<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Hello,<br>
I suggest you have a look at the windows "subst" command (available in
ALL versions of windows),<br>
that allows a virtual drive to be mapped to a directory.<br>
So you can imagine that stunnel always uses the cert Z:/acert.pem<br>
but with the Z drive pointing to C:\users\userA\, or to ...userB..., <br>
with a simple startup bat script.<br>
If the script fails, then NO risk that userB uses cert of user A.<br>
But in that case stunnel must be started ALSO in the startup menu
script (the same as that doing the "subst"),<br>
and NOT as a service.<br>
<br>
Hope this may help,<br>
Pierre<br>
<br>
Le 31/08/2010 00:54, Bucci, David G a écrit :
<blockquote
cite="mid:581C2F1AB3315145BD64D2022634BF8D01A666E272@HVXMSP4.us.lmco.com"
type="cite">
<div><font color="navy" face="Arial" size="2">Thx for replying, Scott
... how did you handle multiple users on the PC, though? They all
shared that cert?<br>
<br>
I thought about having a single location and copying to there on user
login (from a standard location in a user's home dir, e.g.) ... then
firing up stunnel ... but it seems like so much can go wrong, resulting
in User B accessing using User A's certificate (because the copy
failed, e.g.). And we're leery of exposing User A's cert to User B -
especially since stunnel doesn't support encryption of the user's key,
right? So the permissions would be a little tricky and maybe fragile.<br>
<br>
Seems like there should be a straightforward way to do it, dadnabit!<br>
</font></div>
<br>
<div>
<hr tabindex="-1" width="100%" align="center" size="2"><font
face="Tahoma" size="2">
<b>From</b>: Scott Gifford <a class="moz-txt-link-rfc2396E" href="mailto:sgifford@suspectclass.com"><sgifford@suspectclass.com></a>
<br>
<b>To</b>: Bucci, David G
<br>
<b>Cc</b>: <a class="moz-txt-link-abbreviated" href="mailto:stunnel-users@mirt.net">stunnel-users@mirt.net</a> <a class="moz-txt-link-rfc2396E" href="mailto:stunnel-users@mirt.net"><stunnel-users@mirt.net></a>
<br>
<b>Sent</b>: Mon Aug 30 17:41:09 2010<br>
<b>Subject</b>: EXTERNAL: Re: [stunnel-users] Individual user certs
for each person who uses Windows PC
<br>
</font><br>
</div>
On Mon, Aug 30, 2010 at 3:41 PM, Bucci, David G <span dir="ltr"><<a
moz-do-not-send="true" href="mailto:david.g.bucci@lmco.com">david.g.bucci@lmco.com</a>></span>
wrote:
<div>
<div class="gmail_quote">
<div>[ ... ] </div>
<blockquote class="gmail_quote"
style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">I've
tried using envvars in the stunnel.conf (e.g., cert =
%USERPROFILE%\usercert.pem), tried adjusting the command line to
include "-p %USERPROFILE%\usercert.pem" as an option ... </blockquote>
<div><br>
</div>
<div>We implemented something similar by simply making a "C:\stunnel"
directory on each PC, naming the certificate the same thing on all
machines, then hardcoding that path into the stunnel configuration
(e.g. "C:\stunnel\usercert.pem"). Not quite as nice as
%USERPROFILE%\usercert.pem, but it worked. :-)</div>
<div><br>
</div>
<div>Hope this is helpful,</div>
<div><br>
</div>
<div>----Scott.</div>
<div><br>
</div>
</div>
</div>
<pre wrap="">
<fieldset class="mimeAttachmentHeader"></fieldset>
_______________________________________________
stunnel-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:stunnel-users@mirt.net">stunnel-users@mirt.net</a>
<a class="moz-txt-link-freetext" href="http://stunnel.mirt.net/mailman/listinfo/stunnel-users">http://stunnel.mirt.net/mailman/listinfo/stunnel-users</a>
</pre>
</blockquote>
<br>
</body>
</html>