STUNNEL(8)

NAME

stunnel - universal SSL tunnel

SYNOPSIS

stunnel [-c][-p pemfile][-v level][-d[ip:]port[-f]] -l program | -r [ip:]port

DESCRIPTION

The stunnel program is designed to work as SSL encryption wrapper between remote client and local (inetd-startable) or remote server. The concept is that having non-SSL aware daemons running on your system you can easily setup them to communicate with clients over secure SSL channel.

stunnel can be used to add SSL functionality to commonly used inetd daemons like POP-2, POP-3 and IMAP servers as well as to standalone daemons like NNTP, SMTP and HTTP without changes to the source code.

This product includes cryptographic software written by Eric Young (eay@cryptsoft.com)

OPTIONS

-c client mode (remote service uses SSL)

default: server mode

-p pemfile certificate (*.pem) file name

default: /usr/lib/ssl/certs/stunnel.pem

-v level verify peer certificate

-d [ip:]port daemon mode (ip defaults to INADDR_ANY)

default: inetd mode

-f foreground mode (don't fork, log to stderr)

default: background in daemon mode

-l program execute local inetd-type program

-r [ip:]port connect to remote daemon

(ip defaults to INADDR_LOOPBACK)

COMMON SSL PORTS

You will need definitions of SSL services in your /etc/services file. Some commonly used SSL services are listed below:

https      443/tcp        # HTTP over SSL
ssmtp      465/tcp        # SMTP over SSL
snews      563/tcp        # NNTP over SSL
ssl-ldap   636/tcp        # LDAP over SSL
simap      993/tcp        # IMAP over SSL
spop3      995/tcp        # POP-3 over SSL

CERTIFICATES

Each SSL enabled daemon needs to present a valid X.509 certificate to the peer. It also needs a private key to decrypt the incoming data. The easiest way to obtain a certificate and a key is to generate the with free SSLeay package. You can find more information on certificates generation on pages listed below.

Two things are important when generating certificate-key pair for stunnel. The private key cannot be encrypted, because the server has no way to obtain password from the user. To produce an unencrypted key add -nodes option when running req command from SSLeay kit.

Order of contents of the .pem file is also important. It should contain unencrypted private key first, then a signed certificate (not certificate request). There should be also empty lines after certificate and private key. Plaintext certificate information appended on the top of generated certificate should be discarded. So the file should look like this:

-----BEGIN RSA PRIVATE KEY-----
[encoded key]
-----END RSA PRIVATE KEY-----
[empty line]
-----BEGIN CERTIFICATE-----
[encoded certificate]
-----END CERTIFICATE-----
[empty line]

LIMITATIONS

stunnel cannot be used for FTP daemon because of the nature of FTP protocol which utilizes multiple ports for data transfers. There are available SSL enabled versions of FTP and telnet daemons, however.

SEE ALSO

ssl (1), tcpd (8), inetd (8)

http://www.psy.uq.oz.au/~ftp/Crypto/ SSLeay FAQ

http://www.camb.opengroup.org/RI/www/prism/wwwj/ overview of SSL certification using SSLeay package

AUTHORS

Michal Trojnara <Michal.Trojnara@centertel.pl>
Adam Hernik <adas@infocentrum.com>
Pawel Krawczyk <kravietz@ceti.com.pl>