Questions tagged [stunnel]
Stunnel is a small tool that can wrap the connection of other protocols with SSL/TLS.
157
questions
17
votes
2
answers
27k
views
stunnel vpn traffic and ensure it looks like SSL traffic on port 443
I am trying to make my outgoing and incoming traffic look as legitimate as close to SSL traffic as possible. Is there a way to DPI my own traffic to ensure it looks like SSL traffic and not OpenVPN ...
- 3,941
17
votes
2
answers
8k
views
Connecting to MySQL securely - MySQL's SSL vs Stunnel vs SSH Tunneling
We have a PHP application which connects to a MySQL server, and we wish to secure connections between the web & application servers and the database.
At peak times, the web servers make many ...
- 305
15
votes
3
answers
14k
views
Protecting against POODLE SSL on stunnel
How can I mitigate POODLE SSL vulnerability when using stunnel as HTTPS reverse proxy?
- 948
13
votes
3
answers
12k
views
How do I ensure that stunnel sends all intermediate CA certs?
A few computers, but not most, are rejecting the SSL certificate from my webserver. The problem seems to be that some computers are rejecting the CA certs. The problem seems to be manifesting on Mac ...
- 133
10
votes
4
answers
10k
views
haproxy + stunnel + keep-alive?
I'd like to put stunnel in front of haproxy 1.4 to handle HTTPS traffic. I also need stunnel to add the X-Forwarded-For header. This can be achieved by the "stunnel-4.xx-xforwarded-for.diff" patches ...
- 4,262
10
votes
3
answers
66k
views
Stunnel won't work with SSLv3 from some hosts
WARNING: SSLv3 is obsolete. Consider disabling it altogether.
I'm trying to set up Stunnel to server as SSL cache. Everything was smooth, and mostly it works as designed.
Then I encountered errors ...
- 948
9
votes
2
answers
25k
views
Bug setting up stunnel server: `SSL3_GET_CLIENT_HELLO:wrong version number`
I'm setting up an stunnel server on Windows XP, and I get this bug when a client tries to access:
2013.02.14 00:02:16 LOG7[8848:7664]: Service [https] accepted (FD=320) from 107.20.36.147:56160
2013....
- 5,301
6
votes
2
answers
4k
views
HTTP to HTTPS local proxy that can do the HTTPS connection over a proxy
Here's the deal:
Our client software can only connect using http protocol, it can not do https.
However, security requirements dictate end-to-end security, so we need to use https when talking to the ...
- 485
5
votes
3
answers
8k
views
SSHD real-ip behind haproxy
I'm trying to setup an ssh over https connection using haproxy.
I'm currently looking for a way for SSHD to get the source ip from haproxy, similar to reading X-Forwarded-For or X-Real-IP headers.
...
- 917
5
votes
1
answer
2k
views
How does stunnel redirect traffic?
I am familiar with the stunnel.conf and I know how to specify which unencrypted ports it listens to and to which encrypted ports it redirects, but I would like to understand how it gets the power to "...
- 165
5
votes
3
answers
9k
views
Cannot find ssl libraries when configuring stunnel
I am using RHEL 5.6 and trying to install stunnel with the 'xforwardfor' patch from haproxy to get a setup similar to this (older) post: http://www.buro9.com/blog/2009/12/07/installing-haproxy-load-...
- 4,005
5
votes
2
answers
18k
views
Failed to start stunnel4 on Ubuntu 15.04
I get the following error starting stunnel4 service on Ubuntu 15.04:
root@scw-d91ec7:~# service stunnel4 start
Job for stunnel4.service failed. See "systemctl status stunnel4.service" and "journalctl ...
- 177
5
votes
1
answer
8k
views
Multiple SSL certs with Stunnel
I have purchased two PositiveSSL certs (seperately), one for manager.domain.com and another for domain.com. Originally I only needed manager.domain.com using SSL, but than I needed to use SSL on ...
- 475
5
votes
2
answers
8k
views
Unknown protocol when trying to connect to remote host with stunnel
I'm trying to set up a stunnel for WebDav on Windows. I want to connect 80 port on my local interface to 443 on another machine in my network. I can ping the machine remote machine. However when I use ...
- 171
4
votes
3
answers
10k
views
STunnel Not Reading Configuration File
I generated an SSL certificate as specified on the answer to stunnel: SSL-to-SSL? (for smtp/imap)
And have the following configuation file:
cert = /home/marshall/stunnels/certs/umistunnel.keys
; ...
4
votes
1
answer
3k
views
Does stunnel cache DNS?
I'm using stunnel in client mode to proxy between my Haproxy and a HTTPS backend server. I've read that Haproxy caches the resolved IPs on each config load, which isn't a problem in my current setup. ...
- 191
4
votes
4
answers
818
views
Is there an SSL equivelent to an ssh agent?
Here is my situation: There are a number of developers who all need to have access to be able to install ruby gems and python eggs from a remote source. Currently, we have a server inside our firewall ...
4
votes
1
answer
3k
views
stunnel: SSL-to-SSL? (for smtp/imap)
How can I configure stunnel to accpet SSL connections, and connect then to an SSL port on a different server?
Here is my setup:
Our ISP's server, "Mail Server", supports smtp/imap over SSL. (Not ...
- 1,109
4
votes
1
answer
3k
views
Stunnel with SNI: Section *name*: SNI section name not found
Im trying to use stunnel with 2 domains on the same IP.
My conf is this:
;key = /etc/ssl/private/namecheap/server.key
# See this link http://www.sysadminworld.com/2011/how-do-i-use-an-intermediate-...
- 141
4
votes
1
answer
6k
views
Is stunnel capable of working like ssh -R?
I have a machine running MySQL (Windows), on a private network (let's say 192.168.1.10), behind a masquerading gateway. No port forwarding to 192.168.1.10 is possible.
I also have a server with a ...
- 1,351
4
votes
2
answers
14k
views
stunnel: ssl3_get_record error when using TLS 1.2
I'm trying to use stunnel to be able to use HTTPS (port 443) on my localhost for a development web server running locally on port 8000.
It starts and accepts connections, but every time I open https:/...
- 181
4
votes
0
answers
1k
views
stunnel TIMEOUTconnect on Ubuntu 15.10
We use stunnel extensively for LDAP proxying. We recently set up a Ubuntu 15.10 server to migrate some of the tunnels to and are unable to get it to work.
We've scraped through the logs, configs, ...
- 41
4
votes
0
answers
3k
views
Confused about stunnel's TIMEOUTclose setting
I understand from the stunnel documentation and from what I read on the Internet that MS has a buggy implementation of SSL; it fails to send a close_notify thing. The solution, says the documentation, ...
- 2,626
3
votes
4
answers
4k
views
Pound + HAProxy or Stunnel + HAProxy
I'm looking at introducing a loadbalancer to my existing site infrastructure to help with traffic growth and provide a level of failure protection.
The site I am running uses SSL certificates for the ...
- 55
3
votes
3
answers
7k
views
Stunnel multiple ports through the same Port
I'm looking for some help regarding an stunnel configuration I'm working on. Basically I want to have a DMZ machine accept inbound connections to port 80 and 110, and then forward them through my ...
- 31
3
votes
3
answers
6k
views
reverse ssh tunnel over stunnel (or just reverse back down the stunnel connection)
I'm creating a security "dropbox" that can be deployed behind nat or any firewall, call out to a controlled publicly accessible server and then initiate control from the server.
I know this is easily ...
- 893
3
votes
2
answers
7k
views
Stunnel too many clients
I'm trying to hook up stunnel and haproxy to forward https connections through to some backend servers.
I've got haproxy setup right, and I seem to have stunnel set up right. Trouble is that when I ...
- 457
3
votes
1
answer
16k
views
How to log/see the traffic going through stunnel before/after encryption?
So I am using stunnel to talk to a SSL server. I would like to see the messages I am sending before they get encrypted and more importantly the messages I am receiving after they get decrypted.
I ...
- 131
3
votes
2
answers
12k
views
stunnel version 4.53 says SSL server needs a certificate on Windows 7
I have been using stunnel previous versions just fine. It didn't apparently have the feature of a certificate in SSL server mode. That's alright but not necessary for us as we're simply running a ...
- 428
3
votes
1
answer
1k
views
HAProxy and Stunnel PCI Compliance
I am setting up HAProxy to load balance between two web servers. Some of the pages on the site require SSL. Stunnel is handling the https connections and passing them off to haproxy (Stunnel ...
- 33
3
votes
1
answer
1k
views
Set up stunnel to wrap SSL for a single application
I am trying to use stunnel to get an older usenet client to support SSL. I tried the following config:
[myservice]
accept = <LOCAL_PORT>
connect = <REMOTE_HOST>:<REMOTE_PORT>
but ...
- 191
3
votes
1
answer
221
views
Is it necessary to use Stunnel while using Postfix with Amazon SES?
I have configured AWS SES with postfix to send emails. Is it necessary to use Stunnel while using Postfix 3.1.0 with AWS SES?
3
votes
1
answer
3k
views
Unable to create seemingly simple stunnel configuration
I have a computer at work that is behind a firewall with an internal ip address of 192.168.12.13... the firewall maps ports 40000 - 40019 to matching ports on this local machine. (e.g. 40000 - 40000, ...
- 33
3
votes
1
answer
4k
views
ldapsearch doesn't work wih ldap.google.com via stunnel
Can't get it working. I have to use stunnel to be able integrate Jenkins with Google LDAP service. It works fine without stunnel
$ LDAPTLS_CERT=/etc/stunnel/gldap.crt LDAPTLS_KEY=/etc/stunnel/gldap....
- 7,313
3
votes
1
answer
5k
views
Server closed connection error when checking if key exists in a redis cluster using stunnel
Using redis-cli command line utility with the -c switch to connect to a redis cluster with stunnel configured and running.
When I execute the EXISTS command to verify a key, as expected, it redirects ...
- 750
3
votes
0
answers
302
views
Why is the loopback device needed on a client side of Stunnel?
This SANS Institute guide states that
"On the client side, a port listening on the loopback interface of the
local system would send/receive data on the clear-text protocol and
tunnel out on ...
- 187
3
votes
2
answers
14k
views
why is stunnel doing this
I am trying to setup stunnel to encrypt traffic from rsyslog (using the relp protocol), but whenever I try starting stunnel and sending logs to the remote server, i get the following:
Remote ...
- 1,457
2
votes
2
answers
6k
views
SSH over HTTPS through haproxy
I'm trying to setup an ssh over https connection using haproxy. I haven't found any working examples, so any help would be appreciated!
client config;
~$ cat ~/.stunnel/stunnel.conf
pid=
client=yes
...
- 917
2
votes
2
answers
2k
views
DER encoded hash
according to the manpage of stunnel4
the certificates in this directory should be named XXXXXXXX.0 where XXXXXXXX is the hash value of the DER encoded subject of the cert (the first 4 bytes of the ...
- 1,872
2
votes
1
answer
2k
views
Using multiple SSL certificates with Stunnel
I have a HAProxy + stunnel setup, I would like to have different certificates for my domain and submdomain.
Certificate 1 - example.com
Certificate 2 - foo.example.com
How do I configure Stunnel to do ...
- 125
2
votes
2
answers
2k
views
Ubuntu: Compressed, but not encrypted, tunnel for TCP?
How can I set up a tunnel for TCP connections between two hosts so that I can test a few different compression algorithms?
I'm aware of stunnel & SSH, but want to avoid the overhead of encryption....
- 1,109
2
votes
3
answers
3k
views
Stunnel: ssl to ssl
I have a little service which listen only on https://localhost:41952 and checks source hostname (it must be localhost). I want to connect on "listen:1988" and redirect requests with stunnel to "...
- 377
2
votes
1
answer
5k
views
Stunnel and FIX
I am trying to use Stunnel to connect to a remote server through a proxy (I am using stunnel 4.56).
Here is my config file stunnel.conf:
cert = stunnel.pem
key = stunnel.pem
[https]
accept = 127.0....
- 71
2
votes
1
answer
1k
views
Will ssh tunnelling be a simpler way to solve my link encryption issue rather than stunnel?
We have an encryption issue from a vendors mid-tier to an Oracle database. We can use encrypted database connections and have done for 90% of cases.
Our security team has advised us that since this ...
- 2,739
2
votes
1
answer
11k
views
stunnel won't verify client certificate as expected
I'm trying to set up stunnel to provide a TLS wrapper to an HTTP service that doesn't natively support TLS. I have this working well without using TLS client certificates.
When adding the client ...
- 1,115
2
votes
1
answer
6k
views
Stunnel TLS authentication with multiple Authorities
I am trying to secure a rethinkdb cluster behind stunnel. The service needs to support multiple Certificate Authorities (CA). Currently I concat the accepted CAs into one file (/certs/ca.pem) but it ...
- 121
2
votes
2
answers
1k
views
Should I use an ssl terminator or just haproxy?
I'm trying to figure out how to set up my architecture for a socket.io app that will require both https and wss connections. I've found many tutorials on the web suggesting that you use something like ...
- 751
2
votes
2
answers
149
views
Replace Cisco 2600 PTP T1
Our office and an outside location have a dedicated T1 point to point connected with Cisco2600's. We need to eliminate the need of the T1 circuit as it is costly and would like to route the traffic ...
- 91
2
votes
1
answer
5k
views
stunnel Unable to Locate Log File
I have built an alpine linux docker container on 3.11.6 w/ NGINX, Node.js, and stunnel
When I go to load stunnel by calling stunnel inside of the running container I get that it cannot find the log ...
- 131
2
votes
1
answer
1k
views
Redis Cluster over stunnel configuration
I'm trying to set up a 3 node Redis Cluster that communicates over stunnel.
Redis listens on port 6379 (configurable) for client pub/sub and on the configured port+10000 (not configurable - it ...
- 21