Transfer client certificate to Malcolm sensor

[dwade5]

Hello, I am currently attempting to setup two Malcolm instances on my network through ESXi. One VM is set up as the server with all containers and the second VM is setup as the sensor. after storing the credentials and IP address of OpenSearch database and logstash I started Malcolm on both sensor and server. It connects to the OpenSearch over port 9200 with no issue. However, I receive the following error message for logstash:

I realize this is a certificate issue but I wanted to request assistance on how to transfer the client certificates to the Malcolm instance that is acting as a sensor and the directory they should be stored in.

[mmguero]

Just so I understand you right: do you have two Malcolm instances and you're wanting to forward the logs from one to the other? There are a few different ways to do a client/server model with malcolm (in order of preference):

• Hedgehog Linux sensor -> Malcolm
• Malcolm (running the "hedgehog" profile) -> Malcolm
• Malcolm (running the "malcolm" profile) -> another Malcolm instance

Which are you trying to do?

[dwade5]

I Currently have the Malcolm (running the "hedgehog" profile) -> Malcolm setup

[mmguero]

I need to create/document a tool to do this for you. Basically what you'd want to do is take the files from ./logstash/certs and ./filebeat/certs/ on the destination Malcolm instance and copy them to the same location on the source Malcolm instance. Give that a shot and let me know how it goes.

[dwade5]

Apologies for the delay. I transferred the certs as you stated and everything seems to be in order. Thanks for the assist.