HP-UX - Stunnel Configuration

HP-UX - Stunnel Configuration


Stunnel configuration procedure.


The steps outlined below will generate a new private key and certificate request for a host, send the request to the local certificate authority on ${cahost}, then sign and return the request from ${cahost}. Once that is done, the signed certificate is used in the stunnel configuration file to create an encrypted telnet tunnel.

Once the encrypted tunnel is tested/verified, the user will know that stunnel and the certificate are working correctly. After that, it is just a matter of getting the configuration for the Oracle database. This procedure will eliminate two very large variables in the troubleshooting process (stunnel and the certificate).

The additions also include information on the log entries to look for, to verify connectivity.

Compile/install stunnel or ID where it is currently installed. On HP systems, check under /opt/hpws/apache/stunnel/sbin.

Create a directory for the certificates. CD into it.

mkdir -p -m 700 /root/certs; cd $_

Create a private key and cert request. Supply an aribitrary passphrase; we'll remove it later:
openssl req -newkey rsa:1024 -keyout ${host}_private.pem -keyform PEM -out ${host}_req.pem
Generating a 1024 bit RSA private key
writing new private key to '${cahost}_private.pem'
Enter PEM pass phrase: <==== Enter passphrase here
Verifying - Enter PEM pass phrase: <=== Reenter same passphrase here
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:IL
Locality Name (eg, city) []:Naperville
Organization Name (eg, company) [Internet Widgits Pty Ltd]:MYCO
Organizational Unit Name (eg, section) []:IT
Common Name (eg, YOUR name) []:FQDN of the host
Email Address []:YOUR email address

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:Any arbitrary word; it's not used
An optional company name []:MYCO

Send the request to the CA directory on ${cahost}
scp ${host}_req.pem ${cahost}:${caroot}

Sign the certificate.

Log into ${cahost} as root, cd ${caroot}.

The CA needs specific items in the openssl.conf file. Since these entries are not required for normal openssl operation, the user needs to use a different conf file.

export OPENSSL_CONF=${caroot}/openssl.conf

Sign the request:

openssl ca -in ${host}_req.pem
Using configuration from ${caroot}/openssl.conf
Enter pass phrase for ${caroot}/private/cakey.pem: ${passphrase for ${cahost}'s private key}
DEBUG[load_index]: unique_subject = "yes"
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'US'
stateOrProvinceName :PRINTABLE:'IL'
localityName :PRINTABLE:'Naperville'
organizationName :PRINTABLE:'MYCO'
commonName :PRINTABLE:'${cahost}.myco.com'
emailAddress :IA5STRING:'oleary@myco'
Certificate is to be certified until Jul 11 13:54:58 2009 GMT (365 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Version: 3 (0x2)
Serial Number: 3 (0x3)
Signature Algorithm: md5WithRSAEncryption
Issuer: CN=MYCO, ST=IL, C=US/emailAddress=oleary@myco, O=Root Certificate Authority
Not Before: Jul 11 13:54:58 2008 GMT
Not After : Jul 11 13:54:58 2009 GMT
Subject: CN=${cahost}.myco.com, ST=IL, C=US/emailAddress=oleary@myco, O=MYCO, OU=IT
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (1024 bit)
Modulus (1024 bit):
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints:
Signature Algorithm: md5WithRSAEncryption
Data Base Updated

The generic CA puts the newly signed certificates under the ${caroot}/certs directory with a numeric filename. The new key should be the last one modified. ID and copy the newly signed cert back to the target host:

ls -lart ${caroot}/certs | tail -1

scp ${caroot}/certs/##.pem ${host}:/root/certs/${host}_signed.pem

Remove the passphrase from the private key:

Back on the target system, (not ${cahost}) run openssl command to remove the passphrase; update directories and filenames as appropriate:

openssl rsa -in ${host}_private.pem -out ${host}_np_private.pem
Enter pass phrase for ${host}_private.pem: <== Enter passphrase used when creating the key
writing RSA key

mv ${cahost}_np_private.pem ${cahost}_private.pem

Execute stunnel -h to identify where the binary thinks the stunnel.conf file should be. While not mandatory, it may make things easier in the long run to use that default config file.


stunnel [filename] | -help | -version | -sockets
filename - use specified config file instead of /opt/hpws/apache/stunnel/etc/stunnel/stunnel.conf
-help - get config file help
-version - display version and defaults
-sockets - display default socket options

Create a new stunnel.conf. Update directories and filenames as appropriate:
cert = /root/certs/${host}_signed.pem
key = /root/certs/${host}_private.pem
client = no
pid = /var/run/stunnel.pid
# setuid = nobody
# setgid = other

output = /var/run/stunnel.log
# foreground = yes

[ telnet ]
accept = 9999
connect =

Run stunnel. If the user chooses a different location for the stunnel.conf, execute stunnel with the new config file:

stunnel ${config_file}
On another system, that you have access to:
create a new stunnel.conf in a non-standard location with the following information. Update host names and directories as appropriate:
client = yes
pid = /var/run/stunnel.pid

[ telnet ]
accept =
connect = ${host}.myco.com:9999

stunnel ${conf_file}
telnet localhost 9999

The user should be presented with a login prompt to the target host - ${cahost} in this example.

If the user has successfully made it to this point, stunnel is compiled, installed, and configured correctly. The user will need to make additional configuration updates for the Oracle/jdbc connection; however, stunnel and the cert are no longer variables in any troubleshooting exercises.

When all the parties are ready, edit the stunnel config file, comment out the telnet stanza, and update the information as follows. Here is the ascii version of the table below. One note: /var/run, on HPs, tends to be 555 permissions. In order to get the pid file owned by the Oracle ID, I mkdir -p -m 1777 /var/run/stunnel, then update the pid as described below:

Comment Data
Same as test cert = /root/certs/${host}_signed.pem
Same as test key = /root/certs/${host}_private.pem
Same as test client = no
Updated location so oracle user can write to it. pid = /var/run/stunnel/stunnel.pid
Set to the oracle ID of the database in question. setuid = oracle
Set to the group ID of the database in question. setgid = dba
Generic comment # Some debugging stuff useful for troubleshooting
New debug = 7
Choose an appropriate log location; log will be owned by root output = /var/adm/syslog/stunnel.log
New socket = l:TCP_NODELAY=1
New socket = r:TCP_NODELAY=1
Generic comment # Authentication stuff
New verify = 1
Commented out from test # foreground = yes
Comment out the telnet stanza # [ telnet ]
Comment out telnet stanza # accept = 9999
Comment out telnet stanza # connect =

New stanza [ jdbc ]
New stanza: use appropriate port - usually database port + 5000 accept = 51524
New stanza: use appropriate port. connect =

Log entries:
2008.07.22 09:24:16 LOG7[7072:1]: jdbc accepted FD=1 from <=== Where connection's from
2008.07.22 09:24:16 LOG7[7072:1]: FD 1 in non-blocking mode
2008.07.22 09:24:16 LOG7[7072:2]: jdbc started <===== Stanza
2008.07.22 09:24:16 LOG7[7072:2]: TCP_NODELAY option set on local socket
2008.07.22 09:24:16 LOG5[7072:2]: jdbc connected from
Handshake and connection setup
2008.07.22 09:24:16 LOG7[7072:2]: SSL state (accept): before/accept initialization
2008.07.22 09:24:16 LOG7[7072:2]: SSL state (accept): SSLv3 read client hello A
2008.07.22 09:24:16 LOG7[7072:2]: SSL state (accept): SSLv3 write server hello A
2008.07.22 09:24:16 LOG7[7072:2]: SSL state (accept): SSLv3 write certificate A
2008.07.22 09:24:16 LOG7[7072:2]: SSL state (accept): SSLv3 write certificate request A
2008.07.22 09:24:16 LOG7[7072:2]: SSL state (accept): SSLv3 flush data
2008.07.22 09:24:16 LOG7[7072:2]: SSL alert (read): warning: no certificate
2008.07.22 09:24:16 LOG7[7072:2]: SSL state (accept): SSLv3 read client key exchange A
2008.07.22 09:24:16 LOG7[7072:2]: SSL state (accept): SSLv3 read finished A
2008.07.22 09:24:16 LOG7[7072:2]: SSL state (accept): SSLv3 write change cipher spec A
2008.07.22 09:24:16 LOG7[7072:2]: SSL state (accept): SSLv3 write finished A
2008.07.22 09:24:16 LOG7[7072:2]: SSL state (accept): SSLv3 flush data
2008.07.22 09:24:16 LOG7[7072:2]: 1 items in the session cache
2008.07.22 09:24:16 LOG7[7072:2]: 0 client connects (SSL_connect())
2008.07.22 09:24:16 LOG7[7072:2]: 0 client connects that finished
2008.07.22 09:24:16 LOG7[7072:2]: 0 client renegotiatations requested
2008.07.22 09:24:16 LOG7[7072:2]: 1 server connects (SSL_accept())
2008.07.22 09:24:16 LOG7[7072:2]: 1 server connects that finished
2008.07.22 09:24:16 LOG7[7072:2]: 0 server renegotiatiations requested
2008.07.22 09:24:16 LOG7[7072:2]: 0 session cache hits
2008.07.22 09:24:16 LOG7[7072:2]: 0 session cache misses
2008.07.22 09:24:16 LOG7[7072:2]: 0 session cache timeouts
2008.07.22 09:24:16 LOG6[7072:2]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1
Data transfer
2008.07.22 09:24:16 LOG7[7072:2]: FD 2 in non-blocking mode
2008.07.22 09:24:16 LOG7[7072:2]: jdbc connecting
2008.07.22 09:24:16 LOG7[7072:2]: Remote FD=2 initialized
2008.07.22 09:24:16 LOG7[7072:2]: TCP_NODELAY option set on remote socket
2008.07.22 21:26:53 LOG7[7072:2]: SSL socket closed on SSL_read
2008.07.22 21:26:53 LOG5[7072:2]: Connection closed: 4224 bytes sent to SSL, 4242 bytes sent to socket
2008.07.22 21:26:53 LOG7[7072:2]: jdbc finished (0 left)
Connection closed

0 (0)
Article Rating (No Votes)
Rate this article
There are no attachments for this article.
There are no comments for this article. Be the first to post a comment.
Full Name
Email Address
Security Code Security Code
Related Articles RSS Feed
Linux 16 Useful Bandwidth Monitoring Tools to Analyze Network Usage in Linux
Viewed 11143 times since Mon, Sep 21, 2020
Fałszujemy rozpoznania skanerów #1
Viewed 2644 times since Mon, May 21, 2018
stunnel How To Encrypt Traffic to Redis with Stunnel on Ubuntu 16.04
Viewed 1662 times since Sun, Dec 6, 2020
Configuring VLAN interfaces in Linux
Viewed 4772 times since Mon, May 21, 2018
Oracle Linux 7 – How to audit changes to a trusted file such as /etc/passwd or /etc/shadow
Viewed 2546 times since Wed, Jul 25, 2018
OCFS2 Cluster File System Setup Guide in Linux
Viewed 6391 times since Sat, Jun 2, 2018
Linux PAM configuration that allows or deny login via the sshd server
Viewed 1449 times since Wed, Oct 3, 2018
Telnet – Send GET/HEAD HTTP Request
Viewed 2652 times since Mon, Feb 18, 2019
VMWare tools free
Viewed 8038 times since Mon, Jul 16, 2018
logrotate Log Rotate Configuration
Viewed 2811 times since Sun, Jan 12, 2020