Linux Networking Cookbook

19.18. Setting Up stunnel for Syslog-ng

Problem

You have your SSL infrastructure set up, and now you want to configure stunnel to use with your Syslog-ng server.

Solution

You'll need to install stunnel on the clients and server. Install it on Debian with this command:

	# aptitude install stunnel4

On Fedora, use this command:

	# yum install stunnel

Now, edit your server /etc/stunnel/stunnel.conf file to look like this. The cert names come from the previous two recipes:

	cert = /etc/syslog-ng/syslogserver-xena.pem
	CAfile = /etc/syslog-ng/clientkeys
	client = no
	verify = 3
	setgid = stunnel4
	setuid = stunnel4
	
	[syslog-ng]
	#server address
	accept = 192.168.1.50:5140
	connect = 127.0.0.1:514

The stunnel4 user and group are created by the Debian installer. If your system does not create an unprivileged user and group for stunnel, you should create them yourself:

	# groupadd stunnel
	# useradd -d /var/run/stunnel -m -g stunnel -s /bin/false stunnel

The stunnel client configuration file looks like this:

	cert = /etc/syslog-ng/uberpc.pem
	client = yes
	verify = 3
	setuid = stunnel4
	setgid = stunnel4
	
	[syslog-ng]
	accept = 127.0.0.1:514
	#server address
	connect = 192.168.1.50:5140

Now, you're ready to move on to actually configuring Syslog-ng.

Discussion

This is as simple a setup as it is possible to use. By default, stunnel will listen on all interfaces, so if that is the behavior you want, it's not necessary to specify IP addresses. You do need to list which ports you want it to listen to, so check /etc/services ...