stunnel-users

stunnel-users@stunnel.org

6 participants
3313 discussions

Mutual SSL Authentication
by Christopher Hunt 13 Aug '08

13 Aug '08

Hi there, Does stunnel have any in-built support for mutual SSL authentication? If not are there plans to incorporate support? Cheers, -C

2 1

question
by Ted Ehrlich 12 Aug '08

12 Aug '08

1 0

OSX 10.5 install?
by Renner, Christopher R 11 Aug '08

11 Aug '08

> >> Hi, >> >> New list member here. I¹m going through the archives now, and have Googled >> my way to exhaustion, looking for up-to-date instructions to install stunnel >> on a Mac desktop. >> >> I do PHP web application development and need to be able to connect to a NAS >> space via stunnel on my desktop dev environment in order to simulate the live >> environment. >> >> Does anyone 1) have a link to current OSX install instructions, or 2) care to >> share such instructions with me off the top of your head? >> >> I tried working through this darwinports page ( >> http://stunnel.darwinports.com/) but 1) it sends me to Macports.org for the >> .dmg file thereby installing macports and not darwinports....and after that >> the ³port² command is unrecognized in terminal when trying to install >> stunnel. >> >> >> Thanks. >>

2 1

Socket connection status
by Jeffrey Buck 08 Aug '08

08 Aug '08

Hi, I'm running stunnel 4.04 on ia64-redhat-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003. I have basically taken a generic TCP interface and implemented a STUNNEL client/server setup to allow the connection to transfer data using SSL. I have an issue with checking the status of the connection when a connection attempt is made. We are using ObjectSpace libraries for all of our tcp related connections so I don't have the low level calls that are actually being made, but here is a brief description of what is happenning.... We create an os_tcp_socket object and call the connect_to() method. This establishes a connection to the stunnel client on my local machine....which in turn makes the connection the the stunnel server on the remote machine. The problem I'm am having is when I can't get to the remote machine. After the connect_to() call, we check the status of the socket and unless I sleep for 5-10 seconds, it always seems to think that the connection is ok...which kind-of makes sense because it is able to connect to the stunnel client port since it is local...but in fact, if there isn't access to the remote machine, eventually stunnel will close that initial connection to that socket (that where the 5-10 second delay seems to help). The status I really want is weather or not the entire connection was successful through stunnel to the remote machine. Is there a better way to do this other than putting a sleep() in. Right now I have a 10 second sleep in between the connect_to() call and the status check on the local/client stunnel TCP port. That seems to be enough time for stunnel to attept to complete the connection and kill the connection to it's local/client port so that when I check the status of it, it comes back bad. If this is the best way to do it...what is the amount of time needed for stunnel to attempt to complete it's connection to the remote machine? Thanks! Jeff

2 3

Yahoo SSL
by Bernie Murciano 29 Jul '08

29 Jul '08

1 0

Re: [stunnel-users] help with stunnell
by Ludolf Holzheid 28 Jul '08

28 Jul '08

On Thu, 2008-07-24 23:37:22 -0700, vinodsreehari(a)yahoo.com wrote: > [..] > > I configured stnnel in one server as server mode ,for accepting > connection on 8070 ,and connect to 80 . It works only if i specify > https://ipaddress:8070 This is because the default port for https is 443. If you'd configure stunnel to accept on port 443, `https://ipaddress' would work. > I have configured one client server also to accept connection on 80 > and redirect to teh 8070 of server. I want to know that is that teh > way its working . If there is a stunnel instance on the client machine accepting connections on port 80 and connecting to the web server at the https port (default or not), a user could specify `http://localhost' to connect to the web server (and the traffic between the client machine and the server would be secured). > And is it possible to implement the same in a live enviroment ,in > which teh webserver will run on different port ,but users dont need > to specify the port number . Yes. As soon as the destination port for the 'first hop' of a redirected/tunneled connection is the default port for the protocol in question, there is no need to specify the port number. The port numbers of 'intermediate hops' are configuration options for the two stunnel instances (in this case), so the user dosn't have to care about them. HTH, Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Re: [stunnel-users] Wrong documentation
by Sandeep Kumar 25 Jul '08

25 Jul '08

On Thu, Jul 24, 2008 at 9:39 PM, Brian Hatch <bri(a)stunnel.org> wrote: > In the neigborhood of 2008-07-24 09:40 +0530, Sandeep Kumar mentioned: > > > Look at this page > http://www.stunnel.org/faq/stunnel.html#configuration_file > > In service level options section, under the explanation of "CRLpath" it > is > > said that all files in it should be of the form XXXXXXXX.0. But my > stunnnel > > setup worked only when i names as XXXXXXXX.r0 instead of XXXXXXXX.0. > > What version of openssl are you running? stunnel 4.15 with OpenSSL 0.9.8b > > > > -- > Brian Hatch "Have you asked Kirk if > Systems and he'd like the job?" > Security Engineer "You can't hide from me! > http://www.ifokr.org/bri/ I will find you. > > Every message PGP signed > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.2.1 (GNU/Linux) > > iD8DBQFIiKlFVkMj8/ymYEsRAmKxAJ9CTLp0Xi8n1VxdFup/kBUuZe6scwCfcvyu > WQG8BlfrUV8RcP31/ZUEbJk= > =EBgc > -----END PGP SIGNATURE----- > > -- Sandeep Kumar http://students.iiit.ac.in/~sandeep_kr

1 0

Help on configuring Stunnel
by Patel Dippen-CDP054 24 Jul '08

24 Jul '08

I downloaded the pre-compiled Windows version of Stunnel (stunnel-4.25-installer.exe). We need to deploy this on 2 machines A and B. The way it works is: - B connects to A - then A connects to B How should I configure Stunnel on machine A, since, in the first case A is the Server and in the 2nd scenario A becomes the Client. Questions on deploying Stunnel on machine A: - Can I run just 1 instance of Stunnel on machine A? It seems I cannot since I have to set the "client = yes" in the 2nd scenario - Do I need to run multiple instances, 1 running as the Server and the 2nd as the Client? Here is the config file I used on the machine A: **************************** cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [iPerfS] accept = 5010 connect = 127.0.0.1:5001 [iPerfS] accept = 5002 connect = 12.50.0.25:5020 **************************** Here is the config file I used on the machine B: **************************** cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [iPerfC] accept = 5001 connect = 12.50.0.26:5010 [iPerfS] accept = 5020 connect = 127.0.0.1:5002 **************************** Regards, Dippen

1 0

Stunnel 4.24 patch to allow stunnel to search for the OCSP responder within an X.509 certificate's AIA extension.
by Bruce Keats 24 Jul '08

24 Jul '08

Hi all, This patch also fixes a problem with stunnel accepting an "unknown" response as "good" and allows the connection to be setup. An OCSP responder can return one of three responses (good, revoked, unknown), however the code would accept "unknown" as good. This patch fixes that problem and treats an "unknown" response as a failure. Stunnel can query an OCSP responder to determine the revocation status of a certificate when stunnel is verifying the certificate. The code works great, however it is uses a preconfigured OCSP responder. The OCSP responder's IP/hostname is specified in the stunnel configuration file as a URI. I found this rather restrictive, so I added code to extract the OCSP responder's URI from the certificate. As per RFC 3280, one of the valid extensions for X.509 certificate is the Authority Information Access (AIA) where the "accessMethod" can be "is-ad-ocsp" to identify the OCSP responders location as per RFC2560. There can be more than one OCSP responder listed in the AIA because it is a sequence. Each location is queried in the order they appear within the certificate until either a "good" or "revoked" response is received. If an "known" response or a failure then the next OCSP responder is checked. If all OCSP responder queries result in failure then the validation also fails.. A new configuration option "OCSPaia" was added. If the "OCSPaia=yes" then the stunnel will look for the OCSP responder(s) within the certificate's AIA. The locally configured "OCSP=<url>" overrides the OCSPaia option. Bruce

1 0

Wrong documentation
by Sandeep Kumar 24 Jul '08

24 Jul '08

Look at this page http://www.stunnel.org/faq/stunnel.html#configuration_file In service level options section, under the explanation of "CRLpath" it is said that all files in it should be of the form XXXXXXXX.0. But my stunnnel setup worked only when i names as XXXXXXXX.r0 instead of XXXXXXXX.0. -- Sandeep Kumar http://students.iiit.ac.in/~sandeep_kr

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users