Re: [stunnel-users] Feature request - verify fall-back

This is a discussion on Re: [stunnel-users] Feature request - verify fall-back within the Stunnel Users forums, part of the Networking and Network Related category; --===============0646072720== Content-Type: multipart/alternative; boundary="----=_Part_2032_7765907.1210301405049" ------=_Part_2032_7765907.1210301405049 Content-Type: text/plain; charset=ISO-8859-1 ...

		Usenet Forums > Networking and Network Related > Stunnel Users
Re: [stunnel-users] Feature request - verify fall-back

LinkBack

Thread Tools

Display Modes

#1 (permalink)

4 Days Ago

Sudhaker Raj

Posts: n/a

Re: [stunnel-users] Feature request - verify fall-back

--===============0646072720==
Content-Type: multipart/alternative;
boundary="----=_Part_2032_7765907.1210301405049"

------=_Part_2032_7765907.1210301405049
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Web was just an example. I agree that Apache is better place to do this.

What about running stunnel on port 443 which will look like HTTPS to world
but it connects to VNC if a valid client-cert is presented. This way my VNC
will be totally private and protected from *possible detection* & attack.

Technically it is very much possible and I've done it using Java APIs. It
would be neat if stunnel can be modified to do the same. Any help in
creating such patch will be much appreciated.

Thanks,
Sudhaker

On Thu, May 8, 2008 at 3:53 PM, Brian Hatch <bri@stunnel.org> wrote:
> Roughly around 2008-05-07 15:34 -0400, Sudhaker Raj mentioned:
>
>> I wish to use stunnel for following use-case (to create a
>> highly-protected website which can be accessed only using a valid
>> client-cert).
>>
>> gateway.example.com:443 -> public.example.com:80 (when client-cert
>> verification fails)
>> gateway.example.com:443 -> intranet.example.com:80 (when client-cert
>> verification ok - normally hidden from public)
>>
> ...
>> I guess it will be a nice addition to stunnel's feature list.
>
>
> I disagree. I don't think it's a good idea to add to Stunnel.
>
> This is application layer logic you want, essentially. Your best
> bet would be to use SSL in apache/webserver of choice directly.
> Then you can place the verification constraint in the configuration
> and configure the webserver to serve up selected pages if and only
> if a cert has been used via normal apache 'require' ACLs.
>
> Alternatively this could be configured with apache as a reverse
> proxy using mod_proxy in front of two different back end webservers
> (public and intranet in your example above) if you really want
> distinct webservers for each.
>
> --
> Brian Hatch "I think that we missed something.
> Systems and We should have called it 'Licensed
> Security Engineer Software Delivery', not 'Electronic.'"
> http://www.ifokr.org/bri/ --Bruce
>
> Every message PGP signed
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.1 (GNU/Linux)
>
> iD8DBQFII1o7VkMj8/ymYEsRAmKyAJ9IfSok2pZPkknbD5cRHZag+C2hIACeLQhh
> jYZwdCyQhKFk0a/twP/G8qQ=
> =b0uW
> -----END PGP SIGNATURE-----
>
>

------=_Part_2032_7765907.1210301405049
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

 Web was just an example. I agree that Apache is better place to do this. What about running stunnel on port 443 which will look like HTTPS to world but it connects to VNC if a valid client-cert is presented. This way my VNC will be totally private and protected from possible detection & attack. 
 Technically it is very much possible and I've done it using Java APIs. It would be neat if stunnel can be modified to do the same. Any help in creating such patch will be much appreciated. Thanks, Sudhaker 
 On Thu, May 8, 2008 at 3:53 PM, Brian Hatch <<a href="mailto:bri@stunnel.org">bri@stunnel.org</a>> wrote: > Roughly around 2008-05-07 15:34 -0400, Sudhaker Raj mentioned: > >> I wish to use stunnel for following use-case (to create a 
>> highly-protected website which can be accessed only using a valid >> client-cert). >> >> <a href="http://gateway.example.com:443">gateway.example.com:443</a> -> <a href="http://public.example.com:80">public.example.com:80</a> (when client-cert 
>> verification fails) >> <a href="http://gateway.example.com:443">gateway.example.com:443</a> -> <a href="http://intranet.example.com:80">intranet.example.com:80</a> (when client-cert >> verification ok - normally hidden from public) 
>> > ... >> I guess it will be a nice addition to stunnel's feature list. > > > I disagree.  I don't think it's a good idea to add to Stunnel. > > This is application layer logic you want, essentially.  Your best 
> bet would be to use SSL in apache/webserver of choice directly. > Then you can place the verification constraint in the configuration > and configure the webserver to serve up selected pages if and only 
> if a cert has been used via normal apache 'require' ACLs. > > Alternatively this could be configured with apache as a reverse > proxy using mod_proxy in front of two different back end webservers 
> (public and intranet in your example above) if you really want > distinct webservers for each. > > -- > Brian Hatch                  "I think that we missed something. >   Systems and                We should have called it 'Licensed 
>   Security Engineer          Software Delivery', not 'Electronic.'" > <a href="http://www.ifokr.org/bri/">http://www.ifokr.org/bri/</a>    --Bruce > > Every message PGP signed > 
> -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.2.1 (GNU/Linux) > > iD8DBQFII1o7VkMj8/ymYEsRAmKyAJ9IfSok2pZPkknbD5cRHZag+C2hIACeLQhh > jYZwdCyQhKFk0a/twP/G8qQ= > =b0uW > -----END PGP SIGNATURE----- 
> > 

------=_Part_2032_7765907.1210301405049--

--===============0646072720==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
stunnel-users mailing list
stunnel-users@mirt.net
http://stunnel.mirt.net/mailman/listinfo/stunnel-users

--===============0646072720==--

« Previous Thread | Next Thread »

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Posting Rules
You may not post new threads You may not post replies You may not post attachments You may not edit your posts vB code is On Smilies are Off [IMG] code is Off HTML code is Off Trackbacks are On Pingbacks are On Refbacks are On

All times are GMT +1. The time now is 06:57 PM.