1. Prepare a certificate
------------------------
either: request a certificate for your elog URL from your web administrator
- the private key must not be password-protected
- the 'common name' must be the URL of your elog server

or: create a self-signed certificate yourself with the OpenSSL package
- as root user, create a self-signed certificate with the command

root@localhost:# openssl req -new -x509 -config /etc/ssl/openssl.cnf -keyout stunnel.pem -out stunnel.pem -days 365 -nodes

- this creates a self-signed certificate (-x509) whith one year validity (-days 365)
  and no password protection for the private key (-nodes)
- private key and certificate are written to the same file, "stunnel.pem"

Answer all questions, making sure that the 'common name' is the URL under which users
are to reach your elog server.

For more information on how to create and/or manage SSL certificates, see e.g.
http://www.ibiblio.org/pub/Linux/docs/HOWTO/SSL-Certificates-HOWTO

Notice: Unless your web administrator can procure a certificate signed by an established
        CA, your elog users will be asked if they want to accept your (unverifiable) certificate
        when connecting to your elog server. This is no problem at all but can lead to
        questions if your users are unsure about this.


2. Adapt the certificate file to stunnel4 conventions
-----------------------------------------------------
The certificate filename must be the MD5 checksum:
- Retrieve the MD5 checksum of your certificate with

root@localhost:# openssl x509 -hash -noout -in stunnel.pem 

abcdefgh

- Rename the certificate file accordingly

root@localhost:# mv stunnel.pem abcdefgh.0

- Move the certificate file to the standard location, e.g. /etc/ssl/certs
- change the permissions of the file to -rw-------
- make sure there is a blank line between
  -----END RSA PRIVATE KEY----- and -----BEGIN CERTIFICATE-----
  and a blank line after
  -----END CERTIFICATE-----
  in your certificate file.


3. Configure stunnel4
---------------------
Install the stunnel4 package (if not already done).
Modify the configuration file (e.g. /etc/stunnel/stunnel.conf, depending on your
distribution):

- general options:
  cert = /etc/ssl/certs/abcdefgh.0    ; put the name of your certificate file here
  debug = 4                           ; otherwise ALL connection attempts will be logged to your syslog
  pid = /var/run/stunnel4/stunnel.pid ; check where the other services write their pid-files, depends 
                                      ; somewhat on the distribution

- comment out all lines containing chroot options
- comment out all CA lines
- comment out all service sections except the HTTPS section, which should look as follows

[https]
accept  = 443       ; i.e. stunnel listens on port 443, the standard https port
connect = 8080      ; and forwards all connections to port 8080 (use the port under which
                    ; your elogd is running here!)
TIMEOUTclose = 0    ; for buggy MS Internet Explorers, see the stunnel4 manpage


Some Linux distributions require that in the file /etc/defaults/stunnel4 the option ENABLED be set
to ENABLED=1. If not, the stunnel will not be started at system bootup.


4. Start the stunnel4 server
----------------------------
root@localhost# stunnel4 /etc/stunnel/stunnel.conf

Your elog should now be accessible via

https://your.elog.server

cert = /etc/ssl/certs/abcdefgh.0
pid = /var/run/stunnel4/stunnel.pid

; Some performance tunings
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1

; Some debugging stuff useful for troubleshooting
debug = 4

; Service-level configuration
[https]
accept  = 443
connect = 8080
TIMEOUTclose = 0

#!/bin/bash
#
# Makes thumbnails (a jpeg image) from a given set of input files.
# Supported input file types are those supported by 'convert',
# plus PDF.
# Requires convert(1), gs(1) and file(1)
#
# Usage:      make_thumbs [options] [ file1 file2 ... ]
# Author:     Emiliano Gabrielli
# License:    GPL
# Latest Version at http://SuperAlberT.it/download/command_line_scripts/elog/
#
# $Id: make_thumbs,v 1.7 2005/04/14 10:01:37 albert Exp $

function parse_cmdline()
{
	export OPTERR=1
	while getopts "s:q:Vh" "option" ; do
		case "$option" in
		s)
			MAXSIZE=$OPTARG
			;;
		q)
			QUALITY=$OPTARG
			;;
		V)
			echo "$0 version $VERSION by $AUTHOR"
			exit 1
			;;
		h|*)
			echo -e "\nUsage: make_thumb [options] [ file1 file2 ... ]"
			echo -e "Options:\n"\
			        " -s MAXSIZE  the size of the thumbnail to be created\n"\
			        " -q QUALITY  the quality of the JPEG image created\n"\
				    " -V          print version and exit\n"\
				    " -h          print this help and exit\n"
			exit 1
			;;
		esac
	done
}

function make_thumb()
{
	[ ! -z "$1" ] || exit 1
	FILE="$1"

	# Test if file is readable
	if ! [ -r "$FILE" ] ; then
		echo "ERROR in $0: $FILE is not readable."
		exit 1
	fi
	THUMBFILE="$FILE.thumb"
	EXTENSION="`echo \"$FILE\" | sed 's/.*\.\([^.]*\)$/\1/'`"

	# we need this extension in order to instruct 'convert'
	# will be renamed at the end of the job
	JPEGFILE="$THUMBFILE.jpg"
	ROTATE=""

	# PDF needs special handling
	if [[ `file $FILE | grep "PDF document"` ]] ||
	   [[ `file $FILE | grep "PostScript document"` ]]
	then
	    # look if we should rotate
		DEG=`head -200 $FILE | strings | grep "/Rotate " | head -1 | sed -e 's#.*/Rotate \([0-9]\+\).*#\1#'`
		[ ! -z "$DEG" ] && ROTATE="-rotate $DEG"
		# Extract first page and convert: PDF -> PS -> JPEG (needs 'gs' and 'convert')
		gs -q -dNOPAUSE -dBATCH -r75 -dLastPage=1 -sDEVICE=jpeg -sOutputFile=\|cat "$FILE" | \
		convert - $ROTATE -size ${MAXSIZE}x${MAXSIZE} -resize ${MAXSIZE}x${MAXSIZE} -quality $QUALITY +profile "*" "$JPEGFILE" &&
		mv "$JPEGFILE" "$THUMBFILE" &

	# Else it must be one of the following: postscript, JPEG, GIF, TIFF, RS
	elif [[ `file $FILE | grep "\(JPEG\|GIF\|PNG\|TIFF\) image data"` ]] ||
		 [[ "$EXTENSION" == "rs" ]]   || [[ "$EXTENSION" == "RS" ]]
	then
		convert -size ${MAXSIZE}x${MAXSIZE} "$FILE" -resize ${MAXSIZE}x${MAXSIZE} -quality $QUALITY +profile "*" "$JPEGFILE" &&
		mv "$JPEGFILE" "$THUMBFILE" &
	fi
}


AUTHOR="Emiliano 'AlberT' Gabrielli"
VERSION="0.2.0"
MAXSIZE=600   # default value
QUALITY=70    # default value

parse_cmdline $@
shift `expr $OPTIND - 1`

for file in "$@" ; do
	make_thumb $file
done

# vim:ai:ts=4:sw=4: