Re: [Syslog] Some revised text for syslog TLS

Rainer Gerhards wrote:

> Please keep in mind that my message was related to the question if
> there is a use case for using IPs inside a certificate. As I said
> above, there is.

Ok. Do you think this use case is important enough to keep this
feature (checking IPAddress subjectAltName) as part of the "MUST
implement" baseline?

(Joe's latest text already has other forms of name comparison as
optional: "Implementations MAY also support authorization based on
other attributes.  For example, the authorization of a device Serial
Number against the SerialNumber portion of the Subject Distinguished
Name [...]")

> > To support such situation -- while still avoiding dependency on
> > DNS -- it would be useful if you could configure the IP address
> > (used for opening the connection) and server name (compared
> > against the certificate, but not looked up from DNS) separately.
> > 
> > I don't know what that would look like in your configuration file
> > syntax, but maybe something like
> > 
> > *.* @@192.0.2.1[syslogsrv2.example.com]
> 
> rsyslog of course supports this. The actual syntax is:
> 
> $ActionSendStreamDriverAuthMode x509/name # soon to be default
> $ActionSendStreamDriverPermittedPeer syslogsrv2.example.com
> *.* @@192.0.2.1

Ok, good to know.

Best regards,
Pasi
_______________________________________________
Syslog mailing list
Syslog@ietf.org
https://www.ietf.org/mailman/listinfo/syslog