Hi Team,
I wish to use stunnel for following use-case (to create a highly-protected website which can be accessed only using a valid client-cert).
gateway.example.com:443 -> public.example.com:80 (when client-cert verification fails) gateway.example.com:443 -> intranet.example.com:80 (when client-cert verification ok - normally hidden from public)
As of now stunnel simply drops the connection when service is configured to verify the client certificate and verification fails. Is it possible to add a fall-back connect when verification fails.
[protected-web] verify=3 accept=443 connect=intranet.example.com:80 noverify=public.example.com:80
I guess it will be a nice addition to stunnel's feature list.
Thanks, Sudhaker
Sudhaker Raj wrote:
As of now stunnel simply drops the connection when service is configured to verify the client certificate and verification fails. Is it possible to add a fall-back connect when verification fails.
I don't think SSL protocol is able to resume failed negotiations.
Best regards, Mike
Roughly around 2008-05-07 15:34 -0400, Sudhaker Raj mentioned:
I wish to use stunnel for following use-case (to create a highly-protected website which can be accessed only using a valid client-cert).
gateway.example.com:443 -> public.example.com:80 (when client-cert verification fails) gateway.example.com:443 -> intranet.example.com:80 (when client-cert verification ok - normally hidden from public)
...
I guess it will be a nice addition to stunnel's feature list.
I disagree. I don't think it's a good idea to add to Stunnel.
This is application layer logic you want, essentially. Your best bet would be to use SSL in apache/webserver of choice directly. Then you can place the verification constraint in the configuration and configure the webserver to serve up selected pages if and only if a cert has been used via normal apache 'require' ACLs.
Alternatively this could be configured with apache as a reverse proxy using mod_proxy in front of two different back end webservers (public and intranet in your example above) if you really want distinct webservers for each.
Web was just an example. I agree that Apache is better place to do this.
What about running stunnel on port 443 which will look like HTTPS to world but it connects to VNC if a valid client-cert is presented. This way my VNC will be totally private and protected from *possible detection* & attack.
Technically it is very much possible and I've done it using Java APIs. It would be neat if stunnel can be modified to do the same. Any help in creating such patch will be much appreciated.
Thanks, Sudhaker
On Thu, May 8, 2008 at 3:53 PM, Brian Hatch bri@stunnel.org wrote:
Roughly around 2008-05-07 15:34 -0400, Sudhaker Raj mentioned:
I wish to use stunnel for following use-case (to create a highly-protected website which can be accessed only using a valid client-cert).
gateway.example.com:443 -> public.example.com:80 (when client-cert verification fails) gateway.example.com:443 -> intranet.example.com:80 (when client-cert verification ok - normally hidden from public)
...
I guess it will be a nice addition to stunnel's feature list.
I disagree. I don't think it's a good idea to add to Stunnel.
This is application layer logic you want, essentially. Your best bet would be to use SSL in apache/webserver of choice directly. Then you can place the verification constraint in the configuration and configure the webserver to serve up selected pages if and only if a cert has been used via normal apache 'require' ACLs.
Alternatively this could be configured with apache as a reverse proxy using mod_proxy in front of two different back end webservers (public and intranet in your example above) if you really want distinct webservers for each.
-- Brian Hatch "I think that we missed something. Systems and We should have called it 'Licensed Security Engineer Software Delivery', not 'Electronic.'" http://www.ifokr.org/bri/ --Bruce
Every message PGP signed
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux)
iD8DBQFII1o7VkMj8/ymYEsRAmKyAJ9IfSok2pZPkknbD5cRHZag+C2hIACeLQhh jYZwdCyQhKFk0a/twP/G8qQ= =b0uW -----END PGP SIGNATURE-----
-
Brian Hatch -
Michal Trojnara -
Sudhaker Raj