I'd like to setup syslog-ng over stunnel between a host on my LAN and a host in my DMZ but can't quite figure out the configuration. The stunnel config seems to be correct. If I shutdown syslog on both machines, I can run nc -l 5140
on the dmzhost and connect over the stunnel from the LAN end using telnet. Typing text on either connection will echo on both machines.
When I start syslog-ng on either machine, I'm getting errors about Address already in use and Connection refused (111). I read that stunnel needs to be started before syslog-ng, but it doesn't seem to matter as it fails either way. I've attempted to clarify with my configuration below. Any thoughts?
LAN log server (stunnel)
# /etc/stunnel/dmz.conf
client = yes
cert = /etc/stunnel/dmz/stunnel.pem
pid = /var/run/stunnel4/dmz.pid
[lan]
# connect port 55514 on the remote end to LAN localhost on port 5140
connect = dmzhost.ip.addr:55514
accept = 127.0.0.1:5140
LAN syslog-ng config
# /etc/syslog-ng/syslog-ng.conf
# dump data from port 5140 to syslog-ng on the LAN host
source s_dmzhost {tcp(ip("127.0.0.1") port(5140) max-connections(10));};
destination d_dmzhost {
file("/var/log/dmzhost.log"
template("$ISODATE <$FACILITY.$PRIORITY> $HOST $MSG\n")
template_escape(no));
};
log {source(s_dmzhost); destination(d_dmzhost);};
LAN error
# /etc/init.d/syslog-ng start
* Starting system logging syslog-ng
Error binding socket; addr='AF_INET(127.0.0.1:5140)', error='Address already in use (98)'
Error initializing source driver; source='s_dmzhost', id='s_dmzhost#0'
Error initializing message pipeline;
DMZ host web server (stunnel)
# /etc/stunnel/dmzhost.conf
cert = /etc/stunnel/dmzhost/stunnel.pem
pid = /var/run/stunnel4/dmzhost.pid
[syslog]
cert = /etc/stunnel/dmzhost/stunnel.pem
accept = 0.0.0.0:55514
connect = 127.0.0.1:5140
DMZ host syslog-ng
# /etc/syslog-ng/syslog-ng.conf
source s_src {
system();
internal();
};
destination my_stunnel {tcp("127.0.0.1" port(5140));};
log {source(s_src); destination(my_stunnel);};
DMZ host error
# /etc/init.d/syslog-ng start
Jul 27 15:30:16 dmzhost syslog-ng[15456]: Syslog connection failed; \
fd='12', server='AF_INET(127.0.0.1:5140)', error='Connection refused (111)', time_reopen='60'