TLS Client Auth support for net log output

[yroc92]

When sending logs via the net output, TLS client auth is necessary for a secure, encrypted connection and safe transmission of logs. This is especially important when sending logs to a foreign server (think: Elasticsearch via Logstash's TCP plugin).

[francislavoie]

I have a feeling that a logstash writer plugin would probably be more appropriate.

[mholt]

That may be true, but I was thinking it seems fitting that a server that specializes in TLS should be able to establish a TLS connection for transmitting logs. 🤷‍♂️

[francislavoie]

But is there an actual standard for establishing TLS for writing logs, or is it just a proprietary thing logstash is doing? I don't think it makes sense to do this in the net writer if it's only for logstash.

[mholt]

It would just be a TLS client config, similar to what the reverse proxy uses or layer 4's proxy -- enable TLS, maybe configure the trusted roots, client auth, timeouts, etc. Would work with any TCP log ingestor (that also supports TLS, presumably remote log servers).

[mohammed90]

It would just be a TLS client config, similar to what the reverse proxy uses or layer 4's proxy -- enable TLS, maybe configure the trusted roots, client auth, timeouts, etc. Would work with any TCP log ingestor (that also supports TLS, presumably remote log servers).

From prior research, I found that attempting TLS termination for RDBMS and STARTTLS (in the email world) doesn't work like it works for other traffic, e.g. web. They have their own special handling during the handshake. This is where Francis' point about the presence of a standard for such TLS communication in log-writing.

We can test it. If the l4 app can proxy it, then the mere TLS connectivity should work.

[yroc92]

It looks like the TCP plugin for logstash is doing a pretty standard exchange. Here are their docs, and here is a typical example of the config for a Logstash TCP endpoint that is expecting a client cert:

input {
 tcp {
  port => 6514
  mode => "server"
  type => json
  ssl_enable => true
  ssl_certificate_authorities => ["/etc/logstash/ca.d/cacert.pem"]
  ssl_cert => "/etc/logstash/serverreq.pem"
  ssl_key => "/etc/logstash/serverkey.pem"
 }
}