Stunnel in DAB appliances

Why stunnel

Sometimes it is necessary to use a SSH Wrapper - stunnel4 / stunnel3 - for example if we have a server with a MySQL daemon on it that needs to have some databases accessed from another server's MySQL client.

Pre-requisites and Asumptions

For the sake of simplicity, I assume that both are OpenVZ DAB generated appliances having host names Remote-DB-Host (SERVER) and Data-Accessing-Host (CLIENT). We further assume that each host has it's own MySQL daemon running on the normal port 3306. We need to enable a MySQL client on the Data-Accessing-Host to access a MySQL DB in the Remote-DB-Host in a secure manner (SSH Wrapped). Let us assume the following for reference:

Remote-DB-Host - SERVER

IP: 192.168.5.15
MySQL Server Port: 3306
To be configured Incoming SSH MySQL Port: 3320

Data-Accessing-Host - CLIENT

IP: 192.168.5.45
MySQL Server Port: 3306
To be configured MySQL Client Access Port: 3310
To be configured MySQL Client SSH Outgoing Port: 3320
(same as Remote-DB-Host's Incoming SSH Port)

Installation

On both hosts' (SERVER and CLIENT) console, execute:

apt-get install stunnel

If all goes well, you will get stunnel v4 installed.

The installed version of stunnel can be obtained from: # dpkg -l 'stunnel*'

Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Cfg-files/Unpacked/Failed-cfg/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Hold/Reinst-required/X=both-problems (Status,Err: uppercase=bad)
||/ Name           Version        Description
+++-==============-==============-============================================
ii  stunnel        3:4.22-2       dummy upgrade package
ii  stunnel4       3:4.22-2       Universal SSL tunnel for network daemons

PEM Cerificate generation

The PEM certificate should by default exist as /etc/stunnel/stunnel.pem It must be generated on the SERVER and is optional on the CLIENT. The default certificate generation template (edit as needed) is at:

/usr/share/doc/stunnel4/examples/stunnel.cnf

The folowing normal method of certificate generation hangs (Ctrl-C to exit) on DAB appliances:

make-ssl-cert /usr/share/doc/stunnel4/examples/stunnel.cnf /etc/stunnel/stunnel.pem

Hence we will have to revert to it's equivalent:

openssl req -new -x509 -days 365 -nodes -config /usr/share/doc/stunnel4/examples/stunnel.cnf -out 

stunnel.pem -keyout /etc/stunnel/stunnel.pem In order to prevent hacking, the name of the stunnel.pem file is hashed using:

/usr/lib/ssl/misc/c_hash /etc/stunnel/stunnel.pem

This will result in some output like (yours will be different):

e56d2502.0 => /etc/stunnel/stunnel.pem

This should be the file name given to the link stored in /etc/ssl/certs/ folder or better still, if the /etc/stunnel/stunnel.pem file itself is renamed so.

On attempting to use stunnel, you will get the following error:

Wrong permissions on /etc/stunnel/stunnel.pem

This remedied by fixing the permission thus:

chmod 600 /etc/stunnel/stunnel.pem

A file named /etc/stunnel/stunnel.rnd will now have been created. This is the seed for the random number generator.

Server Configuration

We edit the /etc/stunnel/stunnel.conf file in the SERVER and comment out or delete every line leaving only the following in it:

; Certificate/key is needed in server mode and optional in client mode
cert = /etc/stunnel/stunnel.pem

sslVersion = SSLv3
chroot = /var/lib/stunnel4/
setuid = stunnel4
setgid = stunnel4
; PID is created inside chroot jail
pid = /stunnel4.pid

; Some performance tunings
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1

; Service-level configuration

[mysqld]
accept  = 3320
connect = 3306

Client Configuration

We edit the /etc/stunnel/stunnel.conf file in the SERVER:

nano /etc/stunnel/stunnel.conf

and comment out or delete every line leaving only the following in it:

; Certificate/key is needed in server mode and optional in client mode
cert = /etc/stunnel/stunnel.pem

sslVersion = SSLv3
chroot = /var/lib/stunnel4/
setuid = stunnel4
setgid = stunnel4
; PID is created inside chroot jail
pid = /stunnel4.pid
 
; Some performance tunings
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
 
; Use it for client mode
client = yes

; Service-level configuration

[mysqld]
accept  = 3310
connect = 192.168.5.15:3320

Note the presence of the client = yes line in the client config above.

SERVER and CLIENT stunnel Usage

We now edit /etc/default/stunnel making:

ENABLED=1

so that we may run stunnel as a service with default parameters set in the /etc/stunnel/stunnel.conf file.

We now start the stunnel with:

/etc/init.d/stunnel4 start

To stop it:

/etc/init.d/stunnel4 stop

The generic syntax is:

Usage: /etc/init.d/stunnel4 {start|stop|force-reload|restart}

We check the status with:

ps aux | grep stunnel

We should get something like this:

root     25454  0.0  0.0   3860   436 pts/0    S    08:13   0:00 stunnel4 stunnel.conf
root     25455  0.0  0.0   3860   436 pts/0    S    08:13   0:00 stunnel4 stunnel.conf
root     25456  0.0  0.0   3860   436 pts/0    S    08:13   0:00 stunnel4 stunnel.conf
root     25457  0.0  0.0   3860   436 pts/0    S    08:13   0:00 stunnel4 stunnel.conf
root     25458  0.0  0.0   3860   436 pts/0    S    08:13   0:00 stunnel4 stunnel.conf
stunnel4 25460  0.0  0.0   3936   988 ?        Ss   08:13   0:00 stunnel4 stunnel.conf
root     25464  0.0  0.0   1724   548 pts/0    S+   08:13   0:00 grep stunnel

SSH MySQL Client Access

Create a MySQL user (say remoteuser) in the SERVER machine with localhost access and a password and permissions to the databases needed.

On the CLIENT machine we can connect to the MySQL daemon on the SERVER, using:

mysql -h 192.168.5.45 --port=3310 -u remoteuser -p
Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 1005
Server version: 5.0.51a-24+lenny3 (Debian)

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

and disconnect with:

mysql> exit
Bye

If we use localhost instead of the IP (192.168.5.45) in the above mysql connect string, we will get an error like:

inetd mode must define a remote host or an executable

This is peculiar to the OpenVZ Debian template since the localhost is mapped to 127.0.0.1 and not the LAN IP of 192.168.5.45 in the /etc/hosts file as the current LAN IP comes from the OpenVZ template config file at boot time only.

Documentation and Links

• Documentation
• WorldNet Notes
• Linux Gazette Article