best way to set up to stream logs securely from multiple networks to a single graylog server?

[gsmith]

Hello

@nktech1135

but am curious what others do for encrypting log data going across the net?

We use a MS AD , VPN’s /w Certificates, Gateway servers /w authentication software like DUO and ACL’s on switch’s.

Best advice I can give you is to use multiple security techniques . To be honest most, if not all can be hacked.
By stacking security measures this makes it harder to get access to sensitive data, and monitoring the network, you may catch an intrusions before harm can be done.

90% of the time if a issue arises it because someone clicked a link in email or Web UI that they should not have done, So education would be the next priority, or simple create firewall rule to prevent that.

EDIT:

@nktech1135

Do i need a Ca to generate these certs? and if so, how do others do that? We don’t have a CA for anything else. The graylog UI is using letsencrypt for it’s https connection.
Could i somehow use the letsencrypt certs for the input as well? or do i need other certs?
Do i need a cert on both ends of the tcp connection? or can i just have one on the server side and not on the client?
Or should i dump certs entirely and look at some sort of vpn method to handle encryption instead?

I would start here…

• Securing Graylog

Also check this post out.

• Graylog TLS issue - #2 by gsmith