- stunnel-users - stunnel.org

2 secure sockets TCP (Server / Client).
by khaled khaled 07 Jan '08

07 Jan '08

Hi all,I am a new STUNNEL user,I will do 2 secure sockets TCP (Server / Client). I would like to know how to set 'stunnel.conf. I tried but it does not work. Description: ---------- I created a CA root and from this I have created 2 pairs (key and certificate) one for the server and one for the client. You can send me please a config file from a server? Many thanks, Stunnel.config (serveur) ----------------------- ; Sample stunnel configuration file by Michal Trojnara 2002-2006; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode; The default certificate is provided only for testing and should not; be used in a production environment;cert = stunnel.pem;key = stunnel.pemcert = server.crt key = serverkey.key ; Some performance tuningssocket = l:TCP_NODELAY=1socket = r:TCP_NODELAY=1 CAfile = ca.crt ;[Server]accept = 192.168.1.4:4433connect = 192.168.1.4:4433 KHALED Khaled Ingénieur de télécommunications et informatique _________________________________________________________________ Votre contact a choisi Hotmail, l'e-mail nouvelle génération. Créez un compte. http://www.windowslive.fr/hotmail/default.asp

1 0

Missing Something Basic on Config
by Steve 29 Dec '07

29 Dec '07

Using stunnel for NNTPS. Stunnel starts without any apparent problems (log looks normal), but simply doesn't intercept packets from my news reader. There is no activity in the log and sniffing the packets shows everything happening on 119. My understanding of the concept is that there are no configuration changes needed in the newsreader; IOW, I leave it pointing to the unsecured NNTP server with the port set to 119. I fear I'm missing something very obvious. BTW, I've confirmed the ability to use NNTPS with this particular server by using Outlook Express, which is compatible with NNTPS. Version: 4.20; I used the Windows binary. Running XP. Config: ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [nntps] accept = 192.168.1.101:119 connect = secure.news.easynews.com:563 Log: 2007.12.28 22:24:46 LOG5[6640:6644]: stunnel 4.20 on x86-pc-mingw32-gnu with OpenSSL 0.9.8d 28 Sep 2006 2007.12.28 22:24:46 LOG5[6640:6644]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2007.12.28 22:24:46 LOG5[6640:5936]: No limit detected for the number of clients 2007.12.28 22:24:46 LOG7[6640:5936]: FD 196 in non-blocking mode 2007.12.28 22:24:46 LOG7[6640:5936]: SO_REUSEADDR option set on accept socket 2007.12.28 22:24:46 LOG7[6640:5936]: nntps bound to 192.168.1.101:119

1 0

Avoiding outlook express warning...
by fg 28 Dec '07

28 Dec '07

Hello all I use stunnel on a server with a stunnel.pem file generated with openSSL,( this file is not certified with verisign or others...) Each time i launch outlook express on a client a have a warning saying that the server is using a certificate who can't be verified.... I have to close this warning and after all is ok... Question Is it possible to skip this warning? perhaps with a public key approuved in outlook express??? thanks for help --------------------------------- Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

3 2

stunnel
by peter griep 28 Dec '07

28 Dec '07

hello i'm using stunnel with download2day,but it's not working wih grabit can you tell what i must do to work stunnel with grabit. peter

3 2

1 tunnel client to few different servers
by Shalvi Ziv 26 Dec '07

26 Dec '07

All, As my PROXY server gets requests from end-users to be proxied to several different content providers (SMS servers), I was wondering how can encrypt the traffic between the PROXY to the SMS using stunnel, but still handle the differentiation to the various content providers. Meaning, my PROXY listens on port 9090 for all incoming SMS requests and each request should be addressed to different SMS server (i.e. different content provider) based on the number the message was sent to. See following example: Client = yes [SMPP] accept = 9090 (should always be this port) connect = <SMS IP>:442 Now, how can I do it with stunnel configuration (having the <SMS IP> flexibly assigned according to other parameters in the packet)? Thanks! zivs

2 1

Can stunnel be configured to listen for multiple IP addresses and access different email hosts?
by David Goldstein 21 Dec '07

21 Dec '07

2 1

Using stunnel as a non-root user
by T. S. Ferreira 20 Dec '07

20 Dec '07

I have a small web application running as a regular (non root) user on my port 6666. I would like to make it accessible through SSL on port 7777. In order to test it I used (as the same non root user) the following command: stunnel -D 7 -p mypemfile.pem -d 7777 -r localhost:6666 but it does not work. When I check with "ps aux | fgrep stunnel", no such program is running. However if I run it as root, it does work. I did not find in the documentation any restriction with this regard. Since my final application will run on a machine to whose root I do not have access, I would like to find a way to solve this problem. Any hint will be appreciated. -- tsf ----------------------------------------- My system data are: (1) Linux/Ubuntu 7.10, kernel 2.6.22-14-generic, (2) Output of "/usr/bin/stunnel4 -version": stunnel 4.20 on i486-pc-linux-gnu with OpenSSL 0.9.8e 23 Feb 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none (3) Output due to '-D 7' option: 2007.12.20 10:00:45 LOG7[14820:3082589872]: Snagged 64 random bytes from /home/tomasz/.rnd 2007.12.20 10:00:45 LOG7[14820:3082589872]: Wrote 1024 new random bytes to /home/tomasz/.rnd 2007.12.20 10:00:45 LOG7[14820:3082589872]: RAND_status claims sufficient entropy for the PRNG 2007.12.20 10:00:45 LOG7[14820:3082589872]: PRNG seeded successfully 2007.12.20 10:00:45 LOG7[14820:3082589872]: Certificate: jai_ssl.pem 2007.12.20 10:00:45 LOG7[14820:3082589872]: Certificate loaded 2007.12.20 10:00:45 LOG7[14820:3082589872]: Key file: jai_ssl.pem 2007.12.20 10:00:45 LOG7[14820:3082589872]: Private key loaded 2007.12.20 10:00:45 LOG7[14820:3082589872]: SSL context initialized for service stunnel3 (4)"/usr/bin/stunnel" is a Perl script whose comments say " ... wrapper to use stunnel 3.x syntax in stunnel >=4.05 ..."; it is version 2.00 (2005.04.2).

1 1

Stunnel never really connects
by Pat Riehecky 20 Dec '07

20 Dec '07

I am trying to send email over stunnel from a client that doesn't support encryption to a server that does. The local socket opens just fine, but it never really seems to connect to the remote server. A tcpdump shows only three packets exchanged between the two systems (Syn, Syn/Ack, Ack). The behavior is the same regardless of which tls enabled port I point stunnel at. I am able to connect to these ports via telnet and send email so I know the connection can be negotiated. I am using the 4.21 build for windows (XP SP2) found on the main webpage. Help! --- stunnel.conf --- ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ; my email client isn't eudora, but given how ; it doesn't support standards like encrypted ; transport..... options = DONT_INSERT_EMPTY_FRAGMENTS ; Some debugging stuff useful for troubleshooting debug = 7 ; Use it for client mode client = yes [smtp] accept = 127.0.0.1:25 connect = mailserver.mydomain.tld:587 ;connect = mailserver.mydomain.tld:465 ;connect = mailserver.mydomain.tld:25 protocol = smtp

2 1

'PIN' engine control command
by Ludolf Holzheid 14 Dec '07

14 Dec '07

Dear list, I'm trying to use stunnel on Windows with an USB token (`CryptoMate' from ACS). However, I can't manage to make stunnel ask for the token PIN: o Loading the private key works if I specify the PIN in the configuration file (`engineCtrl = PIN:...'). o If there is no `PIN' engine control option in the configuration file, loading the private key fails. The log message are: error stack: 26096080 : error:26096080:engine routines:ENGINE_load_private_key:failed loading private key error stack: 800050A0 : error:800050A0:Vendor defined:PKCS11_login:PIN incorrect Do I have to add a special engine control option to the configuration file in order to get asked for the PIN or is it intended to `just work'? Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

2 2

rtmps with stunnel on linux
by David Schulberg 14 Dec '07

14 Dec '07

Hi, Cannot get rtmps working with Firefox (IceWeasel) on Linux. I have rtmps working fine with Firefox and IE on Windows XP. The error I see in stunnel (see below) when I try rtmps through a Linux browser is "peer suddenly disconnected". Also curious that there are 2 attempts made. 2007.12.13 16:31:41 LOG7[2624:1192]: https accepted FD=212 from 124.190.241.7:59728 2007.12.13 16:31:41 LOG7[2624:1192]: Creating a new thread 2007.12.13 16:31:41 LOG7[2624:1192]: New thread created 2007.12.13 16:31:41 LOG7[2624:2576]: https started 2007.12.13 16:31:41 LOG7[2624:2576]: FD 212 in non-blocking mode 2007.12.13 16:31:41 LOG7[2624:2576]: TCP_NODELAY option set on local socket 2007.12.13 16:31:41 LOG5[2624:2576]: https accepted connection from 124.190.241.7:59728 2007.12.13 16:31:41 LOG7[2624:2576]: SSL state (accept): before/accept initialization 2007.12.13 16:31:41 LOG3[2624:2576]: SSL_accept: Peer suddenly disconnected 2007.12.13 16:31:41 LOG5[2624:2576]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.12.13 16:31:41 LOG7[2624:2576]: https finished (0 left) 2007.12.13 16:31:41 LOG7[2624:1192]: https accepted FD=236 from 124.190.241.7:59729 2007.12.13 16:31:41 LOG7[2624:1192]: Creating a new thread 2007.12.13 16:31:41 LOG7[2624:1192]: New thread created 2007.12.13 16:31:41 LOG7[2624:2572]: https started 2007.12.13 16:31:41 LOG7[2624:2572]: FD 236 in non-blocking mode 2007.12.13 16:31:41 LOG7[2624:2572]: TCP_NODELAY option set on local socket 2007.12.13 16:31:41 LOG5[2624:2572]: https accepted connection from 124.190.241.7:59729 2007.12.13 16:31:41 LOG7[2624:2572]: SSL state (accept): before/accept initialization 2007.12.13 16:31:41 LOG3[2624:2572]: SSL_accept: Peer suddenly disconnected 2007.12.13 16:31:41 LOG5[2624:2572]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.12.13 16:31:41 LOG7[2624:2572]: https finished (0 left) Regards, David Schulberg

1 0

Re: [stunnel-users] * lencoboy Stunnel client and Centos 5 Apache
by Luis Rodrigo Gallardo Cruz 12 Dec '07

12 Dec '07

[Again, please send your responses to the list.] On Wed, Dec 12, 2007 at 06:18:58PM +0000, Mario Neè wrote: > > On Wed, Dec 12, 2007 at 05:00:08PM +0000, Mario Neè wrote: > > > > From: rodrigo(a)nul-unu.com > > > > This takes what is sent to local port 1443, encrypts it, and sends it > > > > like that to the remote 192.168.x.x:443 This means that the remote > > > > Apache needs to be listening on port 443 with ssl enabled there. Is > > > > this what you wanted? > > > > > > yes it's what i want. > > > > > > > Ok. Then I'd guess the problem is that apache is not expecting SSL on > > port 443. Read up on how to enable it. I'd guess a good start is > > http://httpd.apache.org/docs/2.0/mod/mod_ssl.html > > > if i try to connect to 192.168.x.x:443 with firefox everything > works, only with stunnel i get that error Do you try to connect with http://192.168.x.x:443 or with https://192.168.x.x:443 (note the 's')? -- Rodrigo Gallardo GPG-Fingerprint: 7C81 E60C 442E 8FBC D975 2F49 0199 8318 ADC9 BC28

1 0

Re: [stunnel-users] * lencoboy Stunnel client and Centos 5 Apache
by Luis Rodrigo Gallardo Cruz 12 Dec '07

12 Dec '07

[Please, respond to the list, not to the private mail of whoever answers you.] On Wed, Dec 12, 2007 at 05:00:08PM +0000, Mario Neè wrote: > > From: rodrigo(a)nul-unu.com > > On Wed, Dec 12, 2007 at 09:36:35AM +0000, Mario Neè wrote: > > > i'm trying to connect a stunnel client to the welcome page of Apache > > > in Centos 5 (Fresh install with no changes to Apache conf). > > > > > > command to create a client (on Feisty Fawn Ubuntu): > > > sudo stunnel -c -d 1443 -r 192.168.x.x:443 > > > > This takes what is sent to local port 1443, encrypts it, and sends it > > like that to the remote 192.168.x.x:443 This means that the remote > > Apache needs to be listening on port 443 with ssl enabled there. Is > > this what you wanted? > > yes it's what i want. > Ok. Then I'd guess the problem is that apache is not expecting SSL on port 443. Read up on how to enable it. I'd guess a good start is http://httpd.apache.org/docs/2.0/mod/mod_ssl.html -- Rodrigo Gallardo GPG-Fingerprint: 7C81 E60C 442E 8FBC D975 2F49 0199 8318 ADC9 BC28

1 0

newbie config not running
by fuzzy_4711 12 Dec '07

12 Dec '07

Hello list. I am new to stunnel and do have some problems to get it running. The server is a WinXPSP2 behind a router. The router has port forwarding enabled for port 9999 to the stunnel server (4.21). On the same box a vnc server is running on port 5900 which I like to tunnel. Firewall is opened. The netstat -a -n shows the server listening on the desired port (9999). My server config looks like that: cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 ;output = stunnel.log ; Use it for client mode ;client = yes [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 25 [VNC Server] accept = 9999 connect = 5900 The client side is a linux box with config setting: client = yes [VNC Server] accept = 5900 connect = 9999 I turned on debugging and stunnel.log seems to be okay - no error messages. But I am not able to get an connection. What am I doing wrong? Stefan

5 8

* lencoboy Stunnel client and Centos 5 Apache
by Mario Neè 12 Dec '07

12 Dec '07

Hello, i'm trying to connect a stunnel client to the welcome page of Apache in Centos 5 (Fresh install with no changes to Apache conf). command to create a client (on Feisty Fawn Ubuntu): sudo stunnel -c -d 1443 -r 192.168.x.x:443 if i try to connect to http://localhost:1443 and a look in /var/log/syslog i see this error: SSL_connect: error:1408F06B:SSL routines:SSL3_GET_RECORD:bad decompression. _________________________________________________________________ Ti piace giocare con le lettere? Prova ABCLive! http://messengergiochi.it.msn.com/

2 1

server reads ecrypted data on connect ?
by Nikolaj G. 10 Dec '07

10 Dec '07

Hello stunnel'ers, First of all - im a newbie into openssl and stunnel. Im trying to stunnel between my own java socket server and client. The stunnel is established, but the server reads encrypted data on connect. Since I dont send anything, Im surprised to see encrypted data in the server log. Could someone please help. Ive managed to create a root certificate, a request and signing it, using: http://www.eclectica.ca/howto/ssl-cert-howto.php Thanks in advance. /nikolaj PS see configuration below: ----------------------------------------------- Packages (Fedora Core 6): openssl-devel-0.9.8b-15.fc6 openssl-0.9.8b-15.fc6 stunnel-4.15-2 ----------------------------------------------- The SERVER stunnel.conf: ; Certificate/key is needed in server mode CAfile = /root/ssl/cacert.pem cert = /root/ssl/key-cert.pem pid = /root/ssl/stunnel.pid ; Some debugging stuff useful for troubleshooting debug = 7 foreground=yes #setuid = stunnel #setgid = stunnel [mystunnel] accept = ratata.cirque.dk:998 connect = 127.0.0.1:8200 ----------------------------------------------- The CLIENT stunnel.conf: ; Certificate/key is needed in server mode CAfile = /root/ssl/eclectica/cacert.pem pid = /root/ssl/eclectica/stunnel.pid ; Some debugging stuff useful for troubleshooting debug = 7 foreground=yes ; enable client mode client = yes [mystunnel] accept = 127.0.0.1:998 connect = ratata.cirque.dk:8200 ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

1 0

HTTPS hardcoded redirects
by Ezio Ostorero 10 Dec '07

10 Dec '07

All, I have a problem similar to the one described in http://mirt.net/pipermail/stunnel-users/2006-October/001324.html i.e. I ***wish*** to use the recording functionalities of JMeter while accessing an apache-SSL-secured Tomcat web server. JMeter does not allow recording on SSL so I have to ... un-cipher my HTTPS sessions, stunnel looks like the right choice. Being an stunnel newbie, I started here: http://www.stunnel.org/examples/https_client.html , this HOWTO looks quite close to my configuration. We have a plain-vanilla tomcat server behind an apache/SSL, and I want to access this web application from an HTTP-only browser. So, I configure stunnel as a "client", I run it on my PC, with the following configuration: [psuedo-https] accept = 8080 connect = <server>:443 TIMEOUTclose = 0 I read it as follows: stunnel talk cleartext HTTP on the local 8080 port and forwards in crypted HTTPS on the <server> port 443 I set the URL in my browser to http://localhost:8080/oi/ and this happens: 1) Ethereal sez that my PC and <server> start an SSLv3 conversation, good, we're on track 2) I have an HTTP analyzer plugged in my browser that shows me the content of the first GET that is a redirect to an SSO server (on the same <server>:443 port) for user authentication https://<server>/ssoserver/login?service=...... 3) My browser then issue a GET to https://<server>/ssoserver/login?service=...... and is GAME OVER, my beloved stunnel is cleanly bypassed by the hardcoded https://<server>/ string Any suggestion? Is it a dead end? Any dirty trick I could play with? Such as running multiple stunnel instances, setting <server> = localhost in my hosts file etc.? Thanks, Ezio -- Ezio Ostorero, Catania Seltz e limone col sale. Arriminatu, non annacatu

1 0

Re: [stunnel-users] Problem compiling win32 stunnel.exe v 4.21
by butterspoon＠gmail.com 10 Dec '07

10 Dec '07

On 09/12/2007, Luis Rodrigo Gallardo Cruz <rodrigo(a)nul-unu.com> wrote: > On Sun, Dec 09, 2007 at 11:30:01PM +0000, Hidden wrote: > > Okay, so I'm trying to build stunnel.exe (ver 4.21) under Debian Linux > > 2.6.22.1 as a prelude to applying some patches and I'm getting > > stuck. > > Just to make sure I understand: You are trying to build *for* windows > *in* Debian. Yup, just like the documentation (INSTALL.W32) says: 1) install mingw32 cross-compiler o a Unix/Linux machine (native compilation on a Windows machine is possible, but not supported) [...] 5) type "make stunnel.exe" > You seem to be mixing up (the names of) unix libs with windows ones. Well, something is. I'm just doing it by the book! > Anyways, would it not be easier to compile in windows? Anyone else here build stunnel.exe? What did you use? T

1 0

Problem compiling win32 stunnel.exe v 4.21
by Hidden 09 Dec '07

09 Dec '07

Okay, so I'm trying to build stunnel.exe (ver 4.21) under Debian Linux 2.6.22.1 as a prelude to applying some patches and I'm getting stuck. I've followed the instructions in the makefile – Install mingw32; compile and install openssl; unpack and make stunnel.exe. mingw makes a bunch of object files for a while, but then at the link stage it bombs with i586-mingw32msvc/bin/ld: cannot find -lzdll make was when trying to execute the command: i586-mingw32msvc-gcc -s -o stunnel.exe file.obj client.obj log.obj options.obj protocol.obj network.obj resolver.obj ssl.obj ctx.obj verify.obj sthreads.obj stunnel.obj gui.obj resources.obj -L/usr/src/openssl-0.9.8g -lzdll -leay32 -lssl32 -lws2_32 -lgdi32 -mwindows eay32 is nowhere to be found either. It and ssl32 are clearly related to openssl, but I can't see any suitable files in either the openssl build directory (/usr/src/openssl-0.9.8g as advertised). zdll could be something to do with zlib (which I have, ver 1.2.3) and eay32 and ssl32 are obviously related to openssl, but the only libraries under openssl are libssl.a and libcrypto.a (although optimistically trying to bolt in libssl in place of ssl32 doesn't work). ws2_32 and gdi32 are windows sockets and GDI, for what it's worth. I can't find the required libs on the internet anywhere, and maybe it's all down to me being a novice with mingw. I do notice the tantalizingly named files zlib1.dll, libeay32.dll, and libssl32.dll in the precompiled Windows binary distribution of stunnel, but surely I can't use them in any way? I'd love some help from anyone who knows this system better! Thanks, Tony

2 1

SSL session caching with multiple clients through stunnel to an https server
by Paul McGarry 06 Dec '07

06 Dec '07

Hi there, I have an application where apache/php processes make SOAP requests over https to a single remote server (which is IIS I think). I am trying to cut down the time each request takes. In it's current configuration I think some time will be wasted as the php client and IIS server handshake to set up a new SSL connection for each request, thereby adding (at least) twice the network latency between the two servers to each request. (As far as I can tell there is no way to make php SOAP use some kind of persistant connection or SSL cache when talking to the server) I am wondering if I pushed the soap requests as http through stunnel whether stunnel would be more efficient with SSL connections or whether it will just create a new tunnel with a new ssl session for each request it receives? Does anyone have any advice? Paul

1 0

MS Outlook verify = 2 using problem
by FFT` 05 Dec '07

05 Dec '07

Good Day! I'm using Stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 with OpenSSL 0.9.8g 19 Oct 2007 on Fedora-like Linux server. stunnel.conf consists: _______________________________________________________________________________ cert = /usr/local/etc/stunnel/server.crt key = /usr/local/etc/stunnel/server.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) ;sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /usr/local/var/stunnel/ setuid = nobody setgid = nobody ; PID is created inside chroot jail pid = /stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath =/usr/local/etc/stunnel/certs ; It's often easier to use CAfile CAfile = /usr/local/etc/stunnel/ca.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/etc/stunnel/crl.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Service-level configuration [pop3s] accept = 995 connect = 110 ________________________________________________________________________ PKI consists: ROOT_CA CA MAIL_CON_CA SERVER CLIENT server.crt - Server certificate in PEM Format; server.pem - Server key in PEM Format with nopassword ca.pem - ROOT_CA, CA, MAIL_CON_CA certificates in PEM format. When I am using MS Outlook mail Client , there are some PROBLEM with connections to SERVER:995 stunnel.log consists: ______________________________________________ 2007.12.05 14:57:39 LOG5[16668:1074107776]: stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2007.12.05 14:57:39 LOG5[16668:1074107776]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 2007.12.05 14:57:39 LOG6[16668:1074107776]: file ulimit = 1024 (can be changed with 'ulimit -n') 2007.12.05 14:57:39 LOG6[16668:1074107776]: poll() used - no FD_SETSIZE limit for file descriptors 2007.12.05 14:57:39 LOG5[16668:1074107776]: 500 clients allowed 2007.12.05 14:57:39 LOG7[16668:1074107776]: FD 6 in non-blocking mode 2007.12.05 14:57:39 LOG7[16668:1074107776]: FD 8 in non-blocking mode 2007.12.05 14:57:39 LOG7[16668:1074107776]: FD 9 in non-blocking mode 2007.12.05 14:57:39 LOG7[16668:1074107776]: SO_REUSEADDR option set on accept socket 2007.12.05 14:57:39 LOG7[16668:1074107776]: pop3s bound to 0.0.0.0:995 2007.12.05 14:57:39 LOG7[16669:1074107776]: Created pid file /stunnel.pid 2007.12.05 14:57:48 LOG7[16669:1074107776]: pop3s accepted FD=10 from 192.168.1.205:2129 2007.12.05 14:57:48 LOG7[16669:1074228016]: pop3s started 2007.12.05 14:57:48 LOG7[16669:1074228016]: FD 10 in non-blocking mode 2007.12.05 14:57:48 LOG7[16669:1074228016]: TCP_NODELAY option set on local socket 2007.12.05 14:57:48 LOG5[16669:1074228016]: pop3s accepted connection from 192.168.1.205:2129 2007.12.05 14:57:48 LOG7[16669:1074228016]: SSL state (accept): before/accept initialization 2007.12.05 14:57:48 LOG7[16669:1074228016]: SSL state (accept): SSLv3 read client hello A 2007.12.05 14:57:48 LOG7[16669:1074228016]: SSL state (accept): SSLv3 write server hello A 2007.12.05 14:57:48 LOG7[16669:1074228016]: SSL state (accept): SSLv3 write certificate A 2007.12.05 14:57:48 LOG7[16669:1074228016]: SSL state (accept): SSLv3 write certificate request A 2007.12.05 14:57:48 LOG7[16669:1074228016]: SSL state (accept): SSLv3 flush data 2007.12.05 14:57:48 LOG7[16669:1074228016]: SSL alert (write): fatal: handshake failure 2007.12.05 14:57:48 LOG3[16669:1074228016]: SSL_accept: 140890C7: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate 2007.12.05 14:57:48 LOG5[16669:1074228016]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.12.05 14:57:48 LOG7[16669:1074228016]: pop3s finished (0 left) ______________________________________________ I load all Server, CA , and client certificate in SYSTEM, but there is NO Connection. Please help Me with Stunnel and Outlook using.

1 0

(no subject)
by Harmon, Paul 02 Dec '07

02 Dec '07

Ok Guys, I hate to be a nuisance. But I encountered an error coming out o the Stunnel configuration in LINUX. First what does it mean when Stunnel is in INETD mode? Does this imply certain configuration restrictions and why? Thanks, Paul Harmon

2 1

Help using Stunnel-4.XX
by Harmon, Paul 30 Nov '07

30 Nov '07

Hi Folks, Well I know a little more now than before. The version of Stunnel I'm using is Stunnel 4.05 running under Fedora 7.0. I am trying to setup a test scenario at the moment where I am running a stream socket between a client and a server, both mine since this is a test scenario. I need thisese programs to connect over a secure socket and the exchange of data is a custom application. I've read through Barry O'donovan's article and that seems to give me the information on how to configure and use Stunnel on the server side. It is not clear to me yet, what I need to do to the client side. Is there anyone out there who has done this type of thing and could give me some help? Thanks in advance, Paul Harmon

2 1

Problem with stunnel 4.20 on Fedora 7
by Andrew M Dunn 30 Nov '07

30 Nov '07

[Oh wise list folks... I haven't seen any responses to this. Does anybody have any experience either with using stunnel on Fedora 7, or with the particular error? I cannot find any other hints or reasons as to why the resolution is failing... Andy] ----original message------ I can't get stunnel to run on a freshly-installed Fedora 7 system. It fails with "Error resolving '0.0.0.0': servname is not supported for ai_socktype" but the usual other causes of that error (ie. ports not defined in /etc/services, bad settings in /etc/nsswitch.conf) are not the culprit this time. COMMAND LINE: /usr/sbin/stunnel /home/amdunn/security/stunnel.conf COMMAND OUTPUT: 2007.08.29 11:44:12 LOG3[13614:3086243520]: Error resolving '0.0.0.0': servname is not supported for ai_socktype (EAI_SERVICE) file /home/amdunn/security/stunnel.conf line 10: Failed to resolve accepting address STUNNEL.CONF FILE: ; ; stunnel file for testing 443 access to local http server ; cert=/home/amdunn/security/xxxxxxx key=/home/amdunn/security/yyyyyyy foreground=yes ; ; [sweb] accept=443 ; https port connect=80 ; standard httpd listening port TIMEOUTclose=0 ; must set this or IE waits 60sec on page end client=no STUNNEL -VERSION OUTPUT: stunnel 4.20 on i686-redhat-linux-gnu with OpenSSL 0.9.8b 04 May 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none

2 1

zlib compression not working
by webmaster＠escoltesiguies.cat 29 Nov '07

29 Nov '07

I have configured both windows client and linux server (samba) with zlib compression: compression = zlib But I have transferred a txt file of 100Mb in 40 minutes and the same file compressed with gzip (22Mb) in 14 minutes. So I thing compression is not working. Client log tells: Compression enabled using zlib method and server log: Compression enabled using zlib method How can I verify comression is working? maybe compression is working but it is poor?

1 0

About stunnel 4.21 daemon mode
by wei hu 28 Nov '07

28 Nov '07

Dear I had successfully installed stunnel 4.21 on my server, but after I edited the file stunnel.conf and startup the stunnel, I can't find the stunnel via the "ps -ef" command.Then I have found such error message in the log file: 2007.11.27 07:42:28 LOG5[28550:3085354688]: stunnel 4.21 on i686-pc-linux-gnu wi th OpenSSL 0.9.7f 22 Mar 2005 2007.11.27 07:42:28 LOG5[28550:3085354688]: Threading:PTHREAD SSL:ENGINE Sockets :POLL,IPv6 Auth:LIBWRAP 2007.11.27 07:42:28 LOG6[28550:3085354688]: file ulimit = 1024 (can be changed w ith 'ulimit -n') 2007.11.27 07:42:28 LOG6[28550:3085354688]: poll() used - no FD_SETSIZE limit fo r file descriptors 2007.11.27 07:42:28 LOG5[28550:3085354688]: 500 clients allowed 2007.11.27 07:42:28 LOG7[28550:3085354688]: FD 9 in non-blocking mode 2007.11.27 07:42:28 LOG7[28550:3085354688]: FD 10 in non-blocking mode 2007.11.27 07:42:28 LOG7[28550:3085354688]: FD 11 in non-blocking mode 2007.11.27 07:42:28 LOG7[28550:3085354688]: SO_REUSEADDR option set on accept so cket 2007.11.27 07:42:28 LOG7[28550:3085354688]: sproxy bound to 0.0.0.0:83 2007.11.27 07:42:28 LOG3[28556:3085354688]: Failed to get GID for group nobody Do somebody knows how to get GID for group nobody? My nobody group is sured to work correctly with Squid. The config file about group: ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /usr/local/var/lib/stunnel/ setuid = nobody setgid = nobody ; PID is created inside chroot jail pid = /stunnel.pid The command "stunnel -version" response: [root@vps stunnel]# /usr/local/bin/stunnel -version stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.7f 22 Mar 2005 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none The command "/usr/local/bin/stunnel" response: [root@vps stunnel]# /usr/local/bin/stunnel 2007.11.27 07:27:27 LOG7[13697:3085354688]: Snagged 64 random bytes from /root/.rnd 2007.11.27 07:27:27 LOG7[13697:3085354688]: Wrote 1024 new random bytes to /root/.rnd 2007.11.27 07:27:27 LOG7[13697:3085354688]: RAND_status claims sufficient entropy for the PRNG 2007.11.27 07:27:27 LOG7[13697:3085354688]: PRNG seeded successfully 2007.11.27 07:27:27 LOG7[13697:3085354688]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2007.11.27 07:27:27 LOG7[13697:3085354688]: Certificate loaded 2007.11.27 07:27:27 LOG7[13697:3085354688]: Key file: /usr/local/etc/stunnel/stunnel.pem 2007.11.27 07:27:27 LOG7[13697:3085354688]: Private key loaded 2007.11.27 07:27:27 LOG7[13697:3085354688]: SSL context initialized for service sproxy Best Regards, HuWei

2 2

Re: [stunnel-users] More questions on RDP and port forwarding
by richard.woodman＠cox.net 28 Nov '07

28 Nov '07

Carter, Thanks. With the exception of the client's loopback address in the hosts file, I have a very similar configuration. I have created an inbound rule (Custom service with an inbound rule declaration but no outbound rule) that looks just like my inbound RDP rules - I even reviewed the configuration file and the stunnel rule had the same commands as the RDP rule. However, RDP works through the firewall but stunnel does not. My Windows firewall has an exception for stunnel with a scope of "Internet" and the stunnel server works from within the corporate network. Meaning, I think, that the Windows firewall is not denying the connection (at least from within the same subnet). I am not a Windows AD guy, but is there a way to prevent network connections without using the Windows firewall? I mean, can a GPO be created that prevents connections from IP addresses not on the same subnet but that does not use the OS's firewall? If so, this could be the issue because from what I can see, neither the Watchguard nor the Windows firewalls are blocking the connection; yet I still cannot connect. Richard Carter Browne wrote: I use stunnel to protect RDP for a couple of sites using a mix of Watchguard Edge and V series firewalls. For computer ABC that I want to connect to, I create an entry in the hosts file: 127.0.0.n ABCs (where n is greater than 1) On the client side I have an entry: [ABC-RDP] accept = ADCs:12345 connect = ABC:54321 client = yes On the server sid I have an entry: [RDP-IN] accept = 54321 connect = 3389 client = no Port 54321 is enabled in both the Watchguard and the Windows firewalls. Using the 127.n.n.n ports are not processed by the firewalls. You can use 127.0.0.1 for everything, but I needed to connect to more that one host and wanted a standard setup. I have had a number of users confused by this setup whereby the program references a local port to connect to a remote computer. For stunnel, it is the connect string that determines the destination, so any local port works fine for the accept string. Carter

2 1

Problems accessing samba
by webmaster＠escoltesiguies.cat 27 Nov '07

27 Nov '07

I have a winXP machine which should connect to a linux samba. Everything installed following http://wiki.netbsd.se/index.php/How_to_secure_samba_with_stunnel but it don't connect. I have both loglevels set to 7, and as serverlog don't change I thing the error is at clientside. stunnel.conf is: client=yes debug = 7 [smb] accept=222.222.222.222:139 connect=85.48.253.144:8888 And the client log is: 2007.11.27 12:46:58 LOG7[3716:720]: RAND_status claims sufficient entropy for the PRNG 2007.11.27 12:46:58 LOG7[3716:720]: PRNG seeded successfully 2007.11.27 12:46:58 LOG7[3716:720]: Certificate: stunnel.pem 2007.11.27 12:46:58 LOG7[3716:720]: Certificate loaded 2007.11.27 12:46:58 LOG7[3716:720]: Key file: stunnel.pem 2007.11.27 12:46:58 LOG7[3716:720]: Private key loaded 2007.11.27 12:46:58 LOG7[3716:720]: SSL context initialized for service smb 2007.11.27 12:46:58 LOG5[3716:720]: stunnel 4.21 on x86-pc-mingw32-gnu with OpenSSL 0.9.8g 19 Oct 2007 2007.11.27 12:46:58 LOG5[3716:720]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2007.11.27 12:46:58 LOG5[3716:3292]: No limit detected for the number of clients 2007.11.27 12:46:59 LOG7[3716:3292]: FD 216 in non-blocking mode 2007.11.27 12:46:59 LOG7[3716:3292]: SO_REUSEADDR option set on accept socket 2007.11.27 12:46:59 LOG7[3716:3292]: smb bound to 222.222.222.222:139 2007.11.27 12:47:15 LOG7[3716:3292]: smb accepted FD=248 from 88.31.107.217:1625 2007.11.27 12:47:15 LOG7[3716:3292]: Creating a new thread 2007.11.27 12:47:15 LOG7[3716:3292]: New thread created 2007.11.27 12:47:15 LOG7[3716:4028]: smb started 2007.11.27 12:47:15 LOG7[3716:4028]: FD 248 in non-blocking mode 2007.11.27 12:47:15 LOG7[3716:4028]: TCP_NODELAY option set on local socket 2007.11.27 12:47:15 LOG5[3716:4028]: smb accepted connection from 88.31.107.217:1625 2007.11.27 12:47:15 LOG7[3716:4028]: FD 272 in non-blocking mode 2007.11.27 12:47:15 LOG7[3716:4028]: smb connecting 85.48.253.144:8888 2007.11.27 12:47:15 LOG7[3716:4028]: connect_wait: waiting 10 seconds 2007.11.27 12:47:25 LOG7[3716:3292]: smb accepted FD=308 from 88.31.107.217:1628 2007.11.27 12:47:25 LOG7[3716:3292]: Creating a new thread 2007.11.27 12:47:25 LOG7[3716:3292]: New thread created 2007.11.27 12:47:25 LOG7[3716:3012]: smb started 2007.11.27 12:47:25 LOG7[3716:3012]: FD 308 in non-blocking mode 2007.11.27 12:47:25 LOG7[3716:3012]: TCP_NODELAY option set on local socket 2007.11.27 12:47:25 LOG5[3716:3012]: smb accepted connection from 88.31.107.217:1628 2007.11.27 12:47:25 LOG7[3716:3012]: FD 340 in non-blocking mode 2007.11.27 12:47:25 LOG7[3716:3012]: smb connecting 85.48.253.144:8888 2007.11.27 12:47:25 LOG7[3716:3012]: connect_wait: waiting 10 seconds 2007.11.27 12:47:25 LOG6[3716:4028]: connect_wait: s_poll_wait timeout 2007.11.27 12:47:25 LOG5[3716:4028]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.11.27 12:47:25 LOG7[3716:4028]: smb finished (1 left) 2007.11.27 12:47:35 LOG6[3716:3012]: connect_wait: s_poll_wait timeout 2007.11.27 12:47:35 LOG5[3716:3012]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.11.27 12:47:35 LOG7[3716:3012]: smb finished (0 left) Where is the problem? Thanks

1 1

VeriSign Intermediate CA Certificate issue.
by Unai Rodriguez 27 Nov '07

27 Nov '07

Dear All, I am trying to set an https layer using stunnel. I am having problems with the intermediary certificate since it appears broken to the user. You may find a screenshot here: http://u-journal.org/stunnel/Root_Cert_Err.jpg My stunnel version is: 3.26 running on Debian 3.1 I run stunnel as standalone with this parameters: stunnel -d 10.123.16.103:443 -D 7 -R /etc/ssl/certs/stunnel.rnd \ -p /etc/ssl/certs/stunnel.pem -o /var/log/stunnel/stunnel.log \ -r 10.123.16.103:80 -N https You may find the output of my stunnel -V here: http://pastebin.ca/793495 uname -a: Linux lb2-dp-vm 2.6.8-3-686 #1 Tue Dec 5 21:26:38 UTC 2006 i686 GNU/Linux openssl version: OpenSSL 0.9.7e 25 Oct 2004 So, if I create my /etc/ssl/certs/stunnel.pem file like this: -----BEGIN RSA PRIVATE KEY----- rsa_priv_key -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- secured.behringer.com_certificate -----END CERTIFICATE----- -- OR -- -----BEGIN RSA PRIVATE KEY----- rsa_priv_key -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- secured.behringer.com_certificate -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- VeriSign Intermediate CA Certificate (https://www.verisign.com.sg/support/ssl/install/intermediate/secure.shtml) -----END CERTIFICATE----- I get the mentioned error. If I create the /etc/ssl/certs/stunnel.pem like this: -----BEGIN RSA PRIVATE KEY----- rsa_priv_key -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- VeriSign Intermediate CA Certificate (https://www.verisign.com.sg/support/ssl/install/intermediate/secure.shtml) -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- secured.behringer.com_certificate -----END CERTIFICATE----- I get the error: "[...] X509_check_private_key:key values mismatch" You may see the log here: http://pastebin.ca/793500 Any clues on what am I doing wrong? Thank you so much! unai

1 1

Re: [stunnel-users] More questions on RDP and port forwarding
by richard.woodman＠cox.net 26 Nov '07

26 Nov '07

OK, I took my configs, my certs, etc. and put them on two boxes in the lab - then I ensured I could use stunnel to connect using VNC. I then put a NAT box (Linksys BEFSR81) between the two and configured the Linksys to provide port forwarding. I then reconnected and everything worked first time. Therefore, I can only assume that either port-forwarding is misconfigured on my Watchguard SOHO 6tc -or- that the Windows firewall is causing problems (neither lab box has a firewall running). I'll keep you posted on what I find. Thanks. Richard My original post: I did read through the archives but I cannot determine how to get Stunnel working through the firewall. Here is what I wish to do: 1. Tunnel Windows Remote Desktop through stunnel. 2. I wish to connect from home to work; I have access to the firewall at work. Here's what I've done: 1. Installed stunnel on Windows XP at home and at work. I have self-signed certificates and am using verify = 3 (on both computers). Cacert.pem has the CA cert, the work cert, and the home cert in a single file. The server-cert.pem has the work computer's key and cert while the client-1-cert.pem (home computer) has it's own key and cert. 2. Stunnel at home has client = yes, stunnel at work has this commented out. Stunnel at work will become a "server" where multiple clients connect via stunnel and that single computer makes multiple RDP connections. Client (home) computer has [rdp1] accept = 4391 connect = <work outside interface IP>:44391 Server (work) computer has [rdp2] accept = 44391 connect = <work computer name>:3392 If I try this at work from within the corporate network (change the client connect string to the stunnel server's IP or hostname), then everything works fine. However, once I try from outside the work network, nothing works. Firewall is a Watchguard SOHO 6tc and I have a inbound rule permitting 44391 and directing it to X.X.X.52 (the stunnel server). I also have other rules allowing RDP (on port 3392 for instance) directly to the computer I wish to control and those rules work. Essentially, RDP directly through the firewall works but stunnel through the firewall does not. I assume there is no traffic destined for .52 on 44391 because the log file on the server (with debug = 7) only shows the startup sequence and port binding (netstat -a shows I am listening on 44391). I also tried this at home on my Juniper 5XT and was unsuccessful. Please help. Richard

1 0

Re: [stunnel-users] More questions on RDP and port forwarding
by richard.woodman＠cox.net 26 Nov '07

26 Nov '07

Craig, Thanks. Are you advising that I put "client = yes" in the service declaration rather than the main configuration? I already have "client = yes" on the client side (in the main configuration) and that line commented out of the server's configuration (I assume the default is client = no). When I review the log on the client computer, I can see where it times out waiting on a response from the work firewall's outside IP address. I do not see any connection attempts on the server side and both stunnel instances (client and server) have debug = 7 and logging to stunnel.log. Richard > -----Original Message----- > From: stunnel-users-bounces(a)mirt.net [mailto:stunnel-users- > bounces(a)mirt.net] On Behalf Of Richard Woodman > Sent: 26 November 2007 07:44 AM > To: stunnel-users(a)mirt.net > Subject: [stunnel-users] More questions on RDP and port forwarding > > I did read through the archives but I cannot determine how to get > Stunnel > working through the firewall. Here is what I wish to do: > > 1. Tunnel Windows Remote Desktop through stunnel. > 2. I wish to connect from home to work; I have access to the firewall > at > work. > > Here's what I've done: > > 1. Installed stunnel on Windows XP at home and at work. I have self- > signed > certificates and am using verify = 3 (on both computers). Cacert.pem > has > the CA cert, the work cert, and the home cert in a single file. The > server-cert.pem has the work computer's key and cert while the > client-1-cert.pem (home computer) has it's own key and cert. > 2. Stunnel at home has client = yes, stunnel at work has this > commented > out. Stunnel at work will become a "server" where multiple clients > connect > via stunnel and that single computer makes multiple RDP connections. > > Client (home) computer has > Try changing the client config to the following: [rdp1] client = yes accept = 4391 connect = <work outside interface IP>:44391 > > Server (work) computer has > > [rdp2] > accept = 44391 > connect = <work computer name>:3392 > > If I try this at work from within the corporate network (change the > client > connect string to the stunnel server's IP or hostname), then everything > works fine. However, once I try from outside the work network, nothing > works. Firewall is a Watchguard SOHO 6tc and I have a inbound rule > permitting 44391 and directing it to X.X.X.52 (the stunnel server). I > also > have other rules allowing RDP (on port 3392 for instance) directly to > the > computer I wish to control and those rules work. Essentially, RDP > directly > through the firewall works but stunnel through the firewall does not. > I > assume there is no traffic destined for .52 on 44391 because the log > file on > the server (with debug = 7) only shows the startup sequence and port > binding > (netstat -a shows I am listening on 44391). I also tried this at home > on my > Juniper 5XT and was unsuccessful. Please help. > > Richard > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users Cheers, Craig

1 0

More questions on RDP and port forwarding
by Richard Woodman 26 Nov '07

26 Nov '07

I did read through the archives but I cannot determine how to get Stunnel working through the firewall. Here is what I wish to do: 1. Tunnel Windows Remote Desktop through stunnel. 2. I wish to connect from home to work; I have access to the firewall at work. Here's what I've done: 1. Installed stunnel on Windows XP at home and at work. I have self-signed certificates and am using verify = 3 (on both computers). Cacert.pem has the CA cert, the work cert, and the home cert in a single file. The server-cert.pem has the work computer's key and cert while the client-1-cert.pem (home computer) has it's own key and cert. 2. Stunnel at home has client = yes, stunnel at work has this commented out. Stunnel at work will become a "server" where multiple clients connect via stunnel and that single computer makes multiple RDP connections. Client (home) computer has [rdp1] accept = 4391 connect = <work outside interface IP>:44391 Server (work) computer has [rdp2] accept = 44391 connect = <work computer name>:3392 If I try this at work from within the corporate network (change the client connect string to the stunnel server's IP or hostname), then everything works fine. However, once I try from outside the work network, nothing works. Firewall is a Watchguard SOHO 6tc and I have a inbound rule permitting 44391 and directing it to X.X.X.52 (the stunnel server). I also have other rules allowing RDP (on port 3392 for instance) directly to the computer I wish to control and those rules work. Essentially, RDP directly through the firewall works but stunnel through the firewall does not. I assume there is no traffic destined for .52 on 44391 because the log file on the server (with debug = 7) only shows the startup sequence and port binding (netstat -a shows I am listening on 44391). I also tried this at home on my Juniper 5XT and was unsuccessful. Please help. Richard

3 2

I'm very much a newbie to stunnel
by Harmon, Paul 26 Nov '07

26 Nov '07

Hi Guys, I'm very new to Stunnel. In fact I have no experience with it what so ever. My situation is this: I have server program and a client at the moment which know nothing about SSL. Yet the powers that be insist that my two machines, if they must use sockets, do so using SSL. After reading through the distribution, I found this very interesting program called Stunnel which sounds like it might solve my problem quite well. From what I've read so far, I gather this program can be used as an SSL wrapper for my server and my client. Would some kind soul please help me with the configuration process (the configuration file) so that my client and server can be safe and secure? My server uses a port which I have chosen (really quite arbitrarily). Basically I need the server to listen on that port and wait for incoming data which it will processs and in most cases not even reply. With normal sockets this is a no-brainer since Steven's book outlines it very well. If I understand the documentation I've read so far, Stunnel adds the encryption layer on top of that which I need. So how do I configure and invokestunnel in this environment? Sorry for stupid questions at the moment I just lack examples like this and confidence in using the program. Thanks, Paul

2 1

Certificate management
by Koenraad Lelong 23 Nov '07

23 Nov '07

Hi, Since a few months I'm playing with stunnel. Last month I installed a stunnel at a customer. This week he reported he could not connect any more. After testing here I discovered the CA cert had expired. I made this myself and I didn't see that it's only valid for one month. I made new certificates making sure they are valid for longer than one month, so this is solved for now. My question : are there good documents about management of certificates ? I'm specially interested in renewing the certificates. Regards, Koenraad Lelong.

2 1

some newbie questions
by Lluís Forns 23 Nov '07

23 Nov '07

Let me first explain what I want to do in order to see if stunnel is what I need: I have some laptops around the world and I want to let them login in my intranet. The login is versus a Samba server. So more or less the connection would be: Laptop (running winXP) --- router --- internet --- router --- linux ssh server(port 22 open) --- linux samba server Could stunnel help me achivieng this? any hint of how? I have read the documentation, but I am a little lost. thanks -- <http://www.escoltesiguies.cat>*Lluís Forns - Tècnic Informàtic * *Servei d'Informàtica* *Minyons Escoltes i Guies de Catalunya (MEG)* *Telèfon:* 93 590 27 00 *Fax:* 93 590 04 92 *www.escoltesiguies.cat* No m'imprimeixis si no és necessari. Protegim el medi ambient.

2 1

Re: [stunnel-users] Stunnel and Outlook Web Access Problems
by Craig Retief 20 Nov '07

20 Nov '07

I see that you have client = yes in the config file. When client = yes is set outside the service block, it becomes a global setting that tells all the services that it should tunnel that they are clients and not servers. If you specify the client = yes within a service eg. [pop3s] client = yes accept = 995 connect = 110 then stunnel knows that the specified service alone is a client. What I recommend is that you disable the client = yes in the global area and change you config file to something like this: I have removed the comments to shorten the config for explanation: socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 CRLpath = crls CRLfile = certnew.pem debug = 7 output = stunnel.log ;client = yes [https] accept = 443 connect = 192.168.0.5:443 TIMEOUTclose = 0 Try using this as your config and see if it works or not. Cheers Craig From: Dan Vespa [mailto:[email protected]] Sent: 19 November 2007 05:07 PM To: Craig Retief Subject: RE: [stunnel-users] Stunnel and Outlook Web Access Problems Craig, Here it is.... ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment ;cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = crls ; It's often easier to use CAfile ;CAfile = certnew.pem ; Don't forget to c_rehash CRLpath CRLpath = crls ; Alternatively you can use CRLfile CRLfile = certnew.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 [https] accept = 443 connect = 192.168.0.5:443 TIMEOUTclose = 0 ; vim:ft=dosini _____ From: Craig Retief Sent: Mon 19/11/2007 9:54 AM To: 'Dan Vespa' Cc: stunnel-users(a)mirt.net Subject: RE: [stunnel-users] Stunnel and Outlook Web Access Problems Please Post your stunnel configs. Makes life easier. Cheers Craig From: Dan Vespa [mailto:[email protected]] Sent: 19 November 2007 03:35 PM To: Craig Subject: RE: [stunnel-users] Stunnel and Outlook Web Access Problems Craig, I set the debug level higher and this is what my log outputs.... 2007.11.19 08:25:54 LOG7[1596:2656]: RAND_status claims sufficient entropy for the PRNG 2007.11.19 08:25:54 LOG7[1596:2656]: PRNG seeded successfully 2007.11.19 08:25:54 LOG7[1596:2656]: SSL context initialized for service https 2007.11.19 08:25:54 LOG5[1596:2656]: stunnel 4.21 on x86-pc-mingw32-gnu with OpenSSL 0.9.8g 19 Oct 2007 2007.11.19 08:25:54 LOG5[1596:2656]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2007.11.19 08:25:54 LOG5[1596:3012]: No limit detected for the number of clients 2007.11.19 08:25:54 LOG7[1596:3012]: FD 188 in non-blocking mode 2007.11.19 08:25:54 LOG7[1596:3012]: SO_REUSEADDR option set on accept socket 2007.11.19 08:25:54 LOG7[1596:3012]: https bound to 0.0.0.0:443 2007.11.19 08:26:32 LOG7[1596:3012]: https accepted FD=236 from 127.0.0.1:1409 2007.11.19 08:26:32 LOG7[1596:3012]: Creating a new thread 2007.11.19 08:26:32 LOG7[1596:3012]: New thread created 2007.11.19 08:26:32 LOG7[1596:2576]: https started 2007.11.19 08:26:32 LOG7[1596:2576]: FD 236 in non-blocking mode 2007.11.19 08:26:32 LOG7[1596:2576]: TCP_NODELAY option set on local socket 2007.11.19 08:26:32 LOG5[1596:2576]: https accepted connection from 127.0.0.1:1409 2007.11.19 08:26:32 LOG7[1596:2576]: FD 260 in non-blocking mode 2007.11.19 08:26:32 LOG7[1596:2576]: https connecting 192.168.0.5:443 2007.11.19 08:26:32 LOG7[1596:2576]: connect_wait: waiting 10 seconds 2007.11.19 08:26:32 LOG7[1596:2576]: connect_wait: connected 2007.11.19 08:26:32 LOG5[1596:2576]: https connected remote server from 192.168.0.24:1410 2007.11.19 08:26:32 LOG7[1596:2576]: Remote FD=260 initialized 2007.11.19 08:26:32 LOG7[1596:2576]: TCP_NODELAY option set on remote socket 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): before/connect initialization 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 write client hello A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 read server hello A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 read server certificate A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 read server done A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 write client key exchange A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 write change cipher spec A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 write finished A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 flush data 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 read finished A 2007.11.19 08:26:32 LOG7[1596:2576]: 1 items in the session cache 2007.11.19 08:26:32 LOG7[1596:2576]: 1 client connects (SSL_connect()) 2007.11.19 08:26:32 LOG7[1596:2576]: 1 client connects that finished 2007.11.19 08:26:32 LOG7[1596:2576]: 0 client renegotiations requested 2007.11.19 08:26:32 LOG7[1596:2576]: 0 server connects (SSL_accept()) 2007.11.19 08:26:32 LOG7[1596:2576]: 0 server connects that finished 2007.11.19 08:26:32 LOG7[1596:2576]: 0 server renegotiations requested 2007.11.19 08:26:32 LOG7[1596:2576]: 0 session cache hits 2007.11.19 08:26:32 LOG7[1596:2576]: 0 session cache misses 2007.11.19 08:26:32 LOG7[1596:2576]: 0 session cache timeouts 2007.11.19 08:26:32 LOG6[1596:2576]: SSL connected: new session negotiated 2007.11.19 08:26:32 LOG6[1596:2576]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2007.11.19 08:26:53 LOG7[1596:3012]: https accepted FD=288 from 127.0.0.1:1411 2007.11.19 08:26:53 LOG7[1596:3012]: Creating a new thread 2007.11.19 08:26:53 LOG7[1596:3012]: New thread created 2007.11.19 08:26:53 LOG7[1596:1060]: https started 2007.11.19 08:26:53 LOG7[1596:1060]: FD 288 in non-blocking mode 2007.11.19 08:26:53 LOG7[1596:1060]: TCP_NODELAY option set on local socket 2007.11.19 08:26:53 LOG5[1596:1060]: https accepted connection from 127.0.0.1:1411 2007.11.19 08:26:53 LOG7[1596:1060]: FD 312 in non-blocking mode 2007.11.19 08:26:53 LOG7[1596:1060]: https connecting 192.168.0.5:443 2007.11.19 08:26:53 LOG7[1596:1060]: connect_wait: waiting 10 seconds 2007.11.19 08:26:53 LOG7[1596:1060]: connect_wait: connected 2007.11.19 08:26:53 LOG5[1596:1060]: https connected remote server from 192.168.0.24:1412 2007.11.19 08:26:53 LOG7[1596:1060]: Remote FD=312 initialized 2007.11.19 08:26:53 LOG7[1596:1060]: TCP_NODELAY option set on remote socket 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): before/connect initialization 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 write client hello A 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 read server hello A 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 read finished A 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 write change cipher spec A 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 write finished A 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 flush data 2007.11.19 08:26:53 LOG7[1596:1060]: 1 items in the session cache 2007.11.19 08:26:53 LOG7[1596:1060]: 2 client connects (SSL_connect()) 2007.11.19 08:26:53 LOG7[1596:1060]: 2 client connects that finished 2007.11.19 08:26:53 LOG7[1596:1060]: 0 client renegotiations requested 2007.11.19 08:26:53 LOG7[1596:1060]: 0 server connects (SSL_accept()) 2007.11.19 08:26:53 LOG7[1596:1060]: 0 server connects that finished 2007.11.19 08:26:53 LOG7[1596:1060]: 0 server renegotiations requested 2007.11.19 08:26:53 LOG7[1596:1060]: 1 session cache hits 2007.11.19 08:26:53 LOG7[1596:1060]: 0 session cache misses 2007.11.19 08:26:53 LOG7[1596:1060]: 0 session cache timeouts 2007.11.19 08:26:53 LOG6[1596:1060]: SSL connected: previous session reused 2007.11.19 08:26:53 LOG7[1596:1060]: SSL socket closed on SSL_read 2007.11.19 08:26:53 LOG7[1596:1060]: Socket write shutdown 2007.11.19 08:26:53 LOG5[1596:1060]: Connection closed: 70 bytes sent to SSL, 164 bytes sent to socket 2007.11.19 08:26:53 LOG7[1596:1060]: https finished (1 left) 2007.11.19 08:27:53 LOG3[1596:2576]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2007.11.19 08:27:53 LOG5[1596:2576]: Connection reset: 1102 bytes sent to SSL, 1241 bytes sent to socket 2007.11.19 08:27:53 LOG7[1596:2576]: https finished (0 left) Does this make any sense to you???? Dan _____ From: Craig Sent: Mon 19/11/2007 1:34 AM To: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Stunnel and Outlook Web Access Problems OWA rewrites the URL when you log in and I have found that it causes problems when doing that with a Stunnel connection. What I think might be happening is that your initial connection says http://server.tld/ then when you log in OWA rewrites the URL to https://server.tld/ What I think is happening is that your stunnel is listening on port 80 and when you log in, OWA changes the listening port in the browser to port 443. Try running the listening server (stunnel server) to listen on port 443 instead of port 80 and see if that fixes the problem. Cheers Craig From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Dan Vespa Sent: 17 November 2007 07:21 PM To: stunnel-users(a)mirt.net Subject: [stunnel-users] Stunnel and Outlook Web Access Problems I am trying to use the latest version of stunnel to connect to OWA. I set stunnel to listen on port 80 (localhost) and then connect to myserverip on port 443. I get the login screen but can go no further after I Enter my credentials and Click OK. Checking the stunnel log screen it shows that a connect has been made? I don't understand why It won't connect any further?? OWA is on Exchange Server 2003 and I am using Windows XP SP2. I have also updated to Open SSL latest version. Thanks in Advance. Dan

1 0

Re: [stunnel-users] Stunnel and Outlook Web Access Problems
by Craig Retief 19 Nov '07

19 Nov '07

Please Post your stunnel configs. Makes life easier. Cheers Craig From: Dan Vespa [mailto:[email protected]] Sent: 19 November 2007 03:35 PM To: Craig Subject: RE: [stunnel-users] Stunnel and Outlook Web Access Problems Craig, I set the debug level higher and this is what my log outputs.... 2007.11.19 08:25:54 LOG7[1596:2656]: RAND_status claims sufficient entropy for the PRNG 2007.11.19 08:25:54 LOG7[1596:2656]: PRNG seeded successfully 2007.11.19 08:25:54 LOG7[1596:2656]: SSL context initialized for service https 2007.11.19 08:25:54 LOG5[1596:2656]: stunnel 4.21 on x86-pc-mingw32-gnu with OpenSSL 0.9.8g 19 Oct 2007 2007.11.19 08:25:54 LOG5[1596:2656]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2007.11.19 08:25:54 LOG5[1596:3012]: No limit detected for the number of clients 2007.11.19 08:25:54 LOG7[1596:3012]: FD 188 in non-blocking mode 2007.11.19 08:25:54 LOG7[1596:3012]: SO_REUSEADDR option set on accept socket 2007.11.19 08:25:54 LOG7[1596:3012]: https bound to 0.0.0.0:443 2007.11.19 08:26:32 LOG7[1596:3012]: https accepted FD=236 from 127.0.0.1:1409 2007.11.19 08:26:32 LOG7[1596:3012]: Creating a new thread 2007.11.19 08:26:32 LOG7[1596:3012]: New thread created 2007.11.19 08:26:32 LOG7[1596:2576]: https started 2007.11.19 08:26:32 LOG7[1596:2576]: FD 236 in non-blocking mode 2007.11.19 08:26:32 LOG7[1596:2576]: TCP_NODELAY option set on local socket 2007.11.19 08:26:32 LOG5[1596:2576]: https accepted connection from 127.0.0.1:1409 2007.11.19 08:26:32 LOG7[1596:2576]: FD 260 in non-blocking mode 2007.11.19 08:26:32 LOG7[1596:2576]: https connecting 192.168.0.5:443 2007.11.19 08:26:32 LOG7[1596:2576]: connect_wait: waiting 10 seconds 2007.11.19 08:26:32 LOG7[1596:2576]: connect_wait: connected 2007.11.19 08:26:32 LOG5[1596:2576]: https connected remote server from 192.168.0.24:1410 2007.11.19 08:26:32 LOG7[1596:2576]: Remote FD=260 initialized 2007.11.19 08:26:32 LOG7[1596:2576]: TCP_NODELAY option set on remote socket 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): before/connect initialization 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 write client hello A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 read server hello A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 read server certificate A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 read server done A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 write client key exchange A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 write change cipher spec A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 write finished A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 flush data 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 read finished A 2007.11.19 08:26:32 LOG7[1596:2576]: 1 items in the session cache 2007.11.19 08:26:32 LOG7[1596:2576]: 1 client connects (SSL_connect()) 2007.11.19 08:26:32 LOG7[1596:2576]: 1 client connects that finished 2007.11.19 08:26:32 LOG7[1596:2576]: 0 client renegotiations requested 2007.11.19 08:26:32 LOG7[1596:2576]: 0 server connects (SSL_accept()) 2007.11.19 08:26:32 LOG7[1596:2576]: 0 server connects that finished 2007.11.19 08:26:32 LOG7[1596:2576]: 0 server renegotiations requested 2007.11.19 08:26:32 LOG7[1596:2576]: 0 session cache hits 2007.11.19 08:26:32 LOG7[1596:2576]: 0 session cache misses 2007.11.19 08:26:32 LOG7[1596:2576]: 0 session cache timeouts 2007.11.19 08:26:32 LOG6[1596:2576]: SSL connected: new session negotiated 2007.11.19 08:26:32 LOG6[1596:2576]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2007.11.19 08:26:53 LOG7[1596:3012]: https accepted FD=288 from 127.0.0.1:1411 2007.11.19 08:26:53 LOG7[1596:3012]: Creating a new thread 2007.11.19 08:26:53 LOG7[1596:3012]: New thread created 2007.11.19 08:26:53 LOG7[1596:1060]: https started 2007.11.19 08:26:53 LOG7[1596:1060]: FD 288 in non-blocking mode 2007.11.19 08:26:53 LOG7[1596:1060]: TCP_NODELAY option set on local socket 2007.11.19 08:26:53 LOG5[1596:1060]: https accepted connection from 127.0.0.1:1411 2007.11.19 08:26:53 LOG7[1596:1060]: FD 312 in non-blocking mode 2007.11.19 08:26:53 LOG7[1596:1060]: https connecting 192.168.0.5:443 2007.11.19 08:26:53 LOG7[1596:1060]: connect_wait: waiting 10 seconds 2007.11.19 08:26:53 LOG7[1596:1060]: connect_wait: connected 2007.11.19 08:26:53 LOG5[1596:1060]: https connected remote server from 192.168.0.24:1412 2007.11.19 08:26:53 LOG7[1596:1060]: Remote FD=312 initialized 2007.11.19 08:26:53 LOG7[1596:1060]: TCP_NODELAY option set on remote socket 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): before/connect initialization 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 write client hello A 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 read server hello A 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 read finished A 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 write change cipher spec A 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 write finished A 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 flush data 2007.11.19 08:26:53 LOG7[1596:1060]: 1 items in the session cache 2007.11.19 08:26:53 LOG7[1596:1060]: 2 client connects (SSL_connect()) 2007.11.19 08:26:53 LOG7[1596:1060]: 2 client connects that finished 2007.11.19 08:26:53 LOG7[1596:1060]: 0 client renegotiations requested 2007.11.19 08:26:53 LOG7[1596:1060]: 0 server connects (SSL_accept()) 2007.11.19 08:26:53 LOG7[1596:1060]: 0 server connects that finished 2007.11.19 08:26:53 LOG7[1596:1060]: 0 server renegotiations requested 2007.11.19 08:26:53 LOG7[1596:1060]: 1 session cache hits 2007.11.19 08:26:53 LOG7[1596:1060]: 0 session cache misses 2007.11.19 08:26:53 LOG7[1596:1060]: 0 session cache timeouts 2007.11.19 08:26:53 LOG6[1596:1060]: SSL connected: previous session reused 2007.11.19 08:26:53 LOG7[1596:1060]: SSL socket closed on SSL_read 2007.11.19 08:26:53 LOG7[1596:1060]: Socket write shutdown 2007.11.19 08:26:53 LOG5[1596:1060]: Connection closed: 70 bytes sent to SSL, 164 bytes sent to socket 2007.11.19 08:26:53 LOG7[1596:1060]: https finished (1 left) 2007.11.19 08:27:53 LOG3[1596:2576]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2007.11.19 08:27:53 LOG5[1596:2576]: Connection reset: 1102 bytes sent to SSL, 1241 bytes sent to socket 2007.11.19 08:27:53 LOG7[1596:2576]: https finished (0 left) Does this make any sense to you???? Dan _____ From: Craig Sent: Mon 19/11/2007 1:34 AM To: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Stunnel and Outlook Web Access Problems OWA rewrites the URL when you log in and I have found that it causes problems when doing that with a Stunnel connection. What I think might be happening is that your initial connection says http://server.tld/ then when you log in OWA rewrites the URL to https://server.tld/ What I think is happening is that your stunnel is listening on port 80 and when you log in, OWA changes the listening port in the browser to port 443. Try running the listening server (stunnel server) to listen on port 443 instead of port 80 and see if that fixes the problem. Cheers Craig From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Dan Vespa Sent: 17 November 2007 07:21 PM To: stunnel-users(a)mirt.net Subject: [stunnel-users] Stunnel and Outlook Web Access Problems I am trying to use the latest version of stunnel to connect to OWA. I set stunnel to listen on port 80 (localhost) and then connect to myserverip on port 443. I get the login screen but can go no further after I Enter my credentials and Click OK. Checking the stunnel log screen it shows that a connect has been made? I don't understand why It won't connect any further?? OWA is on Exchange Server 2003 and I am using Windows XP SP2. I have also updated to Open SSL latest version. Thanks in Advance. Dan

1 0

Stunnel and Outlook Web Access Problems
by Dan Vespa 19 Nov '07

19 Nov '07

I am trying to use the latest version of stunnel to connect to OWA. I set stunnel to listen on port 80 (localhost) and then connect to myserverip on port 443. I get the login screen but can go no further after I Enter my credentials and Click OK. Checking the stunnel log screen it shows that a connect has been made? I don't understand why It won't connect any further?? OWA is on Exchange Server 2003 and I am using Windows XP SP2. I have also updated to Open SSL latest version. Thanks in Advance. Dan

2 1

NFS over stunnel
by Andy Wettstein 19 Nov '07

19 Nov '07

Hi, I wrote a document about how I am running NFS over stunnel. Using some firewall rules I was able to eliminate most of the complications for using secure NFS. It could probably use more detailed explanations, but the scripts I am using are all there. It still kind of in test phase, but I am currently mounting my home directory using stunnel. I haven't really noticed much of a speed problem in day to day activities. https://w3.physics.uiuc.edu/physwiki/doku.php?id=pcs:unix:nfs_over_stunnel Please send any questions you might have. -- andy wettstein unix administrator department of physics university of illinois at urbana-champaign

2 2

receive error
by Protect Girl 14 Nov '07

14 Nov '07

Hi When run stunnel.exe, I was receive "the procedure entry point SSL_CTX_xet_info_callback could not be located in the dynamic library libssl32.dll" error.

2 1

can't get client address
by Draeath Spamtrap 14 Nov '07

14 Nov '07

Stunnel appears to be working fine, but when started it spams my syslog about 5 times with the following message: "stunnel: warning: can't get client address: Bad file descriptor" There are no other messages from stunnel. I'm not sure where it's coming from... It looks like it is running without command line arguments. My init script has the following snippets that make me think that: > PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin > PREFIX=/usr/local > DAEMON=/usr/local/bin/stunnel > PIDFILE=/var/lib/stunnel/stunnel.pid > > test -f $DAEMON || exit 0 > > case "$1" in > start) > echo -n "Starting universal SSL tunnel: stunnel" > $DAEMON || echo -n " failed" > echo "." > ;; > {TRIMMED REST OF FILE} My stunnel version info: > stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.8e 23 Feb 2007 > Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP > > Global options > debug = 5 > pid = /usr/local/var/run/stunnel/stunnel.pid > RNDbytes = 64 > RNDfile = /dev/urandom > RNDoverwrite = yes > Service-level options > cert = /usr/local/etc/stunnel/stunnel.pem > ciphers = ALL:!ADH:+RC4:@STRENGTH > key = /usr/local/etc/stunnel/stunnel.pem > session = 300 seconds > sslVersion = SSLv3 for client, all for server > TIMEOUTbusy = 300 seconds > TIMEOUTclose = 60 seconds > TIMEOUTconnect = 10 seconds > TIMEOUTidle = 43200 seconds > verify = none My stunnel config file: > cert = /usr/local/etc/stunnel/stunnel.pem > key = /usr/local/etc/stunnel/stunnel.pem > sslVersion = SSLv3 > chroot = /var/lib/stunnel/ > setuid = 99 > setgid = 99 > pid = /stunnel.pid > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > client = yes > [nntps] > accept = 127.0.0.1:119 > connect = secure.news.easynews.com:563 Again, it is all working, and aside from my TCP_NODELAY flags, everything in my conf would be a show-stopper if it was invalid or not working... *of note: I had to set the uid/gid number. for some reason it couldn't resolve the gid/uid on it's own. My /etc/passwd is world-readable (with hashes in shadow) as is standard. I'm not sure I should even be worried about this...

2 2

Reporting bugs in stunnel 4.21
by Michal Trojnara 10 Nov '07

10 Nov '07

Dear Users, Please test the new stunnel 4.21 and report your issues on the Bug Tracking System (http://stunnel.mirt.net/bts.html) or email the information to the stunnel-users mailing list. This is the easiest way to help stunnel working fine on your various systems. I was developing it for quite a long time and I likely failed to fix all the bugs. I'm especially interested in all compilation or runtime issues with the new FIPS and libwrap code. By the time you can find a patch for setuid/setgid+chroot problem here: ftp://stunnel.mirt.net/stunnel/setuid.patch Best regards, Mike

2 2

How is it working?
by fuzzy_4711 07 Nov '07

07 Nov '07

Hello list. After a few tries, my stunnel configuration is working well. I am using it to tunnel my vnc connections to my winXP box. Now I have a question about how the software is working. In the past, when I was using VNC at port 5900 and I did a telnet to that box with port 5900, VNC was answering with something like 003005 which was the VNC protocol version the server was able to communicate. Now because of the tunneling effect, my vnc server still listens at 127.0.0.1:5900 but is expecting ssled connections at xxx.xxx.xxx.xxx:9999. When I do a telnet at xxx.xxx.xxx.xxx at port 9999 my box is answering something like: Connected to xxx.xxx.xxx.xxx Escape character is ... Now if enter something like "test" the telnet window shows me that the connection is closed by foreign host (means: my xp box). Lets assume, someone is trying to hack my computer and doing a port scan. She/he will find out for sure, that my port 9999 is opened. Usually the server listening behind the port is sending something the attacker could use to point to the software running behind the port. In this case, as far as I can see nothing is sent to give a hint that stunnel is waiting there to route my connection attempt to 127.0.0.1:5900. Is it right, that this is the magic - for sure besides encryption and all the algorithms necessary to do the port forwarding - stunnel provides? I mean as long as an attacker doesnt know what is hiding behind the port he/she also doesnt know how to attack or how to get through. Is that conclusion right? Please tell me, if my conclusions are wrong or if I got something wrong. Stefan

3 2

PATCH: Support PostgreSQL SSL
by Marko Kreen 06 Nov '07

06 Nov '07

PostgreSQL protocol has small handshake on connecting before SSL can be initialized. But that means that Stunnel cannot be used by default as it expects the SSL initialization to be the first thing when getting connection. Attached patch adds PostgreSQL protocol support to Stunnel, so that Stunnel can be used to provide SSL when either client or server is not able to do it natively. SSL handshake is described here: http://www.postgresql.org/docs/8.3/static/protocol-flow.html#AEN73013 Patch is tested and works, hopefully it can be included in main Stunnel source. -- marko

1 0

STUNNEL Licensing
by Menon, Sreejith Mohan 06 Nov '07

06 Nov '07

Dear Users, Is there any special licensing required to use STUNNEL ? In case, it is not required from STUNNEL , is there anything to be done on the OPENSSL side ? Thanks and best regards, Sreejith Mohan Menon

1 0

Re: [stunnel-users] almost working
by Tom Allison 05 Nov '07

05 Nov '07

Luke Deller wrote: > Hi Tom, > >> OK, this has been nothing but a bust. > > I've just read this thread, and it looks to me that you have stunnel configured incorrectly for use with inetd. > > Did you see this documentation? > http://www.stunnel.org/faq/stunnel.html#inetd_mode > >> the error keeps saying that port 993 is already in use. > > This is because you have configured stunnel to bind to port 993 using an "accept" option in the configuration file. When using stunnel with inetd, stunnel should not bind to any port; it is inetd which binds to a port. When a client connects to inetd, then inetd will launch stunnel with stunnel's stdin and stdout streams hooked up to the connected socket. > Made some progress. Got past the SSL version. Fixed my firewall to permit IMAPS sessions. confirmed my firewall settings by changing to IMAP and running directly against the imap server. Changed firewall settings from imap to imaps. Keep timing out. Same problem for Mac Mail application (which isn't great) and Debian's Icedove. This is as far as I can get. 2007.11.05 05:43:56 LOG7[27692:47518144360528]: Connection from 65.29.101.30:49841 permitted by libwrap 2007.11.05 05:43:56 LOG5[27692:47518144360528]: inetd connected from 65.29.101.30:49841 2007.11.05 05:43:56 LOG7[27692:47518144360528]: SSL state (accept): before/accept initialization 2007.11.05 05:43:56 LOG7[27692:47518144360528]: SSL state (accept): SSLv3 read client hello A 2007.11.05 05:43:56 LOG7[27692:47518144360528]: SSL state (accept): SSLv3 write server hello A 2007.11.05 05:43:56 LOG7[27692:47518144360528]: SSL state (accept): SSLv3 write certificate A 2007.11.05 05:43:56 LOG7[27692:47518144360528]: SSL state (accept): SSLv3 write server done A 2007.11.05 05:43:56 LOG7[27692:47518144360528]: SSL state (accept): SSLv3 flush data

1 0

Re: [stunnel-users] Using stunnel for RDP / Proxy / Firewall
by Frank Garber 30 Oct '07

30 Oct '07

I tried using the port you suggested and got the same result. I'm able to verify my firewall is letting the traffic through and that my ISP is not blocking the port by using www.canyouseeme.org . Again, all my settings work when I'm not going through the corporate firewall. Can you send me your whole config file for both your client and server sides? I'm wondering if it has to do with my certificate settings. Thanks, Frank ----- Original Message ---- From: Carter Browne <xxxx> To: garberfc <xxxx> Sent: Monday, October 22, 2007 8:07:11 AM Subject: Re: [stunnel-users] Using stunnel for RDP / Proxy / Firewall I do this all the time. The way I do it is to connect locally to RDP on a non-stardard port. In the RDP dialog box, I have 127.0.0.10:12121, then in stunnel on the local side is: [xxx-rdp] accept = 127.0.0.10:12121 connect = server:12122 client = yes on the remote side is [rdp-incoming] accept = 12122 connect = 3389 client = no. Normally RDP listens for any connection to port 3389, so I found it was easiest to get to to work by moving off that port. Note that you have to open port 12122 in the firewall on the remote side. On the other hand, you can close 3389 on the remote side which takes away an obvious port for hackers. Carter garberfc wrote: > Hi All > > I'm a relative newbie to Stunnel, and am trying to set up a tunnel so I can > Remote Desktop from work to my PC/server at home. > > I'm using versions 4.20 of the Windows binaries. > > I've tested the configuration and it works from home using a laptop that is > going through my firewall > when I enter my domain home (so my firewall is set up correctly). I tried a > variety of common ports and got the same response every time. I had to use > the 127.0.0.2 on the client because Remote Desktop didn't want me connecting > to myself... > > When I try if from work I get a dialog box: > The client could not establish a connection to the remote computer. > The most likely causes for this error are: > 1) Remote connections might not be enabled at the remote computer. > 2)The maximum number of connections was exceeded at the remote computer. > 3) A network error occurred while establishing the connection. > > My config is as follows: > > #Client > ;cert = stunnel.pem > ;key = stunnel.pem > > ; Some performance tunings > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > > ; Some debugging stuff useful for troubleshooting > debug = 7 > output = stunnel.log > > ; Use it for client mode > client = yes > > ; Service-level configuration > [https-RDT] > accept = 127.0.0.2:3389 > connect = xx.xx.xx.xx:1494 > > > #Server > ; Some performance tunings > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > > ; Some debugging stuff useful for troubleshooting > debug = 7 > output = stunnel.log > > ; Use it for client mode > client = no > > ; Service-level configuration > [https-RDT] > accept = 1494 > connect = localhost:3389 > > > Is there something I need to do to traverse this proxy? Any help would be > greatly appreciated! > >

3 4

Re: [stunnel-users] almost working
by Tom Allison 30 Oct '07

30 Oct '07

On Oct 29, 2007, at 9:39 PM, Luke Deller wrote: > > Hi Tom, > >> OK, this has been nothing but a bust. > > I've just read this thread, and it looks to me that you have > stunnel configured incorrectly for use with inetd. > > Did you see this documentation? > http://www.stunnel.org/faq/stunnel.html#inetd_mode > >> the error keeps saying that port 993 is already in use. > > This is because you have configured stunnel to bind to port 993 > using an "accept" option in the configuration file. When using > stunnel with inetd, stunnel should not bind to any port; it is > inetd which binds to a port. When a client connects to inetd, then > inetd will launch stunnel with stunnel's stdin and stdout streams > hooked up to the connected socket. Amazing how much progess can be made in a minute. Thank you very much. I did miss that line in the docs. I've moved on to a slightly different error, but it's probably going to be easier for me to sort this one out. I have to go to out, so I'll read up on it and try it when I get back. I'm going to guess I have a ssl version/imap version issue to sort out. I'm trying to connect from a macbook to this server. Thank You!!! 2007.10.30 07:07:59 LOG5[22402:47915096707152]: stunnel 4.18 on x86_64-pc-linux-gnu with OpenSSL 0.9.8c 05 Sep 2006 2007.10.30 07:07:59 LOG5[22402:47915096707152]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2007.10.30 07:07:59 LOG7[22402:47915096707152]: inetd started 2007.10.30 07:07:59 LOG7[22402:47915096707152]: FD 0 in non-blocking mode 2007.10.30 07:07:59 LOG7[22402:47915096707152]: FD 1 in non-blocking mode 2007.10.30 07:07:59 LOG7[22402:47915096707152]: TCP_NODELAY option set on local socket 2007.10.30 07:07:59 LOG7[22402:47915096707152]: FD 4 in non-blocking mode 2007.10.30 07:07:59 LOG7[22402:47915096707152]: FD 5 in non-blocking mode 2007.10.30 07:07:59 LOG7[22402:47915096707152]: Connection from 65.29.101.30:53036 permitted by libwrap 2007.10.30 07:07:59 LOG5[22402:47915096707152]: inetd connected from 65.29.101.30:53036 2007.10.30 07:07:59 LOG7[22402:47915096707152]: SSL state (accept): before/accept initialization 2007.10.30 07:07:59 LOG3[22402:47915096707152]: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2007.10.30 07:07:59 LOG5[22402:47915096707152]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.10.30 07:07:59 LOG7[22402:47915096707152]: inetd finished (0 left)

1 0

almost working
by Tom Allison 30 Oct '07

30 Oct '07

I'm trying to tunnel imap but I'm not getting past this: 2007.10.08 05:56:28 LOG5[5355:47656983060560]: stunnel 4.18 on x86_64-pc-linux-gnu with OpenSSL 0.9.8c 05 Sep 2006 2007.10.08 05:56:28 LOG5[5355:47656983060560]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2007.10.08 05:56:28 LOG6[5355:47656983060560]: file ulimit = 1024 (can be changed with 'ulimit -n') 2007.10.08 05:56:28 LOG6[5355:47656983060560]: poll() used - no FD_SETSIZE limit for file descriptors 2007.10.08 05:56:28 LOG5[5355:47656983060560]: 500 clients allowed 2007.10.08 05:56:28 LOG7[5355:47656983060560]: FD 4 in non-blocking mode 2007.10.08 05:56:28 LOG7[5355:47656983060560]: FD 5 in non-blocking mode 2007.10.08 05:56:28 LOG7[5355:47656983060560]: FD 6 in non-blocking mode 2007.10.08 05:56:28 LOG7[5355:47656983060560]: SO_REUSEADDR option set on accept socket 2007.10.08 05:56:28 LOG3[5355:47656983060560]: Error binding imaps to 0.0.0.0:993 2007.10.08 05:56:28 LOG3[5355:47656983060560]: bind: Address already in use (98) I can't find where to begin. I set SO_REUSEADDR and it didn't do anything different. How do I test this stuff sanely?

4 8

stunnel 4.21 released
by Michal Trojnara 27 Oct '07

27 Oct '07

Dear Users, The new version is available for download on: ftp://stunnel.mirt.net/stunnel/ Version 4.21, 2007.10.27, urgency: LOW/EXPERIMENTAL: * New features sponsored by Open-Source Software Institute - Initial FIPS 140-2 support (see INSTALL.FIPS for details). Win32 platform is not currently supported. * New features - Experimental fast support for non-MT-safe libwrap is provided with pre-spawned processes. - Stunnel binary moved from /usr/local/sbin to /usr/local/bin in order to meet FHS and LSB requirements. Please delete the /usr/local/sbin/stunnel when upgrading. - Added code to disallow compiling stunnel with pthreads when OpenSSL is compiled without threads support. - Win32 DLLs for OpenSSL 0.9.8g. - Minor manual update. - TODO file updated. * Bugfixes - Dynamic locking callbacks added (needed by some engines to work). - AC_ARG_ENABLE fixed in configure.am to accept yes/no arguments. - On some systems libwrap requires yp_get_default_domain from libnsl, additional checking was added. - Sending a list of trusted CAs for the client to choose the right certificate restored. - Some compatibility issues with NTLM authentication fixed. - Taskbar icon (unless there is a config file parsing error) and "Save As" disabled in the service mode for local Win32 security (it's much like Yeti -- some people claim they have seen it). sha1 hash for stunnel-4.21.tar.gz file: 7785c45167d902aa728b839adee02a8cc056d86a Best regards, Mike

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 39, Issue 16
by Frank Garber 24 Oct '07

24 Oct '07

I tested with my firewall with both PCs at home. I can make it work with the port open and when I close the port it fails. it's only when I try to connect from behind the corporate firewall that it fails. I've tried several other port numbers and always get the same results. Can you send me your entire client and server config files so I can see the settings? Thanks, Frank ----- Original Message ---- From: "stunnel-users-request(a)mirt.net" <stunnel-users-request(a)mirt.net> To: stunnel-users(a)mirt.net Sent: Tuesday, October 23, 2007 6:00:06 AM Subject: stunnel-users Digest, Vol 39, Issue 16 Send stunnel-users mailing list submissions to stunnel-users(a)mirt.net To subscribe or unsubscribe via the World Wide Web, visit http://stunnel.mirt.net/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)mirt.net You can reach the person managing the list at stunnel-users-owner(a)mirt.net When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. [RE] Using stunnel for RDP / Proxy / Firewall (Algol Tradent) Hello, I think your problem might be related to your configuration firewall/router. Have you enabled port-forwarding for the connection? >From your configuration files I can see you are using port 1494. Check that you are forwarding that port. Also make sure you configure any firewall software running on the machine you want to connect to, in order to allow connections. Best Regards __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

[RE] Using stunnel for RDP / Proxy / Firewall
by Algol Tradent 22 Oct '07

22 Oct '07

Hello, I think your problem might be related to your configuration firewall/router. Have you enabled port-forwarding for the connection? >From your configuration files I can see you are using port 1494. Check that you are forwarding that port. Also make sure you configure any firewall software running on the machine you want to connect to, in order to allow connections. Best Regards __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Using stunnel for RDP / Proxy / Firewall
by garberfc 20 Oct '07

20 Oct '07

Hi All I'm a relative newbie to Stunnel, and am trying to set up a tunnel so I can Remote Desktop from work to my PC/server at home. I'm using versions 4.20 of the Windows binaries. I've tested the configuration and it works from home using a laptop that is going through my firewall when I enter my domain home (so my firewall is set up correctly). I tried a variety of common ports and got the same response every time. I had to use the 127.0.0.2 on the client because Remote Desktop didn't want me connecting to myself... When I try if from work I get a dialog box: The client could not establish a connection to the remote computer. The most likely causes for this error are: 1) Remote connections might not be enabled at the remote computer. 2)The maximum number of connections was exceeded at the remote computer. 3) A network error occurred while establishing the connection. My config is as follows: #Client ;cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [https-RDT] accept = 127.0.0.2:3389 connect = xx.xx.xx.xx:1494 #Server ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = no ; Service-level configuration [https-RDT] accept = 1494 connect = localhost:3389 Is there something I need to do to traverse this proxy? Any help would be greatly appreciated! -- View this message in context: http://www.nabble.com/Using-stunnel-for-RDP---Proxy---Firewall-tf4654985.ht… Sent from the Stunnel - Users mailing list archive at Nabble.com.

1 0

scaling stunnel
by Ben Hartshorne 19 Oct '07

19 Oct '07

Hi, I am trying to set up syslog + stunnel in a large environment. I am curious about the experience of members of this mailing list regarding how stunnel + syslog-ng scale. I set up a test environment using stunnel 3.26 (because that's what is in my debian installation)[*]. I configured stunnel to run as a daemon (starting on boot), and syslog passes off messages and receives messages from localhost:514. In the stunnel log, it tells me that there is a limit of 500 clients, and it seems that with stunnel 3.x, it must be recompiled to increase this limit. I found some posts on this list that say that while stunnel 3.x uses select(), stunnel 4.x uses poll(), which is much more efficient. So I figure that if I will have to roll my own package, I may as well upgrade to 4.x at the same time. Agree? If so, which version? It's my understanding that this configuration will create a persistent connection between the client and server, holding it open until such time as syslog needs to send a message across it. How many clients have you experienced being able to connect to the log aggregator? My logs are rather sparse, so I expect I will hit a limit based on processor / filehandle / memory usage before I start overloading the local disk. Eventually, I realize that I will have to build a tree structure with intermediate nodes aggregating logs and passing them on to the central host, but I would like to know where people have hit that limit. I would love to have ~5000 clients connected to each aggregating server. Is this within the realm of experience? Does anybody have tuning suggestions for such high numbers of connections? I saw one person mention on the mailing list that compiling without libwrap allowed him to pass ~2500 connections (though he didn't give a new ceiling). Thanks, -ben [*] I was actually impressed at how easy this was. Aside from having to write my own /etc/init.d/ scripts to start the client and server, I could bring down either end of the stunnel connection, and things would just pick up where they left off when the tunnel was reconnected. Add monit into the picture and you've got a nice resilient secure logging system. Slick! -- Ben Hartshorne email: ben(a)hartshorne.net http://ben.hartshorne.net

2 5

SSL Accelerator card and Stunnel
by domstra＠alice.it 16 Oct '07

16 Oct '07

Hi all, We are using STunnel v.3.x and STunnel v.4.x on different systems (Application Servers and DB Servers, on HP and Sun mainframe hardware). We have noticed that the STunnel load is quite heavy for the CPUs of each Server. So, we are beginning to study and analyze a solution that allows we to use STunnel without generate overhead on the CPUs. A good solution could be using a SSL Accelerator card as "SSL engine", in order to offloading the calls to the card CPU. We have also read the following topic in your mailing-list regarding a solutions similar to ours: List: stunnel-users Subject: SSL Accelerator supporto for Stunnel Can you suggest us a list of "SSL Accelerator card" model (and vendor) to install and configure with STunnel? Anyway, do you suggest us to upgrade the STunnel version to the last stable on each Server? Thanks in advance for the support. Awaiting for your kind feedback and suggestions. Best Regards. Dom *********** Scopri la nuova Alice Mail! <http://registra.rossoalice.alice.it/registra/basic/entratabasic.do?entryPoi…> 1 GB di spazio con antivirus, antispam e fino a 2 GB di allegati. <http://registra.rossoalice.alice.it/registra/basic/entratabasic.do?entryPoi…> Registrati GRATIS <http://registra.rossoalice.alice.it/registra/basic/entratabasic.do?entryPoi…>

4 8

stunnel and pan newsreader configuration
by Kernel Panic 13 Oct '07

13 Oct '07

I am attempting to use stunnel to connect securely to a snntp server using pan 0.132. The stunnel install was successful, but when attempting to connect to the server using pan, I either receive a "connection refused" or "connection reset by peer" in the pan error log. Here is the stunnel.log: 2007.10.13 11:16:43 LOG5[5843:3082667712]: stunnel 4.20 on i686-pc-linux-gnu with OpenSSL 0.9.8e 23 Feb 2007 2007.10.13 11:16:43 LOG5[5843:3082667712]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Auth:LIBWRAP 2007.10.13 11:16:43 LOG6[5843:3082667712]: file ulimit = 1024 (can be changed with 'ulimit -n') 2007.10.13 11:16:43 LOG6[5843:3082667712]: poll() used - no FD_SETSIZE limit for file descriptors 2007.10.13 11:16:43 LOG5[5843:3082667712]: 500 clients allowed 2007.10.13 11:16:43 LOG7[5843:3082667712]: FD 4 in non-blocking mode 2007.10.13 11:16:43 LOG7[5843:3082667712]: FD 5 in non-blocking mode 2007.10.13 11:16:43 LOG7[5843:3082667712]: FD 6 in non-blocking mode 2007.10.13 11:16:43 LOG7[5843:3082667712]: SO_REUSEADDR option set on accept socket 2007.10.13 11:16:43 LOG7[5843:3082667712]: NNTP bound to 127.0.0.1:23 2007.10.13 11:16:43 LOG7[5843:3082667712]: Created pid file /home/kpanic/download/stunnel//var/run/stunnel/stunnel.pid 2007.10.13 11:17:00 LOG7[5843:3082667712]: NNTP accepted FD=7 from 127.0.0.1:1085 2007.10.13 11:17:00 LOG7[5843:3085958032]: NNTP started 2007.10.13 11:17:00 LOG7[5843:3085958032]: FD 7 in non-blocking mode 2007.10.13 11:17:00 LOG7[5843:3085958032]: FD 8 in non-blocking mode 2007.10.13 11:17:00 LOG7[5843:3085958032]: FD 9 in non-blocking mode 2007.10.13 11:17:00 LOG7[5843:3082667712]: Cleaning up the signal pipe 2007.10.13 11:17:00 LOG6[5843:3082667712]: Child process 5855 finished with code 0 2007.10.13 11:17:00 LOG7[5843:3085958032]: Connection from 127.0.0.1:1085 permitted by libwrap 2007.10.13 11:17:00 LOG5[5843:3085958032]: NNTP accepted connection from 127.0.0.1:1085 2007.10.13 11:17:00 LOG7[5843:3085958032]: FD 8 in non-blocking mode 2007.10.13 11:17:00 LOG3[5843:3085958032]: bind transparent: Address already in use (98) 2007.10.13 11:17:00 LOG5[5843:3085958032]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.10.13 11:17:00 LOG7[5843:3085958032]: NNTP finished (0 left) 2007.10.13 11:17:00 LOG7[5843:3082667712]: NNTP accepted FD=7 from 127.0.0.1:1086 2007.10.13 11:17:00 LOG7[5843:3085958032]: NNTP started 2007.10.13 11:17:00 LOG7[5843:3085958032]: FD 7 in non-blocking mode 2007.10.13 11:17:00 LOG7[5843:3085958032]: FD 8 in non-blocking mode 2007.10.13 11:17:00 LOG7[5843:3085958032]: FD 9 in non-blocking mode 2007.10.13 11:17:00 LOG7[5843:3082667712]: Cleaning up the signal pipe 2007.10.13 11:17:00 LOG7[5843:3085958032]: Connection from 127.0.0.1:1086 permitted by libwrap 2007.10.13 11:17:00 LOG5[5843:3085958032]: NNTP accepted connection from 127.0.0.1:1086 2007.10.13 11:17:00 LOG6[5843:3082667712]: Child process 5857 finished with code 0 2007.10.13 11:17:00 LOG7[5843:3085958032]: FD 8 in non-blocking mode 2007.10.13 11:17:00 LOG3[5843:3085958032]: bind transparent: Address already in use (98) 2007.10.13 11:17:00 LOG5[5843:3085958032]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.10.13 11:17:00 LOG7[5843:3085958032]: NNTP finished (0 left) 2007.10.13 11:17:05 LOG7[5843:3082667712]: NNTP accepted FD=7 from 127.0.0.1:1087 2007.10.13 11:17:05 LOG7[5843:3085958032]: NNTP started 2007.10.13 11:17:05 LOG7[5843:3085958032]: FD 7 in non-blocking mode 2007.10.13 11:17:05 LOG7[5843:3085958032]: FD 8 in non-blocking mode 2007.10.13 11:17:05 LOG7[5843:3085958032]: FD 9 in non-blocking mode 2007.10.13 11:17:05 LOG7[5843:3082667712]: Cleaning up the signal pipe 2007.10.13 11:17:05 LOG7[5843:3085958032]: Connection from 127.0.0.1:1087 permitted by libwrap 2007.10.13 11:17:05 LOG5[5843:3085958032]: NNTP accepted connection from 127.0.0.1:1087 2007.10.13 11:17:05 LOG6[5843:3082667712]: Child process 5860 finished with code 0 2007.10.13 11:17:05 LOG7[5843:3085958032]: FD 8 in non-blocking mode 2007.10.13 11:17:05 LOG3[5843:3085958032]: bind transparent: Address already in use (98) 2007.10.13 11:17:05 LOG5[5843:3085958032]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.10.13 11:17:05 LOG7[5843:3085958032]: NNTP finished (0 left) 2007.10.13 11:17:10 LOG7[5843:3082667712]: NNTP accepted FD=7 from 127.0.0.1:1088 2007.10.13 11:17:10 LOG7[5843:3085958032]: NNTP started 2007.10.13 11:17:10 LOG7[5843:3085958032]: FD 7 in non-blocking mode 2007.10.13 11:17:10 LOG7[5843:3085958032]: FD 8 in non-blocking mode 2007.10.13 11:17:10 LOG7[5843:3085958032]: FD 9 in non-blocking mode 2007.10.13 11:17:10 LOG7[5843:3082667712]: Cleaning up the signal pipe 2007.10.13 11:17:10 LOG7[5843:3085958032]: Connection from 127.0.0.1:1088 permitted by libwrap 2007.10.13 11:17:10 LOG5[5843:3085958032]: NNTP accepted connection from 127.0.0.1:1088 2007.10.13 11:17:10 LOG6[5843:3082667712]: Child process 5863 finished with code 0 2007.10.13 11:17:10 LOG7[5843:3085958032]: FD 8 in non-blocking mode 2007.10.13 11:17:10 LOG3[5843:3085958032]: bind transparent: Address already in use (98) 2007.10.13 11:17:10 LOG5[5843:3085958032]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.10.13 11:17:10 LOG7[5843:3085958032]: NNTP finished (0 left) 2007.10.13 11:17:15 LOG7[5843:3082667712]: NNTP accepted FD=7 from 127.0.0.1:1089 2007.10.13 11:17:15 LOG7[5843:3085958032]: NNTP started 2007.10.13 11:17:15 LOG7[5843:3085958032]: FD 7 in non-blocking mode 2007.10.13 11:17:15 LOG7[5843:3085958032]: FD 8 in non-blocking mode 2007.10.13 11:17:15 LOG7[5843:3085958032]: FD 9 in non-blocking mode 2007.10.13 11:17:15 LOG7[5843:3082667712]: Cleaning up the signal pipe 2007.10.13 11:17:15 LOG7[5843:3085958032]: Connection from 127.0.0.1:1089 permitted by libwrap 2007.10.13 11:17:15 LOG5[5843:3085958032]: NNTP accepted connection from 127.0.0.1:1089 2007.10.13 11:17:15 LOG7[5843:3085958032]: FD 8 in non-blocking mode 2007.10.13 11:17:15 LOG6[5843:3082667712]: Child process 5866 finished with code 0 2007.10.13 11:17:15 LOG3[5843:3085958032]: bind transparent: Address already in use (98) 2007.10.13 11:17:15 LOG5[5843:3085958032]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.10.13 11:17:15 LOG7[5843:3085958032]: NNTP finished (0 left) Here is the snnt.conf file: # Debug debug = 7 output = /home/kpanic/download/stunnel/stunnel.log # Use it for client mode client = yes foreground = yes [NNTP] protocol = nntp protocolusername = username protocolpassword = password transparent = yes accept = localhost:23 connect = secure.server.com:563 Here is the pan error log: Sat Oct 13 10:46:50 2007 - Error reading from localhost: Connection reset by peer Sat Oct 13 10:46:55 2007 - Error reading from localhost: Connection reset by peer Sat Oct 13 10:47:00 2007 - Error reading from localhost: Connection reset by peer Sat Oct 13 10:47:05 2007 - Error reading from localhost: Connection reset by peer Sat Oct 13 10:47:10 2007 - Error reading from localhost: Connection reset by peer Changing the server setup in pan to look at 127.0.0.1 Sat Oct 13 10:45:40 2007 - Pan 0.132 started Sat Oct 13 10:45:40 2007 - Loaded data backend in 0.0 seconds Sat Oct 13 10:45:47 2007 - Error reading from 127.0.0.1: Connection reset by peer Sat Oct 13 10:45:50 2007 - Error reading from 127.0.0.1: Connection reset by peer Sat Oct 13 10:45:55 2007 - Error reading from 127.0.0.1: Connection reset by peer Sat Oct 13 10:46:00 2007 - Error reading from 127.0.0.1: Connection reset by peer Pan configuration: Address: localhost Port: 23 Username: username Password: password uname -r 2.6.22.9-0.4-bigsmp suse 10.3 Any assistance would be greatly appreciated. Thanks - Tim --------------------------------- Moody friends. Drama queens. Your life? Nope! - their life, your story. Play Sims Stories at Yahoo! Games.

1 0

configuration help
by Tom Allison 12 Oct '07

12 Oct '07

I posted an email a couple days ago and noticed that there isn't any traffic on this mailing list. Is this active/current?

1 0

Stunnel Return Codes - How do I see them in a batch file?
by Robert Lambrecht 10 Oct '07

10 Oct '07

I have Stunnel working successfully in a batch file. I would like to write the error codes in case there is an issue. How do you do this? In Windows, I could do something like: "C:\Program Files\stunnel\stunnel.exe" -start -quiet stunnel.conf goto %errorlevel% :0 :: Normal Return - Complete Batch Process goto :EOF :1 :: Errors - Log them Would this work or how do I get the stunnel return codes? Bob

1 0

Wildcard usage
by Knight Tiger 08 Oct '07

08 Oct '07

Hi, I am new to STUNNEL and I find it very useful for what I am doing right now. I would like to know if STUNNEL does support the functionality I require. I shall describe the situation below. I run a SIP messaging server (SIP is a VoIP protocol used to establish voice calls over the Internet). STUNNEL is running on the same machine as the SIP server. The SIP server listens on a specific port say 8000 so I have in the config file [sip-new] accept = 10000 connect = localhost:8000 and it works beautifully as the client sends the message through a SSL connection to port 10000 on the machine. So far so good. Now I need the server to send a message to the client. SIP server -----> STUNNEL ------> client . Here STUNNEL acts as a SSL client and the client acts as the SSL server. (Both the client and STUNNEL support this functionality), so in the config file I have [sip-client] accept = 11000 connect = ?:8000 How can I code in the client IP address (I know the port number where the client's SSL server is listening on) when I dont know the client IP address before hand ? (The client is typically assigned IP address by a DHCP server) and I will have more than one client which would be acting as a server. The SIP server will know the client's IP address when the client sends a request. (SIP server can determine the IP address from the SIP message and not from the IP header) . So now the message from the SIP server will have the client's IP address but STUNNEL does not have a config for that IP address (since it is dynamic and I need to support many clients) and hence STUNNEL will not create a SSL tunnel to the client. Can I have wildcard for the IP address ? something like [sip-client] accept = 11000 connect = *:8000 and have STUNNEL get the destination IP from the message ? I thank you all in advance, Warm Regards Knight

1 0

Stunnel on the same machine
by subrata＠indiatimes.com 05 Oct '07

05 Oct '07

Hi I want to configure to encrypt mysql both client and server on the same machine. Ie the /usr/local/mysql/bin/mysql -u root -p on the same machine where my mysql daemon is located. How to achieve this. regards Subrata -- My life has changed. What about yours? Log on to the new Indiatimes Mail and Live out of the Inbox!

3 3

Re: [stunnel-users] stunnel-users Digest, Vol 38, Issue 14
by sreejith 04 Oct '07

04 Oct '07

Hi, What you have understood is correct. We are the provider of the Web Service; and my requirement is something as explained below, The end users are using a Web site and the data entered in the web site will be converted to an XML file and send to the Web Service which we have provided. The end users are using STUNNEL to encrypt the XML files before sending to us. Hence, I need to decrypt the message and process it. Hence, I think I need to use STUNNEL for doing the same. Also, upon request from the end users I need to send some data, again it is XML files; and I need to encrypt this using STUNNEL and send it to the end user. I am new to STUNNEL and went through the examples provided in www.stunnel.org and didn't get a very good idea on how to get this done. I hope, I am able to make it clear this time. Best regards, Sreejith On 9/28/07, stunnel-users-request(a)mirt.net <stunnel-users-request(a)mirt.net> wrote: > > Send stunnel-users mailing list submissions to > stunnel-users(a)mirt.net > > To subscribe or unsubscribe via the World Wide Web, visit > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)mirt.net > > You can reach the person managing the list at > stunnel-users-owner(a)mirt.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. Re: Stunnel Dies at 3500 connections... (bear(a)bears.org) > 2. Re: Using Stunnel (Luis Rodrigo Gallardo Cruz) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 27 Sep 2007 11:18:36 -0400 (EDT) > From: bear(a)bears.org > Subject: Re: [stunnel-users] Stunnel Dies at 3500 connections... > To: stunnel-users(a)mirt.net > Message-ID: <Pine.LNX.4.64.0709271117350.31308(a)ferocity.bears.org> > Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed > > On Wed, 26 Sep 2007, Michal Trojnara wrote: > > > Try to disable libwrap first: > > ./configure --disable-libwrap > > make clean > > make > > make install > > It is a bottleneck for this kind of tests. > > PERFECT! Thank you very much! That seems to have sorted out my troubles. > The load average stayed well within what I expected. I've got a hardware > firewall protecting the machine, so libwrap wasn't helping me anyhow. > > Peace, > Gary > > ********* ***** ** Gary Coulbourne > *************************.* Bear Activist > ****** *********** ** *******o > ******* ********* **** ****`- Systems Administrator > ******* ********* ***** http://www.bears.org > ****** ********** **** bear(a)bears.org > ## ***** ***** ## **** KB3INA > ### ***** ### **** Animal Conservation/Preservation > #,,, ***,,, ##,,, **,,, > > > ------------------------------ > > Message: 2 > Date: Thu, 27 Sep 2007 12:23:58 -0500 > From: Luis Rodrigo Gallardo Cruz <rodrigo(a)nul-unu.com> > Subject: Re: [stunnel-users] Using Stunnel > To: stunnel-users(a)mirt.net > Message-ID: <20070927172358.GB4459(a)caribdis.nul-unu.com> > Content-Type: text/plain; charset="us-ascii" > > On Thu, Sep 27, 2007 at 02:46:53PM +0530, sreejith wrote: > > Dear friends, > > > > I have a requirement where in I have a web service that uses STUNNEL for > > encrypting and decrypting XML messages. Please help me out with how to > > proceed ? What needs to be done ? How the configuration file should be ? > > Your question is a little confusing. I assume you are trying to encrypt > the > http traffic that the web service travels over. Otherwise, if you want > to have unencrypted http carrying encripted xml, stunnel is not for you. > > In any case, are you the provider or the consumer for the web service? > > -- > Rodrigo Gallardo > GPG-Fingerprint: 7C81 E60C 442E 8FBC D975 2F49 0199 8318 ADC9 BC28 >

1 0

Re: [stunnel-users] Stunnel Testing
by Robert Lambrecht 04 Oct '07

04 Oct '07

I changed BLAT to a port on the local host and set up Stunnel as suggested on a port other than 25. Everything works well. I will have to play with WireShark to see if SSL works. Thanks for the information. Bob

1 0

Re: [stunnel-users] Stunnel Testing
by Luis Rodrigo Gallardo Cruz 30 Sep '07

30 Sep '07

On Sat, Sep 29, 2007 at 05:23:29PM -0500, Robert Lambrecht wrote: > I am using a command line mailer (BLAT) from a batch file to notify me when > errors occur. My ISP requires SSL however still allows non-SSL traffic on > Port 25 as well. > > I then use Stunnel with the following config: > > [smtps] > accept = 25 > connect = smtp.isp.domain.net:465 > > Port 465 is the SSL port for my ISP. > > I run Stunnel as a service in Vista. > > I then have BLAT send an SMTP message on Port 25 to my ISP. This works. stunnel is listening on port 25 *of your machine*, not your isp's. Thus, you need to have BLAT send it to localhost, port 25. Better yet, to avoid confussion, have stunnel listen on some other port (456 would be a good choice), and have BLAT send to localhost, on that port. To check you're not sending anything on the clear, install a network sniffer (wireshark is good) and have it show your network trafic to your.isp.com. If you can read the mail in the displayed traffic, you're sending in cleartext ;-)

1 0

Stunnel Testing
by Robert Lambrecht 29 Sep '07

29 Sep '07

I am using a command line mailer (BLAT) from a batch file to notify me when errors occur. My ISP requires SSL however still allows non-SSL traffic on Port 25 as well. Here is my scenario: I use BLAT to send an SMTP message on Port 25 to my ISP. This works but I must send my userid and password which I don't want to do. I then use Stunnel with the following config: [smtps] accept = 25 connect = smtp.isp.domain.net:465 Port 465 is the SSL port for my ISP. I run Stunnel as a service in Vista. I then have BLAT send an SMTP message on Port 25 to my ISP. This works. My question is, everything seems to work but how can I test this? I'm trying to figure out if it really worked (I sent the message with SSL to port 465) or I am still just sending a message on Port 25. Since both of these cases work, it is hard for me to tell. I've tried to telnet to these ports; however, since I basically have to specify port 25 in either case for the test, I'm not sure that I am successful. Any thoughts on how to make sure my messages are going through SSL? Bob

1 0

stunnel-users Digest, Vol 38, Issue 14
by Menon, Sreejith Mohan 28 Sep '07

28 Sep '07

Hi, What you have understood is correct. We are the provider of the Web Service; and my requirement is something as explained below, The end users are using a Web site and the data entered in the web site will be converted to an XML file and send to the Web Service which we have provided. The end users are using STUNNEL to encrypt the XML files before sending to us. Hence, I need to decrypt the message and process it. Hence, I think I need to use STUNNEL for doing the same. Also, upon request from the end users I need to send some data, again it is XML files; and I need to encrypt this using STUNNEL and send it to the end user. I am new to STUNNEL and went through the examples provided in www.stunnel.org and didn't get a very good idea on how to get this done. I hope, I am able to make it clear this time. I was communicating through another email id till now (sreejithmohanm(a)gmail.com) For our future communication, I will be using the present email id. Sorry for the inconvenience. Thanks and best regards, Sreejith Mohan Menon Software Engineer Globalization Services SAP Labs India Pvt. Ltd. 4th Floor 1B, RMZ NXT, Sonnenhalli, K.R. Puram Hobli, East Taluk, Bangalore - 560 066. P - +91 80 4013 4987 M - +91 98863 08088 mailto:[email protected]

1 0

Using Stunnel
by sreejith 27 Sep '07

27 Sep '07

Dear friends, I have a requirement where in I have a web service that uses STUNNEL for encrypting and decrypting XML messages. Please help me out with how to proceed ? What needs to be done ? How the configuration file should be ? Thanks and best regards, Sreejith

2 1

Stunnel Dies at 3500 connections...
by bear＠bears.org 27 Sep '07

27 Sep '07

Hey! I'm having a problem with a stunnel setup I have, and was wondering if anyone could help? I have two machines, one is acting as a simulator of clients. It uses the MINA library from apache to simulate a bunch of clients of the server. And the other acting as a server. Without stunnel in place, the client and server chat with no trouble... even with as many as 10k simulated clients. The protocol they communicate is just compressed binary data over standard TCP/IP. 20-50 bytes each direction per exchange. The behavior changes once stunnel is in place. The server behaves just fine, but the client acts very strange... in ways that make me think that stunnel is hitting some OS limit. (The files ulimit is set waaaaaay higher than the number of clients) On starting the client application, it begins making connections through the stunnel tunnel. The first 1500 or so are fine, but after that the load on the machine begins to climb. It gets to 5 or so around 2000. If I only do 2000 clients, the load then drops down into the 0.5 range, and the system runs okay. However, if I set the number of simulated clients higher... say 4000, the load continues to climb. When it gets to 3500 or so, the load goes above 500. The machine becomes unusable, and after a bit, stunnel dies with the message KILLED. I tried changing how quickly the clients connect, but that seemed to make no difference. Also, running two stunnels for the clients, and sending 2000 to each, for instance, causes it to still break down around 3500 or so. (Which is why I think it is an os limit) Any suggestions on this? Thanks! Peace, Gary version Stunnel 4.20 startup info 2007.09.24 12:09:50 LOG7[26537:3086939840]: RAND_status claims sufficient entropy for the PRNG 2007.09.24 12:09:50 LOG7[26537:3086939840]: PRNG seeded successfully 2007.09.24 12:09:50 LOG4[26537:3086939840]: Wrong permissions on hcs-key-and-cert-1024.pem 2007.09.24 12:09:50 LOG7[26537:3086939840]: Certificate: hcs-key-and-cert-1024.pem 2007.09.24 12:09:50 LOG7[26537:3086939840]: Certificate loaded 2007.09.24 12:09:50 LOG7[26537:3086939840]: Key file: hcs-key-and-cert-1024.pem 2007.09.24 12:09:50 LOG7[26537:3086939840]: Private key loaded 2007.09.24 12:09:50 LOG7[26537:3086939840]: SSL context initialized for service hcsuno 2007.09.24 12:09:50 LOG5[26537:3086939840]: stunnel 4.20 on i686-pc-linux-gnu with OpenSSL 0.9.8d 28 Sep 2006 2007.09.24 12:09:50 LOG5[26537:3086939840]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Auth:LIBWRAP 2007.09.24 12:09:50 LOG6[26537:3086939840]: file ulimit = 80000 (can be changed with 'ulimit -n') 2007.09.24 12:09:50 LOG6[26537:3086939840]: poll() used - no FD_SETSIZE limit for file descriptors 2007.09.24 12:09:50 LOG5[26537:3086939840]: 39062 clients allowed 2007.09.24 12:09:50 LOG7[26537:3086939840]: FD 3 in non-blocking mode 2007.09.24 12:09:50 LOG7[26537:3086939840]: FD 4 in non-blocking mode 2007.09.24 12:09:50 LOG7[26537:3086939840]: FD 5 in non-blocking mode 2007.09.24 12:09:50 LOG7[26537:3086939840]: SO_REUSEADDR option set on accept socket 2007.09.24 12:09:50 LOG7[26537:3086939840]: hcsuno bound to 0.0.0.0:4090 2007.09.24 12:09:50 LOG7[26537:3086939840]: Created pid file /tmp/stunnel1.pid uname -a Linux testbed-client1 2.6.9-42.ELsmp #1 SMP Sat Aug 12 09:39:11 CDT 2006 i686 i686 i386 GNU/Linux libc 2.3.4 stunnel -version stunnel 4.20 on i686-pc-linux-gnu with OpenSSL 0.9.8d 28 Sep 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Auth:LIBWRAP Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none gcc -v Reading specs from /usr/lib/gcc/i386-redhat-linux/3.4.6/specs Configured with: ../configure --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --enable-shared --enable-threads=posix --disable-checking --with-system-zlib --enable-__cxa_atexit --disable-libunwind-exceptions --enable-java-awt=gtk --host=i386-redhat-linux Thread model: posix gcc version 3.4.6 20060404 (Red Hat 3.4.6-3) openssl version OpenSSL 0.9.7a Feb 19 2003 In the config, I have: client=yes debug=debug socket = l:TCP_NODELAY=1 pid = /tmp/stunnel1.pid foreground=yes [hcsuno] accept=4090 connect = testbed-hcs1:4094 cert = hcs-key-and-cert-1024.pem key = hcs-key-and-cert-1024.pem ********* ***** ** Gary Coulbourne *************************.* Bear Activist ****** *********** ** *******o ******* ********* **** ****`- Systems Administrator ******* ********* ***** http://www.bears.org ****** ********** **** bear(a)bears.org ## ***** ***** ## **** KB3INA ### ***** ### **** Animal Conservation/Preservation #,,, ***,,, ##,,, **,,,

2 4

Setting up Stunnel with Gmail.
by Roger 24 Sep '07

24 Sep '07

Hi, A simple question from a technical learner! I use Gmail's POP3 & SMTP [SSL] servers for three Gmail accounts using Thunderbird as my email client. I would like to know EXACTLY how to set up stunnel so that my anti-virus program ( NOD32) can scan messages being sent and received by SSL on ports 995 & 465. I have Open SSL installed: downloaded but not yet installed stunnel set up. I have tried before to use stunnel, but failed as I keep getting message, as I recall, to the effect that localhost is not recognised. There are detailed explanations on the web for configuring with Spampal, but I don't have, or need Spampal! Thanks, Roger

2 1

Re: [stunnel-users] Relaying OOB data [Was: A series of minor patchesfrom Debian]
by Richard's Hotmail 23 Sep '07

23 Sep '07

Hi Luis, Thanks for the detailed reply! > Ok, been reading. The short answer is no. Oh well :-( I guess that's what IPsec's for. > The longer answer is SSL doesn't support OOB data, so that's why > not. I did read your post saying you've read specs where it says it > does, but I could find no such. Take a look at RFC4346, section 6.2 > http://tools.ietf.org/html/rfc4346#page-14 > Take a look also at this thread: > http://www1.ietf.org/mail-archive/web/tls/current/msg01041.html Doesn't that thread suggest that OOB functionality is part of the SSLv3 standard? Is version three one of those "yet to be" standards that is still a long way off? Renamed TLS? (I found several RFCs dealing with this, anyone know which is the relevant one? I couldn't find "Urgent", "OOB" or "band" in 4346) My understanding (imagination maybe) is that the OOB character is to be packaged up as a single byte record surrounded with the SSL wrapper with a bit set that says it's the OOB character. I would now like stunnel just to dequeue it from SSL and then set the MSG_OOB flag and replay it to the application port. So it's sort of quasi-OOB to Stunnel and then true-OOB to the receiving port. > The argument (almost) in full: > - SSL doesn't define anything like OOB data in its streams, so > anything we did in stunnel would be an extension, and not > interoperable. And, anyways, would have to be done in openssl and not > in stunnel, I think. I must be confused about what's available (the only SSL code I've cut is simple Java client stuff) 'cos I'm sure I've seen patch-comments that say something like "make sure stunnel handles OOB data correctly" and isn't there some sort of OOB INLINE configuration parameter. Is there really northing available after the SSL_Read that identifies the data as an OOB character? Anyway, thanks again for the reply. Cheers Richard Maher PS. Does anyone out there know of a lower-level version of Stunnel (or something else) that spoofs the originating host-address when replaying the connection on the local server? It sure would be useful for client identification, and for reducing DoS attacks! ----- Original Message ----- From: "Luis Rodrigo Gallardo Cruz" <rodrigo(a)nul-unu.com> To: <stunnel-users(a)mirt.net> Sent: Tuesday, September 18, 2007 9:14 AM Subject: [stunnel-users] Relaying OOB data [Was: A series of minor patchesfrom Debian] > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

A series of minor patches from Debian
by Luis Rodrigo Gallardo Cruz 23 Sep '07

23 Sep '07

Hello. I have recently become the maintainer for the Debian package of stunnel. During the adoption process I noticed a few things that I think would be good to fix in the code. I will be sending the patches to this list (unless a better place for this is pointed out) as separate mails, to allow them to have individual responses, but thought I'd better introduce myself first. Thank you all, -- Rodrigo Gallardo GPG-Fingerprint: 7C81 E60C 442E 8FBC D975 2F49 0199 8318 ADC9 BC28

4 14

[patch] FSF postal address is outdated
by Luis Rodrigo Gallardo Cruz 14 Sep '07

14 Sep '07

The following long but rather trivial patch fixes up the FSF's postal address in the licencing statements for source files. This is a minor change, mostly for the benefit of tying up loose ends. ---------------------------------------------------------------------- diff --git a/src/client.c b/src/client.c index 6b3c5a4..a578b81 100644 --- a/src/client.c +++ b/src/client.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/common.h b/src/common.h index c666086..f96a537 100644 --- a/src/common.h +++ b/src/common.h @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. */ #ifndef COMMON_H diff --git a/src/ctx.c b/src/ctx.c index 90dbdbc..dd4e01b 100644 --- a/src/ctx.c +++ b/src/ctx.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/env.c b/src/env.c index c195950..cbf105d 100644 --- a/src/env.c +++ b/src/env.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/file.c b/src/file.c index 5075b77..e00a82b 100644 --- a/src/file.c +++ b/src/file.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/gui.c b/src/gui.c index df1d6a8..d820b15 100644 --- a/src/gui.c +++ b/src/gui.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/log.c b/src/log.c index 0e3f927..45186b2 100644 --- a/src/log.c +++ b/src/log.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/network.c b/src/network.c index 98b1f5a..dfb76fa 100644 --- a/src/network.c +++ b/src/network.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/nogui.c b/src/nogui.c index deeca5b..a02cea7 100644 --- a/src/nogui.c +++ b/src/nogui.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/options.c b/src/options.c index bad281b..25a6e81 100644 --- a/src/options.c +++ b/src/options.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/protocol.c b/src/protocol.c index f579138..218450c 100644 --- a/src/protocol.c +++ b/src/protocol.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/prototypes.h b/src/prototypes.h index 004a576..50b2aec 100644 --- a/src/prototypes.h +++ b/src/prototypes.h @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. */ #ifndef PROTOTYPES_H diff --git a/src/pty.c b/src/pty.c index d44a624..645492b 100644 --- a/src/pty.c +++ b/src/pty.c @@ -17,7 +17,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/resolver.c b/src/resolver.c index 6180113..84133cc 100644 --- a/src/resolver.c +++ b/src/resolver.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/ssl.c b/src/ssl.c index 84c79ee..7797747 100644 --- a/src/ssl.c +++ b/src/ssl.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/sthreads.c b/src/sthreads.c index de8388a..7588f61 100644 --- a/src/sthreads.c +++ b/src/sthreads.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/stunnel.c b/src/stunnel.c index bdb5dd3..3312cca 100644 --- a/src/stunnel.c +++ b/src/stunnel.c @@ -20,7 +20,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/verify.c b/src/verify.c index 72fcdb2..88b010b 100644 --- a/src/verify.c +++ b/src/verify.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL ---------------------------------------------------------------------- -- Rodrigo Gallardo GPG-Fingerprint: 7C81 E60C 442E 8FBC D975 2F49 0199 8318 ADC9 BC28

1 0

[patch] Move shared library into app specific dir
by Luis Rodrigo Gallardo Cruz 14 Sep '07

14 Sep '07

While upgrading the Debian package for stunnel, I noticed that it installs a shared library into /usr/lib/libstunnel.so This is recommended against by Debian policy, because misguided users might end up linking against it. The following (minor) patch moves the library into /usr/lib/stunnel/ which is a better location for it. ---------------------------------------------------------------------- Index: stunnel-4.20/src/Makefile.am =================================================================== --- stunnel-4.20.orig/src/Makefile.am 2007-07-24 20:36:58.000000000 -0500 +++ stunnel-4.20/src/Makefile.am 2007-07-24 20:39:04.000000000 -0500 @@ -17,7 +17,7 @@ # Unix shared library -lib_LTLIBRARIES = libstunnel.la +pkglib_LTLIBRARIES = libstunnel.la libstunnel_la_SOURCES = $(shared_sources) libstunnel_la_LDFLAGS = -avoid-version @@ -27,7 +27,7 @@ # Additional compiler flags -AM_CPPFLAGS = -DLIBDIR='"$(libdir)"' -DCONFDIR='"$(sysconfdir)/stunnel"' -DPIDFILE='"$(prefix)/var/run/stunnel/stunnel.pid"' +AM_CPPFLAGS = -DLIBDIR='"$(pkglibdir)"' -DCONFDIR='"$(sysconfdir)/stunnel"' -DPIDFILE='"$(prefix)/var/run/stunnel/stunnel.pid"' # Win32 executable ---------------------------------------------------------------------- -- Rodrigo Gallardo GPG-Fingerprint: 7C81 E60C 442E 8FBC D975 2F49 0199 8318 ADC9 BC28

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 38, Issue 2
by Saraka, Luc 12 Sep '07

12 Sep '07

-----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of stunnel-users-request(a)mirt.net Sent: Wednesday, September 12, 2007 6:00 AM To: stunnel-users(a)mirt.net Subject: stunnel-users Digest, Vol 38, Issue 2 Send stunnel-users mailing list submissions to stunnel-users(a)mirt.net To subscribe or unsubscribe via the World Wide Web, visit http://stunnel.mirt.net/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)mirt.net You can reach the person managing the list at stunnel-users-owner(a)mirt.net When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. certificates, openssl and stunnel on windows (David Schulberg) 2. [RE] certificates, openssl and stunnel on windows (algol sigfrid) ---------------------------------------------------------------------- Message: 1 Date: Wed, 12 Sep 2007 00:12:02 +1000 From: "David Schulberg" <davids(a)evertech.com.au> Subject: [stunnel-users] certificates, openssl and stunnel on windows To: <stunnel-users(a)mirt.net> Message-ID: <000001c7f47d$be12f030$1401a8c0@microsensexp> Content-Type: text/plain; charset="iso-8859-1" Hi All, Without wishing to sound na?ve I find this whole subject area to be extraordinarily riddled with cryptic explanations of how to configure stunnel to work with a key and certificate. Using openssl I have generated a file including RSA private key and certificate which stunnel running as a server happily digests. Now I want to create the cer file that Windows will happily digest on the client side. Short of ripping the certificate out of the stunnel.pem file that I created using the command openssl req -new -x509 -days 365 -nodes -config stunnel.cnf -out stunnel.pem -keyout stunnel.pem what are the steps to getting that holy grail with a 'cer' extension? Please educate David ------------------------------ Message: 2 Date: Tue, 11 Sep 2007 22:04:38 -0400 (EDT) From: "algol sigfrid" <m1a2(a)lycos.com> Subject: [stunnel-users] [RE] certificates, openssl and stunnel on windows To: <stunnel-users(a)mirt.net> Message-ID: <20070911220438.HM.0000000000001Lm(a)m1a2.bos-mail-wwl12.lycos.com> Content-Type: text/plain; charset="us-ascii" An HTML attachment was scrubbed... URL: http://stunnel.mirt.net/pipermail/stunnel-users/attachments/20070911/f7d 17618/attachment-0001.html ------------------------------ _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users End of stunnel-users Digest, Vol 38, Issue 2 ********************************************

1 0

certificates, openssl and stunnel on windows
by David Schulberg 12 Sep '07

12 Sep '07

Hi All, Without wishing to sound naïve I find this whole subject area to be extraordinarily riddled with cryptic explanations of how to configure stunnel to work with a key and certificate. Using openssl I have generated a file including RSA private key and certificate which stunnel running as a server happily digests. Now I want to create the cer file that Windows will happily digest on the client side. Short of ripping the certificate out of the stunnel.pem file that I created using the command openssl req -new -x509 -days 365 -nodes -config stunnel.cnf -out stunnel.pem -keyout stunnel.pem what are the steps to getting that holy grail with a 'cer' extension? Please educate David

2 1

[RE] certificates, openssl and stunnel on windows
by algol sigfrid 12 Sep '07

12 Sep '07

1 0

Problem with stunnel 4.20 on Fedora 7
by Andrew M Dunn 29 Aug '07

29 Aug '07

I can't get stunnel to run on a freshly-installed Fedora 7 system. It fails with "Error resolving '0.0.0.0': servname is not supported for ai_socktype" but the usual other causes of that error (ie. ports not defined in /etc/services, bad settings in /etc/nsswitch.conf) are not the culprit this time. COMMAND LINE: /usr/sbin/stunnel /home/amdunn/security/stunnel.conf COMMAND OUTPUT: 2007.08.29 11:44:12 LOG3[13614:3086243520]: Error resolving '0.0.0.0': servname is not supported for ai_socktype (EAI_SERVICE) file /home/amdunn/security/stunnel.conf line 10: Failed to resolve accepting address STUNNEL.CONF FILE: ; ; stunnel file for testing 443 access to local http server ; cert=/home/amdunn/security/xxxxxxx key=/home/amdunn/security/yyyyyyy foreground=yes ; ; [sweb] accept=443 ; https port connect=80 ; standard httpd listening port TIMEOUTclose=0 ; must set this or IE waits 60sec on page end client=no STUNNEL -VERSION OUTPUT: stunnel 4.20 on i686-redhat-linux-gnu with OpenSSL 0.9.8b 04 May 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none -- Andrew M. Dunn VE3XAD Managing Director, Axis Computing Technologies Vice-President, South Simcoe Railway www.AndyDunn.CA

1 0

Mac stunnel not attempting to connect to host
by Michael Kreykenbohm 28 Aug '07

28 Aug '07

I'v used FreeBsd with stunnel without problem, so I'm a little stumped that it doesn't work properly on darwin for Mac. I recall that it might get hung up in the ssl certificates, but I can't find where to look and openssl -connect works perfectly. Any help, appreciated. Symptom: The stunnel is running in debug mode, the client makes a connection to stunnel, stunnel reports the connection stunnel does not attempt to connect to the host (the connect string) No messages suggest it is trying, no network logic show it is connecting. (Since I am using it for email, I can not copy and paste from the orginal to send this email) openssl connects fine to the server and get the correct results Any ideas how/ where to find out what is wrong with the Mac. Thanks stunnel 4.20 on i686-apple-darwin8.10.1 with OpenSSL 0.9.7l 28 Sep 2006 Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv4 Auth:LIBWRAP Global options debug = 5 pid = /opt/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /opt/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /opt/local/etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none 2007.08.26 20:28:51 LOG7[207:2684407808]: RAND_status claims sufficient entropy for the PRNG 2007.08.26 20:28:51 LOG7[207:2684407808]: PRNG seeded successfully 2007.08.26 20:28:51 LOG7[207:2684407808]: Certificate: /opt/local/etc/stunnel/stunnel.pem 2007.08.26 20:28:51 LOG7[207:2684407808]: Certificate loaded 2007.08.26 20:28:51 LOG7[207:2684407808]: Key file: /opt/local/etc/stunnel/stunnel.pem 2007.08.26 20:28:51 LOG7[207:2684407808]: Private key loaded 2007.08.26 20:28:51 LOG7[207:2684407808]: SSL context initialized for service pop3s 2007.08.26 20:28:51 LOG7[207:2684407808]: Certificate: /opt/local/etc/stunnel/stunnel.pem 2007.08.26 20:28:51 LOG7[207:2684407808]: Certificate loaded 2007.08.26 20:28:51 LOG7[207:2684407808]: Key file: /opt/local/etc/stunnel/stunnel.pem 2007.08.26 20:28:51 LOG7[207:2684407808]: Private key loaded 2007.08.26 20:28:51 LOG7[207:2684407808]: SSL context initialized for service smtps 2007.08.26 20:28:51 LOG5[207:2684407808]: stunnel 4.20 on i686-apple-darwin8.10.1 with OpenSSL 0.9.7l 28 Sep 2006 2007.08.26 20:28:51 LOG5[207:2684407808]: Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv4 Auth:LIBWRAP 2007.08.26 20:28:51 LOG6[207:2684407808]: file ulimit = 256 (can be changed with 'ulimit -n') 2007.08.26 20:28:51 LOG6[207:2684407808]: FD_SETSIZE = 1024 (some systems allow to increase this value) 2007.08.26 20:28:51 LOG5[207:2684407808]: 125 clients allowed 2007.08.26 20:28:51 LOG7[207:2684407808]: FD 4 in non-blocking mode 2007.08.26 20:28:51 LOG7[207:2684407808]: FD 6 in non-blocking mode 2007.08.26 20:28:51 LOG7[207:2684407808]: FD 7 in non-blocking mode 2007.08.26 20:28:51 LOG7[207:2684407808]: SO_REUSEADDR option set on accept socket 2007.08.26 20:28:51 LOG7[207:2684407808]: pop3s bound to 0.0.0.0:995 2007.08.26 20:28:51 LOG7[207:2684407808]: FD 8 in non-blocking mode 2007.08.26 20:28:51 LOG7[207:2684407808]: SO_REUSEADDR option set on accept socket 2007.08.26 20:28:51 LOG7[207:2684407808]: smtps bound to 0.0.0.0:5526 2007.08.26 20:28:51 LOG7[207:2684407808]: Created pid file /tmp/stunnel.pid 2007.08.26 20:29:04 LOG7[207:2684407808]: pop3s accepted FD=9 from 127.0.0.1:49162 2007.08.26 20:29:04 LOG7[207:25185792]: pop3s started 2007.08.26 20:29:04 LOG7[207:25185792]: FD 9 in non-blocking mode 2007.08.26 20:29:04 LOG7[207:25185792]: FD 10 in non-blocking mode 2007.08.26 20:29:04 LOG7[207:25185792]: FD 11 in non-blocking mode 2007.08.26 20:29:04 LOG7[207:25185792]: Connection from 127.0.0.1:49162 permitted by libwrap 2007.08.26 20:29:04 LOG5[207:25185792]: pop3s accepted connection from 127.0.0.1:49162 2007.08.26 20:29:04 LOG7[207:25185792]: SSL state (accept): before/accept initialization 2007.08.26 20:29:04 LOG7[207:2684407808]: Cleaning up the signal pipe 2007.08.26 20:29:04 LOG6[207:2684407808]: Child process 212 finished with code 0 <<-- at this point I have done nothing but connect to the stunnel, so I don;t know why it should finished with code 0 yet, and has not closed the connect on the other side.

1 0

[RFC,PATCH] Port stunnel to NSS
by Miloslav Trmac 28 Aug '07

28 Aug '07

Hello, As a part of Fedora's atttempt to rely on a single, FIPS certified. crypto implementation[1], I have prepared a port of stunnel to NSS, activated by passing --with-nss to configure. The port relies on a currently unreleased version of nss_compat_ossl[2]. The NSS interface is rather different from OpenSSL, and many options that are configured explicitly by applications with OpenSSL are either not available to applications with NSS, or configured using external tools in a "NSS database", which stores certificates, private keys and configuration settings. In particular: - The EGD (option "EGD") is not supported. - "RSA support" (loading keys as "RSA PRIVATE KEY" instead of "ANY PRIVATE KEY") is irrelevant, keys are stored in the NSS database - DH key exchange is not supported for the server side - compression (option "compression") is not supported - OpenSSL engines (options "engine", "engineCtrl") are not supported; PKCS#11 plugins are configured in the NSS database - CRLs (options "CRLpath", "CRLfile") are not configured; all CRLs stored in the NSS database are used automatically - OCSP (options "OCSP", "OCSPflag") is not supported in the current port; NSS supports OCSP, but a CA certificate must be specified along with the OCSP URL. - OpenSSL options (option "options") are not supported - NTLM authentication for the "CONNECT" protocol is not supported because NSS currently does not implement MD4 - certificates (option "cert") are stored in the NSS database; the "cert" option contains a nickname of a certificate stored in the database - CA certificates (options "CApath", "CAfile") are stored in the NSS database - error_depth on certificate verification failure is not supported To convert an existing stunnel set up to NSS, at minimum it is necessary to: - select a NSS database directory, $SSL_DIR $ certutil -d $SSL_DIR -N - import server and CA certificates: $ certutil -d $SSL_DIR -A -n server_cert_nickname -i server_cert.pem - import server private key: $ openssl pkcs12 -export -in server_key.pem -out server_key.pfx $ pk12util -d $SSL_DIR -i server_key.pfx - modify stunnel.conf to use "server_cert_nickname" instead of path to "server_cert.pem" in "cert" - when starting stunnel, make sure $SSL_DIR is present in the environment I'm afraid the incompatibilities are large, but the current NSS design really requires a database, and it does not work well with separate files. We'd like to include this NSS port of stunnel in Fedora 8 (if it doesn't prove to be too buggy). I'll be grateful for any comments. Mirek [1] http://fedoraproject.org/wiki/FedoraCryptoConsolidation [2] http://rcritten.fedorapeople.org/nss_compat_ossl.html

1 0

RFC3280 support
by Nagasundaram, Sekhar 22 Aug '07

22 Aug '07

Hello: I have hopefully a quick question. Does Stunnel support reason codes identified in RFC 3280? Thanks all Regards Sekhar Nagasundaram <<Nagasundaram, Sekhar.vcf>>

1 0

Will stunnel service need to be restarted after the configuration changes.
by Zhijiang Lu 15 Aug '07

15 Aug '07

Hi All, After some changes being made to the stunnel configuration file, do I need to restart the stunnel service to pick up the changes? I would think it is desirable to load up the new configurations, and make runtime changes correspondingly. Restarting stunnel will disrupt the currently running sessions. Thanks, -Mark

2 1

Application level encryption or driver level encryption
by atsushi kataoka 12 Aug '07

12 Aug '07

Hi, I have to secure one of my proprietary remote connection server running on windows XP . One option is to secure using the stunnel.Other options are writing some drivers for windows. Presently we are evaluating which option is better whether to opt for application level - stunnel or go for driver - some network filter driver. Can somebody tell me what will be advantages of following application level approach. One more point what is the impact on the performance of using stunnel. Regards.

1 0

Stunnel writing strange timestamps into my logs
by Van 10 Aug '07

10 Aug '07

I was looking through /var/log/messages for another reason and I notice this (representitive log snippet below) It's 10:50 am and while automount is writing messages that jibe with the correct time (see line 5 for example. This part of my log is from about 90 min ago), stunnel seems to be 4 hours ahead, labelling things as happening at about 1pm while everything else is happening about 9am. Where is stunnel getting it's time from? And why a separate source? How can I correct this? - Van Aug 10 13:13:01 <myserver> stunnel: LOG5[29760:3086109600]: pop3s connected remote server from 127.0.0.1:54923 Aug 10 13:13:03 <myserver> stunnel: LOG5[29760:3086109600]: Connection closed: 211 bytes sent to SSL, 56 bytes sent to socket Aug 10 13:13:34 <myserver> stunnel: LOG5[29760:3086109600]: imaps accepted connection from XX.XX.61.109:1409 Aug 10 13:13:34 <myserver> stunnel: LOG5[29760:3086109600]: imaps connected remote server from 127.0.0.1:54927 Aug 10 09:14:13 <myserver> automount[30173]: >> mount: mount to NFS server 'mgm' failed: System Error: Connection timed out. Aug 10 09:14:13 <myserver> automount[30173]: mount(nfs): nfs: mount failure mgm:/bmgm on /nfs/bmgm Aug 10 09:14:13 <myserver> automount[30173]: failed to mount /nfs/bmgm Aug 10 13:14:18 <myserver> stunnel: LOG5[29760:3086109600]: Connection closed: 1013 bytes sent to SSL, 271 bytes sent to socket Aug 10 13:16:02 <myserver> stunnel: LOG5[29760:3086109600]: pop3s accepted connection from XX.XX.61.195:1057 Aug 10 13:16:02 <myserver> stunnel: LOG5[29760:3086109600]: pop3s connected remote server from 127.0.0.1:54947 Aug 10 13:16:02 <myserver> stunnel: LOG5[29760:3086109600]: Connection closed: 150 bytes sent to SSL, 41 bytes sent to socket Aug 10 13:18:01 <myserver> stunnel: LOG5[29760:3086109600]: pop3s accepted connection from 71.167.170.42:60220 Aug 10 13:18:01 <myserver> stunnel: LOG5[29760:3086109600]: pop3s connected remote server from 127.0.0.1:54948 Aug 10 13:18:03 <myserver> stunnel: LOG5[29760:3086109600]: Connection closed: 211 bytes sent to SSL, 56 bytes sent to socket Aug 10 13:18:39 <myserver> stunnel: LOG5[29760:3086109600]: imaps accepted connection from XX.XX.61.109:1410 Aug 10 13:18:39 <myserver> stunnel: LOG5[29760:3086109600]: imaps connected remote server from 127.0.0.1:54952 Aug 10 13:19:23 <myserver> stunnel: LOG5[29760:3086109600]: Connection closed: 1013 bytes sent to SSL, 271 bytes sent to socket Aug 10 09:20:31 <myserver> automount[30282]: >> mount: mount to NFS server 'mgm' failed: System Error: Connection timed out. Aug 10 09:20:31 <myserver> automount[30282]: mount(nfs): nfs: mount failure mgm:/bmgm on /nfs/bmgm Aug 10 09:20:31 <myserver> automount[30282]: failed to mount /nfs/bmgm Aug 10 13:23:01 <myserver> stunnel: LOG5[29760:3086109600]: pop3s accepted connection from 71.167.170.42:60225

1 0

Tunneling though an Http proxy
by Honka 10 Aug '07

10 Aug '07

Hi there, i'm trying to set up stunnel on my laptop which I use at work, and i'm trying to tunnel to my home pc for remote desktop. The only open ports on the work network are 8080, 80 and 443. So I have setup the tunnel to port 8080 onto my home pc and had it working across the network at home. (via internal and external ip's) however it isn't working here. I am assuming because we have an http proxy which requires authentication. So i'm wondering, how can I make stunnel use and authenticate with this proxy so that it will work? Cheers Honka

1 0

Make Install Error
by Morris Hooten - SLS Business Infrastructure 05 Aug '07

05 Aug '07

why do i get this when running make install at the very end? i'm trying to install in a full root solaris 10 zone thanks SunOS mknod: Not owner chmod: WARNING: can't access /usr/local/var/lib/stunnel/dev/zero make[2]: *** [install-data-local] Error 1 make[2]: Leaving directory `/stunnel/stunnel-4.20/tools' make[1]: *** [install-am] Error 2 make[1]: Leaving directory `/stunnel/stunnel-4.20/tools' make: *** [install-recursive] Error 1

1 0

Make Install Error
by Morris Hooten - SLS Business Infrastructure 05 Aug '07

05 Aug '07

why do i get this when running make install at the very end? thanks SunOS mknod: Not owner chmod: WARNING: can't access /usr/local/var/lib/stunnel/dev/zero make[2]: *** [install-data-local] Error 1 make[2]: Leaving directory `/stunnel/stunnel-4.20/tools' make[1]: *** [install-am] Error 2 make[1]: Leaving directory `/stunnel/stunnel-4.20/tools' make: *** [install-recursive] Error 1

1 0

Make Install Error
by Morris Hooten - SLS Business Infrastructure 05 Aug '07

05 Aug '07

why do i get this when running make install at the very end? thanks SunOS mknod: Not owner chmod: WARNING: can't access /usr/local/var/lib/stunnel/dev/zero make[2]: *** [install-data-local] Error 1 make[2]: Leaving directory `/stunnel/stunnel-4.20/tools' make[1]: *** [install-am] Error 2 make[1]: Leaving directory `/stunnel/stunnel-4.20/tools' make: *** [install-recursive] Error 1

1 0

Stunnel message about SSL_shutdown/SSL_get_error
by Lachance, Mario 03 Aug '07

03 Aug '07

Hi, I have been using openssl_0.9.7g and stunnel_4.10 on Solaris 9 without problem for 2 years in a production environment. I want to upgrade to openssl_0.9.8e and stunnel_4.20 on solaris 10. I have done some test on a development system and I have seen a new message in stunnel log file. Old message with openssl_0.9.7g and stunnel_4.10 on Solaris 9 was : Aug 3 14:51:58 solario stunnel[345]: [ID 702911 local6.notice] Too many retries on SSL shutdown New message with openssl_0.9.8e and stunnel_4.20 on solaris 10 is : Aug 3 14:42:30 daprxuu stunnel: [ID 821868 local6.error] LOG3[20957:4]: SSL_shutdown/SSL_get_error returned 6 I don't know if this new message has replaced the old one I was getting. Can someone tell me what is behind this message "_shutdown/SSL_get_error returned 6"? Please note that I am able to transfer message with both system (stunnel 4.10 and stunnel 4.20) from a windows client without any apparent problem. Thank you for your help, Mario Avis de confidentialité: Ce message est confidentiel, protégé par le secret professionnel et à l'usage exclusif du destinataire. Toute autre personne est avisée qu'il lui est strictement interdit de le diffuser, distribuer ou reproduire. Si vous avez reçu ce message par erreur, avisez-nous immédiatement par téléphone et effacez toute copie. Confidentiality Notice: This e-mail is confidential, privileged and intended for the exclusive use of the addressee. Any other person is strictly prohibited from disclosing, distributing or reproducing it. If you have received this e-mail by mistake, please notify us immediately by telephone and delete all copies.

1 0

Re: [stunnel-users] stunnel hanging during negotation with an smtp server
by Hans Werner Strube 01 Aug '07

01 Aug '07

Jason J. Corso wrote: > [ssmtp] > accept = 127.0.0.1:25 > connect = xxxxxx:465 > protocol = smtp > ------- > > However, when I try to send a mail, it appears to hang while > negotiating with the remote server. Here is the output: ... > 2007.07.31 15:41:25 LOG7[5511:25183744]: Negotiations for smtp(server > side) started > 2007.07.31 15:41:25 LOG7[5511:25183744]: RFC 2487 detected Your stunnel seems to be running in server mode. For client mode, add client = yes Also, if you need pure SSL rather than TLS negotiation, remove protocol = smtp

2 1

stunnel hanging during negotation with an smtp server
by Jason J. Corso 31 Jul '07

31 Jul '07

Please help: I'm trying to use stunnel to connect to a secure SMTP server -- I'm using MS Entourage 2004 on an Intel 10.4 Mac. Entourage cannot connect directly to the SMTP server over SSL because it no longer supports NTLM version 1 authentication, which the SMTP server uses. I believe stunnel can be used to workaround this problem (if I'm wrong, please say so), i.e., Entourage can connect locally to stunnel which will then connect to the remote server over SSL properly. I built and installed stunnel version 4.04-12 via Fink (compiled from source via Fink) and OpenSSL 0.9.7i-4 also via Fink. I have the following configuration file: ------ # Comment it out on Win32 cert = /sw/etc/stunnel/stunnel.pem chroot = /sw/var/run/stunnel/ # PID is created inside chroot jail pid = /stunnel.pid setuid = nobody setgid = nogroup # Some debugging stuff debug = 7 output = /dev/stdout foreground = yes [ssmtp] accept = 127.0.0.1:25 connect = xxxxxx:465 protocol = smtp ------- However, when I try to send a mail, it appears to hang while negotiating with the remote server. Here is the output: 2007.07.31 15:41:19 LOG5[5511:2684407808]: stunnel 4.04 on i386-apple-darwin8.10.1 PTHREAD+LIBWRAP with OpenSSL 0.9.7i 14 Oct 2005 2007.07.31 15:41:19 LOG7[5511:2684407808]: Snagged 64 random bytes from xxx/.rnd 2007.07.31 15:41:19 LOG7[5511:2684407808]: Wrote 1024 new random bytes to xxx/.rnd 2007.07.31 15:41:19 LOG7[5511:2684407808]: RAND_status claims sufficient entropy for the PRNG 2007.07.31 15:41:19 LOG6[5511:2684407808]: PRNG seeded successfully 2007.07.31 15:41:19 LOG7[5511:2684407808]: Certificate: /sw/etc/stunnel/stunnel.pem 2007.07.31 15:41:19 LOG7[5511:2684407808]: Key file: /sw/etc/stunnel/stunnel.pem 2007.07.31 15:41:19 LOG5[5511:2684407808]: FD_SETSIZE=1024, file ulimit=256 -> 125 clients allowed 2007.07.31 15:41:19 LOG7[5511:2684407808]: FD 6 in non-blocking mode 2007.07.31 15:41:19 LOG7[5511:2684407808]: SO_REUSEADDR option set on accept socket 2007.07.31 15:41:19 LOG7[5511:2684407808]: ssmtp bound to 127.0.0.1:25 2007.07.31 15:41:19 LOG7[5511:2684407808]: FD 7 in non-blocking mode 2007.07.31 15:41:19 LOG7[5511:2684407808]: FD 8 in non-blocking mode 2007.07.31 15:41:19 LOG7[5511:2684407808]: Created pid file /stunnel.pid 2007.07.31 15:41:25 LOG7[5511:2684407808]: ssmtp accepted FD=9 from 127.0.0.1:50091 2007.07.31 15:41:25 LOG7[5511:2684407808]: FD 9 in non-blocking mode 2007.07.31 15:41:25 LOG7[5511:25183744]: ssmtp started 2007.07.31 15:41:25 LOG5[5511:25183744]: ssmtp connected from 127.0.0.1:50091 2007.07.31 15:41:25 LOG7[5511:25183744]: FD 10 in non-blocking mode 2007.07.31 15:41:25 LOG7[5511:25183744]: ssmtp connecting xxx.xxx.xxx.xxx:465 2007.07.31 15:41:25 LOG7[5511:25183744]: remote connect #1: EINPROGRESS: retrying 2007.07.31 15:41:25 LOG7[5511:25183744]: waitforsocket: FD=10, DIR=write 2007.07.31 15:41:25 LOG7[5511:25183744]: waitforsocket: ok 2007.07.31 15:41:25 LOG7[5511:25183744]: Remote FD=10 initialized 2007.07.31 15:41:25 LOG7[5511:25183744]: Negotiations for smtp(server side) started 2007.07.31 15:41:25 LOG7[5511:25183744]: RFC 2487 detected 2007.07.31 15:41:25 LOG7[5511:25183744]: waitforsocket: FD=10, DIR=read ********* HANGS HERE *********** ...and I have to kill it. I am very new to stunnel and openssl. So, I may be making a simple mistake. But, I could not find the solution on the mailing list or the web. What am I doing wrong? To be clear, the server is using SSL for SMTP. I am able to send mail directly via the smtp server from other mail clients like Thunderbird. Thanks. Any help is much appreciated. Jason

1 0

Re: [stunnel-users] Stunnel Scalability Question
by Ankur Upadhyaya 30 Jul '07

30 Jul '07

Hi Michal, Thank you for your help with this. My stunnel -version output can be found below. Ankur stunnel 4.20 on i686-pc-linux-gnu with OpenSSL 0.9.8b 04 May 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none

2 1

Stunnel on Freebsd not running
by The Volo 30 Jul '07

30 Jul '07

i recently installed the latest stable version 4.20 on a shell running freebsd, i dont have root i had to install it on my account. Compile was successfull, i renamed the default stunnel.conf.. and edited it, i am running stunnel as a client and added this line at the end of stunnel.conf: [eggdrop] accept = 127.0.0.1:12345 connect = irc.efnet.net:6667 when i run stunnel it doesnt do nothing besides sending me to a new bash command line.. [volo@partyline (~/)]$ /home/volo/stunnel/sbin/stunnel /home/volo/stunnel/etc/stunnel/stunnel.conf [volo@partyline (~/)]$ I type ps -x to see if stunnel is running but i dont see it on the list and no pid file exist either. Any ideas on how i can fix this ? i dont see what i am doing wrong trying to run stunnel.. Trying to run stunnel to connect to irc and my eggdrop to connect to stunnel access ip:port thanks

2 1

Automatically Stopping Stunnel
by Brian Mander 19 Jul '07

19 Jul '07

We have stunnel configured to accept connections on a port from an outside company and forward it to a port where we have a tcplistener set up. The problem is that if our tcplistener goes down the company sending us info does not have their software configured to know if we get their info or not. Is there a way to stop allowing connections or shut stunnel down if it can not connect to the port. I hope this is enough information. Brian Mander Programmer Analyst II Omni Hotels (402) 952-6564 bmander(a)omnihotels.com <mailto:[email protected]> Learn more about Omni Hotels sensational summer vacation packages <http://www.omnihotels.com/exclusiveoffers/summer07.aspx> ideal for exploring great destinations with family and friends.

1 0

Stunnel Scalability Question
by Ankur Upadhyaya 18 Jul '07

18 Jul '07

Hi, I have an application with the following characteristics and am trying to determine if Stunnel would be a suitable option for securing my transmissions (in particular, will it scale): - Each of my clients is connected to the Internet via a 56Kbps modem. My server has whatever bandwidth it needs. - Each client "transaction" consists of (a) connecting to a central server using a TCP/IP-based protocol, (b) uploading a 512KB block of data and (c) disconnecting. - Our server needs to be able to handle 2000 concurrent clients under peak loads. - Under the peak load above, I would like to limit the time a client takes to perform a "transaction" to around five minutes or so (uploading 512KB at (56Kbps / 2) = 28Kbps should take ~2.5 minutes). My questions are: (1) Do I have any reason to believe that Stunnel will simply not be able to scale to handle the load described above (i.e. a steady load of 2000 concurrent clients connecting, uploading half a megabyte of data and disconnecting)? (2) If Stunnel can handle this - do you have any thoughts on what sort of machine (or machines) I should be running my server-side Stunnel daemon(s) on? I am particularly concerned about CPU usage. I apologize in advance for any overlap between this query and past threads in the archive/information on the website - I wanted to make sure that I ran the specific requirements above past somebody with experience using Stunnel. Thanks, Ankur

1 0

bind error
by ictforever 07 Jul '07

07 Jul '07

Hi,I use stunnel 4.20 with syslog-ng 2.0,os is centos 5.0.but there are bind errors: ........................... 2007.06.22 05:56:36 LOG7[2898:3086632640]: SO_REUSEADDR option set on accept socket 2007.06.22 05:56:36 LOG3[2898:3086632640]: Error binding 5141 to 192.168.0.1:5141 2007.06.22 05:56:36 LOG3[2898:3086632640]: bind: Cannot assign requested address (99) The stunnel conf : ............................ cert = /usr/local/stunnel/etc/stunnel/syslog-ng-server.pem CAfile = /usr/local/stunnel/etc/stunnel/syslog-ng-client.pem [5141] accept = 192.168.0.1:5141 connect = 127.0.0.1:514 How to correct it?Any suggestion and advice are appreciated. Thanks. Regards.

3 2

stunnel on windows 2003
by John M. Andre 06 Jul '07

06 Jul '07

I've looked around the site, through the help file, and through the archives but I still can't find the answer to my question. I hope someone on this list can give me some insight. I am new to SSL but I have a brand new server and I'm trying to set it up to use stunnel to secure communications over POP, IMAP, SMTP, etc. However, as I look through the documentation, it is clearly written for unix admins. Is there anything that will guide someone how to setup stunnel on windows? Ideally a step-by-step but anything would be nice. Thanks, John

1 0

Out-of-band data
by Richard's Hotmail 03 Jul '07

03 Jul '07

Hi, In the Stunnel FAQ (see snippet below) it says that STUNNEL does not support OOB processing (except if OOB is set to in-line); can someone please tell me if this restriction is still in place? Does OpenSSL not support the sending and receiving of the OOB character? Some other restriction? Cheers Richard Maher Can I use stunnel to protect [insert random protocol here]? Stunnel should be able to secure any random protocol as long as the protocol satisfies the following requirements: 1.. The protocol is TCP, not UDP. 2.. The protocol doesn't use multiple connections, like ftp. 3.. The protocol doesn't depend on Out Of Band (OOB) data, 4.. Remote site can't use an application-specific protocol, like ssltelnet, where SSL is a negotiated option, save for those protocols already supported by the -n argument to Stunnel.

1 0

HTTPS Connect patches for 4.20
by Gym Crazy 02 Jul '07

02 Jul '07

Hi Folks Wonder if you can help me. A predecessor of mine set up stunnel version 4.05 on OpenBSD 3.8. He didn't leave much documentation unfortunately. He also used a patch and re-compiled it. That patch was connect-proxy.mwald.patch. We are getting some performance issues and want to of course move to the latest stable stunnel release 4.20, before asking for any help but we are in a bit of a bind. We are firstly not sure if there is an updated connect-proxy.mwald.patch that works well with stunnel 4.20 (I have searched and searched but can't seem to find any). Or else if there is a patch that performs the same type of function as connect-proxy.mwald.patch but that is stable to use with stunnel 4.20. Any help would be greatly appreciated :-D Regards Paul H ____________________________________________________________________________________ Luggage? GPS? Comic books? Check out fitting gifts for grads at Yahoo! Search http://search.yahoo.com/search?fr=oni_on_mail&p=graduation+gifts&cs=bz

1 0

Re: [stunnel-users] Certificates and public/private keys
by Dario Teixeira 28 Jun '07

28 Jun '07

> Should you not be looking at > http://httpd.apache.org/docs/2.0/ssl/ssl_howto.html > and > https://www.opensc-project.org/files/doc/apache-client-authentication(v0 > .5.1).pdf Hi, Thanks for the reply! I didn't mention it before, but I won't be using Apache or any other mainstream webserver. Most likely I will be using Ocsigen (http://www.ocsigen.org/) Now, the latest development release of Ocsigen already has basic support for SSL, but it can't handle yet client authentication. In short, I am still looking for an stunnel-based solution. Any ideas? Thanks again for your time and attention! Cheers, Dario ___________________________________________________________ Yahoo! Answers - Got a question? Someone out there knows the answer. Try it now. http://uk.answers.yahoo.com/

2 1

HTTPS Connect patches for 4.20
by Gym Crazy 28 Jun '07

28 Jun '07

Hi Folks Wonder if you can help me. A predecessor of mine set up stunnel version 4.05 on OpenBSD 3.8. He didn't leave much documentation unfortunately. He also used a patch and re-compiled it. That patch was connect-proxy.mwald.patch. We are getting some performance issues and want to of course move to the latest stable stunnel release 4.20, before asking for any help but we are in a bit of a bind. We are firstly not sure if there is an updated connect-proxy.mwald.patch that works well with stunnel 4.20 (I have searched and searched but can't seem to find any). Or else if there is a patch that performs the same type of function as connect-proxy.mwald.patch but that is stable to use with stunnel 4.20. Any help would be greatly appreciated :-D Regards Paul H ____________________________________________________________________________________ Looking for a deal? Find great prices on flights and hotels with Yahoo! FareChase. http://farechase.yahoo.com/

1 0

Certificates and public/private keys
by Dario Teixeira 26 Jun '07

26 Jun '07

Dear Stunnel users, I have a webserver running on a machine behind a firewall. I can easily punch a hole on the firewall, allowing any user on the Internet to access the webserver. However, I want to restrict access *only* to some people, those in possession of a secret key. At first sight, this seems like a job for plain ssh tunneling rather than stunnel, but as far as I understand it, ssh tunnels require that the connecting users have an account on the server machine. That won't happen here. It seems that stunnel is therefore more appropriate for this particular problem. Now, the port forwarding mechanics seem similar to those in ssh. I have no problems understanding those. The only problems I am having are figuring out the generation of keys. My excuses if I am using a terminology based on ssh or if I am way off about the capabilities of stunnel, but how can I generate the server's private and public keys? (the latter to be handed out to the clients) I have followed the instructions in the README.Debian file that accompanies the Debian stunnel4 package to produce a stunnel.pem certificate. With it, I have successfully established a stunnel connection between two machines. However, I have to use the same stunnel.pem file on both the client and the server, which strikes me as dangerous. Which parts are really needed on the client and server? Thanks in advance for your help! Cheers, Dario ___________________________________________________________ Yahoo! Answers - Got a question? Someone out there knows the answer. Try it now. http://uk.answers.yahoo.com/

2 1

Preferred way to start stunnel @boot time
by Van 26 Jun '07

26 Jun '07

So I've got stunnel running perfectly on my linux server to forward ssl requests to my pop and imap ports. I need to make sure this happens automatically if the machine is rebooted. On the stunnel site it talks about running stunnel either as a daemon or running stunnel out of xinetd. I was just wondering, which way do people using it out there think is preferable? And why? Neither seems as direct or simple as putting @reboot root /sbin/start_stunnel into my crontab, which is what I did (start_stunnel being a shell script with the proper command and some comments). Just another uneventful way to do the same thing? -Van

2 1