Hi, I am trying to use an ssl connection between client and server in "server-side authentication only" mode. I placed the certificates in the respective /conf folder of nxlog server. these are the current configurations:

>>> CLIENT <<< <Output to_syslog_server> Module om_ssl Host 10.1.1.1 Port 516 Exec $Message = to_leef(); to_syslog_ietf(); </Output>

>>> SERVER <<< <Input in_syslog_ssl> Module im_ssl Host 0.0.0.0 Port 516 CAFile %CERTDIR%/rootCA.pem CertFile %CERTDIR%/central.crt CertKeyFile %CERTDIR%/central.key KeyPass password FlowControl TRUE AllowUntrusted TRUE <Exec> if $raw_event =~ /LEEF/ parse_leef(); else parse_syslog(); </Exec> </Input>

but it makes me this Error:

2019-09-06 17:43:26 ERROR remote ssl socket was reset? (SSL_ERROR_SSL with errno=9); End of file found

Do you have any ideas to solve this?

Thank you Antonio

Hi,

We are trying to connect NXLog with Logmatic.io with a SSL connection. The certificate provided by Logmatic is valid and works with Rsyslog, Syslog-NG or Open-SSL.

However, no matter how hard we try to connect NXLog we have no success and not enough debugging information to troubleshoot it ourselves.

Here is our config:

<Output out>

    Module      om_ssl

    Host        api.logmatic.io

    Port        10515

    CAFile    <path_to_your_.crt_file>



####Add the API key before the event

    Exec     $raw_event="<your_api_key> "+$raw_event;

</Output>

We tried a lot more configuration with AllowUntrusted TRUE/FALSE, CertFile, etc... But the result is always the same:

2015-12-18 18:25:39 INFO connecting to api.logmatic.io:10515

2015-12-18 18:25:39 INFO successfully connected to api.logmatic.io:10515

2015-12-18 18:25:39 INFO reconnecting in 1 seconds

2015-12-18 18:25:40 INFO connecting to api.logmatic.io:10515

2015-12-18 18:25:40 INFO successfully connected to api.logmatic.io:10515

2015-12-18 18:25:41 INFO reconnecting in 1 seconds

2015-12-18 18:25:42 INFO connecting to api.logmatic.io:10515

2015-12-18 18:25:42 INFO successfully connected to api.logmatic.io:10515

Do you have any idea about what it could be?

You can find the certificate here: http://doc.logmatic.io/docs/logging-from-windows#section-enabling-security

Sorry to bother you with that but we spent a lot of time doing our homework before asking this question.

Thanks!!

TL;DR summary: NXLog won't load my certificate - why?

I've set up an NXlog CE server to act as an encrypted entrypoint for a Graylog server. After creating a self-signed certificate and adding it to the configuration, I get an unexpected error in the log when NXlogs starts up.

2015-07-10 06:49:22 INFO reloading configuration and restarting modules
2015-07-10 06:49:22 ERROR SSL error, Failed to open certfile: "/certificates/client.pem";No such file or directory
2015-07-10 06:49:22 INFO configuration reloaded successfully.

I assumed it might be a file rights issue, but looking at the files, it seems like the rights are actually a little too loose for comfort:

root@e757dae37501:/# ll /certificates/
total 20
drwxr-xr-x  2 nxlog nxlog 4096 Jul 10 06:32 ./
drwxr-xr-x 49 root  root  4096 Jul 10 06:32 ../
-rw-r--r--  1 nxlog nxlog 1387 Jul  9 15:51 ca.pem
-rw-r--r--  1 nxlog nxlog  887 Jul  9 15:54 client.key
-rw-r--r--  1 nxlog nxlog 1001 Jul  9 15:55 client.pem

My NXlog configuration looks like this:

...
<Input inssl>
    Module im_ssl
    Host 0.0.0.0
    Port 1515
    InputType Binary
    CAFile "/certificates/ca.pem"
    CertFile "/certificates/client.pem"
    CertKeyFile "/certificates/client.key"
    KeyPass secret
    RequireCert FALSE
    AllowUntrusted TRUE
</Input>
...

I've tried looking at the source code for the SSL module, but it looks like the line that fails is not related to validation but simple file access. I have no idea how to proceed. Suggestions?

Hi,

I'm trying to foward log events with NXlog to logstash over a SSL connection. Therefore, I generated my own CA certificate and a certificate to be used by logstash for the SSL connection. NXlog is installed on a Ubuntu 14.04 (virtual) machine with the CA certificate added as '/etc/ssl/certs/logstash-ca.crt'.

I tested the connection with

openssl s_client -CAfile /etc/ssl/certs/logstash-ca.cert -connect localhost:5000

and everything works fine (all entered text lines are received by logstash).

However, when I start NXlog with the appropriate om_ssl output configuration it fails with

ERROR SSL certificate verification failed: unable to get local issuer certificate (err: 20)

My NXlog configuration looks like this:

User nxlog
Group nxlog

LogFile /var/log/nxlog/nxlog.log
LogLevel DEBUG

# Modules
<Extension _syslog>
    Module xm_syslog
</Extension>
<Extension json>
    Module xm_json
</Extension>

# Nxlog internal logs
<Input internal>
    Module im_internal
    Exec $EventReceivedTime = integer($EventReceivedTime) / 1000000; to_json();
</Input>

<Output sslout>
    Module          om_ssl
    Host            localhost
    Port            5000
    CertFile        "/etc/ssl/certs/logstash-ca.crt"
    OutputType      LineBased
</Output>

<Route logstash>
    Path internal => sslout
</Route>

When I start NXlog with

sudo nxlog -f -c nxlog.conf

the debug output looks like this:

2015-03-05 20:37:05 DEBUG module sslout got 1 poll events
2015-03-05 20:37:05 DEBUG Module sslout can read
2015-03-05 20:37:05 DEBUG [...]
2015-03-05 20:37:05 DEBUG PROCESS_EVENT: READ (sslout)
2015-03-05 20:37:05 DEBUG om_ssl read
2015-03-05 20:37:05 DEBUG doing handshake
2015-03-05 20:37:05 DEBUG verify callback (ok: 0)
2015-03-05 20:37:05 DEBUG preverification returned non-OK: unable to get local issuer certificate
2015-03-05 20:37:05 DEBUG STOP: sslout
2015-03-05 20:37:05 DEBUG remove socket [21]
2015-03-05 20:37:05 DEBUG executing statements
2015-03-05 20:37:05 DEBUG [...]
2015-03-05 20:37:05 INFO reconnecting in 1 seconds
2015-03-05 20:37:05 ERROR [om_ssl.c:532/io_err_handler()] -;[ssl.c:168/nx_ssl_check_io_error()] SSL certificate verification failed: unable to get local issuer certificate (err: 20)

I have no idea why the verification work with OpenSSL but fails with NXlog (I'm using nxlog-ce-2.8.1248 and OpenSSL version is 1.0.1f).

Any help is highly appreciated.