Example: Configure Syslog over TLS

Description

This KB article provides a step-by-step guide on configuring syslog over TLS using rsyslog-gnutls on an Ubuntu Server with GTLS driver as a TLS server.
The syslog server is at IP address 10.220.170.3, and the same server is used as the Certificate Authority (CA) server.

Symptoms

Prerequisites:

Ubuntu Server with rsyslog-gnutls installed

CA server (Ubuntu Server with rsyslog-gnutls)

MX (Eventd client) with Junos OS Release 21.2 or later

Topology :

Syslog Server 10.220.170.3: Ubuntu Server rsyslogd with gnutls gtls driver (TLS server )

CA server 10.220.170.3: Same syslog server used as Certificate Authority Server

Auth mode enabled on the syslog server: Server Authentication

/etc/rsyslog.conf 
module(load="imtcp" StreamDriver.Name="gtls" StreamDriver.Mode="1" StreamDriver.AuthMode="anon")
input(type="imtcp" port="30013" )

MX (Eventd client) 10.220.170.1 <==================> rsyslog-gnutls Ubuntu Syslog Server 10.220.170.3
                                (TLS connection)

Reference docs:

Configure Syslog over TLS | Junos OS | Juniper Networks

Solution

Configuration Steps:

Update rsyslog conf:

Update the /etc/rsyslog.conf file on the syslog server with the following configuration:

Copy the following file to host /var/tmp/rli_40065_tls_ca_chain_rsyslog.conf

# /etc/rsyslog.conf   Configuration file for rsyslog
#
#                      For more information see
#                      /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html
#
# Default logging rules can be found in /etc/rsyslog.d/50-default.conf

#################
#### MODULES ####
#################
global(net.enableDNS="off")
module(load="imuxsock") # provides support for local system logging
module(load="imklog")  # provides kernel logging support
#module(load="immark") # provides --MARK-- message capability
# provides UDP syslog reception
#module(load="imudp")
#input(type="imudp" port="514")
# provides TCP syslog reception
#module(load="imtcp")
#input(type="imtcp" port="514")
# make gtls driver the default
$DefaultNetstreamDriver gtls
# certificate files
$DefaultNetstreamDriverCAFile /etc/ssl/ca-chain.pem
$DefaultNetstreamDriverCertFile /etc/ssl/server.crt
$DefaultNetstreamDriverKeyFile /etc/ssl/server.key
# provides TCP syslog reception with encryption
module(load="imtcp" StreamDriver.Name="gtls" StreamDriver.Mode="1" StreamDriver.AuthMode="anon")
input(type="imtcp" port="30013" )
# Enable non-kernel facility klog messages
$KLogPermitNonKernelFacility on

###########################
#### GLOBAL DIRECTIVES ####
########################### 

$template tplremote,"%timegenerated% %HOSTNAME% %fromhost-ip% %syslogtag%%msg:::drop-last-lf%\n"
$template RemoteHost,"/var/log/messages"
if ($hostname != 'localhost') then ?RemoteHost;tplremote
& ~
#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
# Filter duplicated messages
#$RepeatedMsgReduction on
#
# Set the default permissions for all log files.
#
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
#$PrivDropToUser syslog
#$PrivDropToGroup syslog
#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog
#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf

mv /var/tmp/rli_40065_tls_ca_chain_rsyslog.conf /etc/rsyslog.conf 
systemctl restart rsyslog
systemctl enable rsyslog

2. Configure CA Chain Certs:

Run the following commands on the syslog server:

cd /etc/ssl
rm -f /var/lib/dpkg/lock
apt-get install rsyslog-gnutls -y
apt-get update
apt install gnutls-bin -y

# Generate CA certificates

openssl genrsa -out ca-2k-sha2_512.key 2048

openssl req -new -x509 -days 3650 -key ca-2k-sha2_512.key -out ca-2k-sha2_512.crt -days 365 -subj "/C=US/ST=CA/L=Sunnyvale/O=Juniper/CN=root/OU=QA"

openssl x509 -in ca-2k-sha2_512.crt -out ca-2k-sha2_512.pem -outform PEM

openssl x509 -in ca-2k-sha2_512.pem -text

# Generate sub CA certificates

openssl genrsa -out subca-2k-sha2_512.key 2048 

openssl req -new -key subca-2k-sha2_512.key -out subca-2k-sha2_512.csr -subj "/C=US/ST=CA/L=Sunnyvale/O=Juniper/CN=SUB/OU=QA"

openssl x509 -req -days 3650 -in subca-2k-sha2_512.csr -CA ca-2k-sha2_512.crt -CAkey ca-2k-sha2_512.key -CAcreateserial -out subca-2k-sha2_512.crt -extfile /etc/ssl/openssl.cnf -extensions v3_ca

openssl x509 -in subca-2k-sha2_512.crt -out subca-2k-sha2_512.pem -outform PEM

openssl x509 -in subca-2k-sha2_512.pem -text

# Generate Client and Server Certificates:

openssl genrsa -out client.key 2048

openssl req -new -key client.key -out client.csr -subj "/C=US/ST=CA/L=Sunnyvale/O=Juniper/CN=localhost/OU=QA"

openssl x509 -req -days 3650 -sha512 -in client.csr -CA subca-2k-sha2_512.crt -CAkey subca-2k-sha2_512.key -CAcreateserial -out client.crt -extfile /etc/ssl/openssl.cnf -extensions v3_req

openssl x509 -in client.crt -out client.pem -outform PEM

openssl x509 -in client.pem -text

openssl genrsa -out server.key 2048

openssl req -new -key server.key -out server.csr -subj "/C=US/ST=CA/L=Sunnyvale/O=Juniper/CN=10.220.170.1 /OU=QA"

openssl x509 -req -days 3650 -sha512 -in server.csr -CA subca-2k-sha2_512.crt -CAkey subca-2k-sha2_512.key -CAcreateserial -out server.crt -extfile /etc/ssl/openssl.cnf -extensions v3_req

openssl x509 -in server.crt -out server.pem -outform PEM

openssl x509 -in server.pem -text

cat ca-2k-sha2_512.pem subca-2k-sha2_512.pem > ca-chain.pem

Copy the files to the router:

scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null /etc/ssl/ca-2k-sha2_512.pem [email protected]:/root/

scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null /etc/ssl/subca-2k-sha2_512.pem [email protected]:/root/

The provided configuration steps are for setting up a syslog client on an MX router with additional configurations for secure syslog transport using TLS.

Configure PKI CA Profiles:

set security pki ca-profile ms-ca ca-identity test
set security pki ca-profile ms-ca revocation-check disable
set security pki ca-profile ms-subca ca-identity test
set security pki ca-profile ms-subca revocation-check disable
set security pki traceoptions flag all
commit

Load CA Certificates:

request security pki ca-certificate load ca-profile ms-ca filename /root/ca-2k-sha2_512.pem 

request security pki ca-certificate load ca-profile ms-subca filename /root/subca-2k-sha2_512.pem

Configure Syslog Host and TLS Details:

set system syslog host 10.220.170.3 any any
set system syslog host 10.220.170.3  allow-duplicates
set system syslog host 10.220.170.3 port 30013
set system syslog host 10.220.170.3 transport tls
set system syslog host 10.220.170.3 tlsdetails trusted-ca-group abc ca-profiles ms-ca
set system syslog host 10.220.170.3 tlsdetails trusted-ca-group abc ca-profiles ms-subca
set system syslog file messages any any
commit

Modification History

2023-12-09 : Article Created
2024-03-24: Product added