RaspberryPi/Old Reverse SSH Stunnel - Revision history

Admin: /* Open Firewall */

2016-08-25T06:18:13Z

Open Firewall

← Older revision		Revision as of 06:18, 25 August 2016
Line 160:		Line 160:
	===Open Firewall===		===Open Firewall===

	Now add ~~a firewall~~ a firewall setting on the Raspbery Pi by creating a ~~file~~ <code>firewall.sh</code>:		Now add a firewall setting on the Raspbery Pi to allow SSL packets through the firewal by creating a simple firewall script <code>firewall.sh</code>:

	<pre>		<pre>
			#!/bin/sh

	iptables -A INPUT -p tcp --dport 443 -j ACCEPT		iptables -A INPUT -p tcp --dport 443 -j ACCEPT
	</pre>		</pre>

Admin: /* Open Firewall */

2015-08-04T20:39:19Z

Open Firewall

← Older revision		Revision as of 20:39, 4 August 2015
Line 163:		Line 163:

	<pre>		<pre>
	iptables -A INPUT -p tcp --dport ~~993~~ -j ACCEPT		iptables -A INPUT -p tcp --dport 443 -j ACCEPT
	</pre>		</pre>


	===Install Squid===		===Install Squid===

Admin: Admin moved page RaspberryPi/Reverse SSH Stunnel to RaspberryPi/Old Reverse SSH Stunnel

2015-08-04T19:55:47Z

Admin moved page RaspberryPi/Reverse SSH Stunnel to RaspberryPi/Old Reverse SSH Stunnel

← Older revision	Revision as of 19:55, 4 August 2015
(No difference)

Admin: /* Stunnel on Raspberry Pi */

2015-08-04T19:55:21Z

Stunnel on Raspberry Pi

← Older revision		Revision as of 19:55, 4 August 2015
Line 13:		Line 13:
	The stunnel client will be our command and control server.		The stunnel client will be our command and control server.

	=Stunnel on Raspberry Pi=		=Stunnel on Raspberry Pi Client=

	==Installing==		==Installing==

Admin: /* Install */

2015-08-04T19:52:46Z

Install

← Older revision		Revision as of 19:52, 4 August 2015
Line 201:		Line 201:

	<pre>		<pre>
	$ apt-get install -y stunnel4 ~~squid~~		$ apt-get install -y stunnel4
	</pre>		</pre>

Admin: /* Stunnel on Command and Control Server */

2015-08-04T19:52:35Z

Stunnel on Command and Control Server

← Older revision		Revision as of 19:52, 4 August 2015
Line 189:		Line 189:

	Now we can install an stunnel client on our command and control server.		Now we can install an stunnel client on our command and control server.

			http://www.bsdnow.tv/tutorials/stunnel

			They pose the scenario that you're on an untrusted network and you want to tunnel all your traffic through a secure shell to your trusted server. But the only ports that are open are ports 80 and 443, and there is deep packet inspection to check what kind of traffic is going through.

			In this case, you'd need to wrap your SSH traffic in an SSL layer to get past the firewall that is in place.

	==Install==		==Install==

Admin: /* The Setup */

2015-08-04T19:37:18Z

The Setup

← Older revision		Revision as of 19:37, 4 August 2015
Line 6:		Line 6:

	See also [[RaspberryPi/Reverse SSH]]		See also [[RaspberryPi/Reverse SSH]]

	~~=The Setup=~~

	Our stunnel setup will be as follows		Our stunnel setup will be as follows
Line 15:		Line 13:
	The stunnel client will be our command and control server.		The stunnel client will be our command and control server.

	==Stunnel on Raspberry Pi==		=Stunnel on Raspberry Pi=

	===Installing===		==Installing==

	First, install stunnel		First, install stunnel
Line 25:		Line 23:
	</pre>		</pre>

	===Edit Configuration File===		==Edit Configuration File==

	On the Raspberry Pi, edit the stunnel configuration file:		On the Raspberry Pi, edit the stunnel configuration file:
Line 51:		Line 49:
	Note that it is pointing to a certificate file in <code>/etc/stunnel/stunnel.pem</code>, so our next step will be to create this certificate file.		Note that it is pointing to a certificate file in <code>/etc/stunnel/stunnel.pem</code>, so our next step will be to create this certificate file.

	===Generate Private Keys/Certificates for SSL===		==Generate Private Keys/Certificates for SSL==

	Now you need to generate private keys, so that stunnel has private keys to use when encrypting using SSL.		Now you need to generate private keys, so that stunnel has private keys to use when encrypting using SSL.
Line 61:		Line 59:
	</pre>		</pre>

	====Generate Private Key====		===Generate Private Key===

	Use the openssl library to generate a 2048-bit private RSA key:		Use the openssl library to generate a 2048-bit private RSA key:
Line 74:		Line 72:
	</pre>		</pre>

	====Generate a Self-Signed Certificate====		===Generate a Self-Signed Certificate===

	To do SSL, an stunnel server must have an SSL certificate, which requires a private key and a signature. We already generated a private key, so now we generate a certificate, and use our own key to sign it. Do this by running the following:		To do SSL, an stunnel server must have an SSL certificate, which requires a private key and a signature. We already generated a private key, so now we generate a certificate, and use our own key to sign it. Do this by running the following:
Line 98:		Line 96:
	</pre>		</pre>

	====Key and Certificate====		===Key and Certificate===

	Now you have your private key in <code>key.pem</code> and your server's certificate in <code>cert.pem</code>.		Now you have your private key in <code>key.pem</code> and your server's certificate in <code>cert.pem</code>.
Line 116:		Line 114:
	</pre>		</pre>

	===Configure stunnel to Start on Boot===		==Configure stunnel to Start on Boot==

	Now configure stunnel by editing the default stunnel file:		Now configure stunnel by editing the default stunnel file:
Line 126:		Line 124:
	change <code>enable = 0</code> to <code>enable = 1</code>		change <code>enable = 0</code> to <code>enable = 1</code>

	===Restart stunnel===		==Restart stunnel==

	you can restart the stunnel service now,		you can restart the stunnel service now,
Line 188:		Line 186:
	</pre>		</pre>

	==Stunnel on Command and Control Server==		=Stunnel on Command and Control Server=

	Now we can install an stunnel client on our command and control server.		Now we can install an stunnel client on our command and control server.

	===Install===		==Install==

	Install stunnel on our command and control server in the usual manner, and install squid, too:		Install stunnel on our command and control server in the usual manner, and install squid, too:
Line 200:		Line 198:
	</pre>		</pre>

	===Private Key===		==Private Key==

	Next, we'll copy the private key <code>stunnel.pem</code>, which is the security certificate we created on the Raspberry Pi and will be using to encrypt the SSL traffic, onto our command and control server. This file is IMPORTANT! Without it, you can't decrypt stunnel traffic.		Next, we'll copy the private key <code>stunnel.pem</code>, which is the security certificate we created on the Raspberry Pi and will be using to encrypt the SSL traffic, onto our command and control server. This file is IMPORTANT! Without it, you can't decrypt stunnel traffic.
Line 209:		Line 207:
	</pre>		</pre>

	===Edit Configuration===		==Edit Configuration==

	=Alt Setup=		=Alt Setup=

Admin: /* Private Key */

2015-08-04T19:33:22Z

Private Key

← Older revision		Revision as of 19:33, 4 August 2015
Line 202:		Line 202:
	===Private Key===		===Private Key===

	Next, we'll copy the ~~file~~ <code>stunnel.pem</code>, which is the security certificate we created on the Raspberry Pi and will be using to encrypt the SSL traffic, onto our command and control server. This file is IMPORTANT! Without it, you can't decrypt stunnel traffic.		Next, we'll copy the private key <code>stunnel.pem</code>, which is the security certificate we created on the Raspberry Pi and will be using to encrypt the SSL traffic, onto our command and control server. This file is IMPORTANT! Without it, you can't decrypt stunnel traffic.

			<pre>
			scp root@10.0.0.243:/etc/stunnel/stunnel.pem /etc/stunnel/stunnel.pem
			stunnel.pem 100% 2774 2.7KB/s 00:00
			</pre>

	===Edit Configuration===		===Edit Configuration===

Admin: /* Install */

2015-08-04T19:32:09Z

Install

← Older revision		Revision as of 19:32, 4 August 2015
Line 194:		Line 194:
	===Install===		===Install===

	Install stunnel on our command and control server in the usual manner:		Install stunnel on our command and control server in the usual manner, and install squid, too:

	<pre>		<pre>
	apt-get install -y stunnel4		$ apt-get install -y stunnel4 squid
	</pre>		</pre>

Admin: /* Restart Stunnel */

2015-08-04T19:31:27Z

Restart Stunnel

@@ Line 184: / Line 184: @@
 <pre>
 $ /etc/init.d/stunnel4 restart
 Restarting SSL tunnels:
-Clients allowed=500
+[Started: /etc/stunnel/stunnel.conf] stunnel.
 </pre>