Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have been trying to get rsyslog to transmit through TLS with no luck so far.

There seems to be something wrong with my configuration, but I cannot pinpoint it.

this is my server conf file:

# rsyslog v5 configuration file

# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html

#### MODULES ####

$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imklog   # provides kernel logging support (previously done by rklogd)
$ModLoad immark  # provides --MARK-- message capability
$ModLoad imgssapi # provides GSSAPI syslog reception

# Provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 10514
$InputTCPServerStreamDriverMode 1 # run driver in TLS-only mode
$InputTCPServerStreamDriverAuthMode anon # client is NOT authenticated

# make gtls driver the default
$DefaultNetstreamDriver gtls

# certificate files
$DefaultNetstreamDriverCAFile /etc/pki/tls/private/ca-cert.pem
$DefaultNetstreamDriverCertFile /etc/pki/tls/private/rslserver-cert.pem
$DefaultNetstreamDriverKeyFile /etc/pki/tls/private/rslserver-key.pem

# specify senders you permit to access
$AllowedSender TCP, 127.0.0.1, 10.111.1.0/24, *.evoltek.test.com 

#add: define logfiles
## /var/log/secure
$template Auth_log,"/var/log/secure.d/%fromhost%/%$year%-%$month%.secure"
## /var/log/messages
$template Msg_log,"/var/log/secure.d/%fromhost%/%$year%-%$month%.messages"
## /var/log/maillog
$template Mail_log,"/var/log/secure.d/%fromhost%/%$year%-%$month%.maillog"
## /var/log/cron
$template Cron_log,"/var/log/secure.d/%fromhost%/%$year%-%$month%.cron"
## /var/log/spooler
$template Spool_log,"/var/log/secure.d/%fromhost%/%$year%-%$month%.spooler"
## /var/log/boot.log
$template Boot_log,"/var/log/secure.d/%fromhost%/%$year%-%$month%.boot.log"
## emergency messages "*.emerg"
$template Emerg_log,"/var/log/secure.d/%fromhost%/%$year%-%$month%.emerg"

#### GLOBAL DIRECTIVES ####

# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf

#### RULES ####

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                -?Msg_log

# The authpriv file has restricted access.
authpriv.*                                              -?Auth_log

# Log all the mail messages in one place.
mail.*                                                  -?Mail_log

# Log cron stuff
cron.*                                                  -?Cron_log

# Everybody gets emergency messages
*.emerg                                                 -?Emerg_log

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          -?Spool_log

# Save boot messages also to boot.log
local7.*                                                -?Boot_log

And this is my client conf file:

# rsyslog v5 configuration file

# certificate files
$DefaultNetstreamDriverCAFile /etc/pki/tls/private/ca-cert.pem
$DefaultNetstreamDriverCertFile /etc/pki/tls/private/rslclient-cert.pem
$DefaultNetstreamDriverKeyFile /etc/pki/tls/private/rslclient-key.pem

$ModLoad imuxsock.so
$ModLoad imklog.so
$ModLoad imtcp


$DefaultNetstreamDriver gtls

$ActionSendStreamDriverAuthMode anon 
$ActionSendStreamDriverMode 1 

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog

# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 *

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log

*.* @@10.111.1.151:10514

I have created the certificates following this guide : http://kb.kristianreese.com/index.php?View=entry&EntryID=148

My testing environment does not have FQDNs, so I have left blank the DNs fields and the FQDN ones and I have filled the IP field.

share|improve this question
    
What OS are you using ? In CentOS/RedHat you also to enable the SSL rsyslog port in SElinux. –  b13n1u Mar 4 at 13:49
    
Just noticed it's CentOS:) –  b13n1u Mar 4 at 13:53

2 Answers 2

In CentOS/RedHat you also to enable the SSL rsyslog port in SElinux. Something like semanage port -a -t syslogd_port_t -p tcp 10514 should do the trick.

You can check your current syslog port with sudo semanage port -l| grep syslog

Also you can try, to run rsyslog in debug mode, to see whats happening: Stop rsyslog daemon, then

export RSYSLOG_DEBUGLOG="/path/to/debuglog"

export RSYSLOG_DEBUG="Debug"

now start rsyslog with:

rsyslogd -dn

To check if syntax used is valid use:

rsyslogd -N 1

share|improve this answer
    
This is a CentOS 6 VE running in OpenVZ. It is only for testing, so I have SElinux removed from the template I use, to avoid headaches –  Bruno9779 Mar 4 at 14:10
    
Have you tried to run rsyslog in debug mode ? –  b13n1u Mar 4 at 14:29
up vote 0 down vote accepted

I could not find a working configuration for rsyslog 5.8 (from CentOS repos).

I have installed instead the official rsyslog repos and have got rsyslog 7.6.0 up and running in minutes with this configuration.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.