Stunnel/Server - Revision history

Admin: /* Stunnel SSL Certificates */

2017-04-30T09:03:18Z

Stunnel SSL Certificates

@@ Line 23: / Line 23: @@
 Also see the stunnel official howto: https://www.stunnel.org/howto.html
-Using stunnel in client mode (i.e., stunnel is not acting as an SSL server) means you probably don't need to present a valid certificate. While stunnel always requires a certificate (a pem file) to run, a dummy certificate is generated when stunnel is installed, and that dummy pem file can be used. Most of the time, the client is not required to produce an SSL certificate.
+The short version: if you control the client and the server, and are using a self-signed certificate, you can skip verification or you can install the server's certificate authority (which, for a self-signed certificate, is the same as the certificate itself).
 ===Stunnel Config File===

Admin: /* Stunnel Config File */

2017-04-30T07:04:03Z

Stunnel Config File

← Older revision		Revision as of 07:04, 30 April 2017
Line 16:		Line 16:

	Typically, stunnel is forwarding that traffic on to a local port, something like 8443. (Useful if you have a service only exposed to LOCAL traffic from localhost or 127.0.0.1 and not bound to an EXTERNAL ip address like 0.0.0.0).		Typically, stunnel is forwarding that traffic on to a local port, something like 8443. (Useful if you have a service only exposed to LOCAL traffic from localhost or 127.0.0.1 and not bound to an EXTERNAL ip address like 0.0.0.0).

			===Stunnel SSL Certificates===

			See the [[Stunnel/Certificates]] page for more info on how to create an SSL certificate for the server.

			Also see the stunnel official howto: https://www.stunnel.org/howto.html

			Using stunnel in client mode (i.e., stunnel is not acting as an SSL server) means you probably don't need to present a valid certificate. While stunnel always requires a certificate (a pem file) to run, a dummy certificate is generated when stunnel is installed, and that dummy pem file can be used. Most of the time, the client is not required to produce an SSL certificate.

			Using stunnel in a situation where you control both the client and the server gives you two options that avoid needing a certificate authority to sign your certificate:
			* Skip verification of certificates
			* Verify certificates against locally installed certificates

			If you do require a signed SSL certificate, you can use [[LetsEncrypt]] to get your certificate signed by a CA. The result will be a certificate of the form

			<pre>
			------BEGIN CERTIFICATE--------
			cert data
			------END CERTIFICATE--------
			</pre>

			Append this certificate to your <code>stunnel.pem</code> file.

			See [[Stunnel/Certificates]] for more information about verification of certificates.

	===Stunnel Config File===		===Stunnel Config File===

Admin: /* Starting Stunnel */

2017-03-29T07:20:48Z

Starting Stunnel

@@ Line 89: / Line 89: @@
 </pre>
-You can verify that stunnel is running using nmap to check if the stunnel port is open:
+==Verifying the stunnel server is ok==
 <pre>

Admin at 07:19, 29 March 2017

2017-03-29T07:19:35Z

← Older revision		Revision as of 07:19, 29 March 2017
Line 1:		Line 1:
			This page covers an example stunnel server configuration that will tunnel SSH via stunnel over port 8000.

			On the client, port 2222 (where the client will SSH) is mapped to port 8000 (stunnel), which wraps the SSH traffic in an SSL layer and passes it to the stunnel server.

			On the server, port 8000 (stunnel) is exposed and listening for incoming connections. When it creates a connection it unwraps the SSL layer on the traffic and forwards it to local port 22.

	==Stunnel Server==		==Stunnel Server==

Admin: /* Stunnel Config File */

2017-03-29T07:17:16Z

Stunnel Config File

← Older revision		Revision as of 07:17, 29 March 2017
Line 16:		Line 16:

	<pre>		<pre>
	output = /~~etc~~/~~stunnel~~/stunnel.log		output = /var/log/stunnel4/stunnel.log
	cert=/etc/stunnel/stunnel.fullchain.pem		cert = /etc/stunnel/stunnel.fullchain.pem
	key=/etc/stunnel/stunnel.key.pem		key = /etc/stunnel/stunnel.key.pem
	~~pid~~=~~/var/run/stunnel4/stunnel.pid~~		client = no
	~~client~~=~~yes~~		debug = 7
	[~~http~~]		[ssh]
	accept = ~~444~~		accept = 8000
	connect = 127.0.0.1:~~8444~~		connect = 127.0.0.1:22
	</pre>		</pre>

Admin: /* Stunnel Config File */

2017-03-28T20:50:32Z

Stunnel Config File

← Older revision		Revision as of 20:50, 28 March 2017
Line 22:		Line 22:
	client=yes		client=yes
	[http]		[http]
	accept = ~~443~~		accept = 444
	connect = 127.0.0.1:~~8443~~		connect = 127.0.0.1:8444
	</pre>		</pre>

Admin: /* Ports/Arrangement */

2017-03-28T20:48:05Z

Ports/Arrangement

← Older revision		Revision as of 20:48, 28 March 2017
Line 3:		Line 3:
	Stunnel running as a server will open two ports: one to listen for incoming traffic, and one to forward the (unencrypted) traffic onto.		Stunnel running as a server will open two ports: one to listen for incoming traffic, and one to forward the (unencrypted) traffic onto.

	===Ports~~/Arrangement~~===		===Stunnel Server Ports===

	The arrangement we will use ~~for this server~~ is, stunnel will listen on port 443, open to external traffic, ~~listening~~ for SSL-encrypted stunnel traffic. This means that only stunnel can listen on 443, so this cannot be a server for an HTTPS web site.		Stunnel servers can listen on any port, and the port you choose depends on the application. The configuration we're showing here is intended to bypass a local network that allows only HTTP and HTTPS traffic on ports 80 and 443. Therefore the arrangement we will use is, stunnel will listen on port 443, open to external traffic, for SSL-encrypted stunnel traffic. This means that only stunnel can listen on 443, so this cannot be a server for an HTTPS web site. We can use stunnel on any port that we want, but communicating between stunnel clients and servers on port 443 allows us to disguise arbitrary traffic (HTTP, HTTPS, SSH, database, etc.) as legitimate HTTPS.

			(Note that other services like Iodine allow you to do similar things with disguising network connections over port 53, the typical port used by DNS servers.)

	Typically, stunnel is forwarding that traffic on to a local port, something like 8443. (Useful if you have a service only exposed to LOCAL traffic from localhost or 127.0.0.1 and not bound to an EXTERNAL ip address like 0.0.0.0).		Typically, stunnel is forwarding that traffic on to a local port, something like 8443. (Useful if you have a service only exposed to LOCAL traffic from localhost or 127.0.0.1 and not bound to an EXTERNAL ip address like 0.0.0.0).

Admin: /* Ports/Arrangement */

2017-03-28T20:42:57Z

Ports/Arrangement

← Older revision		Revision as of 20:42, 28 March 2017
Line 5:		Line 5:
	===Ports/Arrangement===		===Ports/Arrangement===

	~~Typically~~, stunnel ~~is listening~~ on port 443, open to external traffic, ~~and is~~ listening for SSL traffic.		The arrangement we will use for this server is, stunnel will listen on port 443, open to external traffic, listening for SSL-encrypted stunnel traffic. This means that only stunnel can listen on 443, so this cannot be a server for an HTTPS web site.

	Typically, stunnel is forwarding that traffic on to a local port, something like 8443. (Useful if you have a service only exposed to LOCAL traffic from localhost or 127.0.0.1 and not bound to an EXTERNAL ip address like 0.0.0.0).		Typically, stunnel is forwarding that traffic on to a local port, something like 8443. (Useful if you have a service only exposed to LOCAL traffic from localhost or 127.0.0.1 and not bound to an EXTERNAL ip address like 0.0.0.0).

Admin: /* Starting Stunnel */

2017-03-28T20:03:30Z

Starting Stunnel

← Older revision		Revision as of 20:03, 28 March 2017
Line 28:		Line 28:
	Starting stunnel is really simple. Just run the stunnel command.		Starting stunnel is really simple. Just run the stunnel command.

	If there are problems, ~~you'll see~~ them~~; if not,~~ you ~~won't~~.		If there are problems, stunnel may or may not print them out when you run the stunnel command.

	Here's an example of a ~~failed startup~~:		Here's an example of a permissions error with a certificate file:

	<pre>		<pre>
Line 54:		Line 54:
	[!] SSL_CTX_use_PrivateKey_file: 200100D: error:0200100D:system library:fopen:Permission denied		[!] SSL_CTX_use_PrivateKey_file: 200100D: error:0200100D:system library:fopen:Permission denied
	[!] Service [http]: Failed to initialize SSL context		[!] Service [http]: Failed to initialize SSL context
			</pre>

			Stunnel may also fail silently. In another window you can run tail on the stunnel log:

			<pre>
			$ tail -f /var/log/stunnel4/stunnel.log
	</pre>		</pre>

Line 60:		Line 66:
	<pre>		<pre>
	$ sudo stunnel		$ sudo stunnel
			</pre>

			The last few lines of the log should also show a clean startup:

			<pre>
			2017.03.28 13:01:53 LOG5[ui]: Compiled with OpenSSL 0.9.8zc 19 Mar 2015
			2017.03.28 13:01:53 LOG5[ui]: Running with OpenSSL 0.9.8zh 14 Jan 2016
			2017.03.28 13:01:53 LOG5[ui]: Update OpenSSL shared libraries or rebuild stunnel
			2017.03.28 13:01:53 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP
			2017.03.28 13:01:53 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf
			2017.03.28 13:01:53 LOG5[ui]: UTF-8 byte order mark not detected
			2017.03.28 13:01:53 LOG4[ui]: Service [https] needs authentication to prevent MITM attacks
			2017.03.28 13:01:53 LOG5[ui]: Configuration successful
	</pre>		</pre>

Line 71:		Line 90:
	Host is up (0.000016s latency).		Host is up (0.000016s latency).
	Other addresses for localhost (not scanned): ::1		Other addresses for localhost (not scanned): ::1
	Not shown: ~~997~~ closed ports		Not shown: 999 closed ports
	PORT STATE SERVICE		PORT STATE SERVICE
	~~22/tcp open ssh~~
	~~80/tcp open http~~
	443/tcp open https		443/tcp open https

Admin: /* Flags */

2017-03-28T17:02:36Z

Flags

← Older revision		Revision as of 17:02, 28 March 2017
Line 79:		Line 79:
	Nmap done: 1 IP address (1 host up) scanned in 1.70 seconds		Nmap done: 1 IP address (1 host up) scanned in 1.70 seconds
	</pre>		</pre>

			==Now Start the Client==

			See [[Stunnel/Client]]

	==Flags==		==Flags==