source: postlfs/security/stunnel.xml@ 0ef1837

10.0 10.1 11.0 6.0 6.1 6.2 6.2.0 6.2.0-rc1 6.2.0-rc2 6.3 6.3-rc1 6.3-rc2 6.3-rc3 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 ken/refactor-virt krejzi/svn lazarus nosym perl-modules qt5new systemd-11177 systemd-13485 trunk xry111/git-date xry111/git-date-for-trunk xry111/git-date-test
Last change on this file since 0ef1837 was 0ef1837, checked in by Randy McMurchy <randy@…>, 17 years ago

Updated to Stunnel-4.07, fixed typos in Ruby instructions

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@3193 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 8.8 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN"
3 "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY stunnel-download-http "http://www.stunnel.org/download/stunnel/src/stunnel-&stunnel-version;.tar.gz">
8 <!ENTITY stunnel-download-ftp "ftp://ftp.fu-berlin.de/unix/linux/mirrors/gentoo/distfiles/stunnel-&stunnel-version;.tar.gz">
9 <!ENTITY stunnel-size "486 KB">
10 <!ENTITY stunnel-buildsize "3.9 MB">
11 <!ENTITY stunnel-time "0.11 SBU">
12]>
13
14<sect1 id="stunnel-package" xreflabel="Stunnel-&stunnel-version;">
15<sect1info>
16<othername>$LastChangedBy$</othername>
17<date>$Date$</date>
18</sect1info>
19<?dbhtml filename="stunnel.html"?>
20<title>Stunnel-&stunnel-version;</title>
21<indexterm zone="stunnel-package">
22<primary sortas="a-Stunnel">Stunnel</primary></indexterm>
23
24<sect2>
25<title>Introduction to <application>Stunnel</application></title>
26
27<para>The <application>Stunnel</application> package contains a program that
28allows you to encrypt arbitrary <acronym>TCP</acronym> connections inside
29<acronym>SSL</acronym> (Secure Sockets Layer) so you can easily communicate
30with clients over secure channels. <application>Stunnel</application> can be
31used to add <acronym>SSL</acronym> functionality to commonly used Inetd
32daemons like <acronym>POP</acronym>-2, <acronym>POP</acronym>-3, and
33<acronym>IMAP</acronym> servers, to standalone daemons like
34<acronym>NNTP</acronym>, <acronym>SMTP</acronym> and <acronym>HTTP</acronym>,
35and in tunneling <acronym>PPP</acronym> over network sockets without changes
36to the server package source code.</para>
37
38<sect3><title>Package information</title>
39<itemizedlist spacing="compact">
40<listitem><para>Download (HTTP):
41<ulink url="&stunnel-download-http;"/></para></listitem>
42<listitem><para>Download (FTP):
43<ulink url="&stunnel-download-ftp;"/></para></listitem>
44<listitem><para>Download size:
45&stunnel-size;</para></listitem>
46<listitem><para>Estimated disk space required:
47&stunnel-buildsize;</para></listitem>
48<listitem><para>Estimated build time:
49&stunnel-time;</para></listitem></itemizedlist>
50</sect3>
51
52<sect3><title><application>Stunnel</application> dependencies</title>
53<sect4><title>Required</title>
54<para><xref linkend="openssl"/></para>
55</sect4>
56
57<sect4><title>Optional</title>
58<para><xref linkend="tcpwrappers"/></para>
59</sect4>
60</sect3>
61
62</sect2>
63
64<sect2>
65<title>Installation of <application>Stunnel</application></title>
66
67<para>The <command>stunnel</command> daemon will be run in a
68<command>chroot</command> jail by an unprivileged user. Create the new user,
69group and <command>chroot</command> home directory structure using the
70following commands:</para>
71
72<screen><userinput><command>groupadd stunnel &amp;&amp;
73useradd -c "Stunnel Daemon" -d /var/lib/stunnel -g stunnel -s /bin/false stunnel &amp;&amp;
74install -d -m 700 -o stunnel -g stunnel /var/lib/stunnel/run</command></userinput></screen>
75
76<note><para>A signed <acronym>SSL</acronym> Certificate and a Private Key is
77necessary to run the <command>stunnel</command> daemon. If you own, or have
78already created a signed <acronym>SSL</acronym> Certificate you wish to use,
79copy it to <filename>tools/stunnel.pem</filename> in the source directory
80before starting the build, otherwise you will be prompted to create one. The
81<filename>.pem</filename> file must be formatted as shown below:</para>
82
83<screen>-----BEGIN RSA PRIVATE KEY-----
84<replaceable>[many encrypted lines of unencrypted key]</replaceable>
85-----END RSA PRIVATE KEY-----
86-----BEGIN CERTIFICATE-----
87<replaceable>[many encrypted lines of certificate]</replaceable>
88-----END CERTIFICATE-----</screen></note>
89
90<para>Install <application>Stunnel</application> by running the following
91commands:</para>
92
93<screen><userinput><command>./configure --prefix=/usr --sysconfdir=/etc \
94 --localstatedir=/var/lib/stunnel &amp;&amp;
95make &amp;&amp;
96make install</command></userinput></screen>
97
98</sect2>
99
100<sect2>
101<title>Command explanations</title>
102
103<para><parameter>--sysconfdir=/etc</parameter>: This parameter forces the
104configuration directory to <filename class='directory'>/etc</filename> instead
105of <filename class='directory'>/usr/etc</filename>.</para>
106
107<para><parameter>--localstatedir=/var/lib/stunnel</parameter>: This parameter
108causes the installation process to create
109<filename class='directory'>/var/lib/stunnel/stunnel</filename> instead of
110<filename class='directory'>/usr/var/stunnel</filename>.</para>
111
112<para><command>make</command>: This command builds the package and, if you
113did not copy an <filename>stunnel.pem</filename> file to the source
114<filename class='directory'>tools/</filename> directory, prompts you for the
115necessary information to create one. Ensure you reply to the</para>
116
117<screen><computeroutput>Common Name (FQDN of your server) [localhost]:</computeroutput></screen>
118
119<para>prompt with the name or <acronym>IP</acronym> address you will be using
120to access the service.</para>
121
122</sect2>
123
124<sect2>
125<title>Configuring <application>Stunnel</application></title>
126
127<sect3><title>Config files</title>
128<para><filename id="stunnel.conf">/etc/stunnel/stunnel.conf</filename></para>
129<indexterm zone="stunnel-package stunnel.conf">
130<primary sortas="e-stunnel.conf">stunnel.conf</primary></indexterm>
131</sect3>
132
133<sect3><title>Configuration Information</title>
134
135<para>Create a basic <filename>/etc/stunnel/stunnel.conf</filename>
136configuration file using the following commands:</para>
137
138<screen><userinput><command>cat &gt;/etc/stunnel/stunnel.conf &lt;&lt; "EOF"</command>
139# File: /etc/stunnel/stunnel.conf
140
141pid = /run/stunnel.pid
142chroot = /var/lib/stunnel
143client = no
144setuid = stunnel
145setgid = stunnel
146
147<command>EOF</command></userinput></screen>
148
149<para>Next, you need to add the service you wish to encrypt to the
150configuration file. The format is as follows:</para>
151
152<screen><userinput>[<replaceable>[service]</replaceable>]
153accept = <replaceable>[hostname:portnumber]</replaceable>
154connect = <replaceable>[hostname:portnumber]</replaceable></userinput></screen>
155
156<para>If you use <application>Stunnel</application> to encrypt a daemon
157started from <command>[x]inetd</command>, you may need to disable that daemon
158in the <filename>/etc/[x]inetd.conf</filename> file and enable a corresponding
159<replaceable>[service]</replaceable>_stunnel service. You may have to add an
160appropriate entry in <filename>/etc/services</filename> as well.</para>
161
162<para>For a full explanation of the commands and syntax used in the
163configuration file, run <command>man stunnel</command>. To see a
164<acronym>BLFS</acronym> example of an actual setup of an
165<command>stunnel</command> encrypted service, read the
166<acronym>SWAT</acronym> configuration section in the <xref linkend="samba3"/>
167instructions.</para>
168
169<para>To automatically start the <command>stunnel</command> daemon when the
170system is rebooted, install the
171<filename id="stunnel.init">/etc/rc.d/init.d/stunnel</filename>
172bootscript from the <xref linkend="intro-important-bootscripts"/>
173package.</para>
174<indexterm zone="stunnel-package stunnel.init">
175<primary sortas="f-stunnel.init">stunnel</primary></indexterm>
176
177<screen><userinput><command>make install-stunnel</command></userinput></screen>
178</sect3>
179
180</sect2>
181
182<sect2>
183<title>Contents</title>
184<segmentedlist>
185<segtitle>Installed Program</segtitle>
186<segtitle>Installed Script</segtitle>
187<segtitle>Installed Library</segtitle>
188<segtitle>Installed Directories</segtitle>
189<seglistitem>
190<seg>stunnel</seg>
191<seg>stunnel3</seg>
192<seg>libstunnel.so</seg>
193<seg>/etc/stunnel, /var/lib/stunnel and
194/usr/share/doc/stunnel</seg></seglistitem>
195</segmentedlist>
196
197<variablelist>
198<bridgehead renderas="sect3">Short Descriptions</bridgehead>
199<?dbfo list-presentation="list"?>
200
201<varlistentry id="stunnel">
202<term><command>stunnel</command></term>
203<listitem><para> is a program designed to work as an <acronym>SSL</acronym>
204encryption wrapper between remote clients and local
205(<command>[x]inetd</command>-startable) or remote servers.</para>
206<indexterm zone="stunnel-package stunnel">
207<primary sortas="b-stunnel">stunnel</primary></indexterm>
208</listitem>
209</varlistentry>
210
211<varlistentry id="stunnel3">
212<term><command>stunnel3</command></term>
213<listitem><para>is a <application>Perl</application> wrapper script to use
214<command>stunnel</command> 3.x syntax with <command>stunnel</command>
215>=4.05.</para>
216<indexterm zone="stunnel-package stunnel3">
217<primary sortas="d-stunnel3">stunnel3</primary></indexterm>
218</listitem>
219</varlistentry>
220
221<varlistentry id="libstunnel.so">
222<term><filename class='libraryfile'>libstunnel.so</filename></term>
223<listitem><para> contains the <acronym>API</acronym> functions required by
224<application>Stunnel</application>.</para>
225<indexterm zone="stunnel-package libstunnel.so">
226<primary sortas="c-libstunnel.so">libstunnel.so</primary></indexterm>
227</listitem>
228</varlistentry>
229</variablelist>
230
231</sect2>
232
233</sect1>
234
Note: See TracBrowser for help on using the repository browser.