Will ssh tunnelling be a simpler way to solve my link encryption issue rather than stunnel?

Question

We have an encryption issue from a vendors mid-tier to an Oracle database. We can use encrypted database connections and have done for 90% of cases.

Our security team has advised us that since this connection goes over a link, everything needs to be secure.

One database client is a proprietary vendor mid-tier for whom we have asked to upgrade with encrypted SSL JDBC links, and they have advised us the timeline for this is two years. We need to have a security solution in a shorter timeframe.

Our security team advised us that stunnel might be a potential solution to this problem. This requires setting up a server, keys on the server and a client.

We already run an ssh server on the box that the Oracle database is running on, with keys for users setup.

It seems to me that stunnel duplicates the pattern of ssh.

server - stunnel server vs ssh server
server key setup - stunnel key setup vs openssh users setting their keys on the server
client - Using an ssh client vs using a stunnel client

Stunnel might be useful in cases where you're not already running an openssh server, or where you want a different key management system.

Now I might be missing something in my analysis. There might be a feature of stunnel that I need that I can't see.

My question is: Will ssh tunnelling be a simpler way to solve my link encryption issue rather than stunnel?

EDIT

This link is already inside a secure network. It is not public. But it is financial services - where the threat model involves hard shell, soft core analysis. It's not good enough to have an insecure link inside a secure network - because you don't trust the inside of your network.

Is your Oracle database a RAC? – Lacek May 31 '19 at 14:03 — Lacek, May 31 '19 at 14:03

user9517 · Accepted Answer · 2020-06-29T15:23:48.440

3

I would just create an IPSec connection between the two systems and not worry about ssh/stunnel.

Today I would use WireGuard. It's much simpler to set up and work with.

edited Jun 29 '20 at 15:23

answered Jan 13 '18 at 12:35

user9517

114,104
20
206
289

Thanks - that's helpful - I'll update the question to clarify. – Hawkeye Jan 15 '18 at 08:33
IPSec is probably still the answer. – user9517 Jan 15 '18 at 11:42
Thanks - could you provide reasons as to why this is better? – Hawkeye Jan 15 '18 at 19:26
IPSec is designed to be a host to host tunnel. – user9517 Jan 15 '18 at 19:44
1

Thanks - what are the benefits over stunnel or ssh ? – Hawkeye Jan 15 '18 at 22:34
2

stunnel is ssh tunneling. It just doesn't spawn a shell. – TheCompWiz May 31 '19 at 00:43
From the WireGuard website you linked to: “WireGuard is not yet complete. _You should not rely on this code._” – Mike Scott May 31 '19 at 06:00
I'm very aware of what the site says. This Q&A will be around long after that statement has been removed. – user9517 May 31 '19 at 06:07
@Iain But you specifically say you would use WireGuard _today_. Change “today” to “when it’s complete and certified” and I’ll withdraw my objection. – Mike Scott May 31 '19 at 07:08
No, I said 'consider using...' – user9517 May 31 '19 at 08:08

Will ssh tunnelling be a simpler way to solve my link encryption issue rather than stunnel?

1 Answers1