Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm a software engineer and not necessarily an ops guy aside from having done a developer's share of dealing with deployment issues.

The individual components of the web app I'm working on will be distributed over distinct cloud-based VMs. What's the best or at least a good practice to go about encrypting communication among e.g. node.js-based http-services and the database - each living in their own instances?

I was thinking of SSH-tunnels between the boxes ... What do you serverfault pros say?

share|improve this question

This seems perilously close to a shopping question, which are prohibited on SF (and other SE sites, apparently) by the FAQ. You also fail to mention what OS will be running on the cloud servers; but I'll go ahead and assume it's Linux.

That said, my first preference would be for IPSec, since it's built into Linux, it's incredibly robust, and well-integrated at the network level (so you don't have to mess with routing tables). There won't be any issues about authentication, since it's all done with pre-shared keys or certificates. It integrates well with iptables firewalls. It recovers well after extended network outages. It comes up automatically at boot time via standard /etc/rcN.d scripts. With IPSec tunnels in place, applications need only throw packets at IP addresses; the encryption all happens way down the stack from there.

Failing that, OpenVPN. It's more complex than IPSec, but shares many of the same advantages.

Failing that, ssh tunnels if you must - but you'll be forever running around putting them back once network outages have made them fall over. I'd rather have (yet more) root canal work than do this with ssh tunnels.

share|improve this answer
Whatever a "shopping question" is supposed to be ... err ... I wasn't intending on posting one o_0 ... and yes, you are assuming right: the servers/VMs will be running Linux. Thanks for the pointers to IPSec and OpenVPN. They are something I'll be looking into. – codesurgeon Nov 5 '12 at 13:14
Check the FAQ (it's linked from the top of every SF page), and . Glad to help. – MadHatter Nov 5 '12 at 13:22

stunnel might be an interesting option too. If you have several VMs (not just two), setting a VPN for them and routing all traffic among the nodes through it could be also sensible to some degree - it would protect "everything forever" - if you add another interconnect, it will by encrypted by default without any need to set up additional ssh/stunnel forwardings. Enforcing IPSec might be another option.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.