Linux Networking Cookbook

19.16. Creating SSL Keys for Your Syslog-ng Server on Debian

Problem

You want to set up a secure Syslog-ng server, and you know you need stunnel and OpenSSL to do this. Creating and managing OpenSSL certificates makes you break out in a rash—it's confusing, and it always takes you too long. Isn't there some kind soul who will show you the way? You're running Debian, or one of its descendants, or pretty much any Linux except Fedora or Red Hat.

Solution

Just follow along, and you'll be fine. What we're going to do is create an OpenSSL Certification Authority, and server and client encryption keys to use with stunnel. stunnel provides the transport for our Syslog-ng traffic, and OpenSSL does the encryption and authentication.

You should have OpenSSL already installed; if not, you know what to do.

We'll take this slowly because managing SSL certificates is confusing, and stunnel complicates matters by requiring a special keyfile format.

Although stunnel is going to use these certificates, I'm naming them "syslog-ng*" because they're for authenticating Syslog-ng traffic. We will create the Certificate Authority (CA) and public-/private-key pairs in the /etc/syslog-ng/ directory on the server. After they are created, I'll store them in /etc/syslog-ng/keys on the server and the clients. Wherever you want to keep your stuff, first make sure that the directories exist.

Now, find your CA.sh script, which is part of OpenSSL, and edit these two lines:

 DAYS="-days 3650" # 10 years CATOP=./syslog-ng-CA ...