Update passive_journal_centralization_guide_self_signed_certs.md
Costa Tsaousis committed
Oct 20, 2023 at 11:15 UTC
7fa8db4b9deeff39a8ff4702e7917d5d14507332
1 file changed
+9
-9
collectors/systemd-journal.plugin/passive_journal_centralization_guide_self_signed_certs.md
+9
-9
@@ -54,17 +54,17 @@ Repeat this process to create the certificates for all your servers. You can add
54
55
Existing certificates are never re-generated. Typically certificates need to be revoked and new ones to be issued. But `systemd-journal-remote` tools do not support handling revocations. So, the only option you have to re-issue a certificate is to delete its files in `/etc/ssl/systemd-journal` and run the script again to create a new one.
56
57
-In `/etc/ssl/systemd-journal` you will find shell scripts named `runme-on-XXX.sh`, where `XXX` are the canonical names of your servers.
57
+Once you run the script of each of your servers, in `/etc/ssl/systemd-journal` you will find shell scripts named `runme-on-XXX.sh`, where `XXX` are the canonical names of your servers.
58
59
These `runme-on-XXX.sh` include everything to install the certificates, fix their file permissions to be accessible by `systemd-journal-remote` and `systemd-journal-upload`, and update `/etc/systemd/journal-remote.conf` and `/etc/systemd/journal-upload.conf`.
60
61
You can copy and paste (or `scp`) these scripts on your server and each of your clients:
62
63
```bash
64
-sudo scp /etc/ssl/systemd-journal-remote/runme-on-XXX.sh XXX:/tmp/
64
+sudo scp /etc/ssl/systemd-journal/runme-on-XXX.sh XXX:/tmp/
65
```
66
67
-So, for the moment make sure that you have the right `runme-on-XXX.sh` at the `/tmp` of all the servers for which you created certificates.
67
+For the rest of this guide, we assume that you have copied the right `runme-on-XXX.sh` at the `/tmp` of all the servers for which you issued certificates.
68
69
### note about certificates file permissions
70
@@ -137,7 +137,7 @@ sudo systemctl enable systemd-journal-remote.service
137
138
`systemd-journal-remote` is now listening for incoming journals from remote hosts.
139
140
-> Remember to delete `/tmp/runme-on-XXX.sh` to make sure your certificates are secure.
140
+> When done, remember to `rm /tmp/runme-on-*.sh` to make sure your certificates are secure.
141
142
## Client configuration
143
@@ -155,9 +155,9 @@ Edit `/etc/systemd/journal-upload.conf` and set the IP address and the port of t
155
URL=https://centralization.server.ip:19532
156
```
157
158
-Make sure that `centralization.server.ip` is one of the `DNS:` or `IP:` parameters you defined when you created the centralization server certificates.
158
+Make sure that `centralization.server.ip` is one of the `DNS:` or `IP:` parameters you defined when you created the centralization server certificates. If it is not, the client may reject to connect.
159
160
-Edit `systemd-journal-upload.service`, and add `Restart=always` to make sure the client will keep trying to push logs, even if the server is temporarily not there, like this:
160
+Next, edit `systemd-journal-upload.service`, and add `Restart=always` to make sure the client will keep trying to push logs, even if the server is temporarily not there, like this:
161
162
```bash
163
sudo systemctl edit systemd-journal-upload.service
@@ -170,7 +170,7 @@ At the top, add:
170
Restart=always
171
```
172
173
-Enable and start `systemd-journal-upload.service`, like this:
173
+Enable `systemd-journal-upload.service`, like this:
174
175
```bash
176
sudo systemctl enable systemd-journal-upload.service
@@ -192,7 +192,7 @@ sudo systemctl restart systemd-journal-upload.service
192
193
The client should now be pushing logs to the central server.
194
195
-> Remember to delete `/tmp/runme-on-XXX.sh` to make sure your certificates are secure.
195
+> When done, remember to `rm /tmp/runme-on-*.sh` to make sure your certificates are secure.
196
197
Here it is in action, in Netdata:
198
@@ -207,7 +207,7 @@ To verify the central server is receiving logs, run this on the central server:
207
sudo ls -l /var/log/journal/remote/
208
```
209
210
-You should see new files from the client's canonical names (CN). These are names on the clients' certificates.
210
+Depending on the `systemd` version you use, you should see new files from the clients' canonical names (as defined at their certificates) or IPs.
211
212
Also, `systemctl status systemd-journal-remote` should show something like this:
213