stunnel-users

3311 discussions

High cpu usage 2016 server
by Cooper, Dave 02 Sep '19

02 Sep '19

Using latest version of stunnel. Running on 3 separate 2016 servers. On each server stunnel is consuming 40% of the cpu even though no end point is even connected. Sent from my iPhone ____________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________ ***MBS DISCLAIMER*** Multi-Bank Securities, Inc. (MBS) cannot be held responsible for errors regarding time and/or price on buy/sell requests via e-mail. Information provided in this email has been prepared from sources to be reliable, but is not guaranteed and is not a complete summary or statement of all data necessary for making an investment decision. This is for informational purposes only and does not constitute a recommendation, please confirm all information before investing. Securities discussed are subject to availability and change in price and yield. Changes to assumptions may have a material impact on returns. Past performance is not indicative of future returns. Additional information is available upon request. This email is intended only for the entity or person to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of this information by entities or persons other than the intended recipient is prohibited. If you receive this message in error, please contact the sender immediately and delete the material from your computer. If you no longer wish to receive e-mails from MBS, please forward this email to compliance(a)mbssecurities.com and place the word REMOVE in the subject line

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 181, Issue 3
by Eric Eberhard 28 Aug '19

28 Aug '19

No. If it ain’t broke, don’t fix it! Old saying but still relevant. The continual updates in all modern software may fix something – and another broken. IMO. I know I am a minority on this this group but an old tried and true setup has great value. Experience, reduces updates and adds to stability. We don’t change our code unless we must. We think it is more stable. Don’t listen to me if you are the type that must have every update ASAP Listen to me if you don’t need the latest and greatest and your app works properly. Study the new version and make a plan to move forward when the time is right. We often move forward to the previous stable release. Often months or even a year later. If the improvements are for things you don’t use, put them off. Look at exactly what the release notes say to help you decide if the update is worth it, you might find it improves only functionality you don’t use. It saves time and money and does not introduce new bugs. We use a very unpopular method – we use inetd. This releases you from all the server management code which is very very very hard to make work on all systems as they work so differently. We are on IBM with AIX (Unix). I doubt a lot of people are testing that configuration. Stunnel is very good at not requiring you to update one step at a time! You can skip safely. Enough blather. I am sure there are a lot of people that disagree with me. And they are likely correct in certain situations. We suggest you look at your situation and and see if you can skip releases … All opinion, not fact. I am old-school so keep that in mind! Good Luck, Eric From: Brent Kimberley [mailto:[email protected]] Sent: Wednesday, August 28, 2019 8:16 AM To: stunnel-users(a)stunnel.org; Eric Eberhard <flash(a)vicsmba.com> Cc: daniel.trickett(a)milliporesigma.com Subject: Re: [stunnel-users] stunnel-users Digest, Vol 181, Issue 3 Have you tried RFC8410? On Thursday, August 22, 2019, 04:00:43 p.m. EDT, Eric Eberhard <flash(a)vicsmba.com <mailto:[email protected]> > wrote: <snip>We use similar logic with one stunnel and have millions of transactions daily... [4+10+1 mil XML+web calls]. <snip>R

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 181, Issue 3
by Eric Eberhard 28 Aug '19

28 Aug '19

Thanks :) -- I think Daniel can solve his problem. If for some reason he cannot make the app server output clear text he has to do it as you laid out. If he can, he can do one stunnel with TLSv1.2 by making the app output clear text. Both will work and should be secure. I’d do the latter is possible – way less overhead doing encryption. We use similar logic with one stunnel and have millions of transactions daily (XML not cXML but that does not matter – ours are often fairly large as in 100s of MB). Encrypting clear to SSLv3 then back to clear to TLSv1.2 is three encryptions along that path instead of one by making the app output clear text. The app will also shrink if that matters as it won’t need encryption code. E From: stunnel-users [mailto:[email protected]] On Behalf Of Brent Kimberley Sent: Thursday, August 22, 2019 7:29 AM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] stunnel-users Digest, Vol 181, Issue 3 >>there is no reason to connect to localhost with any security Should server/interface consolidation trigger functional/technical rework prior to go live? As per the diagram: the app server node x TLS engine node interface is wrapped in SSL the internal localhost x localhost interface is in the clear the TLS engine node x punchout-vendor node is wrapped in TLSv1.2 >> SNI flag (RFC 3546) Good catch. ---------------------------------------------------------------------- Message: 1 Date: Wed, 21 Aug 2019 08:01:08 -0700 From: "Eric Eberhard" <flash(a)vicsmba.com <mailto:[email protected]> > To: "'Brent Kimberley'" <brent_kimberley(a)rogers.com <mailto:[email protected]> >, <stunnel-users(a)stunnel.org <mailto:[email protected]> > Thank you -- what I had in mind but I am not that fancy with the setups as we use one. We go from our application in clear text to stunnel TLSv1.2 which is clearly easier. I did make this work for a short while a long time ago and did not save the files. Plus no may people's horror we use inetd. Of course we only transfer 4 million XML docs per day and handle 10 million Web calls and another million connections for credit cards, etc. I have been told that if I had serious volume inetd is slower -:) but I have not noticed enough of a slowdown to matter. And inetd (at least on an IBM AIX server) is dead reliable and easy. As a curiosity -- as I often see people coding unnecessarily -- there is no reason to connect to localhost with any security at all unless your app can only output SSLv3 which would imply a 3rd party vendor. The traffic never hits the network in any way -- not even the network card -- it goes directly to/from the TCP/IP stack which is why I mentioned just making the app send clear text to one stunnel that outputs TLSv1.2 ... if possible (may not be if it is something you don't have source to). Eric -----Original Message----- From: Brent Kimberley [mailto:[email protected] <mailto:[email protected]> ] Sent: Tuesday, August 20, 2019 6:42 AM To: stunnel-users(a)stunnel.org <mailto:[email protected]> Cc: daniel.trickett(a)milliporesigma.com <mailto:[email protected]> ; flash(a)vicsmba.com <mailto:[email protected]> Subject: Re: stunnel-users Digest, Vol 181, Issue 1 Your mileage may vary. ############################################################################### # From internal application to external host ############################################################################### # [Int_Init] -> [Int_Term] -> [Ext_Init] -> [Ext_Term] ############################################################################### # [internal_initiator] ---ssl---> [Internal terminator] # [Internal terminator] ---http---> [external Initiator] # [external Initiator] ---tls---> [external terminator] ############################################################################### # https://www.stunnel.org/static/stunnel.html <https://www.stunnel.org/static/stunnel.html%20> ############################################################################### [Internal_Terminator] options = SSLv3 client = no accept = host_ip:443 connect = localhost:54321 CAfile = int_init_wallet.pem cert = int_term_pub.pem key = int_term_priv.pem [External_Initiator] options = SINGLE_ECDH_USE options = SINGLE_DH_USE ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256 verify = 3? client = yes options = TLSv1.2 accept = localhost:54321 connect = externalhostname:443 verifyChain = yes renegotiation = no CAfile = ext_term_wallet.pem cert = ext_init_pub.pem key = ext_init_priv.pem ---------------------------------------------------------------------- Date: Mon, 19 Aug 2019 18:21:18 +0000 From: Daniel Trickett <daniel.trickett(a)milliporesigma.com <mailto:[email protected]> > To: "stunnel-users(a)stunnel.org <mailto:[email protected]> " <stunnel-users(a)stunnel.org <mailto:[email protected]> > Subject: [stunnel-users] https to https proxy Hi, Our punchout vendor switched their site to only accept tls 1.2 over the weekend. Unfortunately our application will only support SSL. We are using stunnel with other vendors but can control the inbound host name. This recent one is one we can't manage as it is the software provider. I found a solution for doing https to https. I'm unclear how I get the first https traffic to route to stunnel as the initial call will be from the application will be to the external host.. Any thoughts on whether this would work for my situation? Appreciate any thoughts.. [Tunnel_in] client = yes accept = host_ip:443 connect = localhost:54321 [Tunnel_out] client = no accept = localhost:54321 connect = externalhostname:443 Best regards, Dan

3 2

Re: [stunnel-users] stunnel-users Digest, Vol 181, Issue 3
by Brent Kimberley 22 Aug '19

22 Aug '19

>>there is no reason to connect to localhost with any security Should server/interface consolidation trigger functional/technical rework prior to go live? As per the diagram: the app server node x TLS engine node interface is wrapped in SSL the internal localhost x localhost interface is in the clear the TLS engine node x punchout-vendor node is wrapped in TLSv1.2 >> SNI flag (RFC 3546)Good catch. ---------------------------------------------------------------------- Message: 1 Date: Wed, 21 Aug 2019 08:01:08 -0700 From: "Eric Eberhard" <flash(a)vicsmba.com> To: "'Brent Kimberley'" <brent_kimberley(a)rogers.com>, <stunnel-users(a)stunnel.org> Thank you -- what I had in mind but I am not that fancy with the setups as we use one. We go from our application in clear text to stunnel TLSv1.2 which is clearly easier. I did make this work for a short while a long time ago and did not save the files. Plus no may people's horror we use inetd. Of course we only transfer 4 million XML docs per day and handle 10 million Web calls and another million connections for credit cards, etc. I have been told that if I had serious volume inetd is slower -:) but I have not noticed enough of a slowdown to matter. And inetd (at least on an IBM AIX server) is dead reliable and easy. As a curiosity -- as I often see people coding unnecessarily -- there is no reason to connect to localhost with any security at all unless your app can only output SSLv3 which would imply a 3rd party vendor. The traffic never hits the network in any way -- not even the network card -- it goes directly to/from the TCP/IP stack which is why I mentioned just making the app send clear text to one stunnel that outputs TLSv1.2 ... if possible (may not be if it is something you don't have source to). Eric -----Original Message----- From: Brent Kimberley [mailto:[email protected]] Sent: Tuesday, August 20, 2019 6:42 AM To: stunnel-users(a)stunnel.org Cc: daniel.trickett(a)milliporesigma.com; flash(a)vicsmba.com Subject: Re: stunnel-users Digest, Vol 181, Issue 1 Your mileage may vary. ############################################################################### # From internal application to external host ############################################################################### # [Int_Init] -> [Int_Term] -> [Ext_Init] -> [Ext_Term] ############################################################################### # [internal_initiator] ---ssl---> [Internal terminator] # [Internal terminator] ---http---> [external Initiator] # [external Initiator] ---tls---> [external terminator] ############################################################################### # https://www.stunnel.org/static/stunnel.html ############################################################################### [Internal_Terminator] options = SSLv3 client = no accept = host_ip:443 connect = localhost:54321 CAfile = int_init_wallet.pem cert = int_term_pub.pem key = int_term_priv.pem [External_Initiator] options = SINGLE_ECDH_USE options = SINGLE_DH_USE ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256 verify = 3? client = yes options = TLSv1.2 accept = localhost:54321 connect = externalhostname:443 verifyChain = yes renegotiation = no CAfile = ext_term_wallet.pem cert = ext_init_pub.pem key = ext_init_priv.pem ---------------------------------------------------------------------- Date: Mon, 19 Aug 2019 18:21:18 +0000 From: Daniel Trickett <daniel.trickett(a)milliporesigma.com> To: "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Subject: [stunnel-users] https to https proxy Hi, Our punchout vendor switched their site to only accept tls 1.2 over the weekend. Unfortunately our application will only support SSL. We are using stunnel with other vendors but can control the inbound host name. This recent one is one we can't manage as it is the software provider. I found a solution for doing https to https. I'm unclear how I get the first https traffic to route to stunnel as the initial call will be from the application will be to the external host.. Any thoughts on whether this would work for my situation? Appreciate any thoughts.. [Tunnel_in] client = yes accept = host_ip:443 connect = localhost:54321 [Tunnel_out] client = no accept = localhost:54321 connect = externalhostname:443 Best regards, Dan

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 181, Issue 1
by Eric Eberhard 21 Aug '19

21 Aug '19

Thank you -- what I had in mind but I am not that fancy with the setups as we use one. We go from our application in clear text to stunnel TLSv1.2 which is clearly easier. I did make this work for a short while a long time ago and did not save the files. Plus no may people's horror we use inetd. Of course we only transfer 4 million XML docs per day and handle 10 million Web calls and another million connections for credit cards, etc. I have been told that if I had serious volume inetd is slower -:) but I have not noticed enough of a slowdown to matter. And inetd (at least on an IBM AIX server) is dead reliable and easy. As a curiosity -- as I often see people coding unnecessarily -- there is no reason to connect to localhost with any security at all unless your app can only output SSLv3 which would imply a 3rd party vendor. The traffic never hits the network in any way -- not even the network card -- it goes directly to/from the TCP/IP stack which is why I mentioned just making the app send clear text to one stunnel that outputs TLSv1.2 ... if possible (may not be if it is something you don't have source to). Eric -----Original Message----- From: Brent Kimberley [mailto:[email protected]] Sent: Tuesday, August 20, 2019 6:42 AM To: stunnel-users(a)stunnel.org Cc: daniel.trickett(a)milliporesigma.com; flash(a)vicsmba.com Subject: Re: stunnel-users Digest, Vol 181, Issue 1 Your mileage may vary. ############################################################################### # From internal application to external host ############################################################################### # [Int_Init] -> [Int_Term] -> [Ext_Init] -> [Ext_Term] ############################################################################### # [internal_initiator] ---ssl---> [Internal terminator] # [Internal terminator] ---http---> [external Initiator] # [external Initiator] ---tls---> [external terminator] ############################################################################### # https://www.stunnel.org/static/stunnel.html ############################################################################### [Internal_Terminator] options = SSLv3 client = no accept = host_ip:443 connect = localhost:54321 CAfile = int_init_wallet.pem cert = int_term_pub.pem key = int_term_priv.pem [External_Initiator] options = SINGLE_ECDH_USE options = SINGLE_DH_USE ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256 verify = 3? client = yes options = TLSv1.2 accept = localhost:54321 connect = externalhostname:443 verifyChain = yes renegotiation = no CAfile = ext_term_wallet.pem cert = ext_init_pub.pem key = ext_init_priv.pem ---------------------------------------------------------------------- Date: Mon, 19 Aug 2019 18:21:18 +0000 From: Daniel Trickett <daniel.trickett(a)milliporesigma.com> To: "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Subject: [stunnel-users] https to https proxy Hi, Our punchout vendor switched their site to only accept tls 1.2 over the weekend. Unfortunately our application will only support SSL. We are using stunnel with other vendors but can control the inbound host name. This recent one is one we can't manage as it is the software provider. I found a solution for doing https to https. I'm unclear how I get the first https traffic to route to stunnel as the initial call will be from the application will be to the external host.. Any thoughts on whether this would work for my situation? Appreciate any thoughts.. [Tunnel_in] client = yes accept = host_ip:443 connect = localhost:54321 [Tunnel_out] client = no accept = localhost:54321 connect = externalhostname:443 Best regards, Dan

1 0

Re: [stunnel-users] https to https proxy
by Eric Eberhard 20 Aug '19

20 Aug '19

I'll bite - probably missing something. Why not have your application output clear text to stunnel and set stunnel to TLSv1.2? In other words, drop the SSL from your application. If that won't work I think you can do it with two stunnels (I got it to work once before I did the above). One accepts SSLv3 and outputs clear text . it is the client=no option. The output goes to a stunnel that is client=yes and is set to TLSv1.2 . which outputs to your final destination. The output from the client=no would be to localhost on some port that fires the second stunnel. I suspect you have to use different port numbers. All guesses as I am not sure exactly what you are doing . but if it helps, great :) Eric From: stunnel-users [mailto:[email protected]] On Behalf Of Daniel Trickett Sent: Monday, August 19, 2019 11:21 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] https to https proxy Hi, Our punchout vendor switched their site to only accept tls 1.2 over the weekend. Unfortunately our application will only support SSL. We are using stunnel with other vendors but can control the inbound host name. This recent one is one we can't manage as it is the software provider. I found a solution for doing https to https. I'm unclear how I get the first https traffic to route to stunnel as the initial call will be from the application will be to the external host.. Any thoughts on whether this would work for my situation? Appreciate any thoughts.. [Tunnel_in] client = yes accept = host_ip:443 connect = localhost:54321 [Tunnel_out] client = no accept = localhost:54321 connect = externalhostname:443 Best regards, Dan

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 181, Issue 1
by Brent Kimberley 20 Aug '19

20 Aug '19

Your mileage may vary. ############################################################################### # From internal application to external host ############################################################################### # [Int_Init] -> [Int_Term] -> [Ext_Init] -> [Ext_Term] ############################################################################### # [internal_initiator] ---ssl---> [Internal terminator] # [Internal terminator] ---http---> [external Initiator] # [external Initiator] ---tls---> [external terminator] ############################################################################### # https://www.stunnel.org/static/stunnel.html ############################################################################### [Internal_Terminator] options = SSLv3 client = no accept = host_ip:443 connect = localhost:54321 CAfile = int_init_wallet.pem cert = int_term_pub.pem key = int_term_priv.pem [External_Initiator] options = SINGLE_ECDH_USE options = SINGLE_DH_USE ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256 verify = 3? client = yes options = TLSv1.2 accept = localhost:54321 connect = externalhostname:443 verifyChain = yes renegotiation = no CAfile = ext_term_wallet.pem cert = ext_init_pub.pem key = ext_init_priv.pem ---------------------------------------------------------------------- Date: Mon, 19 Aug 2019 18:21:18 +0000 From: Daniel Trickett <daniel.trickett(a)milliporesigma.com> To: "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Subject: [stunnel-users] https to https proxy Hi, Our punchout vendor switched their site to only accept tls 1.2 over the weekend. Unfortunately our application will only support SSL. We are using stunnel with other vendors but can control the inbound host name. This recent one is one we can't manage as it is the software provider. I found a solution for doing https to https. I'm unclear how I get the first https traffic to route to stunnel as the initial call will be from the application will be to the external host.. Any thoughts on whether this would work for my situation? Appreciate any thoughts.. [Tunnel_in] client = yes accept = host_ip:443 connect = localhost:54321 [Tunnel_out] client = no accept = localhost:54321 connect = externalhostname:443 Best regards, Dan

1 0

https to https proxy
by Daniel Trickett 19 Aug '19

19 Aug '19

Hi, Our punchout vendor switched their site to only accept tls 1.2 over the weekend. Unfortunately our application will only support SSL. We are using stunnel with other vendors but can control the inbound host name. This recent one is one we can't manage as it is the software provider. I found a solution for doing https to https. I'm unclear how I get the first https traffic to route to stunnel as the initial call will be from the application will be to the external host.. Any thoughts on whether this would work for my situation? Appreciate any thoughts.. [Tunnel_in] client = yes accept = host_ip:443 connect = localhost:54321 [Tunnel_out] client = no accept = localhost:54321 connect = externalhostname:443 Best regards, Dan

1 0

Working OCSP example instructions?
by Mark Currie 24 Jul '19

24 Jul '19

Hi, Does anyone have a link to detailed instructions of a working example of Stunnel with OCSP? (including certificate creation if possible) I came across one some time back but can no longer find it. I would greatly appreciate any help with this. I wasn't able to get any replies to my earlier posting showing my problem: https://www.stunnel.org/pipermail/stunnel-users/2019-July/006451.html

1 0

Is there a latest version Debian stunnel package?
by Miranda Zhang 23 Jul '19

23 Jul '19

Hi everyone, I can only find stunnel4 Debian package: https://packages.debian.org/search?keywords=stunnel https://debian.pkgs.org/10/debian-main-amd64/stunnel4_5.50-3_amd64.deb.html ftp://ftp.stunnel.org/stunnel/archive/5.x/stunnel4_5.28-0ubuntu1_amd64.deb <ftp://ftp.stunnel.org/stunnel/archive/5.x/> Is there a 5.55 package? Thanks, Miranda

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users