added 180 characters in body

Source Link

edited May 20, 2018 at 1:09

4.3k
7
31
34

I need to disable TLS 1.2 and make sure connection accept TLS version 1.1 cipher suite SHA: AES128 & SHA: AES256. I do not find any supporting documentation to where to define TLS version. I noticed SSLProtocol -all +TLSv1 +TLSv1.1 +TLSv1.2 can be defined in HTTPD config to enable/disable TLS version that you want but how do I do the same on rsyslog.

Here are my configs on the server side:

#rsyslogd -v
rsyslogd 8.24.0, compiled with:
        PLATFORM:                               x86_64-redhat-linux-gnu
        PLATFORM (lsb_release -d):
        FEATURE_REGEXP:                         Yes
        GSSAPI Kerberos 5 support:              Yes
        FEATURE_DEBUG (debug build, slow code): No
        32bit Atomic operations supported:      Yes
        64bit Atomic operations supported:      Yes
        memory allocator:                       system default
        Runtime Instrumentation (slow code):    No
        uuid support:                           Yes
        Number of Bits in RainerScript integers: 64

See http://www.rsyslog.com for more information.

/etc/rsyslog.conf

##TLS Driver##
$DefaultNetstreamDriver gtls

##TLS Certificate##
$DefaultNetstreamDriverCAFile /etc/pki/rsyslog/ca.crt
$DefaultNetstreamDriverCertFile /etc/pki/rsyslog/cert.PEM
$DefaultNetstreamDriverKeyFile /etc/pki/rsyslog/privatekey.key

module(load="imtcp"
       MaxSessions="2000"
       StreamDriver.mode="1"
       StreamDriver.authmode="x509/name"
       PermittedPeer="*.clientsidehost.com")
input(type="imtcp" port="20514" name="tcp-tls")

The application that I am trying to receive logs from having the following requirement which I am trying to comply.

 TLS 1.0 & TLS 1.1 supported.
 TLS 1.2 is not supported and it needs to be disabled on your configuration.    
 Cipher Suites SHA:AES128 & SHA: AES256 supported.

Any help would be greatly appreciated

Update:

# openssl ciphers -v | awk '{print $2}' | sort -u
SSLv3
TLSv1.2

# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.3 (Maipo)

I need to disable TLS 1.2 and make sure connection accept TLS version 1.1 cipher suite SHA: AES128 & SHA: AES256. I do not find any supporting documentation to where to define TLS version. I noticed SSLProtocol -all +TLSv1 +TLSv1.1 +TLSv1.2 can be defined in HTTPD config to enable/disable TLS version that you want but how do I do the same on rsyslog.

Here are my configs on the server side:

#rsyslogd -v
rsyslogd 8.24.0, compiled with:
        PLATFORM:                               x86_64-redhat-linux-gnu
        PLATFORM (lsb_release -d):
        FEATURE_REGEXP:                         Yes
        GSSAPI Kerberos 5 support:              Yes
        FEATURE_DEBUG (debug build, slow code): No
        32bit Atomic operations supported:      Yes
        64bit Atomic operations supported:      Yes
        memory allocator:                       system default
        Runtime Instrumentation (slow code):    No
        uuid support:                           Yes
        Number of Bits in RainerScript integers: 64

See http://www.rsyslog.com for more information.

/etc/rsyslog.conf

##TLS Driver##
$DefaultNetstreamDriver gtls

##TLS Certificate##
$DefaultNetstreamDriverCAFile /etc/pki/rsyslog/ca.crt
$DefaultNetstreamDriverCertFile /etc/pki/rsyslog/cert.PEM
$DefaultNetstreamDriverKeyFile /etc/pki/rsyslog/privatekey.key

module(load="imtcp"
       MaxSessions="2000"
       StreamDriver.mode="1"
       StreamDriver.authmode="x509/name"
       PermittedPeer="*.clientsidehost.com")
input(type="imtcp" port="20514" name="tcp-tls")

The application that I am trying to receive logs from having the following requirement which I am trying to comply.

 TLS 1.0 & TLS 1.1 supported.
 TLS 1.2 is not supported and it needs to be disabled on your configuration.    
 Cipher Suites SHA:AES128 & SHA: AES256 supported.

Any help would be greatly appreciated

I need to disable TLS 1.2 and make sure connection accept TLS version 1.1 cipher suite SHA: AES128 & SHA: AES256. I do not find any supporting documentation to where to define TLS version. I noticed SSLProtocol -all +TLSv1 +TLSv1.1 +TLSv1.2 can be defined in HTTPD config to enable/disable TLS version that you want but how do I do the same on rsyslog.

Here are my configs on the server side:

#rsyslogd -v
rsyslogd 8.24.0, compiled with:
        PLATFORM:                               x86_64-redhat-linux-gnu
        PLATFORM (lsb_release -d):
        FEATURE_REGEXP:                         Yes
        GSSAPI Kerberos 5 support:              Yes
        FEATURE_DEBUG (debug build, slow code): No
        32bit Atomic operations supported:      Yes
        64bit Atomic operations supported:      Yes
        memory allocator:                       system default
        Runtime Instrumentation (slow code):    No
        uuid support:                           Yes
        Number of Bits in RainerScript integers: 64

See http://www.rsyslog.com for more information.

/etc/rsyslog.conf

##TLS Driver##
$DefaultNetstreamDriver gtls

##TLS Certificate##
$DefaultNetstreamDriverCAFile /etc/pki/rsyslog/ca.crt
$DefaultNetstreamDriverCertFile /etc/pki/rsyslog/cert.PEM
$DefaultNetstreamDriverKeyFile /etc/pki/rsyslog/privatekey.key

module(load="imtcp"
       MaxSessions="2000"
       StreamDriver.mode="1"
       StreamDriver.authmode="x509/name"
       PermittedPeer="*.clientsidehost.com")
input(type="imtcp" port="20514" name="tcp-tls")

The application that I am trying to receive logs from having the following requirement which I am trying to comply.

 TLS 1.0 & TLS 1.1 supported.
 TLS 1.2 is not supported and it needs to be disabled on your configuration.    
 Cipher Suites SHA:AES128 & SHA: AES256 supported.

Any help would be greatly appreciated

Update:

# openssl ciphers -v | awk '{print $2}' | sort -u
SSLv3
TLSv1.2

# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.3 (Maipo)

beware of errors when copying error messages

Source Link

edited May 19, 2018 at 21:32

Rui F Ribeiro

58k
28
156
237

I need to disableddisable TLS 1.2 and make sure connection accept TLS version 1.1 cipher suite SHA: AES128 & SHA: AES256. I do not find any supporting documentation to where to define TLS version. I noticed SSLProtocol -all +TLSv1 +TLSv1.1 +TLSv1.2 can be defined in HTTPD config to enable/disable TLS version that you want but how do I do the same on rsyslog.

Here are my configs on the server side:

#rsyslogd -v
rsyslogd 8.24.0, compiled with:
        PLATFORM:                               x86_64-redhat-linux-gnu
        PLATFORM (lsb_release -d):
        FEATURE_REGEXP:                         Yes
        GSSAPI Kerberos 5 support:              Yes
        FEATURE_DEBUG (debug build, slow code): No
        32bit Atomic operations supported:      Yes
        64bit Atomic operations supported:      Yes
        memory allocator:                       system default
        Runtime Instrumentation (slow code):    No
        uuid support:                           Yes
        Number of Bits in RainerScript integers: 64

See http://www.rsyslog.com for more information.

/etc/rsyslog.conf

##TLS Driver##
$DefaultNetstreamDriver gtls

##TLS Certificate##
$DefaultNetstreamDriverCAFile /etc/pki/rsyslog/ca.crt
$DefaultNetstreamDriverCertFile /etc/pki/rsyslog/cert.PEM
$DefaultNetstreamDriverKeyFile /etc/pki/rsyslog/privatekey.key

module(load="imtcp"
       MaxSessions="2000"
       StreamDriver.mode="1"
       StreamDriver.authmode="x509/name"
       PermittedPeer="*.clientsidehost.com")
input(type="imtcp" port="20514" name="tcp-tls")

The application that I am trying to receive logs from having the following requirement which I am trying to comply.

 TLS 1.0 & TLS 1.1 supported.
 TLS 1.2 is not supportsupported and it needs to be disabled on your configuration.    
 Cipher Suites SHA:AES128 & SHA: AES256 supported.

Any help would be greatly appreciated

I need to disabled TLS 1.2 and make sure connection accept TLS version 1.1 cipher suite SHA: AES128 & SHA: AES256. I do not find any supporting documentation to where to define TLS version. I noticed SSLProtocol -all +TLSv1 +TLSv1.1 +TLSv1.2 can be defined in HTTPD config to enable/disable TLS version that you want but how do I do the same on rsyslog.

Here are my configs on the server side:

#rsyslogd -v
rsyslogd 8.24.0, compiled with:
        PLATFORM:                               x86_64-redhat-linux-gnu
        PLATFORM (lsb_release -d):
        FEATURE_REGEXP:                         Yes
        GSSAPI Kerberos 5 support:              Yes
        FEATURE_DEBUG (debug build, slow code): No
        32bit Atomic operations supported:      Yes
        64bit Atomic operations supported:      Yes
        memory allocator:                       system default
        Runtime Instrumentation (slow code):    No
        uuid support:                           Yes
        Number of Bits in RainerScript integers: 64

See http://www.rsyslog.com for more information.

/etc/rsyslog.conf

##TLS Driver##
$DefaultNetstreamDriver gtls

##TLS Certificate##
$DefaultNetstreamDriverCAFile /etc/pki/rsyslog/ca.crt
$DefaultNetstreamDriverCertFile /etc/pki/rsyslog/cert.PEM
$DefaultNetstreamDriverKeyFile /etc/pki/rsyslog/privatekey.key

module(load="imtcp"
       MaxSessions="2000"
       StreamDriver.mode="1"
       StreamDriver.authmode="x509/name"
       PermittedPeer="*.clientsidehost.com")
input(type="imtcp" port="20514" name="tcp-tls")

The application that I am trying to receive logs from having the following requirement which I am trying to comply.

 TLS 1.0 & TLS 1.1 supported.
 TLS 1.2 is not support and it needs to be disabled on your configuration.    
 Cipher Suites SHA:AES128 & SHA: AES256 supported.

Any help would be greatly appreciated

I need to disable TLS 1.2 and make sure connection accept TLS version 1.1 cipher suite SHA: AES128 & SHA: AES256. I do not find any supporting documentation to where to define TLS version. I noticed SSLProtocol -all +TLSv1 +TLSv1.1 +TLSv1.2 can be defined in HTTPD config to enable/disable TLS version that you want but how do I do the same on rsyslog.

Here are my configs on the server side:

#rsyslogd -v
rsyslogd 8.24.0, compiled with:
        PLATFORM:                               x86_64-redhat-linux-gnu
        PLATFORM (lsb_release -d):
        FEATURE_REGEXP:                         Yes
        GSSAPI Kerberos 5 support:              Yes
        FEATURE_DEBUG (debug build, slow code): No
        32bit Atomic operations supported:      Yes
        64bit Atomic operations supported:      Yes
        memory allocator:                       system default
        Runtime Instrumentation (slow code):    No
        uuid support:                           Yes
        Number of Bits in RainerScript integers: 64

See http://www.rsyslog.com for more information.

/etc/rsyslog.conf

##TLS Driver##
$DefaultNetstreamDriver gtls

##TLS Certificate##
$DefaultNetstreamDriverCAFile /etc/pki/rsyslog/ca.crt
$DefaultNetstreamDriverCertFile /etc/pki/rsyslog/cert.PEM
$DefaultNetstreamDriverKeyFile /etc/pki/rsyslog/privatekey.key

module(load="imtcp"
       MaxSessions="2000"
       StreamDriver.mode="1"
       StreamDriver.authmode="x509/name"
       PermittedPeer="*.clientsidehost.com")
input(type="imtcp" port="20514" name="tcp-tls")

The application that I am trying to receive logs from having the following requirement which I am trying to comply.

 TLS 1.0 & TLS 1.1 supported.
 TLS 1.2 is not supported and it needs to be disabled on your configuration.    
 Cipher Suites SHA:AES128 & SHA: AES256 supported.

Any help would be greatly appreciated

edited title

Link

edited May 19, 2018 at 20:50

Raza

4.3k
7
31
34

rsyslog with TLS version 1.1 cipher suite SHA: AES128 & SHA: AES256

Source Link

asked May 19, 2018 at 20:44

Raza

4.3k
7
31
34

Loading

Stack Exchange Network

Return to Question

rsyslog with TLS version 1.1 cipher suite SHA: AES128 & SHA: AES256