NXLog User Guide

111.18. TLS/SSL (om_ssl)

The om_ssl module uses the OpenSSL library to provide an SSL/TLS transport. It behaves like the om_tcp module, except that an SSL handshake is performed at connection time and the data is received over a secure channel. Log messages transferred over plain TCP can be eavesdropped or even altered with a man-in-the-middle attack, while the om_ssl module provides a secure log message transport.

111.18.1. Configuration

The om_ssl module accepts the following directives in addition to the common module directives. The Host directive is required.

Host: The module will connect to this IP address or DNS hostname.

Port: The module will connect to this port number on the remote host. The default is port 514.

AllowUntrusted: This boolean directive specifies that the connection should be allowed without certificate verification. If set to TRUE the connection will be allowed even if the remote server presents an unknown or self-signed certificate. The default value is FALSE: the remote socket must present a trusted certificate.

CADir: This specifies the path to a directory containing certificate authority (CA) certificates, which will be used to check the certificate of the remote socket. The certificate filenames in this directory must be in the OpenSSL hashed format. A remote’s self-signed certificate (which is not signed by a CA) can also be trusted by including a copy of the certificate in this directory.

CAFile: This specifies the path of the certificate authority (CA) certificate, which will be used to check the certificate of the remote socket. To trust a self-signed certificate presented by the remote (which is not signed by a CA), provide that certificate instead.

CertFile: This specifies the path of the certificate file to be used for the SSL handshake.

CertKeyFile: This specifies the path of the certificate key file to be used for the SSL handshake.

CRLDir: This specifies the path to a directory containing certificate revocation lists (CRLs), which will be consulted when checking the certificate of the remote socket. The certificate filenames in this directory must be in the OpenSSL hashed format.

CRLFile: This specifies the path of the certificate revocation list (CRL) which will be used to check the certificate of the remote socket against.

KeyPass: With this directive, a password can be supplied for the certificate key file defined in CertKeyFile. This directive is not needed for passwordless private keys.

LocalPort: This optional directive specifies the local port number of the connection. If this is not specified a random high port number will be used, which is not always ideal in firewalled network environments.

OutputType: See the OutputType directive in the list of common module directives. The default is LineBased_LF.

Reconnect: This directive has been deprecated as of version 2.4. The module will try to reconnect automatically at increasing intervals on all errors.

SNI: This optional directive specifies the host name used for Server Name Indication (SNI).

SSLCipher: This optional directive can be used to set the permitted SSL cipher list, overriding the default. Use the format described in the ciphers(1ssl) man page.

SSLCompression

This boolean directive allows you to enable data compression when sending data over the network. The compression mechanism is based on the zlib compression library. If the directive is not specified, it defaults to FALSE (the compression is disabled).

Note	Some Linux packages (for example, Debian) use the OpenSSL library provided by the OS and may not support the zlib compression mechanism. The module will emit a warning on startup if the compression support is missing. The generic deb/rpm packages are bundled with a zlib-enabled libssl library.

SSLProtocol: This directive can be used to set the allowed SSL/TLS protocol(s). It takes a comma-separated list of values which can be any of the following: SSLv2, SSLv3, TLSv1, TLSv1.1, and TLSv1.2. By default, the TLSv1, TLSv1.2, and TLSv1.2 protocols are allowed. Note that the OpenSSL library shipped by Linux distributions may not support SSLv2 and SSLv3, in which case these will not work even if enabled with SSLProtocol.

111.18.2. Procedures

The following procedures are exported by om_ssl.

reconnect();: Force a reconnection. This can be used from a Schedule block to periodically reconnect to the server.

111.18.3. Examples

Example 612. Sending Binary Data to Another NXLog Agent

This configuration reads log messages from socket and sends them in the NXLog binary format to another NXLog agent.

nxlog.conf


  1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

  <Input uds>
    Module          im_uds
    UDS             tmp/socket
</Input>

<Output ssl>
    Module          om_ssl
    Host            localhost
    Port            23456
    CAFile          %CERTDIR%/ca.pem
    CertFile        %CERTDIR%/client-cert.pem
    CertKeyFile     %CERTDIR%/client-key.pem
    KeyPass         secret
    AllowUntrusted  TRUE
    OutputType      Binary
</Output>

<Route uds_to_ssl>
    Path            uds => ssl
</Route>