{"componentChunkName":"component---src-components-mark-down-block-js","path":"/docs/tls/","result":{"data":{"markdownRemark":{"html":"

Using TLS for Secure Connections

\n

AppScope supports TLS over TCP connections. Here's how that works:

\n\n

For security's sake, AppScope never opens ports, nor does it listen for or allow incoming connections.

\n

To enable TLS: In the scope.yml config file, set the transport : tls : enable element to true.

\n

Using TLS in Cribl.Cloud

\n

AppScope uses TLS by default to communicate with Cribl Stream over TCP on Cribl.Cloud. Cribl Stream has an AppScope Source ready to use out-of-the-box.

\n

Within Cribl.Cloud, a front-end load balancer (reverse proxy) handles the encrypted TLS traffic and relays it to the AppScope Source port in Cribl Stream. The connection from the load balancer to Cribl Stream does not use TLS, and you should not enable TLS on the AppScope Source in Cribl Stream. No changes in Cribl Stream configuration are needed.

\n

AppScope connects to your Cribl.Cloud Ingest Endpoint on port 10090. The Ingest Endpoint URL is always the same except for the Cribl.Cloud Organization ID, which Cribl Stream uses in the hostname portion, in the following way:

\n
https://in.main-default-<organization>.cribl.cloud:10090\n
\n

If you disable TLS, the port is 10091.

\n

CLI usage

\n

Use scope run with the -c option (in this example, we're scoping ps -ef):

\n
scope run -c tls://host:10090 -- ps -ef\n
\n

Configuration for LD_PRELOAD

\n

To connect AppScope to a Cribl.Cloud-managed instance of Cribl Stream using TLS:

\n
    \n
  1. Enable the transport : tls : enable element in scope.yml.
    2. \n
  2. Connect to port 10090 on your Cribl.Cloud Ingest Endpoint.
    3. \n
\n

To enable TLS in scope.yml, adapt the example below to your environment:

\n
cribl:\n  enable: true\n  transport:\n    type: tcp  # don't use tls here, use tcp and enable tls below\n    host: in.main-default-<organization>.cribl.cloud\n    port: 10090 # cribl.cloud's port for the TLS AppScope Source\n    tls:\n      enable: true\n      validateserver: true\n      cacertpath: ''\n
\n

Scoping Without TLS

\n

If you prefer to connect to Cribl Stream on Cribl.Cloud without encryption, connect to port 10091 instead of port 10090, and disable the tls element in scope.yml.

\n

No changes in Cribl Stream configuration are needed.

\n

Backoff Algorithm

\n

AppScope uses a backoff algorithm for connections to avoid creating excessive network traffic and log entries. When a remote destination that AppScope tries to connect to rejects the connection or is not available, AppScope retries the connection at a progressively slower rate.

","frontmatter":{"title":"Using TLS for Secure Connections"}}},"pageContext":{"slug":"/tls/","id":"f4e45f00-bc5b-5199-8c16-d732da7c4b96"}},"staticQueryHashes":["2787008656","306729481","625673991","640077088"]}