sous-chefs / stunnel

Development repository for the stunnel cookbook

stunnel

Chef cookbook to install and configure stunnel

Maintainers

This cookbook is maintained by the Sous Chefs. The Sous Chefs are a community of Chef cookbook maintainers working together to maintain important cookbooks. If you’d like to know more please visit sous-chefs.org or come chat with us on the Chef Community Slack in #sous-chefs.

Requirements

• Chef 13

Platform Support

• Ubuntu 14.04+
• CentOS 6.9+

Resources

An stunnel_connection resource is provided for defining stunnel connections. As a client:

include_recipe 'stunnel'

stunnel_connection 'random_service' do
  connect "#{rnd_srv_node['ipaddress']}:#{rnd_srv_node['random_service']['port']}"
  accept node['random_service']['local_accept_port']
  notifies :restart, 'service[stunnel]'
end

As a server:

include_recipe 'stunnel::server'

stunnel_connection 'random_service' do
  accept node['random_service']['tunnel_port']
  connect node['random_service']['port']
  notifies :restart, 'service[stunnel]'
end

Attributes

Lots of configurable attributes:

default['stunnel']['install_method'] = 'package'  # the other valid option is 'source'

default['stunnel']['packages'] = %w(stunnel4)
default['stunnel']['service_name'] = 'stunnel4'

default['stunnel']['ssl_dir'] = '/etc/ssl'
default['stunnel']['server_ssl_req']  = "/C=US/ST=Several/L=Locality/O=Example/OU=Operations/CN=#{node['fqdn']}/emailAddress=root@#{node['fqdn']}"
default['stunnel']['cert_fqdn'] = node['fqdn']

default['stunnel']['use_chroot'] = false
default['stunnel']['chroot_path'] = "/usr/var/lib/stunnel"
default['stunnel']['pidfile'] = "/tmp/stunnel.pid"
default['stunnel']['user'] = "root"
default['stunnel']['group'] = "root"
default['stunnel']['ulimit'] = nil # set to a number to add ulimit setting to init script

default['stunnel']['https']['enabled'] = false
default['stunnel']['https']['accept_port'] = "443"
default['stunnel']['https']['connect_port'] = "81"

default['stunnel']['client_mode'] = true

default['stunnel']['fips'] = nil
default['stunnel']['ssl_version'] = 'all'
default['stunnel']['ssl_options'] = 'NO_SSLv2'
default['stunnel']['socket_tunings'] = %w(l:TCP_NODELAY=1 r:TCP_NODELAY=1)
default['stunnel']['compression'] = nil # zlib
default['stunnel']['debug'] = nil # 3
default['stunnel']['output'] = '/var/log/stunnel.log'

# key value pair mapping for default var file
default['stunnel']['default']['enabled'] = 1
default['stunnel']['default']['files'] = '/etc/stunnel/-.conf'
default['stunnel']['default']['options'] = ''

# certificate/key is needed in server mode and optional in client mode
default['stunnel']['certificate_path'] = nil # /etc/pki/stunnel/cert.pem
default['stunnel']['key_path'] = nil # /etc/pki/stunnel/key.pem

FIPS

FIPS mode can be enabled or disabled with the attribute ['stunnel']['fips']. A value of nil will omit the "fips" setting from the config file altogether, falling back to the default behavior for that version of stunnel:

• For 4.x releases FIPS defaults to on if stunnel was compiled with FIPS support.
• For 5.x releases FIPS defaults to off.

ChefSpec Matchers

A set of ChefSpec matchers is included for unit testing with ChefSpec. These are automatically available when you make this cookbook a dependency in your cookbook's metadata. To illustrate:

Recipe code:

stunnel_connection 'haproxy_ssl' do
  accept    '443'
  connect   '8443'
end

And the matching spec:

it 'should create stunnel_connection haproxy_ssl' do
  expect(chef_run).to create_stunnel_connection('haproxy_ssl').with(
    accept:  '443',
    connect: '8443'
  )
end

You can also make assertions for notifying other resources:

it 'should notify stunnel to restart on changes to stunnel_connection[haproxy_ssl]' do
  resource = chef_run.stunnel_connection('haproxy_ssl')
  expect(resource).to notify('service[stunnel]').to(:restart)
end

A matcher for the delete action is also available:

it 'should delete stunnel_connection haproxy_ssl' do
  expect(chef_run).to delete_stunnel_connection('haproxy_ssl')
end

Testing Locally

To run the tests, make sure you've got the latest ChefDK along with Vagrant then you can run chef exec kitchen test which will run the entire test suite on all platforms.

Contributors

This project exists thanks to all the people who contribute.

Backers

Thank you to all our backers!

Sponsors

Support this project by becoming a sponsor. Your logo will show up here with a link to your website.

stunnel's Issues

Unable to restart Stunnel

I am trying to restart my stunnel service on Ubuntu 18.04. But whenever I do restart using systemctl restart stunnel4.service, it fails. But when I do /etc/init.d/stunnel4 restart, it works.

🥞 4.1.0

👩‍🍳 16.8.14

🎩 Ubuntu 18.04. AWS Cloud

Steps To Reproduce

Steps to reproduce the behavior:

1. systemctl restart stunnel4.service -> Fails

🚓 Expected behavior

Stunnel restarting successfully.

🚓 Actual behavior

stunnel4[19673]: [ ] Compression disabled stunnel4[19673]: [ ] Snagged 64 random bytes from /dev/urandom stunnel4[19673]: [!] PRNG seeded with 128 bytes total stunnel4[19673]: [!] PRNG was not seeded with enough random bytes stunnel4[19673]: [!] /etc/stunnel/stunnel.conf:49: "[redis]": Failed to initialize TLS sytemd[1]: stunnel4.service: Control process exited, code=exited status=1 stunnel4[19673]: [Failed: /etc/stunnel/stunnel.conf] stunnel4[19673]: You should check that you have specified the pid= in you configuration file systemd[1]: stunnel4.service: Failed with result 'exit-code'. systemd[1]: Failed to start LSB: Start or stop stunnel 4.x (SSL tunnel for network daemons).

➕ Additional context

As mentioned above, the restart is failing when used with systemctl, but works when I restart with /etc/init.d/stunnel4 restart

Tunnels setup allow MITM attacks because of lack of authentication

See: https://github.com/dnsimple/chef-stunnel/blob/2aefd996299dc18e8887b4bc7c57802a3d5bbf28/templates/default/stunnel.conf.erb#L43-L55

We need to expose these options and do some additional setup; until then we should add a big fat message in the readme about this as 99% are not gonna open the template to inspect every option and notice the commented out section.

Update Changelog

🗣️ Foreword

Thank for taking the time to fill this bug report fully. Without it we may not be able to fix the bug, and the issue may be closed without resolution.

👻 Brief Description

Update all CHANGELOGs to follow standard defined at https://keepachangelog.com/

Issue sprouted from sous-chefs/meta/issues/101. If not applicable then issue should be closed.

Latest version 0.2.5 should be version 2.0.5

In releases the latest available tag is:

https://github.com/hw-cookbooks/stunnel/releases/tag/v0.2.5

Fix ChefSpec matchers to use new method

Consumers of this cookbook in ChefSpec are getting the following deprecation warning:

[DEPRECATION] `ChefSpec::Runner.define_runner_method' is deprecated. It is being used in the stunnel_connection resource matcher. Please use `ChefSpec.define_matcher' instead. (called from spec/unit/recipes/default_spec.rb:15:in `block (3 levels) in <top (required)>')

Update builds to be parallel

🗣️ Foreword

Thank for taking the time to fill this bug report fully. Without it we may not be able to fix the bug, and the issue may be closed without resolution.

👻 Brief Description

As part of our build process we should build each possible operating system separately

1. Ensure you have dokken setup and working:
2. dokken: aliased to KITCHEN_LOCAL_YAML=kitchen.dokken.yml kitchen
3. run dokken list, you should see a list of builds with dokken as the provider
4. download: https://github.com/sous-chefs/repo-management/blob/master/scripts/circleci_maker.rb and make this executable
5. run: dokken list -j | ./circleci_maker.rb > .circleci/config.yml

Issue sprouted from sous-chefs/meta/issues/112. If not applicable then issue should be closed.

Poor default location for stunnel.pid

The default location for the stunnel pidfile is /tmp which gets removed by most distributions /tmp cleanup, causing chef to fail after several days when this file gets removed.

Chef fails with:

STDOUT: Starting SSL tunnels: [Failed: /etc/stunnel/stunnel.conf] You should check that you have specified the pid= in you configuration file

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• Update sous-chefs/.github action to v3.1.0
• Update Actions (major) (actions/stale, actionshub/chef-install)

Detected dependencies

github-actions

.github/workflows/ci.yml

• sous-chefs/.github 3.0.0
• actions/checkout v4
• actionshub/chef-install 2.0.4
• actionshub/test-kitchen 2.1.0

.github/workflows/stale.yml

• actions/stale v8

---

• Check this box to trigger a request for Renovate to run again on this repository

Dangerfile should use failure instead of fail

🗣️ Foreword

Thank for taking the time to fill this bug report fully. Without it we may not be able to fix the bug, and the issue may be closed without resolution.

👻 Brief Description

On the repo, ensure that Dangerfile matches https://github.com/sous-chefs/repo-management/blob/master/Dangerfile

Issue sprouted from sous-chefs/meta/issues/110. If not applicable then issue should be closed.

Remove .rubocop.yml with Dangerfile

🗣️ Foreword

Thank for taking the time to fill this bug report fully. Without it we may not be able to fix the bug, and the issue may be closed without resolution.

👻 Brief Description

If the only thing in the .rubocop/yml is Dangerfile
Run the latest cookstyle
Remove .rubpopo.yml

Issue sprouted from sous-chefs/meta/issues/108. If not applicable then issue should be closed.

Run latest cookstyle

🗣️ Foreword

Thank for taking the time to fill this bug report fully. Without it we may not be able to fix the bug, and the issue may be closed without resolution.

👻 Brief Description

Chef have released updated cookstyle rules, we should therefore run the auto fix against the cookbook

1. Ensure you are on the latest stable chef-workstation
2. Run cookstyle -a

Issue sprouted from sous-chefs/meta/issues/111. If not applicable then issue should be closed.