ADC

Export syslog securely over SSL

July 29, 2024

Contributed by:

You can securely export syslog over SSL (Secure Sockets Layer) ensuring that sensitive log data traverses the network in an encrypted and authenticated manner. By leveraging SSL, you can safeguard syslog transmissions against eavesdropping, tampering, and unauthorized access.

Export audit logs securely over an SSL connection by authenticating the syslog server

The following are the configuration steps to send audit logs securely over an SSL connection by authenticating the syslog server:

Copy the CA certificate. CA certificate is the certificate issued to the syslog server by the Certificate Authority. The certificate is available in the /nsconfig/ssl folder.
1. Run the following command on the certificate:
```
openssl x509 -noout -hash -in <ca_certificate>

```
  The result is a hash (for example 6d2962a8), a series of alphanumeric characters based on the Distinguished Name of the certificate.
2. Run the following command to create a symbolic link to the certificate that uses the hash returned by the previous command and the .0 suffix.
```
ln -s <ca_certificate> 6d2962a8.0

```

Enable load balancing and SSL features.

enable ns feature LoadBalancing
enable ns feature SSL
<!--NeedCopy-->

Add an SSL cert key by giving the CA certificate path.

add ssl certkey server_cacert -cert <path_to_ca_cert>
<!--NeedCopy-->

Add a service of type SSL_TCP with the IP address of the syslog server and the port on which the syslog server listens for SSL packets.
```
add service syslog_service <syslog_server_ip> SSL_TCP <syslog_server_port>

```

Bind the cert key to the service by giving the option -CA.

bind ssl service syslog_service -certkeyName server_cacert -CA
<!--NeedCopy-->

Enable the server authentication in the service.

set ssl service syslog_service -serverAuth ENABLED
<!--NeedCopy-->

Add a load balancing virtual server of type TCP with an IP address and port 514. Add SNIP address in the load balancing virtual server IP’s subnet.
```
add lb vserver lb_vserver TCP <lb_vserver_ip> 514
add ns ip <IP> <subnet> -type SNIP

```

Bind the service to the load balancing virtual server.

bind lb vserver lb_vserver syslog_service
<!--NeedCopy-->

Add syslog action with the IP address as load balancing virtual IP address, port number as 514 and transport as TCP.
```
add syslogaction sys_act <lb_vserver_ip> -loglevel all -transport TCP -serverPort 514

```

Add syslogpolicy and bind the policy to system global.

add syslogpolicy sys_pol true sys_act
bind syslogglobal -policyname sys_pol -priority 1
<!--NeedCopy-->

Export audit logs securely over SSL connection through mutual authentication

The following are the configuration steps to send audit logs securely over SSL connection through mutual authentication:

Copy the CA certificate. CA certificate is the certificate issued to the syslog server by the Certificate Authority. The certificate is available in the /nsconfig/ssl folder.
1. Run the following command on the certificate:
```
openssl x509 -noout -hash -in <ca_certificate>

```
  The result is a hash (for example 6d2962a8), a series of alphanumeric characters based on the Distinguished Name of the certificate.
2. Run the following command to create a symbolic link to the certificate that uses the hash returned by the previous command and the .0 suffix.
```
ln -s <ca_certificate> 6d2962a8.0

```

Add the SSL cert key by giving the CA certificate path.

add ssl cert key server_cacert -cert <path_to_ca_cert>
<!--NeedCopy-->

Add the SSL cert key by giving the client certificate (NetScaler’s certificate) with the key.

add ssl certkey client_cacert -cert <path_to_client_cert> -key <path_to_client_key>
<!--NeedCopy-->

Add service of type SSL_TCP with the IP address of syslog server and the port on which the syslog server listens for SSL packets.
```
add service syslog_service <syslog_server_ip> SSL_TCP <syslog_server_port>

```

Bind the cert key (server) to the service by giving the option -CA.

bind ssl service syslog_service -certkeyName server_cacert -CA
<!--NeedCopy-->

Bind the cert key (client) to the service.

bind ssl service syslog_service -certkeyName client_cacert
<!--NeedCopy-->

Enable the server authentication in the service.

set ssl service syslog_service -serverAuth ENABLED
<!--NeedCopy-->

Add load balancing virtual server of type TCP with an IP address and port 514. Add SNIP address in the load balancing virtual server IP’s subnet.
```
add lb vserver lb_vserver TCP <lb_vserver_ip> 514

```

Bind the service to a load balancing virtual server.

bind lb vserver lb_vserver syslog_service
<!--NeedCopy-->

Add syslog action with the IP address as load balancing virtual IP address, port as 514 and transport as TCP.
```
add syslogaction sys_act <lb_vserver_ip> -loglevel all -transport TCP -serverPort 514

```

Add syslog policy and bind this policy to system global.

add syslogpolicy sys_pol true sys_act
bind syslogglobal -policyname sys_pol -priority 1
<!--NeedCopy-->

With this configuration, SYSLOGTCP connection gets established from NetScaler’s IP address (NSIP) to load balancing virtual server’s IP address (LB VIP) and SSL_TCP connection gets established from Subnet IP(SNIP) of NetScaler to the back end syslog server. The audit log messages are then sent to syslog server over the SSL_TCP connection.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Export syslog securely over SSL

July 29, 2024

Contributed by:

July 29, 2024

Contributed by:

Export syslog securely over SSL

Export audit logs securely over an SSL connection by authenticating the syslog server

Export audit logs securely over SSL connection through mutual authentication

In this article