diff options
| author | Oleksandr Kuchmystyi <o.kuchmystyi@vyos.io> | 2025-09-17 16:33:39 +0300 |
|---|---|---|
| committer | Oleksandr Kuchmystyi <o.kuchmystyi@vyos.io> | 2025-09-30 17:37:52 +0300 |
| commit | 68f2cec785b6705c71d17b30114355569c489d66 (patch) | |
| tree | d3fae021d1be76a55d6e5c73535b0b4459a07d12 /interface-definitions/system_syslog.xml.in | |
| parent | a3b62f290a90a374dca04c6400fd1619f36e808f (diff) | |
| download | vyos-1x-68f2cec785b6705c71d17b30114355569c489d66.tar.gz vyos-1x-68f2cec785b6705c71d17b30114355569c489d66.zip | |
syslog: T4251: Add TLS support to syslog
Add TLS support for remote syslog by extending the CLI and backend to support configuration of CA certificates, client certificates, keys, and authentication modes.
This update integrates with the PKI subsystem for certificate management, ensures proper validation of protocol settings when TLS is enabled, and generates secure rsyslog configuration for forwarding logs over TLS.
Diffstat (limited to 'interface-definitions/system_syslog.xml.in')
| -rw-r--r-- | interface-definitions/system_syslog.xml.in | 54 |
1 files changed, 54 insertions, 0 deletions
diff --git a/interface-definitions/system_syslog.xml.in b/interface-definitions/system_syslog.xml.in index 116cbde73..78217882f 100644 --- a/interface-definitions/system_syslog.xml.in +++ b/interface-definitions/system_syslog.xml.in @@ -65,6 +65,60 @@ #include <include/protocol-tcp-udp.xml.i> #include <include/source-address-ipv4-ipv6.xml.i> #include <include/interface/vrf.xml.i> + <node name="tls"> + <properties> + <help>Transport Layer Security (TLS) options for secure syslog</help> + </properties> + <children> + <leafNode name="enable"> + <properties> + <help>Enable TLS encryption for log transmission to this remote syslog server</help> + <valueless/> + </properties> + </leafNode> + <!-- CA cert help should describe trust anchor for server/client validation --> + #include <include/pki/ca-certificate.xml.i> + <!-- Certificate help should specify identity for mutual authentication --> + #include <include/pki/certificate.xml.i> + <leafNode name="auth-mode"> + <properties> + <help>Specify the authentication and verification method for the remote peer's certificate during the TLS handshake</help> + <completionHelp> + <list>anon fingerprint certvalid name</list> + </completionHelp> + <valueHelp> + <format>anon</format> + <description>Allow encrypted connection without verifying the peer's identity (anonymous TLS)</description> + </valueHelp> + <valueHelp> + <format>fingerprint</format> + <description>Authenticate peer by matching its certificate fingerprint to a configured, permitted list (`permitted-peers` option)</description> + </valueHelp> + <valueHelp> + <format>certvalid</format> + <description>Authenticate peer if it presents a certificate signed by a trusted CA</description> + </valueHelp> + <valueHelp> + <format>name</format> + <description>Authenticate peer by verifying its certificate subject name against a configured value (`permitted-peers` option)</description> + </valueHelp> + <constraint> + <regex>(anon|fingerprint|certvalid|name)</regex> + </constraint> + </properties> + <defaultValue>anon</defaultValue> + </leafNode> + <leafNode name="permitted-peers"> + <properties> + <help>Comma-separated list of allowed peer certificate fingerprints or subject names</help> + <valueHelp> + <format>txt</format> + <description>Comma-separated fingerprints or peer names.\nFor example:\n - 'SHA1:DD:23:E3:E7:70:F5:B4:13:44:16:78:A5:5A:8C:39:48:53:A6:DD:25,SHA256:10:C4:26:1D:CB:3C:AB:12:DB:1A:F0:47:37:AE:6D:D2:DE:66:B5:71:B7:2E:5B:BB:AE:0C:7E:7F:5F:0D:E9:64'\n - 'logs.example.com'</description> + </valueHelp> + </properties> + </leafNode> + </children> + </node> </children> </tagNode> <node name="local"> |