author | John Beck <John.Beck@Oracle.COM> |
Tue, 10 Sep 2013 14:24:13 -0700 | |
branch | s11-update |
changeset 2759 | 810cc8b2e719 |
parent 2723 | 138732f62341 |
permissions | -rw-r--r-- |
2723
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
1 |
# the sample config file should point to the right places on Solaris |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
2 |
# |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
3 |
# |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
4 |
diff -u -r stunnel-4.55.orig/tools/stunnel.conf-sample.in stunnel-4.55/tools/stunnel.conf-sample.in |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
5 |
--- stunnel-4.55.orig/tools/stunnel.conf-sample.in 2012-01-01 13:46:46.000000000 -0800 |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
6 |
+++ stunnel-4.55/tools/stunnel.conf-sample.in 2013-03-21 22:38:08.025113934 -0700 |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
7 |
@@ -9,7 +9,7 @@ |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
8 |
|
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
9 |
; A copy of some devices and system files is needed within the chroot jail |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
10 |
; Chroot conflicts with configuration file reload and many other features |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
11 |
-chroot = @prefix@/var/lib/stunnel/ |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
12 |
+chroot = @localstatedir@/run/stunnel/ |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
13 |
; Chroot jail can be escaped if setuid option is not used |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
14 |
setuid = nobody |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
15 |
setgid = @DEFAULT_GROUP@ |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
16 |
@@ -26,8 +26,8 @@ |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
17 |
; ************************************************************************** |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
18 |
|
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
19 |
; Certificate/key is needed in server mode and optional in client mode |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
20 |
-cert = @prefix@/etc/stunnel/mail.pem |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
21 |
-;key = @prefix@/etc/stunnel/mail.pem |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
22 |
+cert = @sysconfdir@/stunnel/mail.pem |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
23 |
+;key = @sysconfdir@/stunnel/mail.pem |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
24 |
|
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
25 |
; Authentication stuff needs to be configured to prevent MITM attacks |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
26 |
; It is not enabled by default! |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
27 |
@@ -36,12 +36,13 @@ |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
28 |
; CApath is located inside chroot jail |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
29 |
;CApath = /certs |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
30 |
; It's often easier to use CAfile |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
31 |
-;CAfile = @prefix@/etc/stunnel/certs.pem |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
32 |
+;CAfile = @sysconfdir@/stunnel/certs.pem |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
33 |
+;CAfile = @sysconfdir@/pki/tls/certs/ca-bundle.crt |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
34 |
; Don't forget to c_rehash CRLpath |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
35 |
; CRLpath is located inside chroot jail |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
36 |
;CRLpath = /crls |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
37 |
; Alternatively CRLfile can be used |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
38 |
-;CRLfile = @prefix@/etc/stunnel/crls.pem |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
39 |
+;CRLfile = @sysconfdir@/stunnel/crls.pem |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
40 |
|
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
41 |
; Disable support for insecure SSLv2 protocol |
138732f62341
17219320 Various Userland components should be back-ported to 11.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
42 |
options = NO_SSLv2 |