- stunnel-users - stunnel.org

Re: [stunnel-users] Fw: Using stunnel to add https to a webserver that doesn't have ssl setup
by mkanet＠yahoo.com 02 Nov '12

02 Nov '12

Thanks for the reply. Lots of friendly people on here. I should have probably posted my solution when I figured it out. I was already using a server-based method to handle redirection. However, what I didn't consider is adding a one line exception that distinguishes incoming requests from stunnel on 127.0.0.1 in order to prevent an endless loop. I did this by modifying my IIS URL Rewrite module rule to look like below. URL Rewrite module 2.0 is highly optimized; and is ideal for this kind of thing; works perfect under any circumstance; so long as webpages contain relative elements. Works like a charm. <rewrite> <rules> <rule name="HTTP to HTTPS redirect" stopProcessing="true"> <match url="(.*)" /> <conditions logicalGrouping="MatchAll"> <add input="{HTTPS}" pattern="off" ignoreCase="true" /> <add input="{REMOTE_ADDR}" pattern="127.0.0.1" negate="true" /> </conditions> <action type="Redirect" redirectType="Found" url="https://{HTTP_HOST}/{R:1}" /> </rule> </rules> </rewrite> ----- Forwarded Message ----- On Tue, 30 Oct 2012 15:05:54 -0700 (PDT) <mkanet(a)yahoo.com> wrote: > Thanks. I typically let my webserver handle SSL whenever I can since > it's much easier that way; especially since I know how to handle > http->https urlrewrites that way already; and, plenty of examples on > the web for IIS. The reasons for adding stunnel into the mix in this > scenerio completely outweight not having it at all. I couldn't find > any examples anywhere showing how to handle a simple http to https URL redirect if stunnel is involved; not even in javascript. > Hopefully someone here has the expertise to offer a solution at least in html. The easiest way is to use a server side language as PHP and ASP or CGI/perl (if ISS is capable, that I don't know). If you relay on client (javascript, meta refresh) you can't control the behavior of the client (javascript disabled by user or meta redirects). ISS is capable of PHP and, if you are using it, because you didn't tell, is easy (easy, but I haven't done as I don't know much of PHP (I just played a couple of times with it following tutorials)). With ASP, I don't know, but should be possible too. Here you have an example with PHP: http://www.iis-aid.com/articles/how_to_guides/three_methods_redirect_http_h… or this one: http://stackoverflow.com/questions/5106313/redirecting-from-http-to-https-w… (second message). As I said, you have to do it transparent to the user without relying on them.

1 0

Fw: Using stunnel to add https to a webserver that doesn't have ssl setup
by Michael Avanessian 02 Nov '12

02 Nov '12

Thanks. I typically let my webserver handle SSL whenever I can since it's much easier that way; especially since I know how to handle http->https urlrewrites that way already; and, plenty of examples on the web for IIS. The reasons for adding stunnel into the mix in this scenerio completely outweight not having it at all. I couldn't find any examples anywhere showing how to handle a simple http to https URL redirect if stunnel is involved; not even in javascript. Hopefully someone here has the expertise to offer a solution at least in html. On 30.10.2012 20:39, MKANET wrote > Thanks for the quick reply! So... what http code do I use to break > out the infinite loop so it loads only once? I'm afraid I can't answer that one, as you're using IIS and I'm Unices centered. FWIW, in situations where the port-80 service does *nothing but* hand out redirects to port 443, I typically let the full-blown webserver handle the HTTPS (whether natively or behind an SSL wrapper) and use a boilerplate PERL script (alas, not readily usable on Windows) for the redirecting. I've seen too many kinds of webserver doing redirections to autodetermined URLs that happen to miss some vital part of the originally requested URL, including some that *cause* the browser to drop from HTTPS back to HTTP in the first place. :-S Regards, ----- Forwarded Message ---- Thanks for the quick reply! So... what http code do I use to break out the infinite loop so it loads only once? I think the other 2 circumstances may have something similar happening to them (which are forwarded using the web server instead). If I use the webserver to rewrite the URL, the web browser tries to do something (I can't tell what), then returns the error below: The page isn't redirecting properly Firefox has detected that the server is redirecting the request for this address in a way that will never complete. > Normally, I could do this a few different ways (provided my webserver > had ssl added to it natively in a normal way) 1. webserver URL Rewrite > plugin 2. webserver redirect plugin > 3: > > For whatever reason, I'm having all sorts of weird issues when > trying the three methods above if I use stunnel for ssl instead of > using the webserver's builtin ssl. Please note that traffic coming out of the stunnel looks - and actually *is* - just as port-80-ish to the actual webserver as native HTTP requests do, so unless you take special measures to break the loop, the webserver will try to (re-)redirect *that, too*. Regards, J. Bern --

2 1

enabling https capability
by John A. Wallace 01 Nov '12

01 Nov '12

Not sure if this is the right place to ask, but I will give it a try because it seems likely that someone here can point me in the right direction if need be. I am not a programmer. I have an application that can make http connections but not https. The connections are made from a Windows command line interface, not a browser. I would like to enable it to make https connections too without having to reinvent the wheel. If there is some way to connect it to an intermediary proxy program that does have built-in support for the https protocol, that would be swell. Is such a thing possible or is there another solution I don't see? Thanks. John

2 1

Fwd: Trying to minimize memory usage for a scenario where we have several long-lived HTTPS connections.
by Jeremy Frady 31 Oct '12

31 Oct '12

Hello all, Thanks for taking the time to read this. We're operating on a low spec system that can not be modified at this point. stunnel was introduced at the last minute, without consideration to resource requirements and now consumes enough ram to cause the kernel to issue OOM exceptions. So in short, we are trying to trade increased CPU usage for less memory usage and have tried setting “sessions” to 3600 to reduce memory pressure, but unfortunately it doesn't last. Our current solution is to cron a restart of stunnel on a regular basis, but would prefer to limit number of threads or number of cache entries or something else altogether similarly gentler. Thanks again for your consideration and assistance in this! Regards, Jeremy

1 0

6 processes + out of memory issues on CentOS 6 stunnel (4.29)
by Todd Rinaldo 31 Oct '12

31 Oct '12

I'm experimenting with using the stunnel that comes with CentOS 6 (4.29). I have a config file that is successfully being used on stunnel version 4.15 on the same host without any issues. My issues: 1. starting stunnel creates 6 processes. I assume this has something to do with libwrap, but I'm not finding much discussion about it by doing a search. I'm also assuming that the binaries are forking after load, so it's not a significant memory expense to do this due to COW. Is this correct? 2. I'm getting 't of memory' (no "ou" in the error) messages from syslog when I do more than one request via chrome to port 2087. The process indicated from the message points to the stunnel process that has ownership of the open ports. A single request to this port doesn't seem to spawn the issue. Can anyone suggest what might be causing this? Upgrading to a newer version of stunnel is possible, but I would prefer to keep the version Red Hat provides so they can be on the hook for CVE issues. My config file follows: ----- cert = /var/cpanel/ssl/cpanel/cpanel.pem chroot = /usr/local/cpanel/var/run/stunnel/ # PID is created inside chroot jail pid = /stunnel.pid setuid = cpanel setgid = cpanel # Service-level configuration [cpanelhttps] accept = 2083 connect = 2082 TIMEOUTclose = 0 [whmhttps] accept = 2087 connect = 2086 TIMEOUTclose = 0 [webmailhttps] accept = 2096 connect = 2095 TIMEOUTclose = 0

1 0

Re: [stunnel-users] Using stunnel to add https to a webserver that doesn't have ssl setup
by Michael Avanessian 30 Oct '12

30 Oct '12

Thanks for the quick reply! So... what http code do I use to break out the infinite loop so it loads only once? I think the other 2 circumstances may have something similar happening to them (which are forwarded using the web server instead). If I use the webserver to rewrite the URL, the web browser tries to do something (I can't tell what), then returns the error below: The page isn't redirecting properly Firefox has detected that the server is redirecting the request for this address in a way that will never complete. > Normally, I could do this a few different ways (provided my webserver > had ssl added to it natively in a normal way) 1. webserver URL Rewrite > plugin 2. webserver redirect plugin > 3: > > For whatever reason, I'm having all sorts of weird issues when > trying the three methods above if I use stunnel for ssl instead of > using the webserver's builtin ssl. Please note that traffic coming out of the stunnel looks - and actually *is* - just as port-80-ish to the actual webserver as native HTTP requests do, so unless you take special measures to break the loop, the webserver will try to (re-)redirect *that, too*. Regards, J. Bern --

2 1

Using stunnel to add https to a webserver that doesn't have ssl setup
by Michael Avanessian 30 Oct '12

30 Oct '12

Hi there. I appreciate that you guys are all helping each other out. I am brand new to stunnel. Currently, I'm using stunnel to add https to a webserver that doesn't have ssl setup; which works great. I prefer to do that instead of using the webserver's builtin ssl feature. CONFIGURATION: Stunnel.conf includes (which adds ssl to incoming http traffic on port 443) [https] accept = 443 connect = 80 Also, incoming http:80 traffic can also come in; which would bypass stunnel, and go directly to the webserver as http. OBJECTIVE: I am trying to make it so when someone visits: http://mywebsite.com (it forwards automatically to https://mywebsite.com) Normally, I could do this a few different ways (provided my webserver had ssl added to it natively in a normal way) 1. webserver URL Rewrite plugin 2. webserver redirect plugin 3: <meta http-equiv="refresh" content="0; url=https://mywebsite.com"> For whatever reason, I'm having all sorts of weird issues when trying the three methods above if I use stunnel for ssl instead of using the webserver's builtin ssl. The first two methods result in web browser redirect errors, the third method result in an infinite loop reloading the https website. Can someone please tell me what extra accommodation I need to make considering that using stunnel for https can complicate things. I'm using IIS 7.5 as my webserver. I've tried using the the URL rewrite 2.0 mod using the below rule (which works for normal builtin ssl support in the webserver: <rule name="Redirect to HTTPS" stopProcessing="true"> <match url="(.*)" /> <conditions><add input="{HTTPS}" pattern="^OFF$" /> </conditions> </rule> I have also tried the "http redirect" mod; which I can forward to any website except for the one I'm trying to do. Both take me to the https equivalent and give a redirect error. Could someone please be kind enough to tell me what I'm missing? Thanks!

2 1

How upgrade stunnel?
by magali morales 30 Oct '12

30 Oct '12

Hi!! I have installed the version 4.44 of stunnel, haproxy I am currently using 1.4.22. I need to update stunnel most recent version. How do I update stunnel to the latest version? And I want to know How do I uninstall stunnel? I hope you can help me, I thank you in advance!

7 7

TIMEOUTclose exceeded: closing
by Michael Wittig 25 Oct '12

25 Oct '12

Hi, I am using stunnes 4.54, my config looks like this: chroot = /opt/stunnel/jail/ setuid = stunnel setgid = stunnel pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 syslog = yes debug = local1.warning fips = no [http] cert = /opt/stunnel/www.crt key = /opt/stunnel/www.key sslVersion = all options = NO_SSLv2 renegotiation = no accept = 192.168.72.10:443 connect = 192.168.71.10:80 TIMEOUTclose = 0 xforwardedfor = yes My log is full with: Oct 25 14:49:33 www stunnel: LOG3[15114:140668359968512]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing Oct 25 14:49:36 www stunnel: LOG3[15114:140668360591104]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing Oct 25 14:50:08 www stunnel: LOG3[15114:140668360812288]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing Oct 25 14:50:13 www stunnel: LOG3[15114:140668360591104]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing The doc suggests to "set to 0 for buggy MSIE" the mailing list tells me "You requested close timeout of 0 seconds and that's exactly what you get." But i still don't understand why this is an error and what can I do to get rid of it? Or is it okay to don't look for errors in the log? Regards, Michael

2 1

some version issue
by Sergey Pimenov 25 Oct '12

25 Oct '12

Hello, I have a little problem, working with stunnel. The problem is: 25 10:50:53 LOG3[2612:1972]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number and the full log: 25 10:50:32 LOG7[2612:2988]: No limit detected for the number of clients 2012.10.25 10:50:32 LOG5[2612:2988]: stunnel 4.53 on x86-pc-mingw32-gnu platform 2012.10.25 10:50:32 LOG5[2612:2988]: Compiled/running with OpenSSL 0.9.8s-fips 4 Jan 2012 2012.10.25 10:50:32 LOG5[2612:2988]: Threading:WIN32 SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:SELECT+IPv6 2012.10.25 10:50:32 LOG5[2612:2988]: Reading configuration from file stunnel.conf 2012.10.25 10:50:33 LOG5[2612:2988]: FIPS mode is enabled 2012.10.25 10:50:33 LOG7[2612:2988]: Compression not enabled 2012.10.25 10:50:33 LOG7[2612:2988]: PRNG seeded successfully 2012.10.25 10:50:33 LOG6[2612:2988]: Initializing service section [POS] 2012.10.25 10:50:33 LOG7[2612:2988]: Certificate: C:\Arcus2\SSL\pos3135pem.pem 2012.10.25 10:50:33 LOG7[2612:2988]: Certificate loaded 2012.10.25 10:50:33 LOG7[2612:2988]: Key file: C:\Arcus2\SSL\pos3135key.pem 2012.10.25 10:50:33 LOG7[2612:2988]: Private key loaded 2012.10.25 10:50:33 LOG7[2612:2988]: SSL options set: 0x00000004 2012.10.25 10:50:33 LOG5[2612:2988]: Configuration successful 2012.10.25 10:50:33 LOG7[2612:2988]: Service [POS] (FD=180) bound to 127.0.0.1:9021 2012.10.25 10:50:53 LOG7[2612:2988]: Service [POS] accepted (FD=260) from 127.0.0.1:3645 2012.10.25 10:50:53 LOG7[2612:2988]: Creating a new thread 2012.10.25 10:50:53 LOG7[2612:2988]: New thread created 2012.10.25 10:50:53 LOG7[2612:1972]: Service [POS] started 2012.10.25 10:50:53 LOG5[2612:1972]: Service [POS] accepted connection from 127.0.0.1:3645 2012.10.25 10:50:53 LOG6[2612:1972]: connect_blocking: connecting 217.69.205.63:9021 2012.10.25 10:50:53 LOG7[2612:1972]: connect_blocking: s_poll_wait 217.69.205.63:9021: waiting 10 seconds 2012.10.25 10:50:53 LOG5[2612:1972]: connect_blocking: connected 217.69.205.63:9021 2012.10.25 10:50:53 LOG5[2612:1972]: Service [POS] connected remote server from 213.156.128.147:3646 2012.10.25 10:50:53 LOG7[2612:1972]: Remote socket (FD=284) initialized 2012.10.25 10:50:53 LOG3[2612:1972]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2012.10.25 10:50:53 LOG5[2612:1972]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2012.10.25 10:50:53 LOG7[2612:1972]: Remote socket (FD=284) closed 2012.10.25 10:50:53 LOG7[2612:1972]: Local socket (FD=260) closed 2012.10.25 10:50:53 LOG7[2612:1972]: Service [POS] finished (0 left) my .conf file is: cert = C:\Arcus2\SSL\pos3135pem.pem key = C:\Arcus2\SSL\pos3135key.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 CAfile = C:\Arcus2\SSL\cacert.pem debug = 7 output = stunnel.log [POS] client = yes accept = 127.0.0.1:9021 connect = xxx.xxx.xxx.xxx:9021 if I change conf file, adding sslVersion = all or sslVersion = SSLv3, I have another error Section POS: sslVersion = TLSv1 is required in FIPS mode Thank your for help, Sergey Pimenov

2 1