Introduction to Stunnel
The Stunnel package contains a program that allows you to encrypt arbitrary TCP connections inside SSL (Secure Sockets Layer) so you can easily communicate with clients over secure channels. Stunnel can be used to add SSL functionality to commonly used Inetd daemons like POP-2, POP-3, and IMAP servers, to standalone daemons like NNTP, SMTP and HTTP, and in tunneling PPP over network sockets without changes to the server package source code.
-
Download (HTTP): http://www.stunnel.org/download/stunnel/src/stunnel-4.07.tar.gz
-
Download (FTP): ftp://ftp.fu-berlin.de/unix/linux/mirrors/gentoo/distfiles/stunnel-4.07.tar.gz
-
Download MD5 sum: 7d53af550a1c2e01e146b936e58b8860
-
Download size: 486 KB
-
Estimated disk space required: 3.9 MB
-
Estimated build time: 0.11 SBU
Installation of Stunnel
The stunnel daemon will be run in a chroot jail by an unprivileged user. Create the new user, group and chroot home directory structure using the following commands as the root user:
groupadd stunnel &&
useradd -c "Stunnel Daemon" -d /var/lib/stunnel \
-g stunnel -s /bin/false stunnel &&
install -d -m 700 -o stunnel -g stunnel /var/lib/stunnel/run
![[Note]](../images/note.png)
Note
A signed SSL Certificate and a Private Key is necessary to run the stunnel daemon. If you own, or have already created a signed SSL Certificate you wish to use, copy it to tools/stunnel.pem in the source directory before starting the build, otherwise you will be prompted to create one. The .pem file must be formatted as shown below:
-----BEGIN RSA PRIVATE KEY----- [many encrypted lines of unencrypted key] -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- [many encrypted lines of certificate] -----END CERTIFICATE-----
Install Stunnel by running the following commands:
./configure --prefix=/usr --sysconfdir=/etc \
--localstatedir=/var/lib/stunnel &&
make
Now, as the root user:
make install
Command explanations
--sysconfdir=/etc: This parameter forces the configuration directory to /etc instead of /usr/etc.
--localstatedir=/var/lib/stunnel: This parameter causes the installation process to create /var/lib/stunnel/stunnel instead of /usr/var/stunnel.
make: This command builds the package and, if you did not copy an stunnel.pem file to the source tools/ directory, prompts you for the necessary information to create one. Ensure you reply to the
Common Name (FQDN of your server) [localhost]:
prompt with the name or IP address you will be using to access the service.
Configuring Stunnel
Create a basic /etc/stunnel/stunnel.conf configuration file using the following commands:
cat >/etc/stunnel/stunnel.conf << "EOF" # File: /etc/stunnel/stunnel.conf pid = /run/stunnel.pid chroot = /var/lib/stunnel client = no setuid = stunnel setgid = stunnel EOF
Next, you need to add the service you wish to encrypt to the configuration file. The format is as follows:
[[service]] accept = [hostname:portnumber] connect = [hostname:portnumber]
If you use Stunnel to encrypt a daemon started from [x]inetd, you may need to disable that daemon in the /etc/[x]inetd.conf file and enable a corresponding [service]_stunnel service. You may have to add an appropriate entry in /etc/services as well.
For a full explanation of the commands and syntax used in the configuration file, run man stunnel. To see a BLFS example of an actual setup of an stunnel encrypted service, read the the section called “Configuring SWAT” in the Samba instructions.
To automatically start the stunnel daemon when the system is rebooted, install the /etc/rc.d/init.d/stunnel bootscript from the blfs-bootscripts-6.0 package.
make install-stunnel
Contents
Last updated on 2005-02-22 23:38:15 -0700