# Logstash authentication with TCP

**URL:** <https://discuss.elastic.co/t/logstash-authentication-with-tcp/110558>\
**Category:** Logstash\
**Created:** [December 6, 2017, 6:24pm UTC](https://discuss.elastic.co/t/logstash-authentication-with-tcp/110558 "2017-12-06T18:24:39Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![NenadP](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nenadp/32/25131_2.png) [@NenadP](https://discuss.elastic.co/u/NenadP)\
**Post date:** [December 6, 2017, 6:24pm UTC](https://discuss.elastic.co/t/logstash-authentication-with-tcp/110558/1 "2017-12-06T18:24:39Z")

</div>

I am delivering logs from Pivotal web service (based on Cloud Foundry) to remote ELK.

On Pivotal I've created log drain service which delivers logs to logstash via syslog TCP connection. Everything works fine but apparently anyone could connect to my remote box and write data.

Pivotal allows delivering custom key with value which could serve as Auth mechanism, but I didn't see simple password option available in TCP Logstash plugin.

I am curious anyone had similar scenario and describe how they solved it?

Current config:

```
input {
  tcp {
    port => 5000
    type => syslog
  }
}

```

On Pivotal:  
Syslog Drain Url  
`syslog://example.com:5000`

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 6, 2017, 8:41pm UTC](https://discuss.elastic.co/t/logstash-authentication-with-tcp/110558/2 "2017-12-06T20:41:40Z")

</div>

> Pivotal allows delivering custom key with value

How, exactly?

---

<div class="post-metadata">

**Author:** ![NenadP](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nenadp/32/25131_2.png) [@NenadP](https://discuss.elastic.co/u/NenadP)\
**Post date:** [December 7, 2017, 12:07am UTC](https://discuss.elastic.co/t/logstash-authentication-with-tcp/110558/3 "2017-12-07T00:07:07Z")

</div>

Good Question.  
Now when I think these key/value pairs are only for [internal authorization](https://docs.pivotal.io/pivotalcf/1-12/devguide/services/user-provided.html#credentials) (when internal service is bound to internal app).

I don't know much about syslog as protocol in the example above, my naive thinking would be I should be able to provide some kind of auth token, mockup:

`syslog://example.com:5000?token=TOKEN_VALUE`

which I should be somehow able to validate on the logstash end

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 7, 2017, 7:06am UTC](https://discuss.elastic.co/t/logstash-authentication-with-tcp/110558/4 "2017-12-07T07:06:37Z")

</div>

No, that's not possible. The only means of authentication for a tcp input are

- SSL client certificate validation,
- network firewalling, or
- custom filtering of payload (e.g. requiring clients to prefix the payload with an authentication token and dropping all events that don't).

---

<div class="post-metadata">

**Author:** ![NenadP](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nenadp/32/25131_2.png) [@NenadP](https://discuss.elastic.co/u/NenadP)\
**Post date:** [December 7, 2017, 8:04am UTC](https://discuss.elastic.co/t/logstash-authentication-with-tcp/110558/5 "2017-12-07T08:04:32Z")

</div>

Yes, was trying to search up on google but I couldn't find any descriptive howto for TCP Logstash plugin with SSL. I would be able to put certificate and password on my ELK box and setup Logstash input, but I don't have a clue how then Pivotal web service authorizes themselves.

Option 2, probably I could set up iptables and drop anything that's not coming from \*.cf-apps.io on port 5000.

Option 3 seems easiest to achieve, but would require sending a token with each log entry.

---

<div class="post-metadata">

**Author:** ![NenadP](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nenadp/32/25131_2.png) [@NenadP](https://discuss.elastic.co/u/NenadP)\
**Post date:** [December 7, 2017, 8:31pm UTC](https://discuss.elastic.co/t/logstash-authentication-with-tcp/110558/6 "2017-12-07T20:31:38Z")

</div>

A creative poor mans idea would be to use pivotal app guid, which could serve as app secret, they confirmed it's unique and persist across instances:

`cf app <YOUR_APP> --guid`

and then expect them in logstash filter as they appear as

`syslog5424_app:	ce576030-2b11-48c0-b892-e2a4eaee2e1`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 4, 2018, 8:31pm UTC](https://discuss.elastic.co/t/logstash-authentication-with-tcp/110558/7 "2018-01-04T20:31:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.