Linux Networking Cookbook

19.17. Creating SSL Keys for Your Syslog-ng Server on Fedora

Problem

You want to set up a secure Syslog-ng server, and you know you need stunnel and OpenSSL to do this. OpenSSL on Fedora doesn't look like OpenSSL on any other Linux distribution—where is everything? No CA.sh or CA.pl, it uses the /etc/pki directory, and it just looks all weird. What do you do?

Solution

Calm down, because Fedora has a nice Makefile for creating your Public Key Infrastructure (PKI) for stunnel. In fact, it is very easy. Change to its directory, and run it with no options to see what it does:

	# cd /etc/pki/tls/certs
	# make
	This makefile allows you to create:
	 0 public/private key pairs
	 0 SSL certificate signing requests (CSRs)
	 0 Self-signed SSL test certificates
	[...]

Create the server and one client certificate like this:

	# make syslogserver-xena.pem
	# make uberpc.pem

Use the fully qualified domain name of your server for the common name, or clients will emit complaints.

Open uberpc.pem and copy the public certificate, which is the bit between:

	-----BEGIN CERTIFICATE----
	-----END CERTIFICATE----

into a new file. You need to do this for every client—copy all of their public certificates into a single file on the Syslog-ng server, which in this recipe I call /etc/syslog-ng/clientkeys.

Now, you can copy Uberpc's keyfile into its permanent home:

	# scp uberpc.pem root@uberpc:/etc/syslog-ng/keys/

If you have disabled root logins over SSH, I shall leave it to your own ingenuity to figure out how to copy this file. ...