TLS client auth, still got error

New to Graylog Community? READ-ME FIRST Guides
1

Hi,

second try to create a toppic:

I setup an gralog server on debian base with repository installation, not docker.
I managed it to get input and play a bit with dasjbords and alerts.
Now I want to secure input with TLS, but still get following error in the graylog log when enable * tls_client_auth: requiered, but now what I’ve done:

  1. We’ve an own CA working
  2. Generate certs and keys for server and client from the same CA
  3. Secury graylog frontend access with an apache Proxy → works
  4. Setup an TCP syslog Input with TLS:
allow_override_date: true
bind_address: 0.0.0.0
charset_name: UTF-8
expand_structured_data: false
force_rdns: false
max_message_size: 2097152
number_worker_threads: 4
override_source: <empty>
port: 5140
recv_buffer_size: 1048576
store_full_message: false
tcp_keepalive: false
timezone: NotSet
tls_cert_file: /etc/ssl/certs/meddv-log001.mdv.local.crt
tls_client_auth: disabled
tls_client_auth_cert_file: /etc/ssl/certs/meddv_internal_root_certification_authory.pem
tls_enable: true
tls_key_file: /etc/ssl/private/meddv-log001.mdv.local.key
tls_key_password: *******
use_null_delimiter: false
  1. Setup rsyslog with following settings:
root@meddv-cmdb:~# cat /etc/rsyslog.d/tls.conf
$DefaultNetstreamDriver gtls
$DefaultNetstreamDriverCAFile /etc/ssl/certs/meddv_internal_root_certification_authority.pem
$DefaultNetstreamDriverCertFile /etc/ssl/certs/meddv-cmdb.mdv.local_fullchain.crt
$DefaultNetstreamDriverKeyFile /etc/ssl/private/meddv-cmdb.mdv.local.pem
#$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
#$ActionSendStreamDriverMode 1 # run driver in TLS-only mode
#$ActionSendStreamDriverAuthMode anon
root@meddv-cmdb:~# cat /etc/rsyslog.d/meddv-log001.conf
#*.* @@meddv-log001.mdv.local:5140;RSYSLOG_SyslogProtocol23Format
*.* action(
  type="omfwd"
  target="meddv-log001.mdv.local"
  port="5140"
  protocol="tcp"
  KeepAlive="on"
  KeepAlive.Interval="30"
  StreamDriver="gtls"
  StreamDriverMode="1"
  StreamDriverAuthMode="x509/name"
  ResendLastMSGOnReconnect="on"
  queue.filename="fwdRule1"  # unique name prefix for spool files
  queue.type="LinkedList"
  queue.maxDiskSpace="256m"
  queue.saveOnShutdown="on"
  action.resumeRetryCount="-1"
  action.resumeInterval="30"
)
  1. Test the connection → I got still input
  2. Set tls_client_auth: required

Now I got the above given error.

Thank you for any help in advantage

Bye

Gregor

2

Hey @grefabu,

Could you try including the client cert within the folder for the tls_client_auth_cert_file: option

1 Like
3

Did you include the CA in the Graylog Java TrustStore ?
(Graylog needs to validate the client certificate, and there is no CA setting in the input)

1 Like