[syslog-ng] Enable SNI (Server Name Identification) in TLS connection

Attila Szakacs (aszakacs) Attila.Szakacs at oneidentity.com
Thu Sep 26 12:56:41 UTC 2019 

Hi Raghu,

It got merged to master! ?
https://github.com/syslog-ng/syslog-ng/pull/2930

Best regards,
Attila
________________________________
From: syslog-ng <syslog-ng-bounces at lists.balabit.hu> on behalf of Raghunath Adhyapak <funduraghu at gmail.com>
Sent: Wednesday, September 18, 2019 5:35 PM
To: Syslog-ng users' and developers' mailing list <syslog-ng at lists.balabit.hu>
Subject: Re: [syslog-ng] Enable SNI (Server Name Identification) in TLS connection

CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.

That's awesome.

Thanks
Raghu

On Wed, Sep 18, 2019, 17:05 Attila Szakacs (aszakacs) <Attila.Szakacs at oneidentity.com<mailto:Attila.Szakacs at oneidentity.com>> wrote:
To the other question: It will be merged on the master branch probably in a week.

Attila
________________________________
From: syslog-ng <syslog-ng-bounces at lists.balabit.hu<mailto:syslog-ng-bounces at lists.balabit.hu>> on behalf of Attila Szakacs (aszakacs) <Attila.Szakacs at oneidentity.com<mailto:Attila.Szakacs at oneidentity.com>>
Sent: Wednesday, September 18, 2019 1:28 PM
To: Syslog-ng users' and developers' mailing list <syslog-ng at lists.balabit.hu<mailto:syslog-ng at lists.balabit.hu>>
Subject: Re: [syslog-ng] Enable SNI (Server Name Identification) in TLS connection

CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.

Hi Raghu,

You are welcome! Thanks for the good idea.
If everything goes well, this feature will be released in version 3.24, in 3-4 weeks.
The packaging happens at the same time, you will find the 3.24 installer at https://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/<https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdownload.opensuse.org%2Frepositories%2Fhome%3A%2Flaszlo_budai%3A%2Fsyslog-ng%2F&data=02%7C01%7Cattila.szakacs%40oneidentity.com%7C2ca2704f03d1430252cb08d73c4deb58%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637044177696240437&sdata=M9xVXlbEAiGqeLtLx1DsoXM9Tviag8FZVNERp0Z6oBg%3D&reserved=0>

Best regards,
Attila
________________________________
From: syslog-ng <syslog-ng-bounces at lists.balabit.hu<mailto:syslog-ng-bounces at lists.balabit.hu>> on behalf of Raghunath Adhyapak <funduraghu at gmail.com<mailto:funduraghu at gmail.com>>
Sent: Wednesday, September 18, 2019 12:50 PM
To: Syslog-ng users' and developers' mailing list <syslog-ng at lists.balabit.hu<mailto:syslog-ng at lists.balabit.hu>>
Subject: Re: [syslog-ng] Enable SNI (Server Name Identification) in TLS connection

CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.

Hi Atilla,

I updated the code, compiled it and tested the changes.
The changes works as expected.
Thanks for the addressing the issue in such a short time.

Follow-up question:
When will this change get merged into the master branch?
Also, when will this get packaged in Debian package?

Thanks
Raghu

On Tue, Sep 17, 2019 at 4:27 PM Attila Szakacs (aszakacs) <Attila.Szakacs at oneidentity.com<mailto:Attila.Szakacs at oneidentity.com>> wrote:
Hi Raghu,

Currently we are not sending SNI extension in the Client Hello message.
However, I made a PR to implement this: https://github.com/balabit/syslog-ng/pull/2930<https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fbalabit%2Fsyslog-ng%2Fpull%2F2930&data=02%7C01%7Cattila.szakacs%40oneidentity.com%7C2ca2704f03d1430252cb08d73c4deb58%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637044177696240437&sdata=GvVjWOS9Yi%2FJZdl1pblLIOWdtSTJ2gpJkEJVpH37oBQ%3D&reserved=0>

Can you build syslog-ng from source? It would be great, if you tested the PR.

Best regards,
Attila
________________________________
From: syslog-ng <syslog-ng-bounces at lists.balabit.hu<mailto:syslog-ng-bounces at lists.balabit.hu>> on behalf of Raghunath Adhyapak <funduraghu at gmail.com<mailto:funduraghu at gmail.com>>
Sent: Tuesday, September 17, 2019 9:05 AM
To: syslog-ng at lists.balabit.hu<mailto:syslog-ng at lists.balabit.hu> <syslog-ng at lists.balabit.hu<mailto:syslog-ng at lists.balabit.hu>>
Subject: [syslog-ng] Enable SNI (Server Name Identification) in TLS connection

CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.

Hi,

I am using TLS over TCP connection to forward my syslog events to a remote server.
My remote server uses SNI (Server Name Identification) to route connections/events to one of the available backend servers.

I observe that syslog-ng doesn't send SNI during TLS handshake.

How can I enable it?

My configuration is as follows:

===================================
source s_net { syslog(transport(udp) port(1514)); };
destination d_tcp {
        tcp(
                "XX.example.net<https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2FXX.example.net&data=02%7C01%7Cattila.szakacs%40oneidentity.com%7C2ca2704f03d1430252cb08d73c4deb58%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637044177696250438&sdata=KNtS9zpawll0eH6U8VyuBAcp2QHgLzY3S2FdtY5o90s%3D&reserved=0>"
                port(96)
                tls(
                        peer-verify(required-untrusted)
                        ca_dir("/etc/syslog-ng/ssl")
                        key-file("/etc/syslog-ng/ssl/globaltest/XX.example.net.key.pem")
                        cert-file("/etc/syslog-ng/ssl/globaltest/XX.example.net.cert.pem")
                  )
        );
};
log {
        source(s_net);
        destination(d_tcp);
};
===================================

I want syslog-ng to send XX.example.net<https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2FXX.example.net&data=02%7C01%7Cattila.szakacs%40oneidentity.com%7C2ca2704f03d1430252cb08d73c4deb58%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637044177696260431&sdata=5uJJlzHej7SoSTjS1Ov9n99bGQJGWIYfmL2%2FLJLWj1Q%3D&reserved=0> as SNI to my remote server

Please advise

Thanks
Raghu
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng<https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cattila.szakacs%40oneidentity.com%7C2ca2704f03d1430252cb08d73c4deb58%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637044177696260431&sdata=KFw8wgQEfFdLo1EHd%2FHIMQlC6CpVJ1PdXaKL34Y9CnM%3D&reserved=0>
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng<https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02%7C01%7Cattila.szakacs%40oneidentity.com%7C2ca2704f03d1430252cb08d73c4deb58%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637044177696270436&sdata=M%2B74WHS6u07annIaxzoC1kdlvKmlD8oB5T5kqCDmUXc%3D&reserved=0>
FAQ: http://www.balabit.com/wiki/syslog-ng-faq<https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cattila.szakacs%40oneidentity.com%7C2ca2704f03d1430252cb08d73c4deb58%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637044177696280431&sdata=WZcQ9x7SUou61Z6k7lHTz%2BVT4jSd7zlenQWlAL%2BeXUk%3D&reserved=0>

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng<https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cattila.szakacs%40oneidentity.com%7C2ca2704f03d1430252cb08d73c4deb58%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637044177696290423&sdata=iZX6zp8xHcGevLcRiTOHRDb2SqDb7Y7ZhOhyRJ0j2K0%3D&reserved=0>
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng<https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02%7C01%7Cattila.szakacs%40oneidentity.com%7C2ca2704f03d1430252cb08d73c4deb58%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637044177696290423&sdata=OgaDRImuMz3AflHKLq8TCUWvBT1mjANwipDJVhYRxW0%3D&reserved=0>
FAQ: http://www.balabit.com/wiki/syslog-ng-faq<https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cattila.szakacs%40oneidentity.com%7C2ca2704f03d1430252cb08d73c4deb58%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637044177696300417&sdata=xqYD9GcHStDP4DWTNEyOSG8JHN%2BmExrd4agc8Gwlr5Y%3D&reserved=0>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190926/242236fe/attachment-0001.html>

More information about the syslog-ng mailing list