5 ms·

Is there anything that isn't horribly outdated that still needs this?

by tbrownaw 9mo ago

ranger_danger 9mo ago
I use it to wrap my gstreamer tcp streams in TLS to send them over the internet, but socat can also do the same thing.
ray_v 9mo ago
Let me introduce you to software for public library information systems that still thinks it's the 90s!
- tingletech 9mo ago
  wrapping z39.50?
creatonez 9mo ago
I mean, most web application backends don't implement TLS at all, under the assumption that you're using it alongside a reverse proxy. Most of the time this is nginx, but if you want to ensure no bugs are introduced on the HTTP level by the reverse proxy, stunnel is a perfectly fine option.
- boneitis 9mo ago
  Right! That, or I otherwise encounter some kind of asymmetry where one side, whether it is a client or server, implements/requires speaking TLS whereas the otherside isn't readily equipped to do so. I've found stunnel a godsend for bridging the gap. Granted, I am more of a sysadmin-ey type where a few times I've had to abruptly/quickly get something up and running.
ectospheno 9mo ago
I used it once with althttpd. https://sqlite.org/althttpd/doc/trunk/althttpd.md https://sqlite.org/althttpd/doc/trunk/althttpd.md
- hwj 9mo ago
  Another Althttpd user here. Being able to write a "microservice" just by making a file executable is awesome.
patmcc 9mo ago
No joke, it just came up at work as a possible solution to something. We have some legacy systems that talk over TCP in plaintext. It's all within well-secured networks on locked down machines, so fine. But now we want to move things to Megaport, and their agreement says "btw don't put anything in plaintext ever, we guarantee nothing". So stunnel will probably be the fix.
- nine_k 9mo ago
  Not wireguard?
  - 01HNNWZ0MV43FF 9mo ago
    Maybe they need something that works without root and IP space allocation. I like WireGuard and use it myself but it is a bit of an installation compared to binding a port
  - pfix 9mo ago
    Not a security expert and also curious about implications: I always considered it the best solution to have both: VPN encryption and TLS encryption over the VPN. Different OSI Layers. Different Attack Surfaces. Not sure if that is a recommended pratice though (see initial remark ;) )
- Piraty 9mo ago
  I was involved in a very similar situation once. I recommend wireguard for this, it's mature for years, has superb support in linux and some BSDs and there are userspace implementations if you need that. It wraps traffic in UDP, the overhead is much smaller thus throughput mich higher than traditional TCP-based VPN (you want to avoid tcp-in-tcp!). There were once patches posted to lkml that passed QoS-flags from the inner packet to the wireguard packet, if you need that. not sure if that landed upstream in the end. key distribution and lifecycle management is what was still unsolved years back when this was evaluated, nowadays tailscale and its clones and similar oss should serve you well.
- danlitt 9mo ago
  This is cool, but "legacy systems that talk over TCP in plaintext" sounds like it might qualify for "horribly outdated", no?
TheFinalDraw 9mo ago
The company I work for has used it as a relatively simple method for implementing mutual TLS (mTLS) for legacy apps or systems for which it would otherwise be annoying or more difficult to integrate mTLS for, or which doesn’t support mTLS with custom trust store.
- ephaeton 9mo ago
  same here. This thing is gold for "80% solutions" in that respect. It's easier to sanely integrate with legacy transport protocols than trying to update the legacy code base to implement mutual trust the harder, more direct and more error-prone way, IMO.
chasil 9mo ago
If you want an encrypted tunnel maintained by inetd or systemd socket activation, then stunnel is easier to use in this context than ssh. Edit: I put stunnel on port 443 and have it connect to port 80 on my Apache webservers, because I like one way of doing TLS. This guide has been useful for many years in cipher selection: https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/ https://hynek.me/articles/hardening-your-web-servers-ssl-cip...
nirui 9mo ago
Hmmm... Got me thinking, why must all software implement (and maintain) transport security? The security standard changes/improves over time. With software like stunnel takes care of it, your software could be practically security wise up-to-day forever as long as you or your user keeps their stunnel updated.
- 01HNNWZ0MV43FF 9mo ago
  I use Caddy the same way. My web apps aren't allowed to think about TLS, they sit behind Caddy and I'm secure as long as I keep it updated
- drowsspa 9mo ago
  That's basically the idea behind zero trust, isn't it? The idea being that you can't even knock on the TCP port if you're not authenticated
- TheCondor 9mo ago
  As someone that has built security applications for most of this century, I can confidently say that when you make security the problem of one device, system, team or entity that it results in insecurity. It might satisfy some auditors but that’s about it. The most obvious issue is that if any system is compromised, then the attacker can potentially sniff traffic and they are all effectively compromised. The next one, and it’s really key to TLS, is that the app you are proxying probably has an opinion or desired behavior when things can’t be authenticated or are improper. Someone reading you blog and the cert is a day old? Probably not super risky to let them read it. Logging in to the mail server and the keys are bad? You might want the server to just block that. For like a home lab situation or kind of toy systems? These tools are great, I’ve used stunned more than a few times to hack things together
TZubiri 9mo ago
Is there any other way to do this? Just slap an HTTPS proxy on top of an pure HTTP server. It's simpler to debug and understand. Otherwise you need to learn how to slap SSL onto 10 different HTTP things.
eps 9mo ago
Stunnel basically allows you to easily secure existing network protocols. POP3 over stunnel -> SPOP3. A practical solution, both for legacy components and for the cases when you don't want to deal with implementing TLS natively. Ultimately, it's very Unix in spirit. Does one specific thing and is composable with others.
renewiltord 9mo ago
Allows me to speak SSL and receive mail. I like that. I sign up for a bunch of stuff that I want RSSified. I don’t want to implement SSL. This does the trick.

Is there anything that isn't horribly outdated that still needs this?

ranger_danger 9mo ago

I use it to wrap my gstreamer tcp streams in TLS to send them over the internet, but socat can also do the same thing.

ray_v 9mo ago

Let me introduce you to software for public library information systems that still thinks it's the 90s!

tingletech 9mo ago
wrapping z39.50?

creatonez 9mo ago

I mean, most web application backends don't implement TLS at all, under the assumption that you're using it alongside a reverse proxy. Most of the time this is nginx, but if you want to ensure no bugs are introduced on the HTTP level by the reverse proxy, stunnel is a perfectly fine option.

boneitis 9mo ago
Right! That, or I otherwise encounter some kind of asymmetry where one side, whether it is a client or server, implements/requires speaking TLS whereas the otherside isn't readily equipped to do so. I've found stunnel a godsend for bridging the gap. Granted, I am more of a sysadmin-ey type where a few times I've had to abruptly/quickly get something up and running.

ectospheno 9mo ago

I used it once with althttpd. https://sqlite.org/althttpd/doc/trunk/althttpd.md https://sqlite.org/althttpd/doc/trunk/althttpd.md

hwj 9mo ago
Another Althttpd user here. Being able to write a "microservice" just by making a file executable is awesome.

patmcc 9mo ago

No joke, it just came up at work as a possible solution to something. We have some legacy systems that talk over TCP in plaintext. It's all within well-secured networks on locked down machines, so fine. But now we want to move things to Megaport, and their agreement says "btw don't put anything in plaintext ever, we guarantee nothing". So stunnel will probably be the fix.

nine_k 9mo ago
Not wireguard?
- 01HNNWZ0MV43FF 9mo ago
  Maybe they need something that works without root and IP space allocation. I like WireGuard and use it myself but it is a bit of an installation compared to binding a port
- pfix 9mo ago
  Not a security expert and also curious about implications: I always considered it the best solution to have both: VPN encryption and TLS encryption over the VPN. Different OSI Layers. Different Attack Surfaces. Not sure if that is a recommended pratice though (see initial remark ;) )
Piraty 9mo ago
I was involved in a very similar situation once. I recommend wireguard for this, it's mature for years, has superb support in linux and some BSDs and there are userspace implementations if you need that. It wraps traffic in UDP, the overhead is much smaller thus throughput mich higher than traditional TCP-based VPN (you want to avoid tcp-in-tcp!). There were once patches posted to lkml that passed QoS-flags from the inner packet to the wireguard packet, if you need that. not sure if that landed upstream in the end. key distribution and lifecycle management is what was still unsolved years back when this was evaluated, nowadays tailscale and its clones and similar oss should serve you well.
danlitt 9mo ago
This is cool, but "legacy systems that talk over TCP in plaintext" sounds like it might qualify for "horribly outdated", no?

TheFinalDraw 9mo ago

The company I work for has used it as a relatively simple method for implementing mutual TLS (mTLS) for legacy apps or systems for which it would otherwise be annoying or more difficult to integrate mTLS for, or which doesn’t support mTLS with custom trust store.

ephaeton 9mo ago
same here. This thing is gold for "80% solutions" in that respect. It's easier to sanely integrate with legacy transport protocols than trying to update the legacy code base to implement mutual trust the harder, more direct and more error-prone way, IMO.

chasil 9mo ago

If you want an encrypted tunnel maintained by inetd or systemd socket activation, then stunnel is easier to use in this context than ssh. Edit: I put stunnel on port 443 and have it connect to port 80 on my Apache webservers, because I like one way of doing TLS. This guide has been useful for many years in cipher selection: https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/ https://hynek.me/articles/hardening-your-web-servers-ssl-cip...

nirui 9mo ago

Hmmm... Got me thinking, why must all software implement (and maintain) transport security? The security standard changes/improves over time. With software like stunnel takes care of it, your software could be practically security wise up-to-day forever as long as you or your user keeps their stunnel updated.

01HNNWZ0MV43FF 9mo ago
I use Caddy the same way. My web apps aren't allowed to think about TLS, they sit behind Caddy and I'm secure as long as I keep it updated
drowsspa 9mo ago
That's basically the idea behind zero trust, isn't it? The idea being that you can't even knock on the TCP port if you're not authenticated
TheCondor 9mo ago
As someone that has built security applications for most of this century, I can confidently say that when you make security the problem of one device, system, team or entity that it results in insecurity. It might satisfy some auditors but that’s about it. The most obvious issue is that if any system is compromised, then the attacker can potentially sniff traffic and they are all effectively compromised. The next one, and it’s really key to TLS, is that the app you are proxying probably has an opinion or desired behavior when things can’t be authenticated or are improper. Someone reading you blog and the cert is a day old? Probably not super risky to let them read it. Logging in to the mail server and the keys are bad? You might want the server to just block that. For like a home lab situation or kind of toy systems? These tools are great, I’ve used stunned more than a few times to hack things together

TZubiri 9mo ago

Is there any other way to do this? Just slap an HTTPS proxy on top of an pure HTTP server. It's simpler to debug and understand. Otherwise you need to learn how to slap SSL onto 10 different HTTP things.

eps 9mo ago

Stunnel basically allows you to easily secure existing network protocols. POP3 over stunnel -> SPOP3. A practical solution, both for legacy components and for the cases when you don't want to deal with implementing TLS natively. Ultimately, it's very Unix in spirit. Does one specific thing and is composable with others.

renewiltord 9mo ago

Allows me to speak SSL and receive mail. I like that. I sign up for a bunch of stuff that I want RSSified. I don’t want to implement SSL. This does the trick.