stunnel-users

3 participants
3308 discussions

Examples of stunnel and lighttpd
by fanboy 15 Dec '10

15 Dec '10

Apparently lighttpd ssl support isn't so flash, I'm been attempting (I'm a newb) to use stunnel instead, are there any examples? I have a free startssl cert also (ssl.key / ssl.cert) What information do I need to setup a reliable connection?

1 0

How to encrypt the URL?
by cpu.lin 08 Dec '10

08 Dec '10

Dear friends, After reading mailing lists & Web & FAQ I couldn't find answers to these: stunnel.conf as follows: debug=7 client = yes [proxy] accept=1111 connect=62.215.5.69:8080 (Public SSL Proxy) protocol=connect protocolHost=stunnel.mirt.net:443 CLIENT(Browser+Special software)<->firewall<->(Internet)<->Public SSL Proxy<->WEB SERVER Public SSL Proxy as follows: http://tools.rosinstrument.com/raw_free_db.htm?t=2 Only the CLIENT side have stunnel. After running stunnel 4.34 (Windows binaries). Then. Browser http://localhost:1111/ But Sniffer can monitor the command-(CONNECT stunnel.mirt.net:443). The problem as follows: Only the CLIENT side can install special software. Special software including but not limited to stunnel. If the firewall can block many websites depend on Web IP & URL. How to pass through the firewall base on Public SSL Proxy? How to encrypt the URL-(stunnel.mirt.net:443)? What is the special software? If stunnel can solve this issue. How to configure? Best regards, cpu

1 0

stunnel and IE6 issue
by Bill Tindal 06 Dec '10

06 Dec '10

Hi, I have stunnel running in front of HaProxy and everything is working fine however IE6 users cannot access our HTTPS pages and are instead shown a 'Page cannot be found'. They can access normal pages. Obviously there's something that stunnel doesn't like about IE6 (who doesn't) but I'm at a loss as to what changes to make to the stunnel conf. My conf for stunnel is below: ------------------------------------------------ sslVersion = all options = NO_SSLv2 fips = no setuid = root setgid = stunnel pid = /var/run/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 output = /var/log/stunnel.log [secure.domain.com] cert = /usr/local/openssl/certs/secure.domain.com.crt key = /usr/local/openssl/certs/secure.domain.com.key accept = X.X.X.X:443 connect = X.X.X.X:81 xforwardedfor = yes TIMEOUTclose = 0

1 0

How to define stunnel.conf so openvpn packet will go thru stunnel to as HTTP?
by UARE1234 29 Nov '10

29 Nov '10

Hi, >From what I read the examples in stunnel site it possible to wrap VPN's using Stunnel tool. Is it possible to do it for openvpn packets? I can configure thru the openvpn configurations that it packets will go thru port 80 and use TCP but the packets are not http pure. I need to wrap this packets using the stunnel tool. The purpose is to use openvpn over http. I will appreceate if someone can give me a solution for combinig Stunnel and openvpn if possible. Thanks -- View this message in context: http://old.nabble.com/How-to-define-stunnel.conf-so-openvpn-packet-will-go-… Sent from the Stunnel - Users mailing list archive at Nabble.com.

1 0

Is it possible to wrap openvpn thru stunnel to HTTP-Like
by UARE1234 28 Nov '10

28 Nov '10

Hi, I understand that it is possible to wrap VPN's using Stunnel tool. How Can I do that for openvpn. The purpose is to use openvpn over http like. OpenVPN can establish an HTTP connection to a proxy server, where it will issue a CONNECT to establish a binary connection to the VPN server on port 443/TCP. This works in 99,9% but not in this case since I am talking about a very restrictive network but yet Skype for example works on it since it works in a way of http like. I will appreceate if someone can give me a solution for combinig Stunnel and openvpn or other tool if possible. Thanks -- View this message in context: http://old.nabble.com/Is-it-possible-to-wrap-openvpn-thru-stunnel-to-HTTP-L… Sent from the Stunnel - Users mailing list archive at Nabble.com.

1 0

Stunnel resource usage
by Avinash Gaonkar 26 Nov '10

26 Nov '10

Hi All, I need to understand how can we calculate the throughput for stunnel based on allocated CPU and memory. For e.g if we allocate 512Mb of RAM and 1 core for the stunnel in Vmware, what would be the throughput in Mbps. Regards, Avinash gaonkar

1 0

Enhance description of transparent mode in FAQ
by Ivan Trancik 25 Nov '10

25 Nov '10

Hello, I would suggest to improve 'transparent = yes | no (Unix only)' section of http://www.stunnel.org/faq/stunnel.html#service_level_options and how this option work on OS X. I think that this part remote mode (I<connect> option) on Linux >=2.6.28 remote mode (I<connect> option) 2.2.x local mode (I<exec> option) is not clear. Remote mode is a "I<connect> option"? What the heck? And local mode is a "I<exec> option"? Does this "I" thingie stand for unnamed pipe or capital "i" or small cap "L"?? I ran to this problem when I tried to set up stunnel on Mac OS X and carelessly used some example config on web. Setting "transparent = yes" in Mac OS X will result in very funny behavior. Consider this conf debug=7 output=stunnel.log verify=0 foreground=yes client=yes pid= [https] accept=localhost:8080 connect=google.com:443 transparent=yes will result in unbelievable error - "local_bind (original port): Address family not supported by protocol family (47)" Using 127.0.0.1 instead of localhost will do better - "Service https bound to 127.0.0.1:8080" - BUT when you try to access 127.0.0.1:8080 nothing reasonable happens and log will show another strange error "connect_blocking: connect <ip_address>: Network is unreachable (51)" The next spectacular thing is that when you use only localhost connect and accept parameter, than transparent=yes works OK. I would suggest rewriting that part to reflect these kind of situations in more clear way - they are very hard to debug, and honestly I couldn't figure it out even though I read FAQ several times. Final question - is it possible on OS X (which doesn't have iptables interface, but has ipfw) to set up transparent proxy tunnel with stunnel? Thanks.

2 1

Problems with cert
by Ross 25 Nov '10

25 Nov '10

Hello, we were using Stunnel 4.25 for a long time without any problems. We used "verify=3". Our client config file: service = stunnel-client cert = client.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 3 CApath = certificates CAfile = CAcert.pem client = yes [rdp] accept = 3398 connect = XX.XX.XX.XX:3398 But after switching to Stunnel 4.34 (preserving configuration) we started to get errors: 2010.11.25 13:13:30 LOG5[8332:5336]: Service rdp-database accepted connection from 127.0.0.1:30082 2010.11.25 13:13:30 LOG5[8332:5336]: connect_blocking: connected 95.130.236.42:3398 2010.11.25 13:13:30 LOG5[8332:5336]: Service rdp-database connected remote server from XX.XX.XX.XX:30083 2010.11.25 13:13:30 LOG5[8332:5336]: Certificate accepted: depth=1, /C=UA/ST=Lviv/L=Lviv region/O=ROSS/OU=IT/emailAddress=bla(a)bla.com 2010.11.25 13:13:30 LOG4[8332:5336]: CERT: Certificate not found in local repository 2010.11.25 13:13:30 LOG4[8332:5336]: Certificate check failed: depth=0, /C=UA/ST=Lviv/L=Lviv region/O=ROSS/OU=IT/CN=OURSERVER/emailAddress=bala(a)bla.com 2010.11.25 13:13:30 LOG3[8332:5336]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed 2010.11.25 13:13:30 LOG5[8332:5336]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Main error is: CERT: Certificate not found in local repository Looks like stunnel cannot find the hashed server's certificate in C:\Program Files\stunnel\certificates (CApath = certificates) We tried specifying full paths, but it does not help. Switching to "verify=2" (do not check server's cert) works ok. Also stunnel 4.25 (with verify=3) works ok on this configuration. Could you help? Ross

2 1

Re: [stunnel-users] ssl renegotiation
by Jason Haar 25 Nov '10

25 Nov '10

On 11/25/2010 05:42 AM, Joe Williams wrote: > > Got it, so there's no way to configure stunnel to disable it without building a new openssl from source. I was thinking there might be an SSL option I could pass in. > That kind of feature was only introduced into the newer versions of OpenSSL, so by definition, older versions can't have an option to disable it ;-) FYI I still have to run fully patched Apache with "SSLInsecureRenegotiation on" due to MSIE still not supporting proper optional client cert renegotiation. It's only *2 years* since the vulnerability was discovered... (Chrome, Firefox are fine of course) -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

1 0

ssl renegotiation
by Joe Williams 24 Nov '10

24 Nov '10

List, How does one secure stunnel from man in the middle attacks regarding ssl renegotiation. I have seen http://www.openssl.org/docs/ssl/SSL_CTX_set_options.html#SECURE_RENEGOTIATI… but I couldn't tell if stunnel is affected by it, nor what I could do outside of installing a newer version of openssl to prevent it. Additionally I did a scan on www.ssllabs.com and it stated that insecure renegotiation was supported, which isn't good. I am running 0.9.8k-7ubuntu8.4, the standard version that ships with ubuntu 10.04, and stunnel 4.32. What can I do to configure stunnel to protect myself? My current config is below. Thanks. -Joe ; Certificate/key is needed in server mode and optional in client mode cert = /etc/stunnel/file.crt key = /etc/stunnel/file.key foreground = yes debug = 5 ciphers = DES-CBC3-SHA:AES256-SHA:AES128-SHA:RC4-SHA:RC4-MD5 ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = all options = NO_SSLv2 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside chroot jail pid = /stunnel4.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Service-level configuration [https] accept = 443 connect = localhost:80 TIMEOUTclose = 0 Name: Joseph A. Williams Email: joe(a)joetify.com Blog: http://www.joeandmotorboat.com/ Twitter: http://twitter.com/williamsjoe

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users