I'm trying to test a setup of rsyslog that uses ssl. I'm (perhaps mis)-understanding that if I use starttls for the ssl traffic, I should be able to receive both ssl and plain syslog traffic on the same tcp port as the ssl session is negotiated if, as, and when needed.

However I have a testbed plaintext syslog client and a testbed ssl syslog client but i'm unable to make this occur. I can get traffic from either depending on the setting of $InputTCPServerDriverMode being 0 or 1, but not both at once.

So really i'm asking: Is this even possible ? If so, what's the rsyslog config syntax to achieve it ?

I understood that rsyslog could work with starttls, but now i'm starting to doubt it.

The server config looks a bit like this currently:

$ModLoad imuxsock
$ModLoad imklog
$ModLoad imtcp.so
$DefaultNetstreamDriver gtls

$DefaultNetstreamDriverCAFile /root/syslog-ca-cert.crt
$DefaultNetstreamDriverCertFile /root/syslog-server-cert.crt
$DefaultNetstreamDriverKeyFile /root/syslog-server-key.key

$InputTCPServerStreamDriverMode 1
$InputTCPServerStreamDriverAuthMode x509/certvalid
$InputTCPServerRun 514

According to rsyslog'd documentation the gtls driver supports EITHER unencrypted transmission just like the ptcp driver does with InputTCPServerStreamDriverMode set to 0, or TLS mode with it set to 1.

It also states:

Note: mode 0 does not provide any benefit over the ptcp driver. This mode exists for technical reasons, but should not be used. It may be removed in the future.

Thus it appears you have to choose encrypted or not encrypted, at least for a particular IP address+port combination. So you will have to setup two ports, one using the ptcp driver, and one with the gtls driver. Or if every system you have logging supports encryption, only use encrypted syslog connections.

| improve this answer | |
  • yeah. that's what i figured. just wanted to check. bummer ! – Sirex Feb 18 '13 at 2:42
  • thanks for the accept. don't forget to assign the bounty if you're happy with the answer (or I think it happens automatically when it expires) – Grant Feb 18 '13 at 2:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.