Re: CRL handling in syslog
"Peter Czanik (pczanik)" <[email protected]> Tue, 18 Feb 2025 05:59:01 +0000
| Newsgroups | gmane.comp.syslog-ng |
|---|---|
| Message-ID | <CO1PR19MB5126FEBB9DD1EF2731F6AB1D8BFA2@CO1PR19MB5126.namprd19.prod.outlook.com> |
--===============0165752946305322063== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_CO1PR19MB5126FEBB9DD1EF2731F6AB1D8BFA2CO1PR19MB5126namp_" --_000_CO1PR19MB5126FEBB9DD1EF2731F6AB1D8BFA2CO1PR19MB5126namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Hi Shankar, Could you test this on the latest syslog-ng release? Note that I never used= this syslog-ng feature. I'm asking you this, as 4.8.1 is where development= happens, and where we can fix it, if there is a problem. Peter Peter Czanik (CzP) <[email protected]> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik ________________________________ From: syslog-ng <[email protected]> on behalf of Shankar P= ramanik <[email protected]> Sent: Friday, February 14, 2025 08:04 To: [email protected] <[email protected]> Cc: Pritam Pal Singh <[email protected]>; M P Singh <[email protected]= >; Vijaya Kumar Mukka <[email protected]>; Patrick McEvoy <pmcevoy@infobl= ox.com>; Kevin Sheehan <[email protected]>; Michael Winslow <mwinslow@i= nfoblox.com> Subject: [syslog-ng] CRL handling in syslog CAUTION: This email originated from outside of the organization. Do not fol= low guidance, click links, or open attachments unless you recognize the sen= der and know the content is safe. I=92ve configured syslog-ng 3.35.1 to use CRLs but things aren=92t working = as expected. This is what I=92ve done : 1. Create a self-signed CA and use it to sign a server certificate. The = server certificate has a CRL distribution point in it. 2. Revoke the server certificate. Generate the revoked CRL and put it on= the syslog client under /etc/syslog-ng/crl in PEM format. There=92s a <iss= uer hash>.r0 link to the CRL in this directory. 3. Configure ca-dir and crl-dir in the client=92s syslog config. Configu= re the client to connect to the remote syslog server. With this setup, I=92 d expect the syslog client to reject the server certi= ficate since it=92s revoked, but that doesn=92t happen. The TLS handshake a= nd subsequent communication is successful. Is there anything that I=92m missing ? Any pointers will be appreciated. I = can provide additional details of my setup if needed. Thanks! Shankar. --_000_CO1PR19MB5126FEBB9DD1EF2731F6AB1D8BFA2CO1PR19MB5126namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable <html> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DWindows-1= 252"> <style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo= ttom:0;} </style> </head> <body dir=3D"ltr"> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> Hi Shankar,</div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> <br> </div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> Could you test this on the latest syslog-ng release? Note that I = never used this syslog-ng feature. I'm asking you this, as 4.8.1 is where d= evelopment happens, and where we can fix it, if there is a problem.</div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> <br> </div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> Peter</div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> <br> </div> <div id=3D"Signature" class=3D"elementToProof"> <div style=3D"direction: ltr; font-family: Calibri, Arial, Helvetica, sans-= serif; font-size: 12pt; color: rgb(0, 0, 0);"> Peter Czanik (CzP) <[email protected]><br> Balabit (a OneIdentity company) / syslog-ng upstream<br> <a href=3D"https://syslog-ng.com/community/" target=3D"_blank">https://sysl= og-ng.com/<wbr>community/</a><br> <a href=3D"https://twitter.com/PCzanik" target=3D"_blank">https://twitter.c= om/PCzanik</a></div> <span style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-siz= e: 12pt; color: rgb(0, 0, 0);"><br> </span></div> <div id=3D"appendonsend"></div> <hr style=3D"display:inline-block;width:98%" tabindex=3D"-1"> <div id=3D"divRplyFwdMsg" dir=3D"ltr"><font face=3D"Calibri, sans-serif" st= yle=3D"font-size:11pt" color=3D"#000000"><b>From:</b> syslog-ng <syslog-= [email protected]> on behalf of Shankar Pramanik <spramanik= @infoblox.com><br> <b>Sent:</b> Friday, February 14, 2025 08:04<br> <b>To:</b> [email protected] <[email protected]><br= > <b>Cc:</b> Pritam Pal Singh <[email protected]>; M P Singh <msin= [email protected]>; Vijaya Kumar Mukka <[email protected]>; Patri= ck McEvoy <[email protected]>; Kevin Sheehan <ksheehan@infoblox= .com>; Michael Winslow <[email protected]><br> <b>Subject:</b> [syslog-ng] CRL handling in syslog</font> <div> </div> </div> <style> <!-- @font-face {font-family:"Cambria Math"} @font-face {font-family:Aptos} p.x_MsoNormal, li.x_MsoNormal, div.x_MsoNormal {margin:0cm; font-size:12.0pt; font-family:"Aptos",sans-serif} p.x_MsoListParagraph, li.x_MsoListParagraph, div.x_MsoListParagraph {margin-top:0cm; margin-right:0cm; margin-bottom:0cm; margin-left:36.0pt; font-size:12.0pt; font-family:"Aptos",sans-serif} span.x_EmailStyle17 {font-family:"Aptos",sans-serif; color:windowtext} .x_MsoChpDefault {} @page WordSection1 {margin:72.0pt 72.0pt 72.0pt 72.0pt} div.x_WordSection1 {} ol {margin-bottom:0cm} ul {margin-bottom:0cm} --> </style> <div lang=3D"EN-IN" link=3D"#467886" vlink=3D"#96607D" style=3D"word-wrap:b= reak-word"> <div style=3D"background-color:#FFEB9C; width:100%; border-style:solid; bor= der-color:#9C6500; border-width:1pt; padding:2pt; font-size:10pt; line-heig= ht:12pt; font-family:'Calibri'; color:Black; text-align:left"> <span style=3D"color:#9C6500; font-weight:bold">CAUTION:</span> This email = originated from outside of the organization. Do not follow guidance, click = links, or open attachments unless you recognize the sender and know the con= tent is safe.</div> <br> <div> <div class=3D"x_WordSection1"> <p class=3D"x_MsoNormal"> </p> <p class=3D"x_MsoNormal">I=92ve configured syslog-ng 3.35.1 to use CRLs but= things aren=92t working as expected. This is what I=92ve done : </p> <p class=3D"x_MsoNormal"> </p> <ol start=3D"1" type=3D"1" style=3D"margin-top:0cm"> <li class=3D"x_MsoListParagraph" style=3D"margin-left:0cm">Create a self-si= gned CA and use it to sign a server certificate. The server certificate has= a CRL distribution point in it.<br> <br> </li><li class=3D"x_MsoListParagraph" style=3D"margin-left:0cm">Revoke the = server certificate. Generate the revoked CRL and put it on the syslog clien= t under /etc/syslog-ng/crl in PEM format. There=92s a <issuer hash>.r= 0 link to the CRL in this directory.<br> <br> </li><li class=3D"x_MsoListParagraph" style=3D"margin-left:0cm">Configure c= a-dir and crl-dir in the client=92s syslog config. Configure the client to = connect to the remote syslog server.</li></ol> <p class=3D"x_MsoNormal"> </p> <p class=3D"x_MsoNormal">With this setup, I=92 d expect the syslog client t= o reject the server certificate since it=92s revoked, but that doesn=92t ha= ppen. The TLS handshake and subsequent communication is successful.</p> <p class=3D"x_MsoNormal"> </p> <p class=3D"x_MsoNormal">Is there anything that I=92m missing ? Any pointer= s will be appreciated. I can provide additional details of my setup if need= ed.</p> <p class=3D"x_MsoNormal"> </p> <p class=3D"x_MsoNormal">Thanks!</p> <p class=3D"x_MsoNormal">Shankar.</p> <p class=3D"x_MsoNormal"> </p> <p class=3D"x_MsoNormal"> </p> <p class=3D"x_MsoNormal"> </p> </div> </div> </div> </body> </html> --_000_CO1PR19MB5126FEBB9DD1EF2731F6AB1D8BFA2CO1PR19MB5126namp_-- --===============0165752946305322063== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq --===============0165752946305322063==--