Set up your Syslog

To set up a syslog server with SSL (Secure Sockets Layer) enabled, you need to perform the following steps.

Create certs directory to hold the self signed and generated certificates.
```
cd ~
mkdir certs
cd certs
```
Generate self signed certificates.
For CA and server certificates, give details that are not unique to each other.
openssl genrsa 2048 > ca-key.pem
Create CA certificate.
openssl req -new -x509 -nodes -days 3600 -key ca-key.pem -out ca.pem -subj "/CN=selfsigned-ca-certificate"
Create server certificate.
openssl req -newkey rsa:2048 -days 3600 -nodes -keyout server-key.pem -out server-req.pem -subj "/CN=selfsigned-server-certificate"
openssl rsa -in server-key.pem -out server-key.pem
openssl x509 -req -in server-req.pem -days 3600 -CA ca.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem
Verify the certificates and you must see in response as "server-cert.pem: OK".
openssl verify -CAfile ca.pem server-cert.pem
Install and enable rsyslog.
sudo apt update && sudo apt install rsyslog
sudo apt-get install rsyslog-gnutls
sudo systemctl start rsyslog
sudo systemctl status rsyslog
sudo systemctl enable rsyslog
sudo vi /etc/rsyslog.conf
Configure syslog.
sudo vi /etc/rsyslog.conf
module(load="imtcp" StreamDriver.AuthMode="anon" StreamDriver.Mode="1")
module(load="imuxsock") # provides support for local system logging (e.g. via logger command)
module(load="imklog") # provides kernel logging support (previously done by rklogd)
$DefaultNetstreamDriver gtls
$DefaultNetstreamDriverCAFile <path/to/ca.pem>
$DefaultNetstreamDriverCertFile <path/to/server-cert.pem>
$DefaultNetstreamDriverKeyFile <path/to/server-key.pem>
$InputTCPServerRun 6514
$template threatLogs,"/var/log/eaf/threatLogs.log"
*.* ?threatLogs
Note
Make sure to provide the correct path for ca.pem, server-key.pem, and server-cert.pem.
Save the file and restart rsyslog.
sudo systemctl restart rsyslog
sudo systemctl status rsyslog
The server certificate details provided in the POST or PATCH configuration must be base64 encoded.

Create syslog server with multiple chain self signed certificate:

Create a root key and certificate
openssl req -x509 -newkey rsa:4096 -keyout root.key -out root.crt -days 365 -nodes -subj "/CN=RootCA"
Create an Intermediate key and certificate.
openssl req -newkey rsa:4096 -keyout intermediate.key -out intermediate.csr -nodes -subj "/CN=IntermediateCA"
openssl x509 -req -in intermediate.csr -CA root.crt -CAkey root.key -CAcreateserial -out intermediate.crt -days 365
Combine the root and intermediate certificates into a chain.
cat root.crt intermediate.crt > root_chain.crt
Create the server key and certificate.
openssl req -newkey rsa:2048 -keyout server.key -out server.csr -nodes -subj "/CN=SysLogServer"
openssl x509 -req -in server.csr -CA root_chain.crt -CAkey root.key -CAcreateserial -out server.crt -days 365
cat root.crt intermediate.crt server.crt > certificate_chain.crt
module(load="imtcp" StreamDriver.AuthMode="anon" StreamDriver.Mode="1")
module(load="imuxsock") # provides support for local system logging (example, via logger command)
module(load="imklog") # provides kernel logging support (previously done by rklogd)
$DefaultNetstreamDriver gtls
$DefaultNetstreamDriverCAFile /home/appsadm/certs/root.key
$DefaultNetstreamDriverCertFile /home/appsadm/certs/certificate_chain.crt
$DefaultNetstreamDriverKeyFile /home/appsadm/certs/root.key
$InputTCPServerRun 6514
$template threatLogs,"/var/log/eaf/threatLogs.log"

Note
Make sure your syslog server must have a public IP and port enabled for Trellix PODs to access.