Stunnel | IBM 10 SP1 EAL4 specification

cryptography standards that they require. The openssl command can be used by an administrative user for the following:

•Creation of RSA, DH, and DSA parameters.

•Generation of 1024-bit RSA keys.

•Creation of X.509 certificates, CSRs, and CRLs.

•Calculation of message digests.

•Encryption and Decryption with ciphers.

•SSL and TLS client and server tests.

•Handling of S/MIME signed or encrypted mail.

For detailed information about the openssl command and its usage, see:

http://www.openssl.org/docs/apps/openssl.html.

5.12.4.5stunnel

stunnel is designed to work as an SSL encryption wrapper between remote clients and local or remote servers. stunnel can be used to add SSL functionality to commonly used daemons such as POP and IMAP servers, to standalone daemons like SMTP and HTTP, and in tunneling PPP over network sockets without changes to the source code.

The most common use of stunnel is to listen on a network port and establish communications with either a new port via the connect option, or a new program via the exec option. There is also an option that allows a program to accept incoming connections and then launch stunnel.

Each SSL-enabled daemon needs to present a valid X.509 certificate to the peer. The SSL-enabled daemon also needs a private key to decrypt incoming data. stunnel is built on top of SSL, so on the TOE the private key and the certificate can be generated by OpenSSL utilities. These private keys are stored in the /etc/stunnel/stunnel.pem file.

stunnel uses the openssl library, and therefore can use the cipher suites implemented by that library. They are:

•SSL_RSA_WITH_RC4_128_SHA

•TLS_RSA_WITH_AES_128_CBC_SHA

•TLS_RSA_WITH_AES_256_CBC_

•SSL_RSA_WITH_3DES_EDE_CBC_SHA

stunnel is configured by the /etc/stunnel/stunnel.conf file. The file is a simple ASCII file that can be edited by the administrative user to secure SSL-unaware servers. Each service to be secured is named in a square bracket, followed by “option_name = option_value” pairs for that service. Global parameters such as location of the private key file are listed at the beginning of the file. An example follows:

# Global parameters

cert = /etc/stunnel/stunnel.pem pid = /tmp/stunnel.pid

setuid = nobody setgid = nogroup

195

Image 207

IBM 10 SP1 EAL4 manual Stunnel

Contents

Page EJR Table of Contents 2.1 DAC AppArmor Programs with software privilege Permission bits Access Control Lists 100 142 175 207 250 252 269 Terminology Purpose of this documentDocument overview Conventions used in this document System Overview High-level product overview Product historySuse Linux Enterprise Server EServer systems Overall structure of the TOE EServer host computer structurePage EServer system structure TOE services Security policy Local and network services provided by Sles TSF interfaces Operation and administration Approach to TSF identification Page Page System x hardware overview System x hardware architecture System System p System p hardware overviewSystem p hardware architecture System z hardware overview System z hardware architecture System z EServer EServer 326 hardware overviewEServer 326 hardware architecture AMD x86-64 architecture in compatibility mode Page Hardware and software privilege Hardware privilegePrivilege level Levels of Privilege Software privilege AppArmor 2.1 DAC Programs with software privilege TOE Security Functions software structure Kernel TSF software Logical kernel subsystems and their interactions Logical components Execution components Base kernelKernel threads Kernel modules and device drivers Non-kernel TSF softwarePage Definition of subsystems for the CC evaluation TSF databases Trusted process subsystems HardwareFirmware Kernel subsystems User-level audit subsystem Page File and I/O management Functional descriptions Ext3 and CD-ROM file systems before mounting Virtual File System Ext3 and CD-ROM file systems after mounting Pathname translation VFS pathname translation and access control checks Open Write MountShared subtrees Disk-based file systems 2.1 Ext3 file systemExtended Attributes Data structures Page Page Data structures and algorithms ISO 9660 file system for CD-ROM Pseudo file systems ProcfsTmpfs Sysfs DevptsRootfs Binfmtmisc Discretionary Access Control DACConfigfs Inotify Indicates read Permission bits Access Control Lists Types of ACL tagsACL qualifier Aclmask Default ACLs and ACL inheritanceACL permissions Relationship to file permission bits ACL enforcement 7 I/O scheduler Asynchronous I/O Deadline I/O scheduler Anticipatory I/O schedulerCompletely Fair Queuing scheduler Bottom halves 8 I/O interruptsNoop I/O scheduler Top halves Work queue Processor interruptsMachine check Tasklets Data structures Process control and managementPage Process creation and destruction Control of child processesDAC controls Execve Process switchKernel threads Setresuidand setresgid Hyperthreading scheduler Scheduling 14 Hyperthreaded scheduling Kernel preemption Inter-process communication Data structures and algorithms Pipes Fifo creation First-In First-Out Named pipes System V IPC Fifo openCommon data structures Message queues Common functions Semaphores Shared memory regions Algorithms SignalsSockets Data structures 16 Object reuse handling in socket allocation Network subsystem Overview of the network protocol stack 18 How data travels through the Network protocol stack Network layer protocols Transport layer protocols 3.2.2 IPv6 Header Addressing IP Security IPsec Flow LabelsSecurity Transition between IPv4 and IPv6 AH Header Functional Description of IPsec An IP Packet with tunnel mode AH An IP Packet with tunnel mode ESP Link layer protocols Internet Control Message Protocol Icmp Address Resolution Protocol ARP Network services interface Bind Socket Listen AcceptConnect Access control Memory managementGeneric calls Page 24 Previous three-level page-tables architecture Four-Level Page Tables System Memory addressing 26 System x virtual addressing space Segmentation 28 Access control through segmentation Paging 30 Regular paging 32 Access control through paging For more information about call gates, refer to System p 33 Paging data structures 34 Logical partitions Privilege State 36 Determination of processor mode in Lpar Real mode addressing Address Translation on LPARsHypervisor Virtual mode addressing Access to I/O address spaceDirect Memory Access addressing Run-Time Abstraction Services Preventing denial of serviceSystem p native mode 39 Effective address Machine State Register 41 Block address Descriptor Segment descriptorBlock descriptor Address translation mechanisms 45 Block Address Translation entry Address Translation and access control 47 Block Address Translation access controlPage 48 Page Address Translation and access control System z Native hardware modeLpar mode 2.4.3 z/VM Guest mode Address sizes Address spacesAddress translations 49 System z address types and their translation 51 Address translation modes 52 64-bit or 31-bit Dynamic Address Translation 53 Low-address protection on effective address Memory protection mechanisms Table protection 113 114 56 Key match logic for key-controlled protection Logical address EServer Effective address Linear addressPhysical address 59 Data access privilege checks Access control through type check Page 121 63 Page map level four entry Translation Lookaside Buffers Kernel memory management Reverse map Virtual Memory Support for Numa servers Huge Translation Lookaside Buffers 65 Rmap VM 66 TLB Operation Frame management Remapfilepages Process address space Memory area managementNoncontiguous memory area management 68 Object reuse handling while allocating new linear address Symmetric multiprocessing and synchronization Atomic operationsMemory barriers Kernel semaphores Audit subsystemAudit components Spin locks Kernel-userspace interface Audit kernel components Syscall auditing Filesystem watchesTask structure Audit context fields 71 Task Structure File system audit components User space audit components Configuration Audit operation and configuration options Option Description Possible values Operation Audit records Audit record generationKernel record generation Syscall audit record generation 73 Audit Record Generation File system audit record generation 74 Extension to system calls interface Socket call and IPC audit record generation Record generation by trusted programsAudit record format Page Event Description LAF audit events Auditctl Login uid associationAudit tools Kernel modules Linux Security Module framework Structure LSM capabilities module LSM AppArmor moduleAppArmor Var/log/boot.msg Rwl Var/run/klogd.pid AppArmor administrative utilities Securityfs AppArmor access control functions Device drivers 1 I/O virtualization on System zInterpretive-execution facility State description Hardware virtualization and simulation Character device driver Block device driver Init System initialization System Boot methods Boot loaderBoot process Linuxrc 79 System x Sles boot sequence System p Page System p in Lpar 80 System p Sles boot sequence Etc/sysconfig/init script 81 System p Lpar Sles boot sequence Control program System z 82describes the boot process for Sles as a z/VM guest EServer 82 System z Sles boot sequence 169 83schematically describes the boot process of eServer 170 83 eServer 326 Sles boot sequence Identification and authentication Overview Pluggable Authentication Module Modules Configuration terminology Etc/security/pamenv.conf Protected databases Agetty Trusted commands and trusted processesAccess control rules 11.2.1.1 DAC Gpasswd Login Newgrp Mingetty 11.3.7 su Passwd Interaction with audit Network applicationsOpenSSL Secure socket-layer interface 84 SSL location in the network stack Encryption Concepts 87 Encryption Algorithm and Key 88 Asymmetric keys SSL architecture Message Authentication Code MACMessage digest Digital certificates and certificate authority SSL handshake protocol 90 SSL Protocol 187 Symmetric ciphers OpenSSL algorithms Asymmetric ciphers CertificatesHash functions Secure Shell SSH server daemon SSH client Cups Very Secure File Transfer Protocol daemon Cupsd Ping Ping6Openssl Stunnel Chage System managementAccount Management Xinetd Chsh Chfn User management UseraddUsermod Userdel Groupadd Group management Groupdel Groupmod 202 Hwclock System Time managementOther System Management Date 13.5.1.3 I/O controller and network Supervisor mode instructionsMemory Memory separation System p Star Amtu output 207 Batch processing user commands 13.6 I&A supportBatch processing 14.1.2 at Batch processing daemons Cron14.2.2 atd Aureport User-level audit subsystemAudit daemon Audit utilities Audit configuration files Audit logsAutrace TSF libraries Supporting functions LibraryDescription System call linking mechanism Library linking mechanism System call argument verification Pageoffset Audit Discretionary Access Control Object reuseSecurity management TSF protection Secure communications Internal TOE protection mechanisms TP.6 Testing the TOE protection mechanisms TP.7Trusted processes TP.4 TSF Databases TP.5 Summary of kernel subsystem interfaces Kernel subsystem file and I/OExternal Interfaces Internal function Interfaces defined Internal Interfaces 1.1.3 External interfaces system calls Kernel subsystem process control and management Kernel subsystem inter-process communication Internal Interfaces Dopipe Kernel subsystem memory management Kernel subsystem networking Internal interfaces Kernel subsystem audit Kernel subsystem device drivers Other functions Kernel subsystems kernel modules Summary of trusted processes interfaces References RSA 234