Re: [Syslog] Some revised text for syslog TLS

Martin Schütte <lists@mschuette.name> Thu, 29 May 2008 21:34 UTC

Return-Path: <syslog-bounces@ietf.org>
X-Original-To: syslog-archive@megatron.ietf.org
Delivered-To: ietfarch-syslog-archive@core3.amsl.com
Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D7C413A69B8; Thu, 29 May 2008 14:34:07 -0700 (PDT)
X-Original-To: syslog@core3.amsl.com
Delivered-To: syslog@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 73A443A69B8 for <syslog@core3.amsl.com>; Thu, 29 May 2008 14:34:06 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.949
X-Spam-Level:
X-Spam-Status: No, score=-1.949 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_EQ_DE=0.35, MIME_8BIT_HEADER=0.3]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VppXnMHWdIrL for <syslog@core3.amsl.com>; Thu, 29 May 2008 14:34:05 -0700 (PDT)
Received: from mail.asta.uni-potsdam.de (mail.asta.uni-potsdam.de [141.89.58.198]) by core3.amsl.com (Postfix) with ESMTP id E8DEB3A6BCA for <syslog@ietf.org>; Thu, 29 May 2008 14:34:03 -0700 (PDT)
Received: from localhost (mail.asta.uni-potsdam.de [141.89.58.198]) by mail.asta.uni-potsdam.de (Postfix) with ESMTP id EB7B51E6A78 for <syslog@ietf.org>; Thu, 29 May 2008 23:34:01 +0200 (CEST)
X-Virus-Scanned: on mail at asta.uni-potsdam.de
Received: from mail.asta.uni-potsdam.de ([141.89.58.198]) by localhost (mail.asta.uni-potsdam.de [141.89.58.198]) (amavisd-new, port 10024) with ESMTP id BrFi5e1DKbFk for <syslog@ietf.org>; Thu, 29 May 2008 23:33:50 +0200 (CEST)
Received: from [192.168.178.21] (BAA0909.baa.pppool.de [77.128.9.9]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "Martin Schuette", Issuer "AStA-CA" (verified OK)) by mail.asta.uni-potsdam.de (Postfix) with ESMTP id 67CDC1E6A74 for <syslog@ietf.org>; Thu, 29 May 2008 23:33:48 +0200 (CEST)
Message-ID: <483F213E.8060101@mschuette.name>
Date: Thu, 29 May 2008 23:33:50 +0200
From: Martin Schütte <lists@mschuette.name>
User-Agent: Thunderbird 2.0.0.14 (X11/20080511)
MIME-Version: 1.0
To: syslog@ietf.org
References: <AC1CFD94F59A264488DC2BEC3E890DE505DFD90C@xmb-sjc-225.amer.cisco.com> <577465F99B41C842AAFBE9ED71E70ABA309093@grfint2.intern.adiscon.com> <1696498986EFEC4D9153717DA325CB72B36A0B@vaebe104.NOE.Nokia.com>
In-Reply-To: <1696498986EFEC4D9153717DA325CB72B36A0B@vaebe104.NOE.Nokia.com>
Subject: Re: [Syslog] Some revised text for syslog TLS
X-BeenThere: syslog@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Security Issues in Network Event Logging <syslog.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/syslog>, <mailto:syslog-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/pipermail/syslog>
List-Post: <mailto:syslog@ietf.org>
List-Help: <mailto:syslog-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/syslog>, <mailto:syslog-request@ietf.org?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: syslog-bounces@ietf.org
Errors-To: syslog-bounces@ietf.org

Pasi.Eronen@nokia.com schrieb:
> AFAIK certificates containing IP addresses are quite rare; host names
> are much common.  To support such situation -- while still avoiding
> dependency on DNS -- it would be useful if you could configure the IP
> address (used for opening the connection) and server name (compared
> against the certificate, but not looked up from DNS) separately.

Having the iPAddress inside the certificate solves this nicely, without 
additional configuration.

> I don't know what that would look like in your configuration file
> syntax, but maybe something like
> *.* @@192.0.2.1[syslogsrv2.example.com]

One question here: Why is it required to use hostnames only insted of 
the Distinguished Name of the certificate?

-- 
Martin
_______________________________________________
Syslog mailing list
Syslog@ietf.org
https://www.ietf.org/mailman/listinfo/syslog