<div dir="ltr"><div><div><div>Hello,<br><br></div>Have you tried syslog-ng start in forward-mode and verbose (-Fdve)? In that case after the first message you can check the SSL error message during the authentication. It could show you the problem with the certificates.<br><br></div>Br,<br></div>Laci<br></div><div class="gmail_extra"><br><div class="gmail_quote">On 6 March 2015 at 01:27, Michael Starks <span dir="ltr"><<a href="mailto:syslog-ng-list@michaelstarks.com" target="_blank">syslog-ng-list@michaelstarks.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I am trying to get mutual authentication working between a syslog-ng<br>
server and an Rsyslog client, using <a href="http://startssl.com" target="_blank">startssl.com</a> issued certificates.<br>
The client does properly authenticate the server, but syslog-ng does not<br>
recognize the client as trusted.<br>
<br>
Server info:<br>
------------<br>
<br>
# cat /etc/redhat-release<br>
CentOS release 6.6 (Final)<br>
<br>
# /usr/local/syslog-ng/sbin/syslog-ng --version<br>
syslog-ng 3.2.4<br>
Installer-Version: 3.2.4<br>
Revision:<br>
ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.2#master#ef7b91e4a1b1f9628c66138b4ae83de7e4c697c6<br>
Compile-Date: Aug 18 2013 22:16:35<br>
Enable-Threads: off<br>
Enable-Debug: off<br>
Enable-GProf: off<br>
Enable-Memtrace: off<br>
Enable-Sun-STREAMS: off<br>
Enable-IPv6: on<br>
Enable-Spoof-Source: off<br>
Enable-TCP-Wrapper: off<br>
Enable-SSL: on<br>
Enable-SQL: off<br>
Enable-Linux-Caps: on<br>
Enable-Pcre: on<br>
Enable-Pacct: off<br>
<br>
source s_network_secure {<br>
tcp(flags(no-multi-line) ip(0.0.0.0) port(6514)<br>
tls( key-file("/usr/local/syslog-ng/etc/cert.d/cert.key")<br>
cert-file("/usr/local/syslog-ng/etc/cert.d/cert.pem")<br>
ca_dir("/usr/local/syslog-ng/etc/cert.d")<br>
peer_verify(required-untrusted)) );<br>
};<br>
<br>
And of course this is defined in a log statement.<br>
<br>
Here is the directory. Note that the symbolic link of the hash has been<br>
created.<br>
<br>
# ll /usr/local/syslog-ng/etc/cert.d/<br>
total 204<br>
lrwxrwxrwx. 1 root root 13 Mar 3 13:51 876f1e28.0 -> ca-bundle.pem<br>
-rw-r--r--. 1 root root 195587 Mar 3 13:08 ca-bundle.pem<br>
-r--------. 1 root root 1679 Feb 28 11:21 cert.key<br>
-r--------. 1 root root 2260 Feb 28 11:50 cert.pem<br>
-rw-r--r--. 1 root root 2281 Mar 3 13:58 client.key<br>
<br>
required-untrusted works, but required-trusted doesn't. So I figured<br>
maybe it was an SSL issue with the authority, but it seems to validate OK.<br>
<br>
# openssl verify -CAfile 876f1e28.0 -verbose client.key<br>
client.key: OK<br>
<br>
Client info:<br>
------------<br>
<br>
# cat /etc/lsb-release<br>
DISTRIB_ID=Ubuntu<br>
DISTRIB_RELEASE=14.04<br>
DISTRIB_CODENAME=trusty<br>
DISTRIB_DESCRIPTION="Ubuntu 14.04.1 LTS"<br>
<br>
# rsyslogd -v<br>
rsyslogd 7.4.4, compiled with:<br>
FEATURE_REGEXP: Yes<br>
FEATURE_LARGEFILE: No<br>
GSSAPI Kerberos 5 support: Yes<br>
FEATURE_DEBUG (debug build, slow code): No<br>
32bit Atomic operations supported: Yes<br>
64bit Atomic operations supported: Yes<br>
Runtime Instrumentation (slow code): No<br>
uuid support: Yes<br>
<br>
See <a href="http://www.rsyslog.com" target="_blank">http://www.rsyslog.com</a> for more information.<br>
<br>
I suppose there's no additional client info needed since I know it is<br>
presenting the certificate--the issue seems to be that the syslog-ng<br>
server simply doesn't trust it.<br>
<br>
All suggestions appreciated.<br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div><br></div>