Upgrading stunnel
Encryption of data in transit with the Amazon EFS mount helper requires OpenSSL
version
1.0.2 or newer, and a version of stunnel
that supports both
Online Certificate Status Protocol (OCSP) and certificate hostname
checking. The Amazon EFS mount helper uses the stunnel
program for its TLS functionality. Note that
some versions of Linux don't include a version of stunnel
that supports these TLS features by
default. When using one of those Linux distributions, mounting an Amazon EFS file system using TLS
fails.
After installing the Amazon EFS mount helper, you can upgrade your system's version of stunnel with the following instructions.
To upgrade stunnel
on Amazon Linux, Amazon Linux 2, and other supported Linux distributions (except for SLES 12)
-
In a web browser, go to the
stunnel
downloads page https://stunnel.org/downloads.html. -
Locate the latest
stunnel
version that is available intar.gz
format. Note the name of the file as you will need it in the following steps. -
Open a terminal on your Linux client, and run the following commands in the order presented.
-
For RPM:
sudo yum install -y gcc openssl-devel tcp_wrappers-devel
For DEB:
sudo apt-get install build-essential libwrap0-dev libssl-dev
-
Replace
latest-stunnel-version
with the name of the file you noted previously in Step 2.sudo curl -o
latest-stunnel-version
.tar.gz https://www.stunnel.org/downloads/latest-stunnel-version
.tar.gz -
sudo tar xvfz
latest-stunnel-version
.tar.gz -
cd
latest-stunnel-version
/ -
sudo ./configure
-
sudo make
-
The current
stunnel
package is installed inbin/stunnel
. So that the new version can be installed, remove that directory with the following command.sudo rm /bin/stunnel
-
Install the latest version:
sudo make install
-
Create a symlink:
sudo ln -s /usr/local/bin/stunnel /bin/stunnel
-
To upgrade stunnel on macOS Big Sur
-
Open a terminal on your EC2 Mac instance, and run the following command to upgrade to the latest version of stunnel.
brew upgrade stunnel
Upgrading stunnel for SLES 12
Run the following commands and follow the zypper package manager instructions to upgrade stunnel on your compute instance running SLES12.
sudo zypper addrepo https://download.opensuse.org/repositories/security:Stunnel/SLE_12_SP5/security:Stunnel.repo sudo zypper refresh sudo zypper install -y stunnel
After you've installed a version of stunnel with the required features, you can mount your file system using TLS with the Amazon EFS recommended settings.
Disabling Certificate Hostname Checking
If you are unable to install the required dependencies, you can optionally disable certificate hostname checking inside the Amazon EFS mount helper configuration. We do not recommend that you disable this feature in production environments. To disable certificate host name checking, do the following:
-
Using your text editor of choice, open the
/etc/amazon/efs/efs-utils.conf
file. -
Set the
stunnel_check_cert_hostname
value to false. -
Save the changes to the file and close it.
For more information on using encryption of data in transit, see Mounting EFS file systems.
Enabling Online Certificate Status Protocol
In order to maximize file system availability in the event that the CA is not reachable from your VPC, the Online Certificate Status Protocol (OCSP)
is not enabled by default when you choose to encrypt data in transit.
Amazon EFS uses an Amazon certificate authority
In order to provide the strongest security possible, you can enable OCSP so that your Linux clients can check for revoked certificates. OCSP protects against malicious use of revoked certificates, which is unlikely to occur within your VPC. In the event that an EFS TLS certificate is revoked, Amazon will publish a security bulletin and release a new version of EFS mount helper that rejects the revoked certificate.
To enable OCSP on your Linux client for all future TLS connections to EFS
-
Open a terminal on your Linux client.
-
Using your text editor of choice, open the
/etc/amazon/efs/efs-utils.conf
file. -
Set the
stunnel_check_cert_validity
value to true. -
Save the changes to the file and close it.
To enable OCSP as part of the mount
command
-
Use the following mount command to enable OCSP when mounting the file system.
$
sudo mount -t efs -o tls,ocspfs-12345678
:/ /mnt/efs