Re: CRL handling in syslog
Steve Bernacki <[email protected]> Tue, 18 Feb 2025 07:21:39 -0500
| Newsgroups | gmane.comp.syslog-ng |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. --===============2697660449933117525== Content-Type: multipart/alternative; boundary="------------x0hxu2FdjE6k93Mg0dCgf2OC" Content-Language: en-US This is a multi-part message in MIME format. --------------x0hxu2FdjE6k93Mg0dCgf2OC Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Shankar, Can you share what you did to get this to work? This functionality isn't commonly used from what I have observed, so the more working examples the community has, the better! Thank you Steve On 2/18/2025 1:17 AM, Shankar Pramanik wrote: > > Hi Peter, > > Apologies, I should’ve updated earlier. I had missed something during > my testing and it appeared to me that things weren’t working as expected. > > I spent some more time on this, and things do work as expected in the > 3.35.1 release. > > Thank you, > > Shankar. > > *From:*syslog-ng <[email protected]> *On Behalf Of > *Peter Czanik (pczanik) > *Sent:* 18 February 2025 11:29 > *To:* [email protected] > *Cc:* Pritam Pal Singh <[email protected]>; M P Singh > <[email protected]>; Vijaya Kumar Mukka <[email protected]>; > Patrick McEvoy <[email protected]>; Kevin Sheehan > <[email protected]>; Michael Winslow <[email protected]> > *Subject:* Re: [syslog-ng] CRL handling in syslog > > Hi Shankar, Could you test this on the latest syslog-ng release? Note > that I never used this syslog-ng feature. I'm asking you this, as > 4. 8. 1 is where development happens, and where we can fix it, if > there is a problem. Peter Peter Czanik (CzP) > > ZjQcmQRYFpfptBannerStart > > *This Message Is From an External Sender * > > This message came from outside your organization. > > ZjQcmQRYFpfptBannerEnd > > Hi Shankar, > > Could you test this on the latest syslog-ng release? Note that I never > used this syslog-ng feature. I'm asking you this, as 4.8.1 is where > development happens, and where we can fix it, if there is a problem. > > Peter > > Peter Czanik (CzP) <[email protected]> > Balabit (a OneIdentity company) / syslog-ng upstream > https://syslog-ng.com/community/ > <https://urldefense.com/v3/__https:/syslog-ng.com/community/__;!!JYsgTRAg6ZQ!Nmv0DhXOImbcEJRXZo7LX7qoYkIs0jJtWLSDmavO0YTRu0MX0PlFWVOAbAPLVObSzM4igJ8by9VdYP9FeoK-Tr6bhOcU$> > https://twitter.com/PCzanik > <https://urldefense.com/v3/__https:/twitter.com/PCzanik__;!!JYsgTRAg6ZQ!Nmv0DhXOImbcEJRXZo7LX7qoYkIs0jJtWLSDmavO0YTRu0MX0PlFWVOAbAPLVObSzM4igJ8by9VdYP9FeoK-Tus5c2l9$> > > ------------------------------------------------------------------------ > > *From:*syslog-ng <[email protected]> on behalf of > Shankar Pramanik <[email protected]> > *Sent:* Friday, February 14, 2025 08:04 > *To:* [email protected] <[email protected]> > *Cc:* Pritam Pal Singh <[email protected]>; M P Singh > <[email protected]>; Vijaya Kumar Mukka <[email protected]>; > Patrick McEvoy <[email protected]>; Kevin Sheehan > <[email protected]>; Michael Winslow <[email protected]> > *Subject:* [syslog-ng] CRL handling in syslog > > *CAUTION:*This email originated from outside of the organization. Do > not follow guidance, click links, or open attachments unless you > recognize the sender and know the content is safe. > > I’ve configured syslog-ng 3.35.1 to use CRLs but things aren’t working > as expected. This is what I’ve done : > > 1. Create a self-signed CA and use it to sign a server certificate. > The server certificate has a CRL distribution point in it. > 2. Revoke the server certificate. Generate the revoked CRL and put it > on the syslog client under /etc/syslog-ng/crl in PEM format. > There’s a <issuer hash>.r0 link to the CRL in this directory. > 3. Configure ca-dir and crl-dir in the client’s syslog config. > Configure the client to connect to the remote syslog server. > > With this setup, I’ d expect the syslog client to reject the server > certificate since it’s revoked, but that doesn’t happen. The TLS > handshake and subsequent communication is successful. > > Is there anything that I’m missing ? Any pointers will be appreciated. > I can provide additional details of my setup if needed. > > Thanks! > > Shankar. > > > ______________________________________________________________________________ > Member info:https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation:http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ:http://www.balabit.com/wiki/syslog-ng-faq > --------------x0hxu2FdjE6k93Mg0dCgf2OC Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit <!DOCTYPE html> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> </head> <body> <p><span style="mso-fareast-language:EN-US">Shankar,</span></p> <p><span style="mso-fareast-language:EN-US">Can you share what you did to get this to work? This functionality isn't commonly used from what I have observed, so the more working examples the community has, the better!</span></p> <p><span style="mso-fareast-language:EN-US">Thank you<br> Steve<br> </span></p> <div class="moz-cite-prefix">On 2/18/2025 1:17 AM, Shankar Pramanik wrote:<br> </div> <blockquote type="cite" cite="mid:DS7PR07MB77338315D897E7296B90ED92D2FA2@DS7PR07MB7733.namprd07.prod.outlook.com"> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <!--[if !mso]><style>v\:* {behavior:url(#default#VML);} o\:* {behavior:url(#default#VML);} w\:* {behavior:url(#default#VML);} .shape {behavior:url(#default#VML);} </style><![endif]--> <style>@font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;}@font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;}@font-face {font-family:Aptos;}p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0cm; font-size:12.0pt; font-family:"Aptos",sans-serif;}a:link, span.MsoHyperlink {mso-style-priority:99; color:blue; text-decoration:underline;}p.xmsonormal, li.xmsonormal, div.xmsonormal {mso-style-name:x_msonormal; margin:0cm; font-size:12.0pt; font-family:"Aptos",sans-serif;}p.xmsolistparagraph, li.xmsolistparagraph, div.xmsolistparagraph {mso-style-name:x_msolistparagraph; margin-top:0cm; margin-right:0cm; margin-bottom:0cm; margin-left:36.0pt; font-size:12.0pt; font-family:"Aptos",sans-serif;}span.EmailStyle23 {mso-style-type:personal-reply; font-family:"Aptos",sans-serif; color:windowtext;}.MsoChpDefault {mso-style-type:export-only; font-size:10.0pt; mso-ligatures:none;}div.WordSection1 {page:WordSection1;}ol {margin-bottom:0cm;}ul {margin-bottom:0cm;}</style><!--[if gte mso 9]><xml> <o:shapedefaults v:ext="edit" spidmax="1026" /> </xml><![endif]--><!--[if gte mso 9]><xml> <o:shapelayout v:ext="edit"> <o:idmap v:ext="edit" data="1" /> </o:shapelayout></xml><![endif]--> <div class="WordSection1"> <p class="MsoNormal"><span style="mso-fareast-language:EN-US">Hi Peter,<o:p></o:p></span></p> <p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="mso-fareast-language:EN-US">Apologies, I should’ve updated earlier. I had missed something during my testing and it appeared to me that things weren’t working as expected.<o:p></o:p></span></p> <p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="mso-fareast-language:EN-US">I spent some more time on this, and things do work as expected in the 3.35.1 release. <o:p></o:p></span></p> <p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="mso-fareast-language:EN-US">Thank you,<o:p></o:p></span></p> <p class="MsoNormal"><span style="mso-fareast-language:EN-US">Shankar.<o:p></o:p></span></p> <p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm"> <p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> syslog-ng <a class="moz-txt-link-rfc2396E" href="mailto:[email protected]"><[email protected]></a> <b>On Behalf Of </b>Peter Czanik (pczanik)<br> <b>Sent:</b> 18 February 2025 11:29<br> <b>To:</b> <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a><br> <b>Cc:</b> Pritam Pal Singh <a class="moz-txt-link-rfc2396E" href="mailto:[email protected]"><[email protected]></a>; M P Singh <a class="moz-txt-link-rfc2396E" href="mailto:[email protected]"><[email protected]></a>; Vijaya Kumar Mukka <a class="moz-txt-link-rfc2396E" href="mailto:[email protected]"><[email protected]></a>; Patrick McEvoy <a class="moz-txt-link-rfc2396E" href="mailto:[email protected]"><[email protected]></a>; Kevin Sheehan <a class="moz-txt-link-rfc2396E" href="mailto:[email protected]"><[email protected]></a>; Michael Winslow <a class="moz-txt-link-rfc2396E" href="mailto:[email protected]"><[email protected]></a><br> <b>Subject:</b> Re: [syslog-ng] CRL handling in syslog<o:p></o:p></span></p> </div> <p class="MsoNormal"><o:p> </o:p></p> <div> <p class="MsoNormal" style="mso-line-height-alt:.75pt"><span style="font-size:1.0pt;color:white">Hi Shankar, Could you test this on the latest syslog-ng release? Note that I never used this syslog-ng feature. I'm asking you this, as 4.</span><span style="font-size:1.0pt;font-family:"Arial",sans-serif;color:white"> </span><span style="font-size:1.0pt;color:white">8.</span><span style="font-size:1.0pt;font-family:"Arial",sans-serif;color:white"> </span><span style="font-size:1.0pt;color:white">1 is where development happens, and where we can fix it, if there is a problem. Peter Peter Czanik (CzP)<o:p></o:p></span></p> </div> <div> <p class="MsoNormal" style="mso-line-height-alt:.75pt"><span style="font-size:1.0pt;color:white">ZjQcmQRYFpfptBannerStart<o:p></o:p></span></p> </div> <table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="100%" style="width:100.0%;border-radius:4px"> <tbody> <tr> <td style="padding:0cm 0cm 7.5pt 0cm"> <table class="MsoNormalTable" border="1" cellspacing="0" cellpadding="0" width="100%" style="width:100.0%;background:#D0D8DC;border:none;border-top:solid #90A4AE 3.0pt"> <tbody> <tr> <td valign="top" style="border:none;padding:0cm 6.0pt 4.5pt 6.0pt"> <table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" align="left"> <tbody> <tr> <td style="padding:0cm 6.0pt 3.0pt 6.0pt"> <p class="MsoNormal" style="line-height:15.0pt"><b><span style="font-size:10.5pt;font-family:"Arial",sans-serif;color:black">This Message Is From an External Sender <o:p></o:p></span></b></p> </td> </tr> <tr> <td style="padding:0cm 6.0pt 3.0pt 6.0pt"> <p class="MsoNormal" style="line-height:12.0pt"><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:black">This message came from outside your organization. <o:p></o:p></span></p> </td> </tr> </tbody> </table> </td> </tr> </tbody> </table> </td> </tr> </tbody> </table> <div> <p class="MsoNormal" style="mso-line-height-alt:.75pt"><span style="font-size:1.0pt;color:white">ZjQcmQRYFpfptBannerEnd<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="color:black">Hi Shankar,<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p> </div> <div> <p class="MsoNormal"><span style="color:black">Could you test this on the latest syslog-ng release? Note that I never used this syslog-ng feature. I'm asking you this, as 4.8.1 is where development happens, and where we can fix it, if there is a problem.<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p> </div> <div> <p class="MsoNormal"><span style="color:black">Peter<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p> </div> <div id="Signature"> <div> <p class="MsoNormal"><span style="font-family:"Calibri",sans-serif;color:black">Peter Czanik (CzP) <<a href="mailto:[email protected]" moz-do-not-send="true" class="moz-txt-link-freetext">[email protected]</a>><br> Balabit (a OneIdentity company) / syslog-ng upstream<br> <a href="https://urldefense.com/v3/__https:/syslog-ng.com/community/__;!!JYsgTRAg6ZQ!Nmv0DhXOImbcEJRXZo7LX7qoYkIs0jJtWLSDmavO0YTRu0MX0PlFWVOAbAPLVObSzM4igJ8by9VdYP9FeoK-Tr6bhOcU$" target="_blank" moz-do-not-send="true">https://syslog-ng.com/community/</a><br> <a href="https://urldefense.com/v3/__https:/twitter.com/PCzanik__;!!JYsgTRAg6ZQ!Nmv0DhXOImbcEJRXZo7LX7qoYkIs0jJtWLSDmavO0YTRu0MX0PlFWVOAbAPLVObSzM4igJ8by9VdYP9FeoK-Tus5c2l9$" target="_blank" moz-do-not-send="true">https://twitter.com/PCzanik</a><o:p></o:p></span></p> </div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div class="MsoNormal" align="center" style="text-align:center"> <hr size="2" width="98%" align="center"> </div> <div id="divRplyFwdMsg"> <p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black"> syslog-ng <<a href="mailto:[email protected]" moz-do-not-send="true" class="moz-txt-link-freetext">[email protected]</a>> on behalf of Shankar Pramanik <<a href="mailto:[email protected]" moz-do-not-send="true" class="moz-txt-link-freetext">[email protected]</a>><br> <b>Sent:</b> Friday, February 14, 2025 08:04<br> <b>To:</b> <a href="mailto:[email protected]" moz-do-not-send="true" class="moz-txt-link-freetext">[email protected]</a> <<a href="mailto:[email protected]" moz-do-not-send="true" class="moz-txt-link-freetext">[email protected]</a>><br> <b>Cc:</b> Pritam Pal Singh <<a href="mailto:[email protected]" moz-do-not-send="true" class="moz-txt-link-freetext">[email protected]</a>>; M P Singh <<a href="mailto:[email protected]" moz-do-not-send="true" class="moz-txt-link-freetext">[email protected]</a>>; Vijaya Kumar Mukka <<a href="mailto:[email protected]" moz-do-not-send="true" class="moz-txt-link-freetext">[email protected]</a>>; Patrick McEvoy <<a href="mailto:[email protected]" moz-do-not-send="true" class="moz-txt-link-freetext">[email protected]</a>>; Kevin Sheehan <<a href="mailto:[email protected]" moz-do-not-send="true" class="moz-txt-link-freetext">[email protected]</a>>; Michael Winslow <<a href="mailto:[email protected]" moz-do-not-send="true" class="moz-txt-link-freetext">[email protected]</a>><br> <b>Subject:</b> [syslog-ng] CRL handling in syslog</span> <o:p></o:p></p> <div> <p class="MsoNormal"> <o:p></o:p></p> </div> </div> <div> <div style="border:solid #9C6500 1.0pt;padding:2.0pt 2.0pt 2.0pt 2.0pt"> <p class="MsoNormal" style="line-height:12.0pt;background:#FFEB9C"><b><span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#9C6500">CAUTION:</span></b><span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:black"> This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.<o:p></o:p></span></p> </div> <p class="MsoNormal"><o:p> </o:p></p> <div> <div> <p class="xmsonormal"> <o:p></o:p></p> <p class="xmsonormal">I’ve configured syslog-ng 3.35.1 to use CRLs but things aren’t working as expected. This is what I’ve done : <o:p></o:p></p> <p class="xmsonormal"> <o:p></o:p></p> <ol style="margin-top:0cm" start="1" type="1"> <li class="xmsolistparagraph" style="margin-bottom:12.0pt;margin-left:0cm;mso-list:l0 level1 lfo1"> Create a self-signed CA and use it to sign a server certificate. The server certificate has a CRL distribution point in it.<o:p></o:p></li> <li class="xmsolistparagraph" style="margin-bottom:12.0pt;margin-left:0cm;mso-list:l0 level1 lfo1"> Revoke the server certificate. Generate the revoked CRL and put it on the syslog client under /etc/syslog-ng/crl in PEM format. There’s a <issuer hash>.r0 link to the CRL in this directory.<o:p></o:p></li> <li class="xmsolistparagraph" style="margin-left:0cm;mso-list:l0 level1 lfo1">Configure ca-dir and crl-dir in the client’s syslog config. Configure the client to connect to the remote syslog server.<o:p></o:p></li> </ol> <p class="xmsonormal"> <o:p></o:p></p> <p class="xmsonormal">With this setup, I’ d expect the syslog client to reject the server certificate since it’s revoked, but that doesn’t happen. The TLS handshake and subsequent communication is successful.<o:p></o:p></p> <p class="xmsonormal"> <o:p></o:p></p> <p class="xmsonormal">Is there anything that I’m missing ? Any pointers will be appreciated. I can provide additional details of my setup if needed.<o:p></o:p></p> <p class="xmsonormal"> <o:p></o:p></p> <p class="xmsonormal">Thanks!<o:p></o:p></p> <p class="xmsonormal">Shankar.<o:p></o:p></p> <p class="xmsonormal"> <o:p></o:p></p> <p class="xmsonormal"> <o:p></o:p></p> <p class="xmsonormal"> <o:p></o:p></p> </div> </div> </div> </div> <br> <fieldset class="moz-mime-attachment-header"></fieldset> <pre wrap="" class="moz-quote-pre">______________________________________________________________________________ Member info: <a class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a> Documentation: <a class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a> FAQ: <a class="moz-txt-link-freetext" href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a> </pre> </blockquote> </body> </html> --------------x0hxu2FdjE6k93Mg0dCgf2OC-- --===============2697660449933117525== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq --===============2697660449933117525==--