Make syslog secure (allow-list, VPN or TLS)

Steps

1. Level 1: restrict who can send

   Firewall rule allowing only the sender IPs on port 514 (see the ports scenario). This stops casual spoofing from outside but does not encrypt anything.

2. Level 2: send over a VPN

   Put the syslog server on the VPN subnet. On the FortiGate set the syslog destination to the server's private address and send through the tunnel interface (interface-select-method specify). Traffic is encrypted inside the tunnel, and port 514 is never exposed.

3. Level 3: syslog over TLS with rsyslog

   terminalCopy

   sudo apt install -y rsyslog-gnutls
   sudo tee /etc/rsyslog.d/20-tls.conf > /dev/null <<'EOF'
   global(
     DefaultNetstreamDriver="gtls"
     DefaultNetstreamDriverCAFile="/etc/rsyslog-tls/ca.pem"
     DefaultNetstreamDriverCertFile="/etc/rsyslog-tls/server.pem"
     DefaultNetstreamDriverKeyFile="/etc/rsyslog-tls/server.key"
   )
   module(load="imtcp" StreamDriver.Name="gtls" StreamDriver.Mode="1" StreamDriver.AuthMode="x509/name")
   input(type="imtcp" port="6514")
   EOF

   Listens for TLS on 6514. You need a certificate authority, a server certificate and key in /etc/rsyslog-tls/. AuthMode options range from anon (encrypt only) to x509/name (verify the client certificate name). Test with a client before relying on it.

4. Configure the sender for encryption

   On a FortiGate use mode reliable and check set enc-algorithm ? for the encryption option on your FortiOS version, plus Fortinet's documentation for importing the CA certificate. Other devices have their own TLS settings.