Setting up encrypted tunnel using stunnel

Setting up encrypted tunnel using stunnel

To implement encrypted communication between Redis masters and slaves, we recommend using stunnel. Stunnel works as TLS encryption wrapper between client and server.

This step-by-step tutorial will explain how to install and configure stunnel proxies on FreeBSD client and server. Configuration procedures for other operating systems are very similar. For simplicity, this tutorial only covers replication to one client host as this configuration does not require individual preshared keys for each of the clients.

Assuming we have 3 Redis instances on both server and client, listening sockets on the server (master side):

instanceRedis socketstunnel socket
redis localhost:6379 -
bayes localhost:6378 master.example.com:6478
fuzzy localhost:6377 master.example.com:6477

As the instance named redis should not be mirrored, we will replicate fuzzy and bayes instances. So we need to setup 2 TLS tunnels.

Installation

First install the security/stunnel package:

# pkg install stunnel

Create pid-file directory:

# mkdir /var/run/stunnel && chown stunnel:stunnel /var/run/stunnel

To enable stunnel add the following lines to the /etc/rc.conf:

stunnel_enable="YES"
stunnel_pidfile="/var/run/stunnel/stunnel.pid"

Server configuration (master side)

/usr/local/etc/stunnel/stunnel.conf:

setuid = stunnel
setgid = nogroup

pid = /var/run/stunnel/stunnel.pid

[bayes]
accept  = 6478
connect = 6378
ciphers = PSK
PSKsecrets = /usr/local/etc/stunnel/psk.txt

[fuzzy]
accept  = 6477
connect = 6377
ciphers = PSK
PSKsecrets = /usr/local/etc/stunnel/psk.txt

Client configuration (slave side)

/usr/local/etc/stunnel/stunnel.conf:

setuid = stunnel
setgid = nogroup

pid = /var/run/stunnel/stunnel.pid

[bayes]
client = yes
accept  = localhost:6478
connect = master.example.com:6478
ciphers = PSK
PSKsecrets = /usr/local/etc/stunnel/psk.txt

[fuzzy]
client = yes
accept  = localhost:6477
connect = master.example.com:6477
ciphers = PSK
PSKsecrets = /usr/local/etc/stunnel/psk.txt

Preshared keys

Create /usr/local/etc/stunnel/psk.txt . The psk.txt file contains one line for each client:

test1:oaP4EishaeSaishei6rio6xeeph3az

Do not use example passwords.

As both bayes and fuzzy Redis instances located at the same host we can share the same key between them.

Since this file should be kept secret set secure permissions on it:

# chmod 600 /usr/local/etc/stunnel/psk.txt

Starting stunnel

# service stunnel start

Testing

From the client host use the redis-cli utility to connect to the remote instances:

0 (0)
Article Rating (No Votes)
Rate this article
Attachments
There are no attachments for this article.
Comments
There are no comments for this article. Be the first to post a comment.
Full Name
Email Address
Security Code Security Code
Related Articles RSS Feed
An easier way to manage disk decryption at boot with Red Hat Enterprise Linux 7.5 using NBDE
Viewed 3184 times since Mon, Aug 6, 2018
Super Grub2 Disk
Viewed 1094 times since Wed, May 22, 2019
RHEL: Manually encrypting a filesystem with LUKS
Viewed 1491 times since Sun, May 27, 2018
RHEL: Enabling standard ftp/telnet
Viewed 1391 times since Sun, May 27, 2018
HowTo: Find Out Hard Disk Specs / Details on Linux
Viewed 1015 times since Mon, Jan 28, 2019
RHCS6: Extend an existing Logical Volume / GFS2 filesystem
Viewed 1262 times since Sun, Jun 3, 2018
LVM: Mount LVM Partition(s) in Rescue Mode
Viewed 1509 times since Sat, Jun 2, 2018
stunnel Howto A Guide to create SSL access to a HTTP-only webserver with stunnel
Viewed 835 times since Fri, Sep 28, 2018
RHEL: What is "SysRq key" and how to use it
Viewed 2064 times since Sat, Jun 2, 2018
RHEL: GPT/MBR partition tables (using disks larger than 2 TiB)
Viewed 1754 times since Sun, May 27, 2018