The syslog-ng 3.0 Administrator Guide

The syslog-ng application can send and receive log messages securely over the network using the Transport Layer Security (TLS) protocol. TLS is an encryption protocol over the TCP/IP network protocol, so it can be used only with TCP-based sources and destinations ( tcp() and tcp6()).

TLS uses certificates to authenticate and encrypt the communication, as illustrated on the following figure:

Figure 2.7. Certificate-based authentication

The client authenticates the server by requesting its certificate and public key. Optionally, the server can also request a certificate from the client, thus mutual authentication is also possible.

In order to use TLS encryption in syslog-ng, the following elements are required:

When using mutual authentication to verify the identity of the clients, the following elements are required:

Mutual authentication ensures that the syslog-ng server accepts log messages only from authorized clients.

See Section 3.13, “Encrypting log messages with TLS” for details on configuring TLS communication in syslog-ng.