guyelsmorepaddock/stunnel repository overview

⁠STunnel Docker Container

From the stunnel website⁠:

⁠Supported Tags and Respective Dockerfile Links

• master (Dockerfile⁠)
• 5.50-beta3, 5.50, 5, latest, stable (Dockerfile⁠)
• 5.50-beta2 (Dockerfile⁠)
• 5.50-beta1, (Dockerfile⁠)

⁠Examples

⁠Allow Local Insecure Clients to Connect to PKI-Secured SSL/TLS Server

These examples show how you would proxy Redis clients that do not support TLS/SSL to a TLS-secured Redis server on Azure (should apply similarly to AWS).

⁠Using the Default Root Certificate Chain

This example uses the default trusted root CA chain from Alpine Linux:

docker run -itd \
    -e STUNNEL_CLIENT=yes \
    -e STUNNEL_SERVICE=redis \
    -e STUNNEL_ACCEPT=6379 \
    -e STUNNEL_CONNECT=myredis.redis.cache.windows.net:6380 \
    -e STUNNEL_CHECK_HOST=myredis.redis.cache.windows.net \
    -e STUNNEL_VERIFY_CHAIN=yes \
    -p 6379:6379 \
    guyelsmorepaddock/stunnel

⁠Using a Custom Root Certificate Chain

This example shows how to provide your own trusted root certificate chain:

docker run -itd \
    -e STUNNEL_CLIENT=yes \
    -e STUNNEL_SERVICE=redis \
    -e STUNNEL_ACCEPT=6379 \
    -e STUNNEL_CONNECT=myredis.redis.cache.windows.net:6380 \
    -e STUNNEL_CHECK_HOST=myredis.redis.cache.windows.net \
    -e STUNNEL_VERIFY_CHAIN=yes \
    -p 6379:6379 \
    -v /etc/ssl/private/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt:ro \
    guyelsmorepaddock/stunnel

This loads the custom certificate chain from /etc/ssl/private/ca-certificates.crt on the host system into /etc/ssl/certs/ca-certificates.crt in the container, which is the default location the container looks for the certificates. The location within the container can be overridden by setting the STUNNEL_CAFILE environment variable.

⁠Wrap Local Server for PKI-Secured SSL/TLS Client Connections

These examples show you would secure an LDAP server running in a container named directory so that clients can connect to it over LDAPS.

⁠Self-signed Certificate

docker run -itd --name ldaps --link directory:ldap \
    -e STUNNEL_SERVICE=ldaps \
    -e STUNNEL_ACCEPT=636 \
    -e STUNNEL_CONNECT=ldap:389 \
    -p 636:636 \
    guyelsmorepaddock/stunnel

This will automatically generate a self-signed certificate that expires in 365 days.

⁠Custom Certificate

docker run -itd --name ldaps --link directory:ldap \
    -e STUNNEL_SERVICE=ldaps \
    -e STUNNEL_ACCEPT=636 \
    -e STUNNEL_CONNECT=ldap:389 \
    -p 636:636 \
    -v /etc/ssl/private/server.key:/etc/stunnel/stunnel.key:ro \
    -v /etc/ssl/private/server.crt:/etc/stunnel/stunnel.pem:ro \
    guyelsmorepaddock/stunnel

This accomplishes the following:

• Loads the server private key from /etc/ssl/private/server.key on the host system into /etc/stunnel/stunnel.key in the container, which is the default location the container looks for the key. The location within the container can be overridden by setting the STUNNEL_KEY environment variable.

• Loads the server certificate from /etc/ssl/private/server.crt on the host system into /etc/stunnel/stunnel.pem in the container, which is the default location the container looks for the certificate. The location within the container can be overridden by setting the STUNNEL_CRT environment variable.

⁠Using a Custom Cipher List

By default, the container configures stunnel to use only ciphers indicated as "Grade A" on the OWASP Cheat Sheet⁠ (as of 2019-01-25).

For a variety of reasons, including a desire for more security, a need for compatibility with legacy systems and/or a delay in getting updates from vendors, this default may not work for everyone's needs.

This example shows how to provide your own list of allowed ciphers:

docker run -itd --name ldaps --link directory:ldap \
    -e STUNNEL_SERVICE=ldaps \
    -e STUNNEL_ACCEPT=636 \
    -e STUNNEL_CONNECT=ldap:389 \
    -e "STUNNEL_CIPHERS=DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA"
    -p 636:636 \
    -v /etc/ssl/private/server.key:/etc/stunnel/stunnel.key:ro \
    -v /etc/ssl/private/server.crt:/etc/stunnel/stunnel.pem:ro \
    guyelsmorepaddock/stunnel

This example switches stunnel to using the "Broad Compatibility (Grade B)" list of ciphers from OWASP (as of 2019-01-25).

⁠Allow Local Insecure Clients to Connect to PSK-Secured Server

This example demonstrates how to connect to a service that as been secured with a pre-shared key (PSK):

docker run -itd \
    -e STUNNEL_CLIENT=yes \
    -e STUNNEL_SERVICE=myservice \
    -e STUNNEL_CONNECT=myservice.net:1234 \
    -e STUNNEL_ACCEPT=6379 \
    -e STUNNEL_PSK=/etc/stunnel/stunnel.psk \
    -v /etc/ssl/private/server.psk:/etc/stunnel/stunnel.psk:ro \
    -p 6379:6379 \
    guyelsmorepaddock/stunnel

⁠Wrap Local Server for PSK-Secured Client Connections

This example demonstrates how to secure a service with a pre-shared key (PSK):

docker run -itd \
    -e STUNNEL_SERVICE=myservice \
    -e STUNNEL_CONNECT=myservice.net:1234 \
    -e STUNNEL_ACCEPT=6379 \
    -e STUNNEL_PSK=/etc/stunnel/stunnel.psk \
    -v /etc/ssl/private/server.psk:/etc/stunnel/stunnel.psk:ro \
    -p 6379:6379 \
    guyelsmorepaddock/stunnel

⁠Copyright Notice