ZeroMQ securely over the internet

Question

I've been working with zeroMQ a bit and I want to be able to connect securely over the Internet. I'm in ruby and could use SSL and/or some sort of shh connection but cannot find any examples of how to do this.

I found this old stackoverflow link, How does zeromq work together with SSL? saying they were working on some sort of security, but that was a year ago and I can't find any new references.

Even if this isn't built into zeroMQ, I would assume that there would be some way to set this up with OpenSSL or something similar.

Note: zeroMQ website mentions using VPN or something if you want secure transport. I do not want to use VPN. There must be a better way.

Wineglass

How about tunneling through SSH? – Infielder

revsys.com/writings/quicktips/ssh-tunnel.html – Scarletscarlett

Ya, ssh tunnel will work and seems pretty straight forward. Just thought there might be a better, more standard way to do this with zeroMQ – Wineglass

Answer 1

Similar to VPN, but much easier to setup:

• encrypted tunnel with socat

Let's make each zeromq side connected locally to socat, and two socats connect with each other using encrypted channel.

Some links: [1], [2], [3], [4].

Ceporah

Answer 2

Just wanted to add that since the question was asked, the ZMQ team developed, starting with ZeroMQ v4.0.0, the CurveZMQ protocol, which is an authentication and encryption protocol for ZeroMQ based on CurveCP and NaCl - fast, secure elliptic-curve crypto. This allows encrypted ZMQ message exchange, which would supposedly be secure over the internet.

For more details see Using ZeroMQ Security part 1. Some of the features that were added at the time are:

A new wire protocol, ZMTP 3.0, that adds a security handshake to all ZeroMQ connections.

A new security protocol, CurveZMQ, that implements "perfect forward security" between two ZeroMQ peers over a TCP connection. I'll explain CurveZMQ below.

A set of security mechanisms for ZMTP: NULL, PLAIN, and CURVE, each described by their own RFCs. NULL is essentially what we had before. PLAIN allows simple username and password authentication. CURVE implements the CurveZMQ protocol. [...]

For secure messaging over the internet, one would seek to implement, for example, the Ironhouse pattern. See part 2 for a description.

There are certainly Ruby implementations for this protocol, but I did not look for them.

If one is looking for Python implementations, one can look at these resources:

• https://github.com/zeromq/pyzmq/tree/master/examples/security
• https://developer.ibm.com/tutorials/se-distributed-apps-zeromq-part2/

Slowly