stunnel-users

3 participants
3308 discussions

logging real client IP in Apache
by Stoyan Stoyanov 07 Jul '17

07 Jul '17

I have an Apache server serving only HTTP requests on port 80 and an stunnel daemon on the same server listening on port 443 and tunneling HTTPS requests to Apache. Is there a way for the client IP to be passed on to Apache so that I can capture and log that instead of the IP of stunnel, which in this case is 127.0.0.1? Ability to add a variable to the HTTP header would be perfect, but any other suggestions to solve this problem are welcome. Thanks! Stoyan

2 2

Error on startup of Stunnel
by Shelstone Lorde 30 Jun '17

30 Jun '17

I installed version 5.41, the latest version, on a Windows 10 Pro machine. I placed a link to the Stunnel.exe file in the Startup folder. I am getting the error "The ordinal 3253 could not be located in the dynamic link library c:\Users\...Programs\Startup\stunnel.exe". May be there has been a previous posting concerning this error but I have not been able to find it. Any help or suggestion will be appreciated. Thanks.

1 0

Re: [stunnel-users] Stunnel Connectivity Issue
by Ludolf Holzheid 13 Jun '17

13 Jun '17

On Tue, 2017-06-13 22:51:27 +0530, Dheeraj Gautam wrote: > Hi Browne, > > > > I am not understand like what config I have to do in stunnel config file. > > > > As per application it will trigger 8228 port of remote server, but at the momen stunnel is working only when I am trying to telnet localhost on 9233 port. > Dheeraj, I'm afraid you confused the directions: In you configuration file, you told Stunnel to accept connections on localhost, port 9233 ("accept = 127.0.0.1:9233"). Then, you told Stunnel, if such a connection is accepted, to connect to a remote server at port 8228 ("connect = 69.191.198.34:8228"). As long as both connections are established, Stunnel will forward data from localhost to 69.191.198.34 and vice versa, while encrypting the data in the localhost -> 69.191.198.34 direction and decrypting the data in the opposite direction (69.191.198.34 -> localhost). With this setup, a client program (such as Thunderbird) sends and receives plain-text data to/from a Stunnel instance on the same machine, while a server program on a remote machine (such as the Google mail server) sends and receives encrypted data to/from Stunnel. Is this about the setup you have in mind? Is your application server or client? Does it send and receive plain-text data or encrypted data? Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

Configuring stunnel and openssl on Windows to support TLS 1.2
by Liz Turi 13 Jun '17

13 Jun '17

Good morning, I'm hoping you can help point me in the right direction. The problem I'm trying to solve is enabling TLS 1.2 connections on a Windows (environment has both Windows 2008 and Windows 10 environments) platform. Currently, my private keys are managed by the Windows certificate store, using the capi engineId within stunnel (v 5.41), which uses OpenSSL 1.0.1. Because of this, stunnel can only negotiate a TLS 1.1 connection. I've tried compiling OpenSSL 1.1.0f and stunnel 5.41, but no luck either cross compiling under CentOS, nor under Windows using either MSYS2/MINGW32 or Cygwin. What I'm looking for is any one of the following 1) solid current cross-compiling examples or references 2) solid current Windows compiling examples or references using extant versions 3) a way to manage the pfx/p12 (private key) in stunnel without resorting to the Windows certificate store. Option 3 is preferred. I see how to manage pkcs11, but not pkcs12. Thank you in advance! Liz Turi Sr. Consultant Massachusetts eHealth Collaborative 860 Winter Street, Waltham, MA 02451 (m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589 www.maehc.org<http://www.maehc.org> [fb_icon]<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[li_icon]<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=ty…>[tw_icon]<https://twitter.com/MAeHC_org> CONFIDENTIALITY NOTICE The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you.

1 1

Memleak sTunnel Win32 5.41 ?
by Dod 12 Jun '17

12 Jun '17

Hello, I just noticed that stunnel memory usage is growing slowly but surely using 5.41 on Win7 64 Bits. Using a few POP3 SSL tunnels. Now it is using 290MB memory I don't know if it is since 5.41 (didn't pay attention). Is there a way to trace/log something that could be useful ? (apart from the process memory usage curve that I guess will not help). regards.

1 0

TLS-SRP patch
by Kevin Sheldrake 06 Jun '17

06 Jun '17

Hello I recently produced a patch that permits use of TLS-SRP; it is based on the TLS-PSK code and this blog post: https://matthewarcus.wordpress.com/2014/05/10/srp-in-openssl/ It’s not the cleanest of code but it does work as a POC. The patch is available here: https://github.com/rtfcode/tls-srp The README.txt provides some info on testing the patch and how it might be used to help dev web browsers and servers that support TLS-SRP (for IoT work). There is a page on the forthcoming OWASP Summit ‘TLS for Local IoT’ workshop (for which it was developed) at: https://owaspsummit.org/Working-Sessions/IoT/TLS-for-Local-IoT.html In terms of using TLS-SRP support in stunnel as a proxy, it might be useful as a replacement for TLS-PSK where the credentials are user-memorable (pass phrase, for example) as TLS-SRP has lower entropy requirements than TLS-PSK. For example, the creds could be stored in the user’s head rather than in a file and be less open to compromise if a device was seized. I don’t know if that’s useful for anyone; it’s just a thought. Thanks Kev

1 0

Connect to sub-directory path
by Shamim Uz Zaman 25 May '17

25 May '17

Hi Looking for an example to connect to subdirectory path such that [connect] client = yes accept = 127.0.0.1:441 connect = xxx.website.com:443/Connect/topath verifyChain = yes verifyPeer=yes CAfile = ca-certs.pem checkHost = xxx.mywebsite.com OCSPaia = yes When I only use xxx.mywebsite.com:443 it works. However, below three url gives TCP error (Unknown TCP service) xxx.mywebsite.com:443/Connect/topath xxx.mywebsite.com/Connect/topath https://xxx.mywebsite.com/Connect/topath My proxy connection requires to translate to the directory path of the domain. Regards, *Shamim Zaman*

2 1

Stunnel Connectivity Issue
by Dheeraj Gautam 24 May '17

24 May '17

Hi Team, We are using 5.41 release of Stunnel software to establish TCP connection with remote server using by TLSV1.2 protocol. Enclosed configuration file wherein we are trying to establish TCP connection with one my server along with provided certificate and key which are pointed in config file. Could you please let us know what parameters we are missing here due to which connection is not establishing with remote server. Although, stunnel logs indicating that configuration successful, but in logs no where is mentioned about the connection is it connected or not, below is the artifact for your easy ref. Could you please help us here to resolve this issue. Regards, Dheeraj Gautam -- www.arborfs.com This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged. It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail. Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.

1 0

Stunnel on Suse 8.1, connections refused, pid remains
by InvalidPath 09 May '17

09 May '17

So I have this server, I can start stunnel via /etc/rc.d/stunnel start. The pid is there as witnessed by ps -aux | grep stunnel, I have 4 customers that access this server. The customers pull data files that contain certain client records. Anyway my test user connects to the server and is able to pull a handful of files before their process begins timing out. When this happens I can no longer SSH to the host without restarting stunnel. Weird thing is, is that I can see the pid still running when this happens. I have the debug = 7 but the log files according to stunnel - version is set to a level of 5. No clue where it''s getting a 5 from. But I am unable to determine why or what is causing this. And it's starting to cost the company lost revenue. Any help would be greatly appreciated. Ben

1 0

Graceful config reload when -fd option was used
by z a 09 May '17

09 May '17

Hi, Since version 4.30, sending a HUP signal to a running stunnel process will cause it to gracefully reload with the given config file. Is there a way to accomplish this when the running stunnel process was started with the "-fd" flag as in the example below? cat foo.conf | stunnel-fd 0 I tried writing to /proc/$pid/fd/0 but that didn't work. I'm hoping someone here has overcome this issue and might be able to whisper a hint in my direction. I am on Centos 7.2. Thanks

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users