Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

Stunnel and OpenSSL: Concepts

|

159

(If all the unexplained stunnel.conf parameters in Examples 5-3 and 5-4 are making

you nervous, don’t worry: I’ll cover them in my usual verbosity in the next section.)

The only other thing to do on skillet is to start Stunnel, again by simply typing the

command

stunnel.

Finally, you’ve arrived at the payoff: it’s time to invoke rsync. Normally, the rsync

command to poll elfiero directly for its module list would look like this:

[schmoe@skillet ~]$ rsync elfiero::

In fact, nothing you’ve done so far would prevent this from working. (Preventing

nontunneled access to the server is beyond the scope of this quick example.)

But you’re cooler than that: you’re going to connect instead to a local process that

will transparently forward your command over an encrypted session to elfiero,and

elfiero’s reply will come back over the same encrypted channel. Example 5-5 shows

what that exchange looks like (note that you don’t need to be root to run the client

application).

It worked! Now your friends with accounts on skillet can download elfiero’s

unhealthy recipes with cryptographic impunity, safe from the prying eyes of the

American Medical Association.

By the way, if you had to use a nonstandard rsync port for the client’s Stunnel lis-

tener (e.g., by setting the