Logstash security

久未见 提交于 2019-12-13 05:38:15

问题


I am wondering if it is possible to implement something like mutual handshake authorization between logstash and logstash-forwarder?

At the moment, I know that logstash provides ssl certificates for security, but I am not sure if this is the best way to protect my logs flow.

The certificates are not safe enough in my case. If they will get stolen then you are in danger.. Looking for something else that may help. Thanks!


回答1:


The Logstash forwarder project has been deprecated in favor of the Filebeat project.

Generally, you should now prefer using Filebeat over Logstash forwarder. Moreover, Filebeat allows you to set up TLS client authentication, which is what you're after.




回答2:


Well, seems like I was looking for mutual authentication between LSF (or FileBeat) and Logstash.

Here is what I found - there is an open issue, while it is opened, the problem is not solved.

Here is some discussion on this topic:

filebeat has same support as logstash-forwarder used to have, plus some more fine-grained TLS configs (e.g. choose TLS version or configure ciphers). Connection can encrypted via TLS + server certificated is validated. Filebeat itself supports TLS client-auth, BUT logstash must enforce (ask for certificate) client authentication, which is not implemented yet (see github issue).



来源:https://stackoverflow.com/questions/35143503/logstash-security

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!