Input - Raw/Plaintext UDP is not working with graylog ssl

priyanka8 · November 30, 2018, 11:45pm

Hi Team,
We recently enabled SSL for graylog. Everything seems to be working fine after enabling SSL, except the Raw/Plaintext UDP input.
The same works fine without SSL. Went through the logs, but we dont see any error both in graylog nor the application which is pushing logs.
Appreciate your help!!

Totally_Not_A_Robot · December 1, 2018, 1:12pm

What do you specifically mean? Because there is no single, big on/off switch for TLS. There are many different parts of Graylog that can have TLS enabled/disabled.

The web interface
The MongoDB connection
The ElasticSearch connection
Each separate Input

Please describe in a bit more detail what you changed or adjusted.

EDIT :
I don’t have access to Graylog right now, so I can’t verify… Does the UDP/RAW receiver even have an option for TLS?! I don’t think so

benvanstaveren · December 2, 2018, 12:30pm

Graylog has no TLS options for UDP inputs that I could find. There is also no TLS for UDP, instead you’d have DTLS (basically TLS for datagram protocols, seems to be rather obscure)

jan · December 2, 2018, 3:59pm

Graylog has no TLS options for UDP inputs that I could find.

Show me any UDP based communication that can work with TLS …

benvanstaveren · December 2, 2018, 5:59pm

Anything that implements DTLS

Totally_Not_A_Robot · December 2, 2018, 6:54pm

Now the big question is: will @priyanka8 return to answer our questions?

priyanka8 · December 3, 2018, 10:40pm

Hi @Totally_Not_A_Robot,

We have enabled ssl for graylog web interface and rest API.
We did not change anything for input configuration. when we have web interface and rest api without ssl, all inputs were working fine but with ssl enabled, only Input - Raw/Plaintext UDP is not working.

# Enable HTTPS support for the REST API. This secures the communication with the REST API with

TLS to prevent request forgery and eavesdropping. This is disabled by default. Uncomment the

next line to enable it.

rest_enable_tls = true

The X.509 certificate file to use for securing the REST API.

rest_tls_cert_file = /path/to/graylog/data/config/certificate.crt

The private key to use for securing the REST API.

rest_tls_key_file = /path/to/graylog/data/config/certificate.key

The password to unlock the private key used for securing the REST API.

#rest_tls_key_password = secret

The maximum size of the HTTP request headers in bytes.

#rest_max_header_size = 8192

The maximal length of the initial HTTP/1.1 line in bytes.

#rest_max_initial_line_length = 4096

The size of the thread pool used exclusively for serving the REST API.

#rest_thread_pool_size = 16

Enable the embedded Graylog web interface.

Default: true

#web_enable = false

Web interface listen URI

web_listen_uri = /path/to/graylog/data/config/certificate.crt

This is the external address of the REST API of the Graylog server.

Web interface clients need to be able to connect to this for the web interface to work.

If not set, rest_transport_uri will be used.

#web_endpoint_uri = https://localhost/

Enable CORS headers for the web interface. This is necessary for JS-clients accessing the server directly.

If these are disabled, modern browsers will not be able to retrieve resources from the server.

#web_enable_cors = true
web_enable_cors = false

Enable/disable GZIP support for the web interface. This compresses HTTP responses and therefore helps to reduce

overall round trip times. This is enabled by default. Uncomment the next line to disable it.

#web_enable_gzip = false

Enable HTTPS support for the web interface. This secures the communication of the web browser with the web interface

using TLS to prevent request forgery and eavesdropping.

This is disabled by default. Uncomment the next line to enable it and see the other related configuration settings.

web_enable_tls = true

The X.509 certificate file to use for securing the web interface.

web_tls_cert_file = /path/to/graylog/data/config/certificate.crt

The private key to use for securing the web interface.

web_tls_key_file = /path/to/graylog/data/config/certificate.key

The password to unlock the private key used for securing the web interface.

#web_tls_key_password = secret

The maximum size of the HTTP request headers in bytes.

#web_max_header_size = 8192

The maximal length of the initial HTTP/1.1 line in bytes.

#web_max_initial_line_length = 4096

The size of the thread pool used exclusively for serving the web interface.

#web_thread_pool_size = 16

benvanstaveren · December 4, 2018, 8:27am

That’s because UDP inputs do not support TLS. If you want to use TLS, either use a TCP input, or do UDP across a VPN/private network. Or have very, very good firewall rules in place.

Totally_Not_A_Robot · December 4, 2018, 11:31am

Actually, what @priyanka8 did is unrelated… They write:

We have enabled ssl for graylog web interface and rest API.
We did not change anything for input configuration. when we have web interface and rest api without ssl, all inputs were working fine but with ssl enabled, only Input - Raw/Plaintext UDP is not working.

So they only enabled TLS for the GUI etc. That does not affect the UDP inputs. So there would be absolutely no reason for the UDP input to break.

benvanstaveren · December 4, 2018, 12:24pm

The statement is a bit ambiguous

But, it would’ve been nice if @priyanka8 would’ve actually said what isn’t working, because either the input isn’t starting, or it’s starting but not receiving, which could be due to a misconfiguration, or firewall configuration, or … etc. etc.

Just to be anally retentive.

Totally_Not_A_Robot · December 4, 2018, 1:15pm

I have a feeling you and I are gonna get along just fine

benvanstaveren · December 4, 2018, 5:30pm

It’s a Dutch people thing >.>

priyanka8 · December 4, 2018, 11:13pm

Hi @benvanstaveren,

Actually input-Raw/plaintext udp is starting and running but it is not receiving/showing any incoming messages in the “show received messages”.

Also attched the configuration of input-Raw/plaintext udp. I am not sure where I am wrong.

Totally_Not_A_Robot · December 5, 2018, 8:03am

Well, we’re back to basic networking troubleshooting then.

Which hosts are you expecting to connect to this Syslog receiver?
On those sending hosts, can you Netcat to the port you specified?
When you dump in some data through Netcat, does the Input in Graylog show any activity?

Here’s a nice example of faking syslog messages by using Netcat.

benvanstaveren · December 5, 2018, 8:18am

@Totally_Not_A_Robot beat me to it but if the input is running but not receiving, ensure that you don’t have any firewall rules blocking the port, and that you can indeed netcat something, like so:

echo "this is a test message" | nc -u ip-address-of-graylog-server 9500

Then see if received messages show anything. If netcat doesn’t connect, you have a firewall issue, if netcat does connect and sends the message but it doesn’t show in received messages you have another problem

system · December 19, 2018, 8:18am

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Graylog TLS INPUT with Nxlog for Windows Graylog Central (peer support)	2	1958	March 19, 2018
UDP inputs not working Graylog Central (peer support)	3	7671	January 3, 2019
Unable to start inputs after implementing HTTPS on Graylog web interface Graylog Central (peer support)	6	2388	January 25, 2022
Syslog UDP and Raw/Plaintext UDP not accepting input, TCP works Graylog Central (peer support)	2	1911	July 18, 2018
Cant get HTTPS working on graylog Graylog Central (peer support)	12	4646	June 7, 2017

Input - Raw/Plaintext UDP is not working with graylog ssl

TLS to prevent request forgery and eavesdropping. This is disabled by default. Uncomment the

next line to enable it.

The X.509 certificate file to use for securing the REST API.

The private key to use for securing the REST API.

The password to unlock the private key used for securing the REST API.

The maximum size of the HTTP request headers in bytes.

The maximal length of the initial HTTP/1.1 line in bytes.

The size of the thread pool used exclusively for serving the REST API.

Enable the embedded Graylog web interface.

Default: true

Web interface listen URI

This is the external address of the REST API of the Graylog server.

Web interface clients need to be able to connect to this for the web interface to work.

If not set, rest_transport_uri will be used.

Enable CORS headers for the web interface. This is necessary for JS-clients accessing the server directly.

If these are disabled, modern browsers will not be able to retrieve resources from the server.

Enable/disable GZIP support for the web interface. This compresses HTTP responses and therefore helps to reduce

overall round trip times. This is enabled by default. Uncomment the next line to disable it.

Enable HTTPS support for the web interface. This secures the communication of the web browser with the web interface

using TLS to prevent request forgery and eavesdropping.

This is disabled by default. Uncomment the next line to enable it and see the other related configuration settings.

The X.509 certificate file to use for securing the web interface.

The private key to use for securing the web interface.

The password to unlock the private key used for securing the web interface.

The maximum size of the HTTP request headers in bytes.

The maximal length of the initial HTTP/1.1 line in bytes.

The size of the thread pool used exclusively for serving the web interface.

Related topics