04-27-06 11:54 AM
Details of the connection follow:
Oh, I know I;m not anonymous any more, but this is only
person email I'm trying to access and this is my throw-away email
address, so I guess little or no harm done.
"nemo_outis" <abc@xyz.com> wrote in message
news:Xns97B0BAB24255Fabcxyzcom@204.153.244.170...
> PS Provide as much additional info as possible (or you feel conmfortable
> giving) such as with whom and how you will be connecting. Encryption
> protocols are an "it takes two to tango" affair - they must be negotiated
> with the other end, usually to find a "highest common denominator".
For now I am connecting with my own server on a LAN. I want to be able to
use the connection
to secure wifi access to my home computer from a cafe in Washington DC.
(i.e. I connect to
a public wifi hotspot, bring up stunnel and access email or a home computer.
I can already do this
using puTTY, but I like TLS :-) so want to try stunnel. Unless someone knows
how to get Windoz
puTTY to take to OpenBSD openssh in TLS-- I don't.
I've have matched stunnel and ssl library versions. Have tried every stunnel
version from 4.10 to 4.15
and and openssl 7f and 8a. Using a separate client config I have no problem
connectiing TLS
to bananas TLS SMTP server using stunnel 4.10, however I am unable to get a
connection to
banana using stunnel 4.15 (but that is another problem and 4.10 works so it
isn't a priority)
Here is the server config:
Commented out the verify = 3 directive because I am not using the client
certificate.
Server.pem is a standard RSA self-signed cert; I have also tried appending
DH
parameters to it with no luck.
#stunnel server setup
CAfile=CAcert.pem
CApath=certificates
cert=server.pem
debug = 7
#verify = 3
output = log.txt
client = no
options = all
RNDbytes = 1024
RNDfile = random.bfa
RNDoverwrite = yes
Ciphers = DHE-RSA-AES256-SHA:AES256-SHA
#service level configuration
[vnc]
accept = 0.0.0.0:7443
connect = 127.0.0.1:5900
delay = no
Here is the client config:
#stunnel client setup
CAfile=CAcert.pem
CApath=certificates
cert=client.pem
debug = 7
#verify = 3
output = log.txt
client = yes
options = all
RNDbytes = 1024
RNDfile = bananarand.bin
RNDoverwrite = yes
Ciphers = DHE-RSA-AES256-SHA:AES256-SHA
#service level configuration
[fox tls]
accept = localhost:5901
#connect localhost:5900
connect = 192.168.7.157:7443
These configs will connect AES258-SHA. If I remove AES256-SHA as a ciphers
list option the connection fails. The server side log file
says there are no shared ciphers. If I remove ciphers directive altogether
connection defaults to AES256-SHA (which isn't bad, but
it isn't TLS)
Thought: Do I need to append DH parameters to client.pem?
[ Post a follow-up to this message ]
| 
