ubuntu 16.04 syslog over TLS

main server(Receiver - rsyslog.Master.local) - 10.45.9.201

client(Sends log to main server) - 10.45.9.173

## To verify particular CA cert have signed specific SSL crt

cd /opt/immune/etc/remote_connection/certificates

# openssl verify -verbose -CAfile ca.crt ssl.crt

ssl.crt: OK

# MAIN server receiver

1) We will begin by creating a new self-signed CA certificate. As of this post, the requirement for new SSL is 2048bit. Anything 1024bit or less is considered to be obsolete. Once you run the second command, you will be prompted for some basic information about your company.

openssl genrsa 2048 > ca-key.pem

openssl req -new -x509 -nodes -days 3600 -key ca-key.pem -out ca-cert.pem

2) Next, we will create a sets of keys. This is done in three steps. First we create the request, remove the password, then sign it with our CA certificate from step 1.

openssl req -newkey rsa:2048 -days 3600 -nodes -keyout server-key.pem -out server-req.pem

openssl rsa -in server-key.pem -out server-key.pem

openssl x509 -req -in server-req.pem -days 3600 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem

3) Copy all pem files to /etc/ssl/certs

4) Open the rsyslog configuration and add in the lines below. Order is important.

$DefaultNetstreamDriver gtls

$DefaultNetstreamDriverCAFile /etc/ssl/certs/ca-cert.pem

$DefaultNetstreamDriverCertFile /etc/ssl/certs/server-cert.pem

$DefaultNetstreamDriverKeyFile /etc/ssl/certs/server-key.pem

$ModLoad imtcp

$InputTCPServerStreamDriverMode 1

$InputTCPServerStreamDriverAuthMode anon

$InputTCPServerRun 5822 ## syslog tls listens on TCP port 5822

service rsyslog restart

## CLIENT server

1) Upload the ca-cert.pem file only to the /etc/ssl/certs directory on each client.

2) You will need to make sure the rsyslog-gnutls package is installed in order to use TLS

apt-get install rsyslog-gnutls

3) Edit the /etc/rsyslog.conf configuration file and add the following lines at end of file

## syslog over ssl

$DefaultNetstreamDriverCAFile /etc/ssl/certs/ca-cert.pem

$DefaultNetstreamDriver gtls

$ActionSendStreamDriverMode 1

$ActionSendStreamDriverAuthMode anon

#*.* @@(o)server.example.net:10514 # send (all) messages

*.* @@10.45.9.201:5822

reference: https://www.rsyslog.com/doc/v8-stable/tutorials/tls.html

https://linux.die.net/man/5/rsyslog.conf