Re: stunnel-users Digest, Vol 181, Issue 3
Brent Kimberley <[email protected]> Thu, 22 Aug 2019 14:29:20 +0000 (UTC)
| Newsgroups | gmane.network.stunnel.user |
|---|---|
| Message-ID | <[email protected]> |
--===============0441214585543148772== Content-Type: multipart/alternative; boundary="----=_Part_548810_176365299.1566484160894" ------=_Part_548810_176365299.1566484160894 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable >>there is no reason to connect to localhost with any security Should server/interface consolidation trigger functional/technical rework p= rior to go live? As per the diagram:=C2=A0=C2=A0 =C2=A0the=C2=A0app server node x TLS engine= node interface is wrapped in SSL=C2=A0=C2=A0 =C2=A0the internal localhost = x localhost interface is in the clear =C2=A0 =C2=A0the TLS engine node x punchout-vendor node is wrapped in TLSv1= .2 >> SNI flag=C2=A0 (RFC 3546)Good catch.=C2=A0 ---------------------------------------------------------------------- Message: 1 Date: Wed, 21 Aug 2019 08:01:08 -0700 From: "Eric Eberhard" <[email protected]> To: "'Brent Kimberley'" <[email protected]>, =C2=A0=C2=A0=C2=A0 <[email protected]> Thank you -- what I had in mind but I am not that fancy with the setups as = we use one.=C2=A0 We go from our application in clear text to stunnel TLSv1= .2 which is clearly easier.=C2=A0 I did make this work for a short while a = long time ago and did not save the files.=C2=A0 Plus no may people's horror= we use inetd.=C2=A0 Of course we only transfer 4 million XML docs per day = and handle 10 million Web calls and another million connections for credit = cards, etc.=C2=A0 I have been told that if I had serious volume inetd is sl= ower -:) but I have not noticed enough of a slowdown to matter.=C2=A0 And i= netd (at least on an IBM AIX server) is dead reliable and easy. As a curiosity -- as I often see people coding unnecessarily -- there is no= reason to connect to localhost with any security at all unless your app ca= n only output SSLv3 which would imply a 3rd party vendor.=C2=A0 The traffic= never hits the network in any way -- not even the network card -- it goes = directly to/from the TCP/IP stack which is why I mentioned just making the = app send clear text to one stunnel that outputs TLSv1.2 ... if possible (ma= y not be if it is something you don't have source to). Eric -----Original Message----- From: Brent Kimberley [mailto:[email protected]]=20 Sent: Tuesday, August 20, 2019 6:42 AM To: [email protected] Cc: [email protected]; [email protected] Subject: Re: stunnel-users Digest, Vol 181, Issue 1 Your mileage may vary. ##########################################################################= ##### # From internal application to external host ##############################= ################################################# # [Int_Init] -> [Int_Term] -> [Ext_Init] -> [Ext_Term] ####################= ########################################################### # [internal_initiator]=C2=A0 ---ssl--->=C2=A0 [Internal terminator] # [Inte= rnal terminator] ---http---> [external Initiator] # [external Initiator]=C2= =A0 ---tls--->=C2=A0 [external terminator] ################################= ############################################### # https://www.stunnel.org/static/stunnel.html #############################= ##################################################=20 [Internal_Terminator] options =3D SSLv3 client =3D no accept =3D host_ip:443 connect =3D localhost:54321 CAfile=C2=A0 =C2=A0 =C2=A0 =C2=A0 =3D int_init_wallet.pem cert=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =3D=C2=A0 int_term_pub.pem key=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =3D=C2=A0 int_term_priv.pem [External_Initiator] options =3D SINGLE_ECDH_USE options =3D SINGLE_DH_USE ciphers =3D ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256 verify =3D 3? client =3D yes options =3D TLSv1.2 accept =3D localhost:54321 connect =3D externalhostname:443 verifyChain=C2=A0 =C2=A0 =3D yes renegotiation=C2=A0 =3D no CAfile=C2=A0 =C2=A0 =C2=A0 =C2=A0 =3D=C2=A0 ext_term_wallet.pem cert=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =3D ext_init_pub.pem key=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =3D=C2=A0 ext_init_priv.pem ---------------------------------------------------------------------- Date: Mon, 19 Aug 2019 18:21:18 +0000 From: Daniel Trickett <[email protected]> To: "[email protected]" <[email protected]> Subject: [stunnel-users] https to https proxy Hi, Our punchout vendor switched their site to only accept tls 1.2 over the wee= kend. Unfortunately our application will only support SSL. We are using stunnel with other vendors but can control the inbound host na= me. This recent one is one we can't manage as it is the software provider. I found a solution for doing https to https. I'm unclear how I get the firs= t https traffic to route to stunnel as the initial call will be from the ap= plication will be to the external host.. Any thoughts on whether this would work for my situation?=C2=A0 Appreciate = any thoughts.. [Tunnel_in] client =3D yes accept =3D host_ip:443 connect =3D localhost:54321 [Tunnel_out] client =3D no accept =3D localhost:54321 connect =3D externalhostname:443 Best regards, Dan =20 ------=_Part_548810_176365299.1566484160894 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <html><head></head><body><div class=3D"ydp5537b522yahoo-style-wrap" style= =3D"font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:16px= ;"><div></div> <div dir=3D"ltr" data-setdir=3D"false">>><span><span style=3D= "color: rgb(38, 40, 42); font-family: Helvetica Neue, Helvetica, Arial, san= s-serif;">there is no reason to connect to localhost with any security</spa= n></span></div><div dir=3D"ltr" data-setdir=3D"false"><span><span style=3D"= color: rgb(0, 0, 0); font-family: Helvetica Neue, Helvetica, Arial, sans-se= rif; font-size: 16px;"><br></span></span></div><div dir=3D"ltr" data-setdir= =3D"false"><span><span style=3D"color: rgb(0, 0, 0); font-family: Helvetica= Neue, Helvetica, Arial, sans-serif; font-size: 16px;">Should server/interf= ace consolidation trigger functional/technical rework prior to go live?</sp= an></span><br></div><div dir=3D"ltr" data-setdir=3D"false"><br></div><div d= ir=3D"ltr" data-setdir=3D"false"><span style=3D"color: rgb(38, 40, 42);">As= per the diagram: </span></div><div dir=3D"ltr" data-setdir=3D"false">= <span style=3D"color: rgb(38, 40, 42);"> the </span><span = style=3D"color: rgb(38, 40, 42);">app server node x TLS engine node interfa= ce is wrapped in SSL </span></div><div dir=3D"ltr" data-setdir=3D"fals= e"><span style=3D"color: rgb(38, 40, 42);"><span><span style=3D"color: rgb(= 38, 40, 42); font-family: Helvetica Neue, Helvetica, Arial, sans-serif; fon= t-size: 16px;"> the internal localhost x localhost interface is= in the clear</span></span><br></span></div><div dir=3D"ltr" data-setdir=3D= "false"><span style=3D"color: rgb(38, 40, 42);"> the TLS engine= node x punchout-vendor node is wrapped in TLSv1.2</span></div><div dir=3D"= ltr" data-setdir=3D"false"><br></div><div dir=3D"ltr" data-setdir=3D"false"= >>> SNI flag (RFC 3546)</div><div dir=3D"ltr" data-setdir=3D"fa= lse">Good catch. </div><div dir=3D"ltr" data-setdir=3D"false"><div><di= v><br></div></div></div><div dir=3D"ltr" data-setdir=3D"false"><br></div></= div><div id=3D"ydp8b198da9yahoo_quoted_6588234430" class=3D"ydp8b198da9yaho= o_quoted"><div style=3D"font-family:'Helvetica Neue', Helvetica, Arial, san= s-serif;font-size:13px;color:#26282a;"><div>-------------------------------= ---------------------------------------<br></div><div><div dir=3D"ltr"><br>= </div><div dir=3D"ltr">Message: 1<br></div><div dir=3D"ltr">Date: Wed, 21 A= ug 2019 08:01:08 -0700<br></div><div dir=3D"ltr">From: "Eric Eberhard" <= <a href=3D"mailto:[email protected]" rel=3D"nofollow" target=3D"_blank">fla= [email protected]</a>><br></div><div dir=3D"ltr">To: "'Brent Kimberley'" &l= t;<a href=3D"mailto:[email protected]" rel=3D"nofollow" target=3D"= _blank">[email protected]</a>>,<br></div><div dir=3D"ltr"> = ; <<a href=3D"mailto:[email protected]" rel=3D"nofol= low" target=3D"_blank">[email protected]</a>><br></div><div dir= =3D"ltr"><br></div><div dir=3D"ltr">Thank you -- what I had in mind but I a= m not that fancy with the setups as we use one. We go from our applic= ation in clear text to stunnel TLSv1.2 which is clearly easier. I did= make this work for a short while a long time ago and did not save the file= s. Plus no may people's horror we use inetd. Of course we only = transfer 4 million XML docs per day and handle 10 million Web calls and ano= ther million connections for credit cards, etc. I have been told that= if I had serious volume inetd is slower -:) but I have not noticed enough = of a slowdown to matter. And inetd (at least on an IBM AIX server) is= dead reliable and easy.<br></div><div dir=3D"ltr"><br></div><div dir=3D"lt= r">As a curiosity -- as I often see people coding unnecessarily -- there is= no reason to connect to localhost with any security at all unless your app= can only output SSLv3 which would imply a 3rd party vendor. The traf= fic never hits the network in any way -- not even the network card -- it go= es directly to/from the TCP/IP stack which is why I mentioned just making t= he app send clear text to one stunnel that outputs TLSv1.2 ... if possible = (may not be if it is something you don't have source to).<br></div><div dir= =3D"ltr"><br></div><div dir=3D"ltr">Eric<br></div><div dir=3D"ltr"><br></di= v><div dir=3D"ltr">-----Original Message-----<br></div><div dir=3D"ltr">Fro= m: Brent Kimberley [mailto:<a href=3D"mailto:[email protected]" re= l=3D"nofollow" target=3D"_blank">[email protected]</a>] <br></div>= <div dir=3D"ltr">Sent: Tuesday, August 20, 2019 6:42 AM<br></div><div dir= =3D"ltr">To: <a href=3D"mailto:[email protected]" rel=3D"nofollow" = target=3D"_blank">[email protected]</a><br></div><div dir=3D"ltr">C= c: <a href=3D"mailto:[email protected]" rel=3D"nofollow" t= arget=3D"_blank">[email protected]</a>; <a href=3D"mailto:= [email protected]" rel=3D"nofollow" target=3D"_blank">[email protected]</a>= <br></div><div dir=3D"ltr">Subject: Re: stunnel-users Digest, Vol 181, Issu= e 1<br></div><div dir=3D"ltr"><br></div><div dir=3D"ltr">Your mileage may v= ary.<br></div><div dir=3D"ltr"><br></div><div dir=3D"ltr"> ################= ###############################################################<br></div><d= iv dir=3D"ltr"># From internal application to external host ###############= ################################################################<br></div><= div dir=3D"ltr"># [Int_Init] -> [Int_Term] -> [Ext_Init] -> [Ext_T= erm] ######################################################################= #########<br></div><div dir=3D"ltr"># [internal_initiator] ---ssl---&= gt; [Internal terminator] # [Internal terminator] ---http---> [ext= ernal Initiator] # [external Initiator] ---tls---> [external= terminator] ##############################################################= #################<br></div><div dir=3D"ltr"># <a href=3D"https://www.stunne= l.org/static/stunnel.html " rel=3D"nofollow" target=3D"_blank">https://www.= stunnel.org/static/stunnel.html </a>#######################################= ######################################## <br></div><div dir=3D"ltr"><br></d= iv><div dir=3D"ltr">[Internal_Terminator]<br></div><div dir=3D"ltr">options= =3D SSLv3<br></div><div dir=3D"ltr">client =3D no<br></div><div dir=3D"ltr= ">accept =3D host_ip:443<br></div><div dir=3D"ltr">connect =3D localhost:54= 321<br></div><div dir=3D"ltr">CAfile =3D int_in= it_wallet.pem<br></div><div dir=3D"ltr">cert &nb= sp; =3D int_term_pub.pem<br></div><div dir=3D"ltr">key = =3D int_term_priv.pem<br></div><div dir= =3D"ltr"><br></div><div dir=3D"ltr">[External_Initiator]<br></div><div dir= =3D"ltr">options =3D SINGLE_ECDH_USE<br></div><div dir=3D"ltr">options =3D = SINGLE_DH_USE<br></div><div dir=3D"ltr">ciphers =3D ECDHE-RSA-AES256-GCM-SH= A384:ECDHE-RSA-AES128-GCM-SHA256<br></div><div dir=3D"ltr">verify =3D 3?<br= ></div><div dir=3D"ltr">client =3D yes<br></div><div dir=3D"ltr">options = =3D TLSv1.2<br></div><div dir=3D"ltr">accept =3D localhost:54321<br></div><= div dir=3D"ltr">connect =3D externalhostname:443<br></div><div dir=3D"ltr">= verifyChain =3D yes<br></div><div dir=3D"ltr">renegotiation&nb= sp; =3D no<br></div><div dir=3D"ltr">CAfile =3D= ext_term_wallet.pem<br></div><div dir=3D"ltr">cert &nbs= p; =3D ext_init_pub.pem<br></div><div dir=3D"ltr">key = =3D ext_init_priv.pem<br></div><di= v dir=3D"ltr"><br></div><div dir=3D"ltr"><br></div><div dir=3D"ltr">-------= ---------------------------------------------------------------<br></div><d= iv dir=3D"ltr"><br></div><div dir=3D"ltr">Date: Mon, 19 Aug 2019 18:21:18 += 0000<br></div><div dir=3D"ltr">From: Daniel Trickett <<a href=3D"mailto:= [email protected]" rel=3D"nofollow" target=3D"_blank">dani= [email protected]</a>><br></div><div dir=3D"ltr">To: "<a hr= ef=3D"mailto:[email protected]" rel=3D"nofollow" target=3D"_blank">= [email protected]</a>" <<a href=3D"mailto:stunnel-users@stunnel.= org" rel=3D"nofollow" target=3D"_blank">[email protected]</a>><b= r></div><div dir=3D"ltr">Subject: [stunnel-users] https to https proxy<br><= /div><div dir=3D"ltr"><br></div><div dir=3D"ltr">Hi,<br></div><div dir=3D"l= tr"><br></div><div dir=3D"ltr">Our punchout vendor switched their site to o= nly accept tls 1.2 over the weekend. Unfortunately our application will onl= y support SSL.<br></div><div dir=3D"ltr"><br></div><div dir=3D"ltr">We are = using stunnel with other vendors but can control the inbound host name. Thi= s recent one is one we can't manage as it is the software provider.<br></di= v><div dir=3D"ltr"><br></div><div dir=3D"ltr">I found a solution for doing = https to https. I'm unclear how I get the first https traffic to route to s= tunnel as the initial call will be from the application will be to the exte= rnal host..<br></div><div dir=3D"ltr">Any thoughts on whether this would wo= rk for my situation? Appreciate any thoughts..<br></div><div dir=3D"l= tr"><br></div><div dir=3D"ltr"><br></div><div dir=3D"ltr">[Tunnel_in]<br></= div><div dir=3D"ltr">client =3D yes<br></div><div dir=3D"ltr">accept =3D ho= st_ip:443<br></div><div dir=3D"ltr">connect =3D localhost:54321<br></div><d= iv dir=3D"ltr"><br></div><div dir=3D"ltr">[Tunnel_out]<br></div><div dir=3D= "ltr">client =3D no<br></div><div dir=3D"ltr">accept =3D localhost:54321<br= ></div><div dir=3D"ltr">connect =3D externalhostname:443<br></div><div dir= =3D"ltr"><br></div><div dir=3D"ltr"><br></div><div dir=3D"ltr"><br></div><d= iv dir=3D"ltr">Best regards,<br></div><div dir=3D"ltr"><br></div><div dir= =3D"ltr">Dan<br></div><div dir=3D"ltr"><br></div></div> </div> </div></body></html> ------=_Part_548810_176365299.1566484160894-- --===============0441214585543148772== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ stunnel-users mailing list [email protected] https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users --===============0441214585543148772==--