Ghostunnel is an open-source TLS proxy designed to manage mutual authentication for applications lacking native TLS support. It functions bidirectionally, operating in both server mode and client mode.
In server mode, Ghostunnel acts as a front-end for a backend service, accepting TLS connections, verifying the client’s certificate, and forwarding traffic to the service via TCP or a UNIX socket. In client mode, it listens for local plaintext connections, encrypts them with TLS, and presents a client certificate to the remote service. This ensures both parties authenticate each other while applications communicate in plaintext.
Ghostunnel proves particularly useful when an internal service uses plaintext communication but requires mutual TLS. It eliminates the need to modify application code or depend on vendor-specific solutions by handling TLS in a separate process.
When in server mode, the proxy demands explicit configuration of allowed clients. Administrators can set access rules based on common name, organizational unit, DNS or URI names in the certificate, public key pins, or Open Policy Agent policies. These rules can be combined using logical OR operations. Ghostunnel also supports SPIFFE IDs and allows policy updates without restarting the tunnel.
Certificates and keys can be sourced from various locations, including PEM or PKCS#12 files, the macOS Keychain, the Windows Certificate Store, the SPIFFE Workload API, PKCS#11 hardware modules (e.g., YubiKey), or Let’s Encrypt via ACME in server mode. Certificates automatically reload on SIGHUP or a timer, enabling seamless rotation of short-lived credentials.
Ghostunnel emphasizes security with default settings. It restricts listening to localhost or UNIX sockets unless the –unsafe-listen flag is used, and applies similar rules for targets with –unsafe-target. On Linux, it employs Landlock sandboxing by default. A status port provides JSON and Prometheus metrics for monitoring.
The tool is distributed as a single static Go binary with no runtime dependencies, supporting Linux, macOS, Windows, and BSDs. It is licensed under Apache 2.0 and includes features like systemd and launchd socket activation, as well as PROXY protocol v2 for backends requiring original connection details.
Ghostunnel is available for free on GitHub.
Leave a Reply