- stunnel-users - stunnel.org

endpoints using different versions of stunnel
by nishith n 15 Dec '10

15 Dec '10

Hello all, We have a client who would like to send us data using stunnel 4.33 at their end of the connection. Can we establish connection from our end using stunnel 4.11 version. We are working on a sun machine. I know I can simply download the latest stunnel version but it has to go through an authorization process which probably will take more time than I have and hence this question. What could be the impacts to connectivity or otherwise with such a setup? Thanks for your replies, Nishith

1 0

Examples of stunnel and lighttpd
by fanboy 15 Dec '10

15 Dec '10

Apparently lighttpd ssl support isn't so flash, I'm been attempting (I'm a newb) to use stunnel instead, are there any examples? I have a free startssl cert also (ssl.key / ssl.cert) What information do I need to setup a reliable connection?

1 0

How to encrypt the URL?
by cpu.lin 08 Dec '10

08 Dec '10

Dear friends, After reading mailing lists & Web & FAQ I couldn't find answers to these: stunnel.conf as follows: debug=7 client = yes [proxy] accept=1111 connect=62.215.5.69:8080 (Public SSL Proxy) protocol=connect protocolHost=stunnel.mirt.net:443 CLIENT(Browser+Special software)<->firewall<->(Internet)<->Public SSL Proxy<->WEB SERVER Public SSL Proxy as follows: http://tools.rosinstrument.com/raw_free_db.htm?t=2 Only the CLIENT side have stunnel. After running stunnel 4.34 (Windows binaries). Then. Browser http://localhost:1111/ But Sniffer can monitor the command-(CONNECT stunnel.mirt.net:443). The problem as follows: Only the CLIENT side can install special software. Special software including but not limited to stunnel. If the firewall can block many websites depend on Web IP & URL. How to pass through the firewall base on Public SSL Proxy? How to encrypt the URL-(stunnel.mirt.net:443)? What is the special software? If stunnel can solve this issue. How to configure? Best regards, cpu

1 0

stunnel and IE6 issue
by Bill Tindal 06 Dec '10

06 Dec '10

Hi, I have stunnel running in front of HaProxy and everything is working fine however IE6 users cannot access our HTTPS pages and are instead shown a 'Page cannot be found'. They can access normal pages. Obviously there's something that stunnel doesn't like about IE6 (who doesn't) but I'm at a loss as to what changes to make to the stunnel conf. My conf for stunnel is below: ------------------------------------------------ sslVersion = all options = NO_SSLv2 fips = no setuid = root setgid = stunnel pid = /var/run/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 output = /var/log/stunnel.log [secure.domain.com] cert = /usr/local/openssl/certs/secure.domain.com.crt key = /usr/local/openssl/certs/secure.domain.com.key accept = X.X.X.X:443 connect = X.X.X.X:81 xforwardedfor = yes TIMEOUTclose = 0

1 0

How to define stunnel.conf so openvpn packet will go thru stunnel to as HTTP?
by UARE1234 29 Nov '10

29 Nov '10

Hi, >From what I read the examples in stunnel site it possible to wrap VPN's using Stunnel tool. Is it possible to do it for openvpn packets? I can configure thru the openvpn configurations that it packets will go thru port 80 and use TCP but the packets are not http pure. I need to wrap this packets using the stunnel tool. The purpose is to use openvpn over http. I will appreceate if someone can give me a solution for combinig Stunnel and openvpn if possible. Thanks -- View this message in context: http://old.nabble.com/How-to-define-stunnel.conf-so-openvpn-packet-will-go-… Sent from the Stunnel - Users mailing list archive at Nabble.com.

1 0

Is it possible to wrap openvpn thru stunnel to HTTP-Like
by UARE1234 28 Nov '10

28 Nov '10

Hi, I understand that it is possible to wrap VPN's using Stunnel tool. How Can I do that for openvpn. The purpose is to use openvpn over http like. OpenVPN can establish an HTTP connection to a proxy server, where it will issue a CONNECT to establish a binary connection to the VPN server on port 443/TCP. This works in 99,9% but not in this case since I am talking about a very restrictive network but yet Skype for example works on it since it works in a way of http like. I will appreceate if someone can give me a solution for combinig Stunnel and openvpn or other tool if possible. Thanks -- View this message in context: http://old.nabble.com/Is-it-possible-to-wrap-openvpn-thru-stunnel-to-HTTP-L… Sent from the Stunnel - Users mailing list archive at Nabble.com.

1 0

Stunnel resource usage
by Avinash Gaonkar 26 Nov '10

26 Nov '10

Hi All, I need to understand how can we calculate the throughput for stunnel based on allocated CPU and memory. For e.g if we allocate 512Mb of RAM and 1 core for the stunnel in Vmware, what would be the throughput in Mbps. Regards, Avinash gaonkar

1 0

Enhance description of transparent mode in FAQ
by Ivan Trancik 25 Nov '10

25 Nov '10

Hello, I would suggest to improve 'transparent = yes | no (Unix only)' section of http://www.stunnel.org/faq/stunnel.html#service_level_options and how this option work on OS X. I think that this part remote mode (I<connect> option) on Linux >=2.6.28 remote mode (I<connect> option) 2.2.x local mode (I<exec> option) is not clear. Remote mode is a "I<connect> option"? What the heck? And local mode is a "I<exec> option"? Does this "I" thingie stand for unnamed pipe or capital "i" or small cap "L"?? I ran to this problem when I tried to set up stunnel on Mac OS X and carelessly used some example config on web. Setting "transparent = yes" in Mac OS X will result in very funny behavior. Consider this conf debug=7 output=stunnel.log verify=0 foreground=yes client=yes pid= [https] accept=localhost:8080 connect=google.com:443 transparent=yes will result in unbelievable error - "local_bind (original port): Address family not supported by protocol family (47)" Using 127.0.0.1 instead of localhost will do better - "Service https bound to 127.0.0.1:8080" - BUT when you try to access 127.0.0.1:8080 nothing reasonable happens and log will show another strange error "connect_blocking: connect <ip_address>: Network is unreachable (51)" The next spectacular thing is that when you use only localhost connect and accept parameter, than transparent=yes works OK. I would suggest rewriting that part to reflect these kind of situations in more clear way - they are very hard to debug, and honestly I couldn't figure it out even though I read FAQ several times. Final question - is it possible on OS X (which doesn't have iptables interface, but has ipfw) to set up transparent proxy tunnel with stunnel? Thanks.

2 1

Problems with cert
by Ross 25 Nov '10

25 Nov '10

Hello, we were using Stunnel 4.25 for a long time without any problems. We used "verify=3". Our client config file: service = stunnel-client cert = client.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 3 CApath = certificates CAfile = CAcert.pem client = yes [rdp] accept = 3398 connect = XX.XX.XX.XX:3398 But after switching to Stunnel 4.34 (preserving configuration) we started to get errors: 2010.11.25 13:13:30 LOG5[8332:5336]: Service rdp-database accepted connection from 127.0.0.1:30082 2010.11.25 13:13:30 LOG5[8332:5336]: connect_blocking: connected 95.130.236.42:3398 2010.11.25 13:13:30 LOG5[8332:5336]: Service rdp-database connected remote server from XX.XX.XX.XX:30083 2010.11.25 13:13:30 LOG5[8332:5336]: Certificate accepted: depth=1, /C=UA/ST=Lviv/L=Lviv region/O=ROSS/OU=IT/emailAddress=bla(a)bla.com 2010.11.25 13:13:30 LOG4[8332:5336]: CERT: Certificate not found in local repository 2010.11.25 13:13:30 LOG4[8332:5336]: Certificate check failed: depth=0, /C=UA/ST=Lviv/L=Lviv region/O=ROSS/OU=IT/CN=OURSERVER/emailAddress=bala(a)bla.com 2010.11.25 13:13:30 LOG3[8332:5336]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed 2010.11.25 13:13:30 LOG5[8332:5336]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Main error is: CERT: Certificate not found in local repository Looks like stunnel cannot find the hashed server's certificate in C:\Program Files\stunnel\certificates (CApath = certificates) We tried specifying full paths, but it does not help. Switching to "verify=2" (do not check server's cert) works ok. Also stunnel 4.25 (with verify=3) works ok on this configuration. Could you help? Ross

2 1

Re: [stunnel-users] ssl renegotiation
by Jason Haar 25 Nov '10

25 Nov '10

On 11/25/2010 05:42 AM, Joe Williams wrote: > > Got it, so there's no way to configure stunnel to disable it without building a new openssl from source. I was thinking there might be an SSL option I could pass in. > That kind of feature was only introduced into the newer versions of OpenSSL, so by definition, older versions can't have an option to disable it ;-) FYI I still have to run fully patched Apache with "SSLInsecureRenegotiation on" due to MSIE still not supporting proper optional client cert renegotiation. It's only *2 years* since the vulnerability was discovered... (Chrome, Firefox are fine of course) -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

1 0

ssl renegotiation
by Joe Williams 24 Nov '10

24 Nov '10

List, How does one secure stunnel from man in the middle attacks regarding ssl renegotiation. I have seen http://www.openssl.org/docs/ssl/SSL_CTX_set_options.html#SECURE_RENEGOTIATI… but I couldn't tell if stunnel is affected by it, nor what I could do outside of installing a newer version of openssl to prevent it. Additionally I did a scan on www.ssllabs.com and it stated that insecure renegotiation was supported, which isn't good. I am running 0.9.8k-7ubuntu8.4, the standard version that ships with ubuntu 10.04, and stunnel 4.32. What can I do to configure stunnel to protect myself? My current config is below. Thanks. -Joe ; Certificate/key is needed in server mode and optional in client mode cert = /etc/stunnel/file.crt key = /etc/stunnel/file.key foreground = yes debug = 5 ciphers = DES-CBC3-SHA:AES256-SHA:AES128-SHA:RC4-SHA:RC4-MD5 ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = all options = NO_SSLv2 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside chroot jail pid = /stunnel4.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Service-level configuration [https] accept = 443 connect = localhost:80 TIMEOUTclose = 0 Name: Joseph A. Williams Email: joe(a)joetify.com Blog: http://www.joeandmotorboat.com/ Twitter: http://twitter.com/williamsjoe

2 2

SSLPassPhraseDialog
by Avinash Gaonkar 23 Nov '10

23 Nov '10

Hi Team, How can we configure ssl key passphrase in stunnel config file. for. eg SSLPassPhraseDialog exec:/path/to/passphrase-file parameter we have in apache, so no need to key in password every time when we restart service. Regards, Avinash Gaonkar

3 2

SMPP Protocol and STunnel
by Pathak, Apurva (Apu) 23 Nov '10

23 Nov '10

Hello, I would like to find out if I can use STunnel as follows: I have a stand alone C# executable program that uses a third party SDK that implements SMPP protocol and sends SMS text messages with wireless carriers. Recently, one of the wireless carriers wants us to implement SSL Client Authentication and wants SMPP messages that are exchanged with them to be encrypted after the client authentication is done. I want to find out if I can use STunnel running so that STunnel can encrypt and decrypt the messages exchanged between my program and the carrier's SMS server. (1) Is this possible with STunnel? (2) What are the steps involved? I am on the Windows Server 2003 platform. I would really appreciate a reply. Thanks, Apu

3 12

Re: [stunnel-users] Error: faulting application stunnel.exe, version 0.0.0.0, faulting module libeay32.dll, version 1.0.0.1, fault address 0x0007331e.
by Pathak, Apurva (Apu) 21 Nov '10

21 Nov '10

Ok...I may keep it....at the moment things are very stable so I am not touching any thing for the moment. The client mentioned it...and they examined the stunnel.conf of some of their other customers...so...otherwise it made sense to me to keep it. Thanks again for your help! Apurva ====== Hi Apurva, Good news. Just to mention: SslVersion=all OFTEN SOLVES MANY PROBLEMS in various circumstances. So I would keep it... Just search for it in the mailing list and you will see... This is just an advice... Yours sincerely, Pierre -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:stunnel-users-bounces@mirt.net] On Behalf Of stunnel-users-request(a)mirt.net Sent: Sunday, November 21, 2010 1:27 PM To: stunnel-users(a)mirt.net Subject: stunnel-users Digest, Vol 76, Issue 13 Send stunnel-users mailing list submissions to stunnel-users(a)mirt.net To subscribe or unsubscribe via the World Wide Web, visit http://stunnel.mirt.net/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)mirt.net You can reach the person managing the list at stunnel-users-owner(a)mirt.net When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..."

1 0

public domain [PATCH] to stunnel 4.34 for Windows CE / Windows Mobile, "no service" CRITICAL bug and unicode bugs fixed
by Pierre DELAAGE 17 Nov '10

17 Nov '10

Dear All, Please find enclosed a patch in "diff -cr orig patched" format, applying to stunnel4.34 as found here ftp://stunnel.mirt.net/stunnel/. This patch mainly addresses compilation and unicode issues for Windows CE targets + ONE critical issue preventing stunnel to service anything (!). I use MS EVC 4sp2 compiler with WCE 420 SDK, on a vista host platform. Once debugged the code works fine on WM6 HTC smartphones. Should work on WM5. It needs a windows CE openssl lib (I recompiled MY patched version of openssl 1.0.0a successfully: I will have to log a patch to those gentlemen, hoping that they are open to integrate it, something not so obvious in the past). I will later post here a link to my patch for openssl 100a pointing to the openssl mailing list. THIS OPENSSL PATCH IS ESSENTIAL : with my older version of openssl 098pre_j for wce, stunnel does not work anymore (it crashes after first cnx). The present stunnel patch addresses the following issues : ************* I] COMPILATION FAILURES 1/ on common.h "EINVAL redefinition" : in fact the compile options WX (see evc.mak) does not tolerate any warning : The MS evc420 compiler ALWAYS issues a warning on this symbol redefinition. Michal and I are dealing with it since month... But, considering that NEITHER Exxx error codes are used in stunnel, I suggest that in fact ALL these redef should be suppressed. TODO: In the future a proper rewrite of code in log.c, where hardcoded values of WSA error codes are used instead of symbolic constant, will have to be done. 2/ client.c CreateProcess is a UNICODE function: code was ascii only. Code has been adapted to work in unicode. 3/ evc.mak path to new openssl lib has been redefined. proper location for the libs in openssl tree has been set in the make-install block (although this block is presently USELESS and needs a complete rewrite). 4/ gui.c All code using hmainmenu is OFF under winCE. So some new lines involving it were not compiling. 5/ options.c linger_val.l_linger and linger_val.l_onoff require ushort values. Strict type checking of the compiler required a proper cast to ushort of the r-values. stralloc uses "strdup": on Win32 and winCE strdup is _strdup (!). 6/ prototypes.h : _beginthread was defined as returning an int, an a long in sthread.c. After some checking in various documentations, long is the correct type, in particular because _beginthread can return the special error value "-1L". So that unsigned types are illogical. This simplifies the code in some locations, by saving some -now useless- casts. 7/ sthread.c create_client: suppressed some useless cast to (long) for beginthread. ************* II] OPERATIONAL ERRORS (at run-time) This is a reminder of previous notification to the mailing list : due to beginthread improper code and/or use, It is presently IMPOSSIBLE for stunnel 434 to be used in production on WCE: it is just unable to service any...service. Nothing happens if, for example, you use it to connect to an https server. No log either ! I corrected the code with both Michal patch to gui.c and mine to sthread.c: gui.c (Michal patch) : _beginthread was called with 0 as stacksize which, cumulated to an improper coding of sthread/beginthread, led to FAILURE of service thread creation. sthread.c: _beginthread : now supports "0" stacksize value, leading to default linker stack size (1MB by default unless specified differently on the linker command line, something we do not yet perform but could). ************* III] MINOR IMPROVMENT _beginthread: added a log on critical event of "failure" to create a service thread. because I think it is a critical event, isn't it? I hope you will find this patch useful. Thank you for your excellent work, Yours sincerely, Pierre Delaage Note : I use stunnel to establish a simple "vpn" between smartphones and a corporate linux server mainly for HTTPS/POPS/SMTPS support. Stunnel is very relevant in that matter, over solutions based on SSH (although we use also ssh), from a communication cost point of view : ssh establishes permanent socket between client and server, so that the communication is charged by the mobile network provider : and these charges are very expensive. On the contrary stunnel only establishes ssl sockets on demand so that financial charges are limited to strict necessary. Please note that stunnel brings "client based certificate authentication" to POP/SMTP mobile mail user agents which only BASICALLY supports SSL with server authentication, but NO client authentication, such as M$ Outlook for Mobile (unless you pay for an exchange server and exchange client licence). Here again stunnel is very relevant. Note 2 : the strdup and unicode bug fixes should benefit also to the win32 (for PC) stunnel version for PC.

1 1

CApath hash calculation broken (ver 4.34)?
by Konstantin Suvorov 17 Nov '10

17 Nov '10

Hello, I’m trying to setup client-server SSL connection with “level 3” verification on server side. I use 4.34 precompiled binary package for win32. I put client certificates into CApath folder with hashed filenames (I use openssl x509 -hash to get them). And nothing works: I get “bad certificate”. After sniffing for filenames stunnel server is looking for I found out that they are not matching the hash values I got with openssl tool. I downloaded openssl binaries (ver. 0.9.8o) and put them into the stunnel folder. This fixed the bug with wrong filename request inside stunnel, but it started to crash after connection is initiated. I tried to install stunnel (fresh download of 4.34) on another computer – the same problem: requested hash-filename is not equal to actual one. Does anybody know how to fix this? Regards, Konstantin.

1 0

STunnel / Memory Usage / 4 Second Lag
by Jesse Proudman 16 Nov '10

16 Nov '10

We have an account running on STunnel that has been operating just fine for the last 9 days. This morning, all of a sudden, stunnel memory usage spiked to consume the entire available memory on the machine, and response time went from sub 1 second to 4+ seconds. Nothing has changed in the load balanced service itself, the configuration, or any of the traffic numbers. Restarting stunnel gets us between 5 and 60 seconds of normal response times before spiking in memory and going back to 4 seconds. Has any one seen this before? Thanks - Jesse

1 0

Difficulty to compile with alternate 64 bit openssl libraries
by Philippe A. 12 Nov '10

12 Nov '10

Hello, I am having a problem when I compile stunnel against 64 bit openssl libraries: ./configure --prefix $HOME/tls --with-threads=fork --with-ssl=/opt2/openssl stunnel will end up using default libraries in /lib (which I can't remove from my environment). The workaround we have found is to modify the configure script and to force the LIBS variable to use "lib64" instead of "lib". # Add SSL includes and libraries CFLAGS="$CFLAGS -I$ssldir/include" LIBS="$LIBS -L$ssldir/lib64 -lssl -lcrypto" #- <---- Is this a known problem? Is there another way around this without changing the configure script? Thanks!

2 1

Reg:libwrap is not working with stunnel 4.34
by mohan raj 10 Nov '10

10 Nov '10

Hi, I successfully cross compiled the Stunnel version 4.34 with OpenSSL version 1.0.0a for arm-linux.i want to use this stunnel with my own application which will communicate with outer world through LAN or GPRS.currently i am testing stunnel with telnet application.Its working fine.I am able to telnet to arm board through SSL enabled telnet terminal software.Now i want restrict the access.so i used the /etc/hosts/allow and /etc/hosts.deny files with my chrroot directory as "/".but stunnel is not at all cared about libwrap service.its not checking those files.if i give libwrap=yes in stunnel.conf file its says "specified option name is not valid here".i compiled stunnel with the option --enable-libwrap and gave the libwrap lib also through LDFLAGS.here with i attached my stunnel version information file, stunnel .conf file also.i think its due to configuration???still i don`t know what to do???so please guys help me out. Thanks & Regards S.Thiyagarajan.

3 4

Error Reading Certificate File
by Ken Davidson 04 Nov '10

04 Nov '10

Hi, I am trying to update my companies Certificate in STunnel and I'm getting the following error messages: Certificate: pass-web_new.pem Error reading certificate file: pass-web_new.pem error queue: 140DC009 : error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib error queue: 906700D : error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1 lib error queue: D08303A : error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error error queue: D07803A : error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error SSL_CTX_use_certificate_chain_file: D0680A8: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag We are currently using STunnel without issue; but my certificate is due to expire November 15th. I submitted my request via a CSR file created with OPENSSL. I've attempted to put the data into the file pointed at in the stunnel.conf file but this error continues to haunt me. My previous key was 256, but when making this key I created a 1024 key and used that for the CSR file. I've also added the Intermediate certificate information to the file. Any information on what could be the problem is greatly appreciated. Version: 4.34 Thanks, Ken

1 0

FD_SETSIZE still an option in stunnel 4.34?
by Saikat Chakrabarti 04 Nov '10

04 Nov '10

Hi, I am having some issues with my server where connections are getting dropped once I hit a hard limit of around 350 connections. This may or may not be an issue with my stunnel configuration, but I ran across some old posts saying that stunnel by default has a hard limit of around 500 connections and, to get around this, to set FD_SETSIZE at compile time (I found this on the troubleshooting page - http://www.stunnel.org/faq/troubleshooting.html). However, one of the release notes recently also had a comment saying 'no more FD_SETSIZE limit!' - http://www.mail-archive.com/openssl-users@openssl.org/msg38373.html. So my questions are: 1) Does FD_SETSIZE still exist in Stunnel 4.34 and could it be a reason why I am seeing a limit on the number of people that can make a connection? I already tried running stunnel after setting ulimit -Hn and ulimit -Sn to 4096, and it did not seem to make a difference. 2) More noobish question - how do I set the FD_SETSIZE at compile time? I saw in the troubleshooting that it said to do "-DFD_SETSIZE=4096" at compile time. Is this something I should be adding in one of the Makefiles? Some more info about my setup: - I am using stunnel as a layer in front of Node.js to secure websockets and HTTP connections. - I'm running stunnel 4.34 - I am running stunnel from a startup script in /etc/init.d - it runs as a daemon process - I run stunnel with no params, but with this config file - http://pastebin.com/3Yr80ma1 - uname -a output: Linux gomockingbird.com 2.6.18.8-linode22 #1 SMP Tue Nov 10 16:12:12 UTC 2009 i686 GNU/Linux - gcc -v output: Using built-in specs. Target: i486-linux-gnu Configured with: ../src/configure -v --with-pkgversion='Ubuntu 4.3.3-5ubuntu4' --with-bugurl=file:///usr/share/doc/gcc-4.3/README.Bugs --enable-languages=c,c++,fortran,objc,obj-c++ --prefix=/usr --enable-shared --with-system-zlib --libexecdir=/usr/lib --without-included-gettext --enable-threads=posix --enable-nls --with-gxx-include-dir=/usr/include/c++/4.3 --program-suffix=-4.3 --enable-clocale=gnu --enable-libstdcxx-debug --enable-objc-gc --enable-mpfr --enable-targets=all --with-tune=generic --enable-checking=release --build=i486-linux-gnu --host=i486-linux-gnu --target=i486-linux-gnu Thread model: posix gcc version 4.3.3 (Ubuntu 4.3.3-5ubuntu4) - openssl version output: OpenSSL 0.9.8g 19 Oct 2007 Thanks in advance for any help! -- Saikat

2 3

Many services on the same port (VirtualHost)
by Hugo 01 Nov '10

01 Nov '10

Hello all! Does anyone knows a way to make many services listening on the same port? I've got one stunnel4 server which allows me to crypt two http servers. The first service bind on port 465 and the second on 470. What I will is to let user access on the port 465 using 2 different ServerNames. Thank you in anticipation, and excuse me for my quite bad english =D

4 3

Re: [stunnel-users] stunnel-users Digest, Vol 75, Issue 13
by Hugo 31 Oct '10

31 Oct '10

It's what I wanted to do: redirect the public 443 port on the correct local stunnel "accept:" port or service. I'd set 3 services with 3 different certificates on 3 ports. By eg, my first domain is ssl.example.com and the second admin.example.com. These two records point on the same IP. Stunnel has two services on that, so it binds two ports (!=443) (eg, 7100 and 7200) Is there a way to stunnel (or another program) bind on port 443 and, if user connects on ssl.example.com, forward frames/respond using the service/port 7100, and the same for admin.example.com on 7200? https://ssl.example.com ==> https://ssl.example.com:7100 https://admin.example.com ==>https://admin.example.com:7200 ? Thanks Message: 2 Date: Sat, 30 Oct 2010 11:45:19 -0400 (EDT) From: Jon Daley <stunnel(a)jon.limedaley.com> To: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Many services on the same port (VirtualHost) Message-ID: <alpine.DEB.2.00.1010301139120.19689(a)orange.limedaley.com> Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed On Sat, 30 Oct 2010, Hugo wrote: > Does anyone knows a way to make many services listening on the same port? > I've got one stunnel4 server which allows me to crypt two http servers. > The first service bind on port 465 and the second on 470. > What I will is to let user access on the port 465 using 2 different > ServerNames. I am not sure what you are trying to do. You want clients to connect via https to ports 465 on two different IPs and then stunnel to forward them to the appropriate http daemon? I am not sure if stunnel works in that method - that is the reverse of what I use stunnel for - I connect via an unencrypted connection, and forward via stunnel to an encrypted daemon. And if you are talking about virtually hosting https connections, that will work, as long as the certificate contains both servernames - you can't use two different certificates, because you don't know which certificate to serve until after the connection is encrypted.

2 2

Re: [stunnel-users] Many services on the same port (VirtualHost)
by Hugo 30 Oct '10

30 Oct '10

Thanks for the answer, but it seems I haven't got access to IPTables (my stunnel is on a remote shell service) and I think using a webserver is not a good solution for that case. So does anyone knows a program able to bind on a single port, and redirect requests on another depending on the domain name? Thanks you in anticipation Hugo On 30/10/2010 17:02, Pierre DELAAGE wrote: > Hello, > The answer is simply NO in stunnel, > but yes in Apache. > If you are joining one "http server", hosting many virtual hosts, > it should be "trivial". > I recommend using IP based hosting. > > I guess you want to act as a transparent gateway/proxy to https servers : > there is another way to proceed if you have a linux PC on your network > that can act as a routing/gateway: > with iptables you can do redirection to stunnel and get what you want. > Sorry but it is a little bit complicated to develop more now. > > Hope this helps, > Pierre Delaage > > > Le 30/10/2010 17:12, Hugo a écrit : >> Hello all! >> >> Does anyone knows a way to make many services listening on the same port? >> I've got one stunnel4 server which allows me to crypt two http servers. >> The first service bind on port 465 and the second on 470. >> What I will is to let user access on the port 465 using 2 different >> ServerNames. >> >> Thank you in anticipation, and excuse me for my quite bad english =D >> >> >> >> _______________________________________________ >> stunnel-users mailing list >> stunnel-users(a)mirt.net >> http://stunnel.mirt.net/mailman/listinfo/stunnel-users >

2 1

Re: [stunnel-users] openssl cross compiling for windows
by Jon Daley 30 Oct '10

30 Oct '10

On Wed, 27 Oct 2010, Jon Daley wrote: > On Wed, 27 Oct 2010, Michal Trojnara wrote: >> Jon Daley wrote: >>>> 3. Cross-compile OpenSSL: >>>> ./Configure --cross-compile-prefix=i586-mingw32msvc- mingw shared >>>> zlib-dynamic >>>> make >>> And you end up with 3 dlls in the openssl directory? >> >> Not really. Just 2 of them. Zlib is produced in step 2. > Hrm. I wasn't talking about the zlib1.dll. I meant: > ssleay32.dll, libssl32.dll and libeay32.dll. Maybe I got mixed up the names, > and am using one that I don't need. I thought I put them in one at a time, > and waited for Windows to ask me for them, but I'll check again. Ah, yes. I am dumb. I can compile and run it without problems with just the two *eay32 dlls. And we've finally figured out the other bug, where it works on my computer, and not on someone else's. It has to do with ipv6 support, and it didn't go away even after I ./config --disable-ipv6, which that flag is (mostly?) ignored in the windows builds, due to the dynamic LoadLibrary calls. On one computer, stunnel connects on the ipv6 port, but then when running "telnet localhost 7000", it connects via the ipv4 port, and so fails. If we force stunnel to use ipv4 by using 127.0.0.1 instead of localhost, everything works fine. My guess is that his computer is partially/incorrectly configured for ipv6, and so that is the reason for the failure. I'm planning on removing the LoadLibrary calls to force ipv6 to be off, though it'd be nice to not do that, since someday, there will be an ipv6-only network that we'll have to deal with presumably. -- Jon Daley http://jon.limedaley.com ~~ For many people, one of the most frustrating aspects of life is not being to understand other people's behavior. We see them as "guilty" instead of "innocent." -- Unknown

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users