DavidWittman/stunnel-chroot-reload.md

## stunnel-chroot-reload.md

      
    Raw
  

              stunnel-chroot-reload.md
            
          
    Reloading stunnel configurations when in a chroot

Example stunnel config

# /etc/stunnel/stunnel.conf
cert = /etc/stunnel/cert.pem
sslVersion = TLSv1 TLSv1.1 TLSv1.2

chroot = /var/run/stunnel/
setuid = nobody
setgid = nobody
pid = /stunnel.pid

foreground = yes
debug = local6.info
syslog = yes

# Disable Nagle's algorithm
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1

# Enable TCP keepalives
socket = l:SO_KEEPALIVE=1
socket = l:TCP_KEEPIDLE=240
socket = l:TCP_KEEPINTVL=60

[mysql]
accept = 4306
connect = 127.0.0.1:3306

Instructions


Bind mount /etc/stunnel to $chroot/etc/stunnel.

# mkdir -p /var/run/stunnel/etc/stunnel/
# mount -o bind /etc/stunnel /var/run/stunnel/etc/stunnel/


Copy over the certificate to its full path within the chroot, and make sure it has the proper ownership. In our example, since we've already bind-mounted /etc/stunnel, we don't need to recreate any other directory structures.

# chown nobody:nobody $chroot/etc/stunnel/cert.pem
# chmod 0400 $chroot/etc/stunnel/cert.pem


Copy /etc/passwd and /etc/group to $chroot/etc/

# cp /etc/{passwd,group} /var/run/stunnel/etc/


Send a SIGHUP to stunnel to reload the configuration. (Note: this particular command won't work so hot if you're running multiple instances of stunnel. In that case, you should probably use the specific pid of the process you wish to reload.)

# pkill -1 stunnel