rsyslog with TLS

Question

I need to disable TLS 1.2 and make sure connection accept TLS version 1.1 cipher suite SHA: AES128 & SHA: AES256. I do not find any supporting documentation to where to define TLS version. I noticed SSLProtocol -all +TLSv1 +TLSv1.1 +TLSv1.2 can be defined in HTTPD config to enable/disable TLS version that you want but how do I do the same on rsyslog.

Here are my configs on the server side:

#rsyslogd -v
rsyslogd 8.24.0, compiled with:
        PLATFORM:                               x86_64-redhat-linux-gnu
        PLATFORM (lsb_release -d):
        FEATURE_REGEXP:                         Yes
        GSSAPI Kerberos 5 support:              Yes
        FEATURE_DEBUG (debug build, slow code): No
        32bit Atomic operations supported:      Yes
        64bit Atomic operations supported:      Yes
        memory allocator:                       system default
        Runtime Instrumentation (slow code):    No
        uuid support:                           Yes
        Number of Bits in RainerScript integers: 64

See http://www.rsyslog.com for more information.

/etc/rsyslog.conf

##TLS Driver##
$DefaultNetstreamDriver gtls

##TLS Certificate##
$DefaultNetstreamDriverCAFile /etc/pki/rsyslog/ca.crt
$DefaultNetstreamDriverCertFile /etc/pki/rsyslog/cert.PEM
$DefaultNetstreamDriverKeyFile /etc/pki/rsyslog/privatekey.key

module(load="imtcp"
       MaxSessions="2000"
       StreamDriver.mode="1"
       StreamDriver.authmode="x509/name"
       PermittedPeer="*.clientsidehost.com")
input(type="imtcp" port="20514" name="tcp-tls")

The application that I am trying to receive logs from having the following requirement which I am trying to comply.

 TLS 1.0 & TLS 1.1 supported.
 TLS 1.2 is not supported and it needs to be disabled on your configuration.    
 Cipher Suites SHA:AES128 & SHA: AES256 supported.

Any help would be greatly appreciated

Update:

# openssl ciphers -v | awk '{print $2}' | sort -u
SSLv3
TLSv1.2

# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.3 (Maipo)

Answer 1

Using a recent Linux distribution as RHEL 7.0, you will find out openssl does not support TLS 1.0 and TLS 1.1. anymore for security reasons.

As you can see in the openssl ciphers -v output, TLS 1.0 and TLS 1.1 are not listed.

As a solution:

• ask your supplier to support TLS 1.2, you will need it;
• use an older RHEL version that supports TLS 1.0 or TLS 1.1, and point your actual syslog to it, if you have other app that needs the new RHEL version;
• compile a older openssl version + rsyslog by hand;
• or try to get away installing and older rsyslogd rpm (probably wont work)
• setup an SSL tunnel as a last temporary measure between you and rsyslog, again with an other version. But for that, better use then rsyslog there.

Obviously, as time goes by, you will need more and more to have TLS 1.2 support in the near future.