Problem - Kevin Tafuro

attempt to develop and debug SSL-enabled clients and servers together from the
ground up, especially if you do not have any prior experience programming with
SSL. Stunnel will help you debug your SSL code.
A Stunnel configuration file is organized in sections. Each section contains a set of
keys, and each key has an associated value. Sections and keys are both named and
case-insensitive. A configuration file is parsed from top to bottom with sections
delimited by a line containing the name of the section surrounded by square brackets.
The other lines contain key and value pairs that belong to the most recently
parsed section delimiter. In addition, an optional global section that is unnamed
occurs before the first named section in the file. Keys are separated from their associated
value by an equal sign (=).
Comments may only begin at the start of a line that begins with a hash mark (#)
(optionally preceded by whitespace), and the whole line is treated as a comment.
Any leading or trailing whitespace surrounding a key or a value is stripped. Any
other whitespace is significant, including leading or trailing whitespace surrounding
a section name (as it would occur between the square brackets). For example, “[ my_
section ]” is not the same as “[my_section]”. The documentation included with Stunnel
describes the supported keys sufficiently well, so we won’t duplicate it here.
One nice advantage of the configuration files over the old command-line interface is
that each section in the configuration file defines either a client or a server, so a single
instance of Stunnel can be used to run multiple clients or servers. If you want to
run both clients and servers, you still need two instances of Stunnel running because
the flag that determines which mode to run in is a global option. With the command-line
interface, multiple instances of Stunnel used to be required, one for each
client or server that you wanted to run. Therefore, if you wanted to use Stunnel for
POP3, IMAP, and SMTPS servers, you needed to run three instances of Stunnel.
Each section name defines the name of the service that will be used with TCP Wrappers
and for logging purposes. For both clients and servers, specify the accept and
connect keys. The accept key specifies the port on which Stunnel will listen for
incoming connections, and the connect key specifies the port that Stunnel will
attempt to connect to for outgoing connections. At a minimum, these two keys must
specify a port number, but they may also optionally include a hostname or IP
address. To include a hostname or IP address, precede the port number with the
hostname or IP address, and separate the two with a colon (:).
You enable the mode for Stunnel as follows:
Server mode
To enable server mode, set the global option key client to no. When running in
server mode, Stunnel expects incoming connections to speak SSLand makes
outgoing connections without SSL. You will also need to set the two global
options cert and key to the names of files containing the certificate and key to
use.
Enabling SSL without Modifying Source Code | 469
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.