Geek asks and answers

Logging rsyslog on multiple servers with different TLS configurations

Is it possible for rsyslog to be logged on multiple servers with different TLS configurations? We are currently logging in to the local syslog server using the following:

$DefaultNetstreamDriver gtls
$DefaultNetstreamDriverCAFile /etc/pki/rsyslog/ca.pem
$DefaultNetstreamDriverCertFile /etc/pki/rsyslog/local-cert.pem
$DefaultNetstreamDriverKeyFile /etc/pki/rsyslog/local-key.pem
$ActionSendStreamDriverAuthMode anon
$ActionSendStreamDriverMode 1

*.* @@10.50.59.241:6514

Now we are setting up logging for third parties and want to use TLS as well. They state that we must configure rsyslog as follows:

$DefaultNetstreamDriverCAFile /path/to/their/ca.crt
$ActionSendStreamDriver gtls
$ActionSendStreamDriverMode 1
$ActionSendStreamDriverAuthMode x509/name
$ActionSendStreamDriverPermittedPeer *.theirhost.theirdomain

*.* @@theirhost.theirdomain:6514

, CA DefaultNetstreamDriverCAFile. rsyslog.conf, . , rsyslog ( 7.4.8), TLS ?

+3
1

, . -, rsyslog, ( , ), , 7.6 rsyslog.

, CA CA, , . . conf :

$DefaultNetstreamDriverCAFile /etc/pki/rsyslog/ca.pem

*.* action(type="omfwd" protocol="tcp" Target="10.50.59.241" Port="6514" StreamDriverMode="1" StreamDriver="gtls" StreamDriverAuthMode="anon")

*.* action(type="omfwd" Protocol="tcp" Target="some.other.host.com" Port="6514" StreamDriverMode="1" StreamDriver="gtls" StreamDriverAuthMode="x509/name" StreamDriverPermittedPeers="*.some.other.host.com")
+3

More articles:


All Articles