使用Stunnel为MySQL建立加密隧道

使用Stunnel为MySQL建立加密隧道

Stunnel安装

apt-get install stunnel4

第一步 生成证书

在服务端生成两个证书，一个服务端的stunnel_s.pem，一个客户端的stunnel_c.pem

openssl req -new -x509 -days 36500 -nodes -out stunnel_c.pem -keyout stunnel_c.pem
openssl req -new -x509 -days 36500 -nodes -out stunnel_s.pem -keyout stunnel_s.pem

生成的证书，公钥和私钥都在.pem文件里

将两个证书文件拷贝到/etc/stunnel目录，设置两个证书文件的权限为400

sudo cp ./stunnel_s.pem /etc/stunnel/
sudo cp ./stunnel_c.pem /etc/stunnel/
sudo chmod 400 /etc/*.pem

第二步 服务端配置 stunnel.conf

在etc/stunnel目录下创建stunnel.conf文件，内容如下

# pid使用默认的即可
pid = /var/run/stunnel4/stunnel4.pid
# 配置mysql
[mysql]
# 证书与私钥
cert = /etc/stunnel/stunnel_s.pem
key = /etc/stunnel/stunnel_s.pem
# 允许外部访问的端口
accept = 6033
# MySQL监听地址及端口
connect = 127.0.0.1:3306
# 配置安全等级 依据本地安装的证书检查证书
verify = 3
# 服务端CAfile是客户端的公钥，stunnel_c.pem文件包含公钥和私钥
CAfile = /etc/stunnel/stunnel_c.pem

第三步 客户端配置 stunnel.conf

将stunnel_c.pem和stunnel_s.pem拷贝到客户端的stunnel安装目录，存放在客户端的stunnel_s.pem最好删除证书里面的BEGIN PRIVATE KEY 私钥部分，只保留BEGIN CERTIFICATE公钥部分

# stunnel_s.pem内容如下

cat ./stunnel_s.pem

-----BEGIN CERTIFICATE-----
...........................
...........................
-----END CERTIFICATE-----

stunnel.conf文件，内容如下

# pid使用默认的即可
pid = /var/run/stunnel4/stunnel4.pid
# 配置mysql
[mysql]
# 本地监听端口
accept = 127.0.0.1:6033
# 远程服务器的地址及端口
connect = 100.100.100.100:6033
# 使用客户端模式
client = yes
# 配置安全等级 依据本地安装的证书检查证书
verify = 3
# 客户端的CAfile是服务端的公钥，stunnel_s.pem文件已经删除了私钥内容
CAfile = /etc/stunnel/stunnel_s.pem
# 证书和私钥
cert = /etc/stunnel/stunnel_c.pem
key = /etc/stunnel/stunnel_c.pem

第四步 配置为自动启动

sudo echo 'ENABLED=1' >> /etc/default/stunnel4

第五步 服务端和客户端开启stunnel

service stunnel4 start

查看stunnel状态

service stunnel4 status

验证

1、在服务端创建个名为test的数据库

mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| mysql              |
| performance_schema |
| sys                |
+--------------------+
4 rows in set (0.00 sec)

mysql> create database test;
Query OK, 1 row affected (0.01 sec)

mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| mysql              |
| performance_schema |
| sys                |
| test               |
+--------------------+
5 rows in set (0.00 sec)

2、在客户端执行mysql连接本地的6033端口

mysql -h 127.0.0.1 -P 6033 -u root -p

mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| mysql              |
| performance_schema |
| sys                |
| test               |
+--------------------+
5 rows in set (0.00 sec)

3、客户端执行telnet 127.0.0.1 6033，若看到类似如下结果，也说明建立成功

Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
J
9uHT?kJDV>I!s0vcaching_sha2_passwordConnection closed by foreign host.