Stunnel V5.75 for VSI OpenVMS

After the installation has successfully completed, you must include the commands displayed at the end of the installation procedure in SYSTARTUP_VMS.COM and SYSHUTDWN.COM. This is to ensure that stunnel is started and stopped when OpenVMS is booted and shut down.

Before you can use stunnel it is necessary to create a configuration file that defines the services stunnel will support. By default the configuration file used by stunnel for VSI OpenVMS will be STUNNEL$ROOT:[ETC]STUNNEL.CONF; however you can modify the file SYS$STARTUP:STUNNEL$RUN.COM to specify another configuration file name if you so wish, but keep in mind that any such changes may be overwritten if a new stunnel kit is installed, and it is therefore recommended to use STUNNEL$ROOT:[ETC]STUNNEL.CONF.

The specific details of defining stunnel services depends somewhat on the type of the service, and it is recommended that you read thoroughly the documentation provided at https://www.stunnel.org/docs.html in order to become familiar with the configuration process. Sample configurations for various services can also be found on the internet and adapted as necessary.

To get you started, stunnel for VSI OpenVMS includes several sample configuration files, including the files TELNET-CLIENT.CONF and TELNET-SERVER.CONF (both can be found in STUNNEL$ROOT:[ETC]), that can be used to set up a secure telnet tunnel between two OpenVMS servers. To use these sample configurations, on the client OpenVMS system TELNET-CLIENT.CONF should be copied or renamed to STUNNEL.CONF and edited to change the ACCEPT and CONNECT parameters as appropriate to your environment (specifically the host name should be changed to that of the target server), and similarly on the server system TELNET-SERVER.CONF should be copied or renamed to STUNNEL.CONF and edited to change the ACCEPT parameter as appropriate to match your client configuration. You should then be able to start stunnel on both nodes, and if on the client system you telnet to localhost using the port specified ACCEPT port number you should be connected through to the server node via the tunnel.

The template configuration file (STUNNEL$ROOT:[ETC] STUNNEL^.CONF.TEMPLATE) is also provided, which includes details for a number of services. This file may be copied to STUNNEL$ROOT:[ETC]STUNNEL.CONF and modified as necessary.

The privileges TMPMBX, NETMBX, BYPASS, SYSPRV, and DETACH are required in order to run the stunnel start-up and shutdown scripts; the stunnel process (run as a detached process) will inherit the default privileges for the username under which it is started.

The stunnel process can require considerable resources in order to operate efficiently when supporting large numbers of connections. The quota values below should be adequate for most purposes; however, resource usage should be carefully monitored, and quotas adjusted as necessary.

Maxjobs:          0  Fillm:        256  Bytlm:        128000
Maxacctjobs:      0  Shrfillm:       0  Pbytlm:            0
Maxdetach:        0  BIOlm:        150  JTquota:        4096
Prclm:           50  DIOlm:        150  WSdef:          4096
Prio:             4  ASTlm:        300  WSquo:          8192
Queprio:          4  TQElm:        100  WSextent:      16384
CPU:         (none)  Enqlm:       4000  Pgflquo:      256000

If the stunnel process is expected to support large numbers of concurrent connections then it may also be necessary to increase the CHANNELCNT system parameter (this parameter can usually be safely set to its maximum value of 65535).

By default, stunnel will be installed in SYS$SYSDEVICE:[VMS$COMMON]. If you wish to install the software in an alternative location, this can be achieved by using the /DESTINATION qualifier with the PRODUCT INSTALL command to specify the desired location; however, it is important to note that an additional manual step will then be required to complete the installation. Specifically, when an alternative destination is specified, start-up, shutdown, and related command procedures will be placed into subdirectories residing under the specified destination directory. If you wish to run these files from your standard SYS$STARTUP and SYS$MANAGER directories they will need to be copied from the destination subdirectories into the appropriate locations.