stunnel-users

3306 discussions

Wireshark didn't show TLSv1 traffic?
by Bao, Robert 17 Feb '11

17 Feb '11

Hi, I have "ciphers = AES256-SHA" option in stunnel.conf file. And when the server/client established the connection, I see this line in the log file: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 However when I use Wireshark to sniff the traffic, I only see "TCP" in the <Protocol> column for the traffics between the server and the client. Is this normal? What did I do wrong? Thanks. Robert Bao Software House Tyco International 978-577-4202 Explore our new Tyco Online Learning Center Web-based Training Bundles at: www.swhouse.com/support/tyco_online_learning_center.aspx This e-mail may contain or have attached to it information or technology the export or re-export of which is restricted by U.S. laws and regulations. By viewing this e-mail and any attachments, the recipient agrees to the following: (i) the recipients use of the contents of this e-mail and any attachments shall comply with all applicable laws, rules and regulations, including, without limitation, U.S. international trade laws and regulations, and (ii) the recipient may not transfer or otherwise export or re-export any information or technology contained in this e-mail or any attachment except in full compliance with the export controls administered by the U.S. and other countries and any applicable import and use restrictions.

2 2

key+cert+dh risks
by Jean-Yves F. Barbier 15 Feb '11

15 Feb '11

Hi list, I'm using stunnel between two machines only, so is there a risk to reuse the server stunnel.pem on the client? (and if it's risky, why?) JY -- Have a coke and a smile! -- John DeLorean

3 6

Confusion regarding part of stunnel.conf
by Dave 12 Feb '11

12 Feb '11

I've set up a test of stunnel with the latest stunnel and latest openssl, and if I set "verify=0" or "verify=1" I can get it to work (I'm tunneling a pop3 session), but if I set it any higher (to 2 or 3) it won't work for me. Now, I'm not sure which level is "necessary" because in stunnel.conf I read: ------------------------- ; authentication stuff needs to be configured to prevent MITM attacks ; it is not enabled by default! ;verify = 2 ------------------------- ... which sounds like verify defaults to 0. But is a verify level of 1 enough to solve the man-in-the-middle problem? It seems like it would not be (since level 1 will allow absence of a certificate), but I am not sure. I guess my questions boil down to: 1) What are the necessary settings for "authentication stuff" to prevent the MITM attack vector mentioned in stunnel.conf? 2) What is the proper way to set up (self-signed) certs to prevent such an attack? Can a self-signed cert be used at a verify level of 2 or 3? Dave

2 11

[patch] Unix socket support for Stunnel
by Stefan Behte 11 Feb '11

11 Feb '11

Hi, yet another request for a patch inclusion... Quoting from http://haproxy.1wt.eu/#down : "This patch contributed by Exceliance adds to stunnel the ability to connect to haproxy over a UNIX stream socket instead of using TCP. Sometimes this can be more convenient and/or more secure. " I think it would be nice to have it upstream. And I hope I am not bothering Michals yet. ;) Best regards, Stefan Behte

1 0

Security Problems with 4.35
by Stefan Behte 10 Feb '11

10 Feb '11

Hi, in the announcement of 4.35, I saw: "CLOEXEC file descriptor leaks fixed on Linux >= 2.6.28 with glibc >= 2.10. Irreparable race condition leaks remain on other Unix platforms. This issue may have security implications on some deployments." I searched a bit, but did not find an exploit or more information on the severity of this issue. Could someone elaborate the problem a bit? I could diff to the previous version and have a look, but that will take quite some time, and my C is weak... Best regards, Stefan Behte

2 1

use somaxconn in stunnel
by Stefan Behte 10 Feb '11

10 Feb '11

Hi, attached you will find a patch from Thomas Franco to honor SOMAXCONN. It defaults to 128, which is not enough for some setups. It defines the maximum number of requests that can be queued to a listening socket and can be changed with sysctl via net.core.somaxconn. I think it would be nice to have it in stunnel-4.36 to make it usable in bigger installations. It's available online here: https://github.com/op4g/stunnel/commit/e200bebaf92c068aa319c43fdd50cddd6816… Best regards, Stefan Behte

2 4

publish/subscribe with stunnel
by Dam Dam 10 Feb '11

10 Feb '11

Hello, I am having a problem to configure stunnel in a publish/subscribe architecture. Basically, I have a publisher service configured with stunnel as a server. Its configuration is close to: [publisher] accept = p1 connect = 127.0.0.1:p2 This service publishes data to a subscriber. As far I as understood, the subscriber should be configured as a client with stunnel with a configuration close to this: [subscriber] accept = p3 connect = remote:p1 client = yes Now, my problem is that the subscriber does not listen on any port. So p3 does not actually exist. When the subscriber starts, it automatically connects and subscribes to the publisher and waits for data from the publisher service. I would like to secure the connection between the publisher and the subscriber but I am stuck with the configuration. Any ideas? Regards, Damien

2 1

stunnel, haproxy and ssl cert
by Amol 10 Feb '11

10 Feb '11

i got the SSL setup done with the stunnel, but when i connect from the url i always see this entry in my stunnel.log 2011.02.09 14:52:34 LOG3[2433:139832543721216]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing my stunnel config is cert=/etc/stunnel/ssl/group-cert.pem key = /etc/stunnel/ssl/l.key ;setuid = nobody ;setgid = nogroup pid = /etc/stunnel/stunnel.pid debug = 3 output = /etc/stunnel/stunnel.log socket=l:TCP_NODELAY=1 socket=r:TCP_NODELAY=1 [https] accept=443 connect=80 TIMEOUTclose=0 xforwardedfor=yes i have just got familiar to stunnel to not sure i that error is ok?

2 3

Help with stunnel configuration
by Rohler, Brian L 09 Feb '11

09 Feb '11

I'm looking to see if the windows version of stunnel (4.34) can be executed from a command line and have it configured to connect and accept on different ports?

1 0

X-Forwarded-For / X-Forwarded-Proto
by Stefan Behte 09 Feb '11

09 Feb '11

Hello Michal, I've read that you prefer not to support X-Forwarded-For because an old code had a buffer overflow and did not support keep-alive functions of HTTP/1.1. I believe the overflow was fixed in the newer version of the patch I've attached. IMHO the patch will still be very useful, even if it does not support keep-alive: often in high-performence setups keep-alive is not even desired because it fills up ressources needlessly. Even if this does not provide all features, a lot of people would be satisfied with it. There is a great desire for this patch, if one searches for "stunnel x-forwarded-for" on google, you will find more than 60 pages and not only a few dozens of blogs/mailing lists that discuss applying the patch and getting it to work as an SSL terminator for loadbalancing software. And last, I know that the patch (the one Willy Tarreau is hosting on haproxy.1wt.eu and is attached) is in use at several high-traffic websites and runs stable. ;) If it's too much of a hassle for you to review and/or integrate the patch, I can understand that very well, I'd just like to open a discussion and would like to know if you have concerns regarding the patch quality, even if you do not want to include the patch at this time. :) Best regards, Stefan Behte

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users