Update passive_journal_centralization_guide_self_signed_certs.md
Costa Tsaousis committed
Oct 17, 2023 at 21:44 UTC
11f702b971f9b2d83495be7a5ea2d28cd0dcde64
1 file changed
+9
-1
collectors/systemd-journal.plugin/passive_journal_centralization_guide_self_signed_certs.md
+9
-1
@@ -1,6 +1,6 @@
1
# Passive journal centralization with encryption using self-signed certificates
2
3
-This page will guide you through creating a passive journal centralization setup using self-signed certificates for encryption.
3
+This page will guide you through creating a passive journal centralization setup using self-signed certificates for encryption and authorization.
4
5
A _passive_ journal server waits for clients to push their metrics to it, so in this setup we will:
6
@@ -8,6 +8,14 @@ A _passive_ journal server waits for clients to push their metrics to it, so in
8
2. configure `systemd-journal-remote` on the server, to listen for incoming connections.
9
3. configure `systemd-journal-upload` on the clients, to push their logs to the server.
10
11
+Keep in mind that the authorization involved works like this:
12
+
13
+1. The server (`systemd-journal-remote`) validates that the sender (`systemd-journal-upload`) uses a trusted certificate (a certificate issued by the same certificate authority as its own).
14
+ So, **the server will accept logs from any client having a trusted certificate**.
15
+2. The client (`systemd-journal-upload`) validates that the receiver (`systemd-journal-remote`) uses a trusted certificate (like the server does) and it also checks that the hostname of the URL specified to its configuration, matches one of the names of the server it gets connected to. So, the client does a validation that it connected to the right server, using the URL hostname against the names of the server on its certificate.
16
+
17
+This means, that if both certificates are issued by the same certificate authority, only the client can potentially reject the server.
18
+
19
## Self-signed certificates
20
21
Use [this script](https://gist.github.com/ktsaou/d62b8a6501cf9a0da94f03cbbb71c5c7) to create a self-signed certificates authority and certificates for all your servers.