stunnel-users October 2017

stunnel-users@stunnel.org

11 participants
15 discussions

Re: [stunnel-users] Need some info
by Heinsbroek, Peter 09 Oct '17

09 Oct '17

I know. I have a module that reads and writes the pin encrypted from/into a disk file. Till stunnel 5.38 it worked via engine_pkcs and now I try to build it into stunnel. I works ,but the only thing now is where to store the pin after decrypting it. __________________ With regards Peter Heinsbroek Tel. +31 (0)88 265 9869 -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Malgorzata Olszówka Sent: Thursday, October 05, 2017 3:03 PM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Need some info W dniu 05.10.2017 o 14:39, Heinsbroek, Peter pisze: > How can I get the pin info from the config file entry “engineCtrl = > PIN:12345” into a variable in the ctx.c source With regards, Peter > Heinsbroek SQL & Unix Administrator Hello Peter, This is an example pin to the SoftHSM token. Regards, Malgorzata Olszowka _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, Atos’ liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. On all offers and agreements under which Atos Nederland B.V. supplies goods and/or services of whatever nature, the Terms of Delivery from Atos Nederland B.V. exclusively apply. The Terms of Delivery shall be promptly submitted to you on your request.

1 0

Professional support agreement
by alper erbakan 07 Oct '17

07 Oct '17

Hi, I am trying to find a company that willing to glve professional support for stunnel Windows version. I tried to reach from stunnel.org e-mail addresses is not working. Would you please help? Best regards iPhone'umdan gönderildi

2 1

Comments on daily DH Parameters regeneration...
by Taed Wynnell 06 Oct '17

06 Oct '17

We've been experiencing pain due to the daily STunnel regeneration of the DH Parameters. On our single-core machines in the field, this process will use 100% of the CPU for possibly an extended time. This interferes with other tasks that the machine is intended for. What's odd is that this process time ranges wildly, ranging from as low as 3 seconds to 90 minutes, even on the same machine. We see this behavior on all (thousands) of our machines, now that we know what to look for (the "Cron jobs completed in" trace in stunnel.log). We now know that we can set the DH Parameters in the configuration file, and that's what we'll be doing going forward. (Unless someone has another idea to offer.) I'd like to suggest some ideas for the future since I've seen on the mailing list that there are others who have run into this issue: * If the DH Parameter regeneration would run at Idle priority instead of Normal priority, it would not be nearly as noticeable, in that the CPU usage would still be there, but it wouldn't impact other services. The recomputation may be done in a separate thread, if so, this is straight-forward. * If there were a configuration file parameter to specify the regeneration interval. It would default to 24 hours (which is the current behavior), but could be set to a longer interval, a shorter interval for extreme security, or even to never. STunnel would still regenerate at the time of the service starting, unless a fixed DH is found in the configuration file. If a fixed DH were specified in the configuration file, that would avoid the service start computation and the interval would default to never. If both a fixed DH and the interval were specified in the configuration file, it would use the specified interval and recompute only after that interval.

1 0

Need some info
by Heinsbroek, Peter 05 Oct '17

05 Oct '17

How can I get the pin info from the config file entry “engineCtrl = PIN:12345” into a variable in the ctx.c source With regards, Peter Heinsbroek SQL & Unix Administrator Tel. +31 (0)88 265 9869 Mob. +31 6 5375 3244 Werner von Siemensstraat 3 2712 PN Zoetermeer, Nederland Org. unit B&PS-BTN/NL-TS-PS Central Unit 04 Email peter.heinsbroek(a)atos.net<mailto:peter.heinsbroek@atos.netm> Web www.nl.atos.net<UrlBlockedError.aspx> Atos IT Solutions and Services B.V. Comm. Register The Hague no. 27380688 This e-mail is intended exclusively for the addressee(s), and may not be forwarded or made available for use to any person other than the addressee(s). If you are not the intended recipient, please notify the sender thereof and destroy/delete the message. The sender disclaims any liability as regards (the content of) this e-mail. This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, Atos’ liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. On all offers and agreements under which Atos Nederland B.V. supplies goods and/or services of whatever nature, the Terms of Delivery from Atos Nederland B.V. exclusively apply. The Terms of Delivery shall be promptly submitted to you on your request.

1 0

Using Chrome directly as an STunnel Client to connect to an STunnel Server
by Dipen Doshi 05 Oct '17

05 Oct '17

Hello, I am new to STunnel and I am running into a problem. Here is my setup. I use an ASUS router with Merlin firmware. I have STunnel installed via Entware on this router. Running "stunnel -version" gives me: stunnel 5.41 on mipsel-openwrt-linux-gnu platform Compiled/running with OpenSSL 1.0.2k 26 Jan 2017 Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Global options: RNDbytes = 64 RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = HIGH:!DH:!aNULL:!SSLv2 (with "fips = no") curve = prime256v1 debug = daemon.notice logId = sequential options = NO_SSLv2 options = NO_SSLv3 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none ------------------------------------------------------------------------------------------- I use my own server certificate signed by my own CA. This cert has the proper SANs with correct DNS/IP entries. I use this server certificate both for my router's HTTPS web gui and for the "cert" and "key" files listed in the config file below. Also, the "CAfile" in the config is pointing to my Root CA's certificate. My Root CA is also imported in my Windows box's certificate store. I can directly access my router's web gui from LAN side via these ports: 80 (HTTP), 2000 (HTTPS). Router's LAN subnet is 10.49.49.0/24 and the router's WAN IP is 10.76.5.3 (it is double NAT for testing, this router is for testing) Also, STunnel is running as a server accepting connections on port 443 (all interfaces) on the router. ------------------------------------------------------------------------------------------- I want to use Chrome directly as an STunnel client on my Windows box. So, I don't run STunnel on my Windows box in the client mode. SITUATION 1: WORKS FINE!! -- PURPOSE: Use Chrome to connect to "https://WAN_IP:443" This should forward to the router's port 80 (HTTP protocol used). My STunnel config file on the router has: setuid = nobody setgid = nobody foreground foreground = yes syslog = yes debug = 7 [Test-Service] accept = 443 connect = 10.49.49.1:80 requireCert = yes verifyChain = yes CAfile = /mnt/Merlin/entware/etc/stunnel/ca.crt cert = /mnt/Merlin/entware/etc/stunnel/server.crt key = /mnt/Merlin/entware/etc/stunnel/server.key SITUATION 2: DOES NOT WORK!! -- PURPOSE: Use Chrome to connect to "https://WAN_IP:443" This should forward to the router's port 2000 (HTTPS protocol used). There is only one change from the Situation 1 config file. The line for "connect" changed to "connect = 10.49.49.1:2000) This does not work. Note that I can directly access my router's web gui over https with "https://LAN_IP:2000" via Chrome, with no warnings. ------------------------------------------------------------------------------ My thoughts: So, my current path is Chrome (Acting as STunnel Client) --> STunnel Server (on the router) --> Router's Web GUI. The "Chrome --> STunnel" Server connection is fine. Chrome prompts for private key and STunnel server correctly shows this incoming Chrome connection. The problem is the "STunnel Server --> Router" relay that uses HTTPS protocol. 1. STunnel does not like HTTPS to HTTPS relay. HTTP to HTTPS works, but not HTTPS to HTTPS. 2. STunnel server on my router is a client to my router's web gui. Is STunnel verifying the certificate of my router's HTTPS certificate? 3. If the above answer is yes, my guess is that STunnel sees a self signed certificate for this router and kills the connection? 4. How do I tell STunnel server to ignore certificate warnings for a remote connection, like when connecting to this router? 5. Or how do I explicitly tell STunnel to trust my Root CA while making this connection to my router? I couldn't find any options in STunnel for this. Regards, Dipen Doshi

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users October 2017