<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hi all, <br>
I'm truing to make mutual self cert authentication with Syslog-NG
and using LogAnalyzer to see the logs. <br>
I have done the following:<br>
<br>
<b>Server configuration:</b><br>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
Creating a CA<br>
making directory and put the openssl.cnf file in the directory etc.
<br>
do the following command:<br>
1. openssl req -new -x509 -keyout private/cakey.pem -out cacert.pem
-days 365 -config openssl.cnf<br>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
2. openssl req -nodes -new -x509 -keyout serverkey.pem -out
serverreq.pem -days 365 -config openssl.cnf<br>
3. openssl x509 -x509toreq -in serverreq.pem -signkey serverkey.pem
-out tmp.pem<br>
4. openssl ca -config openssl.cnf -policy policy_anything -out
servercert.pem -infiles tmp.pem<br>
5. In <b>/etc/syslog-ng/</b> create directory <b>cert.d</b> and <b>ca.d</b>
copy the <b>serverkey.pem</b> and <b>servercert.pem</b> to <b>cert.d</b>
and copy <b>cacert.pem</b> to <b>ca.d</b>. Go to <b>ca.d</b> and
issue the following command <b>"openssl x509 -noout -hash -in
cacert.pem"</b> and do the link <b>"ln -s cacert.pem 6d2962a8.0"<br>
</b>6. On the syslog-ng.conf file i put the following changes:<br>
***************************************<br>
source s_sys {<br>
system();<br>
internal();<br>
network(<br>
port(6514)<br>
file("/proc/kmsg" log_prefix("kernel: "));<br>
transport("tls")<br>
tls( key_file("/etc/syslog-ng/cert.d/serverkey.pem")<br>
cert_file("/etc/syslog-ng/cert.d/servercert.pem")<br>
ca_dir("/etc/syslog-ng/ca.d"))<br>
);<br>
};<br>
********************************************<br>
And restart the service<br>
<br>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
==================<br>
<b>Client Configuration</b><br>
Creating CA<br>
making directory and put the openssl.cnf file in the directory etc.
<br>
do the following command <br>
1. openssl req -new -x509 -keyout private/cakey.pem -out cacert.pem
-days 365 -config openssl.cnf<br>
2. openssl req -nodes -new -x509 -keyout clientkey.pem -out
clientreq.pem -days 365 -config openssl.cnf<br>
3. openssl x509 -x509toreq -in clientreq.pem -signkey clientkey.pem
-out tmp.pem<br>
4. openssl ca -config openssl.cnf -policy policy_anything -out
clientcert.pem -infiles tmp.pem<br>
5. In <b>/etc/syslog-ng/</b> create directory <b>cert.d</b> and <b>ca.d</b>
copy the <b>"clientkey.pem" </b>and <b>"clientcert.pem" </b>to <b>"cert.d"
</b>and copy <b>"cacert.pem" </b>to <b>"ca.d" </b>and issue the
following command in the <b>ca.d</b> directory. <b>openssl x509
-noout -hash -in cacert.pem </b>and <b>ln -s cacert.pem
6d2962a8.0<br>
</b>6. add the following to the <b>syslog-ng.conf</b> file<br>
******************************************************<br>
destination d_tcp {<br>
tcp("192.168.111.176" port(6514)<br>
tls( ca_dir("/etc/syslog-ng/ca.d")<br>
key_file("/etc/syslog-ng/cert.d/clientkey.pem")<br>
cert_file("/etc/syslog-ng/cert.d/clientcert.pem") )<br>
); };<br>
***************************************************************<br>
<br>
And finally i have the following errors :) <br>
Jan 12 11:58:02 syslogserver syslog-ng[5507]: Syslog connection
accepted; fd='16', client='AF_INET(192.168.111.104:45631)',
local='AF_INET(0.0.0.0:6514)'<br>
Jan 12 11:58:02 syslogserver syslog-ng[5507]: SSL error while
reading stream; tls_error='SSL routines:SSL3_READ_BYTES:tlsv1 alert
unknown ca'<br>
Jan 12 11:58:02 syslogserver syslog-ng[5507]: I/O error occurred
while reading; fd='16', error='Connection reset by peer (104)'<br>
Jan 12 11:58:02 syslogserver syslog-ng[5507]: Syslog connection
closed; fd='16', client='AF_INET(192.168.111.104:45631)',
local='AF_INET(0.0.0.0:6514)'<br>
Jan 12 11:58:12 syslogserver syslog-ng[5507]: Syslog connection
accepted; fd='16', client='AF_INET(192.168.111.104:58937)',
local='AF_INET(0.0.0.0:6514)'<br>
Jan 12 11:58:12 syslogserver syslog-ng[5507]: SSL error while
reading stream; tls_error='SSL routines:SSL3_READ_BYTES:tlsv1 alert
unknown ca'<br>
Jan 12 11:58:12 syslogserver syslog-ng[5507]: I/O error occurred
while reading; fd='16', error='Connection reset by peer (104)'<br>
Jan 12 11:58:12 syslogserver syslog-ng[5507]: Syslog connection
closed; fd='16', client='AF_INET(192.168.111.104:58937)',
local='AF_INET(0.0.0.0:6514)'<br>
<br>
Can someone help me with this and tell me what im doing wrong ?<br>
<br>
Thanks in advanced !<br>
<br>
</body>
</html>