stunnel-users

3306 discussions

Fw: Using stunnel to add https to a webserver that doesn't have ssl setup
by Michael Avanessian 02 Nov '12

02 Nov '12

Thanks. I typically let my webserver handle SSL whenever I can since it's much easier that way; especially since I know how to handle http->https urlrewrites that way already; and, plenty of examples on the web for IIS. The reasons for adding stunnel into the mix in this scenerio completely outweight not having it at all. I couldn't find any examples anywhere showing how to handle a simple http to https URL redirect if stunnel is involved; not even in javascript. Hopefully someone here has the expertise to offer a solution at least in html. On 30.10.2012 20:39, MKANET wrote > Thanks for the quick reply! So... what http code do I use to break > out the infinite loop so it loads only once? I'm afraid I can't answer that one, as you're using IIS and I'm Unices centered. FWIW, in situations where the port-80 service does *nothing but* hand out redirects to port 443, I typically let the full-blown webserver handle the HTTPS (whether natively or behind an SSL wrapper) and use a boilerplate PERL script (alas, not readily usable on Windows) for the redirecting. I've seen too many kinds of webserver doing redirections to autodetermined URLs that happen to miss some vital part of the originally requested URL, including some that *cause* the browser to drop from HTTPS back to HTTP in the first place. :-S Regards, ----- Forwarded Message ---- Thanks for the quick reply! So... what http code do I use to break out the infinite loop so it loads only once? I think the other 2 circumstances may have something similar happening to them (which are forwarded using the web server instead). If I use the webserver to rewrite the URL, the web browser tries to do something (I can't tell what), then returns the error below: The page isn't redirecting properly Firefox has detected that the server is redirecting the request for this address in a way that will never complete. > Normally, I could do this a few different ways (provided my webserver > had ssl added to it natively in a normal way) 1. webserver URL Rewrite > plugin 2. webserver redirect plugin > 3: > > For whatever reason, I'm having all sorts of weird issues when > trying the three methods above if I use stunnel for ssl instead of > using the webserver's builtin ssl. Please note that traffic coming out of the stunnel looks - and actually *is* - just as port-80-ish to the actual webserver as native HTTP requests do, so unless you take special measures to break the loop, the webserver will try to (re-)redirect *that, too*. Regards, J. Bern --

2 1

enabling https capability
by John A. Wallace 01 Nov '12

01 Nov '12

Not sure if this is the right place to ask, but I will give it a try because it seems likely that someone here can point me in the right direction if need be. I am not a programmer. I have an application that can make http connections but not https. The connections are made from a Windows command line interface, not a browser. I would like to enable it to make https connections too without having to reinvent the wheel. If there is some way to connect it to an intermediary proxy program that does have built-in support for the https protocol, that would be swell. Is such a thing possible or is there another solution I don't see? Thanks. John

2 1

Fwd: Trying to minimize memory usage for a scenario where we have several long-lived HTTPS connections.
by Jeremy Frady 31 Oct '12

31 Oct '12

Hello all, Thanks for taking the time to read this. We're operating on a low spec system that can not be modified at this point. stunnel was introduced at the last minute, without consideration to resource requirements and now consumes enough ram to cause the kernel to issue OOM exceptions. So in short, we are trying to trade increased CPU usage for less memory usage and have tried setting “sessions” to 3600 to reduce memory pressure, but unfortunately it doesn't last. Our current solution is to cron a restart of stunnel on a regular basis, but would prefer to limit number of threads or number of cache entries or something else altogether similarly gentler. Thanks again for your consideration and assistance in this! Regards, Jeremy

1 0

6 processes + out of memory issues on CentOS 6 stunnel (4.29)
by Todd Rinaldo 31 Oct '12

31 Oct '12

I'm experimenting with using the stunnel that comes with CentOS 6 (4.29). I have a config file that is successfully being used on stunnel version 4.15 on the same host without any issues. My issues: 1. starting stunnel creates 6 processes. I assume this has something to do with libwrap, but I'm not finding much discussion about it by doing a search. I'm also assuming that the binaries are forking after load, so it's not a significant memory expense to do this due to COW. Is this correct? 2. I'm getting 't of memory' (no "ou" in the error) messages from syslog when I do more than one request via chrome to port 2087. The process indicated from the message points to the stunnel process that has ownership of the open ports. A single request to this port doesn't seem to spawn the issue. Can anyone suggest what might be causing this? Upgrading to a newer version of stunnel is possible, but I would prefer to keep the version Red Hat provides so they can be on the hook for CVE issues. My config file follows: ----- cert = /var/cpanel/ssl/cpanel/cpanel.pem chroot = /usr/local/cpanel/var/run/stunnel/ # PID is created inside chroot jail pid = /stunnel.pid setuid = cpanel setgid = cpanel # Service-level configuration [cpanelhttps] accept = 2083 connect = 2082 TIMEOUTclose = 0 [whmhttps] accept = 2087 connect = 2086 TIMEOUTclose = 0 [webmailhttps] accept = 2096 connect = 2095 TIMEOUTclose = 0

1 0

Re: [stunnel-users] Using stunnel to add https to a webserver that doesn't have ssl setup
by Michael Avanessian 30 Oct '12

30 Oct '12

Thanks for the quick reply! So... what http code do I use to break out the infinite loop so it loads only once? I think the other 2 circumstances may have something similar happening to them (which are forwarded using the web server instead). If I use the webserver to rewrite the URL, the web browser tries to do something (I can't tell what), then returns the error below: The page isn't redirecting properly Firefox has detected that the server is redirecting the request for this address in a way that will never complete. > Normally, I could do this a few different ways (provided my webserver > had ssl added to it natively in a normal way) 1. webserver URL Rewrite > plugin 2. webserver redirect plugin > 3: > > For whatever reason, I'm having all sorts of weird issues when > trying the three methods above if I use stunnel for ssl instead of > using the webserver's builtin ssl. Please note that traffic coming out of the stunnel looks - and actually *is* - just as port-80-ish to the actual webserver as native HTTP requests do, so unless you take special measures to break the loop, the webserver will try to (re-)redirect *that, too*. Regards, J. Bern --

2 1

Using stunnel to add https to a webserver that doesn't have ssl setup
by Michael Avanessian 30 Oct '12

30 Oct '12

Hi there. I appreciate that you guys are all helping each other out. I am brand new to stunnel. Currently, I'm using stunnel to add https to a webserver that doesn't have ssl setup; which works great. I prefer to do that instead of using the webserver's builtin ssl feature. CONFIGURATION: Stunnel.conf includes (which adds ssl to incoming http traffic on port 443) [https] accept = 443 connect = 80 Also, incoming http:80 traffic can also come in; which would bypass stunnel, and go directly to the webserver as http. OBJECTIVE: I am trying to make it so when someone visits: http://mywebsite.com (it forwards automatically to https://mywebsite.com). Normally, I could do this a few different ways (provided my webserver had ssl added to it natively in a normal way) 1. webserver URL Rewrite plugin 2. webserver redirect plugin 3: <meta http-equiv="refresh" content="0; url=https://mywebsite.com"> For whatever reason, I'm having all sorts of weird issues when trying the three methods above if I use stunnel for ssl instead of using the webserver's builtin ssl. The first two methods result in web browser redirect errors, the third method result in an infinite loop reloading the https website. Can someone please tell me what extra accommodation I need to make considering that using stunnel for https can complicate things. I'm using IIS 7.5 as my webserver. I've tried using the the URL rewrite 2.0 mod using the below rule (which works for normal builtin ssl support in the webserver: <rule name="Redirect to HTTPS" stopProcessing="true"> <match url="(.*)" /> <conditions><add input="{HTTPS}" pattern="^OFF$" /> </conditions> </rule> I have also tried the "http redirect" mod; which I can forward to any website except for the one I'm trying to do. Both take me to the https equivalent and give a redirect error. Could someone please be kind enough to tell me what I'm missing? Thanks!

2 1

How upgrade stunnel?
by magali morales 30 Oct '12

30 Oct '12

Hi!! I have installed the version 4.44 of stunnel, haproxy I am currently using 1.4.22. I need to update stunnel most recent version. How do I update stunnel to the latest version? And I want to know How do I uninstall stunnel? I hope you can help me, I thank you in advance!

7 7

TIMEOUTclose exceeded: closing
by Michael Wittig 25 Oct '12

25 Oct '12

Hi, I am using stunnes 4.54, my config looks like this: chroot = /opt/stunnel/jail/ setuid = stunnel setgid = stunnel pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 syslog = yes debug = local1.warning fips = no [http] cert = /opt/stunnel/www.crt key = /opt/stunnel/www.key sslVersion = all options = NO_SSLv2 renegotiation = no accept = 192.168.72.10:443 connect = 192.168.71.10:80 TIMEOUTclose = 0 xforwardedfor = yes My log is full with: Oct 25 14:49:33 www stunnel: LOG3[15114:140668359968512]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing Oct 25 14:49:36 www stunnel: LOG3[15114:140668360591104]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing Oct 25 14:50:08 www stunnel: LOG3[15114:140668360812288]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing Oct 25 14:50:13 www stunnel: LOG3[15114:140668360591104]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing The doc suggests to "set to 0 for buggy MSIE" the mailing list tells me "You requested close timeout of 0 seconds and that's exactly what you get." But i still don't understand why this is an error and what can I do to get rid of it? Or is it okay to don't look for errors in the log? Regards, Michael

2 1

some version issue
by Sergey Pimenov 25 Oct '12

25 Oct '12

Hello, I have a little problem, working with stunnel. The problem is: 25 10:50:53 LOG3[2612:1972]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number and the full log: 25 10:50:32 LOG7[2612:2988]: No limit detected for the number of clients 2012.10.25 10:50:32 LOG5[2612:2988]: stunnel 4.53 on x86-pc-mingw32-gnu platform 2012.10.25 10:50:32 LOG5[2612:2988]: Compiled/running with OpenSSL 0.9.8s-fips 4 Jan 2012 2012.10.25 10:50:32 LOG5[2612:2988]: Threading:WIN32 SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:SELECT+IPv6 2012.10.25 10:50:32 LOG5[2612:2988]: Reading configuration from file stunnel.conf 2012.10.25 10:50:33 LOG5[2612:2988]: FIPS mode is enabled 2012.10.25 10:50:33 LOG7[2612:2988]: Compression not enabled 2012.10.25 10:50:33 LOG7[2612:2988]: PRNG seeded successfully 2012.10.25 10:50:33 LOG6[2612:2988]: Initializing service section [POS] 2012.10.25 10:50:33 LOG7[2612:2988]: Certificate: C:\Arcus2\SSL\pos3135pem.pem 2012.10.25 10:50:33 LOG7[2612:2988]: Certificate loaded 2012.10.25 10:50:33 LOG7[2612:2988]: Key file: C:\Arcus2\SSL\pos3135key.pem 2012.10.25 10:50:33 LOG7[2612:2988]: Private key loaded 2012.10.25 10:50:33 LOG7[2612:2988]: SSL options set: 0x00000004 2012.10.25 10:50:33 LOG5[2612:2988]: Configuration successful 2012.10.25 10:50:33 LOG7[2612:2988]: Service [POS] (FD=180) bound to 127.0.0.1:9021 2012.10.25 10:50:53 LOG7[2612:2988]: Service [POS] accepted (FD=260) from 127.0.0.1:3645 2012.10.25 10:50:53 LOG7[2612:2988]: Creating a new thread 2012.10.25 10:50:53 LOG7[2612:2988]: New thread created 2012.10.25 10:50:53 LOG7[2612:1972]: Service [POS] started 2012.10.25 10:50:53 LOG5[2612:1972]: Service [POS] accepted connection from 127.0.0.1:3645 2012.10.25 10:50:53 LOG6[2612:1972]: connect_blocking: connecting 217.69.205.63:9021 2012.10.25 10:50:53 LOG7[2612:1972]: connect_blocking: s_poll_wait 217.69.205.63:9021: waiting 10 seconds 2012.10.25 10:50:53 LOG5[2612:1972]: connect_blocking: connected 217.69.205.63:9021 2012.10.25 10:50:53 LOG5[2612:1972]: Service [POS] connected remote server from 213.156.128.147:3646 2012.10.25 10:50:53 LOG7[2612:1972]: Remote socket (FD=284) initialized 2012.10.25 10:50:53 LOG3[2612:1972]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2012.10.25 10:50:53 LOG5[2612:1972]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2012.10.25 10:50:53 LOG7[2612:1972]: Remote socket (FD=284) closed 2012.10.25 10:50:53 LOG7[2612:1972]: Local socket (FD=260) closed 2012.10.25 10:50:53 LOG7[2612:1972]: Service [POS] finished (0 left) my .conf file is: cert = C:\Arcus2\SSL\pos3135pem.pem key = C:\Arcus2\SSL\pos3135key.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 CAfile = C:\Arcus2\SSL\cacert.pem debug = 7 output = stunnel.log [POS] client = yes accept = 127.0.0.1:9021 connect = xxx.xxx.xxx.xxx:9021 if I change conf file, adding sslVersion = all or sslVersion = SSLv3, I have another error Section POS: sslVersion = TLSv1 is required in FIPS mode Thank your for help, Sergey Pimenov

2 1

Stunnel 4.54 manifest
by John A. Wallace 24 Oct '12

24 Oct '12

Hi, Michal. Good news about the update! I noticed that this version, the one for Windows installation, has many more files in it than the last version. It's no problem, but I was just wondering why the change this time? Thanks. John > -----Original Message----- > From: stunnel-announce-bounces(a)stunnel.org [mailto:stunnel-announce- > bounces(a)stunnel.org] On Behalf Of stunnel-announce-request(a)stunnel.org > Sent: Wednesday, October 10, 2012 5:00 AM > To: stunnel-announce(a)stunnel.org > Subject: stunnel-announce Digest, Vol 48, Issue 1 > > Send stunnel-announce mailing list submissions to > stunnel-announce(a)stunnel.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-announce > or, via email, send a message with subject or body 'help' to > stunnel-announce-request(a)stunnel.org > > You can reach the person managing the list at > stunnel-announce-owner(a)stunnel.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-announce digest..." > > > Today's Topics: > > 1. stunnel 4.54 released (Michal Trojnara) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 09 Oct 2012 23:37:41 +0200 > From: Michal Trojnara <Michal.Trojnara(a)mirt.net> > To: stunnel-users(a)stunnel.org, stunnel-announce(a)stunnel.org, > openssl-users(a)openssl.org > Subject: [stunnel-announce] stunnel 4.54 released > Message-ID: <50749925.8030905(a)mirt.net> > Content-Type: text/plain; charset="iso-8859-1" > > Dear Users, > > > I have released version 4.54 of stunnel. The ChangeLog entry: > > > Version 4.54, 2012.10.09, urgency: MEDIUM: > * New Win32 features > - FIPS module updated to version 2.0. > - OpenSSL DLLs updated to version 1.0.1c. > - zlib DLL updated to version 1.2.7. > - Engine DLLs added: 4758cca, aep, atalla, capi, chil, cswift, gmp, > gost, nuron, padlock, sureware, ubsec. > * Other new features > - "session" option renamed to more readable "sessionCacheTimeout". > The old name remains accepted for backward compatibility. > - New service-level "sessionCacheSize" option to control session cache > size. > - New service-level option "reset" to control whether TCP RST flag is > used to indicate errors. The default value is "reset = yes". > - New service-level option "renegotiation" to disable SSL > renegotiation. > This feature is based on a public-domain patch by Janusz Dziemidowicz. > - New FreeBSD socket options: IP_FREEBIND, IP_BINDANY, IPV6_BINDANY > (thx to Janusz Dziemidowicz). > - New parameters to configure TLS v1.1/v1.2 with OpenSSL version 1.0.1 > or higher (thx to Henrik Riomar). > * Bugfixes > - Fixed "Application Failed to Initialize Properly (0xc0150002)" error. > - Fixed missing SSL state debug log entries. > - Fixed a race condition in libwrap code resulting in random stalls > (thx to Andrew Skalski). > - Session cache purged at configuration file reload to reduce memory > leak. > Remaining leak of a few kilobytes per section is yet to be fixed. > - Fixed regression bug in "transparent = destination" functionality > (thx to Stefan Lauterbach). This bug was introduced in stunnel 4.51. > - "transparent = destination" is now a valid endpoint in inetd mode. > - "delay = yes" fixed to work even if specified *after* "connect" > option. > - Multiple "connect" targets fixed to also work with delayed resolver. > - The number of resolver retries of EAI_AGAIN error has been limited > to > 3 in order to prevent infinite loops.. > > > Home page: https://www.stunnel.org/ <http://stunnel.mirt.net/> > Download: https://www.stunnel.org/downloads.html > <ftp://stunnel.mirt.net/stunnel/> > > > SHA-256 hash for stunnel-4.54.tar.gz: > > b7e1b9e63569574dbdabee8af90b8ab88db3fe13dcb1268d59a1408c56e6de7b > > > Best regards, > > Mike > > > -------------- next part -------------- A non-text attachment was > scrubbed... > Name: signature.asc > Type: application/pgp-signature > Size: 196 bytes > Desc: OpenPGP digital signature > URL: <http://www.stunnel.org/pipermail/stunnel- > announce/attachments/20121009/f9eac1e3/attachment-0001.pgp> > > ------------------------------ > > _______________________________________________ > stunnel-announce mailing list > stunnel-announce(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-announce > > > End of stunnel-announce Digest, Vol 48, Issue 1 > ***********************************************

3 6

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users