Stunnel/Client - Revision history

Admin: /* Stunnel Client */

2017-04-30T19:50:47Z

Stunnel Client

← Older revision		Revision as of 19:50, 30 April 2017
Line 1:		Line 1:
	==Stunnel Client==		==Stunnel Client==

	Running an stunnel client requires installing stunnel and setting up a configuration file just like if you were setting up an [[Stunnel/Server]], except swapping the accept and connect ports, since we want the client to accept local traffic (on port 8443) and send it on to the server that it connects to with SSL (on port 443).		Running an stunnel client requires installing stunnel and setting up a configuration file just like if you were setting up an [[Stunnel/Server]], except swapping the accept and connect ports, since we want the client to accept local traffic (e.g., on port 8443) and send it on to the server that it connects to with SSL (e.g., on port 443).

	===Ports/Arrangement===		===Ports/Arrangement===

Admin: /* Starting Stunnel Client */

2017-03-28T20:07:26Z

Starting Stunnel Client

@@ Line 48: / Line 48: @@
 [ ] Clients allowed=2375
 [ ] Cron thread initialized
 [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP
 [ ] errno: (*__error())
@@ Line 78: / Line 74: @@
 This error in particular can be fixed with <code>mkdir /var/{log,run}/stunnel4</code>.
 ==Testing Stunnel Client==

Admin: /* Starting Stunnel Client */

2017-03-28T20:05:43Z

Starting Stunnel Client

← Older revision		Revision as of 20:05, 28 March 2017
Line 42:		Line 42:
	To start stunnel, you'll run the stunnel binary. This will attempt to silently establish a connection in the background to the specified stunnel server.		To start stunnel, you'll run the stunnel binary. This will attempt to silently establish a connection in the background to the specified stunnel server.

	~~if the connection is successful, the command will be totally silent~~. ~~Otherwise~~, ~~it will print out whatever error results from running~~ the ~~command. Here's what~~ an ~~unsuccessful command looks like~~:		Stunnel may fail with an error message. For example, the following is an example of a failure due to a nonexistent log directory:

	<pre>		<pre>
Line 77:		Line 77:
	</pre>		</pre>

			This error in particular can be fixed with <code>mkdir /var/{log,run}/stunnel4</code>.

	==Testing Stunnel Client==		==Testing Stunnel Client==

Admin: /* Stunnel Config File */

2017-03-28T19:57:15Z

Stunnel Config File

← Older revision		Revision as of 19:57, 28 March 2017
Line 22:		Line 22:
	</pre>		</pre>

	~~Note the server~~ certificate ~~and key files~~ must be the same ~~ones~~ as ~~are~~ on the stunnel server. This is how you verify the identity of the server - if you can receive their public key over a trusted, published, public channel, then you can exchange encrypted communications with them. Use a trusted, encrypted channel like SSH or a USB key if you have physical access to the server.		A couple of things to note:
			* Server certificate must be the same certificate as is on the stunnel server.
			* <code>/var/log/stunnel4</code> and <code>/var/run/stunnel4</code> must both exist.

	~~If using Homebrew stunnel~~ as ~~your client~~, the server's ~~certificate~~ file ~~should go~~ in <code>~~/usr/local~~/etc/stunnel/</code>. ~~On unix, try~~ <code>/etc/~~stunnel~~</code>		<pre>
			$ sudo mkdir -p /var/{run,log}/stunnel4
			</pre>

			Why does the certificate on the client need to be the same one as is on the server? That's how you verify the identity of the server - if you can receive their public key over a trusted, published, public channel, then you can exchange encrypted communications with them. Use a trusted, encrypted channel like SSH or a USB key if you have physical access to the server.

			If you can't establish a trusted connection with the server, there's no way to verify its identity.

			On Linux you can put your certificates and your config file in <code>/etc/stunnel</code>.

			For [[Homebrew]] users it is <code>/usr/local/etc/homebrew</code>.

	==Starting Stunnel Client==		==Starting Stunnel Client==

Admin: /* Starting Stunnel */

2017-03-28T18:16:42Z

Starting Stunnel

@@ Line 26: / Line 26: @@
 If using Homebrew stunnel as your client, the server's certificate file should go in <code>/usr/local/etc/stunnel/</code>. On unix, try <code>/etc/stunnel</code>
-==Starting Stunnel==
+==Starting Stunnel Client==
 To start stunnel, you'll run the stunnel binary. This will attempt to silently establish a connection in the background to the specified stunnel server.
@@ Line 64: / Line 64: @@
 [ ] Service [https] closed
 </pre>
 ==Flags==

Admin: /* Starting Stunnel */

2017-03-28T17:41:56Z

Starting Stunnel

@@ Line 30: / Line 30: @@
 To start stunnel, you'll run the stunnel binary. This will attempt to silently establish a connection in the background to the specified stunnel server.
-if the connection is successful, the command will be totally silent. Otherwise, it will print out whatever error results from running the command.
+if the connection is successful, the command will be totally silent. Otherwise, it will print out whatever error results from running the command. Here's what an unsuccessful command looks like:
 ==Flags==

Admin: /* Flags */

2017-03-28T17:38:37Z

Flags

← Older revision		Revision as of 17:38, 28 March 2017
Line 25:		Line 25:

	If using Homebrew stunnel as your client, the server's certificate file should go in <code>/usr/local/etc/stunnel/</code>. On unix, try <code>/etc/stunnel</code>		If using Homebrew stunnel as your client, the server's certificate file should go in <code>/usr/local/etc/stunnel/</code>. On unix, try <code>/etc/stunnel</code>

			==Starting Stunnel==

			To start stunnel, you'll run the stunnel binary. This will attempt to silently establish a connection in the background to the specified stunnel server.

			if the connection is successful, the command will be totally silent. Otherwise, it will print out whatever error results from running the command.

	==Flags==		==Flags==

Admin: /* Stunnel Client */

2017-03-28T17:30:24Z

Stunnel Client

← Older revision		Revision as of 17:30, 28 March 2017
Line 2:		Line 2:

	Running an stunnel client requires installing stunnel and setting up a configuration file just like if you were setting up an [[Stunnel/Server]], except swapping the accept and connect ports, since we want the client to accept local traffic (on port 8443) and send it on to the server that it connects to with SSL (on port 443).		Running an stunnel client requires installing stunnel and setting up a configuration file just like if you were setting up an [[Stunnel/Server]], except swapping the accept and connect ports, since we want the client to accept local traffic (on port 8443) and send it on to the server that it connects to with SSL (on port 443).

			===Ports/Arrangement===

			The stunnel server will be listening on port 443. We want to connect to the external server on 443, and forward the traffic to a local port 8443.

			===Stunnel Config File===

	If we want to establish a connection on port 443 (externally) to forward on to port 8443 (locally), we can use the following config file:		If we want to establish a connection on port 443 (externally) to forward on to port 8443 (locally), we can use the following config file:
Line 18:		Line 24:
	Note the server certificate and key files must be the same ones as are on the stunnel server. This is how you verify the identity of the server - if you can receive their public key over a trusted, published, public channel, then you can exchange encrypted communications with them. Use a trusted, encrypted channel like SSH or a USB key if you have physical access to the server.		Note the server certificate and key files must be the same ones as are on the stunnel server. This is how you verify the identity of the server - if you can receive their public key over a trusted, published, public channel, then you can exchange encrypted communications with them. Use a trusted, encrypted channel like SSH or a USB key if you have physical access to the server.

	If using Homebrew stunnel as your client, the server's certificate file should go in <code>/usr/local/etc/stunnel/</code>.		If using Homebrew stunnel as your client, the server's certificate file should go in <code>/usr/local/etc/stunnel/</code>. On unix, try <code>/etc/stunnel</code>

	==Flags==		==Flags==

Admin: /* Stunnel Client */

2017-03-28T04:19:28Z

Stunnel Client

← Older revision		Revision as of 04:19, 28 March 2017
Line 17:		Line 17:

	Note the server certificate and key files must be the same ones as are on the stunnel server. This is how you verify the identity of the server - if you can receive their public key over a trusted, published, public channel, then you can exchange encrypted communications with them. Use a trusted, encrypted channel like SSH or a USB key if you have physical access to the server.		Note the server certificate and key files must be the same ones as are on the stunnel server. This is how you verify the identity of the server - if you can receive their public key over a trusted, published, public channel, then you can exchange encrypted communications with them. Use a trusted, encrypted channel like SSH or a USB key if you have physical access to the server.

			If using Homebrew stunnel as your client, the server's certificate file should go in <code>/usr/local/etc/stunnel/</code>.

	==Flags==		==Flags==

Admin: /* Stunnel Client */

2017-03-28T03:15:15Z

Stunnel Client

← Older revision		Revision as of 03:15, 28 March 2017
Line 15:		Line 15:
	connect = 10.11.12.13:443		connect = 10.11.12.13:443
	</pre>		</pre>

			Note the server certificate and key files must be the same ones as are on the stunnel server. This is how you verify the identity of the server - if you can receive their public key over a trusted, published, public channel, then you can exchange encrypted communications with them. Use a trusted, encrypted channel like SSH or a USB key if you have physical access to the server.

	==Flags==		==Flags==