0

I'm running OTRS on a CentOS server and the MySQL DB is running on a remote server, on CentOS as well. OTRS does not support an encrypted connection with MySQL hence the connection is not encrypted. I would like to use stunnel to encrypt the connection but I fail to configure it. MySQL is using the default port 3306.

OTRS = 10.0.0.4 MySQL = 10.0.0.3

#Sample stunnel configuration on OTRS Server

#Provide the full path to your certificate-key pair file

cert = /etc/pki/tls/certs/stunnel.pem

#lock the process into a chroot jail

chroot = /var/run/stunnel

# and create the PID file in this jail

pid = /stunnel.pid

#change the UID and GID of the process for security reasons
setuid = nobody
setgid = nobody

#enable client mode
client = yes


socket = l:TCP_NODELAY=1
#socket = r:TCP:NODELAY=1

[mysqls]
accept = 0.0.0.0:3306
connect = 10.0.0.3:3307

And the config file on the database server:

#Sample configuration file for MySQL

#Provide the full path to your certificate-key pair file
cert = /etc/pki/tls/certs/stunnel.pem

#Allow only TLS, thus avoiding SSL
sslVersion = TLSv1

#lock the process into a chroot jail
chroot = /var/run/stunnel

#change the UID and GID of the process for security reasons
setuid = nobody
setgid = nobody

pid = /stunnel.pid
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1

#Configure our secured MySQL Server
[mysqls]

accept = 3307
connect = 3306

I guess that the part in the stunnel config file on the OTRS Server is wrong. Any ideas?

accept = 0.0.0.0:3306

Improve this question
  • "I fail to configure it" "I guess that the part in the stunnel config file ... is wrong" It will be far more useful if you explained how you know there is a problem, like content of error messages, etc. This is also not looking like a security question. – schroeder Feb 15 '18 at 13:37
  • Its not OTRS which does the MySQL TLS stuff - its Perl - see stackoverflow.com/questions/23566966/… – symcbean Feb 15 '18 at 14:08
  • OTRS is written in Perl. To make OTRS capable of connecting to MySQL via TLS the code would need to be changed - this would void the support contract. Hence my only option is to use stunnel. – cyzczy Feb 15 '18 at 14:16
  • You could also do this via a Point 2 Point vpn connection that is much easier to set up btw – pm1391 Feb 16 '18 at 22:25
0

Ok, I figured it out.

I've changed the database host value in the Config.pm file from the real IPv4 address of the database server to 127.0.0.1:

enter image description here

Then I've configured the stunnel.conf on the OTRS box to listen on 127.0.0.1:3306 (OTRS by default connects to the standard MySQL port) and to connect to the real IPv$ address of the database host but on port 3307:

enter image description here

On the database server the stunnel.conf looks like this:

enter image description here

Running tcpdump on the db server and analyzing the .pcap in Wireshark it shows that the connection is encrypted and OTRS still works:

enter image description here

Whether the stunnel.conf files are good constructed this I don't know yet, but for example I've read that chroot shouldn't be used longer but will dig more deep into it.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.