How To Set Up an SSL Tunnel Using Stunnel on Ubuntu

The main idea of this tutorial is to give light in order to serve SSL certificaties and converts your HTTP server on HTTPS.

The relationship with this project its because InteractiveSpace only serve HTTP petitions, but we need HTTPS in order to allow the pop-ups that appears when a user would like to interact with mike or cam elements.

Google Chrome allows change many policies like audio/VideoCaptureAllow or Audio/VideoCaptureAllowUrls (here the complet list) but the properties that we needed only works on kiosk mode. So we've decided to use Stunnel to solve this problem.

What’s Stunnel

The Stunnel program is designed to work as an SSL encryption wrapper between remote client and local (inetd-startable) or remote server. It can be used to add SSL functionality to commonly used inetd daemons like POP2, POP3, and IMAP servers without any changes in the program's code.

What Stunnel basically does is that it turns any insecure TCP port into a secure encrypted port using OpenSSL package for cryptography. It’s somehow like a small secure VPN that runs on specific ports.

Step 1: Install Stunnel

First of all update your Ubuntu’s package list and also upgrade the existing packages to the latest version:

apt-get update

apt-get upgrade

Then install Stunnel package using the code below:

apt-get install stunnel4 -y

##Step 2: Create SSL Certificates Stunnel uses SSL certificate to secure its connections, which you can easily create using the OpenSSL package:

 openssl genrsa -out key.pem 2048
 openssl req -new -x509 -key key.pem -out cert.pem -days 1095
 cat key.pem cert.pem >> /etc/stunnel/stunnel.pem

Basically, the commands above is for creating a private key, creating a certificate using that key and combining the two of them into one files named "stunnel.pem" to use with Stunnel.

Note: When creating the certificate, you will be asked for some information such as country and state, which you can enter whatever you like but when asked for "Common Name" you must enter the correct host name or IP address of your InteractiveSpaces Controller or Master.

##Step 3: Configure Stunnel Stunnel configures itself using a file named "stunnel.conf" which by default is located in "/etc/stunnel".

Create a "stunnel.conf" file in the "/etc/stunnel" directory (use sudo):

nano /etc/stunnel/stunnel.conf

We’re going to be using a SSL certificate to identify ourselves to the server so we have to set the path to that certificate in "stunnel.conf" file using this line:

cert = /etc/stunnel/stunnel.pem

Next we specify a service for use with Stunnel. It can be any of the services which use networking such as mail server, proxy server, etc. In our case InteractiveSpaces

After setting a name for the service you’re going to use, you must tell Stunnel to listen on which port for that service. This can be any of the 65535 ports, as long as it’s not blocked by another service or firewall:

[InteractiveSpaces]

accept = 8000

Then depending on the service you’re going to use the secure tunnel on, you must specify the port and IP address of that in the configuration file Basically Stunnel takes packets from a secure port and then forwards it to the port and IP address of the service you specified.

Squid proxy by default runs on localhost and port 3128 so we have to tell Stunnel to forward accepted connections to that port:

connect = 10.0.0.50:9000

So overall the "stunnel.conf" file must contain the lines below:

client = no

[InteractiveSpaces]

accept = 8000

connect = 10.0.0.50:9000

cert = /etc/stunnel/stunnel.pem

Note: The client = no part isn't necessary, Stunnel by default is set to server mode.

Remember that you could be able to add more services because there are lot of example activities that runs on differents ports like routable input/output activities that uses 9001 and 9002 port.

##Step 4: Stunnel startup

Also, enable Stunnel automatic startup by configuring the "/etc/default/stunnel4" file, enter command below to open the file in text editor:

nano /etc/default/stunnel4

And change ENABLED to 1:

ENABLED=1

Finally, restart Stunnel for configuration to take effect, using this command:

/etc/init.d/stunnel4 restart

References

Securing the Insecure with SSL and Creating SSL Tunnels

Stunnel - HowTo

How To Set Up an SSL Tunnel Using Stunnel on Ubuntu