<div dir="ltr">Hi David,<div><br></div><div>I see, thanks. We test it before merging, so there is no need to test it for us. I was just asking, because some folks want to try the feature out themselves before the stable release, to make sure it works.</div><div><br></div><div>On another note, the good news is that the pkcs12-file() option already had this feature sincs 3.12.1. So if you can wrap it in a pfx file, and use the pkcs12-file() option, the certificate_authorities field will be filled, like you expect it to be.</div><div>Screenshot from wireshark (note the pkcs hint):</div><div><img src="cid:ii_lg1xmgi40" alt="image.png" width="562" height="219"><br></div><div><br></div><div>Cheers,</div><div>Attila</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Apr 3, 2023 at 8:37 PM David Hauck <<a href="mailto:davidh@netacquire.com">davidh@netacquire.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg-4595517812300604597">
<div lang="EN-US" style="overflow-wrap: break-word;">
<div class="m_-4595517812300604597WordSection1">
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11pt;font-family:Calibri,sans-serif">Hi Attila,<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11pt;font-family:Calibri,sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11pt;font-family:Calibri,sans-serif">Great, thx for working on this!<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11pt;font-family:Calibri,sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11pt;font-family:Calibri,sans-serif">I think if would be best if we got back to this after the merge to main is complete and a new release is generated. I’m running this on a custom distro so I will
need to work with the distro vendor to get this integrated before I can get a runtime image that will work on my test systems. It’s also feasible for me to run a common distro (Ubuntu or Fedora derivative) as a VM for testing, but this also will take some
setting up. Let me know if you’re really stuck getting this tested and then I can try to rig something up here.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11pt;font-family:Calibri,sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11pt;font-family:Calibri,sans-serif">Thanks again,<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11pt;font-family:Calibri,sans-serif">-David<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11pt;font-family:Calibri,sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11pt;font-family:Calibri,sans-serif">PS: Ultimately moving to the current release (with this feature added) will involve more work for us to validate, given the existing v3.31.2 runtimes. This includes
(potentially) work to upgrade the configuration. Can you say anything about what might be involved in upgrading a (fairly generic, but fairly intricate) v3.31.2 configuration to v4.x.x?<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11pt;font-family:Calibri,sans-serif"><u></u> <u></u></span></p>
<div style="border-top:none;border-right:none;border-bottom:none;border-left:1.5pt solid blue;padding:0cm 0cm 0cm 4pt">
<div>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif"> syslog-ng <<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a>>
<b>On Behalf Of </b>Attila Szakács<br>
<b>Sent:</b> Monday, April 03, 2023 9:04 AM<br>
<b>To:</b> Syslog-ng users' and developers' mailing list <<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a>><br>
<b>Subject:</b> Re: [syslog-ng] TLS "trusted-dn" Question<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">I have opened a PR: <a href="https://usg02.safelinks.protection.office365.us/?url=https%3A%2F%2Fgithub.com%2Fsyslog-ng%2Fsyslog-ng%2Fpull%2F4412&data=05%7C01%7Cdavidh%40netacquire.com%7C7f3b7f7db2cf411828e508db345d1aba%7Cec65e18eede24cedbdab49355e3f602d%7C0%7C0%7C638161346727644149%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=3tI6DxNYsGaIQ%2F8fnGzj%2FHbAGy3GUQRIAqNFmgdtS9Y%3D&reserved=0" target="_blank">https://github.com/syslog-ng/syslog-ng/pull/4412</a>
:)<u></u><u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Mon, Apr 3, 2023 at 2:36 PM Attila Szakács <<a href="mailto:attila.szakacs@axoflow.com" target="_blank">attila.szakacs@axoflow.com</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0cm 0cm 0cm 6pt;margin-left:4.8pt;margin-right:0cm">
<div>
<p class="MsoNormal">Thanks! I will try to implement it this week, or if I won't have the time for it, I will create a feature request for it.
<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">In the meantime, I would like to ask: will there be any way you can try out the new feature before a stable release? I can provide you deb or rpm packages or a container image manually, or when we merge it to master, it will be available
in our nightly APT repo and nightly docker image. I can provide you a patch, if you are building locally, but I am afraid that the change won't trivially apply to 3.31, as there have been modifications around TLS since then. Does any of this work for you?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Cheers,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Attila<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Thu, Mar 30, 2023 at 5:32 PM David Hauck <<a href="mailto:davidh@netacquire.com" target="_blank">davidh@netacquire.com</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0cm 0cm 0cm 6pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<div>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11pt;font-family:Calibri,sans-serif">Hi Attila,</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11pt;font-family:Calibri,sans-serif"> </span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt">
<i><span style="color:gray">The trusted-dn() option is used for an additional verification step to reject clients/servers</span></i><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11pt;font-family:Calibri,sans-serif"> </span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11pt;font-family:Calibri,sans-serif">Ah, OK, yes, I think I misread (or misinterpreted) this. I get how this is used now, thx.</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11pt;font-family:Calibri,sans-serif"> </span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt">
<i><span style="color:gray">Could you kindly confirm that this is what you are looking for?</span></i><u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11pt;font-family:Calibri,sans-serif">Yes, exactly. This is similar to what (for e.g.) the SSLCACertificate{File|Path} mod_ssl directives
are used for with the Apache HTTP Server and its HTTPS operation (see <a href="https://usg02.safelinks.protection.office365.us/?url=https%3A%2F%2Fhttpd.apache.org%2Fdocs%2F2.4%2Fmod%2Fmod_ssl.html&data=05%7C01%7Cdavidh%40netacquire.com%7C7f3b7f7db2cf411828e508db345d1aba%7Cec65e18eede24cedbdab49355e3f602d%7C0%7C0%7C638161346727644149%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=Y%2BGb1rgUzAQcoNoPTZYkrbGr%2BSqpfBD6ZE6XmETALNE%3D&reserved=0" target="_blank">
https://httpd.apache.org/docs/2.4/mod/mod_ssl.html</a>). Without this connecting clients aren’t given any hints that can help them provide a proper client certificate (when they otherwise have many to choose from, each possibly signed by different CAs).</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11pt;font-family:Calibri,sans-serif"> </span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11pt;font-family:Calibri,sans-serif">Thanks,</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11pt;font-family:Calibri,sans-serif">-David</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:11pt;font-family:Calibri,sans-serif"> </span><u></u><u></u></p>
<div style="border-top:none;border-right:none;border-bottom:none;border-left:1.5pt solid blue;padding:0cm 0cm 0cm 4pt">
<div>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif"> syslog-ng <<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a>>
<b>On Behalf Of </b>Attila Szakács<br>
<b>Sent:</b> Thursday, March 30, 2023 3:12 AM<br>
<b>To:</b> Syslog-ng users' and developers' mailing list <<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a>><br>
<b>Subject:</b> Re: [syslog-ng] TLS "trusted-dn" Question</span><u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<p class="MsoNormal">Hi David,
<u></u><u></u></p>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">The trusted-dn() option is used for an additional verification step to reject clients/servers, which provide a cert having such a <b>subject</b> field that does not match with any
of the patterns set in trusted-dn().<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Unfortunately, I think that the first sentence in the documentation is a bit misleading:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><i>Description: To accept connections only from hosts using certain certificates signed by the trusted CAs, list the distinguished names of the accepted certificates in this parameter.
For example, using trusted-dn("*, O=Example Inc, ST=Some-State, C=*") will accept only certificates issued for the Example Inc organization in Some-State state.</i><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">If I understand correctly, what you would like to achieve is defined in <a href="https://usg02.safelinks.protection.office365.us/?url=https%3A%2F%2Fwww.ietf.org%2Frfc%2Frfc5246.txt&data=05%7C01%7Cdavidh%40netacquire.com%7C7f3b7f7db2cf411828e508db345d1aba%7Cec65e18eede24cedbdab49355e3f602d%7C0%7C0%7C638161346727800365%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=Y%2BrLItCfeBYP%2FOGdRzWHznnMi80f9hWMSQ8%2FJNY1vTE%3D&reserved=0" target="_blank">https://www.ietf.org/rfc/rfc5246.txt</a>
-> <span style="color:black">7.4.4. Certificate Request:</span><u></u><u></u></p>
</div>
<div>
<pre style="white-space:pre-wrap"><span style="color:black"> certificate_authorities</span><u></u><u></u></pre>
<pre><span style="color:black"> A list of the distinguished names [X501] of acceptable</span><u></u><u></u></pre>
<pre><span style="color:black"> certificate_authorities, represented in DER-encoded format. These</span><u></u><u></u></pre>
<pre><span style="color:black"> distinguished names may specify a desired distinguished name for a</span><u></u><u></u></pre>
<pre><span style="color:black"> root CA or for a subordinate CA; thus, this message can be used to</span><u></u><u></u></pre>
<pre><span style="color:black"> describe known roots as well as a desired authorization space. If</span><u></u><u></u></pre>
<pre><span style="color:black"> the certificate_authorities list is empty, then the client MAY</span><u></u><u></u></pre>
<pre><span style="color:black"> send any certificate of the appropriate ClientCertificateType,</span><u></u><u></u></pre>
<pre><span style="color:black"> unless there is some external arrangement to the contrary.</span><u></u><u></u></pre>
<pre style="white-space:pre-wrap"><span style="color:black"> </span><u></u><u></u></pre>
<pre style="white-space:pre-wrap"><span style="font-family:Arial,sans-serif;color:rgb(34,34,34)">This is not implemented in syslog-ng, yet, but it could be done easily with </span><span style="font-family:Arial,sans-serif;color:black"><a href="https://usg02.safelinks.protection.office365.us/?url=https%3A%2F%2Fwww.openssl.org%2Fdocs%2Fman3.0%2Fman3%2FSSL_get0_CA_list.html&data=05%7C01%7Cdavidh%40netacquire.com%7C7f3b7f7db2cf411828e508db345d1aba%7Cec65e18eede24cedbdab49355e3f602d%7C0%7C0%7C638161346727800365%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=Pk7pU%2Ft01LoCJbs8hS6Vt08tsCD5Ex%2Bgu5C2EceHrmc%3D&reserved=0" target="_blank">SSL_set_client_CA_list()</a>:</span><u></u><u></u></pre>
<pre><i><span style="font-family:Arial,sans-serif;color:black">SSL_set_client_CA_list() sets the list of CAs sent to the client when requesting a client certificate for the chosen ssl, overriding the setting valid for ssl's SSL_CTX object.</span></i><u></u><u></u></pre>
</div>
<div>
<p class="MsoNormal"><span style="color:black">Could you kindly confirm that this is what you are looking for?</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12pt"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">Cheers,</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">Attila</span><u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<div>
<p class="MsoNormal">On Wed, Mar 29, 2023 at 8:42 PM David Hauck <<a href="mailto:davidh@netacquire.com" target="_blank">davidh@netacquire.com</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0cm 0cm 0cm 6pt;margin:5pt 0cm 5pt 4.8pt">
<p class="MsoNormal" style="margin-bottom:12pt">Hi,<br>
<br>
I'm currently using syslog-ng OSE v3.31.2 and trying to get a TLS configured endpoint to use the 'trusted-dn()' TLS option. I'm having trouble getting syslog-ng to return these DN specifiers in the Certificate Request option during the TLS negotiation so that
clients can properly condition their supplied client certificates. <br>
<br>
I invariably see the following TLS negotiations (empty DNs list) in my Wireshark captures (as returned by the syslog-ng server):<br>
<br>
TLSv1.2 Record Layer: Handshake Protocol: Certificate Request<br>
Content Type: Handshake (22)<br>
Version: TLS 1.2 (0x0303)<br>
Length: 58<br>
Handshake Protocol: Certificate Request<br>
Handshake Type: Certificate Request (13)<br>
Length: 54<br>
Certificate types count: 3<br>
Certificate types (3 types)<br>
Signature Hash Algorithms Length: 46<br>
Signature Hash Algorithms (23 algorithms)<br>
Distinguished Names Length: 0 <----- always '0'<br>
<br>
In these cases my clients choose random client certificates that can't be refined to certificates signed by those expected (via the 'trusted-dn()' values) by the server and the connection is immediately closed.<br>
<br>
Here's the syslog-ng.conf entry for these sources:<br>
<br>
source s_515_tls {<br>
network( transport(tls) port(515) ip-protocol(6)<br>
tls(ca-dir("/etc/ssl/certs") key-file("/root/naservers.key") cert-file("/root/naservers.cer")<br>
peer-verify(required-trusted) trusted-dn("CN=*.<a href="https://usg02.safelinks.protection.office365.us/?url=http%3A%2F%2Fnetacquire.com%2F&data=05%7C01%7Cdavidh%40netacquire.com%7C7f3b7f7db2cf411828e508db345d1aba%7Cec65e18eede24cedbdab49355e3f602d%7C0%7C0%7C638161346727800365%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=w2ZnIVpwm0j%2FK6aUUMcwPL%2FIy%2FI5efo5wnhc0AfhvJw%3D&reserved=0" target="_blank">netacquire.com</a>"))
); <br>
};<br>
<br>
I've tried several variants of the 'trusted-dn()' values, including other wildcards for country, state, etc. I always see a DNs list of zero size in the TLS Certificate Request option returned by the server. As expected switching to 'peer-verify(required-untrusted)'
results in successful negotiation (with expected server-side errors indicating problems associated with the client certificates) and subsequent successful client/server logging.<br>
<br>
I figure I must be missing something obvious ;). Any ideas?<br>
<br>
Here's my syslog-ng version info:<br>
<br>
[logdest:~]# syslog-ng --version<br>
syslog-ng 3 (3.31.2)<br>
Config version: 3.29<br>
Installer-Version: 3.31.2<br>
Revision:<br>
Compile-Date: Nov 9 2021 12:52:59<br>
Module-Directory: /usr/lib/syslog-ng<br>
Module-Path: /usr/lib/syslog-ng<br>
Include-Path: /usr/share/syslog-ng/include<br>
Available-Modules: tfgetent,mod-python,cryptofuncs,hook-commands,kvformat,cef,afuser,linux-kmsg-format,map-value-pairs,system-source,azure-auth-header,csvparser,affile,afprog,secure-logging,http,examples,timestamp,afsocket,confgen,stardate,dbparser,xml,disk-buffer,appmodel,afsnmp,add-contextual-data,afstomp,graphite,json-plugin,basicfuncs,syslogformat,pseudofile,tags-parser<br>
Enable-Debug: off<br>
Enable-GProf: off<br>
Enable-Memtrace: off<br>
Enable-IPv6: on<br>
Enable-Spoof-Source: off<br>
Enable-TCP-Wrapper: on<br>
Enable-Linux-Caps: on<br>
Enable-Systemd: off<br>
<br>
Thanks,<br>
-David<br>
______________________________________________________________________________<br>
Member info: <a href="https://usg02.safelinks.protection.office365.us/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=05%7C01%7Cdavidh%40netacquire.com%7C7f3b7f7db2cf411828e508db345d1aba%7Cec65e18eede24cedbdab49355e3f602d%7C0%7C0%7C638161346727800365%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=BvNYFUW9IImZyq44CSQVIOs3f6Uy%2BL80tySBEwraWQ0%3D&reserved=0" target="_blank">
https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="https://usg02.safelinks.protection.office365.us/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=05%7C01%7Cdavidh%40netacquire.com%7C7f3b7f7db2cf411828e508db345d1aba%7Cec65e18eede24cedbdab49355e3f602d%7C0%7C0%7C638161346727800365%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=EsYB36BkS3xryLcLbVSsj2HsoQruvi4zfTF%2Fh58aXdQ%3D&reserved=0" target="_blank">
http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="https://usg02.safelinks.protection.office365.us/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&data=05%7C01%7Cdavidh%40netacquire.com%7C7f3b7f7db2cf411828e508db345d1aba%7Cec65e18eede24cedbdab49355e3f602d%7C0%7C0%7C638161346727800365%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=Iyw1mQXzwgQbk%2Fa%2BvyUEwd%2BOcWA53qkW%2FeM%2FKVAGgBQ%3D&reserved=0" target="_blank">
http://www.balabit.com/wiki/syslog-ng-faq</a><u></u><u></u></p>
</blockquote>
</div>
<p style="background:rgb(191,255,0)"><b><span style="color:black">External Email Warning!</span></b><span style="color:black"> Use caution before clicking links or opening attachments.</span><u></u><u></u></p>
</div>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12pt">______________________________________________________________________________<br>
Member info: <a href="https://usg02.safelinks.protection.office365.us/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=05%7C01%7Cdavidh%40netacquire.com%7C7f3b7f7db2cf411828e508db345d1aba%7Cec65e18eede24cedbdab49355e3f602d%7C0%7C0%7C638161346727800365%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=BvNYFUW9IImZyq44CSQVIOs3f6Uy%2BL80tySBEwraWQ0%3D&reserved=0" target="_blank">
https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="https://usg02.safelinks.protection.office365.us/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=05%7C01%7Cdavidh%40netacquire.com%7C7f3b7f7db2cf411828e508db345d1aba%7Cec65e18eede24cedbdab49355e3f602d%7C0%7C0%7C638161346727800365%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=EsYB36BkS3xryLcLbVSsj2HsoQruvi4zfTF%2Fh58aXdQ%3D&reserved=0" target="_blank">
http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="https://usg02.safelinks.protection.office365.us/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&data=05%7C01%7Cdavidh%40netacquire.com%7C7f3b7f7db2cf411828e508db345d1aba%7Cec65e18eede24cedbdab49355e3f602d%7C0%7C0%7C638161346727800365%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=Iyw1mQXzwgQbk%2Fa%2BvyUEwd%2BOcWA53qkW%2FeM%2FKVAGgBQ%3D&reserved=0" target="_blank">
http://www.balabit.com/wiki/syslog-ng-faq</a><u></u><u></u></p>
</div>
</blockquote>
</div>
</blockquote>
</div>
<p style="background:rgb(191,255,0)"><b><span style="color:black">External Email Warning!</span></b><span style="color:black"> Use caution before clicking links or opening attachments.</span><u></u><u></u></p>
</div>
</div>
</div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</div></blockquote></div>