Installing and configuring stunnel in Linux system

Step 1) Installing stunnel by sourcecode

tar zxf stunnel-4.XX.tar.gz

$ cd stunnel-4.XX

$ ./configure

$ make

$ make install   (as root)

Step 2) Enabling stunnel

echo "ENABLED=1" > /etc/default/stunnel

Step 3) Create a user stunnel for port redirection.

useradd  -s /sbin/nologin -M stunnel

Step 4) Creating init script for stunnel

vim /etc/init.d/stunnel

================================================

#! /bin/sh -e

### BEGIN INIT INFO

# chkconfig: 2345 54 26

# description:          stunnel

### END INIT INFO

DEFAULTPIDFILE="/var/run/stunnel.pid"

DAEMON=/usr/bin/stunnel

NAME=stunnel

DESC="SSL tunnels"

FILES="/etc/stunnel/*.conf"

OPTIONS=""

ENABLED=0

get_pids() {

   local file=$1

   if test -f $file; then

     CHROOT=`grep "^chroot" $file|sed "s;.*= *;;"`

     PIDFILE=`grep "^pid" $file|sed "s;.*= *;;"`

     if [ "$PIDFILE" = "" ]; then

       PIDFILE=$DEFAULTPIDFILE

     fi

     if test -f $CHROOT/$PIDFILE; then

       cat $CHROOT/$PIDFILE

     fi

   fi

}

startdaemons() {

  if ! [ -d /var/run/stunnel ]; then

    rm -rf /var/run/stunnel

    install -d -o stunnel -g stunnel /var/run/stunnel

  fi

  for file in $FILES; do

    if test -f $file; then

      ARGS="$file $OPTIONS"

      PROCLIST=`get_pids $file`

      if [ "$PROCLIST" ] && kill -s 0 $PROCLIST 2>/dev/null; then

        echo -n "[Already running: $file] "

      elif $DAEMON $ARGS; then

        echo -n "[Started: $file] "

      else

        echo "[Failed: $file]"

        echo "You should check that you have specified the pid= in you configuration file"

        exit 1

      fi

    fi

  done;

}

killdaemons()

{

  SIGNAL=${1:-TERM}

  for file in $FILES; do

    PROCLIST=`get_pids $file`

    if [ "$PROCLIST" ] && kill -s 0 $PROCLIST 2>/dev/null; then

       kill -s $SIGNAL $PROCLIST

       echo -n "[stopped: $file] "

    fi

  done

}

if [ "x$OPTIONS" != "x" ]; then

  OPTIONS="-- $OPTIONS"

fi

test -f /etc/default/stunnel && . /etc/default/stunnel

if [ "$ENABLED" = "0" ] ; then

  echo "$DESC disabled, see /etc/default/stunnel"

  exit 0

fi

test -x $DAEMON || exit 0

set -e

case "$1" in

  start)

        echo -n "Starting $DESC: "

        startdaemons

        echo "$NAME."

        ;;

  stop)

        echo -n "Stopping $DESC: "

        killdaemons

        echo "$NAME."

        ;;

  reopen-logs)

        echo -n "Reopening log files $DESC: "

        killdaemons USR1

        echo "$NAME."

        ;;

  force-reload|reload)

        echo -n "Reloading configuration $DESC: "

        killdaemons HUP

        echo "$NAME."

        ;; 

  restart)

        echo -n "Restarting $DESC: "

        killdaemons

        sleep 5

        startdaemons

        echo "$NAME."

        ;;

  *)

        N=/etc/init.d/$NAME

        echo "Usage: $N {start|stop|reload|reopen-logs|restart}" >&2

        exit 1

        ;;

esac

exit 0

===============================================

chmod +x /etc/init.d/stunnel

Step 5) Create key and certificate

openssl req -new -x509 -nodes -out cert.pem -keyout cert.key -days 365

Copy the key and certs to server

Step 6) Stunnel server configuration for accepting data on port 11612 and transferring data to port 10051 of local system(192.168.0.5)

vim /etc/stunnel/stunnel.conf

cert = /etc/stunnel/cert.pem

key = /etc/stunnel/cert.key

#Debug - emerg (0), alert (1), crit (2), err (3), warning (4), notice (5), info (6), or debug (7)

debug=1

output=/var/log/stunnel.log

[ZAB_Server]

accept=11612

connect=127.0.0.1:10051

===========================

chown -R stunnel:stunnel /etc/stunnel
service stunnel restart

Note: You could directly use command for this setup as written below

stunnel -P/tmp/ -p /etc/stunnel/cert.pem -d 11612 -r localhost: 10051

Step7)  Stunnel configuration for client for accepting data on port 10052 and transferring data to port 10051 of stunnel server (192.168.0.5)

================================

#cert = /etc/stunnel/cert.pem

client = yes

output = /var/log/stunnel.log

[ZAB]

accept = 10052

connect =192.168.0.5:11612

==================================

chown -R stunnel:stunnel /etc/stunnel
service stunnel restart

Note: You could directly use command for this setup as written below

stunnel -P/tmp/ -c -d 10052 -r 192.168.0.5:11612