/rsyslog")
and must exist with the correct permissions before rsyslog is started, not sure what the default is for FreeBSD.
 
Thankyou, the security/gnutls is already installed.
And I've compiled the port of rsyslog8, that seems to have the gtls module.
It does not complain about the missing module now, and it can understand the directives.
I also added

Code: 
global(workDirectory="/usr/local/etc/rsyslog.d")
$DefaultNetstreamDriverCAFile /usr/local/etc/rsyslog.d/rsyslog.crt

(know that making the queue in the configfile is weird, but I know it has the rights to the folder, so just while testing it is set there).
at the top of the rainier script, above the action( statement
Not sure if there is a 'rainier' way of doing that?
Now I only see this in the logfile, which I guess is because there is no client certificate
Code: 
DATETIME hostname rsyslogd[12324] warning: certificate file is not set [v8.2412.0 try https://www.rsyslog.com/e/2330 ]
DATETIME hostname rsyslogd[12324] warning: key file is not set [v8.2412.0 try https://www.rsyslog.com/e/2331 ]

But now it's receiving logs, so I guess I can ignore the warnings?

Now I just have to go throughy the other 10 freebsd's that needs to have this set up :-)
 
Now on the next, I'm confused, I'm pretty sure I did the exact same steps, but it still complains that lmnsd_gtls is not found?

Code: 
# pkg install security/gnutls
# pkg install git

# git clone --depth 1 https://git.FreeBSD.org/ports.git /usr/ports

# cd /usr/ports/sysutils/rsyslog8/
# make install clean

add gnutls to selections
1739438617305.png

Code: 
Don't add syntax highlighter
Don't install docs
Don't install info
Don't install nls

I tried doing rsyslogd -v and I don't see gtls anywhere in the list.
What on earth did I forget?
 
The module is there???

Ahh, found an error
rsyslogd: could not load module 'lmnsd_gtls', errors: trying to load module /usr/local/lib/rsyslog/lmnsd_gtls.so: /usr/local/lib/libtasn1.so.6: version LIBTASN1_0_3 required by /usr/local/lib/libgnutls.so.30 not defined [v8.2412.0 try https://www.rsyslog.com/e/2066 ]
 
So now it's working.
This is my procedure (I already had rsyslog package installed)

Code: 
service rsyslogd stop
pkg remove rsyslog
freebsd-update fetch
freebsd-update install
pkg install security/gnutls libtasn1 git
git clone --depth 1 https://git.FreeBSD.org/ports.git /usr/ports
cd /usr/ports/sysutils/rsyslog8/
make clean
make install
during the compilation I mark the gnutls addition, and everything else it suggests are not installed.
Then the config
Code: 
global(workDirectory="/usr/local/etc/rsyslog.d")
$DefaultNetstreamDriverCAFile /usr/local/etc/rsyslog.d/rsyslog.crt

action(type="omfwd"
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.

queue.filename="fwdRule1"       # unique name prefix for spool files
queue.maxdiskspace="1g"         # 1gb space limit (use as much as possible)
queue.saveonshutdown="on"       # save messages to disk on shutdown
queue.type="LinkedList"         # run asynchronously
action.resumeRetryCount="-1"    # infinite retries if host is down

StreamDriver="gtls"
StreamDriverMode="1"
StreamDriverAuthMode="x509/certvalid"
Target="RSYSLOG-HOST" Port="6514" Protocol="tcp")

That works, it sends the encrypted rsyslog to the rsyslog proxy
 
You must log in or register to reply here.
Back
Top