Re: stunnel-ed httpd

> [email protected]:

> A correct run file is
> 
> #!/bin/sh
> exec 2>&1
> exec envuidgid root softlimit -o20 -d50000 tcpserver -vDRHl0 -b50 -c100 0 443 stunnel -f -l /usr/local/publicfile/bin/httpd  -- httpds /publics/file

the idea of using stunnel in itself works, even without an unpatched httpd,
unless browsers specify the https:// scheme, i presume.

there's one important problem, though, i don't want other people to run
into, at least on the freebsd-4.x platforms using "cc -pthread ...". 
unless you raise the memory softlimit much higher with "softlimit -d350000
..." you will get a non-obvious error:

"Fatal error 'Unable to install alternate signal stack' at line ?  in file
/usr/src/lib/libc_r/uthread/uthread_init.c"

it can also be:

"SSL_accept:  error :1409C021:SSL routines:SSL3_SETUP_BUFFERS:Malloc
failure"

also, if you can't memorize the current working directory with this setup,
you may spend some time copying around the certificate.  using the -p flag
to stunnel explicitly telling it where to look will help.

the run file in my working test setup looks like this:

#!/bin/sh
# $Header$
exec 2>&1
exec envuidgid http \
softlimit -o20 -d450000 \
tcpserver -pX -x /etc/tcprules/tcp.http.cdb \
-vDrhl0 -b5 -c11 0 443 \
stunnel -f \
-D 6 \
-p /var/pub/pub1/stunnel.pem \
-l /var/pub/bin/httpd \
-- httpds \
/var/pub/pub1/file

clemens fischer