2

We have an encryption issue from a vendors mid-tier to an Oracle database. We can use encrypted database connections and have done for 90% of cases.

Our security team has advised us that since this connection goes over a link, everything needs to be secure.

One database client is a proprietary vendor mid-tier for whom we have asked to upgrade with encrypted SSL JDBC links, and they have advised us the timeline for this is two years. We need to have a security solution in a shorter timeframe.

Our security team advised us that stunnel might be a potential solution to this problem. This requires setting up a server, keys on the server and a client.

We already run an ssh server on the box that the Oracle database is running on, with keys for users setup.

It seems to me that stunnel duplicates the pattern of ssh.

  1. server - stunnel server vs ssh server
  2. server key setup - stunnel key setup vs openssh users setting their keys on the server
  3. client - Using an ssh client vs using a stunnel client

Stunnel might be useful in cases where you're not already running an openssh server, or where you want a different key management system.

Now I might be missing something in my analysis. There might be a feature of stunnel that I need that I can't see.

My question is: Will ssh tunnelling be a simpler way to solve my link encryption issue rather than stunnel?


EDIT

  • This link is already inside a secure network. It is not public. But it is financial services - where the threat model involves hard shell, soft core analysis. It's not good enough to have an insecure link inside a secure network - because you don't trust the inside of your network.
1
  • Is your Oracle database a RAC?
    – Lacek
    May 31, 2019 at 14:03

1 Answer 1

3
+100

I would just create an IPSec connection between the two systems and not worry about ssh/stunnel.


Today I would use WireGuard. It's much simpler to set up and work with.

10
  • Thanks - that's helpful - I'll update the question to clarify.
    – Hawkeye
    Jan 15, 2018 at 8:33
  • IPSec is probably still the answer.
    – user9517
    Jan 15, 2018 at 11:42
  • Thanks - could you provide reasons as to why this is better?
    – Hawkeye
    Jan 15, 2018 at 19:26
  • 1
    Thanks - what are the benefits over stunnel or ssh ?
    – Hawkeye
    Jan 15, 2018 at 22:34
  • 2
    stunnel is ssh tunneling. It just doesn't spawn a shell.
    – TheCompWiz
    May 31, 2019 at 0:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .