Skip to content

Commit 54e8dce

Browse files
authored
Merge pull request #1545 from fluent/lynettemiles/sc-105726/update-administration-transport-security
Updating transport security for style and grammar
2 parents 32d38ce + 181a262 commit 54e8dce

File tree

1 file changed

+106
-88
lines changed

1 file changed

+106
-88
lines changed

administration/transport-security.md

Lines changed: 106 additions & 88 deletions
Original file line numberDiff line numberDiff line change
@@ -1,85 +1,93 @@
11

22
# Transport Security
33

4-
Fluent Bit provides integrated support for _Transport Layer Security_ \(TLS\) and it predecessor _Secure Sockets Layer_ \(SSL\) respectively. In this section we will refer as TLS only for both implementations.
4+
Fluent Bit provides integrated support for Transport Layer Security (TLS) and
5+
its predecessor Secure Sockets Layer (SSL). This section refers only
6+
to TLS for both implementations.
57

6-
Both input and output plugins that perform Network I/O can optionally enable TLS and configure the behavior. The following table describes the properties available:
8+
Both input and output plugins that perform Network I/O can optionally enable TLS and
9+
configure the behavior. The following table describes the properties available:
710

811
| Property | Description | Default |
912
| :--- | :--- | :--- |
10-
| tls | enable or disable TLS support | Off |
11-
| tls.verify | force certificate validation | On |
12-
| tls.verify\_hostname | force TLS verification of hostnames | Off |
13-
| tls.debug | Set TLS debug verbosity level. It accept the following values: 0 \(No debug\), 1 \(Error\), 2 \(State change\), 3 \(Informational\) and 4 Verbose | 1 |
14-
| tls.ca\_file | absolute path to CA certificate file | |
15-
| tls.ca\_path | absolute path to scan for certificate files | |
16-
| tls.crt\_file | absolute path to Certificate file | |
17-
| tls.key\_file | absolute path to private Key file | |
18-
| tls.key\_passwd | optional password for tls.key\_file file | |
19-
| tls.vhost | hostname to be used for TLS SNI extension | |
20-
21-
*Note : in order to use TLS on input plugins the user is expected to provide both a certificate and private key*
22-
23-
The listed properties can be enabled in the configuration file, specifically on each output plugin section or directly through the command line.
13+
| `tls` | Enable or disable TLS support. | `Off` |
14+
| `tls.verify` | Force certificate validation. | `On` |
15+
| `tls.verify_hostname` | Force TLS verification of host names. | `Off` |
16+
| `tls.debug` | Set TLS debug verbosity level. Accepted values: `0` (No debug), `1` (Error), `2` (State change), `3` (Informational) and `4`. (Verbose) | `1` |
17+
| `tls.ca_file` | Absolute path to CA certificate file. | _none_ |
18+
| `tls.ca_path` | Absolute path to scan for certificate files. | _none_ |
19+
| `tls.crt_file` | Absolute path to Certificate file. | _none_ |
20+
| `tls.key_file` | Absolute path to private Key file. | _none_ |
21+
| `tls.key_passwd` | Optional password for `tls.key_file` file. | _none_ |
22+
| `tls.vhost` | Hostname to be used for TLS SNI extension. | _none_ |
23+
24+
To use TLS on input plugins, you must provide both a certificate and a
25+
private key.
26+
27+
The listed properties can be enabled in the configuration file, specifically in each
28+
output plugin section or directly through the command line.
2429

2530
The following **output** plugins can take advantage of the TLS feature:
2631

27-
* [Amazon S3](../pipeline/outputs/s3.md)
28-
* [Apache SkyWalking](../pipeline/outputs/skywalking.md)
29-
* [Azure](../pipeline/outputs/azure.md)
30-
* [Azure Blob](../pipeline/outputs/azure_blob.md)
31-
* [Azure Data Explorer (Kusto)](../pipeline/outputs/azure_kusto.md)
32-
* [Azure Logs Ingestion API](../pipeline/outputs/azure_logs_ingestion.md)
33-
* [BigQuery](../pipeline/outputs/bigquery.md)
34-
* [Dash0](../pipeline/outputs/dash0.md)
35-
* [Datadog](../pipeline/outputs/datadog.md)
36-
* [Elasticsearch](../pipeline/outputs/elasticsearch.md)
37-
* [Forward](../pipeline/outputs/forward.md)
38-
* [GELF](../pipeline/outputs/gelf.md)
39-
* [Google Chronicle](../pipeline/outputs/chronicle.md)
40-
* [HTTP](../pipeline/outputs/http.md)
41-
* [InfluxDB](../pipeline/outputs/influxdb.md)
42-
* [Kafka REST Proxy](../pipeline/outputs/kafka-rest-proxy.md)
43-
* [LogDNA](../pipeline/outputs/logdna.md)
44-
* [Loki](../pipeline/outputs/loki.md)
45-
* [New Relic](../pipeline/outputs/new-relic.md)
46-
* [OpenSearch](../pipeline/outputs/opensearch.md)
47-
* [OpenTelemetry](../pipeline/outputs/opentelemetry.md)
48-
* [Oracle Cloud Infrastructure Logging Analytics](../pipeline/outputs/oci-logging-analytics.md)
49-
* [Prometheus Remote Write](../pipeline/outputs/prometheus-remote-write.md)
50-
* [Slack](../pipeline/outputs/slack.md)
51-
* [Splunk](../pipeline/outputs/splunk.md)
52-
* [Stackdriver](../pipeline/outputs/stackdriver.md)
53-
* [Syslog](../pipeline/outputs/syslog.md)
54-
* [TCP & TLS](../pipeline/outputs/tcp-and-tls.md)
55-
* [Treasure Data](../pipeline/outputs/treasure-data.md)
56-
* [WebSocket](../pipeline/outputs/websocket.md)
32+
- [Amazon S3](../pipeline/outputs/s3.md)
33+
- [Apache SkyWalking](../pipeline/outputs/skywalking.md)
34+
- [Azure](../pipeline/outputs/azure.md)
35+
- [Azure Blob](../pipeline/outputs/azure_blob.md)
36+
- [Azure Data Explorer (Kusto)](../pipeline/outputs/azure_kusto.md)
37+
- [Azure Logs Ingestion API](../pipeline/outputs/azure_logs_ingestion.md)
38+
- [BigQuery](../pipeline/outputs/bigquery.md)
39+
- [Dash0](../pipeline/outputs/dash0.md)
40+
- [Datadog](../pipeline/outputs/datadog.md)
41+
- [Elasticsearch](../pipeline/outputs/elasticsearch.md)
42+
- [Forward](../pipeline/outputs/forward.md)
43+
- [GELF](../pipeline/outputs/gelf.md)
44+
- [Google Chronicle](../pipeline/outputs/chronicle.md)
45+
- [HTTP](../pipeline/outputs/http.md)
46+
- [InfluxDB](../pipeline/outputs/influxdb.md)
47+
- [Kafka REST Proxy](../pipeline/outputs/kafka-rest-proxy.md)
48+
- [LogDNA](../pipeline/outputs/logdna.md)
49+
- [Loki](../pipeline/outputs/loki.md)
50+
- [New Relic](../pipeline/outputs/new-relic.md)
51+
- [OpenSearch](../pipeline/outputs/opensearch.md)
52+
- [OpenTelemetry](../pipeline/outputs/opentelemetry.md)
53+
- [Oracle Cloud Infrastructure Logging Analytics](../pipeline/outputs/oci-logging-analytics.md)
54+
- [Prometheus Remote Write](../pipeline/outputs/prometheus-remote-write.md)
55+
- [Slack](../pipeline/outputs/slack.md)
56+
- [Splunk](../pipeline/outputs/splunk.md)
57+
- [Stackdriver](../pipeline/outputs/stackdriver.md)
58+
- [Syslog](../pipeline/outputs/syslog.md)
59+
- [TCP & TLS](../pipeline/outputs/tcp-and-tls.md)
60+
- [Treasure Data](../pipeline/outputs/treasure-data.md)
61+
- [WebSocket](../pipeline/outputs/websocket.md)
5762

5863
The following **input** plugins can take advantage of the TLS feature:
5964

60-
* [Docker Events](../pipeline/inputs/docker-events.md)
61-
* [Elasticsearch (Bulk API)](../pipeline/inputs/elasticsearch.md)
62-
* [Forward](../pipeline/inputs/forward.md)
63-
* [Health](../pipeline/inputs/health.md)
64-
* [HTTP](../pipeline/inputs/http.md)
65-
* [Kubernetes Events](../pipeline/inputs/kubernetes-events.md)
66-
* [MQTT](../pipeline/inputs/mqtt.md)
67-
* [NGINX Exporter Metrics](../pipeline/inputs/nginx.md)
68-
* [OpenTelemetry](../pipeline/inputs/opentelemetry.md)
69-
* [Prometheus Scrape Metrics](../pipeline/inputs/prometheus-scrape-metrics.md)
70-
* [Prometheus Remote Write](../pipeline/inputs/prometheus-remote-write.md)
71-
* [Splunk (HTTP HEC)](../pipeline/inputs/splunk.md)
72-
* [Syslog](../pipeline/inputs/syslog.md)
73-
* [TCP](../pipeline/inputs/tcp.md)
74-
75-
In addition, other plugins implements a sub-set of TLS support, meaning, with restricted configuration:
76-
77-
* [Kubernetes Filter](../pipeline/filters/kubernetes.md)
65+
- [Docker Events](../pipeline/inputs/docker-events.md)
66+
- [Elasticsearch (Bulk API)](../pipeline/inputs/elasticsearch.md)
67+
- [Forward](../pipeline/inputs/forward.md)
68+
- [Health](../pipeline/inputs/health.md)
69+
- [HTTP](../pipeline/inputs/http.md)
70+
- [Kubernetes Events](../pipeline/inputs/kubernetes-events.md)
71+
- [MQTT](../pipeline/inputs/mqtt.md)
72+
- [NGINX Exporter Metrics](../pipeline/inputs/nginx.md)
73+
- [OpenTelemetry](../pipeline/inputs/opentelemetry.md)
74+
- [Prometheus Scrape Metrics](../pipeline/inputs/prometheus-scrape-metrics.md)
75+
- [Prometheus Remote Write](../pipeline/inputs/prometheus-remote-write.md)
76+
- [Splunk (HTTP HEC)](../pipeline/inputs/splunk.md)
77+
- [Syslog](../pipeline/inputs/syslog.md)
78+
- [TCP](../pipeline/inputs/tcp.md)
79+
80+
In addition, other plugins implement a subset of TLS support, with
81+
restricted configuration:
82+
83+
- [Kubernetes Filter](../pipeline/filters/kubernetes.md)
7884

7985
## Example: enable TLS on HTTP input
80-
By default HTTP input plugin uses plain TCP, enabling TLS from the command line can be done with:
8186

82-
```text
87+
By default, the HTTP input plugin uses plain TCP. Run the following command to enable
88+
TLS:
89+
90+
```bash
8391
./bin/fluent-bit -i http \
8492
-p port=9999 \
8593
-p tls=on \
@@ -90,11 +98,12 @@ By default HTTP input plugin uses plain TCP, enabling TLS from the command line
9098
-m '*'
9199
```
92100

93-
In the command line above, the two properties _tls_ and _tls.verify_ where enabled for demonstration purposes \(we strongly suggest always keep verification ON\).
101+
In the previous command, the two properties `tls` and `tls.verify` are set
102+
for demonstration purposes. Always enable verification in production environments.
94103

95104
The same behavior can be accomplished using a configuration file:
96105

97-
```text
106+
```python
98107
[INPUT]
99108
name http
100109
port 9999
@@ -110,20 +119,22 @@ The same behavior can be accomplished using a configuration file:
110119

111120
## Example: enable TLS on HTTP output
112121

113-
By default HTTP output plugin uses plain TCP, enabling TLS from the command line can be done with:
122+
By default, the HTTP output plugin uses plain TCP. Run the following command to enable
123+
TLS:
114124

115-
```text
116-
$ fluent-bit -i cpu -t cpu -o http://192.168.2.3:80/something \
125+
```bash
126+
fluent-bit -i cpu -t cpu -o http://192.168.2.3:80/something \
117127
-p tls=on \
118128
-p tls.verify=off \
119129
-m '*'
120130
```
121131

122-
In the command line above, the two properties _tls_ and _tls.verify_ where enabled for demonstration purposes \(we strongly suggest always keep verification ON\).
132+
In the previous command, the properties `tls` and `tls.verify` are enabled
133+
for demonstration purposes. Always enable verification in production environments.
123134

124135
The same behavior can be accomplished using a configuration file:
125136

126-
```text
137+
```python
127138
[INPUT]
128139
Name cpu
129140
Tag cpu
@@ -140,11 +151,14 @@ The same behavior can be accomplished using a configuration file:
140151

141152
## Tips and Tricks
142153

143-
### Generate your own self signed certificates for testing purposes.
154+
### Generate a self signed certificates for testing purposes
144155

145-
This will generate a 4096 bit RSA key pair and a certificate that is signed using SHA-256 with the expiration date set to 30 days in the future, `test.host.net` set as common name and since we opted out of `DES` the private key will be stored in plain text.
156+
The following command generates a 4096 bit RSA key pair and a certificate that's signed
157+
using `SHA-256` with the expiration date set to 30 days in the future. In this example,
158+
`test.host.net` is set as the common name. This example opts out of `DES`, so the
159+
private key is stored in plain text.
146160

147-
```
161+
```bash
148162
openssl req -x509 \
149163
-newkey rsa:4096 \
150164
-sha256 \
@@ -156,9 +170,12 @@ openssl req -x509 \
156170

157171
### Connect to virtual servers using TLS
158172

159-
Fluent Bit supports [TLS server name indication](https://en.wikipedia.org/wiki/Server_Name_Indication). If you are serving multiple hostnames on a single IP address \(a.k.a. virtual hosting\), you can make use of `tls.vhost` to connect to a specific hostname.
173+
Fluent Bit supports
174+
[TLS server name indication](https://en.wikipedia.org/wiki/Server_Name_Indication).
175+
If you are serving multiple host names on a single IP address (for example, using
176+
virtual hosting), you can make use of `tls.vhost` to connect to a specific hostname.
160177

161-
```text
178+
```python
162179
[INPUT]
163180
Name cpu
164181
Tag cpu
@@ -174,22 +191,23 @@ Fluent Bit supports [TLS server name indication](https://en.wikipedia.org/wiki/S
174191
tls.vhost fluent.example.com
175192
```
176193

177-
### Verify subjectAltName
194+
### Verify `subjectAltName`
178195

179-
By default, TLS verification of hostnames is not done automatically.
180-
As an example, we can extract the X509v3 Subject Alternative Name from a certificate:
196+
By default, TLS verification of host names isn't done automatically.
197+
As an example, you can extract the X509v3 Subject Alternative Name from a certificate:
181198

182-
```
199+
```text
183200
X509v3 Subject Alternative Name:
184201
DNS:my.fluent-aggregator.net
185202
```
186203

187-
As you can see, this certificate covers only `my.fluent-aggregator.net` so if we use a different hostname it should fail.
188-
189-
To fully verify the alternative name and demonstrate the failure we enable `tls.verify_hostname`:
204+
This certificate covers only `my.fluent-aggregator.net` so if you use a different
205+
hostname it should fail.
190206

207+
To fully verify the alternative name and demonstrate the failure, enable
208+
`tls.verify_hostname`:
191209

192-
```text
210+
```python
193211
[INPUT]
194212
Name cpu
195213
Tag cpu
@@ -205,9 +223,9 @@ To fully verify the alternative name and demonstrate the failure we enable `tls.
205223
tls.ca_file /path/to/fluent-x509v3-alt-name.crt
206224
```
207225

208-
This outgoing connect will be failed and disconnected:
226+
This outgoing connect will fail and disconnect:
209227

210-
```
228+
```text
211229
[2024/06/17 16:51:31] [error] [tls] error: unexpected EOF with reason: certificate verify failed
212230
[2024/06/17 16:51:31] [debug] [upstream] connection #50 failed to other.fluent-aggregator.net:24224
213231
[2024/06/17 16:51:31] [error] [output:forward:forward.0] no upstream connections available

0 commit comments

Comments
 (0)