-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Hi Guys,
stunnel 5.27 will be made available on 3rd December.
Best regards,
Mike
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCAAGBQJWXHz/AAoJEC78f/DUFuAUcxAQAK5PrsoU4i0n25IYfFnuGWm/
R9Y4BJKO6/4+VHjRN9Yi4gJb0t7QpVxYQH9RuQAYVWp5RYeYqnxyb55m5iZ5IYBl
V5ke5+DjTtPpMuTDShLz9BkL01lyrw8c+mwLy1IZM4nUgAQHyWp4lgcKgKukoY6N
DYxloE5GmWW3ylGLAJUFlcVZmNayo8pmmVeWLbhsCRt0OyFJbrS8XUcVviZVcxAD
q3Lly63NFC0Nsl+5MGmKxO8sRCu3UW0WkT4P5MbJr2f5b9AuTlrBmBNZ/fmyPAV9
5/LvAc5vdh9DwJEgGF3yvFqdFghR8TNuGNqBJaDn5pk+6rmc0qNeQkFFsq0CRX34
jSwNCl0A0SuXp4YGPTOFK9rp8bKjxq5VDUAGa6OyEhd92H2pSLxDA/aJqlY6f1vs
MZQb6az60lrUq1JNnoYeUfO9AFMCFpqyFV4kqmfUOlnJox99JbZ5/U38CeaO9n8P
tIz7jgijYRDK6itaCuf1QaWJxCU5S7yCUL1dtyi2nTDTvrG8WmTr93SniyGXScix
fXIIb4Aa7mg3/p9J9TFONzxw0CySj/32ZBIgiLAWcAaa1Gnuy3+ARSAu1U6t9to8
Unnzppd1B7qn0qk1QANtktz4JAu63FUg7RSPHFt8+nLcABtslkjHdcVvzGl3F02k
zjYq9bMufBOqlCDctGQO
=rtq3
-----END PGP SIGNATURE-----
Hi,
I have a couple of questions regarding failover with stunnel:
1. I would like to know if there is a way to use failover with two servers with two different set of TLS cert/key.
The following rule doesn't work, because the cert and key parameters are overwritten, but it shows what I would like to achieve:
[failover]
accept = 127.0.0.1:4441 <http://127.0.0.1:4441/>
cert = cert_1.cert
key = key_1.pem
connect = server-1:1234
cert = cert_2.cert
key = key_2.pem
connect = server-2:1234
2. On the same topic, I would like to know if there is an option that could open the local port (accept) only when the connection (connect) is established?
The problem I'm facing is that I use a PAC profile with failover on several stunnel entries: "return PROXY 127.0.0.1:4441 <http://127.0.0.1:4441/>; PROXY 127.0.0.1:4442 <http://127.0.0.1:4442/>; PROXY 127.0.0.1:4443 <http://127.0.0.1:4443/>;". However, when one of the remote server is down (i.e. server-1), it is not easily detected by web-browsers (Chrome does not seem to detect it well), and so instead of switching to the next PROXY, it simply dies on the first one. If the port 4441 relative to server-1 (which is unavailable) was closed, then the webrowser could easily detect it and switch to the second server with port 4442.
3. Is there another way to tweak stunnel behavior when a remote server is down?
I'm thinking about a couple of things, like being able to switch to a different rule set:
[failover1]
accept = 127.0.0.1:4441 <http://127.0.0.1:4441/>
cert = cert_1.cert
key = key_1.pem
connect = server-1:1234
connect = 127.0.0.1:4442 <http://127.0.0.1:4442/> ; This is failover2
[failover2]
accept = 127.0.0.1:4442 <http://127.0.0.1:4442/>
cert = cert_2.cert
key = key_2.pem
connect = server-2:1234
Or maybe there are some options that I'm not aware of to timeout connections more efficiently: so that Chrome (or other clients using HTTP proxies) will immediately know that stunnel cannot connect to the remote server and so that the proxy is down.
Thank you for your help.
Cheers,
Thireus.
Hello,
Can you tell me from which stunnel version, the "bin" folder and the "config" folder appeared ?
The change is between the version 4.53 and 5.26, but which one ?
Thanks a lot for the answer
Best regards, Manu
Dear All,
Currently we are using syslog communication without any security. That is using UDP protocol with the server listening on port number 514. This is unsecure.
I want to use syslog over TLS that is over TCP .
As of now in my project syslogd daemon is used. I am planning to use stunnel to achieve this.
I have few questions. Please clarify
* To support stunnel, syslogd should be on TCP and not on UDP?
* Is stunnel is a daemon ?
* My understanding is syslogd forwards messages to the stunnel local portal at port 61514.
The local stunnel forwards data via the network to port 60514 to its remote peer.
* I assume stunnel-5.26(stunnel-5.26.tar.gz) is the latest version and this can be used on linux
Regards,
Girish
Hi,
Once again, thanks a lot for taking care of stunnel!
Attached is a trivial patch for two minor typo fixes. Thanks in
advance for looking over it :)
G'luck,
Peter
--
Peter Pentchev roam(a)ringlet.net roam(a)FreeBSD.org pp(a)storpool.com
PGP key: http://people.FreeBSD.org/~roam/roam.key.asc
Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13
Hi,
The website and the documentation does not indicate and a Google
search does not give any relevant results, so I would like to ask if
Stunnel supports OCSP stapling?
Thank you,
Ádám
Is STunnel 5.22 supported on Windows 2003 server?
Thanks,
DEEPAK SUBBANARASIMHA
Kewill
DDI: +00 (1) 978 482 2625
Email: deepak.subbanarasimha(a)kewill.com<mailto:[email protected]>
www.kewill.com<http://www.kewill.com/>
Tel: +00 (1) 978 482 2500 | Fax: +00 (1) 978 482 2501
1 Executive Drive, Chelmsford, MA 01824, USA
IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately notify us by telephone at (978) 482-2500 and return the original message to us at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code. Thank You. Copyright (c) 2013 by Kewill Inc
IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately return the original message to the sender at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Although Kewill takes reasonable precautions to minimize the risk, Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code.
On AIX 6.1 using IBM's XLC compiler, I do "configure" and that successfully
completes. However, when I "make", it fails due to the parameters
"-fstack-protector" and "-fPIE"... apparently it couldn't find the files
"stack-protector" and "PIE" as "-f" specifies a file. However, gcc and
perhaps many other cc variants, "-f" specifies a compile option. I was able
to compile with XLC by ripping out the "stack-protector" and "PIE" sections
of "configure" and running "make" but it would be best to use the stack
protector mechanisms used for AIX's XLC:
https://www.ibm.com/developerworks/mydeveloperworks/blogs/b10932b4-0edd-4e6…
Has anyone compiled Stunnel 5.26 using IBM's XLC without removing the
stack-protector and PIE sections in the configure file?
The other option is to use gxlc instead of xlc to map the GNU C compiler
options to XLC options. Would that be preferred (less modification of
configure file)? I was able to get that working, but still an unusually
high number of warnings.
http://geco.mines.edu/files/manuals/xlc/mapping.pdf
The article above (from IBM) has "-qstackprotect=size=N" - what suggestion
parameter to use for "N"?
To be nice to everyone's mailbox, I have posted the logs here:
Stunnel 5.26 AIX XLC - fails
http://pastebin.ca/3250237
Stunnel 5.26 AIX GXLC - passes
http://pastebin.ca/3250242
Thanks,
-Rob
We are currently using Stunnel on a stand-alone PC to link a 3rd party
application that monitors a Graphical User Interface application for alarm
notification. Stunnel is used to link this 3rd party alarm notification
software to be able to send message to Amazon Web Services for email
distribution to the users/operators that need this information.
IT would like to investigate having all applications operate from a server
possibly running 2012 OS, in a virtual environment. The GUI and 3rd party
software will operate in this environment and I wanted to see if Stunnel
would have any issues continuing to send messages out to Amazon.
Thank you,
Duane Moody
Global Data Specialists
1815 W. 1st Ave, Suite 110
Mesa, AZ 85202
PH: 480-461-3401, Ext 223
Fax: 480-461-3411
Cell: 602-696-9457
www.gbl-data.com
