<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<style>
<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:Arial;
color:windowtext;}
@page Section1
{size:595.3pt 841.9pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=FR link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Hi,<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'>I’m using syslog-ng OSE with encrypted message
transport thanks to TLS for few week. Now I try to activate the mutual authentication
option. I have several issues with the TLS mutual authentication logs error :<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-GB
style='font-size:12.0pt'>Jun 4 16:01:31 desktop syslog-ng[26644]: SSL
error while reading stream; tls_error='SSL routines:SSL3_READ_BYTES:tlsv1 alert
unknown ca'<br>
Jun 4 16:01:31 desktop syslog-ng[26644]: I/O error occurred while
reading; fd='14', error='Connection reset by peer (104)'<br>
Jun 4 16:01:31 desktop syslog-ng[26644]: Syslog connection closed; fd='14',
client='AF_INET(10.254.1.172:43751)', local='AF_INET(</span><a
href="http://0.0.0.0:9999" title="blocked::http://0.0.0.0:9999/"><span
lang=EN-GB>0.0.0.0:9999</span></a></font><span lang=EN-GB>)<o:p></o:p></span></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-GB
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-GB
style='font-size:12.0pt'>This is samples of config file:<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-GB
style='font-size:12.0pt'>Server :<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-GB
style='font-size:12.0pt'>source s_net_tls {<br>
tcp(port(9999)<br>
tls(key_file("/etc/pfc/credentials/Server/server.key")<br>
cert_file("/etc/pfc/credentials/Server/server.pem")<br>
ca_dir("/etc/pfc/credentials/CA/")<br>
# peer_verify(optional-untrusted)<br>
peer_verify(required-trusted)<br>
) );<br>
}; <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-GB
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-GB
style='font-size:12.0pt'>Client :<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-GB
style='font-size:12.0pt'>destination d_remote_server_tls {<br>
tcp("10.254.1.141" port(9999)<br>
tls(ca_dir("/etc/pfc/credentials/CA")<br>
key_file("/etc/pfc/credentials/Client/client.key")<br>
cert_file("/etc/pfc/credentials/Client/client.pem")<br>
peer_verify(required-trusted)<br>
# peer_verify(optional-untrusted)<br>
));<br>
};<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'>here is how I generated my CA certificate, server and
client certificate :<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-GB
style='font-size:12.0pt'>openssl genrsa 1024 > CA/ca.key<br>
openssl req -new -x509 -days 365 -key CA/ca.key -out CA/ca.cert<br>
cat CA/ca.cert CA/ca.key > CA/ca.pem<br>
<br>
openssl genrsa 1024 > Client/client.key<br>
openssl req -new -key Client/client.key -out Client/client.csr<br>
openssl x509 -req -days 365 -in Client/client.csr -CA CA/ca.cert -CAkey
CA/ca.key -set_serial 01 -out Client/client.cert<br>
cat Client/client.cert Client/client.key > Client/client.pem<br>
<br>
openssl genrsa 1024 > Server/server.key<br>
openssl req -new -key Server/server.key -out Server/server.csr<br>
openssl x509 -req -days 365 -in Server/server.csr -CA CA/ca.cert -CAkey
CA/ca.key -set_serial 01 -out Server/server.cert<br>
cat Server/server.cert Server/server.key > Server/server.pem<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-GB
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-GB
style='font-size:12.0pt'>Of course I done the link with <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-GB
style='font-size:12.0pt'>Openssl x509 –noout –hash –in ca.pem<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-GB
style='font-size:12.0pt'>Ln –s ca.pem XXXX<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-GB
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-GB
style='font-size:12.0pt'>If anyone can help me, or give a step by step
procedure that works. I also tried the procedure described in the “Syslog-nd
admin guide” it doesn’t work too.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-GB
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-GB
style='font-size:12.0pt'>Regards<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-GB
style='font-size:12.0pt'>Thomas<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>-------------------</span></font><o:p></o:p></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Thomas Hahusseau</span></font><o:p></o:p></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Apprenti ingénieur</span></font><o:p></o:p></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>EADS - DS / ENST Bretagne</span></font><o:p></o:p></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> </span><o:p></o:p></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
</div>
</body>
</html>