Solved

how do i Secure syslog with TLS

Posted on 2012-04-10
6
1,052 Views
Last Modified: 2012-04-19
Hello Experts,

I am using Linux RHEL 5.7 server, I want to secure syslog with TLS, Please guide me through the steps.
0
Comment
Question by:sudhirgoogle
6 Comments
 
LVL 51

Expert Comment

by:ahoffmann
ID: 37831617
can you please explain what you want to archive: a) sending syslog data from host A to host B or b) reading syslog file with your browser?
0
 
LVL 33

Accepted Solution

by:
Dave Howe earned 250 total points
ID: 37832295
You don't - seriously, TLS is a TCP based protocol, and *normally* syslog is UDP - therefore, if you want to protect the data in transit, you would need to wrap the traffic in some sort of tunnel (probably vpn, as most tunnels are also TCP only)

There is an RFC regarding how this *could* be done - rfc5425 - but at this time, almost nobody supports this new format so getting it to work in practice would be a nightmare. In addition, rfc6012 details how the new and experimental DTLS (rfc4347 - TLS for UDP, basically) could be used for a syslog transport, but this is (as far as I know) not implemented by *anyone* in the real world.

In short, trying to do TLS for syslog opens a can of worms, and probably not one you want opening. most sites avoid the issue entirely by having a dedicated management VLAN which also carries syslog traffic.
0
 
LVL 29

Assisted Solution

by:Michael W
Michael W earned 250 total points
ID: 37832377
Here's the how-to:

https://www.icts.uiowa.edu/confluence/display/ICTSit/Add+TLS+Functionality+to+your+syslog-ng+setup

Just remember that you have to enable TCP mode to use Syslog-NG with TLS.
0
Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

 
LVL 33

Expert Comment

by:Dave Howe
ID: 37832456
mwecomputers: yup, syslog-ng supports it, but how do you plan to get anything to send TLS wrapped syslog packets to it?
0
 
LVL 1

Author Comment

by:sudhirgoogle
ID: 37854206
i want to achieve sending syslog data from host A to host B
0
 
LVL 1

Author Closing Comment

by:sudhirgoogle
ID: 37864864
Thanks.
0

Featured Post

Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

Setting up Secure Ubuntu server on VMware 1.      Insert the Ubuntu Server distribution CD or attach the ISO of the CD which is in the “Datastore”. Note that it is important to install the x64 edition on servers, not the X86 editions. 2.      Power on th…
BIND is the most widely used Name Server. A Name Server is the one that translates a site name to it's IP address. There is a new bug in BIND (https://kb.isc.org/article/AA-01272), affecting all versions of BIND 9 from BIND 9.1.0 (inclusive) thro…
Connecting to an Amazon Linux EC2 Instance from Windows Using PuTTY.
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now