Network UPS Tools User Manual
Network UPS Tools User Manual
Network UPS Tools User Manual
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
<strong>Network</strong> <strong>UPS</strong> <strong>Tools</strong> <strong>User</strong> <strong>Manual</strong> 40 / 84<br />
9.5 Configuring SSL<br />
SSL is available as a build option (--with-ssl).<br />
It encrypts sessions between upsd and clients, and can also be used to authenticate servers.<br />
This means that stealing port 3493 from upsd will no longer net you interesting passwords.<br />
Several things must happen before this will work, however. This chapter will present these steps.<br />
SSL is available via two back-end libraries : NSS and OpenSSL (historically). You can choose to use one of them by specifying<br />
it with a build option (--with-nss or --with-openssl). If neither is specified, the configure script will try to detect one<br />
of them, with a precedence for OpenSSL.<br />
9.5.1 OpenSSL backend usage<br />
This section describes how to enable NUT SSL support using OpenSSL.<br />
Install OpenSSL<br />
Install OpenSSL as usual, either from source or binary packages. If using binary packages, be sure to include the developer<br />
libraries.<br />
Recompile and install NUT<br />
Recompile NUT from source, starting with configure --with-openssl.<br />
Then install everything as usual.<br />
Create a certificate and key for upsd<br />
openssl (the program) should be in your PATH, unless you installed it from source yourself, in which case it may be in /usr/local/ssl/bin.<br />
Use the following command to create the certificate:<br />
openssl req -new -x509 -nodes -out upsd.crt -keyout upsd.key<br />
You can also put a -days nnn in there to set the expiration. If you skip this, it may default to 30 days. This is probably not<br />
what you want.<br />
It will ask several questions. What you put in there doesn’t matter a whole lot, since nobody is going to see it for now. Future<br />
versions of the clients may present data from it, so you might use this opportunity to identify each server somehow.<br />
Figure out the hash for the key<br />
Use the following command to determine the hash of the certificate:<br />
openssl x509 -hash -noout -in upsd.crt<br />
You’ll get back a single line with 8 hex characters. This is the hash of the certificate, which is used for naming the client-side<br />
certificate. For the purposes of this example the hash is 0123abcd.
Change language