Ghostunnel: Open-Source TLS Proxy Enhances Application Security
Ghostunnel, a new open-source TLS proxy, provides mutual authentication and encryption for applications lacking native support, bolstering security for internal and external communications.
Ghostunnel has emerged as a valuable open-source tool designed to bridge the security gap for applications that do not natively support Transport Layer Security (TLS) encryption and mutual authentication. This proxy acts as an intermediary, enabling developers to secure communication channels without modifying the underlying applications.
Operating in two distinct modes, Ghostunnel offers flexibility in its deployment. In server mode, it sits in front of a backend service, accepting incoming TLS connections. Crucially, it validates the client's certificate before forwarding the traffic to the protected service, typically over TCP or a UNIX socket. Conversely, in client mode, Ghostunnel listens for plain, unencrypted local connections, encrypts them using TLS with a client certificate, and then establishes a connection to a remote endpoint. This dual functionality allows for end-to-end security, where both the application and the client can mutually authenticate each other, even if the applications themselves communicate in plaintext.
The tool is particularly useful when an internal service requires enhanced security for its communication link, but the necessary TLS implementation is either absent or belongs to a vendor that cannot be easily modified. Ghostunnel effectively offloads this security responsibility from the application to a dedicated, manageable process.
Configuration of access control in server mode is robust. Ghostunnel requires administrators to specify precisely who is allowed to connect, offering several verification options. These include checking the certificate's common name, organizational unit, DNS or URI name, public key pinning, or a custom policy. Multiple checks can be combined using an OR logic. For advanced policy management, Ghostunnel integrates with Open Policy Agent (OPA), allowing for complex authorization rules that can be reloaded dynamically without interrupting service.
Ghostunnel supports a wide array of sources for cryptographic keys and certificates, enhancing its interoperability and ease of use. These include standard PEM and PKCS#12 files, native macOS Keychain and Windows Certificate Store integration, the SPIFFE Workload API, and PKCS#11 hardware security modules like YubiKeys. In server mode, it can also obtain certificates via Let's Encrypt using the ACME protocol. The proxy supports automatic certificate reloading upon receiving a SIGHUP signal or on a configurable timer, making the use of short-lived credentials practical for enhanced security postures.
Security-conscious defaults are a hallmark of Ghostunnel. By default, it refuses to listen on anything other than localhost or a UNIX socket, and similarly restricts target connections unless explicitly overridden with --unsafe-listen and --unsafe-target flags. On Linux systems, it leverages the Landlock security module for sandboxing, further limiting its attack surface. For monitoring purposes, a status port exposes metrics in JSON and Prometheus formats, allowing for integration with existing observability tools.
Ghostunnel is distributed as a single, static Go binary with no runtime dependencies, simplifying deployment across various operating systems including Linux, macOS, Windows, and BSD variants. It is released under the permissive Apache 2.0 license. Additional features include systemd and launchd socket activation support, and PROXY protocol v2 integration for backends that need to ascertain the original client connection details.
The project is freely available on GitHub, offering a powerful and flexible solution for organizations looking to enhance the security of their applications through robust TLS encryption and mutual authentication.