Thought I would revive this topic – TLS seems to be working (both transport and auth) with graylog community 5.* and mongodb 7.*
I have a 3-node mongodb cluster. I’ve generated certs for each host involved – all 3 mongodb plus the graylog hosts that are mongodb clients – and these are signed by the same fake CA. (Real certs should work of course :-D)
The /etc/mongod.conf network and security config looks like this
net:
port: 27017
bindIp: node0.fqdn
tls:
mode: requireTLS
certificateKeyFile: /path/to/node0-keypair.pem
CAFile: /path/to/my-ca.pem
allowConnectionsWithoutCertificates: false
security:
authorization: enabled
clusterAuthMode: x509
(NOTE: one fiddly part is the certificateKeyFile setting. It requires a concatenated key file + cert file. That’s why I call it “keypair” here.)
Also have a replica set defined
replication:
replSetName: graylog
Start up the 3 nodes, and you can connect with the mongosh command line something like this
mongosh --host=nonename.fqdn --tls --tlsCertificateKeyFile=/path/to/nodename-keypair.pem --tlsCAFile=/path/to/my-ca.pem --authenticationMechanism=MONGODB-X509
With this connection you can initialize the replicaset.
rs.initiate( {
_id : "graylog",
members: [
{ _id: 1, host: "node0.fqdn:27017" },
{ _id: 2, host: "node1.fqdn:27017" },
{ _id: 3, host: "node2.fqdn:27017" }
]
} )
On the graylog side, you can’t point to the individual cert and CA files. You have to use the JVM’s keystore and truststore. Here’s how I do that.
Create a java keystore containing the cert for the graylog host. I’ll call this “graylog-node-keystore.jks”
Create a java truststore containing the certificate authority used to sign your certs – what I call “fake CA” above. This also needs to include other certs you want to trust – you can start with the default truststore from whatever JVM you’re using. I’ll call this “my-truststore.jks”
Configure graylog to use the keystore and truststore – one way is to set JVM startup arguments. I do this in /etc/sysconfig/graylog-server
GRAYLOG_SERVER_JAVA_OPTS="$GRAYLOG_SERVER_JAVA_OPTS -Djavax.net.ssl.keyStore=/path/to/graylog-node-keystore.jks"
GRAYLOG_SERVER_JAVA_OPTS="$GRAYLOG_SERVER_JAVA_OPTS -Djavax.net.ssl.trustStore=/path/to/my-truststore.jks"
If you follow standard practice and have passwords on your keystore and truststore you’ll need to specify those as well.
GRAYLOG_SERVER_JAVA_OPTS="$GRAYLOG_SERVER_JAVA_OPTS -Djavax.net.ssl.keyStorePassword=changeit"
GRAYLOG_SERVER_JAVA_OPTS="$GRAYLOG_SERVER_JAVA_OPTS -Djavax.net.ssl.trustStorePassword=changeit"
Then in /etc/graylog/server/server.conf the mongodb_uri looks like this
mongodb_uri = mongodb://node0.fqdn:27017,node1.fqdn:27017,node2.fqdn:27017/graylog?replicaSet=graylog&tls=true&authMechanism=MONGODB-X509
First time startup of graylog it should connect and initialize the mongdb database, and you are up and running.
So this appears to be working. If anyone else is interested would be great to confirm. Thanks!
