[syslog-ng] Docker syslog-ng TLS issue

[Steven La]

I created a CA cert following the instructions here:
https://support.oneidentity.com/fr-fr/technical-documents/syslog-ng-open-source-edition/3.22/mutual-authentication-using-tls

And the serverkey.pem is not encrypted, but syslog-ng is asking for a
password when it starts up for the serverkey.pem. Any help would be
appreciate


Head of the server.key
-----BEGIN PRIVATE KEY-----
MIIEvAI....

syslog error:
[2021-03-17T19:56:03.552322] Error setting up TLS session context;
tls_error='system library:fopen:Permission denied',
location='/etc/syslog-ng/syslog-ng.conf:21:2'
[2021-03-17T19:56:03.552355] Error setting up TLS context;
keyfile='/etc/ssl/certs/cert.d/serverkey.pem'
[2021-03-17T19:56:03.552407] Waiting for password;
keyfile='/etc/ssl/certs/cert.d/serverkey.pem'


syslog-ng config:
@version: 3.29
@include "scl.conf"

source s_local {
internal();
};

source s_network {
default-network-drivers(
# NOTE: TLS support
#
# the default-network-drivers() source driver opens the TLS
# enabled ports as well, however without an actual key/cert
# pair they will not operate and syslog-ng would display a
# warning at startup.
#
tls(key-file("/etc/ssl/certs/cert.d/serverkey.pem")
cert-file("/etc/ssl/certs/cert.d/servercert.pem")
ca_dir("/etc/ssl/certs/ca.d"))
                peer_verify(optional-untrusted)
);
};

destination d_local {
file("/var/log/messages");
file("/var/log/messages-kv.log" template("$ISODATE $HOST $(format-welf
--scope all-nv-pairs)\n") frac-digits(3));
};

log {
source(s_local);
source(s_network);
destination(d_local);
};

docker run command:
sudo docker run -d --privileged -it -v
"/data/syslog-ng/config/syslog-ng.conf:/etc/syslog-ng/syslog-ng.conf" -v
"/data/syslog-ng/logs:/var/log" -v "/data/syslog-ng/certs:/etc/ssl/certs"
-p 514:514/udp -p 601:601 -p 6514:6514 --name syslog-ng2
balabit/syslog-ng:latest -edv

Thanks,
Steven
-- 

Steven La

408-503-0289

steven.la at datastax.com <Steven.La at datastax.com>  |  datastax.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20210317/8b427a6f/attachment.html>