dweomer/dockerfiles-stunnel

secure services with stunnel

dweomer/stunnel

Stunnel on Alpine

To secure an LDAP container named directory:

docker run -itd --name ldaps --link directory:ldap \
        -e STUNNEL_SERVICE=ldaps \
        -e STUNNEL_ACCEPT=636 \
        -e STUNNEL_CONNECT=ldap:389 \
        -p 636:636 \
#       -v /etc/ssl/private/server.key:/etc/stunnel/stunnel.key:ro \
#       -v /etc/ssl/private/server.crt:/etc/stunnel/stunnel.pem:ro \
    dweomer/stunnel

Copyright Notice

The MIT License (MIT)

Copyright © 2015-2023 Jacob Blain Christen

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

dockerfiles-stunnel's Issues

Compiled version

This is mostly to let you know about the following. I hope you don't mind?! And maybe we should join forces, since this is basically a copy of your code with a slight twist, see below.

I wanted to be able to get at the (simpler) PSK feature of stunnel, started by forking your repo and finally understood that the underlying Alpine package does not have support for PSK out-of-the-box (stunnel -help provides hints in that direction). So I ended up creating a new repo that compiles the latest version of stunnel directly from the sources. Apart from that, I have added support for a new environment variable called STUNNEL_PSK and forced in the configuration file in the entrypoint.

Tag releases

Thanks for this tight stunnel package. It would be great if you could also tag every release with a version number. I would like to use this image on production, but since there are no tags there is a small risk it could break in the future.

regression in stunnel 5.43 fixed in 5.44

Stefano emailed me to say:

Hi Jacob,

I noticed a regression on stunnel 5.43 that is installed in the latest version of dweomer/stunnel image.

Basically if I don't specify any host in the accept the defaulting doesn't work. They fixed this in 5.44:
1 stunnel change log
2
3 Version 5.44, 2017.11.26, urgency: MEDIUM
4 * New features
5 - Signed Win32 executables, libraries, and installer.
6 * Bugfixes
7 - Default accept address restored to INADDR_ANY.
8 - Fixed a race condition in "make check".
9 - Fixed removing the pid file after configuration reload.

Fix vulnerabilities

Hello,

dweomer/stunnel has collected some vulnerabilites (13 issues so far) over the last months regarding

• zlib 1.2.12-r0
• busybox 1.35.0-r6
• openssl 1.1.1o-r0
• openssl 1.1.1n-r0

It seems, simply rebuilding and uploading to Docker Hub could fix most (if not all) of the issues.

Would you be so kind?

Regards,
Steffen

TLSv1.3 unsupported

I tried sslVersion = TLSv1.3 but I get an Unsupported protocol error. I assume stunnel hasn't been compiled with newer openssl versions. Maybe compile from source in the docker image, rather than install with apk?

Ran into an error while building latest image.

Ran into an error while building the latest image against redis:alpine

Cannot write random bytes: 481BC65F957F0000:error:1200007A:random number generator:RAND_write_file:Not a regular file:crypto/rand/randfile.c:190:Filename=/dev/urandom

stunnel exited with code 1 FOR Service [socks_server]: Each service must define two endpoints

root@stunnel:/data/docker/stunnel# docker-compose up
Pulling stunnel (dweomer/stunnel:)...
latest: Pulling from dweomer/stunnel
96526aa774ef: Already exists
0837742a6a44: Already exists
02e82157f23e: Already exists
d9fe7172cee4: Already exists
921d3c2bfb90: Already exists
Digest: sha256:c46e11e6cc135275566de318d739f815c272c23084fc1e65704f7e228992e9ef
Status: Downloaded newer image for dweomer/stunnel:latest
Recreating stunnel ... done
Attaching to stunnel
stunnel    | .......+++++++++++++++++++++++++++++++++++++++*....+........+++++++++++++++++++++++++++++++++++++++*...+...+..+..........+..+...+......+.......+...+.....+....+...+..+..................+...................+.....+.........+.+.........+..+............+.+.....+.......+.........+...........+....+...........+...+....+..+...+...+.......+........+...+....+........+....+......+..+.+............+.....+..........+........+.+...+...+.....+.........+.+...+.........+..................+...+.........+..+...+......................+...+........+....+...+..+.+.....+.......+......+..............+.+..+...+...............+....+..+...+......+.......+...+.....+....+...+..+...+...+......................+...+..+....+........+.......+......+...+..+....+.....+.........+.+........+.+.....+......+..........+...+...............+..+....+.........+...........+....+........+.........+.+...............+..+...+...+.+...........+......................+...+.........+..................+........+....+...+..+..........+.....+...+.+.........+..+...+......+......+....+..+............+.......+..............+....+.....+...+...+.+...+.....+.............+........+....+...............+......+..+.......+..+.+...+......+...+........+.......+.....+......+...............+..........+...........+.+.....+...+.+.....+....+............+..+...+.......+..+..................+.+..+...+.........+.+.....+......+....+..+.......+...+..+......+..........+...........+....+......+.....+....+............+..+.+...........+...............+.........+...............+.......+.....+..........+..+.+......+...+........+....+......+...+..+.......+...+..+.......+.....+.+..+.+...........+...+...+.......+.......................+.......+..+...+..........+...+............+...+........+......+...+.+.....+....+..+......+...+....+..+.++++++
stunnel    | .+..+....+.....+..........+.....+....+..+...+...+....+.....+.+.....+.......+...+++++++++++++++++++++++++++++++++++++++*...............+++++++++++++++++++++++++++++++++++++++*...+....+.......................+.............+...........+...+.......+...+......+.....+....+..+.+........++++++
stunnel    | -----
stunnel    | '/etc/stunnel/stunnel.pem' -> '/usr/local/share/ca-certificates/stunnel-ca.crt'
stunnel    | '/etc/stunnel/stunnel.pem' -> '/usr/local/share/ca-certificates/stunnel.crt'
stunnel    | WARNING: Skipping duplicate certificate in file ca-cert-stunnel.pem
stunnel    | [ ] Initializing inetd mode configuration
stunnel    | [ ] Clients allowed=512000
stunnel    | [.] stunnel 5.71 on x86_64-alpine-linux-musl platform
stunnel    | [.] Compiled/running with OpenSSL 3.1.3 19 Sep 2023
stunnel    | [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI
stunnel    | [ ] errno: (*__errno_location())
stunnel    | [ ] Initializing inetd mode configuration
stunnel    | [.] Reading configuration from file /etc/stunnel/stunnel.conf
stunnel    | [.] UTF-8 byte order mark not detected
stunnel    | [ ] No PRNG seeding was required
stunnel    | [ ] Initializing service [socks_server]
stunnel    | [!] Service [socks_server]: Each service must define two endpoints
stunnel    | [!] Configuration failed
stunnel    | [ ] Deallocating temporary section defaults
stunnel    | [ ] Cleaning up context [stunnel]
stunnel    | [ ] Deallocating section [socks_server]
stunnel    | [ ] Cleaning up context [socks_server]
stunnel exited with code 1

# root@stunnel:/data/docker/stunnel# cat docker-compose.yml
version: "3"
services:
  stunnel:
    image: 'dweomer/stunnel'
    container_name: stunnel
    environment:
      - STUNNEL_PROTOCOL=socks
      - STUNNEL_SERVICE=socks_server
      - STUNNEL_ACCEPT=9080
      - STUNNEL_CONNECT=127.0.0.1:9081
      - STUNNEL_KEY=/etc/stunnel/stunnel.key
      - STUNNEL_CRT=/etc/stunnel/stunnel.pem
      - STUNNEL_VERIFY_CHAIN=yes
      - STUNNEL_CAFILE=/etc/stunnel/stunnel.pem
    ports:
      - "9080:9080"
    volumes:
      - /data/docker/stunnel/conf:/etc/stunnel
      #- /etc/ssl/private/server.key:/etc/stunnel/stunnel.key:ro
      #- /etc/ssl/private/server.crt:/etc/stunnel/stunnel.pem:ro