Hi, Syslog-ng/entware question..... I'm trying to use encryption for loggly with syslog-ng... their community page says:
Quick TLS setup
There are going to be times when you're going to want your logs encrypted during transport. This is where TLS comes in. The quick setup will ensure that your logs go to Loggly encrypted, but it will skip the step where Loggly validates you (which prevents man-in-the-middle attacks). The configuration is similar to above, but for a couple changes within the destination.
template LogglyFormat { template("<${PRI}>1 ${ISODATE} ${HOST} ${PROGRAM} ${PID} ${MSGID} [026308d8-2b63-4225-8fe9-e01294b6e472@41058] $MSG\n");};
destination d_loggly {
tcp("logs-01.loggly.com" port(6514)
tls(peer-verify(required-untrusted) ca_dir('
/opt/syslog-ng/keys/ca.d/'))
template(LogglyFormat));
};
log {
source(s_loggly);
destination(d_loggly);
};
### END Syslog Logging Directives for Loggly (myaccount.loggly.com) ###
You'll need to download Loggly's
SSL certificate and the intermediate certificate from
Starfield, called sf_bundle.crt. The certificates can be obtained by:
$ wget
https://logdog.loggly.com/media/loggly.com.crt
$ wget
https://certs.starfieldtech.com/repository/sf_bundle.crt
To verify, go ahead and double check the sha1sum or md5:
$ sha1sum sf_bundle.crt
9f4b50011bdeabda276c9dd08f32f545218ea1b7 sf_bundle.crt
$ md5sum sf_bundle.crt
f742e64a892167bb5b4a10da5a380425 sf_bundle.crt
The sha1 hash is displayed on the
Starfield web page where you can also obtain the intermediary cert via the browser. You then need to concatenate both and put it into syslog-ng's CA directory:
$ cat {sf_bundle.crt,loggly.com.crt} > loggly_full.crt
$ mv loggly_full.crt
/opt/syslog-ng/keys/ca.d/
Of course, you'll need to restart syslog-ng to see your changes take effect. You may want to start syslog-ng with the -d flag (for debug) so you can get an idea of what's happening. TLS can be a little tricky to get just right.
Anyone have an idea where is the CA directory on the entware version of syslog-ng or where to create it??
opkg file syslog-ng gives:
Code:
Package syslog-ng (3.8.1-3) is installed on root and has the following files:
/opt/lib/syslog-ng/libsyslogformat.so
/opt/lib/syslog-ng/libdbparser.so
/opt/etc/init.d/S01syslog-ng
/opt/lib/syslog-ng/libafsocket.so
/opt/lib/syslog-ng/libdisk-buffer.so
/opt/lib/syslog-ng/libdate.so
/opt/lib/syslog-ng/libkvformat.so
/opt/lib/syslog-ng/libgraphite.so
/opt/lib/syslog-ng/libafamqp.so
/opt/lib/libsyslog-ng-3.8.so.0
/opt/lib/syslog-ng/libafstomp.so
/opt/etc/syslog-ng.conf
/opt/lib/syslog-ng/libsdjournal.so
/opt/lib/syslog-ng/libadd-contextual-data.so
/opt/lib/libsyslog-ng-3.8.so.0.0.0
/opt/lib/syslog-ng/libcurl.so
/opt/lib/syslog-ng/liblinux-kmsg-format.so
/opt/lib/syslog-ng/libafuser.so
/opt/lib/libsyslog-ng.so
/opt/lib/syslog-ng/libpseudofile.so
/opt/lib/syslog-ng/libcsvparser.so
/opt/lib/syslog-ng/libcef.so
/opt/lib/syslog-ng/libcryptofuncs.so
/opt/lib/syslog-ng/libafprog.so
/opt/lib/syslog-ng/libbasicfuncs.so
/opt/lib/syslog-ng/libsystem-source.so
/opt/sbin/syslog-ng-ctl
/opt/lib/syslog-ng/libaffile.so
/opt/lib/syslog-ng/libconfgen.so
/opt/sbin/syslog-ng
Appreciate any insight...thanks
