Return
-
Title
Force TLSv1.2 in Syslog-ng PE -
Description
TLS version 1.2 is required for use in logging with Syslog-ng PE. -
Cause
Vulnerabilities exist in version prior to TLS version 1.2. -
Resolution
Currently, TLS version 1.2 is only supported in Syslog-ng PE version 7.
There is a workaround for forcing TLS version 1.2 in Syslog-ng PE version 6, however, this is unsupported.In Version 7 of Syslog-ng PE use the following cipher_suite where the TLS option is defined within the Syslog-ng configuration:
cipher_suite("HIGH:!COMPLEMENTOFDEFAULT:!aNULL:!eNULL:!DHE-RSA-AES128-SHA:!DHE-RSA-AES256-SHA:!ECDHE-RSA-AES128-SHA:!ECDHE-RSA-AES256-SHA:!AES128-SHA:!AES256-SHA")ssl-options(no-sslv2, no-sslv3, no-tlsv1, no-tlsv11)In Version 6 of Syslog-ng PE use one of the following two cipher_suite statements where the TLS option is defined within the Syslog-ng configuration:Possible Solution 1:cipher_suite("TLSv1.2:!LOW:!aNULL:!ADH:!EXPORT:!SSLv2:!SSLv3:!DES:!RC4")Possible Solution 2:cipher_suite("ALL:!LOW:!aNULL:!ADH:!EXPORT:!SSLv2:!SSLv3:!DES:!RC4")