FilterHN

Stunnel

75 points

by firesteelrain

9 hours ago

| past

| 5 comments

| stunnel.org

| HN

▲

binaryturtle

26 minutes ago

[-]

Stunnel is an important part of my setup here.

Back when Apple's Mail on a more outdated OS X setup stopped to be able to connect to various mail servers because of Apple's own outdated SSL/TLS implementation (security.framework?) I just plugged stunnel in the middle to make things work again: Mail connects to localhost and stunnel then safely connects to the remote mail server.

While this was an important fix at that time it also provided surprisingly additional benefits. Now it was much easier to entirely block outgoing connections from Mail with Little Snitch. Instead having numerous allow directives per mailserver, just one full block. E.g. no more random config changes that break everything, because Apple decided to push some auto-config changes for well-known mail providers. No more accidental tracking pixel triggers. Also all the accounts are now just vanilla POP3/SMTP accounts rather than those with "special handling". Finally Mail became much more stable for some reason. No more long lockups when I want to open the Account settings, no more random lockups when launching the app, etc.

Now I really do not want to miss this extra layer anymore because all the bonus benefits (even if it shouldn't be needed any longer just to make SSL/TLS work again).

Over time bunch of other things (Mail unrelated) got plugged into the stunnel config too. :)

▲

chasil

5 hours ago

[-]

NFSv4 over stunnel, by yours truly.

https://www.linuxjournal.com/content/encrypting-nfsv4-stunne...

RFC-9289: Towards Remote Procedure Call Encryption

“Special mention goes to Charles Fisher, author of ‘Encrypting NFSv4 with Stunnel TLS’ [LJNL]. His article inspired the mechanism described in this document.”

https://www.rfc-editor.org/info/rfc9289

▲

p0w3n3d

2 hours ago

[-]

Wireguard is the best (I find its great performance an order of magnitude better than tunelling via ssh for example).

I know stunnel serves different purpose, but still why would you need it for your service if you can be in the vpn and speak plaintext?

▲

YPPH

1 minute ago

[-]

[delayed]

▲

krylon

1 hour ago

[-]

I only use it for shell access to machines in my home network, so I cannot remark on performance, but it is also by far the easiest to use VPN solution I've had contact with. Not that I'm an expert in this matter, but setting up Wireguard access was dead simple and it has never given me any trouble since.

▲

tbrownaw

8 hours ago

[-]

Is there anything that isn't horribly outdated that still needs this?

▲

patmcc

6 hours ago

[-]

No joke, it just came up at work as a possible solution to something. We have some legacy systems that talk over TCP in plaintext. It's all within well-secured networks on locked down machines, so fine. But now we want to move things to Megaport, and their agreement says "btw don't put anything in plaintext ever, we guarantee nothing". So stunnel will probably be the fix.

▲

Piraty

52 minutes ago

[-]

I was involved in a very similar situation once. I recommend wireguard for this, it's mature for years, has superb support in linux and some BSDs and there are userspace implementations if you need that. It wraps traffic in UDP, the overhead is much smaller thus throughput mich higher than traditional TCP-based VPN (you want to avoid tcp-in-tcp!). There were once patches posted to lkml that passed QoS-flags from the inner packet to the wireguard packet, if you need that. not sure if that landed upstream in the end. key distribution and lifecycle management is what was still unsolved years back when this was evaluated, nowadays tailscale and its clones and similar oss should serve you well.

▲

nine_k

5 hours ago

[-]

Not wireguard?

▲

pfix

2 hours ago

[-]

Not a security expert and also curious about implications:

I always considered it the best solution to have both: VPN encryption and TLS encryption over the VPN. Different OSI Layers. Different Attack Surfaces.

Not sure if that is a recommended pratice though (see initial remark ;) )

▲

01HNNWZ0MV43FF

4 hours ago

[-]

Maybe they need something that works without root and IP space allocation. I like WireGuard and use it myself but it is a bit of an installation compared to binding a port

▲

eps

1 hour ago

[-]

Stunnel basically allows you to easily secure existing network protocols.

POP3 over stunnel -> SPOP3.

A practical solution, both for legacy components and for the cases when you don't want to deal with implementing TLS natively.

Ultimately, it's very Unix in spirit. Does one specific thing and is composable with others.

▲

ray_v

7 hours ago

[-]

Let me introduce you to software for public library information systems that still thinks it's the 90s!

▲

tingletech

6 hours ago

[-]

wrapping z39.50?

▲

TheFinalDraw

6 hours ago

[-]

The company I work for has used it as a relatively simple method for implementing mutual TLS (mTLS) for legacy apps or systems for which it would otherwise be annoying or more difficult to integrate mTLS for, or which doesn’t support mTLS with custom trust store.

▲

nirui

4 hours ago

[-]

Hmmm... Got me thinking, why must all software implement (and maintain) transport security?

The security standard changes/improves over time. With software like stunnel takes care of it, your software could be practically security wise up-to-day forever as long as you or your user keeps their stunnel updated.

▲

drowsspa

1 hour ago

[-]

That's basically the idea behind zero trust, isn't it? The idea being that you can't even knock on the TCP port if you're not authenticated

▲

01HNNWZ0MV43FF

4 hours ago

[-]

I use Caddy the same way. My web apps aren't allowed to think about TLS, they sit behind Caddy and I'm secure as long as I keep it updated

▲

renewiltord

18 minutes ago

[-]

Allows me to speak SSL and receive mail. I like that. I sign up for a bunch of stuff that I want RSSified. I don’t want to implement SSL. This does the trick.

▲

chasil

4 hours ago

[-]

If you want an encrypted tunnel maintained by inetd or systemd socket activation, then stunnel is easier to use in this context than ssh.

Edit: I put stunnel on port 443 and have it connect to port 80 on my Apache webservers, because I like one way of doing TLS.

This guide has been useful for many years in cipher selection:

https://hynek.me/articles/hardening-your-web-servers-ssl-cip...

▲

creatonez

7 hours ago

[-]

I mean, most web application backends don't implement TLS at all, under the assumption that you're using it alongside a reverse proxy. Most of the time this is nginx, but if you want to ensure no bugs are introduced on the HTTP level by the reverse proxy, stunnel is a perfectly fine option.

▲

boneitis

5 hours ago

[-]

Right! That, or I otherwise encounter some kind of asymmetry where one side, whether it is a client or server, implements/requires speaking TLS whereas the otherside isn't readily equipped to do so.

I've found stunnel a godsend for bridging the gap. Granted, I am more of a sysadmin-ey type where a few times I've had to abruptly/quickly get something up and running.

▲

ectospheno

7 hours ago

[-]

I used it once with althttpd. https://sqlite.org/althttpd/doc/trunk/althttpd.md

▲

ranger_danger

7 hours ago

[-]

I use it to wrap my gstreamer tcp streams in TLS to send them over the internet, but socat can also do the same thing.

▲

TZubiri