[stunnel-users] Feature request - verify fall-back

Fri May 9 04:50:04 CEST 2008

Web was just an example. I agree that Apache is better place to do this.

What about running stunnel on port 443 which will look like HTTPS to world
but it connects to VNC if a valid client-cert is presented. This way my VNC
will be totally private and protected from *possible detection* & attack.

Technically it is very much possible and I've done it using Java APIs. It
would be neat if stunnel can be modified to do the same. Any help in
creating such patch will be much appreciated.

Thanks,
Sudhaker

On Thu, May 8, 2008 at 3:53 PM, Brian Hatch <bri at stunnel.org> wrote:
> Roughly around 2008-05-07 15:34 -0400, Sudhaker Raj mentioned:
>
>> I wish to use stunnel for following use-case (to create a
>> highly-protected website which can be accessed only using a valid
>> client-cert).
>>
>> gateway.example.com:443 -> public.example.com:80 (when client-cert
>> verification fails)
>> gateway.example.com:443 -> intranet.example.com:80 (when client-cert
>> verification ok - normally hidden from public)
>>
> ...
>> I guess it will be a nice addition to stunnel's feature list.
>
>
> I disagree.  I don't think it's a good idea to add to Stunnel.
>
> This is application layer logic you want, essentially.  Your best
> bet would be to use SSL in apache/webserver of choice directly.
> Then you can place the verification constraint in the configuration
> and configure the webserver to serve up selected pages if and only
> if a cert has been used via normal apache 'require' ACLs.
>
> Alternatively this could be configured with apache as a reverse
> proxy using mod_proxy in front of two different back end webservers
> (public and intranet in your example above) if you really want
> distinct webservers for each.
>
> --
> Brian Hatch                  "I think that we missed something.
>   Systems and                We should have called it 'Licensed
>   Security Engineer          Software Delivery', not 'Electronic.'"
> http://www.ifokr.org/bri/    --Bruce
>
> Every message PGP signed
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.1 (GNU/Linux)
>
> iD8DBQFII1o7VkMj8/ymYEsRAmKyAJ9IfSok2pZPkknbD5cRHZag+C2hIACeLQhh
> jYZwdCyQhKFk0a/twP/G8qQ=
> =b0uW
> -----END PGP SIGNATURE-----
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.stunnel.org/pipermail/stunnel-users/attachments/20080508/6a002e0f/attachment.html>