Logstash SSL TCP input

vnovotny98 · September 29, 2022, 8:37am

Hello, first, I am sorry. I don’t know in which category should I post this.

I have logback in my application that sends logs to logstash, I use this logstash in docker: Docker Hub

i want to find something like this: Tcp input plugin | Logstash Reference [8.4] | Elastic
because it communicates with TLS 1.1and I would like to set it only to TLS 1.3 or do you have any other ideas? thanks

vnovotny98 · September 29, 2022, 8:55am

I tried that.
[ERROR][logstash.inputs.tcp ] Unknown setting ‘ssl_supported_protocols’ for tcp

I think it is added in Logstash 8.2

github.com/elastic/logstash

[Meta] Support TLS 1.3

opened 05:08PM - 26 Feb 19 UTC

jsvd

enhancement meta security shortlist

TLS v1.3 is available since Java `8u262-b10` (AdoptOpenJDK) or` 8u261-b12` in th…e Oracle build. https://java.com/en/jre-jdk-cryptoroadmap.html Logstash 7.15/16 ships with Java 11 and 8.0 will even drop support for Java 8 -> TLS v1.3 could be assumed available. This issue intends to track all the work towards being confident that Logstash supports TLS v1.3. --- ### Core - [ ] Secured LS API endpoint should support TLSv1.3 * atm this is [*blocked*](https://github.com/elastic/logstash/issues/13406) by Puma providing 1.3 support under JRuby - [x] using the vendor-ed JDK LS should default to enabling TLSv1.2 and TLSv1.3 in the Java SSL engine --- ### Dependencies - [x] confirm Manticore (Apache HttpClient 4.x) works as expected against TLSv1.3 - [x] JRuby-OpenSSL lacks support for TLSv1.3 (initial support available in 0.12.1) scope unknown -> need to review Ruby OpenSSL + C-OpenSSL changes - [x] extra JOSSL support to be able to select Java cipher names for an SSL context to allow easy `cipher_suites => ...` support for low level plugins such as the tcp input (requested feature) - [x] Puma does not support TLSv1.3 using it's MiniSSL JRuby implementation scope should be relatively simple --- ### Plugins - [x] ES output - https://github.com/logstash-plugins/logstash-output-elasticsearch/pull/1055 - should work out-of-the box against ES when secured or even restricted to 1.3 only * [x] integration tests against ES using `xpack.security.http.ssl.supported_protocols: TLSv1.3` * [x] (optional) support for `ssl_supported_protocols` option (default `=> ['TLSv1.2', 'TLSv1.3']`) would be nice if the naming prefix would align with planned TLS configuration unification - [x] **ES input** - https://github.com/logstash-plugins/logstash-input-elasticsearch/pull/162 - should work out-of-the box against ES when secured or even restricted to 1.3 only * [x] integration tests against ES using `xpack.security.http.ssl.supported_protocols: TLSv1.3` should be working -> ~~testing relies on using the Elasticsearch transport Ruby http adapter (need TLSv1.3 in JOpenSSL)~~ * [ ] ~~(optional) enabled protocol version configuration~~ does not make much sense given only `ca_file` TLS configuration is supported atm - [x] **ES filter** - should work out-of-the box against ES when secured or even restricted to 1.3 only https://github.com/logstash-plugins/logstash-filter-elasticsearch/pull/154 * [x] integration tests against ES using `xpack.security.http.ssl.supported_protocols: TLSv1.3` * [ ] ~~(optional) enabled protocol version configuration~~ does not make much sense given only `ca_file` TLS setting - [x] **HTTP mixin** https://github.com/logstash-plugins/logstash-mixin-http_client/pull/40 - [x] **HTTP output** https://github.com/logstash-plugins/logstash-output-http/pull/131 * [x] (optional) enabled protocol version configuration - [x] **HTTP Poller input** - Manticore based (HTTP mixin) https://github.com/logstash-plugins/logstash-input-http_poller/pull/133 * [x] (optional) enabled protocol version configuration - [x] **HTTP filter** - Manticore based (HTTP mixin) https://github.com/logstash-plugins/logstash-filter-http/pull/38 * [x] (optional) enabled protocol version configuration - [x] **TCP input** - Netty based for server mode, JOpenSSL in client mode (blocked by JRuby-OpenSSL 1.3 support) https://github.com/logstash-plugins/logstash-input-tcp/pull/198 * [x] need a new configuration option e.g. `ssl_supported_protocols` * [x] ~~plugin is lacking TLS tests~~ * [x] support for configuring TLS `ssl_cipher_suites` - [x] **HTTP input** https://github.com/logstash-plugins/logstash-input-http/pull/146 * [x] expose TLSv1.3 in min/max version configuration (consider deprecating the min/max options) * [x] new configuration option (`ssl_supported_protocols`) in favor of `tls_min_version` / `tls_max_version` https://github.com/logstash-plugins/logstash-input-http/pull/151 * [x] plugin is lacking TLS tests (testing depends on Manticore) - [x] **TCP output** - using JOpenSSL (blocked by JRuby-OpenSSL TLS 1.3 support) https://github.com/logstash-plugins/logstash-output-tcp/pull/47 * [x] need a new configuration option * [x] TLSv1.3 testing * [x] (extra) ~~support for configuring TLS cipher_suites (similar to Beats input)~~ - [x] **Beats input** - Netty based - does only enable TLS 1.2 review plugin for TLS 1.3 https://github.com/logstash-plugins/logstash-input-beats/pull/447 * [x] need a new configuration option `ssl_supported_protocols` (Beats naming `ssl.supported_protocols`) https://github.com/logstash-plugins/logstash-input-beats/pull/450 * [x] `cipher_suites` setting should account for TLS 1.3 suite names * [x] ~~consider abandoning the `cipher_suites` default on recent LS (Java >= 11) to rely on Java defaults~~ * [x] TLS 1.3 (integration) testing

Will this be included in any Logstash OSS with OpenSearch Output Plugin

vnovotny98 · September 29, 2022, 9:04am

Okay, after quick searching I must say this works. Docker Hub
And it can push data to Opensearch 1 as well, nice

Topic		Replies	Views
Logstash to Logstash configuration OpenSearch feature-request	7	561	December 19, 2023
OpenSearch Dashboards support for TLS1.3 Security security-issue	3	551	October 3, 2022
Integrate Logstash or fluentd with Open Distro for Elasticsearch Open Source Elasticsearch and Kibana troubleshoot , configure	4	2425	January 13, 2022
Issue with Kibana -> ElasticSearch / TLSv1.3 " Protocol TLSv1.3 is not supported." Security	4	1899	May 14, 2019
Opensearch 2.3 and logstash 8.4: elastic common schema? OpenSearch configure	4	996	October 26, 2022

Logstash SSL TCP input

Related topics