stunnel-users

stunnel-users@stunnel.org

6 participants
3294 discussions

help - SSL bandwidth overhead with using different ciphers
by Slim Ben Mahmoud 30 Jul '10

30 Jul '10

Dear SSL experts, In order to assess the performances of an adaptive security algorithm using SSL, I need to measure the network overhead induced by the establishment of SSL tunnels. The experiment aims to measure the bandwidth consumptions (or throughputs) when SSL tunnels are established using the different ciphers implemented in Stunnel (AES256-SHA or RC4-SHA for instance). Do you think that I have to expect a different throughput when I use different ciphers for every tunnels or the overhead is the pretty much the same? In fact, the first results show no difference between the throughputs no matter the cipher I use. I know that SSL overhead is traditionally measured in delay or latency because of the handshake phase (the encryption process time is negligible on the new CPUs) but this is not what i want to show. I hope that my request is enough clear, let me know if it is not the case. Best regards. --Slim

2 1

Proxy for content filtering
by Raj 29 Jul '10

29 Jul '10

Hi All I want to build a proxy server, which acts as man in the middle proxy. The main intention of application is to do content filtering, whether it is an http or https request. I want to block some specified URL. Can anybody tell me what is the best approach of doing this Thanks, Raj Rajmohan SK

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 72, Issue 2
by TONY WESTENHOFER 07 Jul '10

07 Jul '10

stunnel-users-request(a)mirt.net wrote: >Send stunnel-users mailing list submissions to > stunnel-users(a)mirt.net > >To subscribe or unsubscribe via the World Wide Web, visit > http://stunnel.mirt.net/mailman/listinfo/stunnel-users >or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)mirt.net > >You can reach the person managing the list at > stunnel-users-owner(a)mirt.net > >When replying, please edit your Subject line so it is more specific >than "Re: Contents of stunnel-users digest..." > > >Today's Topics: > > 1. Re: telnetd and tcp_wrappers (Spence, Thomas Civ 844 CS/SCOX) > 2. change openssl version with configure (Bhavna Jhunjhunwala) > > >---------------------------------------------------------------------- > >Message: 1 >Date: Tue, 6 Jul 2010 08:28:11 -0400 >From: "Spence, Thomas Civ 844 CS/SCOX" <Thomas.Spence(a)pentagon.af.mil> >Subject: Re: [stunnel-users] telnetd and tcp_wrappers >To: "stunnel-users(a)mirt.net" <stunnel-users(a)mirt.net> >Message-ID: > <751B1F405F4AFF4D907BD567538A83FB04FFE0B6DA(a)tequilasunrise.pentagon.ncr.ds.af.mil> > >Content-Type: text/plain; charset="us-ascii" > >2 guys did help me and still no luck... > >Anyone who tried this: > >[tssl] >accept = 992 >exec = /usr/sbin/telnetd > >Let me know... Reason why I am asking you because when I log off the server then stunnel's process stopped running but I want it keep running after logoff. Before I changed 'exec = /usr/sbin/telnetd', it was 'connect = 23' and the stunnel's process ran great and never stop running... Strange. > >I really need your help. Thanks. > >--------------- >Tom Spence >ABIDES SYSTEM SUPPORT >844th CS/SCOX > > > >------------------------------ > >Message: 2 >Date: Tue, 6 Jul 2010 17:41:42 -0400 >From: Bhavna Jhunjhunwala <bhavnaj(a)quantitativebrokers.com> >Subject: [stunnel-users] change openssl version with configure >To: stunnel-users(a)mirt.net >Message-ID: > <AANLkTikGWuO2XbF8-rtOTMyfeHVdeUV8TZGJvmYfKekB(a)mail.gmail.com> >Content-Type: text/plain; charset="iso-8859-1" > >Hi, > >I have stunnel version as below installed on Mac: > >s*tunnel 4.33 on i386-apple-darwin10.2.0 with OpenSSL 0.9.8k 25 Mar 2009* >*Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv6 Auth:LIBWRAP* >* * >*Global options* >*debug = daemon.notice* >*pid = /usr/local/var/run/stunnel/stunnel.pid* >*RNDbytes = 64* >*RNDfile = /dev/urandom* >*RNDoverwrite = yes* >* * >*Service-level options* >*cert = /usr/local/etc/stunnel/stunnel.pem* >*ciphers = ALL:!aNULL:!eNULL:!SSLv2* >*session = 300 seconds* >*stack = 65536 bytes* >*sslVersion = SSLv3 for client, all for server* >*TIMEOUTbusy = 300 seconds* >*TIMEOUTclose = 60 seconds* >*TIMEOUTconnect = 10 seconds* >*TIMEOUTidle = 43200 seconds* >*verify = none* > >I would like to upgrade the openssl version to 1.0.0a, so I do >./configure --with-ssl=dir >make >make install > >After make install i get below error: > >*make install* >*Making install in src* >*test -z "/usr/local/bin" || ../auto/install-sh -c -d "/usr/local/bin"* >* /bin/sh ../libtool --mode=install /usr/bin/install -c 'stunnel' >'/usr/local/bin/stunnel'* >*/usr/bin/install -c stunnel /usr/local/bin/stunnel* >*test -z "/usr/local/bin" || ../auto/install-sh -c -d "/usr/local/bin"* >* /usr/bin/install -c 'stunnel3' '/usr/local/bin/stunnel3'* >*test -z "/usr/local/lib/stunnel" || ../auto/install-sh -c -d >"/usr/local/lib/stunnel"* >* /bin/sh ../libtool --mode=install /usr/bin/install -c 'libstunnel.la' >'/usr/local/lib/stunnel/libstunnel.la'* >*/usr/bin/install -c .libs/libstunnel.dylib >/usr/local/lib/stunnel/libstunnel.dylib* >*/usr/bin/install -c .libs/libstunnel.lai /usr/local/lib/stunnel/ >libstunnel.la* >*----------------------------------------------------------------------* >*Libraries have been installed in:* >* /usr/local/lib/stunnel* >* >* >*If you ever happen to want to link against installed libraries* >*in a given directory, LIBDIR, you must either use libtool, and* >*specify the full pathname of the library, or use the `-LLIBDIR'* >*flag during linking and do at least one of the following:* >* - add LIBDIR to the `DYLD_LIBRARY_PATH' environment variable* >* during execution* >* >* >*See any operating system documentation about shared libraries for* >*more information, such as the ld(1) and ld.so(8) manual pages.* >*----------------------------------------------------------------------* >*make[2]: Nothing to be done for `install-data-am'.* >*Making install in doc* >*make[2]: Nothing to be done for `install-exec-am'.* >*test -z "/usr/local/share/doc/stunnel" || ../auto/install-sh -c -d >"/usr/local/share/doc/stunnel"* >* /usr/bin/install -c -m 644 'stunnel.html' >'/usr/local/share/doc/stunnel/stunnel.html'* >* /usr/bin/install -c -m 644 'stunnel.pl.html' >'/usr/local/share/doc/stunnel/stunnel.pl.html'* >* /usr/bin/install -c -m 644 'stunnel.fr.html' >'/usr/local/share/doc/stunnel/stunnel.fr.html'* >*test -z "/usr/local/share/man/man8" || ../auto/install-sh -c -d >"/usr/local/share/man/man8"* >*mkdir: /usr/local/share/man/man8: Permission denied* >*make[2]: *** [install-man8] Error 1* >*make[1]: *** [install-am] Error 2* > > > >and when I check the stunnel version it still uses the old ssl version. >Am I doing something wrong here? > >-- >Thanks, >Bhavna >Quantitative Brokers >646 293 1808 > > >DISCLAIMER: >This e-mail and any attachments are for the confidential use of the >intended recipient. If you are not the intended recipient of this >message you are hereby notified that any review, dissemination, >distribution or copying of this message is strictly prohibited. This >communication is for information purposes only and should not be >regarded as an offer to sell or as a solicitation of an offer to buy >any investment product, an official confirmation of any transaction >or an official statement of Quantitative Brokers, LLC. > >E-mail transmissions cannot be guaranteed to be secure or error-free. >Therefore, we do not represent that this information is complete or >accurate and it should not be relied upon as such. > >All information is subject to change without notice. >Quantitative Brokers may, at its discretion, monitor and review the >content of all e-mail communications. >

1 0

problem with "verify=0"
by wujot＠home.pl 07 Jul '10

07 Jul '10

Hello everybody, The basic SSL negotiation requires the exchange of nine SSL messages. If client authentication is required, server can send additional message "certificate request". But this message is optional. I'm using stunnel ver. 4.27 for Win and 4.28 for Linux. In both cases stunnel, working as server, is sending "certificate request" message to the client, regardless of "verify" state, even with "verify=0". When "verify=0", server doesn't care about client's certificate. So, what for server sends this message? The part of my configuration and log is bellow: [test] accept = 60000 connect = 192.168.3.15:4679 client = no ;verify = 0 verify = none ciphers=DES-CBC3-SHA session = 3600 2010.07.07 12:53:35 LOG7[2412:4280]: SSL state (accept): before/accept initialization 2010.07.07 12:53:35 LOG7[2412:4280]: SSL state (accept): SSLv3 read client hello A 2010.07.07 12:53:35 LOG7[2412:4280]: SSL state (accept): SSLv3 write server hello A 2010.07.07 12:53:35 LOG7[2412:4280]: SSL state (accept): SSLv3 write certificate A 2010.07.07 12:53:35 LOG7[2412:4280]: SSL state (accept): SSLv3 write certificate request A <-------------???!!! 2010.07.07 12:53:35 LOG7[2412:4280]: SSL state (accept): SSLv3 flush data 2010.07.07 12:53:42 LOG6[2412:4280]: VERIFY IGNORE: depth=1, /C= .............. 2010.07.07 12:53:42 LOG5[2412:4280]: CRL: verification passed 2010.07.07 12:53:42 LOG5[2412:4280]: VERIFY OK: depth=1, /C= .......... 2010.07.07 12:53:42 LOG6[2412:4280]: VERIFY IGNORE: depth=0, /C= ................ 2010.07.07 12:53:42 LOG5[2412:4280]: CRL: verification passed 2010.07.07 12:53:42 LOG5[2412:4280]: VERIFY OK: depth=0, /C= .......................... 2010.07.07 12:53:42 LOG7[2412:4280]: SSL state (accept): SSLv3 read client certificate A 2010.07.07 12:53:42 LOG7[2412:4280]: SSL state (accept): SSLv3 read client key exchange a 2010.07.07 12:53:42 LOG7[2412:4280]: SSL state (accept): SSLv3 read certificate verify A 2010.07.07 12:53:42 LOG7[2412:4280]: SSL state (accept): SSLv3 read finished A 2010.07.07 12:53:42 LOG7[2412:4280]: SSL state (accept): SSLv3 write change cipher spec A 2010.07.07 12:53:42 LOG7[2412:4280]: SSL state (accept): SSLv3 write finished A So, my question is: how to remove "certificate request" message from stunnel-as-server negotiation? Regards, Wojtek

1 0

change openssl version with configure
by Bhavna Jhunjhunwala 06 Jul '10

06 Jul '10

Hi, I have stunnel version as below installed on Mac: s*tunnel 4.33 on i386-apple-darwin10.2.0 with OpenSSL 0.9.8k 25 Mar 2009* *Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv6 Auth:LIBWRAP* * * *Global options* *debug = daemon.notice* *pid = /usr/local/var/run/stunnel/stunnel.pid* *RNDbytes = 64* *RNDfile = /dev/urandom* *RNDoverwrite = yes* * * *Service-level options* *cert = /usr/local/etc/stunnel/stunnel.pem* *ciphers = ALL:!aNULL:!eNULL:!SSLv2* *session = 300 seconds* *stack = 65536 bytes* *sslVersion = SSLv3 for client, all for server* *TIMEOUTbusy = 300 seconds* *TIMEOUTclose = 60 seconds* *TIMEOUTconnect = 10 seconds* *TIMEOUTidle = 43200 seconds* *verify = none* I would like to upgrade the openssl version to 1.0.0a, so I do ./configure --with-ssl=dir make make install After make install i get below error: *make install* *Making install in src* *test -z "/usr/local/bin" || ../auto/install-sh -c -d "/usr/local/bin"* * /bin/sh ../libtool --mode=install /usr/bin/install -c 'stunnel' '/usr/local/bin/stunnel'* */usr/bin/install -c stunnel /usr/local/bin/stunnel* *test -z "/usr/local/bin" || ../auto/install-sh -c -d "/usr/local/bin"* * /usr/bin/install -c 'stunnel3' '/usr/local/bin/stunnel3'* *test -z "/usr/local/lib/stunnel" || ../auto/install-sh -c -d "/usr/local/lib/stunnel"* * /bin/sh ../libtool --mode=install /usr/bin/install -c 'libstunnel.la' '/usr/local/lib/stunnel/libstunnel.la'* */usr/bin/install -c .libs/libstunnel.dylib /usr/local/lib/stunnel/libstunnel.dylib* */usr/bin/install -c .libs/libstunnel.lai /usr/local/lib/stunnel/ libstunnel.la* *----------------------------------------------------------------------* *Libraries have been installed in:* * /usr/local/lib/stunnel* * * *If you ever happen to want to link against installed libraries* *in a given directory, LIBDIR, you must either use libtool, and* *specify the full pathname of the library, or use the `-LLIBDIR'* *flag during linking and do at least one of the following:* * - add LIBDIR to the `DYLD_LIBRARY_PATH' environment variable* * during execution* * * *See any operating system documentation about shared libraries for* *more information, such as the ld(1) and ld.so(8) manual pages.* *----------------------------------------------------------------------* *make[2]: Nothing to be done for `install-data-am'.* *Making install in doc* *make[2]: Nothing to be done for `install-exec-am'.* *test -z "/usr/local/share/doc/stunnel" || ../auto/install-sh -c -d "/usr/local/share/doc/stunnel"* * /usr/bin/install -c -m 644 'stunnel.html' '/usr/local/share/doc/stunnel/stunnel.html'* * /usr/bin/install -c -m 644 'stunnel.pl.html' '/usr/local/share/doc/stunnel/stunnel.pl.html'* * /usr/bin/install -c -m 644 'stunnel.fr.html' '/usr/local/share/doc/stunnel/stunnel.fr.html'* *test -z "/usr/local/share/man/man8" || ../auto/install-sh -c -d "/usr/local/share/man/man8"* *mkdir: /usr/local/share/man/man8: Permission denied* *make[2]: *** [install-man8] Error 1* *make[1]: *** [install-am] Error 2* and when I check the stunnel version it still uses the old ssl version. Am I doing something wrong here? -- Thanks, Bhavna Quantitative Brokers 646 293 1808 DISCLAIMER: This e-mail and any attachments are for the confidential use of the intended recipient. If you are not the intended recipient of this message you are hereby notified that any review, dissemination, distribution or copying of this message is strictly prohibited. This communication is for information purposes only and should not be regarded as an offer to sell or as a solicitation of an offer to buy any investment product, an official confirmation of any transaction or an official statement of Quantitative Brokers, LLC. E-mail transmissions cannot be guaranteed to be secure or error-free. Therefore, we do not represent that this information is complete or accurate and it should not be relied upon as such. All information is subject to change without notice. Quantitative Brokers may, at its discretion, monitor and review the content of all e-mail communications.

1 0

Re: [stunnel-users] telnetd and tcp_wrappers
by Spence, Thomas Civ 844 CS/SCOX 06 Jul '10

06 Jul '10

2 guys did help me and still no luck... Anyone who tried this: [tssl] accept = 992 exec = /usr/sbin/telnetd Let me know... Reason why I am asking you because when I log off the server then stunnel's process stopped running but I want it keep running after logoff. Before I changed 'exec = /usr/sbin/telnetd', it was 'connect = 23' and the stunnel's process ran great and never stop running... Strange. I really need your help. Thanks. --------------- Tom Spence ABIDES SYSTEM SUPPORT 844th CS/SCOX

1 0

Re: [stunnel-users] telnetd and tcp_wrappers
by Spence, Thomas Civ 844 CS/SCOX 02 Jul '10

02 Jul '10

Hi Again, I tried: [tssl] accept = 992 exec = /usr/sbin/telnetd It works. When I log into the server with no problem. When I am ready to log off then the process stopped running??? How can it stays running in process (/usr/local/bin/stunnel)? Thanks. Tom -----Original Message----- From: Spence, Thomas Civ 844 CS/SCOX Sent: Thursday, July 01, 2010 11:53 AM To: 'stunnel-users(a)mirt.net' Subject: telnetd and tcp_wrappers Hi all.. They requested us to turn off the telnetd from inetd.conf and not allowing to use tcp_wrappers... We are still using stunnel 4.33... We can't connect our server from PC with PowerTerm WebConnect because telnetd is off. Is there any way for all users to connect the server by using PowerTerm WebConnect? stunnel.conf: [tssl] accept = 992 connect = 23 (can't use telnet port) I know I can't use "connect = 22" because it doesn't work. Any idea? I really need your help... --------------- Tom Spence

2 1

telnetd and tcp_wrappers
by Spence, Thomas Civ 844 CS/SCOX 01 Jul '10

01 Jul '10

Hi all.. They requested us to turn off the telnetd from inetd.conf and not allowing to use tcp_wrappers... We are still using stunnel 4.33... We can't connect our server from PC with PowerTerm WebConnect because telnetd is off. Is there any way for all users to connect the server by using PowerTerm WebConnect? stunnel.conf: [tssl] accept = 992 connect = 23 (can't use telnet port) I know I can't use "connect = 22" because it doesn't work. Any idea? I really need your help... --------------- Tom Spence

1 0

Re: [stunnel-users] Connecting to stunnel with SQLServer
by Mohit Anchlia 30 Jun '10

30 Jun '10

Has anyone else tried using Java SSL or anything using Java that will not require stunnel on the client side? On Fri, Jun 25, 2010 at 12:13 PM, Carter Browne <cbrowne(a)cbcs-usa.com> wrote: > On 6/24/2010 11:00 PM, Mohit Anchlia wrote: >> On Thu, Jun 24, 2010 at 10:27 AM, Carter Browne <cbrowne(a)cbcs-usa.com> wrote: >> >>> On 6/24/2010 12:09 PM, Mohit Anchlia wrote: >>> >>>> On Thu, Jun 24, 2010 at 5:14 AM, Carter Browne <cbrowne(a)cbcs-usa.com> wrote: >>>> >>>> >>>>> It is very easy to do if you have stunnel running on both ends. On the >>>>> client side in the configuration file you could have: >>>>> >>>>> [MSSQL-OUT] >>>>> accept = localhost:1433 >>>>> connect = remote:20000 >>>>> client = yes >>>>> >>>>> >>>> Thanks. So if I have stunnel running on both ends how do I connect to >>>> SQL server? Just open a JDBC connection on the local port and it will >>>> automatically connect on the remote side? >>>> >>>> >>> In this example, I would define an alias using the configuration manager >>> giving it your name for the data base, and having it connect to port >>> 1433 on localhost. For my systems, >>> I usually use a dummy name defined in the 127.0.0.0/8 net and some port >>> other than 1433. This approach does require stunnel on both ends. I >>> haven't tried any other approaches. >>> MS SQL server does have some options for encrypting the traffic as well >>> - I did not think they would work for my mixed Linux/Windows >>> environment, but it might work for your environment. >>> >>> >>> >>>> Also, are there any other options? We have 20 servers from which we >>>> need to connect. I was trying to avoid install of another binary and >>>> relying on it for being up and running. Is it possible to use Java >>>> SSL? Or is that too complicated and not proven to work? Not sure if >>>> there is any other option. >>>> >>>> >>>> >>>>> on the remote side have: >>>>> >>>>> [MSSQL-IN] >>>>> accept = 20000 >>>>> connect = 1433 >>>>> client = no >>>>> >>>>> In this example port 20000 would have to be open to any firewalls >>>>> including the Windows firewall and assumes you are using the standard >>>>> MSSQL port on the server. >>>>> >>>>> You would probably want to use the SQL Server Configuration Manager on >>>>> the client computer to add an alias for your data base. >>>>> >>>>> >> Our client will be on Linux box. I am trying to understand if I am >> using JDBC the connection URL is something like: >> >> jdbc:sqlserver://[serverName[\instanceName][:portNumber]][;property=value[;property=value]] >> >> So if I use stunnel on both sides then how will this work? What will I >> give in my connection string? >> > > I don't have a Java DB connection, so I cannot speak from experience. > For both the Windows and the Linux ODBC drivers, using the example above > the server name would be > localhost:1433. The Instance name and any properties that you send > would not change. Again, using the values in the example, stunnel is > simply mapping localhost:1433 to remote:1433. > > Carter >> >>>>> Carter >>>>> >>>>> Carter Browne >>>>> CBCS >>>>> cbrowne(a)cbcs-usa.com >>>>> 781-721-2890 >>>>> >>>>> >>>>> On 6/23/2010 11:32 PM, Mohit Anchlia wrote: >>>>> >>>>> >>>>>> We have a requirement to connect to a SQLServer that is connected >>>>>> through stunnel on the other end. Can I use java SSL to talk to >>>>>> stunnel? What are my options? >>>>>> _______________________________________________ >>>>>> stunnel-users mailing list >>>>>> stunnel-users(a)mirt.net >>>>>> http://stunnel.mirt.net/mailman/listinfo/stunnel-users >>>>>> >>>>>> >>>>>> >>>>>> >>>>> >>>> >>> >> >

1 1

stunnel question and behaviour
by eni-urgence 25 Jun '10

25 Jun '10

Hello all. I want to use stunnel as ssl terminatation for https and pass httpd request to haproxy. I have compiled stunnel (source http://www.stunnel.org/download/stunnel/src/stunnel-4.32.tar.gz ) and apply this patch http://haproxy.1wt.eu/download/patches/stunnel-4.32-xforwarded-for.diff. I have placed the binary in /usr/local/bin . I want to use the heartbeat capabilities and start stunnel only if VIP is on the node. In order to make that, the init script of stunnel must be LSB compatible like said http://www.linux-ha.org/LSBResourceAgent. When i made a /etc/init.d/stunnel stop then a /etc/init.d/stunnel start, the service wont start . in order to reproduce make a //etc/init.d/stunnel start/ /ps -ef/ said stunnel 30301 1 0 13:21 pts/2 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf stunnel 30302 1 0 13:21 pts/2 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf stunnel 30303 1 0 13:21 pts/2 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf stunnel 30304 1 0 13:21 pts/2 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf stunnel 30305 1 0 13:21 pts/2 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf stunnel 30306 1 0 13:21 ? 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf Is it normal there is many process of stunnel ? And only the last pid process with ? in place of pts/2 is on the pid file. //etc/init.d/stunnel stop/ /ps -ef /said /stunnel 30306 1 0 13:21 ? 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf/ /and / //etc/init.d/stunnel start/ / DÃ©marrage de stunnel :Reading configuration from file /etc/stunnel/stunnel.conf FIPS mode disabled RAND_status claims sufficient entropy for the PRNG PRNG seeded successfully Certificate: /path_to_mycrt Certificate loaded Key file: /path_to_my_key Private key loaded SSL context initialized for servicemy_domaine_name Configuration successful No limit detected for the number of clients FD=9 in non-blocking mode FD=10 in non-blocking mode FD=11 in non-blocking mode Option SO_REUSEADDR set on accept socket Error binding secure.scan-prod.com to 192.168.100.156:443 bind: Address already in use (98)/ return code 1 after stop there is a remaining stunnel process. It appears that this process is the one which the pid had been added to pidfile a /file /usr/local/bin/stunnel /said //usr/local/bin/stunnel: ELF 64-bit LSB executable, AMD x86-64, version 1 (SYSV), for GNU/Linux 2.6.9, dynamically linked (uses shared libs), for GNU/Linux 2.6.9, stripped/ /usr/local/bin/stunnel -version said /stunnel 4.32 on x86_64-unknown-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008/ /Threading:PTHREAD SSL:ENGINE,FIPS Sockets:POLL,IPv6 Auth:LIBWRAP/ /Global options/ /debug = daemon.notice/ /pid = /usr/local/var/run/stunnel/stunnel.pid/ /RNDbytes = 64/ /RNDfile = /dev/urandom/ /RNDoverwrite = yes/ /Service-level options/ /cert = /usr/local/etc/stunnel/stunnel.pem/ /ciphers = FIPS/ /session = 300 seconds/ /stack = 65536 bytes/ /sslVersion = TLSv1/ /TIMEOUTbusy = 300 seconds/ /TIMEOUTclose = 60 seconds/ /TIMEOUTconnect = 10 seconds/ /TIMEOUTidle = 43200 seconds/ /verify = none/ my stunnel.conf is like that /; Protocol version (all, SSLv2, SSLv3, TLSv1)/ /sslVersion = all/ /setuid = stunnel/ /setgid = stunnel/ /chroot = /var/chroot/stunnel/ /pid = /var/run/stunnel.pid/ /output = /var/log/stunnel.log/ /debug = 5/ /fips = no/ /socket=l:TCP_NODELAY=1/ /socket=r:TCP_NODELAY=1/ /[my_domain]/ /key = /path_to_my_key/ /cert = /path_to_mycrt/ /accept = 192.168.100.156:443/ /connect = 192.168.100.156:10443/ /xforwardedfor = yes/ /TIMEOUTclose = 0 Thanks for your help /

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users