Skip to content

Commit 44698c5

Browse files
committed
Updating transport security for style and gramamr
Signed-off-by: Lynette Miles <[email protected]>
1 parent e4f6a3e commit 44698c5

File tree

1 file changed

+107
-88
lines changed

1 file changed

+107
-88
lines changed

administration/transport-security.md

Lines changed: 107 additions & 88 deletions
Original file line numberDiff line numberDiff line change
@@ -1,85 +1,93 @@
11

22
# Transport Security
33

4-
Fluent Bit provides integrated support for _Transport Layer Security_ \(TLS\) and it predecessor _Secure Sockets Layer_ \(SSL\) respectively. In this section we will refer as TLS only for both implementations.
4+
Fluent Bit provides integrated support for Transport Layer Security (TLS) and
5+
it predecessors Secure Sockets Layer (SSL) respectively. This section refers only
6+
to TLS for both implementations.
57

6-
Both input and output plugins that perform Network I/O can optionally enable TLS and configure the behavior. The following table describes the properties available:
8+
Both input and output plugins that perform Network I/O can optionally enable TLS and
9+
configure the behavior. The following table describes the properties available:
710

811
| Property | Description | Default |
912
| :--- | :--- | :--- |
10-
| tls | enable or disable TLS support | Off |
11-
| tls.verify | force certificate validation | On |
12-
| tls.verify\_hostname | force TLS verification of hostnames | Off |
13-
| tls.debug | Set TLS debug verbosity level. It accept the following values: 0 \(No debug\), 1 \(Error\), 2 \(State change\), 3 \(Informational\) and 4 Verbose | 1 |
14-
| tls.ca\_file | absolute path to CA certificate file | |
15-
| tls.ca\_path | absolute path to scan for certificate files | |
16-
| tls.crt\_file | absolute path to Certificate file | |
17-
| tls.key\_file | absolute path to private Key file | |
18-
| tls.key\_passwd | optional password for tls.key\_file file | |
19-
| tls.vhost | hostname to be used for TLS SNI extension | |
20-
21-
*Note : in order to use TLS on input plugins the user is expected to provide both a certificate and private key*
22-
23-
The listed properties can be enabled in the configuration file, specifically on each output plugin section or directly through the command line.
13+
| `tls` | Enable or disable TLS support | `Off` |
14+
| `tls.verify` | Force certificate validation | `On` |
15+
| `tls.verify_hostname` | Force TLS verification of host names | `Off` |
16+
| `tls.debug` | Set TLS debug verbosity level. Accepted values: `0` (No debug), `1` (Error), `2` (State change), `3` (Informational) and `4` (Verbose) | `1` |
17+
| `tls.ca_file` | Absolute path to CA certificate file | _none_ |
18+
| `tls.ca_path` | Absolute path to scan for certificate files | _none_ |
19+
| `tls.crt_file` | Absolute path to Certificate file | _none_ |
20+
| `tls.key_file` | Absolute path to private Key file | _none_ |
21+
| `tls.key_passwd` | Optional password for `tls.key_file` file | _none_ |
22+
| `tls.vhost` | Hostname to be used for TLS SNI extension | _none_ |
23+
24+
To use TLS on input plugins, the user is expected to provide both a certificate and
25+
private key.
26+
27+
The listed properties can be enabled in the configuration file, specifically in each
28+
output plugin section or directly through the command line.
2429

2530
The following **output** plugins can take advantage of the TLS feature:
2631

27-
* [Amazon S3](../pipeline/outputs/s3.md)
28-
* [Apache SkyWalking](../pipeline/outputs/skywalking.md)
29-
* [Azure](../pipeline/outputs/azure.md)
30-
* [Azure Blob](../pipeline/outputs/azure_blob.md)
31-
* [Azure Data Explorer (Kusto)](../pipeline/outputs/azure_kusto.md)
32-
* [Azure Logs Ingestion API](../pipeline/outputs/azure_logs_ingestion.md)
33-
* [BigQuery](../pipeline/outputs/bigquery.md)
34-
* [Dash0](../pipeline/outputs/dash0.md)
35-
* [Datadog](../pipeline/outputs/datadog.md)
36-
* [Elasticsearch](../pipeline/outputs/elasticsearch.md)
37-
* [Forward](../pipeline/outputs/forward.md)
38-
* [GELF](../pipeline/outputs/gelf.md)
39-
* [Google Chronicle](../pipeline/outputs/chronicle.md)
40-
* [HTTP](../pipeline/outputs/http.md)
41-
* [InfluxDB](../pipeline/outputs/influxdb.md)
42-
* [Kafka REST Proxy](../pipeline/outputs/kafka-rest-proxy.md)
43-
* [LogDNA](../pipeline/outputs/logdna.md)
44-
* [Loki](../pipeline/outputs/loki.md)
45-
* [New Relic](../pipeline/outputs/new-relic.md)
46-
* [OpenSearch](../pipeline/outputs/opensearch.md)
47-
* [OpenTelemetry](../pipeline/outputs/opentelemetry.md)
48-
* [Oracle Cloud Infrastructure Logging Analytics](../pipeline/outputs/oci-logging-analytics.md)
49-
* [Prometheus Remote Write](../pipeline/outputs/prometheus-remote-write.md)
50-
* [Slack](../pipeline/outputs/slack.md)
51-
* [Splunk](../pipeline/outputs/splunk.md)
52-
* [Stackdriver](../pipeline/outputs/stackdriver.md)
53-
* [Syslog](../pipeline/outputs/syslog.md)
54-
* [TCP & TLS](../pipeline/outputs/tcp-and-tls.md)
55-
* [Treasure Data](../pipeline/outputs/treasure-data.md)
56-
* [WebSocket](../pipeline/outputs/websocket.md)
32+
- [Amazon S3](../pipeline/outputs/s3.md)
33+
- [Apache SkyWalking](../pipeline/outputs/skywalking.md)
34+
- [Azure](../pipeline/outputs/azure.md)
35+
- [Azure Blob](../pipeline/outputs/azure_blob.md)
36+
- [Azure Data Explorer (Kusto)](../pipeline/outputs/azure_kusto.md)
37+
- [Azure Logs Ingestion API](../pipeline/outputs/azure_logs_ingestion.md)
38+
- [BigQuery](../pipeline/outputs/bigquery.md)
39+
- [Dash0](../pipeline/outputs/dash0.md)
40+
- [Datadog](../pipeline/outputs/datadog.md)
41+
- [Elasticsearch](../pipeline/outputs/elasticsearch.md)
42+
- [Forward](../pipeline/outputs/forward.md)
43+
- [GELF](../pipeline/outputs/gelf.md)
44+
- [Google Chronicle](../pipeline/outputs/chronicle.md)
45+
- [HTTP](../pipeline/outputs/http.md)
46+
- [InfluxDB](../pipeline/outputs/influxdb.md)
47+
- [Kafka REST Proxy](../pipeline/outputs/kafka-rest-proxy.md)
48+
- [LogDNA](../pipeline/outputs/logdna.md)
49+
- [Loki](../pipeline/outputs/loki.md)
50+
- [New Relic](../pipeline/outputs/new-relic.md)
51+
- [OpenSearch](../pipeline/outputs/opensearch.md)
52+
- [OpenTelemetry](../pipeline/outputs/opentelemetry.md)
53+
- [Oracle Cloud Infrastructure Logging Analytics](../pipeline/outputs/oci-logging-analytics.md)
54+
- [Prometheus Remote Write](../pipeline/outputs/prometheus-remote-write.md)
55+
- [Slack](../pipeline/outputs/slack.md)
56+
- [Splunk](../pipeline/outputs/splunk.md)
57+
- [Stackdriver](../pipeline/outputs/stackdriver.md)
58+
- [Syslog](../pipeline/outputs/syslog.md)
59+
- [TCP & TLS](../pipeline/outputs/tcp-and-tls.md)
60+
- [Treasure Data](../pipeline/outputs/treasure-data.md)
61+
- [WebSocket](../pipeline/outputs/websocket.md)
5762

5863
The following **input** plugins can take advantage of the TLS feature:
5964

60-
* [Docker Events](../pipeline/inputs/docker-events.md)
61-
* [Elasticsearch (Bulk API)](../pipeline/inputs/elasticsearch.md)
62-
* [Forward](../pipeline/inputs/forward.md)
63-
* [Health](../pipeline/inputs/health.md)
64-
* [HTTP](../pipeline/inputs/http.md)
65-
* [Kubernetes Events](../pipeline/inputs/kubernetes-events.md)
66-
* [MQTT](../pipeline/inputs/mqtt.md)
67-
* [NGINX Exporter Metrics](../pipeline/inputs/nginx.md)
68-
* [OpenTelemetry](../pipeline/inputs/opentelemetry.md)
69-
* [Prometheus Scrape Metrics](../pipeline/inputs/prometheus-scrape-metrics.md)
70-
* [Prometheus Remote Write](../pipeline/inputs/prometheus-remote-write.md)
71-
* [Splunk (HTTP HEC)](../pipeline/inputs/splunk.md)
72-
* [Syslog](../pipeline/inputs/syslog.md)
73-
* [TCP](../pipeline/inputs/tcp.md)
74-
75-
In addition, other plugins implements a sub-set of TLS support, meaning, with restricted configuration:
76-
77-
* [Kubernetes Filter](../pipeline/filters/kubernetes.md)
65+
- [Docker Events](../pipeline/inputs/docker-events.md)
66+
- [Elasticsearch (Bulk API)](../pipeline/inputs/elasticsearch.md)
67+
- [Forward](../pipeline/inputs/forward.md)
68+
- [Health](../pipeline/inputs/health.md)
69+
- [HTTP](../pipeline/inputs/http.md)
70+
- [Kubernetes Events](../pipeline/inputs/kubernetes-events.md)
71+
- [MQTT](../pipeline/inputs/mqtt.md)
72+
- [NGINX Exporter Metrics](../pipeline/inputs/nginx.md)
73+
- [OpenTelemetry](../pipeline/inputs/opentelemetry.md)
74+
- [Prometheus Scrape Metrics](../pipeline/inputs/prometheus-scrape-metrics.md)
75+
- [Prometheus Remote Write](../pipeline/inputs/prometheus-remote-write.md)
76+
- [Splunk (HTTP HEC)](../pipeline/inputs/splunk.md)
77+
- [Syslog](../pipeline/inputs/syslog.md)
78+
- [TCP](../pipeline/inputs/tcp.md)
79+
80+
In addition, other plugins implement a sub-set of TLS support, with
81+
restricted configuration:
82+
83+
- [Kubernetes Filter](../pipeline/filters/kubernetes.md)
7884

7985
## Example: enable TLS on HTTP input
80-
By default HTTP input plugin uses plain TCP, enabling TLS from the command line can be done with:
8186

82-
```text
87+
By default HTTP input plugin uses plain TCP, enabling TLS from the command line can
88+
be done using the following command:
89+
90+
```bash
8391
./bin/fluent-bit -i http \
8492
-p port=9999 \
8593
-p tls=on \
@@ -90,11 +98,13 @@ By default HTTP input plugin uses plain TCP, enabling TLS from the command line
9098
-m '*'
9199
```
92100

93-
In the command line above, the two properties _tls_ and _tls.verify_ where enabled for demonstration purposes \(we strongly suggest always keep verification ON\).
101+
In the previous command, the two properties `tls` and `tls.verify` are set
102+
for demonstration purposes. It's strongly suggested to always keep verification
103+
on.
94104

95105
The same behavior can be accomplished using a configuration file:
96106

97-
```text
107+
```python
98108
[INPUT]
99109
name http
100110
port 9999
@@ -110,20 +120,22 @@ The same behavior can be accomplished using a configuration file:
110120

111121
## Example: enable TLS on HTTP output
112122

113-
By default HTTP output plugin uses plain TCP, enabling TLS from the command line can be done with:
123+
By default HTTP output plugin uses plain TCP, enabling TLS from the command line can
124+
be done with:
114125

115-
```text
116-
$ fluent-bit -i cpu -t cpu -o http://192.168.2.3:80/something \
126+
```bash
127+
fluent-bit -i cpu -t cpu -o http://192.168.2.3:80/something \
117128
-p tls=on \
118129
-p tls.verify=off \
119130
-m '*'
120131
```
121132

122-
In the command line above, the two properties _tls_ and _tls.verify_ where enabled for demonstration purposes \(we strongly suggest always keep verification ON\).
133+
In the previous command, the properties `tls` and `tls.verify` are enabled
134+
for demonstration purposes. Verification should always be on.
123135

124136
The same behavior can be accomplished using a configuration file:
125137

126-
```text
138+
```python
127139
[INPUT]
128140
Name cpu
129141
Tag cpu
@@ -140,11 +152,14 @@ The same behavior can be accomplished using a configuration file:
140152

141153
## Tips and Tricks
142154

143-
### Generate your own self signed certificates for testing purposes.
155+
### Generate a self signed certificates for testing purposes
144156

145-
This will generate a 4096 bit RSA key pair and a certificate that is signed using SHA-256 with the expiration date set to 30 days in the future, `test.host.net` set as common name and since we opted out of `DES` the private key will be stored in plain text.
157+
This will generate a 4096 bit RSA key pair and a certificate that's signed using
158+
`SHA-256` with the expiration date set to 30 days in the future. In this example,
159+
`test.host.net` set as common name. This example opts out of `DES`, so the private
160+
key will be stored in plain text.
146161

147-
```
162+
```bash
148163
openssl req -x509 \
149164
-newkey rsa:4096 \
150165
-sha256 \
@@ -156,9 +171,12 @@ openssl req -x509 \
156171

157172
### Connect to virtual servers using TLS
158173

159-
Fluent Bit supports [TLS server name indication](https://en.wikipedia.org/wiki/Server_Name_Indication). If you are serving multiple hostnames on a single IP address \(a.k.a. virtual hosting\), you can make use of `tls.vhost` to connect to a specific hostname.
174+
Fluent Bit supports
175+
[TLS server name indication](https://en.wikipedia.org/wiki/Server_Name_Indication).
176+
If you are serving multiple host names on a single IP address (for example, using
177+
virtual hosting), you can make use of `tls.vhost` to connect to a specific hostname.
160178

161-
```text
179+
```python
162180
[INPUT]
163181
Name cpu
164182
Tag cpu
@@ -174,22 +192,23 @@ Fluent Bit supports [TLS server name indication](https://en.wikipedia.org/wiki/S
174192
tls.vhost fluent.example.com
175193
```
176194

177-
### Verify subjectAltName
195+
### Verify `subjectAltName`
178196

179-
By default, TLS verification of hostnames is not done automatically.
180-
As an example, we can extract the X509v3 Subject Alternative Name from a certificate:
197+
By default, TLS verification of host names isn't done automatically.
198+
As an example, you can extract the X509v3 Subject Alternative Name from a certificate:
181199

182-
```
200+
```text
183201
X509v3 Subject Alternative Name:
184202
DNS:my.fluent-aggregator.net
185203
```
186204

187-
As you can see, this certificate covers only `my.fluent-aggregator.net` so if we use a different hostname it should fail.
188-
189-
To fully verify the alternative name and demonstrate the failure we enable `tls.verify_hostname`:
205+
This certificate covers only `my.fluent-aggregator.net` so if you use a different
206+
hostname it should fail.
190207

208+
To fully verify the alternative name and demonstrate the failure, enable
209+
`tls.verify_hostname`:
191210

192-
```text
211+
```python
193212
[INPUT]
194213
Name cpu
195214
Tag cpu
@@ -205,9 +224,9 @@ To fully verify the alternative name and demonstrate the failure we enable `tls.
205224
tls.ca_file /path/to/fluent-x509v3-alt-name.crt
206225
```
207226

208-
This outgoing connect will be failed and disconnected:
227+
This outgoing connect will fail and disconnect:
209228

210-
```
229+
```text
211230
[2024/06/17 16:51:31] [error] [tls] error: unexpected EOF with reason: certificate verify failed
212231
[2024/06/17 16:51:31] [debug] [upstream] connection #50 failed to other.fluent-aggregator.net:24224
213232
[2024/06/17 16:51:31] [error] [output:forward:forward.0] no upstream connections available

0 commit comments

Comments
 (0)