Data Encryption in Transit: Complete Implementation Guide

Introduction

Data encryption in transit protects sensitive information as it moves across networks, preventing interception, eavesdropping, and man-in-the-middle attacks. While encryption at rest protects stored data, encryption in transit ensures that data remains confidential and tamper-proof during transmission between systems, applications, and users. In modern distributed architectures with cloud services, microservices, and remote access requirements, securing data in transit is not optional—it's a fundamental requirement for protecting organizational and customer data.

This comprehensive guide provides Linux system administrators with practical, in-depth knowledge of implementing encryption in transit across various protocols and services. From securing web traffic with TLS/SSL to encrypting database connections, email communications, API calls, and internal service-to-service communication, this guide covers the technical implementations, certificate management, and monitoring procedures necessary to protect data in motion.

Why Data Encryption in Transit Matters

Network traffic is vulnerable to numerous attack vectors. Without encryption, data transmitted across networks can be intercepted, modified, or impersonated by attackers positioned anywhere along the communication path. This includes not just internet-facing communications but also internal network traffic, which is increasingly recognized as a critical attack surface.

Common Threats Mitigated by Encryption in Transit:

  1. Packet Sniffing: Attackers capturing network traffic to extract sensitive information
  2. Man-in-the-Middle (MITM) Attacks: Intercepting and potentially modifying communications between parties
  3. Session Hijacking: Stealing session tokens or cookies transmitted over unencrypted connections
  4. Credential Theft: Capturing usernames, passwords, API keys transmitted in plaintext
  5. Data Tampering: Modifying data in transit without detection
  6. DNS Spoofing: Redirecting traffic to malicious servers
  7. Replay Attacks: Capturing and re-transmitting valid data to gain unauthorized access

Regulatory and Compliance Requirements

Multiple regulatory frameworks mandate encryption in transit:

  • GDPR: Requires appropriate technical measures to protect personal data, explicitly mentioning encryption in transit
  • PCI-DSS: Mandates strong cryptography for transmitting cardholder data across open networks
  • HIPAA: Requires encryption of electronic protected health information (ePHI) in transit
  • SOC 2: Includes encryption in transit as a key security control
  • ISO 27001: Specifies cryptographic controls for data in transit

Non-compliance can result in significant fines, regulatory actions, and reputational damage.

Encryption Protocols Overview

This guide covers the following encryption protocols and their implementations:

  1. TLS/SSL: For HTTPS, email, and application protocols
  2. SSH: For remote access, file transfers, and tunneling
  3. IPsec/VPN: For site-to-site and remote access VPNs
  4. STARTTLS: For upgrading plaintext connections to encrypted
  5. mTLS: For mutual authentication in microservices
  6. DNSSEC: For securing DNS communications

TLS/SSL Fundamentals

Transport Layer Security (TLS) and its predecessor Secure Sockets Layer (SSL) are cryptographic protocols that provide secure communications over networks. Modern implementations use TLS 1.2 or TLS 1.3, with SSL and older TLS versions deprecated due to security vulnerabilities.

How TLS Works

TLS Handshake Process:

  1. Client Hello: Client sends supported cipher suites, TLS version, and random data
  2. Server Hello: Server selects cipher suite, sends certificate, and random data
  3. Certificate Verification: Client verifies server certificate against trusted CAs
  4. Key Exchange: Client and server establish shared encryption keys
  5. Finished: Both parties confirm handshake completion
  6. Encrypted Communication: All subsequent data encrypted with session keys

TLS Versions and Security

  • SSL 2.0/3.0: Deprecated, critically vulnerable (POODLE, DROWN attacks)
  • TLS 1.0/1.1: Deprecated as of 2020, should not be used
  • TLS 1.2: Currently widely supported and secure with proper configuration
  • TLS 1.3: Latest version, improved security and performance

This guide focuses exclusively on TLS 1.2 and 1.3.

Implementing HTTPS with Apache

Installing and Configuring Apache with TLS

# Install Apache and SSL module
sudo apt-get update
sudo apt-get install -y apache2
sudo a2enmod ssl
sudo a2enmod headers
sudo systemctl restart apache2

# Install Certbot for Let's Encrypt certificates
sudo apt-get install -y certbot python3-certbot-apache

# Obtain SSL certificate
sudo certbot --apache -d example.com -d www.example.com

# Certbot will automatically configure Apache and create renewal cron job

# Verify certificate installation
sudo certbot certificates

Apache TLS Best Practices Configuration

# Create strong TLS configuration
sudo tee /etc/apache2/conf-available/ssl-hardening.conf << 'EOF'
# TLS/SSL Security Hardening Configuration

<IfModule mod_ssl.c>
    # Disable SSLv2, SSLv3, TLS 1.0, TLS 1.1 (use only TLS 1.2 and 1.3)
    SSLProtocol -all +TLSv1.2 +TLSv1.3

    # Strong cipher suites (prioritize modern, forward-secret ciphers)
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256

    # Server cipher preference
    SSLHonorCipherOrder on

    # Disable SSL compression (mitigates CRIME attack)
    SSLCompression off

    # Enable OCSP stapling (reduces certificate verification latency)
    SSLUseStapling on
    SSLStaplingCache "shmcb:/var/run/apache2/ssl_stapling(32768)"
    SSLStaplingReturnResponderErrors off

    # Session cache
    SSLSessionCache "shmcb:/var/run/apache2/ssl_scache(512000)"
    SSLSessionCacheTimeout 300

    # Disable session tickets (potential privacy concern)
    SSLSessionTickets off

    # HSTS (HTTP Strict Transport Security) - force HTTPS
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

    # Additional security headers
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"

    # CSP (Content Security Policy) - adjust for your needs
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';"
</IfModule>
EOF

# Enable the configuration
sudo a2enconf ssl-hardening
sudo systemctl reload apache2

Virtual Host HTTPS Configuration

# Create secure virtual host configuration
sudo tee /etc/apache2/sites-available/example.com-ssl.conf << 'EOF'
<VirtualHost *:443>
    ServerName example.com
    ServerAlias www.example.com
    ServerAdmin [email protected]

    DocumentRoot /var/www/example.com/public_html

    # SSL Engine
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem

    # Logs
    ErrorLog ${APACHE_LOG_DIR}/example.com-ssl-error.log
    CustomLog ${APACHE_LOG_DIR}/example.com-ssl-access.log combined

    # Directory configuration
    <Directory /var/www/example.com/public_html>
        Options -Indexes +FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>
</VirtualHost>

# HTTP to HTTPS redirect
<VirtualHost *:80>
    ServerName example.com
    ServerAlias www.example.com

    # Redirect all HTTP to HTTPS
    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R=301,L]
</VirtualHost>
EOF

# Enable site
sudo a2ensite example.com-ssl
sudo systemctl reload apache2

Testing Apache TLS Configuration

# Test locally with OpenSSL
openssl s_client -connect localhost:443 -tls1_2
openssl s_client -connect localhost:443 -tls1_3

# Check supported protocols
for version in ssl2 ssl3 tls1 tls1_1 tls1_2 tls1_3; do
    echo -n "Testing $version: "
    openssl s_client -connect example.com:443 -$version < /dev/null 2>&1 | grep -q "Protocol" && echo "Supported" || echo "Not supported"
done

# Test with testssl.sh (comprehensive SSL/TLS testing)
git clone https://github.com/drwetter/testssl.sh.git
cd testssl.sh
./testssl.sh --fast https://example.com

# Test with SSL Labs (online)
# Visit: https://www.ssllabs.com/ssltest/analyze.html?d=example.com

Implementing HTTPS with Nginx

Installing and Configuring Nginx with TLS

# Install Nginx
sudo apt-get update
sudo apt-get install -y nginx

# Install Certbot for Let's Encrypt
sudo apt-get install -y certbot python3-certbot-nginx

# Obtain SSL certificate
sudo certbot --nginx -d example.com -d www.example.com

# Certbot automatically configures Nginx and sets up renewal

Nginx TLS Best Practices Configuration

# Create strong TLS configuration file
sudo tee /etc/nginx/conf.d/ssl-hardening.conf << 'EOF'
# TLS/SSL Security Hardening for Nginx

# SSL protocols (TLS 1.2 and 1.3 only)
ssl_protocols TLSv1.2 TLSv1.3;

# Strong cipher suites
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';

# Prefer server ciphers
ssl_prefer_server_ciphers on;

# DH parameters for forward secrecy
ssl_dhparam /etc/nginx/ssl/dhparam.pem;

# Session configuration
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_session_tickets off;

# OCSP stapling
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;

# Security headers
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
EOF

# Generate DH parameters (takes several minutes)
sudo mkdir -p /etc/nginx/ssl
sudo openssl dhparam -out /etc/nginx/ssl/dhparam.pem 4096

# Test configuration
sudo nginx -t

# Reload Nginx
sudo systemctl reload nginx

Nginx Virtual Host HTTPS Configuration

# Create server block for HTTPS
sudo tee /etc/nginx/sites-available/example.com << 'EOF'
# HTTP server - redirect to HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;

    # Redirect all HTTP to HTTPS
    return 301 https://$server_name$request_uri;
}

# HTTPS server
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name example.com www.example.com;

    # SSL certificates
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    # Document root
    root /var/www/example.com/public_html;
    index index.html index.php;

    # Logging
    access_log /var/log/nginx/example.com-access.log;
    error_log /var/log/nginx/example.com-error.log;

    # Security headers (additional to global config)
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';" always;

    # PHP processing (if needed)
    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
        fastcgi_param HTTPS on;
    }

    # Static file caching
    location ~* \.(jpg|jpeg|png|gif|ico|css|js|svg|woff|woff2|ttf|eot)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
    }

    # Deny access to hidden files
    location ~ /\. {
        deny all;
    }
}
EOF

# Enable site
sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

Database Encryption in Transit

MySQL/MariaDB TLS Configuration

# Generate SSL certificates for MySQL (if not using existing CA)
sudo mkdir -p /etc/mysql/ssl
cd /etc/mysql/ssl

# Create CA certificate
sudo openssl req -new -x509 -days 3650 -nodes \
    -out ca-cert.pem \
    -keyout ca-key.pem \
    -subj "/C=US/ST=State/L=City/O=Organization/CN=MySQL-CA"

# Create server certificate
sudo openssl req -new -nodes \
    -out server-req.pem \
    -keyout server-key.pem \
    -subj "/C=US/ST=State/L=City/O=Organization/CN=mysql-server"

# Sign server certificate with CA
sudo openssl x509 -req -days 3650 \
    -in server-req.pem \
    -CA ca-cert.pem \
    -CAkey ca-key.pem \
    -set_serial 01 \
    -out server-cert.pem

# Create client certificate
sudo openssl req -new -nodes \
    -out client-req.pem \
    -keyout client-key.pem \
    -subj "/C=US/ST=State/L=City/O=Organization/CN=mysql-client"

# Sign client certificate with CA
sudo openssl x509 -req -days 3650 \
    -in client-req.pem \
    -CA ca-cert.pem \
    -CAkey ca-key.pem \
    -set_serial 02 \
    -out client-cert.pem

# Set permissions
sudo chown mysql:mysql /etc/mysql/ssl/*
sudo chmod 600 /etc/mysql/ssl/*.pem

# Configure MySQL to use SSL
sudo tee -a /etc/mysql/mariadb.conf.d/50-server.cnf << 'EOF'

[mysqld]
# SSL/TLS Configuration
ssl-ca=/etc/mysql/ssl/ca-cert.pem
ssl-cert=/etc/mysql/ssl/server-cert.pem
ssl-key=/etc/mysql/ssl/server-key.pem

# Require SSL for all connections (optional but recommended)
require_secure_transport=ON

# TLS version
tls_version=TLSv1.2,TLSv1.3
EOF

# Restart MySQL
sudo systemctl restart mysql

# Verify SSL is enabled
mysql -u root -p -e "SHOW VARIABLES LIKE '%ssl%';"

# Create user requiring SSL
mysql -u root -p << 'EOF'
CREATE USER 'secure_user'@'%' IDENTIFIED BY 'strong_password' REQUIRE SSL;
GRANT ALL PRIVILEGES ON database_name.* TO 'secure_user'@'%';
FLUSH PRIVILEGES;
EOF

# Test SSL connection from client
mysql -u secure_user -p \
    --ssl-ca=/etc/mysql/ssl/ca-cert.pem \
    --ssl-cert=/etc/mysql/ssl/client-cert.pem \
    --ssl-key=/etc/mysql/ssl/client-key.pem

# Verify connection is encrypted
mysql -u secure_user -p -e "SHOW STATUS LIKE 'Ssl_cipher';"

PostgreSQL TLS Configuration

# Generate SSL certificates for PostgreSQL
sudo mkdir -p /var/lib/postgresql/ssl
cd /var/lib/postgresql/ssl

# Create server certificate (or use existing CA-signed cert)
sudo openssl req -new -x509 -days 3650 -nodes \
    -out server.crt \
    -keyout server.key \
    -subj "/C=US/ST=State/L=City/O=Organization/CN=postgresql-server"

# Set permissions
sudo chown postgres:postgres /var/lib/postgresql/ssl/*
sudo chmod 600 /var/lib/postgresql/ssl/server.key
sudo chmod 644 /var/lib/postgresql/ssl/server.crt

# Configure PostgreSQL to use SSL
sudo -u postgres psql -c "ALTER SYSTEM SET ssl = on;"
sudo -u postgres psql -c "ALTER SYSTEM SET ssl_cert_file = '/var/lib/postgresql/ssl/server.crt';"
sudo -u postgres psql -c "ALTER SYSTEM SET ssl_key_file = '/var/lib/postgresql/ssl/server.key';"
sudo -u postgres psql -c "ALTER SYSTEM SET ssl_min_protocol_version = 'TLSv1.2';"

# Restart PostgreSQL
sudo systemctl restart postgresql

# Configure pg_hba.conf to require SSL
sudo tee -a /etc/postgresql/*/main/pg_hba.conf << 'EOF'
# Require SSL for all non-local connections
hostssl all all 0.0.0.0/0 md5
hostssl all all ::/0 md5
EOF

# Reload configuration
sudo systemctl reload postgresql

# Test SSL connection
psql "postgresql://username@localhost/database?sslmode=require"

# Verify connection is encrypted
psql -U postgres -c "SELECT ssl, cipher FROM pg_stat_ssl WHERE pid = pg_backend_pid();"

MongoDB TLS Configuration

# Generate SSL certificate for MongoDB
sudo mkdir -p /etc/mongodb/ssl
cd /etc/mongodb/ssl

# Create certificate and key in single PEM file (MongoDB requirement)
sudo openssl req -new -x509 -days 3650 -nodes \
    -out mongodb-cert.pem \
    -keyout mongodb-key.pem \
    -subj "/C=US/ST=State/L=City/O=Organization/CN=mongodb-server"

# Combine certificate and key
sudo cat mongodb-cert.pem mongodb-key.pem > mongodb.pem

# Set permissions
sudo chown mongodb:mongodb /etc/mongodb/ssl/*
sudo chmod 600 /etc/mongodb/ssl/mongodb.pem

# Configure MongoDB to use TLS
sudo tee -a /etc/mongod.conf << 'EOF'

net:
  tls:
    mode: requireTLS
    certificateKeyFile: /etc/mongodb/ssl/mongodb.pem
    allowInvalidCertificates: false
    allowInvalidHostnames: false
EOF

# Restart MongoDB
sudo systemctl restart mongod

# Connect with TLS
mongo --tls --tlsCertificateKeyFile /etc/mongodb/ssl/mongodb.pem

# Connect from application (example connection string)
# mongodb://localhost:27017/?tls=true&tlsCertificateKeyFile=/etc/mongodb/ssl/mongodb.pem

Email Encryption in Transit

Postfix with TLS (SMTP)

# Install Postfix
sudo apt-get install -y postfix

# Generate or use existing SSL certificate
# Using Let's Encrypt certificate
CERT_DIR="/etc/letsencrypt/live/mail.example.com"

# Configure Postfix for TLS
sudo tee -a /etc/postfix/main.cf << EOF

# TLS Configuration for Outgoing Mail (SMTP)
smtp_tls_security_level = may
smtp_tls_loglevel = 1
smtp_tls_session_cache_database = btree:\${data_directory}/smtp_scache
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt

# TLS Configuration for Incoming Mail (SMTPD)
smtpd_tls_security_level = may
smtpd_tls_cert_file = ${CERT_DIR}/fullchain.pem
smtpd_tls_key_file = ${CERT_DIR}/privkey.pem
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_database = btree:\${data_directory}/smtpd_scache
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_mandatory_ciphers = high
smtpd_tls_ciphers = high

# Require TLS for specific domains (optional)
smtp_tls_policy_maps = hash:/etc/postfix/tls_policy

EOF

# Create TLS policy file for specific domains
sudo tee /etc/postfix/tls_policy << 'EOF'
# Force TLS for specific domains
example.com encrypt
partner.com secure
EOF

sudo postmap /etc/postfix/tls_policy

# Configure submission port (587) for authenticated users
sudo tee -a /etc/postfix/master.cf << 'EOF'

submission inet n       -       y       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_tls_auth_only=yes
  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING
EOF

# Restart Postfix
sudo systemctl restart postfix

# Test TLS connection
openssl s_client -connect mail.example.com:25 -starttls smtp
openssl s_client -connect mail.example.com:587 -starttls smtp

# Check mail logs for TLS usage
sudo tail -f /var/log/mail.log | grep TLS

Dovecot with TLS (IMAP/POP3)

# Install Dovecot
sudo apt-get install -y dovecot-core dovecot-imapd dovecot-pop3d

# Configure Dovecot SSL/TLS
sudo tee /etc/dovecot/conf.d/10-ssl.conf << 'EOF'
# SSL/TLS Configuration

ssl = required

# SSL certificate and key
ssl_cert = </etc/letsencrypt/live/mail.example.com/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.example.com/privkey.pem

# SSL protocols
ssl_min_protocol = TLSv1.2
ssl_protocols = !SSLv2 !SSLv3 !TLSv1 !TLSv1.1

# SSL ciphers (strong ciphers only)
ssl_cipher_list = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256

# Prefer server ciphers
ssl_prefer_server_ciphers = yes

# DH parameters
ssl_dh = </etc/dovecot/dh.pem
EOF

# Generate DH parameters
sudo openssl dhparam -out /etc/dovecot/dh.pem 4096

# Restart Dovecot
sudo systemctl restart dovecot

# Test IMAP TLS
openssl s_client -connect mail.example.com:993

# Test POP3 TLS
openssl s_client -connect mail.example.com:995

# Test STARTTLS on port 143 (IMAP)
openssl s_client -connect mail.example.com:143 -starttls imap

SSH Encryption

SSH provides encrypted remote access and file transfer. Modern SSH uses strong encryption by default, but configuration hardening improves security.

SSH Server Hardening

# Create hardened SSH configuration
sudo tee /etc/ssh/sshd_config.d/hardening.conf << 'EOF'
# SSH Hardening Configuration

# Protocol version
Protocol 2

# Host keys (use only modern algorithms)
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers (strong, modern ciphers only)
Ciphers [email protected],[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr

# MACs (message authentication codes)
MACs [email protected],[email protected],hmac-sha2-512,hmac-sha2-256

# Key exchange algorithms
KexAlgorithms curve25519-sha256,[email protected],ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256

# Public key authentication
PubkeyAuthentication yes

# Password authentication (disable for key-only auth)
PasswordAuthentication no
PermitEmptyPasswords no

# Challenge-response authentication
ChallengeResponseAuthentication no

# Root login
PermitRootLogin no

# X11 forwarding
X11Forwarding no

# TCP forwarding
AllowTcpForwarding no

# Agent forwarding
AllowAgentForwarding no

# Logging
LogLevel VERBOSE
SyslogFacility AUTH

# Session settings
ClientAliveInterval 300
ClientAliveCountMax 2
LoginGraceTime 60
MaxAuthTries 3
MaxSessions 10
EOF

# Restart SSH
sudo systemctl restart sshd

# Test SSH configuration
sudo sshd -t

# Verify cipher support
ssh -Q cipher
ssh -Q mac
ssh -Q kex

SSH Client Configuration

# Create user SSH config
mkdir -p ~/.ssh
chmod 700 ~/.ssh

tee ~/.ssh/config << 'EOF'
# Global SSH client hardening

Host *
    # Ciphers
    Ciphers [email protected],[email protected],[email protected]

    # MACs
    MACs [email protected],[email protected]

    # Key exchange
    KexAlgorithms curve25519-sha256,[email protected],ecdh-sha2-nistp521

    # Public key authentication
    PubkeyAuthentication yes
    PasswordAuthentication no

    # Connection settings
    ServerAliveInterval 60
    ServerAliveCountMax 3

    # Known hosts
    StrictHostKeyChecking ask
    VisualHostKey yes

# Host-specific configurations
Host production-server
    HostName prod.example.com
    User admin
    Port 22
    IdentityFile ~/.ssh/production_key
    IdentitiesOnly yes
EOF

chmod 600 ~/.ssh/config

SFTP Server Configuration

# Configure SFTP with chroot jail
sudo tee -a /etc/ssh/sshd_config << 'EOF'

# SFTP subsystem
Subsystem sftp internal-sftp

# SFTP user group configuration
Match Group sftpusers
    ChrootDirectory /home/%u
    ForceCommand internal-sftp
    AllowTcpForwarding no
    X11Forwarding no
    PermitTunnel no
EOF

# Create SFTP group and user
sudo groupadd sftpusers
sudo useradd -g sftpusers -s /bin/false -m sftpuser

# Setup directory structure
sudo chown root:root /home/sftpuser
sudo chmod 755 /home/sftpuser
sudo mkdir /home/sftpuser/uploads
sudo chown sftpuser:sftpusers /home/sftpuser/uploads

# Set password or add SSH key
sudo passwd sftpuser
# Or: sudo mkdir -p /home/sftpuser/.ssh && sudo tee /home/sftpuser/.ssh/authorized_keys < public_key

# Restart SSH
sudo systemctl restart sshd

# Test SFTP connection
sftp sftpuser@localhost

VPN and IPsec

OpenVPN Configuration

# Install OpenVPN
sudo apt-get update
sudo apt-get install -y openvpn easy-rsa

# Setup PKI
make-cadir ~/openvpn-ca
cd ~/openvpn-ca

# Configure CA variables
tee vars << 'EOF'
export KEY_COUNTRY="US"
export KEY_PROVINCE="State"
export KEY_CITY="City"
export KEY_ORG="Organization"
export KEY_EMAIL="[email protected]"
export KEY_OU="IT"
export KEY_NAME="server"
EOF

source vars
./clean-all
./build-ca

# Generate server certificate
./build-key-server server

# Generate Diffie-Hellman parameters
./build-dh

# Generate HMAC signature
openvpn --genkey --secret keys/ta.key

# Copy certificates to OpenVPN directory
sudo cp ~/openvpn-ca/keys/{server.crt,server.key,ca.crt,dh2048.pem,ta.key} /etc/openvpn/

# Configure OpenVPN server
sudo tee /etc/openvpn/server.conf << 'EOF'
# OpenVPN Server Configuration

port 1194
proto udp
dev tun

# Certificates
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem

# Network
server 10.8.0.0 255.255.255.0
topology subnet

# Routes
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

# Security
tls-auth ta.key 0
cipher AES-256-GCM
auth SHA256
tls-version-min 1.2
tls-cipher TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384:TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256

# Privileges
user nobody
group nogroup

# Persistence
persist-key
persist-tun

# Logging
status /var/log/openvpn/openvpn-status.log
log-append /var/log/openvpn/openvpn.log
verb 3

# Connection
keepalive 10 120
comp-lzo
max-clients 100
EOF

# Enable IP forwarding
sudo sed -i 's/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=1/' /etc/sysctl.conf
sudo sysctl -p

# Configure firewall
sudo iptables -A FORWARD -i tun0 -j ACCEPT
sudo iptables -A FORWARD -o tun0 -j ACCEPT
sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

# Start OpenVPN
sudo systemctl enable openvpn@server
sudo systemctl start openvpn@server

# Generate client certificates
cd ~/openvpn-ca
source vars
./build-key client1

# Create client configuration
cat > ~/client1.ovpn << 'EOF'
client
dev tun
proto udp
remote vpn.example.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-GCM
auth SHA256
tls-version-min 1.2
verb 3

<ca>
[PASTE ca.crt contents]
</ca>

<cert>
[PASTE client1.crt contents]
</cert>

<key>
[PASTE client1.key contents]
</key>

<tls-auth>
[PASTE ta.key contents]
</tls-auth>
key-direction 1
EOF

WireGuard VPN (Modern Alternative)

# Install WireGuard
sudo apt-get install -y wireguard

# Generate server keys
sudo mkdir -p /etc/wireguard
cd /etc/wireguard
umask 077
wg genkey | tee server_private.key | wg pubkey > server_public.key

# Configure WireGuard server
sudo tee /etc/wireguard/wg0.conf << 'EOF'
[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = [PASTE server_private.key contents]

# Enable IP forwarding
PostUp = sysctl -w net.ipv4.ip_forward=1
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

# Client peer
[Peer]
PublicKey = [CLIENT_PUBLIC_KEY]
AllowedIPs = 10.0.0.2/32
EOF

# Start WireGuard
sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0

# Check status
sudo wg show

# Generate client keys
wg genkey | tee client_private.key | wg pubkey > client_public.key

# Create client configuration
cat > client.conf << 'EOF'
[Interface]
Address = 10.0.0.2/24
PrivateKey = [PASTE client_private.key]
DNS = 8.8.8.8

[Peer]
PublicKey = [PASTE server_public.key]
Endpoint = vpn.example.com:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25
EOF

Monitoring and Verification

TLS Certificate Monitoring

# Create certificate monitoring script
cat > /root/scripts/certificate_monitor.sh << 'EOF'
#!/bin/bash
# TLS Certificate Monitoring and Expiration Alert

REPORT_FILE="/var/log/security/certificate_status_$(date +%Y%m%d).log"
ALERT_EMAIL="[email protected]"
WARN_DAYS=30

exec > >(tee -a "$REPORT_FILE")

echo "========================================"
echo "TLS CERTIFICATE STATUS REPORT"
echo "Date: $(date)"
echo "========================================"
echo ""

check_cert() {
    local domain="$1"
    local port="${2:-443}"

    echo "=== Checking $domain:$port ==="

    # Get certificate expiration
    EXPIRY=$(echo | openssl s_client -servername "$domain" -connect "$domain:$port" 2>/dev/null | \
             openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)

    if [ -n "$EXPIRY" ]; then
        EXPIRY_EPOCH=$(date -d "$EXPIRY" +%s)
        NOW_EPOCH=$(date +%s)
        DAYS_LEFT=$(( ($EXPIRY_EPOCH - $NOW_EPOCH) / 86400 ))

        echo "Certificate expires: $EXPIRY"
        echo "Days until expiration: $DAYS_LEFT"

        if [ "$DAYS_LEFT" -lt "$WARN_DAYS" ]; then
            echo "WARNING: Certificate expiring soon!" | \
                mail -s "Certificate Expiration Warning: $domain" "$ALERT_EMAIL"
        fi

        # Check cipher and protocol
        echo | openssl s_client -connect "$domain:$port" 2>/dev/null | \
            grep -E "Protocol|Cipher"

    else
        echo "ERROR: Could not retrieve certificate for $domain:$port"
        echo "Certificate check failed for $domain:$port" | \
            mail -s "Certificate Check Failure" "$ALERT_EMAIL"
    fi

    echo ""
}

# Check configured domains
check_cert "example.com" 443
check_cert "mail.example.com" 25
check_cert "mail.example.com" 587
check_cert "mail.example.com" 993

# Check local certificates
echo "=== Local Certificate Files ==="
for cert in /etc/letsencrypt/live/*/cert.pem; do
    if [ -f "$cert" ]; then
        DOMAIN=$(basename $(dirname "$cert"))
        EXPIRY=$(openssl x509 -in "$cert" -noout -enddate | cut -d= -f2)
        EXPIRY_EPOCH=$(date -d "$EXPIRY" +%s)
        NOW_EPOCH=$(date +%s)
        DAYS_LEFT=$(( ($EXPIRY_EPOCH - $NOW_EPOCH) / 86400 ))

        echo "Domain: $DOMAIN"
        echo "Expires: $EXPIRY ($DAYS_LEFT days)"

        if [ "$DAYS_LEFT" -lt "$WARN_DAYS" ]; then
            echo "WARNING: Certificate expiring soon!"
        fi

        echo ""
    fi
done

echo "========================================"
echo "REPORT COMPLETED: $(date)"
echo "========================================"

EOF

chmod +x /root/scripts/certificate_monitor.sh

# Schedule daily certificate checks
echo "0 8 * * * /root/scripts/certificate_monitor.sh" | sudo crontab -

Connection Encryption Verification

# Create encryption verification script
cat > /root/scripts/verify_encryption.sh << 'EOF'
#!/bin/bash
# Verify Encryption in Transit

REPORT_FILE="/var/log/security/encryption_verification_$(date +%Y%m%d).txt"

exec > >(tee -a "$REPORT_FILE")

echo "========================================"
echo "ENCRYPTION IN TRANSIT VERIFICATION"
echo "Date: $(date)"
echo "========================================"
echo ""

# Web Server Encryption
echo "=== Web Server HTTPS Status ==="
if systemctl is-active --quiet apache2 nginx; then
    netstat -tulpn | grep -E ":443|:80"
    echo ""
    echo "Testing HTTPS connection:"
    curl -I https://localhost 2>&1 | head -5
fi
echo ""

# Database Encryption
echo "=== Database TLS Status ==="
if systemctl is-active --quiet mysql mariadb; then
    echo "MySQL SSL Status:"
    mysql -u root -p -e "SHOW VARIABLES LIKE '%ssl%';" 2>/dev/null
    echo ""
    echo "Current connections SSL status:"
    mysql -u root -p -e "SHOW STATUS LIKE 'Ssl%';" 2>/dev/null
fi

if systemctl is-active --quiet postgresql; then
    echo "PostgreSQL SSL Status:"
    sudo -u postgres psql -c "SHOW ssl;" 2>/dev/null
fi
echo ""

# Email Encryption
echo "=== Email Server TLS Status ==="
if systemctl is-active --quiet postfix; then
    echo "Postfix TLS configuration:"
    postconf | grep tls_security_level
    echo ""
    echo "Recent TLS connections:"
    grep "TLS connection established" /var/log/mail.log 2>/dev/null | tail -5
fi

if systemctl is-active --quiet dovecot; then
    echo "Dovecot SSL configuration:"
    doveconf | grep ssl
fi
echo ""

# SSH Encryption
echo "=== SSH Encryption Status ==="
sshd -T | grep -E "ciphers|macs|kexalgorithms"
echo ""

# Active encrypted connections
echo "=== Active Encrypted Connections ==="
ss -t -o state established | grep -E ":443|:993|:995|:465|:22"
echo ""

echo "========================================"
echo "VERIFICATION COMPLETED: $(date)"
echo "========================================"

EOF

chmod +x /root/scripts/verify_encryption.sh

# Schedule weekly verification
echo "0 9 * * 1 /root/scripts/verify_encryption.sh | mail -s 'Weekly Encryption Verification' [email protected]" | sudo crontab -

Compliance and Auditing

Create Comprehensive Encryption Audit

# Create encryption in transit compliance audit
cat > /root/scripts/encryption_transit_audit.sh << 'EOF'
#!/bin/bash
# Encryption in Transit Compliance Audit

AUDIT_FILE="/var/log/security/encryption_transit_audit_$(date +%Y%m%d).txt"

exec > >(tee -a "$AUDIT_FILE")

echo "========================================"
echo "ENCRYPTION IN TRANSIT AUDIT"
echo "Date: $(date)"
echo "Auditor: $(whoami)"
echo "========================================"
echo ""

echo "=== COMPLIANCE CHECKLIST ==="
echo ""

# 1. TLS Version Requirements
echo "[ ] Requirement: TLS 1.2 or higher only"
echo "Apache TLS protocols:"
apachectl -M | grep ssl && apachectl -t -D DUMP_CONFIG 2>/dev/null | grep SSLProtocol
echo "Nginx TLS protocols:"
nginx -T 2>/dev/null | grep ssl_protocols
echo ""

# 2. Strong Cipher Suites
echo "[ ] Requirement: Strong cipher suites only"
echo "Configured ciphers (Apache):"
apachectl -t -D DUMP_CONFIG 2>/dev/null | grep SSLCipherSuite | head -3
echo "Configured ciphers (Nginx):"
nginx -T 2>/dev/null | grep ssl_ciphers | head -3
echo ""

# 3. HSTS Enabled
echo "[ ] Requirement: HSTS header present"
curl -I https://localhost 2>/dev/null | grep -i strict-transport-security
echo ""

# 4. Certificate Validity
echo "[ ] Requirement: Valid certificates, 30+ days until expiration"
for domain in example.com mail.example.com; do
    echo "Checking $domain..."
    echo | openssl s_client -connect "$domain:443" 2>/dev/null | openssl x509 -noout -dates
done
echo ""

# 5. Database Encryption
echo "[ ] Requirement: Database connections encrypted"
if systemctl is-active --quiet mysql mariadb; then
    mysql -u root -p -e "SELECT COUNT(*) as encrypted_connections FROM information_schema.processlist WHERE ssl_cipher IS NOT NULL;" 2>/dev/null
fi
echo ""

# 6. Email Transport Encryption
echo "[ ] Requirement: Email transport encrypted"
postconf | grep "smtp.*tls_security_level"
echo ""

# 7. SSH Strong Encryption
echo "[ ] Requirement: SSH using strong ciphers"
sshd -T | grep ciphers
echo ""

# 8. No Deprecated Protocols
echo "[ ] Requirement: SSLv2, SSLv3, TLS 1.0, TLS 1.1 disabled"
for proto in ssl2 ssl3 tls1 tls1_1; do
    echo -n "Testing $proto: "
    timeout 2 openssl s_client -connect localhost:443 -$proto < /dev/null 2>&1 | \
        grep -q "handshake failure" && echo "Disabled" || echo "ENABLED (BAD)"
done
echo ""

# 9. Internal Traffic Encryption
echo "[ ] Requirement: Internal service-to-service encrypted"
echo "Active encrypted connections:"
ss -t | grep -E ":443|:3306|:5432" | wc -l
echo ""

# 10. Monitoring and Logging
echo "[ ] Requirement: TLS connections logged"
echo "Recent TLS log entries:"
grep -i "tls\|ssl" /var/log/apache2/access.log /var/log/nginx/access.log /var/log/mail.log 2>/dev/null | wc -l
echo ""

echo "========================================"
echo "AUDIT COMPLETED"
echo "Report saved to: $AUDIT_FILE"
echo "========================================"

EOF

chmod +x /root/scripts/encryption_transit_audit.sh

Conclusion

Encryption in transit is a foundational security control that protects data as it moves across networks, preventing interception, tampering, and unauthorized access. This guide has provided comprehensive coverage of implementing encryption for web traffic (HTTPS), database connections, email communications, remote access (SSH), and VPN connectivity.

Key Takeaways

1. TLS 1.2+ is Mandatory: Disable all legacy protocols (SSLv2, SSLv3, TLS 1.0, TLS 1.1) and use only TLS 1.2 and TLS 1.3 with strong cipher suites.

2. Certificate Management is Critical: Implement automated certificate renewal, monitor expiration dates, and maintain proper certificate chain validation.

3. Defense in Depth: Encrypt all network communications, not just internet-facing traffic. Internal service-to-service communication should also be encrypted.

4. Perfect Forward Secrecy: Use cipher suites that support perfect forward secrecy (ECDHE, DHE) to protect past sessions even if keys are compromised.

5. Regular Testing and Monitoring: Continuously verify encryption implementation, test cipher strength, and monitor for configuration drift.

Implementation Priority

  1. Immediate Priority:

    • Enable HTTPS for all web applications
    • Disable legacy protocols (SSL, TLS 1.0/1.1)
    • Implement HSTS headers
    • Configure certificate autorenewal

  2. Short-term (1-3 months):

    • Enable database connection encryption
    • Secure email transport with TLS
    • Implement SSH hardening
    • Deploy certificate monitoring

  3. Long-term:

    • Implement mutual TLS (mTLS) for microservices
    • Deploy VPN for remote access
    • Encrypt all internal service communications
    • Regular security audits and penetration testing

By implementing the techniques outlined in this guide, you establish robust encryption in transit that protects your organization's data as it moves across networks, ensuring confidentiality, integrity, and compliance with regulatory requirements.