- stunnel-users - stunnel.org

Feature request - verify fall-back
by Sudhaker Raj 09 May '08

09 May '08

Hi Team, I wish to use stunnel for following use-case (to create a highly-protected website which can be accessed only using a valid client-cert). gateway.example.com:443 -> public.example.com:80 (when client-cert verification fails) gateway.example.com:443 -> intranet.example.com:80 (when client-cert verification ok - normally hidden from public) As of now stunnel simply drops the connection when service is configured to verify the client certificate and verification fails. Is it possible to add a fall-back connect when verification fails. [protected-web] verify=3 accept=443 connect=intranet.example.com:80 noverify=public.example.com:80 I guess it will be a nice addition to stunnel's feature list. Thanks, Sudhaker

3 3

launch stunnel server daemon from php?
by Wesley Kenzie 06 May '08

06 May '08

I am having problems launching stunnel from a php "exec" command. I would like to have it launch as a server daemon and then have the exec command return control to the php script. The best I have been able to do is launch it in foreground with a command like "/usr/local/bin/stunnel /etc/stunnel/test.conf &" but control never returns to the php script. I do not want to use inetd mode, and would prefer to specify command line arguments, but I see they are no longer available in version 4. Any ideas? . . . . . Wesley Kenzie wkenzie(a)gmail.com

2 2

HTTPS connections aborted
by Matthias Kellermann 05 May '08

05 May '08

Hi list, I've set up a loadbalancer with haproxy and I'm using stunnel to have HTTPS on the loadbalancer. Every connection on port 443 is forwarded by stunnel to port 80 where haproxy listens. Some facts: FreeBSD 6.2 i386 stunnel 4.22 OpenSSL 0.9.7e-p1 gcc version 3.4.6 [FreeBSD] 20060305 Here is my stunnel.conf: sslVersion = all chroot = /var/tmp/stunnel setuid = stunnel setgid = nogroup pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 3 [https] cert = /usr/local/etc/stunnel/ssl/mycert.pem accept=localip:443 connect=localip:80 Some of my customers using HTTPS are claiming about aborted connections with MS Internet Explorer. They get a message about "secure and unsecure objects on this site, proceed?". When clicking yes they get a IE error message: "site not found". (Sorry, I don't know the exact english error message because customers use german version of IE). Of course there are only HTTPS objects on the page. In my logs I've lot of these entries: SSL_accept: Peer suddenly disconnected From time to time I'll get this error: SSL_read: Connection reset by peer (54) or: SSL_read: Operation timed out (60) or: SSL_write: Broken pipe (32) At the moment I have no idea where these errors come from and if they really belong to the error the customer gets with his IE browser. Any ideas what could cause these error messages? Thanks in advance, Matthias

2 1

Stunnel <=> p2p
by mluft 05 May '08

05 May '08

Hi, i just started working with stunnel, and i'm really impressed! But i've got 2 questions: * How is it realized, that a setup like this: accept = 15000 connect = 16000 also encrypts the reply of the app which listens on port 16000? Is there a kind of masquerading? * I think of a tool like tsocks or socksify: "tsocks application" redirects all traffic from application over an socks proxy. Is it possible to realize such a redirection with stunnel? So that all outgoing traffic of an application gets encrypted? I know that i can build point-to-point tunnels, but that's not possible for my scenario... Thanks & Cheers, Matthias

1 0

Stunnel 4.23 xforwardfor patch
by Rene Plattner 05 May '08

05 May '08

Dear stunnel users! I noticed that the xforwardfor patch does not work any more on version > 4.20! This is due an function renaming in stunnel! After adding xforwardfor patch for version 4.20 see options.c: Simply replace log_raw(...); to s_log(LOG_RAW,...); chears, -- Dipl.-Ing. Rene' Plattner Zentraler Informatikdienst (ZID) Universität Innsbruck, Österreich Technikerstr. 13 A-6020 Innsbruck Tel: ++43512/507-2360 Fax: ++43512/507-2944

1 0

Can stunnel be configured to listen for multiple IP addresses and access different email hosts?
by F Boyd Crow 04 May '08

04 May '08

I have attempted to use stunnel to retrieve POP3 SSL mail from two different ISPs: pop.att.yahoo.com and pop.gmail.com. I have tried putting in separate Access/Connect line pairs under [pop3s] either point to the different ports on 127.0.0.1 whch is an Exchange Server 2003 machine. I have tried pointing both to the same port. In either case, the first POP3 host is accessed but not the second. I have also tried one Access line and two separate connects. It works fine with one Access line and one Connect line but a previous post on this subject indicated I should be able to do retrievals from two separate sites and I do not see how. I am using the POP3 Connection Manager on Small Business Server 2003. I set the email server to 127.0.0.1 and use port 9995. The corresponding section of the stunnel.conf file is client = yes debug = 7 ; Service-level configuration [pop3s] accept = 9995 connect = pop.gmail.com:995 ;does not work with two separate pop3s, either with two separate accept ports or one common final comment is my own. Has anyone successfully accessed mail from two POP3 servers through stunnel or have any suggestions? Boyd

1 0

stunnel 4.23 released
by Michal Trojnara 04 May '08

04 May '08

Dear Users, I have just released a new version of stunnel. Please find below the ChangeLog entry: Version 4.23, 2008.05.03, urgency: HIGH: * Bugfixes - Local privilege escalation bug on Windows NT based systems fixed. A local user could exploit stunnel running as a service to gain localsystem privileges. Home page/download: http://stunnel.mirt.net/ sha1sum for stunnel-4.23.tar.gz file: d0fef8b518a44b9623692381a53680e0b4b01686 Best regards, Mike

1 0

Re: [stunnel-users] launch stunnel server daemon from php?
by Wesley Kenzie 03 May '08

03 May '08

No, that does not work either. I can get stunnel to start fine outside of php, but not as an exec or shell_exec from within a running script, or even from within php -a interactively. I can get other programs to work fine this way, so it is specific to the stunnel executable as best I can tell. I have tried running various forms of bash scripts too, but none do any better. Ideas? . . . . . Wesley On Fri, May 2, 2008 at 12:52 PM, Ludolf Holzheid < lholzheid(a)bihl-wiedemann.de> wrote: > On Fri, 2008-05-02 12:32:19 -0700, Wesley Kenzie wrote: > > Yes. Without this stunnel would not launch. With foreground = no and > with > > the trailing & on the command line I got it to launch, but still control > > will not return to my php script ... > > > > . . . . . > > Wesley > > > > On Fri, May 2, 2008 at 12:29 PM, Ludolf Holzheid < > > lholzheid(a)bihl-wiedemann.de> wrote: > > > > > On Fri, 2008-05-02 12:19:38 -0700, Wesley Kenzie wrote: > > > > I am having problems launching stunnel from a php "exec" command. I > > > would > > > > like to have it launch as a server daemon and then have the exec > command > > > > return control to the php script. > > > > > > Did you try to specify ``foreground = no'' in the configuration file? > > Wesley, > > I must confess that I don't know php and its `exec' command. There > must be something special about it. > > I would try to start a shell, which starts stunnel, which, in turn, > detaches itself to the background (i.e. something like "/bin/sh -c > '/usr/local/bin/stunnel /etc/stunnel/test.conf'"). So that the process > started by `exec' finishes and hopefully control returns to php. > > hth, > > Ludolf > > -- > > A: Because it messes up the order in which people normally read text. > Q: Why is top-posting such a bad thing? > A: Top-posting. > Q: What is the most annoying thing in e-mail? >

1 0

Re: [stunnel-users] launch stunnel server daemon from php?
by Wesley Kenzie 02 May '08

02 May '08

Yes. Without this stunnel would not launch. With foreground = no and with the trailing & on the command line I got it to launch, but still control will not return to my php script ... . . . . . Wesley On Fri, May 2, 2008 at 12:29 PM, Ludolf Holzheid < lholzheid(a)bihl-wiedemann.de> wrote: > On Fri, 2008-05-02 12:19:38 -0700, Wesley Kenzie wrote: > > I am having problems launching stunnel from a php "exec" command. I > would > > like to have it launch as a server daemon and then have the exec command > > return control to the php script. > > Did you try to specify ``foreground = no'' in the configuration file? > > Ludolf > > -- > > --------------------------------------------------------------- > Ludolf Holzheid Tel: +49 621 339960 > Bihl+Wiedemann GmbH Fax: +49 621 3392239 > Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de > D-68199 Mannheim, Germany > --------------------------------------------------------------- >

1 0

Verify=3 restart needed ?
by Edouard Dessioux 30 Apr '08

30 Apr '08

Hi everyone, Sorry for the repost, but in the web mailing list, my previous message appears weird, so I thought I could re-post it. I'm using stunnel v4.16 on a Windows 2003 Server, and I'm working with stunnel in verify=3 mode. I wanted to know if the stunnel needs to be restarted after a certificates has been removed ? If not, how long is the certificate considered valid after the file has been removed ? Regards, Edouard DESSIOUX Directeur de Projets Tibco Mobile 3, rue Danton - 92240 Malakoff Tél : +33 (0)1 55 58 04 59 - Fax : +33 (0)1 55 58 03 89 - Mob. +33 (0)6 34 02 61 54 E-mail : edessioux(a)tibco.fr - www.tibcomobile.fr Faites un geste pour la planète, n'imprimez ce message que si nécessaire.

3 3