Question
Foritgate Syslog to Ubuntu gives "Decode error" and "No supported cipher suites have been found"
I am trying to send Traffic Syslog encrypted from Fortigate firewall to Rsyslog on Ubuntu server.
I have managed to do this for other Clients, however one of my latest Client gets an error saying
"Decode error" in traffic dump and "No supported cipher suites have been found" in Rsyslog logs.
The certificate is uploaded to the Fortigate firewall at System > Certificates > CA Certificate (rootCA_ip.pem+key.pem).
Tcdump Decode Error from Ubuntu Server:
RSYSLOG error logs on Ubuntu Server:
rsyslogd: tcpsrv listener (inputname: 'imtcp') failed to process incoming connection with error -2083
gnutls returned error on handshake: No supported cipher suites have been found.
tcpsrv listener (inputname: 'imtcp') failed to process incoming connection with error -2083
Generate Certificates:
The Ubuntu server is hosted at Google Cloud and it generates root certificates during creation with a Startup Script:
# -------- VARIABLES -------------------------------------------------------------------------- echo "--- VARIABLES ---" CUSTOMER_NAME="Development" # CHANGE ME # -------- GENERATE ROOT CERTIFICATE ------------------------------------------------------------ echo "--- GENERATE ROOT CERTIFICATE ---" mkdir /opt/certs cd /opt/certs my_ip=`curl -s ifconfig.me` # Generate password rm -f /opt/certs/password.txt certificate_password=`pwgen 14 1` echo "$certificate_password" | tee -a /opt/certs/password.txt # Generate Certificate :: rootCA touch /opt/certs/rootCA_openssl.cnf # Generate Certificate :: rootCA :: Contents root_ca_contents="[ req ] distinguished_name = req_distinguished_name req_extensions = v3_req prompt = no [ req_distinguished_name ] countryName = NO stateOrProvinceName = Oslo organizationName = $CUSTOMER_NAME commonName = $CUSTOMER_NAME Root CA $my_ip [ v3_req ] basicConstraints = CA:true keyUsage = critical, keyCertSign" # Generate Certificate :: rootCA :: Put service to file echo "$root_ca_contents" | tee -a /opt/certs/rootCA_openssl.cnf # -------- GENERATE SERVER CERTIFICATE ------------------------------------------------------------ echo "--- GENERATE SERVER CERTIFICATE ---" # Generate Certificate :: Server touch /opt/certs/server_openssl.cnf # Generate Certificate :: Server :: Contents server_contents="[ req ] distinguished_name = req_distinguished_name req_extensions = v3_req prompt = no [ req_distinguished_name ] countryName = NO stateOrProvinceName = Oslo localityName = Oslo organizationName = $CUSTOMER_NAME commonName = $my_ip [ v3_req ] basicConstraints = CA:FALSE keyUsage = nonRepudiation, digitalSignature, keyEncipherment subjectAltName = @AlT _names [ alt_names ] IP.1 = $my_ip" # Generate Certificate :: Server :: Put service to file echo "$server_contents" | tee -a /opt/certs/server_openssl.cnf # -------- GENERATE CERTIFICATE SCRIPT --------------------------------------------------- echo "--- GENERATE CERTIFICATE SCRIPT ---" # Generate Certificate Script touch /opt/certs/generate_certificates.sh certificate_script="#!/bin/bash # Variables echo \"VARIABLES\" my_ip=\$(curl -s ifconfig.me) certificate_password=\$(cat /opt/certs/password.txt) date_ymd=\$(date +\"%Y-%m-%d\") customer_abbreviation=$CUSTOMER_ABBREVIATION hostname=\$(hostname) os_id=\$(lsb_release -is) os_version=\$(lsb_release -sr) # CD cd /opt/certs # Root CA echo \"ROOT CA\" # Root CA :: generating a new RSA private key openssl genrsa -aes256 -out rootCA_\$my_ip.key --passout pass:\$certificate_password 2048 # Root CA :: Certificate Signing Request (CSR) openssl req -new -key rootCA_\$my_ip.key -out rootCA_\$my_ip.csr -config rootCA_openssl.cnf --passin pass:\$certificate_password # Root CA :: Create a self-signed X.509 certificate from a Certificate Signing Request (CSR) openssl x509 -req -in rootCA_\$my_ip.csr -sha512 -signkey rootCA_\$my_ip.key -out rootCA_\$my_ip.pem -days 364 -extensions v3_req -extfile rootCA_openssl.cnf --passin pass:\$certificate_password # Root CA :: Remove the passphrase from an RSA private key openssl rsa -in rootCA_\$my_ip.key -out rootCA_\$my_ip.nopass.key --passin pass:\$certificate_password # Root CA :: Convert the PEM files to CRT openssl x509 -in rootCA_\$my_ip.pem -out rootCA_\$my_ip.crt # Root CA :: Combine the no-password private key and the certificate into one file cat rootCA_\$my_ip.nopass.key rootCA_\$my_ip.pem > rootCA_\$my_ip.nopass.pem+key.pem # Root CA :: Combine the password private key and the certificate into one file cat rootCA_\$my_ip.key rootCA_\$my_ip.pem > rootCA_\$my_ip.pem+key.pem # Server CA echo \"SERVER CA\" openssl genrsa -aes256 -out server_\$my_ip.key --passout pass:\$certificate_password 2048 openssl req -new -key server_\$my_ip.key -out server_\$my_ip.csr -config server_openssl.cnf --passin pass:\$certificate_password openssl x509 -req -in server_\$my_ip.csr -sha256 -CA rootCA_\$my_ip.pem -CAkey rootCA_\$my_ip.key -out server_\$my_ip.pem -days 364 -extensions v3_req -extfile server_openssl.cnf --passin pass:\$certificate_password openssl rsa -in server_\$my_ip.key -out server_\$my_ip.nopass.key --passin pass:\$certificate_password # Convert the PEM files to CRT openssl x509 -in server_\$my_ip.pem -out server_\$my_ip.crt # Verify echo \"VERIFY\" openssl verify -verbose -CAfile rootCA_\$my_ip.pem server_\$my_ip.pem # Copy certificates to /etc/ssl/certs/ so we can use them with rsyslog cp rootCA_\$my_ip.nopass.pem+key.pem /etc/ssl/certs/rootCA_\$my_ip.nopass.pem+key.pem cp rootCA_\$my_ip.crt /etc/ssl/certs/rootCA_\$my_ip.crt cp server_\$my_ip.nopass.key /etc/ssl/certs/server_\$my_ip.nopass.key cp server_\$my_ip.pem /etc/ssl/certs/server_\$my_ip.pem cp server_\$my_ip.crt /etc/ssl/certs/server_\$my_ip.crt chmod 644 rootCA_\$my_ip.nopass.pem+key.pem /etc/ssl/certs/rootCA_\$my_ip.nopass.pem+key.pem chmod 644 rootCA_\$my_ip.crt /etc/ssl/certs/rootCA_\$my_ip.crt chmod 644 server_\$my_ip.nopass.key /etc/ssl/certs/server_\$my_ip.nopass.key chmod 644 server_\$my_ip.pem /etc/ssl/certs/server_\$my_ip.pem chmod 644 server_\$my_ip.crt /etc/ssl/certs/server_\$my_ip.crt # Zip echo \"ZIP\" rm -f /opt/certs/cert.zip cd /opt/certs zip \"/opt/certs/cert.zip\" password.txt rootCA_* server_* # Update Certificate store sudo update-ca-certificates " echo "$certificate_script" | tee -a /opt/certs/generate_certificates.sh chmod +x /opt/certs/generate_certificates.sh /opt/certs/generate_certificates.sh
The firewall config looks like this:
config log syslogd3 setting
set status enable
set server "35.2.3.4"
set mode reliable
set port 6514
set enc-algorithm high
end
My Rsyslog config is created at the startup of the Ubuntu server and it looks like this:
# -------- RSYSLOG INSTALL START :: FIREWALL 3 (FORTIGATE FIREWALL) ------------------------------------------ echo "--- RSYSLOG INSTALL START :: FIREWALL 3 (FORTIGATE FIREWALL) ---" # Rsyslog :: Truncate Rsyslog sudo truncate -s 0 /etc/rsyslog.conf # Rsyslog :: Config contents config_content="# /etc/rsyslog.conf global( DefaultNetstreamDriver=\"gtls\" DefaultNetstreamDriverCAFile=\"/etc/ssl/certs/rootCA_$my_ip.nopass.pem+key.pem\" DefaultNetstreamDriverCertFile=\"/etc/ssl/certs/server_$my_ip.pem\" DefaultNetstreamDriverKeyFile=\"/etc/ssl/certs/server_$my_ip.nopass.key\" ) module(load=\"imtcp\" StreamDriver.Name=\"gtls\" StreamDriver.Mode=\"1\" StreamDriver.Authmode=\"anon\") # Define a ruleset for the LimaCharlie Adapter ruleset(name=\"limaCharlieRuleset\") { *.* action( type=\"omfwd\" Target=\"127.0.0.1\" Port=\"514\" Protocol=\"tcp\" ) } # Use the defined ruleset for logs received on port 6514 input(type=\"imtcp\" port=\"6514\" ruleset=\"limaCharlieRuleset\") ################# #### MODULES #### ################# module(load=\"imuxsock\") # provides support for local system logging #module(load=\"immark\") # provides --MARK-- message capability # provides kernel logging support and enable non-kernel klog messages module(load=\"imklog\" permitnonkernelfacility=\"on\") ########################### #### GLOBAL DIRECTIVES #### ########################### # Filter duplicated messages \$RepeatedMsgReduction on # Set the default permissions for all log files. \$FileOwner syslog \$FileGroup adm \$FileCreateMode 0640 \$DirCreateMode 0755 \$Umask 0022 \$PrivDropToUser syslog \$PrivDropToGroup syslog # Where to place spool and state files \$WorkDirectory /var/spool/rsyslog # Include all config files in /etc/rsyslog.d/ \$IncludeConfig /etc/rsyslog.d/*.conf ############################ #### DEFAULT RULES ###### ############################ # Default rules for local logging (you can customize or remove as needed) auth,authpriv.* /var/log/auth.log *.*;auth,authpriv.none -/var/log/syslog kern.* -/var/log/kern.log mail.* -/var/log/mail.log mail.err /var/log/mail.err *.=debug;auth,authpriv.none;news.none;mail.none -/var/log/debug *.=info;*.=notice;*.=warn;auth,authpriv.none;cron.none;daemon.none;mail.none;news.none -/var/log/messages # Emergencies are sent to everybody logged in. *.emerg :omusrmsg:* " # Rsyslog :: :: Put config to file echo "$config_content" | tee /etc/rsyslog.conf # Rsyslog :: Enable service sudo systemctl enable rsyslog sudo systemctl start rsyslog systemctl restart rsyslog
How can I debug the error?