Stunnel/Docker - Revision history

Admin: Replacing charlesreid1.com:3000 with git.charlesreid1.com

2019-10-09T03:56:01Z

Replacing charlesreid1.com:3000 with git.charlesreid1.com

← Older revision		Revision as of 03:56, 9 October 2019
Line 77:		Line 77:
	==Build Container==		==Build Container==

	Here is the Dockerfile: https://charlesreid1.com~~:3000~~/docker/d-stunnel/src/master/Dockerfile		Here is the Dockerfile: https://git.charlesreid1.com/docker/d-stunnel/src/master/Dockerfile

	Now build:		Now build:

Admin at 05:40, 5 April 2017

2017-04-05T05:40:13Z

← Older revision		Revision as of 05:40, 5 April 2017
Line 196:		Line 196:
	{{DockerFlag}}		{{DockerFlag}}
	{{StunnelFlag}}		{{StunnelFlag}}

			[[Category:Stunnel.conf]]

Admin: /* Passwordless Access with Stunnel */

2017-03-31T02:50:59Z

Passwordless Access with Stunnel

← Older revision		Revision as of 02:50, 31 March 2017
Line 181:		Line 181:

	In the context of stunnel trick, this will enable a passwordless and transparent connection to be made without user interaction (e.g., ON A HEADLESS SERVER, like the [[RaspberryPi]]):		In the context of stunnel trick, this will enable a passwordless and transparent connection to be made without user interaction (e.g., ON A HEADLESS SERVER, like the [[RaspberryPi]]):

			<pre>
			[raspberrypi] $ ssh master@commandandcontrol

			<raspberry pi is not prompted for password>

			[master@commandandcontrol] $
			</pre>

	Following the above steps and using the Raspberry Pis as the clients should allow you to set up connections with the remote server as soon as the Pis can connect to an open/public wifi network.		Following the above steps and using the Raspberry Pis as the clients should allow you to set up connections with the remote server as soon as the Pis can connect to an open/public wifi network.

Admin: /* Passwordless SSH over Stunnel */

2017-03-31T02:30:46Z

Passwordless SSH over Stunnel

← Older revision		Revision as of 02:30, 31 March 2017
Line 125:		Line 125:

	==Passwordless SSH over Stunnel==		==Passwordless SSH over Stunnel==

			To get the client passwordless access to the server over an encrypted, secure connection, you will need to add the client's SSH key to the remote server's trusted/authorized keys.

			You need to do this '''using whichever username you want to SSH as'''.

			If you want passwordless SSH access over stunnel, and you want to be root on the remote server, you will need to add the client's public SSH key to the root user's authorized keys file, located in <code>/root/.ssh/authorized_keys</code>. That's because you'll be SSHing through the stunnel connection and connecting as the root user.

			If you want passwordless SSH access as a different user, like zappa, edit that user's authorized keys file, <code>/home/zappa/.ssh/authorized_keys</code>.

			===Passwordless SSH Setup===

	'''DO THIS STEP ONCE'''		'''DO THIS STEP ONCE'''

	~~To get~~ the client ~~passwordless access to the server over an encrypted~~, ~~secure connection, add~~ the client~~'s SSH key to the remote server's trusted/authorized keys.~~		Start out on the client machine. First, generate a key for the client machine (you want passwordless access FROM this machine):

	~~Generate a key~~:

	<pre>		<pre>
Line 137:		Line 145:
	</pre>		</pre>

	Now log into the server, and edit the authorized keys file:		Now log into the server (where you want passwordless access TO), and edit the authorized keys file:

	<pre>		<pre>
Line 143:		Line 151:
	</pre>		</pre>

	Copy and paste the key into the authorized keys file.		Copy and paste the client's public key into the server's authorized keys file.

	'''END DO THIS STEP ONCE'''		'''END DO THIS STEP ONCE'''
Line 154:		Line 162:
	</pre>		</pre>

	Now you'll be able to SSH into the remote server without a password.		Now you'll be able to SSH into the remote server without a password:

	~~In the context of the stunnel trick, this will enable a passwordless and transparent connection to be made without user interaction (e.g., ON A HEADLESS SERVER, like the [[RaspberryPi]])~~:

	<pre>		<pre>
	[client] $ ssh ~~-p 2222 root~~@~~localhost~~		[client] $ ssh zappa@remote

	<user ~~does~~ not ~~enter any passwords~~>		<user is not prompted for password>

	[~~server~~] #		[zappa@remote] $
	</pre>		</pre>

			===Passwordless Access with Stunnel===

			Once you have set up passwordless login, you can use it tandem with stunnel to establish passwordless encrypted connections with a server.

			This is an extremely handy configuration if you have a bunch of distributed nodes, like wifi sensors running on Rapsberry Pis, that can reach the remote server and need to transfer files or interact with the server.

			It's particularly useful if those Raspberry Pi nodes need to do so from behind a restrictive, HTTP/HTTPS-only firewall.

			In the context of stunnel trick, this will enable a passwordless and transparent connection to be made without user interaction (e.g., ON A HEADLESS SERVER, like the [[RaspberryPi]]):

			Following the above steps and using the Raspberry Pis as the clients should allow you to set up connections with the remote server as soon as the Pis can connect to an open/public wifi network.

	=Flags=		=Flags=

Admin: /* Connect via ssh over stunnel */

2017-03-31T02:10:28Z

Connect via ssh over stunnel

← Older revision		Revision as of 02:10, 31 March 2017
Line 124:		Line 124:
	Bingo!		Bingo!

			==Passwordless SSH over Stunnel==

			'''DO THIS STEP ONCE'''

			To get the client passwordless access to the server over an encrypted, secure connection, add the client's SSH key to the remote server's trusted/authorized keys.

			Generate a key:

			<pre>
			[client] $ ssh-keygen -t rsa
			[client] $ cat ~/.ssh/id_rsa.pub
			</pre>

			Now log into the server, and edit the authorized keys file:

			<pre>
			[remote] $ vi ~/.ssh/authorized_keys
			</pre>

			Copy and paste the key into the authorized keys file.

			'''END DO THIS STEP ONCE'''

			Now that we have this all set up, we can access the remote server by starting the SSH agent and loading the key that the remote server will trust:

			<pre>
			[client] $ eval "$(ssh-agent -s)"
			[client] $ ssh-add -K ~/.ssh/id_rsa
			</pre>

			Now you'll be able to SSH into the remote server without a password.

			In the context of the stunnel trick, this will enable a passwordless and transparent connection to be made without user interaction (e.g., ON A HEADLESS SERVER, like the [[RaspberryPi]]):

			<pre>
			[client] $ ssh -p 2222 root@localhost

			<user does not enter any passwords>

			[server] #
			</pre>

	=Flags=		=Flags=

Admin at 02:01, 31 March 2017

2017-03-31T02:01:52Z

← Older revision		Revision as of 02:01, 31 March 2017
Line 1:		Line 1:
	This page explains how to use stunnel in a Docker container to serve up different kinds of traffic over an encrypted SSL connection.		This page explains how to use stunnel in a Docker container to serve up different kinds of traffic over an encrypted SSL connection.

	For passwordless SSH setup, see [[SSH]]		For passwordless SSH setup, see [[SSH#Passwordless Login]]

	=ssh traffic over port 443 using stunnel on docker=		=ssh traffic over port 443 using stunnel on docker=

Admin at 02:01, 31 March 2017

2017-03-31T02:01:29Z

← Older revision		Revision as of 02:01, 31 March 2017
Line 1:		Line 1:
	This page explains how to use stunnel in a Docker container to serve up different kinds of traffic over an encrypted SSL connection.		This page explains how to use stunnel in a Docker container to serve up different kinds of traffic over an encrypted SSL connection.

			For passwordless SSH setup, see [[SSH]]

	=ssh traffic over port 443 using stunnel on docker=		=ssh traffic over port 443 using stunnel on docker=

Admin: /* Connect via ssh over stunnel */

2017-03-31T02:00:46Z

Connect via ssh over stunnel

← Older revision		Revision as of 02:00, 31 March 2017
Line 101:		Line 101:
	==Connect via ssh over stunnel==		==Connect via ssh over stunnel==

			Now from the client, start stunnel:

			<pre>
			[client] $ stunnel
			</pre>

			See the [[Stunnel/Client]] page for details on how to ensure stunnel is correctly running.

			Once you execute this command, the stunnel instance on your client machine will connect to the stunnel server on your remote machine. You should now have an operational SSH tunnel.

			<pre>
			[client] $ ssh -p 2222 root@localhost

			[remote] # whoami
			root

			[remote] #
			</pre>

			Bingo!




			=Flags=

	{{DockerFlag}}		{{DockerFlag}}
	{{StunnelFlag}}		{{StunnelFlag}}

Admin: /* Run Container */

2017-03-31T01:56:33Z

Run Container

← Older revision		Revision as of 01:56, 31 March 2017
Line 96:		Line 96:
	/bin/bash		/bin/bash
	</pre>		</pre>

			The stunnel command should be run from inside the container. (This is something I am having an issue with.)

	==Connect via ssh over stunnel==		==Connect via ssh over stunnel==

Admin: /* Set up client */

2017-03-31T01:56:04Z

Set up client

@@ Line 35: / Line 35: @@
 </pre>
-The client will also need a copy of the server's certificate file, which can be securely copied from the server.
+The client will also need a copy of the server's certificate file, which can be securely copied from the server:
 ==Set up server==