1

I'd like to setup syslog-ng over stunnel between a host on my LAN and a host in my DMZ but can't quite figure out the configuration. The stunnel config seems to be correct. If I shutdown syslog on both machines, I can run nc -l 5140 on the dmzhost and connect over the stunnel from the LAN end using telnet. Typing text on either connection will echo on both machines.

When I start syslog-ng on either machine, I'm getting errors about Address already in use and Connection refused (111). I read that stunnel needs to be started before syslog-ng, but it doesn't seem to matter as it fails either way. I've attempted to clarify with my configuration below. Any thoughts?

LAN log server (stunnel)

# /etc/stunnel/dmz.conf
client  = yes
cert    = /etc/stunnel/dmz/stunnel.pem
pid     = /var/run/stunnel4/dmz.pid

[lan]
# connect port 55514 on the remote end to LAN localhost on port 5140
connect = dmzhost.ip.addr:55514
accept  = 127.0.0.1:5140

LAN syslog-ng config

# /etc/syslog-ng/syslog-ng.conf
# dump data from port 5140 to syslog-ng on the LAN host
source s_dmzhost {tcp(ip("127.0.0.1") port(5140) max-connections(10));};

destination d_dmzhost {
   file("/var/log/dmzhost.log"
   template("$ISODATE <$FACILITY.$PRIORITY> $HOST $MSG\n")
   template_escape(no));
};

log {source(s_dmzhost); destination(d_dmzhost);};

LAN error

# /etc/init.d/syslog-ng start
 * Starting system logging syslog-ng 
Error binding socket; addr='AF_INET(127.0.0.1:5140)', error='Address already in use (98)'
Error initializing source driver; source='s_dmzhost', id='s_dmzhost#0'
Error initializing message pipeline;

DMZ host web server (stunnel)

# /etc/stunnel/dmzhost.conf 
cert    = /etc/stunnel/dmzhost/stunnel.pem
pid     = /var/run/stunnel4/dmzhost.pid

[syslog]
cert    = /etc/stunnel/dmzhost/stunnel.pem
accept  = 0.0.0.0:55514
connect = 127.0.0.1:5140

DMZ host syslog-ng

# /etc/syslog-ng/syslog-ng.conf
source s_src {
       system();
       internal();
};

destination my_stunnel {tcp("127.0.0.1" port(5140));};
log {source(s_src); destination(my_stunnel);};

DMZ host error

# /etc/init.d/syslog-ng start
Jul 27 15:30:16 dmzhost syslog-ng[15456]: Syslog connection failed; \
fd='12', server='AF_INET(127.0.0.1:5140)', error='Connection refused (111)', time_reopen='60'
1
  • 1
    It's been a few days and nobody's answered. I tried "reversing" the connection which amounts to establishing the Stunnel connection from the DMZ back into the LAN. Everything worked then (well, I had to re-config syslog on the DMZ and LAN hosts first). I guess I was thinking Stunnel would work in either direction independent of which host originated the connection. I think I'm wrong in that assumption. In general, bringing a connection back into the LAN from the DMZ is a bad practice so I need a better solution. Jul 29, 2015 at 15:31

0

You must log in to answer this question.

Browse other questions tagged .