<p dir="ltr"><br>
On Mar 8, 2016 07:22, "Girish Kumar" <<a href="mailto:girish.kumar@al-enterprise.com">girish.kumar@al-enterprise.com</a>> wrote:<br>
><br>
> Thanks Bazi.<br>
><br>
> <br>
><br>
> I would like to analyze little more on syslog-ng log files related to TLS. Could you please let me know how to enable debug logs in syslog-ng.<br>
><br>
> <br>
><br>
> I have one more query on ssl option.<br>
><br>
> There is a TLS options in 3.7.2 , ssl-options() which is used for setting ssl option. Options are no-sslv2, no-sslv3, no-tlsv1, no-tlsv11, no-tlsv12 and by default option is no-sslv2. Hope my understanding is correct. I referred the following link<br>
><br>
> <a href="https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/tlsoptions.html">https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/tlsoptions.html</a><br>
><br>
> <br>
><br>
> Could you please let me know how to set ssl-option in syslog-ng 3.6. I didn’t find similar option there. Currently my syslog-ng server is 3.6.2 and client is 3.7.2<br>
><br></p>
<p dir="ltr">In syslog-ng 3.6 nosslv2 was hardwired and couldn't be configured.</p>
<p dir="ltr">> <br>
><br>
> Regards,<br>
><br>
> Girish<br>
><br>
> <br>
><br>
> <br>
><br>
> From: <a href="mailto:syslog-ng-bounces@lists.balabit.hu">syslog-ng-bounces@lists.balabit.hu</a> [mailto:<a href="mailto:syslog-ng-bounces@lists.balabit.hu">syslog-ng-bounces@lists.balabit.hu</a>] On Behalf Of Scheidler, Balázs<br>
> Sent: Monday, March 07, 2016 1:17 PM<br>
> To: Syslog-ng users' and developers' mailing list<br>
> Subject: Re: [syslog-ng] Syslog over TLS : Protocol is TCP and TLS<br>
><br>
> <br>
><br>
> Well, if you open the payload of the initial packages (e.g. after the SYN-SYNACK-ACK handshake), you should see binary stuff instead of plain text log messages.<br>
><br>
><br>
> -- <br>
> Bazsi<br>
><br>
> <br>
><br>
> On Mon, Mar 7, 2016 at 7:07 AM, Girish Kumar <<a href="mailto:girish.kumar@al-enterprise.com">girish.kumar@al-enterprise.com</a>> wrote:<br>
><br>
> Hi All,<br>
><br>
> Finally I was able to setup syslog-ng client and server. Communicate over TLS. Thanks for all your help.<br>
><br>
> In wireshark capture I am seeing all protocol as TCP and not as TLS. Please let me know whether my communication has happened over TLS.<br>
><br>
> If yes how do I validate that. Can I enable additional logs in syslog-ng ?<br>
><br>
> <br>
><br>
> <br>
><br>
> My tls part of conf file<br>
><br>
> <br>
><br>
> Client<br>
><br>
> --------<br>
><br>
> destination d_destination {<br>
><br>
> syslog("135.254.163.151" port(6514)<br>
><br>
> transport("tls")<br>
><br>
> tls( ca_dir("/etc/ca.d")<br>
><br>
> key_file("/etc/cert.d/myCliPrivate.key")<br>
><br>
> cert_file("/etc/cert.d/myCliCert.pem") )<br>
><br>
> );<br>
><br>
> };<br>
><br>
> <br>
><br>
> <br>
><br>
> Server<br>
><br>
> ---------<br>
><br>
> source d_source {<br>
><br>
> syslog(ip("135.254.163.151") port(6514)<br>
><br>
> transport("tls")<br>
><br>
> tls( key_file("/etc/syslog-ng/cert.d/mySerPrivate.key")<br>
><br>
> cert_file("/etc/syslog-ng/cert.d/mySerCert.pem")<br>
><br>
> ca_dir("/etc/syslog-ng/ca.d"))<br>
><br>
> );<br>
><br>
> };<br>
><br>
> <br>
><br>
> <br>
><br>
> Regards,<br>
><br>
> Girish<br>
><br>
><br>
> ______________________________________________________________________________<br>
> Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
> Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
> FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
><br>
> <br>
><br>
><br>
> ______________________________________________________________________________<br>
> Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
> Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
> FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
><br>
><br>
</p>