Stunnel degub how to#
Stunnel degub manual#

Normally the File daemon will contact the Storage daemon on port 9103 (supplied by the Director), so we need an stunnel that listens on port 9103 on the File daemon's machine, encrypts the data and sends it to the Storage daemon. The connection between the Director and the File daemon is simply a control channel used to start the job and get the job status.

In fact, in a minimalist solution, this is the only connection that needs to be encrypted, because it is the one that transports your data. That is the connection between the File daemon and the Storage daemon, which takes place on port 9103. To simplify things a bit, let's for the moment consider only the data channel.

Stunnel degub how to#

See below for how to create a self-signed certificate. Having a CA signed certificate is highly recommended if you are using your client across the Internet, otherwise you are exposed to the man in the middle attack and hence loss of your data. If you want your clients to verify that the server is in fact valid (Stunnel 2 and Stunnel 3), you will need to have the server certificates signed by a CA (Certificate Authority), and you will need to have the CA's public certificate (contains the CA's public key). You may create this certificate yourself in which case, it will be self-signed, or you may have it signed by a CA. It is possible to keep the two in separate files, but normally, you keep them in one single. In order for stunnel to function as a server, which it does in our diagram for Stunnel 1 and Stunnel 4, you must have a certificate and the key. Don't worry about all the details of the port numbers and such for the moment. Since pictures usually help a lot, here is an overview of what we will be doing. None of the other conf files need to be changed. To accomplish this, we will need to construct four separate conf files for stunnel, and we will need to make some minor modifications to the Director's conf file.

This may sound a bit complicated, but it really isn't. The encryption is accomplished between the Director and the File daemon by using an stunnel on the Director's machine (server) to encrypt the data and to contact an stunnel on the File daemon's machine (client), which decrypts the data and passes it to the client.Д«etween the File daemon and the Storage daemon, we use an stunnel on the File daemon's machine to encrypt the data and another stunnel on the Storage daemon's machine to decrypt the data.ДЄs a consequence, there are actually four copies of stunnel running, two on the server and two on the client. listens for the Director to contact it), and the Storage daemon is a server to the File daemon. This is the typical server/client view of the world, the File daemon is a server to the Director (i.e. The File daemon then contacts the Storage daemon using the address and port parameters supplied by the Director. This example was developed between two Linux machines running stunnel version 4.04-4 on a Red Hat Enterprise 3.0 system.ДЇirst, you must know that with the standard Bacula configuration, the Director will contact the File daemon on port 9102. Although the details may be slightly different, the same principles apply whether you are encrypting between Unix, Linux, or Win32 machines. We assume the Director and the Storage daemon are running on one machine that will be called server and the Client or File daemon is running on a different machine called client. This chapter will show you how to use stunnel to encrypt communications to your client programs. Without too much effort, it is possible to encrypt the communications between any of the daemons.

Stunnel degub manual#

Please see the TLSCommEncryptionmainchapter of the Bacula Enterprise Main Manual if you are using Bacula 1.37 or greater. Prior to version 1.37, Bacula did not have built-in communications encryption.

Using stunnel to Encrypt to a Second Client.

Starting and Testing the Control Channel.

Stunnel Configuration for the Control Channel.

Starting and Testing the Data Encryption.Stunnel Configuration for the Data Channel.Next: Bacula Projects Up: Miscellaneous Guide Previous: Variable Expansion Contents Index