- stunnel-users - stunnel.org

Choosing local 'source' IP? (again)
by Don Werve 14 Apr '06

14 Apr '06

This is a repost, but the response I got last time said, 'use the "local" option'...which does not appear to work. Ok, so here's the problem: I've got stunnel handling SSL for a web-based service that is otherwise too stupid to be able to talk https. On the same piece of hardware that runs this service (Virtuozzo if you must know), I've set up stunnel to listen to ETH0_IP:443 and wrapper them to ETH0_IP:80, which is where VZ listens. This works wonderfully. Unfortunately, I need to set up a redirection rule inside this service that bounces people back to the https:// page if they try to come in over http. Since said service isn't managing its own SSL, I have no solid way of determining which connections are wrappered by stunnel and which connections come in over the wire, save for by the IP address of the connection. Now, each piece of iron has two ethernet adapters, so I got the bright idea to try and get stunnel to 'appear' to be connecting from the IP address of the second adapter. So, I set 'local = ETH1_IP' in stunnel.conf, and...nada. Still shows as connecting from ETH0_IP. I've screwed with socket options, read the source code for Stunnel, and so on. Having read the source code and refreshed my knowledge of socket() and connect(), is it really even possible to do what I want if stunnel is running on the same system? Oh, a ptrace of stunnel also yields the following: socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 8 fcntl64(8, F_GETFL) = 0x2 (flags O_RDWR) fcntl64(8, F_SETFL, O_RDWR|O_NONBLOCK) = 0 bind(8, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("[ETH1_IP]")}, 16) = 0 connect(8, {sa_family=AF_INET, sin_port=htons(80), sin_addr=inet_addr("[ETH0_IP]")}, 16) = -1 EINPROGRESS (Operation now in progress) ...and the connection inside of $CRAP_SYSTEM shows the connection as coming from ETH0_IP. So, I'm kind of at my wits' end here. Any possible way to make this work? Thanks-in-advance! -- Don Werve <donw(a)iradeon.net> Chief Systems Administrator / Systems Architect

1 0

stunnel4 stealing my ports (listening on ports it shouldn't be)
by Eric Brown 12 Apr '06

12 Apr '06

I have two stunnel processes. One listing on 443 -> localhost:80. The other listening on 8000 -> localhost:7001. (See configs below.) However, when I stop the process listening on port 7001, both stunnel processes start listening on 7001 (and a few other ports). I'm completely confused as to why this would happen. This is what I see normally: mta4-tiny-support (epgate)[6]$ sudo lsof -p 25253 -p 25255 -a -i4 Password: COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME stunnel4 25253 root 6u IPv4 3439450 TCP *:8000 (LISTEN) stunnel4 25255 root 6u IPv4 3439456 TCP *:https (LISTEN) This is what I see when stunnel appears to go bizerk: (after stopping the process that was listening on ports *:7000, localhost:7001 & localhost:7005) COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME stunnel4 22788 root 5u IPv4 1269640 TCP 127.0.0.1:4341- >127.0.0.1:19996 (CLOSE_WAIT) stunnel4 22788 root 6u IPv4 1273504 TCP 127.0.0.1:7001 (LISTEN) stunnel4 22788 root 7u IPv4 1273476 TCP 127.0.0.1:4606- >127.0.0.1:19995 (ESTABLISHED) stunnel4 22788 root 9u IPv4 1273477 TCP 127.0.0.1:19995- >127.0.0.1:4606 (ESTABLISHED) stunnel4 22788 root 11u IPv4 1273507 TCP *:7000 (LISTEN) stunnel4 22788 root 17u IPv4 1273515 TCP 127.0.0.1:7005 (LISTEN) stunnel4 22788 root 19u IPv4 1274895 TCP 127.0.0.1:7001- >127.0.0.1:1793 (CLOSE_WAIT) stunnel4 22788 root 24u IPv4 1275089 TCP *:8000 (LISTEN) stunnel4 22790 root 5u IPv4 1269640 TCP 127.0.0.1:4341- >127.0.0.1:19996 (CLOSE_WAIT) stunnel4 22790 root 6u IPv4 1273504 TCP 127.0.0.1:7001 (LISTEN) stunnel4 22790 root 7u IPv4 1273476 TCP 127.0.0.1:4606- >127.0.0.1:19995 (ESTABLISHED) stunnel4 22790 root 9u IPv4 1273477 TCP 127.0.0.1:19995- >127.0.0.1:4606 (ESTABLISHED) stunnel4 22790 root 11u IPv4 1273507 TCP *:7000 (LISTEN) stunnel4 22790 root 17u IPv4 1273515 TCP 127.0.0.1:7005 (LISTEN) stunnel4 22790 root 19u IPv4 1274895 TCP 127.0.0.1:7001- >127.0.0.1:1793 (CLOSE_WAIT) stunnel4 22790 root 24u IPv4 1275094 TCP *:443 (LISTEN) Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State User Inode PID/Program name tcp 0 0 127.0.0.1:7008 0.0.0.0:* LISTEN 0 1281907 24848/python tcp 0 0 0.0.0.0:8000 0.0.0.0:* LISTEN 0 1275089 22788/stunnel4 tcp 0 0 0.0.0.0:1025 0.0.0.0:* LISTEN 0 1681 - tcp 0 0 0.0.0.0:963 0.0.0.0:* LISTEN 0 1556 1205/rpc.statd tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 0 1238 986/portmap tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 0 1281911 24848/python tcp 0 0 127.0.0.1:7025 0.0.0.0:* LISTEN 0 1281130 24605/master tcp 0 0 127.0.0.1:7026 0.0.0.0:* LISTEN 0 1281542 24677/python tcp 0 0 0.0.0.0:818 0.0.0.0:* LISTEN 0 1356 1061/ypbind tcp 0 0 127.0.0.1:7027 0.0.0.0:* LISTEN 0 1281731 24777/python tcp 0 0 127.0.0.1:7028 0.0.0.0:* LISTEN 0 1281910 24848/python tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 0 1486 1195/sshd tcp 0 0 0.0.0.0:7000 0.0.0.0:* LISTEN 0 1273507 22788/stunnel4 tcp 0 0 127.0.0.1:5432 0.0.0.0:* LISTEN 400 1269115 20559/postmaster tcp 0 0 172.16.80.213:25 0.0.0.0:* LISTEN 0 1281126 24605/master tcp 0 0 172.16.80.212:25 0.0.0.0:* LISTEN 0 1280994 24584/master tcp 0 0 127.0.0.1:7001 0.0.0.0:* LISTEN 0 1273504 22788/stunnel4 tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 0 1275094 22790/stunnel4 tcp 0 0 127.0.0.1:955 0.0.0.0:* LISTEN 0 1518 1201/famd tcp 0 0 127.0.0.1:7005 0.0.0.0:* LISTEN 0 1273515 22788/stunnel4 tcp 0 0 127.0.0.1:7006 0.0.0.0:* LISTEN 0 1281540 24677/python tcp 0 0 127.0.0.1:7007 0.0.0.0:* LISTEN 0 1281724 24777/python I'm running stunnel 4.09 on Debian 3.1/Linux 2.6 Kernel. My configurations are: pid=/var/run/epgate_admin_stunnel4.pid cert=/epgate/etc/ssl/admin.stunnel [Admin] accept=8000 connect=7001 and: pid=/var/run/epgate_quarantine_stunnel4.pid cert=/epgate/etc/ssl/quar.stunnel [Quarantine] accept=443 connect=80

1 0

Deamon signal on close connection
by Ondra Medek 05 Apr '06

05 Apr '06

Hi, I'm using stunnel4 in daemon mode. It runs a bash script "service" for each connection. I want to stop the script, when the client closes the connection. Does the stunnel4 send any signal to child process when the connection is closed? My script receives no signal. Or is it a problem of bash? The only way how can the script find, that connection is broken is by reading the standart input, but I don't want to read any standart input. Thanks P.S. a snip of stunnel4 config: [aswconsole] accept = 1002 exec = /home/ondrejm/SeptimOS/ServerConsole/aswc-new/opt/asw/console/service

1 0

Having problems with an special configuration
by Michael Spiegle 04 Apr '06

04 Apr '06

Hi all, I've got a strange thing (at least I think so) that i'm trying to do with stunnel and it doesn't work. Here's the layout... Feel free to skip the next 3 paragraphs to get to the root of the problem: I'm using stunnel to provide SSL for a set of webservers behind a pair of LVS loadbalancers using keepalived. lets say I have a public IP of 10.0.0.1. I have an iptables rule which marks all 443 traffic to this IP with a fwmark, then keepalived dumps the traffic to the stunnel after seeing this fwmark. I have configured LVS to use direct-routing so that the stunnel server can see the original public IP which was requested (so it can serve up the right cert). Now, here is where things break. Internally, lets say stun is setup with an IP 192.168.0.10, and the LVS server has an interface on this VLAN with the IP 192.168.0.5. In my keepalived configuration for the correct fwmark, I dump the traffic to stun on 192.168.0.10. When I test this by creating a connection to the public IP address (10.0.0.1), LVS dumps the traffic to stunnel as planned and stunnel sees something like the following in TCPDUMP: Websurfer's_IP:123131 ----> 10.0.0.1:443 Stunnel refuses to do anything with the traffic. I assumed this was becuase the IP 10.0.0.1 wasn't configured anywhere on the stunnel box itself. I assigned this IP to the loopback interface as an alias, and it still doesn't work. I've straced/debug-logged stunnel and it doesn't do anything - almost like it doesn't think it should service the traffic. If I run netstat - plan, stunnel is listening to 0.0.0.0:443. So, why doesn't stunnel want to do anything with this traffic? uname -a: Linux ssl-server.domain.com 2.4.29-1.2smp #1 SMP Fri Mar 18 15:45:07 EST 2005 i686 unknown Running redhat 7.3. Glibc: glibc-2.2.5-44 glibc-common-2.2.5-44 openssl version: 0.9.6b configuration: cert = /nfs/ssl/pem/default chroot = /nfs certdir = /ssl/pem hashdir = yes pid = /run/stunnel.pid setuid = nobody setgid = nogroup output = /var/log/stunnel.log [https] accept = 443 connect = *:80 httpprotocol = yes TIMEOUTclose = 1 IP on loopback: bash-2.05a# ip addr list 1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 brd 127.255.255.255 scope host lo inet 10.0.0.1/32 brd 10.0.0.255 scope global lo:0 ... ... ... Michael Spiegle mike(a)nauticaltech.com 310.686.4570

1 0

(stunnel-4.14) poor performance with openssl engine
by Zhuang Yuyao 03 Apr '06

03 Apr '06

Hi, I've just added openssl engine support for Cavium Nitrox lite PCI card. Here are the speed test output: [engine] stands for speed test output with engine [soft] stands for speed test output without engine (openssl internal software implementation used) ~ # openssl speed -evp [rc4|aes256|sha1] [-engine /root/libcavium.so] ...... The 'numbers' are in 1000s of bytes per second processed. type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes rc4[engine] 6339.20k 25376.00k 100966.40k 3757056.00k 919961.60k rc4[soft] 6056.66k 7017.34k 7228.37k 7339.13k 7356.14k aes-256-cbc[engine] 3178.40k 25465.60k 50636.80k 194201.60k 2088140.80k aes-256-cbc[soft] 2430.36k 2572.93k 2597.45k 2617.27k 2609.82k sha1[engine] 774.20k 3115.20k 16486.40k 27033.60k 285593.60k sha1[soft] 915.74k 2622.71k 5678.93k 7942.23k 9041.75k ~ # openssl speed rsa [-engine /root/libcavium.so] sign verify sign/s verify/s rsa[soft] 512 bits 0.013810s 0.001349s 72.4 741.2 rsa[soft] 1024 bits 0.079200s 0.004342s 12.6 230.3 sign verify sign/s verify/s rsa[engine] 512 bits 0.000037s 0.000022s 26725.8 45181.5 rsa[engine] 1024 bits 0.000046s 0.000043s 21866.7 23489.1 The speed test shows than using engine is much much faster than software implementations. but while testing with stunnel, the result is really poor. I am still using apache benchmark 2 as the test tool. #ab2 -c 50 -n 100 https://192.168.10.5/test_1k.html (a html file whose size is 1Kbytes) #ab2 -c 50 -n 100 https://192.168.10.5/test_4k.html (a html file whose size is 4Kbytes) #ab2 -c 50 -n 100 https://192.168.10.5/test_50k.html (a html file whose size is 50Kbytes) #ab2 -c 50 -n 100 https://192.168.10.5/test_100k.html (a html file whose size is 100Kbytes) #ab2 -c 50 -n 100 https://192.168.10.5/test_200k.html (a html file whose size is 200Kbytes) Here is the result: Algorithm engine 1K 4K 50K 100K 200K AES-256-CBC+SHA1 no 14.12 13.21 7.92 4.48 2.17 (Requests per second) AES-256-CBC+SHA1 yes 51.10 23.34 7.30 3.12 1.91 (Requests per second) the data says everything. while using engine with stunnel, we got some performance increasement for processing small files, but processing bigger files is even slower than software implementation (it's quite strange, because proccessing large data blocks with hardware engine is assumed to be much faster than proccessing small data blocks). I did the same test for several times, but the result is the same. something I can be sure: 1) while doing stunnel engine test, all of the algorithms are processed by the engine. I can see it by debugging information printed on console screen. 2) the client running ab2 is a AMD64 with 1G RAM, and the web server (apache) used in the test above is an XEON with 2G RAM. so the bottleneck should be neither ab2 nor apache. So here are my questions: Has anyone tried stunnel with a hardware acceleartor? How about the performance? BTW, attached to this mail is a little patch for stunnel-4.14 which allows the engine directive in stunnel.conf to be set to either a engine id or a shared object path refer to the engine (ie. engine = /root/libcavium.so) Best regards, Zhuang Yuyao --- stunnel-4.14/src/ssl.c Thu Oct 27 09:42:54 2005 UTC +++ stunnel/src/ssl.c Tue Mar 28 08:48:03 2006 UTC @@ -122,6 +143,21 @@ } #if (SSLEAY_VERSION_NUMBER >= 0x00907000L) && defined(HAVE_OSSL_ENGINE_H) +static ENGINE *load_dynamic_engine(const char *engine) +{ + ENGINE *e = ENGINE_by_id("dynamic"); + if (e) + { + if (!ENGINE_ctrl_cmd_string(e, "SO_PATH", engine, 0) + || !ENGINE_ctrl_cmd_string(e, "LOAD", NULL, 0)) + { + ENGINE_free(e); + e = NULL; + } + } + return e; +} + static void init_engine(void) { ENGINE *e; @@ -133,9 +169,12 @@ } e=ENGINE_by_id(options.engine); if(!e) { + e = load_dynamic_engine(options.engine); + if (!e) { s_log(LOG_ERR, "Engine not found"); exit(1); } + } if(!ENGINE_init(e)) { s_log(LOG_ERR, "Engine can't be initialized"); ENGINE_free(e);

2 1

autostart stunnel at boot
by christof mestdag 03 Apr '06

03 Apr '06

hi is there another solution for booting stunnel without writting a custom rc5 script ? DO i have to make changes to make it works as a daemon? -> stunnel.conf client=yes output=/var/log/stunnel.log [ldaps] accept=localhost:389 connect=192.168.1.101:636

1 0

Re: [stunnel-users] Config for client proxy https (privoxy + stunnel)
by Xavier Cheney 02 Apr '06

02 Apr '06

Hi everybody, I found my mistake !! The process is not good. This is the correct process : browser (localhost:8118) <-> (localhost:8118) privoxy <-web-> server [and] (localhost:8888) stunnel (server:443) So with only privoxy like proxy in my Firefox config - when I ask http://server/page.html , data is modified by privoxy - when I ask https://server/page.html, data is transmitted by privoxy - when I ask http://localhost:888/page.html data is modified by privoxy and the real data transmitted is https://server/page.html , stunnel managing SSL between localhost and server. My new config : [https] accept = 8888 connect = server:443 In fact, it was the stunnel main function that I didn't understand. Sorry :) Thanks to exos, and hope it will help someone, Xavier Xavier Cheney <xav26000(a)yahoo.fr> a écrit : Hi, I wan to customize web page before viewing by my browser Firefox. With "privoxy" (www.privoxy.org) I can modify (proxy filter) HTTP web page, but not HTTPS pages. So, I want to use stunnel, to transfer HTTPS in HTTP between my proxy and server, like this : browser (8118) <-> (8118) privoxy (8888) <-> (8888) stunnel (server:443) <-web-> server This is my stunnel.conf : ---------------------------------------------------- ciphers = RC4-MD5:DES-CBC3-SHA verify = 0 debug = 7 client = yes [https] accept = 8888 connect = server.server.com:443 TIMEOUTclose = 0 ---------------------------------------------------- And my log : ---------------------------------------------------- 2006.03.31 11:40:02 LOG7[3396:2944]: RAND_status claims sufficient entropy for the PRNG 2006.03.31 11:40:02 LOG6[3396:2944]: PRNG seeded successfully 2006.03.31 11:40:02 LOG7[3396:2944]: SSL context initialized for service https 2006.03.31 11:40:02 LOG5[3396:2944]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.03.31 11:40:02 LOG5[3396:2944]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.03.31 11:40:02 LOG5[3396:2952]: No limit detected for the number of clients 2006.03.31 11:40:02 LOG7[3396:2952]: FD 192 in non-blocking mode 2006.03.31 11:40:02 LOG7[3396:2952]: SO_REUSEADDR option set on accept socket 2006.03.31 11:40:02 LOG7[3396:2952]: https bound to 0.0.0.0:8888 2006.03.31 11:40:07 LOG7[3396:2952]: https accepted FD=200 from 127.0.0.1:2414 2006.03.31 11:40:07 LOG7[3396:2952]: Creating a new thread 2006.03.31 11:40:07 LOG7[3396:2952]: New thread created 2006.03.31 11:40:07 LOG7[3396:3320]: https started 2006.03.31 11:40:07 LOG7[3396:3320]: FD 200 in non-blocking mode 2006.03.31 11:40:07 LOG5[3396:3320]: https connected from 127.0.0.1:2414 2006.03.31 11:40:07 LOG7[3396:3320]: FD 232 in non-blocking mode 2006.03.31 11:40:07 LOG7[3396:3320]: https connecting 195.101.206.82:443 2006.03.31 11:40:07 LOG7[3396:3320]: connect_wait: waiting 10 seconds 2006.03.31 11:40:07 LOG7[3396:3320]: connect_wait: connected 2006.03.31 11:40:07 LOG7[3396:3320]: Remote FD=232 initialized 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): before/connect initialization 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 write client hello A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 read server hello A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 read server certificate A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 read server done A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 write client key exchange A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 write change cipher spec A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 write finished A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 flush data 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 read finished A 2006.03.31 11:40:07 LOG7[3396:3320]: 1 items in the session cache 2006.03.31 11:40:07 LOG7[3396:3320]: 1 client connects (SSL_connect()) 2006.03.31 11:40:07 LOG7[3396:3320]: 1 client connects that finished 2006.03.31 11:40:07 LOG7[3396:3320]: 0 client renegotiations requested 2006.03.31 11:40:07 LOG7[3396:3320]: 0 server connects (SSL_accept()) 2006.03.31 11:40:07 LOG7[3396:3320]: 0 server connects that finished 2006.03.31 11:40:07 LOG7[3396:3320]: 0 server renegotiations requested 2006.03.31 11:40:07 LOG7[3396:3320]: 0 session cache hits 2006.03.31 11:40:07 LOG7[3396:3320]: 0 session cache misses 2006.03.31 11:40:07 LOG7[3396:3320]: 0 session cache timeouts 2006.03.31 11:40:07 LOG6[3396:3320]: SSL connected: new session negotiated 2006.03.31 11:40:07 LOG6[3396:3320]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2006.03.31 11:40:07 LOG7[3396:3320]: Socket closed on read 2006.03.31 11:40:07 LOG7[3396:3320]: SSL write shutdown 2006.03.31 11:40:07 LOG7[3396:3320]: SSL alert (write): warning: close notify 2006.03.31 11:40:07 LOG7[3396:3320]: SSL_shutdown retrying 2006.03.31 11:40:07 LOG7[3396:3320]: SSL doesn't need to read or write 2006.03.31 11:40:07 LOG6[3396:3320]: s_poll_wait timeout: connection close 2006.03.31 11:40:07 LOG5[3396:3320]: Connection closed: 211 bytes sent to SSL, 163 bytes sent to socket 2006.03.31 11:40:07 LOG7[3396:3320]: https finished (0 left) 2006.03.31 11:40:07 LOG7[3396:2952]: https accepted FD=220 from 127.0.0.1:2417 2006.03.31 11:40:07 LOG7[3396:2952]: Creating a new thread 2006.03.31 11:40:07 LOG7[3396:2952]: New thread created 2006.03.31 11:40:07 LOG7[3396:3944]: https started 2006.03.31 11:40:07 LOG7[3396:3944]: FD 220 in non-blocking mode 2006.03.31 11:40:07 LOG5[3396:3944]: https connected from 127.0.0.1:2417 2006.03.31 11:40:07 LOG7[3396:3944]: FD 232 in non-blocking mode 2006.03.31 11:40:07 LOG7[3396:3944]: https connecting 195.101.206.82:443 2006.03.31 11:40:07 LOG7[3396:3944]: connect_wait: waiting 10 seconds 2006.03.31 11:40:08 LOG7[3396:3944]: connect_wait: connected 2006.03.31 11:40:08 LOG7[3396:3944]: Remote FD=232 initialized 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): before/connect initialization 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 write client hello A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 read server hello A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 read finished A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 write change cipher spec A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 write finished A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 flush data 2006.03.31 11:40:08 LOG7[3396:3944]: 1 items in the session cache 2006.03.31 11:40:08 LOG7[3396:3944]: 2 client connects (SSL_connect()) 2006.03.31 11:40:08 LOG7[3396:3944]: 2 client connects that finished 2006.03.31 11:40:08 LOG7[3396:3944]: 0 client renegotiations requested 2006.03.31 11:40:08 LOG7[3396:3944]: 0 server connects (SSL_accept()) 2006.03.31 11:40:08 LOG7[3396:3944]: 0 server connects that finished 2006.03.31 11:40:08 LOG7[3396:3944]: 0 server renegotiations requested 2006.03.31 11:40:08 LOG7[3396:3944]: 1 session cache hits 2006.03.31 11:40:08 LOG7[3396:3944]: 0 session cache misses 2006.03.31 11:40:08 LOG7[3396:3944]: 0 session cache timeouts 2006.03.31 11:40:08 LOG6[3396:3944]: SSL connected: previous session reused 2006.03.31 11:40:08 LOG7[3396:3944]: Socket closed on read 2006.03.31 11:40:08 LOG7[3396:3944]: SSL write shutdown 2006.03.31 11:40:08 LOG7[3396:3944]: SSL alert (write): warning: close notify 2006.03.31 11:40:08 LOG7[3396:3944]: SSL_shutdown retrying 2006.03.31 11:40:08 LOG7[3396:3944]: SSL doesn't need to read or write 2006.03.31 11:40:08 LOG6[3396:3944]: s_poll_wait timeout: connection close 2006.03.31 11:40:08 LOG5[3396:3944]: Connection closed: 211 bytes sent to SSL, 163 bytes sent to socket 2006.03.31 11:40:08 LOG7[3396:3944]: https finished (0 left) ---------------------------------------------------- Note the first "Socket closed on read". I think the problem is there. The web reply is "Bad Request (Invalid URL)" Where did I do a mistake ? Thanks for answer, Xavier

1 0

Config for client proxy https (privoxy + stunnel)
by Xavier Cheney 31 Mar '06

31 Mar '06

Hi, I wan to customize web page before viewing by my browser Firefox. With "privoxy" (www.privoxy.org) I can modify (proxy filter) HTTP web page, but not HTTPS pages. So, I want to use stunnel, to transfer HTTPS in HTTP between my proxy and server, like this : browser (8118) <-> (8118) privoxy (8888) <-> (8888) stunnel (server:443) <-web-> server This is my stunnel.conf : ---------------------------------------------------- ciphers = RC4-MD5:DES-CBC3-SHA verify = 0 debug = 7 client = yes [https] accept = 8888 connect = server.server.com:443 TIMEOUTclose = 0 ---------------------------------------------------- And my log : ---------------------------------------------------- 2006.03.31 11:40:02 LOG7[3396:2944]: RAND_status claims sufficient entropy for the PRNG 2006.03.31 11:40:02 LOG6[3396:2944]: PRNG seeded successfully 2006.03.31 11:40:02 LOG7[3396:2944]: SSL context initialized for service https 2006.03.31 11:40:02 LOG5[3396:2944]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.03.31 11:40:02 LOG5[3396:2944]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.03.31 11:40:02 LOG5[3396:2952]: No limit detected for the number of clients 2006.03.31 11:40:02 LOG7[3396:2952]: FD 192 in non-blocking mode 2006.03.31 11:40:02 LOG7[3396:2952]: SO_REUSEADDR option set on accept socket 2006.03.31 11:40:02 LOG7[3396:2952]: https bound to 0.0.0.0:8888 2006.03.31 11:40:07 LOG7[3396:2952]: https accepted FD=200 from 127.0.0.1:2414 2006.03.31 11:40:07 LOG7[3396:2952]: Creating a new thread 2006.03.31 11:40:07 LOG7[3396:2952]: New thread created 2006.03.31 11:40:07 LOG7[3396:3320]: https started 2006.03.31 11:40:07 LOG7[3396:3320]: FD 200 in non-blocking mode 2006.03.31 11:40:07 LOG5[3396:3320]: https connected from 127.0.0.1:2414 2006.03.31 11:40:07 LOG7[3396:3320]: FD 232 in non-blocking mode 2006.03.31 11:40:07 LOG7[3396:3320]: https connecting 195.101.206.82:443 2006.03.31 11:40:07 LOG7[3396:3320]: connect_wait: waiting 10 seconds 2006.03.31 11:40:07 LOG7[3396:3320]: connect_wait: connected 2006.03.31 11:40:07 LOG7[3396:3320]: Remote FD=232 initialized 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): before/connect initialization 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 write client hello A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 read server hello A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 read server certificate A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 read server done A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 write client key exchange A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 write change cipher spec A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 write finished A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 flush data 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 read finished A 2006.03.31 11:40:07 LOG7[3396:3320]: 1 items in the session cache 2006.03.31 11:40:07 LOG7[3396:3320]: 1 client connects (SSL_connect()) 2006.03.31 11:40:07 LOG7[3396:3320]: 1 client connects that finished 2006.03.31 11:40:07 LOG7[3396:3320]: 0 client renegotiations requested 2006.03.31 11:40:07 LOG7[3396:3320]: 0 server connects (SSL_accept()) 2006.03.31 11:40:07 LOG7[3396:3320]: 0 server connects that finished 2006.03.31 11:40:07 LOG7[3396:3320]: 0 server renegotiations requested 2006.03.31 11:40:07 LOG7[3396:3320]: 0 session cache hits 2006.03.31 11:40:07 LOG7[3396:3320]: 0 session cache misses 2006.03.31 11:40:07 LOG7[3396:3320]: 0 session cache timeouts 2006.03.31 11:40:07 LOG6[3396:3320]: SSL connected: new session negotiated 2006.03.31 11:40:07 LOG6[3396:3320]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2006.03.31 11:40:07 LOG7[3396:3320]: Socket closed on read 2006.03.31 11:40:07 LOG7[3396:3320]: SSL write shutdown 2006.03.31 11:40:07 LOG7[3396:3320]: SSL alert (write): warning: close notify 2006.03.31 11:40:07 LOG7[3396:3320]: SSL_shutdown retrying 2006.03.31 11:40:07 LOG7[3396:3320]: SSL doesn't need to read or write 2006.03.31 11:40:07 LOG6[3396:3320]: s_poll_wait timeout: connection close 2006.03.31 11:40:07 LOG5[3396:3320]: Connection closed: 211 bytes sent to SSL, 163 bytes sent to socket 2006.03.31 11:40:07 LOG7[3396:3320]: https finished (0 left) 2006.03.31 11:40:07 LOG7[3396:2952]: https accepted FD=220 from 127.0.0.1:2417 2006.03.31 11:40:07 LOG7[3396:2952]: Creating a new thread 2006.03.31 11:40:07 LOG7[3396:2952]: New thread created 2006.03.31 11:40:07 LOG7[3396:3944]: https started 2006.03.31 11:40:07 LOG7[3396:3944]: FD 220 in non-blocking mode 2006.03.31 11:40:07 LOG5[3396:3944]: https connected from 127.0.0.1:2417 2006.03.31 11:40:07 LOG7[3396:3944]: FD 232 in non-blocking mode 2006.03.31 11:40:07 LOG7[3396:3944]: https connecting 195.101.206.82:443 2006.03.31 11:40:07 LOG7[3396:3944]: connect_wait: waiting 10 seconds 2006.03.31 11:40:08 LOG7[3396:3944]: connect_wait: connected 2006.03.31 11:40:08 LOG7[3396:3944]: Remote FD=232 initialized 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): before/connect initialization 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 write client hello A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 read server hello A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 read finished A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 write change cipher spec A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 write finished A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 flush data 2006.03.31 11:40:08 LOG7[3396:3944]: 1 items in the session cache 2006.03.31 11:40:08 LOG7[3396:3944]: 2 client connects (SSL_connect()) 2006.03.31 11:40:08 LOG7[3396:3944]: 2 client connects that finished 2006.03.31 11:40:08 LOG7[3396:3944]: 0 client renegotiations requested 2006.03.31 11:40:08 LOG7[3396:3944]: 0 server connects (SSL_accept()) 2006.03.31 11:40:08 LOG7[3396:3944]: 0 server connects that finished 2006.03.31 11:40:08 LOG7[3396:3944]: 0 server renegotiations requested 2006.03.31 11:40:08 LOG7[3396:3944]: 1 session cache hits 2006.03.31 11:40:08 LOG7[3396:3944]: 0 session cache misses 2006.03.31 11:40:08 LOG7[3396:3944]: 0 session cache timeouts 2006.03.31 11:40:08 LOG6[3396:3944]: SSL connected: previous session reused 2006.03.31 11:40:08 LOG7[3396:3944]: Socket closed on read 2006.03.31 11:40:08 LOG7[3396:3944]: SSL write shutdown 2006.03.31 11:40:08 LOG7[3396:3944]: SSL alert (write): warning: close notify 2006.03.31 11:40:08 LOG7[3396:3944]: SSL_shutdown retrying 2006.03.31 11:40:08 LOG7[3396:3944]: SSL doesn't need to read or write 2006.03.31 11:40:08 LOG6[3396:3944]: s_poll_wait timeout: connection close 2006.03.31 11:40:08 LOG5[3396:3944]: Connection closed: 211 bytes sent to SSL, 163 bytes sent to socket 2006.03.31 11:40:08 LOG7[3396:3944]: https finished (0 left) ---------------------------------------------------- Note the first "Socket closed on read". I think the problem is there. The web reply is "Bad Request (Invalid URL)" Where did I do a mistake ? Thanks for answer, Xavier --------------------------------- Nouveau : téléphonez moins cher avec Yahoo! Messenger ! Découvez les tarifs exceptionnels pour appeler la France et l'international.Téléchargez la version beta. --------------------------------- Nouveau : téléphonez moins cher avec Yahoo! Messenger ! Découvez les tarifs exceptionnels pour appeler la France et l'international.Téléchargez la version beta.

1 0

Stunnel client failed to connect to a server?
by Xia David You -X (xiyou - Varite Inc.＠Cisco) 31 Mar '06

31 Mar '06

Hi, I have a client which is build on stunnel which is failed to talk to a secured server while we can connect to the server with IE as client. We have both Server certificate and Client Certificate. From looking the log, it appears that the IE also got the same failure in the first step, but it did not give up and tried again with "2 1 0.0470 (0.0470) C>S SSLv2 compatible client hello" and successed. so what did we do wrong here? some extra openssl library need to be built in? thanks David Both Sever side SSL dump attached (IE client and Stunnel client).

1 0

unpublished Ceritificate
by Happy Manocha 28 Mar '06

28 Mar '06

Hi all, I am a newbie with Stunnel. Can anyone let me know how can I configure my client for a server , which does not have published certificate. Though I am able to connect but it gives a warning message "The server you are connected to is using a security certificate that could not be verifed...etc". Is there any way to avoid it? An early response will be appreciated. Regds Happy Manocha

2 1

stunnel runs in background but fails to do his job
by christof mestdag 19 Mar '06

19 Mar '06

hi, i'm having difficulties using the stunnel program. I've got some help to change the syntax from 3.X to 4.X but it doesn't work. I've got this config file -> client=yes output=/var/log/stunnel.log [ldaps] accept=localhost:389 connect=192.168.1.101:636 I run it with /usr/sbin/stunnel ./stunnel.conf -> check background: ps -ef | grep stunnel root 3270 ..... /usr/sbin/stunnel ./stunnel.conf Problem is when i close on server gate 389 i can't get any input. I expect the traffic going towards port 636 on server but it doenst. I can close port 636 and open just 389. He keeps sending everyting towards 389. I also tried to create a stunnel.conf by using make stunnel.conf in the tools directory ( in you tar.gz ) but nothing changes. /var/log/stunnel.log says -> date : stunnel 4.05 on i386-red hat .... with openssl 0.9.7a ->date : FD_SETSIZE=1024 file ulimt=1024 -> 500 clients allowed any input for my problem. It's kinda important. I'm really fed up with the tutorials which shows it works and everything always fails at my place :( greetz christof

1 0

converting old syntax to 4.x syntax
by christof mestdag 17 Mar '06

17 Mar '06

Hi, i've got a old syntax and i don't find what the new syntax might be. stunnel -c -d localhost:389 -r win2003server:636 ( I want to make a tunnel to the ssl port of the active directory server to allow password changes ) i've read a possibility which allows no use of certificates but it was in old syntax. any input to change that syntax? i thought it might be something like this. -> client=yes foreground=no accept = 389 connect = win2003server.FME.local what do i do with this. an upgrade manual speaks of an stunnel.conf file. But this one doesn't excists on my Red Hat Desktop computer. It says also that we have an /usr/local/etc/stunnel dir but i don't have that also. I only have an /etc/stunnel dir (which is totally empty ) and the /usr/sbin/stunnel tool ( version 4.05 ) thx in advance

2 2

Multiple Host Certificates
by Sligar, Benjamin 17 Mar '06

17 Mar '06

Is it possible to run one instance of stunnel and have it verify certain ports against different certificates? For instance: [listen1 5003] accept = 5003 connect = 10.61.0.132:7300 [listen2 5008] accept = 5008 connect = 10.61.0.132:7300 Would it be possible to have listen2 validate on a seperate certificate, or, will I need to run a second instance of stunnel on my box and have it point to the different certificate? Basically, I want to know if I can setup a different certificate on a per-port basis. I don't see any options in the definition of the listen port that I can specify a different CERT, only the default CERT option at the top of the config file. Version: stunnel-4.04 Options cert = /usr/local/conf/ssl.pem chroot = /usr/local/stunnel-4.04/var/run/stunnel/ pid = /stunnel.pid setuid = www setgid = webgroup options = NO_SSLv2 ciphers = DES-CBC3-SHA:IDEA-CBC-SHA:RC4-SHA:RC4-MD5:AES256-SHA:AES128-SHA uname -a Linux ssl 2.4.7-10 #1 Thu Sep 6 17:27:27 EDT 2001 i686 unknown gcc -v Reading specs from /usr/lib/gcc-lib/i386-redhat-linux/2.96/specs gcc version 2.96 20000731 (Red Hat Linux 7.1 2.96-98) openssl version OpenSSL 0.9.6b [engine] 9 Jul 2001 This e-mail message is for the sole use of the intended recipient(s) and may contain confidential and privileged information of Transaction Network Services. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

2 1

Help with config of stunnel.
by mike smith 16 Mar '06

16 Mar '06

I am trying to set up a tunnel for telnet. I am doing this just to learn how to get stunnel to work. I thought this would be easy way to learn how to use stunnel for other uses we have. My problem is I don't understand how to start it on the client side. I can telnet to the server without stunnel but I don't know how to start stunnel on the client side. The log file shows ssltelnet bound to 0.0.0.0:23 for the client and ssltelnet bound to 0.0.0.0:992 for the server If you have any ideas what I may need to do I would be greatfull. I'm sure that I'm missing a step configuring it. This is what my stunnel.conf files look like for the server cert = /usr/local/etc/stunnel/stunnel.pem chroot = /usr/local/var/run/stunnel/ pid = /stunnel.pid setuid = nobody setgid = nobody client = no debug = 7 output = /stunnel.log [ssltelnet] accept = 992 connect = 23 For the Client cert = /usr/local/etc/stunnel/stunnel.pem chroot = /usr/local/var/run/stunnel/ pid = /stunnel.pid setuid = nobody setgid = nobody client = yes debug = 7 output = /stunnel.log [ssltelnet] accept = 23 connect = 192.168.1.102:992 --------------------------------- Yahoo! Travel Find great deals to the top 10 hottest destinations! --------------------------------- Yahoo! Travel Find great deals to the top 10 hottest destinations!

1 0

IE tries to verify client certificate?
by Don Werve 15 Mar '06

15 Mar '06

I've got stunnel providing SSL wrapper services for an otherwise SSL-stupid vendor-webserver-thingy that listens on port 80. I'm using a wildcard certificate purchased from $VENDOR, and it seems to work fine in Safari, Firefox, w3m, and basically everything SSL aware known to Man. Except, that is, Internet Explorer, where the user gets a popup window asking them to choose a certificate to verify their connection. This is really throwing me for a loop; I've tried setting 'verify = 0' and 'options = ALL' in the service definition under stunnel, no dice. Any ideas why IE thinks it needs to verify, but nothing else does? -- Don Werve <donw(a)iradeon.net> Chief Systems Administrator / Systems Architect

1 0

GeoTrust QuickSSL cert and stunnel
by Steve Shepherd 15 Mar '06

15 Mar '06

I've got a client that has a GeoTrust "QuickSSL" certificate (we normally deal with Thawte). I installed the cert/key, but it is not functioning (pulling up default certificate), so I figured I would need the CA. I gathered the CA, so in the file I have: Certificate Private Key Certificate GeoTrust CA Where is the default location to install other CA's and/or chained certs? Thanks!

1 0

RE: [stunnel-users] Static Version Built?
by Kevin A. McGrail 15 Mar '06

15 Mar '06

That would be my guess but the last time I wanted static binaries was Redhat 2.1 on a DEC Alpha-based machine, sorry. -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Hal Vaughan Sent: Wednesday, March 15, 2006 1:25 PM To: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Static Version Built? On Wednesday 15 March 2006 13:04, Kevin A. McGrail wrote: > Do you have static libraries in your SSL lib or just shared libraries? > i.e. libssl.a (static) and libssl.so (dynamic) or just one or the > other? > > Have you tested with ldd? > > For example, on my machine, I get this showing me I'm linking > dynamically. > > ldd /usr/sbin/stunnel > libutil.so.1 => /lib/libutil.so.1 (0x40023000) > libpthread.so.0 => /lib/i686/libpthread.so.0 (0x40027000) > libnsl.so.1 => /lib/libnsl.so.1 (0x4003b000) > libdl.so.2 => /lib/libdl.so.2 (0x40050000) > libssl.so.2 => /lib/libssl.so.2 (0x40053000) > libcrypto.so.2 => /lib/libcrypto.so.2 (0x40080000) > libc.so.6 => /lib/i686/libc.so.6 (0x42000000) > /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000) > > Regards, > KAM Yes, I'm getting the same thing, so it's linking to the shared libraries, even though in the cases I've checked, I have the static libraries. Hal _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

RE: [stunnel-users] Static Version Built?
by Kevin A. McGrail 15 Mar '06

15 Mar '06

Do you have static libraries in your SSL lib or just shared libraries? i.e. libssl.a (static) and libssl.so (dynamic) or just one or the other? Have you tested with ldd? For example, on my machine, I get this showing me I'm linking dynamically. ldd /usr/sbin/stunnel libutil.so.1 => /lib/libutil.so.1 (0x40023000) libpthread.so.0 => /lib/i686/libpthread.so.0 (0x40027000) libnsl.so.1 => /lib/libnsl.so.1 (0x4003b000) libdl.so.2 => /lib/libdl.so.2 (0x40050000) libssl.so.2 => /lib/libssl.so.2 (0x40053000) libcrypto.so.2 => /lib/libcrypto.so.2 (0x40080000) libc.so.6 => /lib/i686/libc.so.6 (0x42000000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000) Regards, KAM -----Original Message----- From: Hal Vaughan [mailto:[email protected]] Sent: Wednesday, March 15, 2006 12:55 PM To: Kevin A. McGrail Subject: Re: [stunnel-users] Static Version Built? On Wednesday 15 March 2006 12:24, you wrote: > It's not going to use source. It's going to use headers and compiled > libraries. Specifying it just helps point it to the correct headers > and libraries if you for example, have them installed in an unusual > place or have more than one set on your machine. Does it link to those libs or incorporate them into the binary (if I'm building static with the correct command line options)? Sorry to ask so many questions, but I've had no experience in C or C++. Thanks, Hal

2 1

Static Version Built?
by Hal Vaughan 15 Mar '06

15 Mar '06

Okay, I think I have a static version of Stunnel now. Thanks to help and answers from Jan and Keven! I did this: ./configure --with-ssl=/usr --enable-static --disable-shared --disable-libwrap I'm not sure about the "--with-ssl" option, but it didn't seem to want to work without it. So I have a few questions: 1) How can I be sure it is static? 2) If it isn't static and I run it on a system that does not have all it needs, will it give me errors immediately, or only if a subroutine needs a library that isn't there. 3) Does the "--disable-libwrap" or anything else remove any features? 4) Does using the "--with-ssl" option make it use the libs on my system and make it non-static? 5) My "best guess" is that to install a static version, I just copy over the files src/stunnel and src/libstunnel.la to /usr/bin and /usr/lib, respectively. Is that right? (And, of course, copy man files to the right place.) Thanks -- I hope I'll be done with all these questions soon. Hal

2 4

Logging change in 4.15
by MeeAGhost 15 Mar '06

15 Mar '06

Running 4.15 the messages below being written to STDOUT whenever I start stunnel but not written to the the file defined by output in the .conf file. In prior versions the messages were written to whatever I had defined output to equal. 2006.03.14 19:40:03 LOG7[11513:1]: Snagged 64 random bytes from /export/home/ghost/.rnd 2006.03.14 19:40:03 LOG7[11513:1]: Wrote 1024 new random bytes to /export/home/ghost/.rnd 2006.03.14 19:40:03 LOG7[11513:1]: RAND_status claims sufficient entropy for the PRNG 2006.03.14 19:40:03 LOG6[11513:1]: PRNG seeded successfully 2006.03.14 19:40:03 LOG7[11513:1]: Certificate: /usr/local/etc/stunnel/server.pem 2006.03.14 19:40:03 LOG7[11513:1]: Key file: /usr/local/etc/stunnel/server.pem 2006.03.14 19:40:03 LOG7[11513:1]: Loaded verify certificates from /usr/local/etc/stunnel/cacert.pem 2006.03.14 19:40:03 LOG7[11513:1]: Verify directory set to /usr/local/etc/stunnel/certificates 2006.03.14 19:40:03 LOG5[11513:1]: Peer certificate location /usr/local/etc/stunnel/certificates I looked in ctx.c and ssl.c at the calls to s_log (in log.c) but wasn't able to determine what would cause some messages to be written to the output file and the messages above to be written to STDOUT. I think it has to do with file_putline not being passed the output file name. Anyone else seeing this behavior? -- Chris

2 1

What is "lwrap"? (compiling problem)
by Hal Vaughan 15 Mar '06

15 Mar '06

I keep getting a message: /usr/bin/ld: cannot find -lwrap when I try make. I had to use: ./configure --with-ssl=/usr and it worked, but I keep getting the above error message. I've Googled for it and it seems to reference an SSL library, but it looks like I've got them all installed (unless it needs Python SSL libraries). Thanks! Hal

1 0

SSL Libraries on Debian
by Hal Vaughan 14 Mar '06

14 Mar '06

I tried compiling Stunnel on Debian and get an error -- I need the ssl libraries. I tried ./configure --with-ssl=/usr/lib/ssl, which is where libssl-dev was installed, and it doesn't help. There is a libssl file in /usr/lib, but --with-ssl=/usr/lib/ssl doesn't seem to work either. What package on Debian provides the needed headers (according to aptitude, libssl-dev, the one I installed, does, but experience is telling me otherwise). (This, btw, is why I am trying to make static binaries -- you can never tell what to expect on Linux systems at this point. Often config/make doesn't work and there are many times when packages don't work out for one reason or another.) Thanks for any help on this. Hal

3 4

stunnel 4.14 died silently under traffic stress test
by Zhuang Yuyao 14 Mar '06

14 Mar '06

Hi, While doing apache benchmark test, stunnel 4.14 died silently. Network topo: client(192.168.20.81 debian running ab2) ---(https)---> gateway(192.168.20.1 running stunnel in server mode) ---(http)---> web server(192.168.10.254) Gateway hardware: 80386 compatible cpu (VIA C3 400Mhz); RAM: 64M stunnel.conf: ############################### ..... compression = zlib client = no ciphers = DES-CBC3-SHA:DES-CBC3-MD5 verify = 1 [test] accept = 443 connect = 192.168.10.254:80 TIMEOUTclose = 0 ############################### Web Server hardware: Dell 2850 with 2G RAM. test_100k.html is a html file whose size is 100k bytes. test_4k.html is a html file whose size is 4k bytes. In client, I am using ab2 as the stress test tool: #ab2 -n 200 -c 100 https://192.168.20.1:443/test_4k.html (means 200 request and 100 concurrency) successfully finished. #ab2 -n 200 -c 100 https://192.168.20.1:443/test_100k.html (means 200 request and 100 concurrency) stunnel died after a few seconds, running log shows: 2006.03.09 15:20:39 LOG5[6962:1024]: stunnel 4.14 on i386-pc-linux-gnu PTHREAD+POLL+IPv4 with OpenSSL 0.9.7i 14 Oct 2005 2006.03.09 15:20:39 LOG5[6962:1024]: 500 clients allowed 2006.03.09 15:20:53 LOG5[6964:1026]: test connected from 192.168.20.81:50186 2006.03.09 15:20:53 LOG5[6965:2051]: test connected from 192.168.20.81:50187 2006.03.09 15:20:53 LOG5[6966:3076]: test connected from 192.168.20.81:50188 2006.03.09 15:20:53 LOG5[6967:4101]: test connected from 192.168.20.81:50189 2006.03.09 15:20:53 LOG5[6968:5126]: test connected from 192.168.20.81:50190 2006.03.09 15:20:54 LOG5[6969:6151]: test connected from 192.168.20.81:50191 2006.03.09 15:20:54 LOG5[6970:7176]: test connected from 192.168.20.81:50192 2006.03.09 15:20:54 LOG5[6971:8201]: test connected from 192.168.20.81:50193 2006.03.09 15:20:54 LOG5[6972:9226]: test connected from 192.168.20.81:50194 2006.03.09 15:20:54 LOG5[6973:10251]: test connected from 192.168.20.81:50195 2006.03.09 15:20:54 LOG5[6974:11276]: test connected from 192.168.20.81:50196 2006.03.09 15:20:54 LOG5[6975:12301]: test connected from 192.168.20.81:50197 2006.03.09 15:20:54 LOG5[6976:13326]: test connected from 192.168.20.81:50198 2006.03.09 15:20:54 LOG5[6977:14351]: test connected from 192.168.20.81:50199 2006.03.09 15:20:54 LOG5[6978:15376]: test connected from 192.168.20.81:50200 2006.03.09 15:20:54 LOG5[6979:16401]: test connected from 192.168.20.81:50201 2006.03.09 15:20:54 LOG5[6980:17426]: test connected from 192.168.20.81:50202 2006.03.09 15:20:54 LOG5[6981:18451]: test connected from 192.168.20.81:50203 2006.03.09 15:20:54 LOG5[6982:19476]: test connected from 192.168.20.81:50204 2006.03.09 15:20:54 LOG5[6983:20501]: test connected from 192.168.20.81:50205 2006.03.09 15:20:54 LOG5[6984:21526]: test connected from 192.168.20.81:50206 2006.03.09 15:20:54 LOG5[6985:22551]: test connected from 192.168.20.81:50207 2006.03.09 15:20:54 LOG5[6986:23576]: test connected from 192.168.20.81:50208 2006.03.09 15:20:54 LOG5[6987:24601]: test connected from 192.168.20.81:50209 2006.03.09 15:20:54 LOG5[6988:25626]: test connected from 192.168.20.81:50210 2006.03.09 15:20:54 LOG5[6989:26651]: test connected from 192.168.20.81:50211 2006.03.09 15:20:54 LOG5[6990:27676]: test connected from 192.168.20.81:50212 2006.03.09 15:20:54 LOG5[6991:28701]: test connected from 192.168.20.81:50213 2006.03.09 15:20:54 LOG5[6992:29726]: test connected from 192.168.20.81:50214 2006.03.09 15:20:54 LOG5[6993:30751]: test connected from 192.168.20.81:50215 2006.03.09 15:20:54 LOG5[6994:31776]: test connected from 192.168.20.81:50216 2006.03.09 15:20:54 LOG5[6995:32801]: test connected from 192.168.20.81:50217 2006.03.09 15:20:54 LOG5[6996:33826]: test connected from 192.168.20.81:50218 2006.03.09 15:20:54 LOG5[6997:34851]: test connected from 192.168.20.81:50219 2006.03.09 15:20:54 LOG5[6998:35876]: test connected from 192.168.20.81:50220 2006.03.09 15:20:54 LOG5[6999:36901]: test connected from 192.168.20.81:50221 2006.03.09 15:20:54 LOG5[7000:37926]: test connected from 192.168.20.81:50222 2006.03.09 15:20:54 LOG5[7001:38951]: test connected from 192.168.20.81:50223 2006.03.09 15:20:54 LOG5[7002:39976]: test connected from 192.168.20.81:50224 2006.03.09 15:20:54 LOG5[7003:41001]: test connected from 192.168.20.81:50225 2006.03.09 15:20:54 LOG5[7004:42026]: test connected from 192.168.20.81:50226 2006.03.09 15:20:55 LOG5[7005:43051]: test connected from 192.168.20.81:50227 2006.03.09 15:20:55 LOG5[7006:44076]: test connected from 192.168.20.81:50228 2006.03.09 15:20:55 LOG5[7007:45101]: test connected from 192.168.20.81:50229 2006.03.09 15:20:55 LOG5[7008:46126]: test connected from 192.168.20.81:50230 2006.03.09 15:20:55 LOG5[7009:47151]: test connected from 192.168.20.81:50231 2006.03.09 15:20:55 LOG5[7010:48176]: test connected from 192.168.20.81:50232 2006.03.09 15:20:55 LOG5[7011:49201]: test connected from 192.168.20.81:50233 2006.03.09 15:20:55 LOG5[7012:50226]: test connected from 192.168.20.81:50234 2006.03.09 15:20:55 LOG5[7013:51251]: test connected from 192.168.20.81:50235 2006.03.09 15:20:55 LOG5[7014:52276]: test connected from 192.168.20.81:50236 2006.03.09 15:20:55 LOG5[7015:53301]: test connected from 192.168.20.81:50237 2006.03.09 15:20:55 LOG5[7016:54326]: test connected from 192.168.20.81:50238 2006.03.09 15:20:55 LOG5[7017:55351]: test connected from 192.168.20.81:50239 2006.03.09 15:20:55 LOG5[7018:56376]: test connected from 192.168.20.81:50240 2006.03.09 15:20:55 LOG5[7019:57401]: test connected from 192.168.20.81:50241 2006.03.09 15:20:55 LOG5[7020:58426]: test connected from 192.168.20.81:50242 2006.03.09 15:20:55 LOG5[7021:59451]: test connected from 192.168.20.81:50243 2006.03.09 15:20:55 LOG5[7022:60476]: test connected from 192.168.20.81:50244 2006.03.09 15:20:55 LOG5[7023:61501]: test connected from 192.168.20.81:50245 2006.03.09 15:20:55 LOG5[7024:62526]: test connected from 192.168.20.81:50246 Killed It looks like that is resource on gateway is exhausted under such a traffic, but my question is: why stunnel just died instead of rejecting further connections. Thanks very much. Zhuang Yuyao

2 7

Static Binaries for Linux? (Didn't get answer previously)
by Hal Vaughan 13 Mar '06

13 Mar '06

I've brought this up before and didn't get ANY answer at all, and I'm sure someone involved with Stunnel would at least know if what I'm asking is possible. I know help is given on a volunteer basis, so if someone could help me figure this out, it would be a huge help. So far I've spent over a week on getting Stunnel or another program to do the job and if I can't get this to work, I need to just drop Stunnel and figure out how to do the same thing in Java. So thanks for any help. I may need to include Stunnel with my application so my clients behind restrictive firewalls can still enable me to work on their systems with RealVNC. I'm working with clients on both Windows and Linux. Is there a way to get static binaries for Linux? I don't know C or C++ or much more than running ./configure && make && make install. I'd like to know if it is possible or what is needed to create static binaries of the files so I could easily install stunnel on any Linux system by just copying over the proper files. Also, what archive format does the Windows installer use? I'd like to do something similar for Windows, so if I could pull the files out of the installer and copy them over myself, it would be a huge help. Thanks! Hal

3 4

Compile failure with 4.15
by MeeAGhost 13 Mar '06

13 Mar '06

I ran ./configure --enable-dh --disable-libwrap then when I try to execute make the build fails: [...] if gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.15\" -DPACKAGE_STRING=\"stunnel\ 4.15\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.15\" -DHOST=\"sparc-sun-solaris2.9\" -DCPU_SPARC=1 -DVENDOR_SUN=1 -DOS_SOLARIS2_9=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DHAVE_LIBNSL=1 -DHAVE_LIBSOCKET=1 -DHAVE_LIBDL=1 -DHAVE_LIBZ=1 -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_SYS_FILIO_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_GETCONTEXT=1 -DHAVE___MAKECONTEXT_V2=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETADDRINFO=1 -DHAVE_GETNAMEINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/usr/local\" -DHAVE_OSSL_ENGINE_H=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DUSE_DH=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/local/include -MT ctx.o -MD -MP -MF ".deps/ctx.Tpo" -c -o ctx.o ctx.c; \ then mv -f ".deps/ctx.Tpo" ".deps/ctx.Po"; else rm -f ".deps/ctx.Tpo"; exit 1; fi ctx.c: In function `init_dh': ctx.c:170: error: `section' undeclared (first use in this function) ctx.c:170: error: (Each undeclared identifier is reported only once ctx.c:170: error: for each function it appears in.) ctx.c:198: error: `ctx' undeclared (first use in this function) ctx.c: In function `crl_callback': ctx.c:491: warning: cast increases required alignment of target type make[1]: *** [ctx.o] Error 1 make[1]: Leaving directory `/tmp/stunnel-4.15/src' make: *** [all-recursive] Error 1 I checked ctx.c and couldn't see where section and ctx are being defined inside of the init_dh function nor could I see them defined in the header files. Am I missing something? TIA for any assistance. -- Chris

2 1

Rainbow Technologies CryptoSwift CS200 driver
by Michal Trojnara 11 Mar '06

11 Mar '06

Dear Users, I just bought a second-hand Rainbow Technologies CryptoSwift CS200 card to test engine support for stunnel. Unfortunately I can't find any Linux/Windows driver for this card. Do you have one? Please help. Best regards, Mike

2 1

stunnel 4.15 released
by Michal Trojnara 11 Mar '06

11 Mar '06

Version 4.15, 2006.03.11, urgency: LOW: * Release notes - There are a lot of new features in this version. I recommend to test it well before upgrading your mission-critical systems. * Bugfixes - Fix for pthreads on Solaris 10 (thx to Hans Werner Strube <strube(a)physik3.gwdg.de>). - Attempt to autodetect socklen_t type in configure script. - Default threading model changed to pthread for better portability. - DH parameters are not included in the certificate by default. * New features sponsored by Software House http://www.swhouse.com/ - Most SSL-related options (including client, cert, key) are now available on service level, so it is possible to have an SSL client and an SSL server in a single stunnel process. - Windows CE (version 3.0 and higher) support. * New features - Client mode CONNECT protocol support (RFC 2817 section 5.2). http://www.ietf.org/rfc/rfc2817.txt - Retrying exec+connect services added. * File locations are more compliant to Filesystem Hierarchy Standard 2.3 - configuration and certificates are in $prefix/etc/stunnel/ - binaries are in $prefix/sbin/ - default pid file is $prefix/var/run/stunnel.pid - manual is $prefix/man/man8/stunnel.8 - other docs are in $prefix/share/doc/stunnel/ - libstunnel is in $prefix/lib - chroot directory is setup in $prefix/var/lib/stunnel/ this directory is chmoded 1770 and group nogroup sha1sum for stunnel-4.15.tar.gz: 735406c1ca94904581158a434214e1f6568539d0 Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Mike

1 0

"STACK_RESERVE is too high" after every connect
by Rob Munsch 10 Mar '06

10 Mar '06

Hello. I've recently gone on a self-inflicted crash course on openssl and seem to have gotten a centralized logging system going, logging to MySQL. I'm seeing everything i'd expect to see, but with an extra bit: what is STACK_RESERVE, and why is it too high? Some context, mildly sanitized: |Mar 9 18:33:34 isis stunnel: LOG5[24810:6]: syslog-ng connected from x.x.x.x:44032| |Mar 9 18:33:34 isis stunnel: LOG5[24810:6]: VERIFY OK: depth=1, /C=US/ST=Pennsylvania/L=Philadelphia/O=Solutions for Progress/CN=blah.com/emailAddress=blah@blah| |Mar 9 18:33:34 isis stunnel: LOG5[24810:6]: VERIFY OK: depth=0, /C=US/ST=Pennsylvania/O=Solutions for Progress/OU=IT/CN=IT/emailAddress=blah@blah| |Mar 9 20:39:02 isis stunnel: LOG5[24810:6]: Connection closed: 0 bytes sent to SSL, 2891 bytes sent to socket| |Mar 9 20:39:02 isis stunnel: LOG3[24810:6]: STACK_RESERVE is too high| this is daemon.log on the server machine (isis). Messages from the remote host are going to MySQL successfully. But at the end of every apparently-successful transaction, there's this stack complaint. Can't find anything in the archives or via Google for "stunnel stack_reserve," which i found really odd, which is why i'm here... Version output: stunnel 4.14 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7g 11 Apr 2005 Thanks! -- Rob Munsch Solutions For Progress IT

2 1

RE: How to get tcpwrappers configured/compiled into stunnel 4.04 on Tru64 UNIX 5.1B
by John Lanier 08 Mar '06

08 Mar '06

Hello, I am a newbie to stunnel and tcpwrappers, so please bear with me: I am trying to compile tcpwrapper support into stunnel v4.04 on Tru64 UNIX v5.1B (apparently v4.14 does not compile on 5.1A or higher, per http://stunnel.mirt.net/pipermail/stunnel-users/2006-January/000935.html) I am having what appears to be problems getting tcpwrapper support to compile with 4.04. I have consulted the following resources, but I am still having problems: ------------------------------------------------------------------------------------------------------- 1. http://www.stunnel.org/faq/troubleshooting.html#ToC9 "configure isn't finding my TCP Wrapper installation" Solution: You probably have it in a non-standard place, ie somewhere that gcc can't find it on it's own. Let's say you had your tcp wrappers installed in /opt/tcpd_7.6. To help gcc find your include files and libraries, you'd want to set three environment variables as follows: CFLAGS="$CFLAGS -I/opt/tcpd_7.6/include" CPPFLAGS="$CPPFLAGS -I/opt/tcpd_7.6/include" LDFLAGS="$LDFLAGS -L/opt/tcpd_7.6/lib" export CFLAGS CPPFLAGS LDFLAGS And then re-run configure. This is the generic way to have configure find specific libraries, and is not specific to Stunnel itself. 2. http://www.stunnel.org/faq/run.html#ToC5 "Running stunnel with TCP wrappers" You do not need to use the tcpd binary to wrap stunnel (although you could). You can can compile in support for TCP wrappers when you compile stunnel itself. The configure program should be able to determine if the libwrap library (-lwrap) and headers are available in standard locations. ............. I have openssl 0.9.7h installed on ccpe01 v51b pk#5, with tcp-wrappers7.6. I did the configure, make and make install and things. All stages appeared successful, but then I attempted the ./configure --with-tcp-wrappers and it errored with -lwrap not found. checking for SSL directory... /usr/local/ssl checking for "/dev/urandom"... yes checking whether to disable RSA support... no checking whether to enable DH support... no checking for gethostbyname in -lnsl... no checking for socket in -lsocket... no checking for pthread_create in -lpthread... no checking for pthread_create in -lc_r... no checking for openpty in -lutil... yes checking whether to use the libwrap (TCP wrappers) library... yes checking for hosts_access in -lwrap... not found <-- .............. So then I tried assigning the 3 environment variables and things got worse. The include and lib directories are referenced for tcpd 7.6, but after installing tcp wrappers I do not find include or lib directories for tcpd. Q: Should I expect NOT to see the include or lib directories as defined in #1 above, and, if so, will specifying the absolute path to the tcpwrapper images (EX: /var/tcp_wrappers/tcp_wrappers_7.6) suffice? 3. I followed these instructions when compiling/configuring tcpd v7.6 (downloaded from ftp://ftp.porcupine.org/pub/security/index.html) ............ 7.1 - Easy configuration and installation ----------------------------------------- The "easy" recipe requires no changes to existing software or configuration files. Basically, you move the daemons that you want to protect to a different directory and plug the resulting holes with copies of the wrapper programs. If you don't run Ultrix, you won't need the miscd wrapper program. The miscd daemon implements among others the SYSTAT service, which produces the same output as the WHO command. Type `make' and follow the instructions. The Makefile comes with ready-to-use templates for many common UNIX implementations (sun, ultrix, hp-ux, aix, irix,...). .............. Thanks in advance for any guidance and/or advice that you can offer. --John Lanier

1 0

Special Installs -- Static Binaries and Required Files
by Hal Vaughan 08 Mar '06

08 Mar '06

I may need to include Stunnel with my application so my clients behind restrictive firewalls can still enable me to work on their systems with RealVNC. I'm working with clients on both Windows and Linux. Windows: I know the installer has the files included in it in an archive, but what archive format is it, or what kind or archive program on Linux can I use to read it? Is installing Stunnel on Windows just a matter of copying the files, or are there settings I have to change in the registry? Linux: Is there any way to get static binaries (yes, I know they're bigger) so I can just copy over files to install it as a program (not as a service -- I noticed Debian set it up as a service)? Thanks! Hal

1 0

Stunnel Won't Start on Linux (even with fixed /etc/default/stunnel)
by Hal Vaughan 08 Mar '06

08 Mar '06

I'm trying to start stunnel4 on Linux. I've modified the /etc/stunnel/stunnel.conf file so I can use it with RealVNC. When I run "stunnel4 /etc/stunnel/stunnel.conf" or "/etc/init.d/stunnel4 start", neither command gives me errors or any output, even with -d 7 set. After the shell returns control to me, I do "ps -ax" and have yet to see any instance of stunnel running. There is never a file in /var/run/stunnel to indicate a working daemon if I start it as one. I have edited /etc/default/stunnel4 to look like this (changed ENABLED). I've included it and my /etc/stunnel/stunnel.conf below. No matter what I do, there is never any evidence that stunnel is staring or doing anything. Even error messages would be a big help, so I'd at least know what was wrong. Any help appreciated. I'm sure it's something so obvious I don't see how I could miss it. Thanks for any help. Hal -----------------/etc/default/stunnel4------------------------ # /etc/default/stunnel # Julien LEMOINE <speedblue(a)debian.org> # September 2003 # Change to one to enable stunnel ENABLED=1 FILES="/etc/stunnel/*.conf" OPTIONS="" # Change to one to enable ppp restart scripts PPP_RESTART=0 ------------/etc/stunnel/stunnel.conf-------------------- CAfile = /etc/stunnel/CAcert.pem CApath = /etc/stunnel/ cert = server.pem client = no verify = 3 debug = 7 [vnc] accept = 443 connect = 127.0.0.1:5500

2 2

RE: [stunnel-users] Re: Can stunnel do this?
by Matteo D'Amato 07 Mar '06

07 Mar '06

Here is what I'm getting Insude stunnel.conf file: cert=/usr/local/etc/stunnel/stunnel.pem cafile=/usr/local/etc/stunnel/stunnel.pem output=/var/log/stunnel.log client=yes debug=7 [1440] accept=10.10.10.2:1440 connect=192.168.19.50:1078 Launched using: stunnel /etc/stunnel/stunnel.conf -p /usr/local/etc/stunnel/stunnel.pem Log file: 2006.03.07 08:30:01 LOG5[13209:0]: Received signal 15; terminating 2006.03.07 08:30:01 LOG7[13209:0]: removing pid file /usr/local/var/stunnel/stunnel.pid 2006.03.07 08:30:20 LOG5[13219:1]: stunnel 4.14 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 2006.03.07 08:30:20 LOG7[13219:1]: Snagged 64 random bytes from /root/.rnd 2006.03.07 08:30:20 LOG7[13219:1]: Wrote 1024 new random bytes to /root/.rnd 2006.03.07 08:30:20 LOG7[13219:1]: RAND_status claims sufficient entropy for the PRNG 2006.03.07 08:30:20 LOG6[13219:1]: PRNG seeded successfully 2006.03.07 08:30:20 LOG7[13219:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2006.03.07 08:30:20 LOG7[13219:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2006.03.07 08:30:20 LOG6[13219:1]: file ulimit = 1024 (can be changed with 'ulimit -n') 2006.03.07 08:30:20 LOG6[13219:1]: poll() used - no FD_SETSIZE limit for file descriptors 2006.03.07 08:30:20 LOG5[13219:1]: 500 clients allowed 2006.03.07 08:30:20 LOG7[13219:1]: FD 4 in non-blocking mode 2006.03.07 08:30:20 LOG7[13219:1]: FD 5 in non-blocking mode 2006.03.07 08:30:20 LOG7[13219:1]: FD 6 in non-blocking mode 2006.03.07 08:30:20 LOG7[13219:1]: SO_REUSEADDR option set on accept socket 2006.03.07 08:30:20 LOG7[13219:1]: 1440 bound to 10.10.10.2:1440 2006.03.07 08:30:20 LOG7[13220:1]: Created pid file /usr/local/var/stunnel/stunnel.pid 2006.03.07 08:30:20 LOG7[13220:0]: Waiting -1 second(s) for 2 file descriptor(s) 2006.03.07 08:31:46 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:46 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->(IN) 2006.03.07 08:31:46 LOG7[13220:1]: 1440 accepted FD=7 from 10.10.10.100:1049 2006.03.07 08:31:46 LOG7[13220:1]: Creating a new context 2006.03.07 08:31:46 LOG7[13220:1]: Context 2 created 2006.03.07 08:31:46 LOG7[13220:2]: Context swap: 1 -> 2 2006.03.07 08:31:46 LOG7[13220:2]: 1440 started 2006.03.07 08:31:46 LOG7[13220:2]: FD 7 in non-blocking mode 2006.03.07 08:31:46 LOG7[13220:2]: FD 8 in non-blocking mode 2006.03.07 08:31:46 LOG7[13220:2]: FD 9 in non-blocking mode 2006.03.07 08:31:46 LOG7[13221:0]: Waiting 300 second(s) for 3 file descriptor(s) 2006.03.07 08:31:46 LOG7[13221:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:46 LOG7[13221:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:31:46 LOG7[13221:0]: CONTEXT 2, FD=9, (OUT)->(OUT) 2006.03.07 08:31:46 LOG7[13220:0]: Waiting 300 second(s) for 3 file descriptor(s) 2006.03.07 08:31:46 LOG7[13220:0]: Cleaning up the signal pipe 2006.03.07 08:31:46 LOG6[13220:0]: Child process 13221 finished with code 0 2006.03.07 08:31:46 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:46 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:31:46 LOG7[13220:0]: CONTEXT 2, FD=8, (IN)->(INHUP) 2006.03.07 08:31:46 LOG7[13220:2]: Connection from 10.10.10.100:1049 permitted by libwrap 2006.03.07 08:31:46 LOG5[13220:2]: 1440 connected from 10.10.10.100:1049 2006.03.07 08:31:46 LOG7[13220:2]: FD 8 in non-blocking mode 2006.03.07 08:31:46 LOG7[13220:2]: 1440 connecting 192.168.19.50:1078 2006.03.07 08:31:46 LOG7[13220:2]: connect_wait: waiting 10 seconds 2006.03.07 08:31:46 LOG7[13220:0]: Waiting 10 second(s) for 3 file descriptor(s) 2006.03.07 08:31:46 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:46 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:31:46 LOG7[13220:0]: CONTEXT 2, FD=8, (INOUT)->(OUT) 2006.03.07 08:31:46 LOG7[13220:2]: connect_wait: connected 2006.03.07 08:31:46 LOG7[13220:2]: Remote FD=8 initialized 2006.03.07 08:31:46 LOG7[13220:2]: SSL state (connect): before/connect initialization 2006.03.07 08:31:46 LOG7[13220:2]: SSL state (connect): SSLv3 write client hello A 2006.03.07 08:31:46 LOG7[13220:0]: Waiting 300 second(s) for 3 file descriptor(s) 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->(IN) 2006.03.07 08:31:47 LOG7[13220:1]: CONTEXT 2, FD=8, (IN)->() 2006.03.07 08:31:47 LOG7[13220:1]: Context swap: 2 -> 1 2006.03.07 08:31:47 LOG7[13220:1]: Current context: 1 2006.03.07 08:31:47 LOG7[13220:1]: 1440 accepted FD=9 from 10.10.10.100:1050 2006.03.07 08:31:47 LOG7[13220:1]: Creating a new context 2006.03.07 08:31:47 LOG7[13220:1]: Context 3 created 2006.03.07 08:31:47 LOG7[13220:3]: Context swap: 1 -> 3 2006.03.07 08:31:47 LOG7[13220:3]: 1440 started 2006.03.07 08:31:47 LOG7[13220:3]: FD 9 in non-blocking mode 2006.03.07 08:31:47 LOG7[13220:3]: FD 10 in non-blocking mode 2006.03.07 08:31:47 LOG7[13220:3]: FD 11 in non-blocking mode 2006.03.07 08:31:47 LOG7[13222:0]: Waiting 299 second(s) for 4 file descriptor(s) 2006.03.07 08:31:47 LOG7[13222:0]: CONTEXT 2, FD=8, (IN)->() 2006.03.07 08:31:47 LOG7[13222:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:47 LOG7[13222:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:31:47 LOG7[13222:0]: CONTEXT 3, FD=11, (OUT)->(OUT) 2006.03.07 08:31:47 LOG7[13220:0]: Waiting 299 second(s) for 4 file descriptor(s) 2006.03.07 08:31:47 LOG7[13220:0]: Cleaning up the signal pipe 2006.03.07 08:31:47 LOG6[13220:0]: Child process 13222 finished with code 0 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 2, FD=8, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 3, FD=10, (IN)->(INHUP) 2006.03.07 08:31:47 LOG7[13220:3]: Connection from 10.10.10.100:1050 permitted by libwrap 2006.03.07 08:31:47 LOG5[13220:3]: 1440 connected from 10.10.10.100:1050 2006.03.07 08:31:47 LOG7[13220:3]: FD 10 in non-blocking mode 2006.03.07 08:31:47 LOG7[13220:3]: 1440 connecting 192.168.19.50:1078 2006.03.07 08:31:47 LOG7[13220:3]: connect_wait: waiting 10 seconds 2006.03.07 08:31:47 LOG7[13220:0]: Waiting 10 second(s) for 4 file descriptor(s) 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 2, FD=8, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 3, FD=10, (INOUT)->(OUT) 2006.03.07 08:31:47 LOG7[13220:3]: connect_wait: connected 2006.03.07 08:31:47 LOG7[13220:3]: Remote FD=10 initialized 2006.03.07 08:31:47 LOG7[13220:3]: SSL state (connect): before/connect initialization 2006.03.07 08:31:47 LOG7[13220:3]: SSL state (connect): SSLv3 write client hello A 2006.03.07 08:31:47 LOG7[13220:0]: Waiting 299 second(s) for 4 file descriptor(s) 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 2, FD=8, (IN)->(IN) 2006.03.07 08:31:47 LOG7[13220:2]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:47 LOG7[13220:2]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:31:47 LOG7[13220:2]: CONTEXT 3, FD=10, (IN)->() 2006.03.07 08:31:47 LOG7[13220:2]: Context swap: 3 -> 2 2006.03.07 08:31:47 LOG7[13220:2]: Current context: 2 2006.03.07 08:31:47 LOG7[13220:0]: Waiting 300 second(s) for 4 file descriptor(s) 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 3, FD=10, (IN)->(IN) 2006.03.07 08:31:47 LOG7[13220:3]: CONTEXT 2, FD=8, (IN)->() 2006.03.07 08:31:47 LOG7[13220:3]: Context swap: 2 -> 3 2006.03.07 08:31:47 LOG7[13220:3]: Current context: 3 2006.03.07 08:31:47 LOG7[13220:0]: Waiting 300 second(s) for 4 file descriptor(s) 2006.03.07 08:32:02 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:32:02 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:32:02 LOG7[13220:0]: CONTEXT 2, FD=8, (IN)->(IN) 2006.03.07 08:32:02 LOG7[13220:2]: CONTEXT 3, FD=10, (IN)->() 2006.03.07 08:32:02 LOG7[13220:2]: Context swap: 3 -> 2 2006.03.07 08:32:02 LOG7[13220:2]: Current context: 2 2006.03.07 08:32:02 LOG7[13220:0]: Waiting 285 second(s) for 4 file descriptor(s) 2006.03.07 08:32:02 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:32:02 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:32:02 LOG7[13220:0]: CONTEXT 3, FD=10, (IN)->(IN) 2006.03.07 08:32:02 LOG7[13220:3]: CONTEXT 2, FD=8, (IN)->() 2006.03.07 08:32:02 LOG7[13220:3]: Context swap: 2 -> 3 2006.03.07 08:32:02 LOG7[13220:3]: Current context: 3 2006.03.07 08:32:02 LOG7[13220:0]: Waiting 300 second(s) for 4 file descriptor(s) 2006.03.07 08:32:17 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:32:17 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:32:17 LOG7[13220:0]: CONTEXT 2, FD=8, (IN)->(IN) 2006.03.07 08:32:17 LOG7[13220:2]: CONTEXT 3, FD=10, (IN)->() 2006.03.07 08:32:17 LOG7[13220:2]: Context swap: 3 -> 2 2006.03.07 08:32:17 LOG7[13220:2]: Current context: 2 2006.03.07 08:32:17 LOG7[13220:2]: SSL alert (write): fatal: handshake failure 2006.03.07 08:32:17 LOG3[13220:2]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2006.03.07 08:32:17 LOG7[13220:2]: 1440 finished (1 left) 2006.03.07 08:32:17 LOG5[13220:2]: stack_info: size=65536, current=4208 (6%), maximum=4208 (6%) 2006.03.07 08:32:17 LOG7[13220:2]: Context 2 closed 2006.03.07 08:32:17 LOG7[13220:0]: Waiting 285 second(s) for 3 file descriptor(s) 2006.03.07 08:32:17 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:32:17 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:32:17 LOG7[13220:0]: CONTEXT 3, FD=10, (IN)->(IN) 2006.03.07 08:32:17 LOG7[13220:3]: Context set: 2 (dropped) -> 3 2006.03.07 08:32:17 LOG7[13220:3]: Current context: 3 2006.03.07 08:32:17 LOG7[13220:3]: Releasing context 2 2006.03.07 08:32:17 LOG7[13220:3]: SSL alert (write): fatal: handshake failure 2006.03.07 08:32:17 LOG3[13220:3]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2006.03.07 08:32:17 LOG7[13220:3]: 1440 finished (0 left) 2006.03.07 08:32:17 LOG5[13220:3]: stack_info: size=65536, current=4208 (6%), maximum=4208 (6%) 2006.03.07 08:32:17 LOG7[13220:3]: Context 3 closed 2006.03.07 08:32:17 LOG7[13220:0]: Waiting -1 second(s) for 2 file descriptor(s) --Matteo D'Amato

1 0

RE: [stunnel-users] Re: Can stunnel do this?
by Kevin A. McGrail 07 Mar '06

07 Mar '06

This sounds like exactly what stunnel does. You want to have host A talk to Server A via SSL so you run stunneld on it. Then it will redirect that connection to server B via non-SSL. What protocol are we talking about here? Let's assume it's https: On Server A, setup stunnel with a conf file with these lines (as well as many others surely) [https] accept = 443 connect = serverb.smartbox.ca:80 Then your host connects to server a, negotiates SSL and the information is sent to the other server. I think your biggest issue is going to be the certificate on Server A so that the Host connects to the Server without certificate issues. Sincerely, Kevin A. McGrail aka KAM > -----Original Message----- > From: stunnel-users-bounces(a)mirt.net > [mailto:[email protected]] On Behalf Of Matteo D'Amato > Sent: Monday, March 06, 2006 7:20 PM > To: stunnel-users(a)mirt.net > Subject: RE: [stunnel-users] Re: Can stunnel do this? > > Stunnel can only be installed on Server A > > > > --Matteo D'Amato > > -----Original Message----- > From: stunnel-users-bounces(a)mirt.net > [mailto:[email protected]] On Behalf Of Matteo D'Amato > Sent: Monday, March 06, 2006 5:58 PM > To: stunnel-users(a)mirt.net > Subject: [stunnel-users] Re: Can stunnel do this? > > Hi, > Can stunnel do this > > > Host A ---------> Server A ---------> Server B > SSL unencrypted > > This looks like the opposite of what stunnel does. I have a > host that speaks SSL that needs to talk to a server that does > not and the host must always initiate the connection. Any > ideas if this can be done with stunnel or is there another > way to do this. Thanks

1 0

RE: [stunnel-users] Re: Can stunnel do this?
by Matteo D'Amato 07 Mar '06

07 Mar '06

Stunnel can only be installed on Server A --Matteo D'Amato -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Matteo D'Amato Sent: Monday, March 06, 2006 5:58 PM To: stunnel-users(a)mirt.net Subject: [stunnel-users] Re: Can stunnel do this? Hi, Can stunnel do this Host A ---------> Server A ---------> Server B SSL unencrypted This looks like the opposite of what stunnel does. I have a host that speaks SSL that needs to talk to a server that does not and the host must always initiate the connection. Any ideas if this can be done with stunnel or is there another way to do this. Thanks -- Matteo D'Amato Smartbox Equipment Inc _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

Re: Can stunnel do this?
by Matteo D'Amato 06 Mar '06

06 Mar '06

Hi, Can stunnel do this Host A ---------> Server A ---------> Server B SSL unencrypted This looks like the opposite of what stunnel does. I have a host that speaks SSL that needs to talk to a server that does not and the host must always initiate the connection. Any ideas if this can be done with stunnel or is there another way to do this. Thanks -- Matteo D'Amato Smartbox Equipment Inc

1 0

configure problem in 4.14
by MeeAGhost 06 Mar '06

06 Mar '06

Whether --enable-dh is defined or not the stunnel created certificates created during make-install will include DH support. This is because the USE_DH variable in tools/Makefile is undefined which in turn causes the test portion of the install-data-local section of the tools/Makefile below to fail test $(USE_DH) -eq 0 || $(openssl) gendh $$RND 512 >> stunnel.pem; \ $(openssl) x509 -subject -dates -fingerprint -noout -in stunnel.pem; \ ${INSTALL} -m 600 stunnel.pem $(DESTDIR)$(confdir)/stunnel.pem; \ rm stunnel.pem; \ The test fails with this error message "/bin/bash: test: -eq: unary operator expected" since USE_DH is empty (undefined). I looked at the dh section of the configure script and it appears USE_DH is being set to 1 when --enable-dh is defined. However, USE_DH=1 is only in the DEFS section of tools/Makefile and not actually setting the value of USE_DH variable. I read in the change notes (from several years ago) that dh was disabled by default. I have been running stunnel for the past 3-4 years but have since I initially installed it back then I have been upgrading and therefore the above section of the tools\Makefile was skipped since I already had certificates defined. I went to install on a new box today and found the above 'problem'. So I am not sure how long this has been like this. Before I tried to figure out what is "wrong" I wanted to see if others have noticed this. I have seen this on Solaris 9 and in the cygwin 1.5.19.

2 1

tappipe 1.02 (stable!) released
by Michal Trojnara 03 Mar '06

03 Mar '06

Dear Users, The stable version of my VPN for stunnel/Linux is ready for download here: ftp://ftp.mirt.net/tappipe/ AFAIK it's the shortest (only 356 lines in C language) and probably one of the easiest to setup VPNs ever. Here is the ChangeLog entry: * version 1.02 2006.03.03, status: functional, stable - retransmission rate limiting algoritm improved - some minor bugfixes Could someone contribute a manual page? 8-) Best regards, Mike

1 0

Zombie problem with stunnel-4.11
by Ole Husgaard 01 Mar '06

01 Mar '06

Hi, I am trying to set up stunnel to be invoked from xinetd.d to secure pop3 access, and I'm having problems with zombie processes. It looks like stunnel does not clean up after the pop3 session: 31679 ? Ss 0:00 xinetd -stayalive -reuse -pidfile /var/run/xinetd.pid 32049 ? Ss 0:00 \_ stunnel /etc/pop3s/stunnel.cnf 32050 ? Z 0:00 \_ [ipop3d] <defunct> The contents of my stunnel.cnf file is: CAfile = /var/www/html/ca-cert.crt CRLfile = /var/www/html/ca-crl.crl cert = /etc/pop3s/pop3s.cert key = /etc/pop3s/pop3s.key verify = 2 exec = /usr/sbin/ipop3d execargs = ipop3d I use a non-standard port 997 for the service, so I have the line pop3s-eXerp 997/tcp in my /etc/services file. The xinetd configuration file for the service is: service pop3s-eXerp { disable = no socket_type = stream wait = no user = root server = /usr/sbin/stunnel server_args = /etc/pop3s/stunnel.cnf log_on_success += USERID log_on_failure += USERID } I have searched the net, but have not seen anybody else who have had this problem. Does anybody have an idea of what is causing this problem, or what I can do to work around it? Best Regards, Ole Husgaard.

2 1

Client setup
by Ting 21 Feb '06

21 Feb '06

Hello all, Wonder if anybody could advise. I have a client tn3270 application running on Solaris 2.8. Currently, it is using clear text to communicate with tn3270 server. Now, I need to run tn3270 with SSL. If I install stunnel in the Solaris 2.8 box to act as a wrapper. 1. Do I run the stunnel as a client only ? Is the command: stunnel -c -d <port1> -r <tn3270server>:<port2> a. Is port1 the original port where client tn3270 application sends to server ? b. Is port2 the same as port1 ? c. Alternatively, am I supposed to change the client tn3270 application to direct the data to a new port X, then port1 = X, while port2 is the port where the server is listening on. Thank you in advance. Warm Regards, TW --------------------------------- Do you Yahoo!? Yahoo! Movies - Search movie info and celeb profiles and photos.

2 1

Choosing local 'source' IP?
by Don Werve 20 Feb '06

20 Feb '06

Ok, so here's the problem: I've got stunnel handling SSL for a web-based service that is otherwise too stupid to be able to talk https. Unfortunately, I need to set up a redirection rule inside this service that bounces people back to the https:// page if they try to come in over http. Since said service isn't managing its own SSL, I have no solid way of determining which connections are wrappered by stunnel and which connections come in over the wire, and if I bounce stunnel connections, I end up in an infinite loop. Fortunately, all stunnel connections give a REMOTE_IP of the second ethernet adapter of the host system, which is good. My question is, how do I configure stunnel to 'force' this behavior? E.g., I want to explicitly specify in stunnel.conf 'Connect to the service for which you are acting as a wrapper from *this* IP/interface'. I've tried the 'local = ' option and setting socket flags for 'l' and 'r', and while they don't break anything, I can't use them to force a connection from any other adapter, so I don't think they are doing what I need. This wouldn't be an issue, either, except I don't know how stunnel determines this, and I don't want to (at some point in the future) have things 'magically change' (read: break horribly). Thanks-in-advance! -- Don Werve <donw(a)iradeon.net> Chief Systems Administrator / Systems Architect

2 1

RE: question about stunnel setup
by Anthony Cicalla 15 Feb '06

15 Feb '06

Encrypting traffic to a remote syslog-ng server including SSL peer authentication 1. Install stunnel and syslog-ng on all machines. 2. Create certificates for all machines. On RedHat 9 and similar machines, you can do the following as root: # cd /etc/pki/tls/certs # make syslog-ng-server.pem # make syslog-ng-client.pem 3. Place copies of syslog-ng-server.pem on all machines in /etc/stunnel with one important alteration. The clients only need the certificate section of syslog-ng-server.pem. In other words, remove the private key section from syslog-ng-server.pem on all clients. Place every client's syslog-ng-client.pem in /etc/stunnel. For server, create a special syslog-ng-client.pem containing the certificate sections for all clients and place in /etc/stunnel. In other words, remove the private key sections from all syslog-ng-client.pem files and concatenate what is left to create server's special syslog-ng-client.pem. Ok my question is from above it says to create one syslog-ng-client.pem file per client. 1)Do the names for each of these need to remain syslog-ng-client.pem or can they have names that reflect the host that they are on? 2) if they all need to keep that name do just move the client file to one client/host and then delete it from the server then move on to create the next?

2 1

stunnel and syslog
by Bart Somers 10 Feb '06

10 Feb '06

Hi to all, We recently ran in to a problem using stunnel on our AIX 5.2 machines. This is our situation: we are running stunnel as a client to protect http (and a proprietary protocol) traffic between our company and a customer. We are using client-athentication to grant access to the server and on our client-side we validate the server-certificates. This all works fine. Due to new security-restrictions, we are moving all our private-key material into HSM-boxes, in our case these are nCipher nShield HSM's. According to the documantion on there website ( http://active.ncipher.com ) we builded openssl nCipher-enabled. Based on this openssl-version, we builded stunnel. All the build-options are shown below in this message. The compiler used is the IBM C compiler. According to the manuals from stunnel we needed to put in an extra line to the config-file which shows "engine = chil" (chil is the Cryptographic Hardware Interface Library, the way the nCipher HSM's are known to openssl) After all this, we created key's in the hsm, using the nCipher tools and loaded them into stunnel (using this method you get a "pseudo-pem-file", which is actually a reference to the hardware-key). Fire-up stunnel using the commands from nCipher to preload the key's and we are all good to go! When this all seems to work very stable after a few months, with thousands of connections and ditto megabytes transfered, we wanted to have all the logging to our syslogserver (it runs syslog-ng) and this is the place where my problem hits in: When commenting-out the option "output = /home/bart/stl/var/stunnel.log" and restarting stunnel, stunnel dies after the first or second connection, leaving no logging, corefiles or whatever behind. Using plain key's (so no HSM, but with the same build which is aware of the HSM), syslog is no problem. Using HSM-key's with plaintext logfiles (no syslog) works also excellent. As i don't have any ideas anymore where to search, i want to ask you if somebody ever have seen this behaviour or knows where it could be caused by. (And maybe how to solve it....) Thanks in advance! Best regards, Bart Somers. ############################# # Build- and config-options # ############################# bart@server1:./stunnel -version stunnel 4.11 on powerpc-ibm-aix5.2.0.0 UCONTEXT+POLL+IPv4 with OpenSSL 0.9.8 05 Jul 2005 Global options cert = home/bart/stl/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /home/bart/stl/etc/stunnel/stunnel.pem pid = /home/bart/stl/var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds bart@server1:./openssl version OpenSSL 0.9.8 05 Jul 2005 compile-options: Openssl: $ export LDFLAGS="-L/opt/nfast/toolkits/hwcrhk" $ ./config --prefix=/home/bart/stl –DNFast –ldl make and make install Stunnel: $ export CPPFLAGS="-I/home/bart/stl/include" $ export LDFLAGS="-L/opt/nfast/toolkits/hwcrhk" $ ./configure –-prefix=/home/bart/stl –-with-ssl=/home/bart/stl -–disable-libwrap make and make install Config-file: Include engine = chil Start-up: $ with-nfast –f /home/bart/stl/tmp/ff /home/bart/stl/sbin/stunnel /home/bart/stl/etc/stunnel/stunnel.conf Relevant information from the config-file: engine = chil cert = /home/bart/stl/etc/stunnel/my-key.pem key = /home/bart/stl/etc/stunnel/my-key-hsm.pem ;(no chroot options used) pid = /prj/stl_004/tmp/test/stunnel-client.pid debug = 7 ; output = /home/bart/stl/var/stunnel.log # when in comment, problems! client = yes [test] accept = 9400 connect = 10.10.10.10:443 All other values are the default from the example.

2 4

transparent mode in linux
by Jesse Small 10 Feb '06

10 Feb '06

Hello, I am having trouble with the 'transparent = yes' option in my configuration file. Basically the goal is to see the IP address of the client connecting to our server, but I am getting this error in the log file: bind transparent: Cannot assign requested address (99) Failed to initialize remote connection After searching through the stunnel archives, I saw that this option (-T back then) was supported only up to the Linux 2.2 kernel, but didn't work on the 2.4 kernel. All the messages I read through were a few years old. I am using Fedora Core 4 with a 2.6 kernel, and wanted to see if there were any updates and if it was now possible to see the client's IP address. Otherwise all incoming connections appear as if from localhost. We are using stunnel v4.14. Thanks for your help, Jesse

2 1

stunnel closing connections with RST ?
by sergei 09 Feb '06

09 Feb '06

I'm setting up load-balanced service requiring stunnel with SSL on its front end. There are two hosts behind load balancer running stunnel . Service behind stunnel does not speak SSL. Every few minutes load balancer checks if those stunnels are still alive by opening tcp connection to stunnel listening port. Now problem is that stunnel closes those test connections with RST and load balancer takes it as that host is dead. This is without "client = yes" option because service does not speak SSL load-balancer -> stunnel-host TCP D=1234 S=33007 Syn stunnel-host -> load-balancer TCP D=33007 S=1234 Syn Ack load-balancer -> stunnel-host TCP D=1234 S=33007 Ack load-balancer -> stunnel-host TCP D=1234 S=33007 Fin Ack stunnel-host -> load-balancer TCP D=33007 S=1234 Ack stunnel-host -> load-balancer TCP D=33007 S=1234 Rst On the other hand with client=yes everything works fine load-balancer -> stunnel-host TCP D=123 S=33010 Syn stunnel-host -> load-balancer TCP D=33010 S=123 Syn Ack load-balancer -> stunnel-host TCP D=123 S=33010 Ack load-balancer -> stunnel-host TCP D=123 S=33010 Fin Ack stunnel-host -> load-balancer TCP D=33010 S=123 Fin Ack load-balancer -> stunnel-host TCP D=123 S=33010 Ack Is there any way to make stunnel without "client = yes" close connection "normal way" with FIN instead of RST ? stunnel is last version, load balancer is some older F5 BigIP thanks sergei

3 7

certificate root chain
by Olivier twist 09 Feb '06

09 Feb '06

Hello, I've already sent a message for my problem but no answer. I have a server certificate signed by GlobalSign. I don't want to use client certificate. But if I don't put the certification chain on the CAFILE of stunnel and don't set verify at 1, stunnel doesn't check the server certification chain and the server certificate appears broken on client side !!! I've post this problem on the stunnel mailing list but you tell me that if I don't use client certificate I don't have to set verify at 1. But it doesn't work, and why GlobalSign and others explain how to install server certificatation chain on servers like apache mod ssl?(see http://support.globalsign.net/en/serversign/apachemodssl.cfm) when I read this help file I suppose that the ssl protocol on server side makes a check of server certificate, and that's the reason why the certificate chain appears broken or not on client side. My current ugly solution is to set verify at 1, in this case, on client side, the certificate appears good and not broken but... a dialog box appears and ask for client certificate and some plugin like flash doesn't support that. i use stunnel 4.14 stunnel.conf: cert = c:\certif\inTest.crt key = c:\certif\inTest.key socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 1 CAfile = c:\certif\ca.pem ;client = yes [https] accept = 443 connect = 127.0.0.1:901 TIMEOUTclose = 0 [rtmps] accept = 80 connect = 127.0.0.1:900 TIMEOUTclose = 0 Could anybody gives me a support? Thx Oliver

3 3

Re: [stunnel-users] certificate root chain
by Hans Werner Strube 09 Feb '06

09 Feb '06

Olivier twist wrote: > I have a server certificate signed by GlobalSign. I don't want to use client > certificate. > But if I don't put the certification chain on the CAFILE of stunnel and > don't set verify at 1, stunnel doesn't check the server certification chain > and the server certificate appears broken on client side !!! ... > cert = c:\certif\inTest.crt > key = c:\certif\inTest.key ... > CAfile = c:\certif\ca.pem AFAIK the whole certificate chain from your server certificate up to the CA certificate should be in inTest.crt (simply concatenate the PEM files). The CAfile would be needed for client verification only.

1 0

RE: [stunnel-users] stunnel help
by Anthony Cicalla 07 Feb '06

07 Feb '06

I sent an email last week for help with a stunnel setup. I am attempting to send syslog messages via a snare agent through stunnel to a fedora core 4 box with syslog-ng installed. I have been able to get one machine to successfully log to the fedora box out of 4. I set these boxes up the same way and I am confused as to why one is working and the others aren't . This is my stunnel.conf file for the clients cert = C:\bin\stunnel\syslog-ng-server.pem CAfile = c:\bin\stunnel\syslog-ng-client.pem verify = 3 [5140] accept = 127.0.0.1:514 connect = 192.168.185.60:5140 This is my stunnel.conf file for the server cert = /etc/stunnel/syslog-ng-server.pem CAfile = /etc/stunnel/syslog-ng-client.pem verify = 3 [5140] accept = 192.168.185.60:5140 connect = 127.0.0.1:514 This is my syslog-ng.conf file on the server options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(514)); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; The snare agents are configured to send logs to 127.0.0.1 514. Any thoughts or idea's would be great. sincerely, Anthony -----Original Message----- From: Michal Trojnara [mailto:[email protected]] Sent: Tuesday, February 07, 2006 1:03 AM To: stunnel-users(a)mirt.net Subject: RE: [stunnel-users] stunnel closing connections with RST ? sergei wrote: > Is there any way to make stunnel without "client = yes" > close connection "normal way" with FIN instead of RST ? Stunnel resets connections for a reason. Probably it was reset by the other peer. Check your stunnel log files for details. Best regards, Mike _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

Multiple Instances of Same Application, Different Ports
by Steve Ricketts 06 Feb '06

06 Feb '06

1 0

stunnel not connecting to port 139 on server
by Neil Aggarwal 05 Feb '06

05 Feb '06

Hello: I have two windows machines. I am trying to connect to a shared drive on the server over an stunnel connection following the instructions on this page: http://research.lumeta.com/ches/cheap/stunnelsolution.html The connection from the client seems to connect to the server, but the server-side stunnel seems to be getting a timeout when it attempts to connect to port 139. I am able to map the network drive locally, so I am surprised it is not able to connect. Here is the log from stunnel on the server: 2006.02.04 18:22:17 LOG5[2116:3068]: stunnel 4.14 on x86-pc-mingw32-gnu WIN32+SELECT+IPv6 with OpenSSL 0.9.7i 14 Oct 2005 2006.02.04 18:22:17 LOG7[2116:3968]: RAND_status claims sufficient entropy for the PRNG 2006.02.04 18:22:17 LOG6[2116:3968]: PRNG seeded successfully 2006.02.04 18:22:17 LOG7[2116:3968]: Certificate: stunnel.pem 2006.02.04 18:22:17 LOG7[2116:3968]: Key file: stunnel.pem 2006.02.04 18:22:17 LOG5[2116:3968]: No limit detected for the number of clients 2006.02.04 18:22:17 LOG7[2116:3968]: FD 168 in non-blocking mode 2006.02.04 18:22:17 LOG7[2116:3968]: SO_REUSEADDR option set on accept socket 2006.02.04 18:22:17 LOG7[2116:3968]: netDrives bound to 0.0.0.0:2139 2006.02.04 18:24:49 LOG7[2116:3968]: netDrives accepted FD=188 from 192.168.1.247:1334 2006.02.04 18:24:49 LOG7[2116:3968]: Creating a new thread 2006.02.04 18:24:49 LOG7[2116:3968]: New thread created 2006.02.04 18:24:49 LOG7[2116:2224]: netDrives started 2006.02.04 18:24:49 LOG7[2116:2224]: FD 188 in non-blocking mode 2006.02.04 18:24:49 LOG7[2116:2224]: TCP_NODELAY option set on local socket 2006.02.04 18:24:49 LOG5[2116:2224]: netDrives connected from 192.168.1.247:1334 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): before/accept initialization 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 read client hello A 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 write server hello A 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 write certificate A 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 write server done A 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 flush data 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 read client key exchange A 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 read finished A 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 write change cipher spec A 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 write finished A 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 flush data 2006.02.04 18:24:49 LOG7[2116:2224]: 1 items in the session cache 2006.02.04 18:24:49 LOG7[2116:2224]: 0 client connects (SSL_connect()) 2006.02.04 18:24:49 LOG7[2116:2224]: 0 client connects that finished 2006.02.04 18:24:49 LOG7[2116:2224]: 0 client renegotiatations requested 2006.02.04 18:24:49 LOG7[2116:2224]: 1 server connects (SSL_accept()) 2006.02.04 18:24:49 LOG7[2116:2224]: 1 server connects that finished 2006.02.04 18:24:49 LOG7[2116:2224]: 0 server renegotiatiations requested 2006.02.04 18:24:49 LOG7[2116:2224]: 0 session cache hits 2006.02.04 18:24:49 LOG7[2116:2224]: 0 session cache misses 2006.02.04 18:24:49 LOG7[2116:2224]: 0 session cache timeouts 2006.02.04 18:24:49 LOG6[2116:2224]: SSL accepted: new session negotiated 2006.02.04 18:24:49 LOG6[2116:2224]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2006.02.04 18:24:49 LOG7[2116:2224]: FD 216 in non-blocking mode 2006.02.04 18:24:49 LOG7[2116:2224]: netDrives connecting 127.0.0.1:139 2006.02.04 18:24:49 LOG7[2116:2224]: connect_wait: waiting 10 seconds 2006.02.04 18:24:59 LOG7[2116:3968]: netDrives accepted FD=236 from 192.168.1.247:1336 2006.02.04 18:24:59 LOG7[2116:3968]: Creating a new thread 2006.02.04 18:24:59 LOG7[2116:3968]: New thread created 2006.02.04 18:24:59 LOG7[2116:3544]: netDrives started 2006.02.04 18:24:59 LOG7[2116:3544]: FD 236 in non-blocking mode 2006.02.04 18:24:59 LOG7[2116:3544]: TCP_NODELAY option set on local socket 2006.02.04 18:24:59 LOG5[2116:3544]: netDrives connected from 192.168.1.247:1336 2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): before/accept initialization 2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): SSLv3 read client hello A 2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): SSLv3 write server hello A 2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): SSLv3 write change cipher spec A 2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): SSLv3 write finished A 2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): SSLv3 flush data 2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): SSLv3 read finished A 2006.02.04 18:24:59 LOG7[2116:3544]: 1 items in the session cache 2006.02.04 18:24:59 LOG7[2116:3544]: 0 client connects (SSL_connect()) 2006.02.04 18:24:59 LOG7[2116:3544]: 0 client connects that finished 2006.02.04 18:24:59 LOG7[2116:3544]: 0 client renegotiatations requested 2006.02.04 18:24:59 LOG7[2116:3544]: 2 server connects (SSL_accept()) 2006.02.04 18:24:59 LOG7[2116:3544]: 2 server connects that finished 2006.02.04 18:24:59 LOG7[2116:3544]: 0 server renegotiatiations requested 2006.02.04 18:24:59 LOG7[2116:3544]: 1 session cache hits 2006.02.04 18:24:59 LOG7[2116:3544]: 0 session cache misses 2006.02.04 18:24:59 LOG7[2116:3544]: 0 session cache timeouts 2006.02.04 18:24:59 LOG6[2116:2224]: connect_wait: s_poll_wait timeout 2006.02.04 18:24:59 LOG6[2116:3544]: SSL accepted: previous session reused 2006.02.04 18:24:59 LOG3[2116:2224]: Failed to initialize remote connection 2006.02.04 18:24:59 LOG7[2116:3544]: FD 216 in non-blocking mode 2006.02.04 18:24:59 LOG7[2116:2224]: netDrives finished (1 left) 2006.02.04 18:24:59 LOG7[2116:3544]: netDrives connecting 127.0.0.1:139 2006.02.04 18:24:59 LOG7[2116:3544]: connect_wait: waiting 10 seconds 2006.02.04 18:25:09 LOG6[2116:3544]: connect_wait: s_poll_wait timeout 2006.02.04 18:25:09 LOG3[2116:3544]: Failed to initialize remote connection 2006.02.04 18:25:09 LOG7[2116:3544]: netDrives finished (0 left) Here is the stunnel.conf file from the server: ; Sample stunnel configuration file by Michal Trojnara 2002-2005 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode ;client = yes ; Service-level configuration [netDrives] accept = 2139 connect = 139 In case you need it, here is the stunnel log from the client: 2006.02.04 18:23:43 LOG5[3236:2376]: stunnel 4.14 on x86-pc-mingw32-gnu WIN32+SELECT+IPv6 with OpenSSL 0.9.7i 14 Oct 2005 2006.02.04 18:23:43 LOG7[3236:324]: RAND_status claims sufficient entropy for the PRNG 2006.02.04 18:23:43 LOG6[3236:324]: PRNG seeded successfully 2006.02.04 18:23:43 LOG7[3236:324]: Certificate: stunnel.pem 2006.02.04 18:23:43 LOG7[3236:324]: Key file: stunnel.pem 2006.02.04 18:23:43 LOG5[3236:324]: No limit detected for the number of clients 2006.02.04 18:23:43 LOG7[3236:324]: FD 200 in non-blocking mode 2006.02.04 18:23:43 LOG7[3236:324]: SO_REUSEADDR option set on accept socket 2006.02.04 18:23:43 LOG7[3236:324]: netDrives bound to 222.222.222.222:139 2006.02.04 18:24:42 LOG7[3236:324]: netDrives accepted FD=220 from 192.168.1.247:1333 2006.02.04 18:24:42 LOG7[3236:324]: Creating a new thread 2006.02.04 18:24:42 LOG7[3236:324]: New thread created 2006.02.04 18:24:42 LOG7[3236:572]: netDrives started 2006.02.04 18:24:42 LOG7[3236:572]: FD 220 in non-blocking mode 2006.02.04 18:24:42 LOG7[3236:572]: TCP_NODELAY option set on local socket 2006.02.04 18:24:42 LOG5[3236:572]: netDrives connected from 192.168.1.247:1333 2006.02.04 18:24:42 LOG7[3236:572]: FD 252 in non-blocking mode 2006.02.04 18:24:42 LOG7[3236:572]: netDrives connecting 192.168.1.10:2139 2006.02.04 18:24:42 LOG7[3236:572]: connect_wait: waiting 10 seconds 2006.02.04 18:24:42 LOG7[3236:572]: connect_wait: connected 2006.02.04 18:24:42 LOG7[3236:572]: Remote FD=252 initialized 2006.02.04 18:24:42 LOG7[3236:572]: TCP_NODELAY option set on remote socket 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): before/connect initialization 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 write client hello A 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 read server hello A 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 read server certificate A 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 read server done A 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 write client key exchange A 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 write change cipher spec A 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 write finished A 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 flush data 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 read finished A 2006.02.04 18:24:42 LOG7[3236:572]: 1 items in the session cache 2006.02.04 18:24:42 LOG7[3236:572]: 1 client connects (SSL_connect()) 2006.02.04 18:24:42 LOG7[3236:572]: 1 client connects that finished 2006.02.04 18:24:42 LOG7[3236:572]: 0 client renegotiatations requested 2006.02.04 18:24:42 LOG7[3236:572]: 0 server connects (SSL_accept()) 2006.02.04 18:24:42 LOG7[3236:572]: 0 server connects that finished 2006.02.04 18:24:42 LOG7[3236:572]: 0 server renegotiatiations requested 2006.02.04 18:24:42 LOG7[3236:572]: 0 session cache hits 2006.02.04 18:24:42 LOG7[3236:572]: 0 session cache misses 2006.02.04 18:24:42 LOG7[3236:572]: 0 session cache timeouts 2006.02.04 18:24:42 LOG6[3236:572]: SSL connected: new session negotiated 2006.02.04 18:24:42 LOG6[3236:572]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2006.02.04 18:24:52 LOG3[3236:572]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2006.02.04 18:24:52 LOG7[3236:324]: netDrives accepted FD=276 from 192.168.1.247:1335 2006.02.04 18:24:52 LOG5[3236:572]: Connection reset: 72 bytes sent to SSL, 0 bytes sent to socket 2006.02.04 18:24:52 LOG7[3236:324]: Creating a new thread 2006.02.04 18:24:52 LOG7[3236:572]: netDrives finished (0 left) 2006.02.04 18:24:52 LOG7[3236:324]: New thread created 2006.02.04 18:24:52 LOG7[3236:1336]: netDrives started 2006.02.04 18:24:52 LOG7[3236:1336]: FD 276 in non-blocking mode 2006.02.04 18:24:52 LOG7[3236:1336]: TCP_NODELAY option set on local socket 2006.02.04 18:24:52 LOG5[3236:1336]: netDrives connected from 192.168.1.247:1335 2006.02.04 18:24:52 LOG7[3236:1336]: FD 248 in non-blocking mode 2006.02.04 18:24:52 LOG7[3236:1336]: netDrives connecting 192.168.1.10:2139 2006.02.04 18:24:52 LOG7[3236:1336]: connect_wait: waiting 10 seconds 2006.02.04 18:24:52 LOG7[3236:1336]: connect_wait: connected 2006.02.04 18:24:52 LOG7[3236:1336]: Remote FD=248 initialized 2006.02.04 18:24:52 LOG7[3236:1336]: TCP_NODELAY option set on remote socket 2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): before/connect initialization 2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): SSLv3 write client hello A 2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): SSLv3 read server hello A 2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): SSLv3 read finished A 2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): SSLv3 write change cipher spec A 2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): SSLv3 write finished A 2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): SSLv3 flush data 2006.02.04 18:24:52 LOG7[3236:1336]: 1 items in the session cache 2006.02.04 18:24:52 LOG7[3236:1336]: 2 client connects (SSL_connect()) 2006.02.04 18:24:52 LOG7[3236:1336]: 2 client connects that finished 2006.02.04 18:24:52 LOG7[3236:1336]: 0 client renegotiatations requested 2006.02.04 18:24:52 LOG7[3236:1336]: 0 server connects (SSL_accept()) 2006.02.04 18:24:52 LOG7[3236:1336]: 0 server connects that finished 2006.02.04 18:24:52 LOG7[3236:1336]: 0 server renegotiatiations requested 2006.02.04 18:24:52 LOG7[3236:1336]: 1 session cache hits 2006.02.04 18:24:52 LOG7[3236:1336]: 0 session cache misses 2006.02.04 18:24:52 LOG7[3236:1336]: 0 session cache timeouts 2006.02.04 18:24:52 LOG6[3236:1336]: SSL connected: previous session reused 2006.02.04 18:25:02 LOG3[3236:1336]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2006.02.04 18:25:02 LOG5[3236:1336]: Connection reset: 72 bytes sent to SSL, 0 bytes sent to socket 2006.02.04 18:25:02 LOG7[3236:1336]: netDrives finished (0 left) Here is the stunnel.conf file from the client: ; Sample stunnel configuration file by Michal Trojnara 2002-2005 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [netDrives] accept = 222.222.222.222:139 connect = tcServer.crcBusinessServices.com:2139 Any ideas what could be wrong? Thanks, Neil -- Neil Aggarwal, JAMM Consulting, (214) 986-3533, www.JAMMConsulting.com FREE! Valuable info on how your business can reduce operating costs by 17% or more in 6 months or less! http://newsletter.JAMMConsulting.com

1 0

tappipe 1.01 released
by Michal Trojnara 04 Feb '06

04 Feb '06

Here is the ChangeLog entry: * version 1.01 2006.02.04, status: functional, not proven to be stable - TUN changed to TAP (project renamed from tunpipe to tappipe) - TCP-over-TCP meltdown problem fixed http://sites.inka.de/sites/bigred/devel/tcp-tcp.html - important bugfixes Download site: ftp://stunnel.mirt.net/tappipe/ Best regards, Mike

1 0

Stunnel with ntsyslog on windows 2000 forwarding to syslog-ng on fedora core 4 with stunnel in the middle.
by Anthony Cicalla 03 Feb '06

03 Feb '06

Website questions answered first 1) ntsyslog(on windows 2000 pro) is not connecting through stunnel to (fedora core 4) syslog-ng daemon. 2) latest version of stunnel just downloaded it. 3)stunnel syslog-ng -f /etc/syslog-ng.conf 4)ran the command but got no output. (stunnel /etc/stunnel/stunnel.conf -f -D -7) 5)ran the command and it exectuted as above but still got no optput ran (stunnel /etc/stunnel/stunnel.conf -V) 6)Linux echelon.bankserv.com 2.6.11-1.1369_FC4 #1 Thu Jun 2 22:55:56 EDT 2005 i686 i686 i386 GNU/Linux 7)sry I'm a noob and don't know how to get this. I am from the windows side of the house. If you need it send me the command and I will get you the output. 8)Using built-in specs. Target: i386-redhat-linux Configured with: ../configure --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --enable-shared --enable-threads=posix --enable-checking=release --with-system-zlib --enable-__cxa_atexit --disable-libunwind-exceptions --enable-libgcj-multifile --enable-languages=c,c++,objc,java,f95,ada --enable-java-awt=gtk --with-java-home=/usr/lib/jvm/java-1.4.2-gcj-1.4.2.0/jre --host=i386-redhat-linux Thread model: posix gcc version 4.0.0 20050519 (Red Hat 4.0.0-8) 9)This is the latest version for fedora core 4. I downloaded the packages for openssl and ran the updater. I am setting up centralized logging with stunnel, syslog-ng, ntsyslog. Following the directions from these two links. <http://www.stunnel.org/examples/syslog-ng.html> <http://www.monitorware.com/Common/en/Articles/eventlog-stunnel-syslog.php> Encrypting traffic to a remote syslog-ng server including SSL peer authentication 1. Install stunnel and syslog-ng on all machines. 2. Create certificates for all machines. On RedHat 9 and similar machines, you can do the following as root: # cd /etc/pki/tls/certs # make syslog-ng-server.pem # make syslog-ng-client.pem 3. Place copies of syslog-ng-server.pem on all machines in /etc/stunnel with one important alteration. The clients only need the certificate section of syslog-ng-server.pem. In other words, remove the private key section from syslog-ng-server.pem on all clients. Place every client's syslog-ng-client.pem in /etc/stunnel. For server, create a special syslog-ng-client.pem containing the certificate sections for all clients and place in /etc/stunnel. In other words, remove the private key sections from all syslog-ng-client.pem files and concatenate what is left to create server's special syslog-ng-client.pem. 4. Give only root ownership, read and write permissions for certificates. 5. On server, create /etc/stunnel/stunnel.conf containing the following replacing server IP address accordingly: cert = /etc/stunnel/syslog-ng-server.pem CAfile = /etc/stunnel/syslog-ng-client.pem verify = 3 [5140] accept = 192.x.x.x:5140 connect = 127.0.0.1:514 On clients, create /etc/stunnel/stunnel.conf containing the following replacing server IP address accordingly: client = yes cert = /etc/stunnel/syslog-ng-client.pem CAfile = /etc/stunnel/syslog-ng-server.pem verify = 3 [5140] accept = 127.0.0.1:514 connect = 192.x.x.x:5140 6. On server, create the following in /etc/syslog-ng.conf: options { long_hostnames(off); sync(0); keep_hostname(yes); chain_hostnames(no); }; source src {unix-stream("/dev/log"); pipe("/proc/kmsg"); internal();}; source stunnel {tcp(ip("127.0.0.1") port(514) max-connections(1));}; destination remoteclient {file("/var/log/remoteclient");}; destination dest {file("/var/log/messages");}; log {source(src); destination(dest);}; log {source(stunnel); destination(remoteclient);}; On clients, create the following in /etc/syslog-ng.conf: options {long_hostnames(off); sync(0);}; source src {unix-stream("/dev/log"); pipe("/proc/kmsg"); internal();}; destination dest {file("/var/log/messages");}; destination stunnel {tcp("127.0.0.1" port(514));}; log {source(src);destination(dest);}; log {source(src);destination(stunnel);}; (See syslog-ng documentation for more sophisticated syslog-ng.conf alternatives.) 7. Open necessary ports with regards to packet filtering and TCP wrappers. 8. On all machines, add the following lines to boot procedure and execute them now: # stunnel # syslog-ng -f /etc/syslog-ng.conf That was the unix side stunnel config. Copy the files to a location of your choice. If in doubt what you need, download the latest stunnel binary as well as the ZIP file with the openssl libararies. Place everything in the same directory, e.g. c:\bin\stunnel. Please note that the stunnel binary (eg. stunnel-4.04.exe) is the actual stunnel program and NOT a self-extracting exe program. Once you have done this, you only need to supply stunnel with a correct configuration file. You can use the one from the stunnel UNIX/Linux tutorial, step 5. Make sure that you not only copy over the config file but also the needed .PEM files. You probably need to change the pathes in the stunnel.conf file to reflect your local Windows directory structure. Once you have the config file ready, you can start the Windows stunnel. Please note that it by default starts interactively. If all goes well, there is a small icon in the icon tray. Double-Click it to get a status window. If something goes wrong, the status window automatically appears with a nice error message. AT THIS POINT I AM ABLE TO START STUNNEL WITH NO ERRORS SHOW UP BUT 0 ACTIVE TUNNELS. Let's assume all went well. What is left is that we must tell the event log monitor where to forward events to. Installation: Install the service by executing the following command: NTsyslog -install The service will be started automatically by the service control manager during system startup. You can start and stop the service manually from the Services Control Panel. By default the service runs under the LocalSystem account. The service can be configured to run as a local user with the following rights: * Log on as a service * Manage auditing and security log The user the service runs as can be configured in the NTsyslog Properties page which can be accessed through the Services Control Panel. A GUI tool, NTSyslogCtrl is provided to configure what types of messages are monitored and what priority to use for each type. The priority for each event log type controls the service and facility that the syslog message is sent to. Each log type has a seperate priority. If the priority for a particular key does not exist, as if you were upgrading, or using an old NTSyslogCtrl app, the default is 9, user.alert. Usually, syslog refers to a "facility" and "severity". These are combined in to a single value called "priority". To calculate the priorities from normal facility and severity codes: Take the numeric value for the facility, multiply by 8, and add the numeric value for the severity. Standard facility and severity values are: Facility: (0) kernel (12) ntp (1) user (13) log audit (2) mail (14) log alert (3) system (15) clock 2 (4) security/auth 1 (16) local 0 (5) syslog (17) local 1 (6) line printer (18) local 2 (7) news (19) local 3 (8) uucp (20) local 4 (9) clock 1 (21) local 5 (10) security/auth 2 (22) local 6 (11) ftp (23) local 7 Severity: (0) emergency (4) warning (1) alert (5) notice (2) critical (6) information (3) error (7) debug Note that facility 4, 9, 10, and 15 have different meaning on various systems. Please consult your system manual pages or syslogd documentation. Complete details are available in RFC 3164. See: <http://www.ietf.org/rfc/rfc3164.txt> The NTSyslog service must be stopped and restarted for the Registry settings to take effect. By default all messages are sent using the user.alert priority. Registry Settings: The NTSyslogCtrl program is the preferred method of configuring the registry. Editing the registry manually is not required when using the configuration tool. The syslog host is configured by creating the following Registry entry: [HKEY_LOCAL_MACHINE\SOFTWARE\SaberNet] "Syslog"="192.X.X.X" An additional syslog host may be configured for redundancy: [HKEY_LOCAL_MACHINE\SOFTWARE\SaberNet] "Syslog1"="" The syslog host can be specified by domain name (loghost.example.com) or by IP address (10.123.112.1). The types of event log messages sent to the syslog host can be configured by setting the dword value for each of the types of messages. All types with a non-zero value will be processed. The included registry file enables all event types for each event log: [HKEY_LOCAL_MACHINE\SOFTWARE\SaberNet\Syslog\System] "Information"=dword:00000001 "Information Priority"=dword:00000009 "Warning"=dword:00000001 "Warning Priority"=dword:00000009 "Error"=dword:00000001 "Error Priority"=dword:00000009 "Audit Success"=dword:00000001 "Audit Success Priority"=dword:00000009 "Audit Failure"=dword:00000001 "Audit Failure Priority"=dword:00000009 [HKEY_LOCAL_MACHINE\SOFTWARE\SaberNet\Syslog\Security] "Information"=dword:00000001 "Information Priority"=dword:00000009 "Warning"=dword:00000001 "Warning Priority"=dword:00000009 "Error"=dword:00000001 "Error Priority"=dword:00000009 "Audit Success"=dword:00000001 "Audit Success Priority"=dword:00000009 "Audit Failure"=dword:00000001 "Audit Failure Priority"=dword:00000009 [HKEY_LOCAL_MACHINE\SOFTWARE\SaberNet\Syslog\Application] "Information"=dword:00000001 "Information Priority"=dword:00000009 "Warning"=dword:00000001 "Warning Priority"=dword:00000009 "Error"=dword:00000001 "Error Priority"=dword:00000009 "Audit Success"=dword:00000001 "Audit Success Priority"=dword:00000009 "Audit Failure"=dword:00000001 "Audit Failure Priority"=dword:00000009 Version 1.11 and later supports user defined event logs. Simply add the appropriate sub-key and settings to the registry in the same format as the three standard event logs: [HKEY_LOCAL_MACHINE\SOFTWARE\SaberNet\Syslog\Directory Service] "Information"=dword:00000001 "Information Priority"=dword:00000009 "Warning"=dword:00000001 "Warning Priority"=dword:00000009 "Error"=dword:00000001 "Error Priority"=dword:00000009 "Audit Success"=dword:00000001 "Audit Success Priority"=dword:00000009 "Audit Failure"=dword:00000001 "Audit Failure Priority"=dword:00000009 ok after all of this configuration and setup I get no syslogs in on the logging server. I did and ethereal capture and tested a few settings. If I point it directly to the syslog ip address it's still not connecting becuase it's trying to connect on port 514. The syslog server is running on port 5140 from the config. I can telnet to port 5140 with no problems. I can start the nt syslog service with the server's ip and see packets attempting to be sent this tells me that ntsyslog is working. When I go to examine stunnel I get 2006.02.02 10:18:06 LOG5[484:108]: stunnel 4.14 on x86-pc-mingw32-gnu WIN32+SELECT+IPv4 with OpenSSL 0.9.7i 14 Oct 2005 2006.02.02 10:18:07 LOG5[484:652]: No limit detected for the number of clients 2006.02.02 11:38:18 LOG5[484:640]: 5140 connected from 127.0.0.1:1386 2006.02.02 11:38:27 LOG3[484:640]: SSL_accept: 140760FC: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol And that is where I am stuck... any help would be greatly appreciated. I check this regularly so I will reply or attempt suggestions pretty quickly and reply the results. I am still pretty new with linux so if you want me to do something or to get you some information put the commands or step of how to do it in the post. It will not only help me but it will help others behind me that might not know as much as well. I followed the instructions above which has the commands. I created the pem files and the conf files just as above althought there is not /etc/syslog-ng.conf on the windows machine. I still made the files but they are put in c:\bin\stunnel becuase syslog-ng doesn't run on windows. they reccommended snare of something of the like to forward the logs so I chose ntsyslog. Ntsyslog is setup exactly like the instructions say. like I said above stunnel starts without an error when I start the ntsyslog the error appears in the stunnel log. Client Stunnel.conf cert = C:\bin\stunnel\syslog-ng-server.pem CAfile = c:\bin\stunnel\syslog-ng-client.pem verify = 3 [5140] accept = 127.0.0.1:514 connect = 192.168.x.x:5140 Client Server stunnel.conf cert = /etc/stunnel/syslog-ng-server.pem CAfile = /etc/stunnel/syslog-ng-client.pem verify = 3 [5140] accept = 192.168.x.x:5140 connect = 127.0.0.1:514 syslog-ng.conf options { long_hostnames(off); sync(0); keep_hostname(yes); chain_hostnames(no); }; source src {unix-stream("/dev/log"); pipe("/proc/kmsg"); internal();}; source stunnel {tcp(ip("127.0.0.1") port(514) max-connections(1));}; destination remoteclient {file("/var/log/remoteclient");}; destination dest {file("/var/log/messages");}; log {source(src); destination(dest);}; log {source(stunnel); destination(remoteclient);}; When you run the gui for ntsyslog it creates the registry entries so i did no have to create them. Client is on windows the server is the fedora core 4 box

1 0

tunpipe
by Michal Trojnara 03 Feb '06

03 Feb '06

Dear Users, For the last two days I was working on a VPN solution for stunnel. The early alpha version is ready for download here: ftp://stunnel.mirt.net/tunpipe/ Advantages: - based on proven strength of SSL encryption (much better than IPSec or any proprietary encryption protocol), - very clean and lightweight design, - very easy to configure. Disadvantages: - only works on GNU/Linux (can be ported to some other Unixes), - use of TCP is the main performance limitation. Aternative solutions: http://www.math.ucla.edu/~jimc/documents/vpn.html Suggestions and comments are welcome. Best regards, Mike

2 3

Encrypted tunnel for HTTP traffic?
by Robert Nicholson 01 Feb '06

01 Feb '06

Can anybody tell me if it's possible for stunnel to act as a local web proxy that simply encrypts my outgoing HTTP traffic and decrypts it on the way back in? Specifically is it still possible to block urls at the hosting provider with this approach and is all my browsing then safe from prying eyes? What I want is along the lines of a VPN solution but it sounds like stunnel can at least take care of my HTTP needs.

2 1

FQDN validation and checking within
by Nagasundaram, Sekhar 01 Feb '06

01 Feb '06

Mike: Given this: what is the best way for Stunnel to make authentication And authorization decisions based on information presented in the Certificate from the peer. My question comes from: how do I do level 3 Checking in a scalable manner when my order of magnitude is in the Thousands... Much thanks Sekhar ------------------------------- Message: 3 Date: Tue, 31 Jan 2006 09:51:06 +0100 From: "Michal Trojnara" <Michal.Trojnara(a)mobi-com.net> Subject: RE: [stunnel-users] FQDN validation and checking within STunnel To: <stunnel-users(a)mirt.net> Message-ID: <20060131085108.B053F1C130(a)linode.mirt.net> Content-Type: text/plain; charset="us-ascii" Nagasundaram, Sekhar wrote: > Is there a setting in Stunnel to do FQDN checking? DNS is not a secure protocol (http://www.securesphere.net/download/papers/dnsspoof.htm) Security should not be based on DNS checks. I'm not going to implement this feature. Best regards, Mike ------------------------------ Message: 4 Date: Tue, 31 Jan 2006 10:41:37 +0100 From: "Michal Trojnara" <Michal.Trojnara(a)mobi-com.net> Subject: RE: --with-threads=ucontext portability (was Re: [stunnel-users] stunnel4.x.x and IRIX) To: <stunnel-users(a)mirt.net> Message-ID: <20060131094139.33A011C17C(a)linode.mirt.net> Content-Type: text/plain; charset="iso-8859-1" Miloslav Trmac wrote: > I have just seen a crash at a similar place on x86_64. The apparent > cause is sthreads.c:116: > makecontext(&ctx->ctx, (void(*)(void))cli, 1, arg); arg is a void > *, but: > - the size is given as 1; it should be > (sizeof (arg) + sizeof (int) - 1) / sizeof (int) > because the "size" is defined as a number of int arguments > - it won't work anyway; makecontext () is defined to work only for > integer parameters. It is not possible to pass a pointer as > integers on x86_64, which uses registers to pass the first 6 > integer or pointer parameters. Are we still talking about IRIX? http://nixdoc.net/man-pages/IRIX/man3c/makecontext.3c.html I can't find any of mentioned limitations in the manual. Just the opposite: "the arguments that follow the argc parameter for makecontext are restricted to longs and pointers only". Best regards, Mike ------------------------------ _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users End of stunnel-users Digest, Vol 18, Issue 19 *********************************************

2 1

Encrypted tunnel for HTTP traffic?
by Robert Nicholson 01 Feb '06

01 Feb '06

Can anybody tell me if it's possible for stunnel to act as a local web proxy that simply encrypts my outgoing HTTP traffic and decrypts it on the way back in? Specifically is it still possible to block urls at the hosting provider with this approach and is all my browsing then safe from prying eyes? What I want is along the lines of a VPN solution but it sounds like stunnel can at least take care of my HTTP needs.

1 0

Stunnel Question /Feature request
by Mathias . 31 Jan '06

31 Jan '06

Hi everybody. Is it possible at the Client side specify where the Stunnel server should connect to? I mean. If I'm using stunnel both on the clisnt side and the Server side is it possible from within the Stunnel.conf file specify a destination at serverside that overides the "connect=" tag specified in the stunnel.conf file at the server side. This would make it possible to have two services accessible at the same port. I.e IIS using https (accessible from any browser) and a nother SSL, non-web, based service (accessible from a Stunnel client). Anyone that ever have thought about creating such a patch? /M

1 0

stunnel 4.x.x and IRIX
by Eric Haddix 31 Jan '06

31 Jan '06

I happened upon a user here that posted a couple of months ago(I think) who used IRIX and had successfully compiled stunnel. Any chance you're still around!?!? I get one of two things. Before I apply the patch, it will crash right after startup. No logs, just dumps core. After the patch, it starts and exits immediately. I can run it with -version, etc. and it seems to work fine. Anyone had this and/or know what can be done? Eric

3 10

FQDN validation and checking within STunnel
by Nagasundaram, Sekhar 31 Jan '06

31 Jan '06

All: Is there a setting in Stunnel to do FQDN checking? Level 3 checking requires a local copy of the Peer's certificate. When doing mutual authentication, I run into scalability issues when the devices Run into the thousands using Level3 validation. However, if Stunel was capable of doing FQDN checks, That would help while not requiring me to do level 3 checks (although that is probably better). Thanks Sekhar

2 1

stunnel errors on Solaris
by Kevin Mooney 27 Jan '06

27 Jan '06

Hello All, I am having some errors on a Solaris 8 machine with stunnel. Everything seems to be working fine, but I am just a little leary since it is under security violations. I couldn't get anything from google using the string Too many retries on SSL shutdown. I was curious if anyone has seen this before or if somebody might have an idea as to what this means. Thank You, Kevin Security Violations =-=-=-=-=-=-=-=-=-= Jan 26 14:38:24 duvel stunnel: [ID 821868 daemon.notice] LOG5[23863:11151]: Too many retries on SSL shutdown Jan 26 14:38:24 duvel stunnel: [ID 821868 daemon.notice] LOG5[23863:11151]: Too many retries on SSL shutdown Jan 26 15:28:19 duvel stunnel: [ID 821868 daemon.notice] LOG5[23863:11180]: Too many retries on SSL shutdown Jan 26 15:28:19 duvel stunnel: [ID 821868 daemon.notice] LOG5[23863:11180]: Too many retries on SSL shutdown Jan 26 14:38:24 duvel stunnel: [ID 821868 daemon.notice] LOG5[23863:11151]: Too many retries on SSL shutdown Jan 26 15:28:19 duvel stunnel: [ID 821868 daemon.notice] LOG5[23863:11180]: Too many retries on SSL shutdown

2 1

Stunnel and Forte Agent
by Malcolm William Mason 27 Jan '06

27 Jan '06

Hello to all, I have been using Stunnel to access News Groups at ATT.net to by-pass or tunnel through ATT's SSL for some time. I have run into trouble and I am getting a message "connection" failed. At first I thought that it was Stunnel and after deleting and re-installing Stunnel, I an getting the same RESULT. Was there an older version of Stunnel that worked and will the new, updated Stunnel not work or does it need to have some settings changed? Malcolm Mason MWM1(a)jhu.edu

1 0

Proxy Support and 4.15b2
by Ben Green 26 Jan '06

26 Jan '06

Greetings everyone, I have been working for a few days with Stunnel and have been trying to get it working with the proxy servers that filter all outbound traffic at work. I stumbled across 4.15b2 today and was able to get it all to work well to SSL enable telnet and fix through the connect protocol. I plan to use this in production if all goes well in dev, test, and qa over the next 2 months. I was not around on the list when the announcement went out for 4.15b2 on November 16th (found it in the archives). I'll get to my point, now. I am wondering how testing is going with 4.15b2. Is it going to be released as 4.15, soon? Has anyone put 4.15b2 in a production situation? Thanks. Ben Green

2 1

Win32 proxy enabled version
by Richard Houston 24 Jan '06

24 Jan '06

Hi all, I am looking for a windows version of stunnel with proxy server support. I need to use this from behind a Novel Boarder manager firewall. Also is there any documentation on the config file options? Thanks much in advance! +------------------------------------+ Best regards, -Richard Houston -R.L.H. Consulting -E-Mail rhouston(a)rlhc.net -WWW http://www.rlhc.net -Blog http://www.rlhc.net/blog/

1 0

Re: [stunnel-users] exclusively TLS
by Jesse Small 24 Jan '06

24 Jan '06

I've been working through the same problem as John, but I tried using Jan's solution by setting the options and still haven't been able to get it to work. On server1 I am running openssl s_server with tls-only specified: openssl s_server -accept 8443 -cert XDS_REG_HXTI.cer -key hxti1.key -tls1 On the client side (server2), I have stunnel set up as a client listening on localhost port 8100, and forwarding over to server1, port 8443. Then to test I run 'telnet localhost 8100' and see the error message from s_server: ACCEPT ERROR 16656:error:1408A10B:SSL routines:SSL3_GET_CLIENT_HELLO:wrong version number:s3_srvr.c:683: shutting down SSL CONNECTION CLOSED In my stunnel.log file I can see this error message: SSL_connect: 14094410: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure So to me it still seems to be sending out a client hello in sslv3, despite my efforts to the contrary. Below are the pertinent parts of my stunnel_client.conf file. Any help you could give would be greatly appreciated. Thanks, Jesse ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS options = NO_SSLv2 options = NO_SSLv3 [toOtherServer] accept = 8100 connect = devapp:8443 -----Original Message----- From: Jan Meijer [mailto:[email protected]] Sent: Friday, January 20, 2006 5:20 PM To: Moehrke, John (GE Healthcare) Cc: stunnel-users(a)mirt.net Subject: RE: [stunnel-users] exclusively TLS On Fri, 20 Jan 2006, Moehrke, John (GE Healthcare) wrote: > It is not the list of ciphers that I want to choose from. We are indeed > using a select set of ciphers and that seems to be working fine. My > problem is that when stunnel connects to the server it is trying sslv3, > and this causes an error as the server is only supporting TLS. I could > easily be wrong... Ah, that way. options = SSL_options OpenSSL library options The parameter is the OpenSSL option name as described in the SSL_CTX_set_options(3ssl) manual, but without SSL_OP_ prefix. Several options can be used to specify multiple options. For example for compatibility with erroneous Eudora SSL implementation the following option can be used: options = DONT_INSERT_EMPTY_FRAGMENTS Check the SSL_CTX_set_options manpage, it says -amongst other things-: SSL_OP_NO_SSLv2 Do not use the SSLv2 protocol. SSL_OP_NO_SSLv3 Do not use the SSLv3 protocol. SSL_OP_NO_TLSv1 Do not use the TLSv1 protocol. That ought to do the trick I'd say. Let us know if it did :) Jan -- http://www.surfnet.nl/organisatie/jame

1 0

ad tdions
by Malcolm William Mason 23 Jan '06

23 Jan '06

I am, apparently on this But how do I post to it as others seen to. Pro Posterioribus

1 0

Looking for a job in UK or Ireland
by Michal Trojnara 23 Jan '06

23 Jan '06

Hi, I hope you don't mind this time I'll use stunnel mailing lists for something personal. I've just updated my Resume: http://mike.mirt.net/cv-en.pdf Do you know of interesting job openings? Possibly as an architect or in a similar position. Best regards, Mike

1 0

https to http proxy is buggy with IE
by Glen 22 Jan '06

22 Jan '06

Hi Everyone, I am trying to use stunnel to do the ssl portion for the web server. Mainly because the certificate I have is easy to setup in stunnel (was originally created for an openssl based serer) and the web server supports it's own propriatery cert format which I would like to avoid having to convert to. I have it working fine with all browsers except for the buggy Internet Explorer. With internet explorer anything requiring a page redirect fails (from viewing the logs it appears the socket gets closed before the redirect is finished resulting in a blank page being sent to the browser. I have tried the TIMEOUTclose = 0 but that hasn't helped. Any suggestions? thanks, Glen

2 1

stunnel 4.14 errors and dropped connection
by stunnelusers＠tinfoil.cotse.net 21 Jan '06

21 Jan '06

Hello, If I leave my computer downloading via stunnel and come back to it later, I find the download has stopped halfway and in the stunnel log it says: SSL_read: Connection reset by peer (WSAECONNRESET) (10054) and then a number of lines like: Error resolving 'xxx.xxx.xxx': Neither nodename nor servname known (EAI_NONAME) where xxx.xxx.xxx is the url I was downloading from. I am using stunnel 4.14 on win xp. If I try to load a web page like google I get told it cannot be found. I have to switch off the router and switch it back on. When Windows finds the "new" connection it resets itself and everything works perfectly again, for a while, and then it happens all over again. This did not happen before I upgraded to 4.14. What is happening? Why is it happening? How do i stop it? Thanks.

1 0

RE: [stunnel-users] exclusively TLS
by Moehrke, John (GE Healthcare) 20 Jan '06

20 Jan '06

It is not the list of ciphers that I want to choose from. We are indeed using a select set of ciphers and that seems to be working fine. My problem is that when stunnel connects to the server it is trying sslv3, and this causes an error as the server is only supporting TLS. I could easily be wrong... John > > I need to talk to a server that is requiring pure TLS. It seems that > > STUNNEL always starts with SSL. How do I get STUNNEL to > start the client > > side conversation with TLS? > > http://www.stunnel.org/faq/stunnel.html#global_options > > ciphers = cipherlist > > Select permitted SSL ciphers > > A colon delimited list of the ciphers to allow in the SSL > connection. > For example DES-CBC3-SHA:IDEA-CBC-MD5 > > > For an exhaustive table of allowed ciphersuite values, if > it's not in the > stunnel manual check > http://www.modssl.org/docs/2.8/ssl_reference.html#ToC9 > > Jan > > -- > http://www.surfnet.nl/organisatie/jame > >

2 1

exclusively TLS
by Moehrke, John (GE Healthcare) 20 Jan '06

20 Jan '06

I need to talk to a server that is requiring pure TLS. It seems that STUNNEL always starts with SSL. How do I get STUNNEL to start the client side conversation with TLS? John Moehrke Enterprise Security Architect GE Healthcare T 262 293 1667 W126 N7449 Flint Road, Suite 200, Menomonee Falls, WI 53051 John.Moehrke(a)med.ge.com <mailto:[email protected]> www.gehealthcare.com <http://www.gehealthcare.com/> What I may see or hear in the course of the treatment or even outside of the treatment in regard to the life of men, which on no account one must spread abroad, I will keep to myself, holding such things shameful to be spoken about. (One Portion of the Hippocratic Oath - Hippocrates, circa 400 B.C.)

2 1

Stunnel in a three tier setup
by Louis Young 19 Jan '06

19 Jan '06

Hi Guys I would like to set up stunnel in a three tier environment, i.e. instead of just having a client and a server, I have a client, midware and server. I tried doing this: On the client: [VNC on TestMachine] accept = 9000 connect = 192.168.100.12:9000 192.168.100.12 is the "mid-ware" machine: On this "mid-ware" machine: [VNC on TestMachine] accept = 9000 connect = 192.168.100.16:9000 192.168.100.16 is the destination: Then on the destination: [VNC] accept = 9000 connect = 192.168.100.16:5900 The only machine with client=yes is the client and they all use the same key. If I change the settings on the client to point directly to the destination (i.e. using only two machines), it works, but with three machines there seems to be a problem Any ideas? Regards, Louis Young Systems Administrator Kwikpay SA (Pty) Ltd

2 1

verify server certification is missing
by Olivier twist 17 Jan '06

17 Jan '06

I think a functionnality is missing in stunnel. I compare the behaviour of stunnel and apache mod-ssl. If you have a certificate signed by third party, apache checks the root certificate like stunnel do this with -v 1 option but apache don't ask for a client certificate, stunnel do this :-( I think that stunnel should control server certificate chain defined in CA file even if option -v 1 is not set !!! Could you give your opinion? If I use stunnel and not apache it's because I have some protocols to handle with ssl and stunnel is a very easy to use solution. Thanks Oliver

1 0

Delay option
by Stefaan Van Dooren 16 Jan '06

16 Jan '06

Hi, I'm setting up stunnel and I'm facing a problem with dynamic IP-adresses. Searching google and the man pages I tought that the "delay = yes" option would solve my problem, but it doesn't seems to. If I had "delay = yes" to my config file, none of my services seems to work anymore. If I remove it, everything is working fine, until the the remote-IP changes, and I have to restart stunnel. What am I doing wrong ? Or isn't this the right option for this job ? Stunnel -version : stunnel 4.14 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 Global options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /usr/local/etc/stunnel/stunnel.pem pid = /usr/local/var/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds Stefaan

2 1

Connection Refused by libwrap
by Eddie Atherton 16 Jan '06

16 Jan '06

Hi, With Version 4.14, I've now started seeing the following messages occaisionally when I fire up 4 concurrent connections from my Windows box, via stunnel on Linux, to my NewsServer: Jan 3 17:55:13 The-Tardis stunnel: LOG3[17760:399]: Unexpected socket close (read_blocking) Jan 3 17:55:13 The-Tardis stunnel: LOG4[17760:399]: Connection from 192.168.0.2:2073 REFUSED by libwrap Jan 3 17:55:13 The-Tardis stunnel: LOG3[17761:399]: Unexpected socket close (read_blocking) Jan 3 17:55:13 The-Tardis stunnel: LOG4[17761:399]: Connection from 192.168.0.2:2073 REFUSED by libwrap Jan 3 17:55:13 The-Tardis stunnel: LOG3[17761:400]: Unexpected socket close (read_blocking) Jan 3 17:55:13 The-Tardis stunnel: LOG4[17761:400]: Connection from 192.168.0.2:2074 REFUSED by libwrap Jan 3 17:55:13 The-Tardis stunnel: LOG3[3824:399]: Unexpected socket close (read_blocking) Jan 3 17:55:13 The-Tardis stunnel: LOG4[3824:399]: Connection from 192.168.0.2:2073 REFUSED by libwrap Jan 3 17:55:13 The-Tardis stunnel: LOG3[3824:400]: Unexpected socket close (read_blocking) Jan 3 17:55:13 The-Tardis stunnel: LOG4[3824:400]: Connection from 192.168.0.2:2074 REFUSED by libwrap Jan 3 17:55:13 The-Tardis stunnel: LOG3[3824:401]: Unexpected socket close (read_blocking) Jan 3 17:55:13 The-Tardis stunnel: LOG4[3824:401]: Connection from 192.168.0.2:2075 REFUSED by libwrap Following this, the connections continues as normal. Now, ASAIK, I'm not using the wrappers. I'm starting stunnel as a daemon, in rc.local. There are no entries in inetd.conf for the port that the windows machine connects from. Here's the relevent parts of the config file: ; Use it for client mode client = yes [nntps] accept = 563 connect = newsgroups.comcast.net:563 Cheers, Eddie

2 2

need help with verify 1 option
by Olivier twist 13 Jan '06

13 Jan '06

2 2

Some newbie question for stunnel
by Thomas Stein 13 Jan '06

13 Jan '06

Hello, After reading some doc pages about stunnel I have still some questions: 1.) I read that the client part of a pop3 connection (e.g. for GoogleMail) is like stunnel -c -d pop3 -r bar:pop3s However I did not found any explations of the flags -d, -d and -r When I type stunnel -help none of these flags are explained. 2.) Can I replace pop3 and pop3s in the command above by real port numbers? 3.) Is stunnel compatible with SSH servers ? In other words: can stunnel on the local machine communicate with a SSH server on the remote computer and vice versa? 4.) Is there a timeout function? Read: When I start stunnel I would like to exit the service after lets say 5 minutes automatically. Is there such a feature/option? 5.) Has someone experiences with googlemail pop3 retrieval of emails? Is the following stunnel command recommendable for googlemail.com? stunnel -c -d pop3 -r pop.googlemail.com:pop3 Thank you in advance for the answer Thomas -- ___________________________________________________ Play 100s of games for FREE! http://games.mail.com/

2 1

Sniffing the network --how to disable SSL?
by david-e.hansen＠ubs.com 12 Jan '06

12 Jan '06

Hi, I know this sort of defeats the whole purpose of stunnel, but I have an LDAP server which listens for non-SSL on one port, and SSL on another. We decided to use stunnel and the SSL port on our LDAP server for security purposes. However, now we need to see the communication between clients and the LDAP server, in order to debug a production problem. Sniffing won't be terribly useful unless we can turn off the SSL encryption of the communication. I can't just re-point the application to the non-SSL port because this is stored in a central database and would affect everyone (it's a 3rd pty app), so I just want to change the stunnel.conf file on my PC so that it does port-forwarding but no encryption. Is this possible to do? Regards, David E. Hansen Stunnel version 4, LDAP version 3 Visit our website at http://www.ubs.com This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message which arise as a result of e-mail transmission. If verification is required please request a hard-copy version. This message is provided for informational purposes and should not be construed as a solicitation or offer to buy or sell any securities or related financial instruments.

2 1

running on one machine stunnel server AND client
by Dan Beldiman 11 Jan '06

11 Jan '06

Hi, I am using stunnel4 (stunnel 4.09 on i386-pc-linux-gnu PTHREAD+POLL+IPv6+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004) on debian linux. I want to run on one machine an stunnel server and an stunnel client, so it can recive a connection and also open a new connection to a different server (in the ascii graphic below server b) SERVER A SERVER B SERVER C | | | | ------>------ ----->---- The configuration file only allows me to specify client=yes or no, but I can not specify this for each connection. How can I set up a client and server on the same machine? Thanks Dan

2 3

Stunnel 4.14 & 4.15 don't compile on Tru64 (5.1A)!
by Alberto D'Ambrosio 11 Jan '06

11 Jan '06

Hi! I'd like to upgrade Stunnel from 4.04 to 4.14/4.15 on my Tru64 box, but it no longer compiles: ========================================= cc: Error: client.c, line 173: In this declaration, "socklen_t" must specify a type. (badparsedecl) socklen_t addrlen; ----^ cc: Error: client.c, line 893: In this declaration, "socklen_t" must specify a type. (badparsedecl) socklen_t addrlen; ----^ cc: Error: client.c, line 1003: In this declaration, "socklen_t" must specify a type. (badparsedecl) socklen_t optlen; ----^ cc: Error: client.c, line 175: In this statement, "addrlen" is not declared. (undeclared) addrlen=sizeof(SOCKADDR_UNION); ----^ cc: Warning: client.c, line 259: In this statement, the referenced type of the pointer value "sid_ctx" is "unsigned char", which is not compatible with "const char" because they differ by signed/unsigned attribute. (ptrmismatch1) SSL_set_session_id_context(c->ssl, sid_ctx, strlen(sid_ctx)); -------------------------------------------------------^ cc: Error: client.c, line 904: In this statement, "addrlen" is not declared. (undeclared) addrlen=sizeof(SOCKADDR_UNION); ----^ cc: Error: client.c, line 1019: In this statement, "optlen" is not declared. (undeclared) optlen=sizeof(error); ------------^ *** Exit 1 Stop. *** Exit 1 Stop. ========================================= For your information: - Version 4.04 compiles and works fine. - Version 4.06 compiles but doesn't work: Jan 11 10:36:14 scilla stunnel[701061]: daemon_loop: s_poll_wait: Invalid argument (22) Jan 11 10:38:37 scilla last message repeated 77888 times Jan 11 10:36:44 scilla last message repeated 24118 times - any version >= 4.07 no longer compiles. - OpenSSL 0.9.8a compiles and works fine. Any help is appreciated. Ciao, Alberto

2 1

Private key storage on usb token or CD
by Siddhartha Jain 10 Jan '06

10 Jan '06

Hi, What would I need to do to store private keys generated on a Windows client on a USB Token or a CD? Thanks, - Siddhartha

2 1

Re: Connection reset by peer on same local network?
by Gabe Martin-Dempesy 04 Jan '06

04 Jan '06

On Jan 4, 2006, at 5:00 AM, stunnel-users-request(a)mirt.net wrote: > Please try the latest stunnel and OpenSSL first. > Also send detailed logs (debug=7). Same behavior occurs after upgrade. on debug 7: Server log: 2006.01.04 09:01:35 LOG7[14085:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2006.01.04 09:01:35 LOG7[14085:0]: CONTEXT 1, FD=4, (IN)->() 2006.01.04 09:01:35 LOG7[14085:0]: CONTEXT 1, FD=6, (IN)->() 2006.01.04 09:01:35 LOG7[14085:0]: CONTEXT 2, FD=8, (OUT)->() 2006.01.04 09:01:35 LOG7[14085:0]: CONTEXT 2, FD=7, (OUT)->(ERRHUP) 2006.01.04 09:01:35 LOG7[14085:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2006.01.04 09:01:35 LOG7[14085:0]: CONTEXT 1, FD=4, (IN)->() 2006.01.04 09:01:35 LOG7[14085:0]: CONTEXT 1, FD=6, (IN)->() 2006.01.04 09:01:35 LOG7[14085:0]: CONTEXT 2, FD=8, (OUT)->() 2006.01.04 09:01:35 LOG7[14085:0]: CONTEXT 2, FD=7, (OUT)->(ERRHUP) 2006.01.04 09:01:35 LOG3[14085:2]: transfer() loop executes not transferring any data 2006.01.04 09:01:35 LOG3[14085:2]: please report the problem to Michal.Trojnara(a)mirt.net 2006.01.04 09:01:35 LOG3[14085:2]: socket open: rd=yes wr=yes, ssl open: rd=yes wr=yes 2006.01.04 09:01:35 LOG3[14085:2]: socket ready: rd=no wr=no, ssl ready: rd=yes wr=no 2006.01.04 09:01:35 LOG3[14085:2]: ssl want: rd=no wr=no 2006.01.04 09:01:35 LOG3[14085:2]: socket input buffer: 16384 byte (s), ssl input buffer: 16384 byte(s) 2006.01.04 09:01:35 LOG3[14085:2]: check_SSL_pending=0, ssl_closing=0 2006.01.04 09:01:35 LOG5[14085:2]: Connection reset: 1345269015 bytes sent to SSL, 213024 bytes sent to socket 2006.01.04 09:01:35 LOG7[14085:2]: 973 finished (0 left) 2006.01.04 09:01:35 LOG5[14085:2]: stack_info: size=65536, current=4620 (7%), maximum=4620 (7%) 2006.01.04 09:01:35 LOG7[14085:2]: Context 2 closed 2006.01.04 09:01:35 LOG7[14085:0]: Waiting -1 second(s) for 2 file descriptor(s) Client log: 2006.01.04 09:00:39 LOG7[9605:0]: Waiting 43200 second(s) for 5 file descriptor(s) 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 1, FD=4, (IN)->() 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 1, FD=6, (IN)->() 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 1, FD=7, (IN)->() 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 2, FD=8, (OUT)->() 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 2, FD=9, (OUT)->(OUT) 2006.01.04 09:00:39 LOG7[9605:2]: SSL_write returned WANT_WRITE: retrying 2006.01.04 09:00:39 LOG3[9605:2]: SSL socket closed with 16384 byte (s) in buffer 2006.01.04 09:00:39 LOG5[9605:2]: Connection reset: 348124 bytes sent to SSL, 1345102011 bytes sent to socket 2006.01.04 09:00:39 LOG7[9605:2]: 8001 finished (0 left) 2006.01.04 09:00:39 LOG7[9605:2]: Context 2 closed 2006.01.04 09:00:39 LOG7[9605:0]: Waiting -1 second(s) for 3 file descriptor(s) This part of the logs: 2006.01.04 09:00:39 LOG7[9605:0]: Waiting 43200 second(s) for 5 file descriptor(s) 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 1, FD=4, (IN)->() 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 1, FD=6, (IN)->() 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 1, FD=7, (IN)->() 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 2, FD=8, (OUT)->() 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 2, FD=9, (OUT)->(OUT) loops continuously in both server and client lots the entire time, repeating several times each second. One rsync session over stunnel generates stunnel logs over 50MB. I have no idea if this is typical LOG7 behavior or not, but I'm mentioning it just in case.

1 0

stunnel 4.14 and zlib compression problem
by David Cheung 03 Jan '06

03 Jan '06

I'm hoping that someone can shed some light on the following problem: when I run stunnel: [root@test stunnel]# stunnel /etc/stunnel/stunnel.conf 2006.01.03 10:49:27 LOG5[4619:1]: stunnel 4.14 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7h 11 Oct 2005 2006.01.03 10:49:27 LOG3[4619:1]: Failed to initialize zlib compression method content of stunnel.conf: foreground = yes debug = 7 cert = /etc/stunnel/stunnel.pem output = /dev/stdout chroot = /var/run/stunnel/ setuid = nobody setgid = nobody pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 compression = zlib [demo] accept = 1443 connect = www:80 TIMEOUTclose = 0 It also appears that the libraries are properly linked in: [root@test tmp]# ldd /usr/sbin/stunnel linux-gate.so.1 => (0xffffe000) libz.so.1 => /usr/lib/libz.so.1 (0xb7fc9000) libdl.so.2 => /lib/libdl.so.2 (0xb7fc5000) libutil.so.1 => /lib/libutil.so.1 (0xb7fc1000) libnsl.so.1 => /lib/libnsl.so.1 (0xb7fab000) libssl.so.0.9.7 => /usr/lib/libssl.so.0.9.7 (0xb7f78000) libcrypto.so.0.9.7 => /usr/lib/libcrypto.so.0.9.7 (0xb7e66000) libwrap.so.0 => /usr/lib/libwrap.so.0 (0xb7e5f000) libc.so.6 => /lib/tls/libc.so.6 (0xb7d40000) /lib/ld-linux.so.2 (0xb7fdf000) I'm running this on Arch Linux with a stock 2.6.15 kernel. Any help would be appreciated.

2 1

Connection reset by peer on same local network?
by Gabe Martin-Dempesy 03 Jan '06

03 Jan '06

I'm attempting to setup an encrypted rsync to pull backups off of a file server onto a safe backup machine. To do this I'm using a combination of stunnel and rsyncd (It needs to pull root-owned files, so -e ssh wouldn't work unless I want to have a backup script remotely logging in as root!!) For now the machines are both on the same local network, 10.10.10.0/24, but I'm have weird problems with stunnel getting a 'connection reset by peer' after a couple minutes of the rsync, halting the transfer prematurely. Here's what I see in the logs: Client: Dec 29 10:19:21 backup stunnel[2568]: 8001 connected from 127.0.0.1:39215 Dec 29 10:21:09 backup stunnel[2568]: SSL_write: Connection reset by peer (104) Dec 29 10:21:09 backup stunnel[2568]: Connection reset: 192532 bytes sent to SSL, 5920666 bytes sent to socket Server: Dec 29 10:20:00 proto stunnel[30434]: 973 connected from 10.10.10.20:54054 Dec 29 10:20:00 proto rsyncd[1776]: rsync on xserve from localhost (127.0.0.1) Dec 29 10:21:49 proto stunnel[30434]: SSL socket closed with 16384 byte(s) in buffer Dec 29 10:21:49 proto stunnel[30434]: Connection reset: 5953434 bytes sent to SSL, 98416 bytes sent to socket Dec 29 16:21:49 proto rsyncd[1776]: rsync: writefd_unbuffered failed to write 4096 bytes: phase "unknown": Connection reset by peer Dec 29 16:21:49 proto rsyncd[1776]: rsync error: error in rsync protocol data stream (code 12) at io.c(666) Note that the client gets the 'connection reset by peer' a good 40 seconds before the server notices the disconnect. Here are the associated stunnel.conf's, which are pretty basic Client: cert = /etc/stunnel/backup.crt key = /etc/stunnel/backup.key setuid = stunnel setgid = stunnel pid = /var/run/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 client = yes [8001] accept = 8001 connect = 10.10.10.15:973 Server: cert = /etc/stunnel/proto.crt key = /etc/stunnel/proto.key setuid = stunnel setgid = stunnel pid = /var/run/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [973] accept = 973 connect = 127.0.0.1:rsync Both are using: stunnel 4.09 on i686-pc-linux-gnu PTHREAD+POLL+IPv6+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 Global options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /etc/stunnel/stunnel.pem pid = /var/lib/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds Both of these machines are Gentoo 2005.1, updated to current, using the hardened 2.6 profile. Neither of them use non-standard make flags. Does anyone have some insight? There shouldn't be any "peer" (besides themselves) in the way between these two boxes to disconnect them.

2 1

RE: [stunnel-users] Connection reset by peer on same local networ k?
by Jeremy Simons 03 Jan '06

03 Jan '06

The problem is not with stunnel, but with rsyncd. I assume you are running rsyncd on the source machine in conjunction with the /etc/rsyncd.conf file. The cool thing about running rsyncd through stunnel is the rsync client appears to the rsyncd as a local machine (obviously) so permissions are a problem. The best way I could recommend since you need to access root owned files would be to setup your rsyncd entry something like: ## Example of full access to /home directory [home] uid = root gid = root path = /home comment = home directory. hosts allow = 127.0.0.1 read only = no ignore nonreadable = no refuse options = checksum dont compress = * If you notice the "hosts allow" directive only allows access from localhost(127.0.0.1). The problem is *anyone* can connect to your stunnel server unless you require security I would recommend using your firewall to allow access to your stunnel instance and also to use non-standard ports (I.E. 50000-50010). Using a firewall in lieu of authentication is obviously NOT secure or even recommended for a production environment but is simply added security that certainly doesn't hurt. The workaround would be to secure stunnel and leave rsyncd wide-open to localhost. As for the "connection reset" errors I was getting the same thing until I upgraded to the latest version of stunnel. I read a post on stunnel.mirt.net about it. Are you sure you're using the latest version of stunnel? Jeremy -----Original Message----- From: Gabe Martin-Dempesy [mailto:[email protected]] Sent: Tuesday, January 03, 2006 1:49 PM To: stunnel-users(a)mirt.net Subject: [stunnel-users] Connection reset by peer on same local network? I'm attempting to setup an encrypted rsync to pull backups off of a file server onto a safe backup machine. To do this I'm using a combination of stunnel and rsyncd (It needs to pull root-owned files, so -e ssh wouldn't work unless I want to have a backup script remotely logging in as root!!) For now the machines are both on the same local network, 10.10.10.0/24, but I'm have weird problems with stunnel getting a 'connection reset by peer' after a couple minutes of the rsync, halting the transfer prematurely. Here's what I see in the logs: Client: Dec 29 10:19:21 backup stunnel[2568]: 8001 connected from 127.0.0.1:39215 Dec 29 10:21:09 backup stunnel[2568]: SSL_write: Connection reset by peer (104) Dec 29 10:21:09 backup stunnel[2568]: Connection reset: 192532 bytes sent to SSL, 5920666 bytes sent to socket Server: Dec 29 10:20:00 proto stunnel[30434]: 973 connected from 10.10.10.20:54054 Dec 29 10:20:00 proto rsyncd[1776]: rsync on xserve from localhost (127.0.0.1) Dec 29 10:21:49 proto stunnel[30434]: SSL socket closed with 16384 byte(s) in buffer Dec 29 10:21:49 proto stunnel[30434]: Connection reset: 5953434 bytes sent to SSL, 98416 bytes sent to socket Dec 29 16:21:49 proto rsyncd[1776]: rsync: writefd_unbuffered failed to write 4096 bytes: phase "unknown": Connection reset by peer Dec 29 16:21:49 proto rsyncd[1776]: rsync error: error in rsync protocol data stream (code 12) at io.c(666) Note that the client gets the 'connection reset by peer' a good 40 seconds before the server notices the disconnect. Here are the associated stunnel.conf's, which are pretty basic Client: cert = /etc/stunnel/backup.crt key = /etc/stunnel/backup.key setuid = stunnel setgid = stunnel pid = /var/run/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 client = yes [8001] accept = 8001 connect = 10.10.10.15:973 Server: cert = /etc/stunnel/proto.crt key = /etc/stunnel/proto.key setuid = stunnel setgid = stunnel pid = /var/run/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [973] accept = 973 connect = 127.0.0.1:rsync Both are using: stunnel 4.09 on i686-pc-linux-gnu PTHREAD+POLL+IPv6+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 Global options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /etc/stunnel/stunnel.pem pid = /var/lib/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds Both of these machines are Gentoo 2005.1, updated to current, using the hardened 2.6 profile. Neither of them use non-standard make flags. Does anyone have some insight? There shouldn't be any "peer" (besides themselves) in the way between these two boxes to disconnect them. _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

stunnel library inconsistencies
by Brian T 29 Dec '05

29 Dec '05

Hi, I've been using stunnel 4.08 on an embedded Linux platform for a while now, and am attempting to move to the 2.6 kernel from the 2.4.20, which has changed my building platform. I am cross-compiling with libs and tools targeted for the embedded system, which is an i486 type AMD Elan chip. I have tried 4.08, 4.14 and 4.15b, all with the same result. Everything looks to compile properly, but when running stunnel I get the following: Inconsistency detected by ld.so: dl-minimal.c: 134: realloc: Assertion `ptr == alloc_last_block' failed! strace doesn't supply any helpful information. I have tried building with and without tcpwrappers, and have tried libssl 0.9.7g and 0.9.7i. Libssl v0.9.8a doesn't seem to play very nice. Anyone able to look at my config.log? It's 140k uncompressed, but will zip it up if needed. Thanks, -Brian

2 2

./configure issues
by Campbell Vertesi 29 Dec '05

29 Dec '05

I'm running a fresh install of Solaris 10-sparc, and am having a helluvatime getting stunnel to configure. I come from a Gentoo background, where compiling apps is second nature, and I'm not used to this kind of problem! I originally installed gcc3.3.2 using the sunfreeware package, and as an afterthought went back again using pkg-get to make sure I had all the dependencies I needed. When I run ./configure, it errors out: # ./configure configure: **************************************** initialization checking for a BSD-compatible install... /opt/sfw/bin/ginstall -c checking whether build environment is sane... yes checking for gawk... gawk checking whether make sets $(MAKE)... yes checking build system type... sparc-sun-solaris2.10 checking host system type... sparc-sun-solaris2.10 checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ANSI C... none needed checking for style of include used by make... GNU checking dependency style of gcc... gcc3 checking for a BSD-compatible install... /opt/sfw/bin/ginstall -c checking whether make sets $(MAKE)... (cached) yes configure: **************************************** libtool checking for a sed that does not truncate output... /opt/sfw/bin/gsed checking for egrep... egrep checking for ld used by gcc... /usr/ccs/bin/ld checking if the linker (/usr/ccs/bin/ld) is GNU ld... no checking for /usr/ccs/bin/ld option to reload object files... -r checking for BSD-compatible nm... /opt/sfw/lib/bin//nm -B checking whether ln -s works... yes checking how to recognise dependent libraries... pass_all checking how to run the C preprocessor... /lib/cpp configure: error: C preprocessor "/lib/cpp" fails sanity check See `config.log' for more details. relevant chunk of config.log: configure:2615: checking whether gcc accepts -g configure:2636: gcc -c -g conftest.c >&5 configure:2642: $? = 0 configure:2645: test -z || test ! -s conftest.err configure:2648: $? = 0 configure:2651: test -s conftest.o configure:2654: $? = 0 configure:2665: result: yes configure:2682: checking for gcc option to accept ANSI C configure:2752: gcc -c -g -O2 conftest.c >&5 In file included from conftest.c:13: /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/stdio.h:36:27: iso/stdio_iso.h: No such file or directory /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/stdio.h:105:27: iso/stdio_c99.h: No such file or directory In file included from conftest.c:13: /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/stdio.h:210: error: parse error before '*' token /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/stdio.h:246: error: parse error before '*' token /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/stdio.h:247: error: parse error before '*' token /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/stdio.h:256: error: parse error before '*' token /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/stdio.h:258: error: parse error before '*' token /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/stdio.h:282: error: parse error before '*' token /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/stdio.h:284: error: parse error before '*' token /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/stdio.h:295: error: parse error before '*' token /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/stdio.h:296: error: parse error before "FILE" In file included from conftest.c:14: /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:27:31: sys/feature_tests.h: No such file or directory /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:28 :26: sys/isa_defs.h: No such file or directory /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:33:27: sys/machtypes.h: No such file or directory /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:45:27: sys/int_types.h: No such file or directory In file included from conftest.c:14: /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:68: error: parse error before "int32_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:72: error: parse error before "uint32_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:214: error: parse error before "int32_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:219: error: parse error before "uint32_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:225: error: parse error before "int32_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:230: error: parse error before "uint32_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:233: error: parse error before "offset_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:234: error: parse error before "u_offset_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:235: error: parse error before "len_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:236: error: parse error before "diskaddr_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:395: error: parse error before "uint16_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:397: error: parse error before "__pthread_mutex_ceiling" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:398: error: parse error before "__pthread_mutex_type" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:399: error: parse error before "__pthread_mutex_magic" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:403: error: parse error before "uint8_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:406: error: parse error before "uint32_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:409: error: parse error before "__pthread_mutex_owner64" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:411: error: parse error before "__pthread_mutex_data" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:416: error: parse error before "uint8_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:418: error: parse error before "__pthread_cond_magic" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:420: error: parse error before "__pthread_cond_data" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:427: error: parse error before "int32_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:429: error: parse error before "__pthread_rwlock_magic" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:430: error: parse error before "__pthread_rwlock_mutex" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:431: error: parse error before "__pthread_rwlock_readercv" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:432: error: parse error before "__pthread_rwlock_writercv" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:439: error: parse error before "uint32_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:441: error: parse error before "__pthread_barrier_cycle" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:442: error: parse error before "__pthread_barrier_reserved" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:443: error: parse error before "__pthread_barrier_lock" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:444: error: parse error before "__pthread_barrier_cond" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:447: error: parse error before "pthread_spinlock_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:474: error: parse error before "upad64_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:618:24: sys/select.h: No such file or directory conftest.c:15:22: sys/stat.h: No such file or directory conftest.c:18: error: parse error before '*' token conftest.c:18: warning: `struct stat' declared inside parameter list conftest.c:18: warning: its scope is only this definition or declaration, which is probably not what you want conftest.c:18: warning: data definition has no type or storage class conftest.c:47: error: parse error before "FILE" conftest.c:47: warning: `struct stat' declared inside parameter list conftest.c:47: error: `pairnames' declared as function returning a function conftest.c:47: error: parse error before "int" configure:2758: $? = 1 configure: failed program was: | /* confdefs.h. */ | | #define PACKAGE_NAME "stunnel" | #define PACKAGE_TARNAME "stunnel" | #define PACKAGE_VERSION "4.14" | #define PACKAGE_STRING "stunnel 4.14" | #define PACKAGE_BUGREPORT "" | #define PACKAGE "stunnel" | #define VERSION "4.14" | #define HOST "sparc-sun-solaris2.10" | /* end confdefs.h. */ | #include <stdarg.h> | #include <stdio.h> | #include <sys/types.h> | #include <sys/stat.h> | /* Most of the following tests are stolen from RCS 5.7's src/conf.sh. */ | struct buf { int x; }; | FILE * (*rcsopen) (struct buf *, struct stat *, int); | static char *e (p, i) | char **p; | int i; | { | return p[i]; | } | static char *f (char * (*g) (char **, int), char **p, ...) | { | char *s; | va_list v; | va_start (v,p); | s = g (p, va_arg (v,int)); | va_end (v); | return s; | } | | /* OSF 4.0 Compaq cc is some sort of almost-ANSI by default. It has | function prototypes and stuff, but not '\xHH' hex character constants. | These don't provoke an error unfortunately, instead are silently treated | as 'x'. The following induces an error, until -std1 is added to get | proper ANSI mode. Curiously '\x00'!='x' always comes out true, for an | array size at least. It's necessary to write '\x00'==0 to get something | that's true only with -std1. */ | int osf4_cc_array ['\x00' == 0 ? 1 : -1]; | | int test (int i, double x); | struct s1 {int (*f) (int a);}; | struct s2 {int (*f) (double a);}; | int pairnames (int, char **, FILE *(*)(struct buf *, struct stat *, int), int, int); | int argc; | char **argv; | int | main () | { | return f (e, argv, 0) != argv[0] || f (e, argv, 1) != argv[1]; | ; | return 0; | } I'm at my wits end at this point. Any help would be greatly appreciated! # uname -a SunOS foobar 5.10 Generic sun4u sparc SUNW,Sun-Blade-100 # gcc -v Reading specs from /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/specs Configured with: ../configure --with-as=/usr/ccs/bin/as --with-ld=/usr/ccs/bin/ld --disable-nls Thread model: posix gcc version 3.3.2 # make -v GNU Make 3.80 Copyright (C) 2002 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. Thanks Cam

1 0

how do i configure stunnel to work with TLS_RSA_WITH_RC4_128_SHA
by Nadav, Erez 29 Dec '05

29 Dec '05

hi, I had installed stunnel to work as client. I do i configure the stunnel to encrypt send data in TLS_RSA_WITH_RC4_128_SHA Regards Erez __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

1 0

how do i configure SSL or stunnel for the following encription
by Nadav, Erez 28 Dec '05

28 Dec '05

1. TLS_RSA_WITH_RC4_128_SHA 2. TLS_RSA_WITH_AES_256_CBC_SHA Regards Nadav Erez R&D Verint Systems Inc Phone: +972+9-9624753 Cellular: +972-54-7784753 Email: Erez.Nadav(a)verint.com Web: www.verint.com <http://www.verint.com/> __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

1 0

stunnel + openbsd + popa3d
by Pedro [bodymind] 28 Dec '05

28 Dec '05

hi! I'm getting nuts with this... i hope someone can help me... i'm trying to use popa3d trough stunnel, with inetd... stunnel.log: 2005.12.28 14:03:45 LOG5[6298:2102628352]: stunnel 4.11 on i386-unknown-openbsd3.8 PTHREAD+POLL+IPv6+LIBWRAP with OpenSSL 0.9.7g 11 Apr 2005 2005.12.28 14:03:45 LOG7[6298:2102628352]: Snagged 64 random bytes from /dev/arandom 2005.12.28 14:03:45 LOG7[6298:2102628352]: RAND_status claims sufficient entropy for the PRNG 2005.12.28 14:03:45 LOG6[6298:2102628352]: PRNG seeded successfully 2005.12.28 14:03:45 LOG7[6298:2102628352]: Certificate: /etc/stunnel/teste.pem 2005.12.28 14:03:45 LOG7[6298:2102628352]: Key file: /etc/stunnel/teste.pem 2005.12.28 14:03:45 LOG7[6298:2102628352]: stunnel started 2005.12.28 14:03:45 LOG7[6298:2102628352]: FD 0 in non-blocking mode 2005.12.28 14:03:45 LOG7[6298:2102628352]: FD 1 in non-blocking mode 2005.12.28 14:03:45 LOG5[6298:2102628352]: stunnel connected from 2x.x.x.x :37594 2005.12.28 14:03:45 LOG7[6298:2102628352]: SSL state (accept): before/accept initialization 2005.12.28 14:03:45 LOG7[6298:2102628352]: SSL state (accept): SSLv3 read client hello A 2005.12.28 14:03:45 LOG7[6298:2102628352]: SSL state (accept): SSLv3 write server hello A 2005.12.28 14:03:45 LOG7[6298:2102628352]: SSL state (accept): SSLv3 write certificate A 2005.12.28 14:03:45 LOG7[6298:2102628352]: SSL state (accept): SSLv3 write server done A 2005.12.28 14:03:45 LOG7[6298:2102628352]: SSL state (accept): SSLv3 flush data 2005.12.28 14:03:45 LOG7[6298:2102628352]: SSL state (accept): SSLv3 read client key exchange A 2005.12.28 14:03:45 LOG7[6298:2102628352]: SSL state (accept): SSLv3 read finished A 2005.12.28 14:03:45 LOG7[6298:2102628352]: SSL state (accept): SSLv3 write change cipher spec A 2005.12.28 14:03:45 LOG7[6298:2102628352]: SSL state (accept): SSLv3 write finished A 2005.12.28 14:03:45 LOG7[6298:2102628352]: SSL state (accept): SSLv3 flush data 2005.12.28 14:03:45 LOG7[6298:2102628352]: 1 items in the session cache 2005.12.28 14:03:45 LOG7[6298:2102628352]: 0 client connects (SSL_connect()) 2005.12.28 14:03:45 LOG7[6298:2102628352]: 0 client connects that finished 2005.12.28 14:03:45 LOG7[6298:2102628352]: 0 client renegotiatations requested 2005.12.28 14:03:45 LOG7[6298:2102628352]: 1 server connects (SSL_accept()) 2005.12.28 14:03:45 LOG7[6298:2102628352]: 1 server connects that finished 2005.12.28 14:03:45 LOG7[6298:2102628352]: 0 server renegotiatiations requested 2005.12.28 14:03:45 LOG7[6298:2102628352]: 0 session cache hits 2005.12.28 14:03:45 LOG7[6298:2102628352]: 0 session cache misses 2005.12.28 14:03:45 LOG7[6298:2102628352]: 0 session cache timeouts 2005.12.28 14:03:45 LOG6[6298:2102628352]: SSL accepted: new session negotiated 2005.12.28 14:03:45 LOG6[6298:2102628352]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.12.28 14:03:45 LOG7[6298:2102628352]: bind#1: Invalid argument (22) 2005.12.28 14:03:45 LOG7[6298:2102628352]: bind#2: Invalid argument (22) 2005.12.28 14:03:45 LOG3[6298:2102628352]: connect: Invalid argument (22) 2005.12.28 14:03:45 LOG3[6298:2102628352]: Failed to initialize remote connection 2005.12.28 14:03:45 LOG7[6298:2102628352]: stunnel finished (0 left) openssl error when i connect: $ openssl s_client -connect xxx.xxx.xxx.xxx:995 -state -debug CONNECTED(00000003) SSL_connect:before/connect initialization write to 080A6E20 [080A6E68] (148 bytes => 148 (0x94)) 0000 - 80 92 01 03 01 00 69 00-00 00 20 00 00 39 00 00 ......i... ..9.. 0010 - 38 00 00 35 00 00 16 00-00 13 00 00 0a 07 00 c0 8..5............ 0020 - 00 00 33 00 00 32 00 00-2f 00 00 07 05 00 80 03 ..3..2../....... 0030 - 00 80 00 00 66 00 00 05-00 00 04 01 00 80 08 00 ....f........... 0040 - 80 00 00 63 00 00 62 00-00 61 00 00 15 00 00 12 ...c..b..a...... 0050 - 00 00 09 06 00 40 00 00-65 00 00 64 00 00 60 00 [email protected]..`. 0060 - 00 14 00 00 11 00 00 08-00 00 06 04 00 80 00 00 ................ 0070 - 03 02 00 80 1f e8 cf 61-77 e3 92 52 b4 e8 c6 04 .......aw..R.... 0080 - c9 67 e7 93 20 4e 20 36-28 fa 98 6f b6 e5 29 c3 .g.. N 6(..o..). 0090 - 53 b0 ce 69 S..i SSL_connect:SSLv2/v3 write client hello A read from 080A6E20 [080AC3C8] (7 bytes => 7 (0x7)) 0000 - 16 03 01 00 4a 02 ....J. 0007 - <SPACES/NULS> read from 080A6E20 [080AC3CF] (72 bytes => 72 (0x48)) 0000 - 00 46 03 01 43 b2 9f 7f-42 8f 27 c4 ec 25 62 81 .F..C...B.'..%b. 0010 - 93 e3 33 1b f5 4f 12 ab-41 50 97 69 29 ba a2 b4 ..3..O..AP.i)... 0020 - 56 5c d6 10 20 c3 77 7b-35 5b 05 da 22 0f 14 47 V\.. .w{5[.."..G 0030 - 00 21 e3 96 d8 5b 57 04-5d b1 75 60 fa 72 62 49 .!...[W.].u`.rbI 0040 - 19 2a 0d 12 af 00 35 .*....5 0048 - <SPACES/NULS> SSL_connect:SSLv3 read server hello A read from 080A6E20 [080AC3C8] (5 bytes => 5 (0x5)) 0000 - 16 03 01 02 39 ....9 read from 080A6E20 [080AC3CD] (569 bytes => 569 (0x239)) 0000 - 0b 00 02 35 00 02 32 00-02 2f 30 82 02 2b 30 82 ...5..2../0..+0. 0010 - 01 94 02 09 00 eb 73 d0-24 42 f1 a3 36 30 0d 06 ......s.$B..60.. 0020 - 09 2a 86 48 86 f7 0d 01-01 04 05 00 30 5a 31 0b .*.H........0Z1. 0030 - 30 09 06 03 55 04 06 13-02 70 74 31 0e 30 0c 06 0...U....pt1.0.. 0040 - 03 55 04 08 13 05 45 76-6f 72 61 31 0e 30 0c 06 .U....Xxxxx1.0.. 0050 - 03 55 04 07 13 05 45 76-6f 72 61 31 0d 30 0b 06 .U....Xxxxx1.0.. 0060 - 03 55 04 0a 13 04 4e 65-65 69 31 0d 30 0b 06 03 .U....Xxxx1.0... 0070 - 55 04 0b 13 04 4e 65 65-69 31 0d 30 0b 06 03 55 U....Xxxx1.0...U 0080 - 04 03 13 04 4e 65 65 69-30 1e 17 0d 30 35 31 32 ....Xxxx0...0512 0090 - 32 36 30 31 30 31 33 31-5a 17 0d 30 36 30 31 32 26010131Z..06012 00a0 - 35 30 31 30 31 33 31 5a-30 5a 31 0b 30 09 06 03 5010131Z0Z1.0... 00b0 - 55 04 06 13 02 70 74 31-0e 30 0c 06 03 55 04 08 U....pt1.0...U.. 00c0 - 13 05 45 76 6f 72 61 31-0e 30 0c 06 03 55 04 07 ..Xxxxx1.0...U.. 00d0 - 13 05 45 76 6f 72 61 31-0d 30 0b 06 03 55 04 0a ..Xxxxx1.0...U.. 00e0 - 13 04 4e 65 65 69 31 0d-30 0b 06 03 55 04 0b 13 ..Xxxx1.0...U... 00f0 - 04 4e 65 65 69 31 0d 30-0b 06 03 55 04 03 13 04 .Xxxx1.0...U.... 0100 - 4e 65 65 69 30 81 9f 30-0d 06 09 2a 86 48 86 f7 Xxxx0..0...*.H.. 0110 - 0d 01 01 01 05 00 03 81-8d 00 30 81 89 02 81 81 ..........0..... 0120 - 00 9e e7 9f f2 de 73 9e-79 d5 76 4c d9 83 63 94 ......s.y.vL..c. 0130 - 53 12 e8 8d 73 43 9d 09-b1 48 d6 69 05 5d 31 1d S...sC...H.i.]1. 0140 - 24 a7 bd d6 8f a0 79 4a-1c 73 dc 78 75 9b 66 0b $.....yJ.s.xu.f. 0150 - dc 0b 27 a2 fe 4f 4a 0b-67 77 d4 96 34 c8 81 3f ..'..OJ.gw..4..? 0160 - 4a 6d a6 50 f5 6a f0 fa-53 f8 ed ba f7 51 c5 27 Jm.P.j..S....Q.' 0170 - 71 77 cf cb 95 85 83 f8-a2 c0 2b 0a c2 56 b9 6e qw........+..V.n 0180 - d1 fa e4 1a 72 a0 58 6a-41 99 ba 5e 3c 75 0c 97 ....r.XjA..^<u.. 0190 - 0f 67 e2 93 a5 48 b1 1a-18 9c 22 cf 41 2b 75 ec .g...H....".A+u. 01a0 - 05 02 03 01 00 01 30 0d-06 09 2a 86 48 86 f7 0d ......0...*.H... 01b0 - 01 01 04 05 00 03 81 81-00 8c ef 64 ef d0 62 8d ...........d..b. 01c0 - c5 77 68 00 28 d5 c6 18-d0 c8 17 d2 c4 9a 65 40 .wh.(.........e@ 01d0 - 4c 7b c8 bb 5d 5b 03 af-db e6 00 c7 3f 5a a0 a2 L{..][......?Z.. 01e0 - d5 90 bc eb 77 c2 87 88-e2 6a 25 09 c9 f6 3c 47 ....w....j%...<G 01f0 - 25 b2 85 90 d3 a2 a2 51-52 26 7a 50 b3 f4 e3 a2 %......QR&zP.... 0200 - 97 b9 ea bd 31 19 5b c8-70 bc c3 01 8e ea 0b a2 ....1.[.p....... 0210 - d5 5b 60 64 cd 65 37 60-63 94 8d 8f 72 4a d3 4f .[`d.e7`c...rJ.O 0220 - 0a a3 be c8 b4 f0 fa 60-83 b2 30 f5 59 47 45 2e .......`..0.YGE. 0230 - 50 a2 2f 17 52 0c d9 23-d1 P./.R..#. depth=0 /C=pt/ST=Xxxxx/L=Xxxxx/O=Xxxx/OU=Xxxx/CN=Xxxx verify error:num=18:self signed certificate verify return:1 depth=0 /C=pt/ST=Xxxxx/L=Xxxxx/O=Xxxx/OU=Xxxx/CN=Xxxx verify return:1 SSL_connect:SSLv3 read server certificate A read from 080A6E20 [080AC3C8] (5 bytes => 5 (0x5)) 0000 - 16 03 01 00 04 ..... read from 080A6E20 [080AC3CD] (4 bytes => 4 (0x4)) 0000 - 0e . 0004 - <SPACES/NULS> SSL_connect:SSLv3 read server done A write to 080A6E20 [080B6640] (139 bytes => 139 (0x8B)) 0000 - 16 03 01 00 86 10 00 00-82 00 80 65 51 68 44 44 ...........eQhDD 0010 - 2e 50 99 2d 01 7b 10 39-93 94 8e 9d 0d 80 bf b8 .P.-.{.9........ 0020 - fd 55 11 35 a2 3c 9d 66-cd bb 0e 91 32 fe c6 b9 .U.5.<.f....2... 0030 - 86 2c 21 6c af ba c5 ac-08 2a 17 4a a8 97 5c b5 .,!l.....*.J..\. 0040 - e4 36 ed a0 a3 0b ab c4-19 61 c3 fc 17 cf b3 7f .6.......a...... 0050 - 5b f3 8b bc 8f e5 e4 fd-88 5c 83 da 61 1f a3 4b [........\..a..K 0060 - df 00 37 61 31 8f 50 fe-72 8b 72 8d 48 bf 2f 3b ..7a1.P.r.r.H./; 0070 - 10 fc 3b cf 5a 61 4a 51-ab e4 76 54 57 5e d6 4d ..;.ZaJQ..vTW^.M 0080 - 9a c2 a7 9f fc 5c f8 0d-55 40 bb .....\..U@. SSL_connect:SSLv3 write client key exchange A write to 080A6E20 [080B6640] (6 bytes => 6 (0x6)) 0000 - 14 03 01 00 01 01 ...... SSL_connect:SSLv3 write change cipher spec A write to 080A6E20 [080B6640] (53 bytes => 53 (0x35)) 0000 - 16 03 01 00 30 fe 84 71-85 05 57 bf bc 74 1f 55 ....0..q..W..t.U 0010 - db 54 8f eb 38 a8 d4 fe-1d 24 a9 4e d1 65 6b 6a .T..8....$.N.ekj 0020 - e1 c8 47 57 1f 64 80 1e-7a af a0 9b fd 6e 1c 0b ..GW.d..z....n.. 0030 - 0c a7 a6 3e 30 ...>0 SSL_connect:SSLv3 write finished A SSL_connect:SSLv3 flush data read from 080A6E20 [080AC3C8] (5 bytes => 5 (0x5)) 0000 - 14 03 01 00 01 ..... read from 080A6E20 [080AC3CD] (1 bytes => 1 (0x1)) 0000 - 01 . read from 080A6E20 [080AC3C8] (5 bytes => 5 (0x5)) 0000 - 16 03 01 00 30 ....0 read from 080A6E20 [080AC3CD] (48 bytes => 48 (0x30)) 0000 - ef 6b 5b 33 44 bb 18 4a-a4 e5 95 07 cf 17 d2 4c .k[3D..J.......L 0010 - b2 c0 10 59 68 4b aa a4-96 a7 e7 9c 0c bd ae 80 ...YhK.......... 0020 - 38 fb 08 ec 28 2c 51 15-26 fe 44 3f c8 31 f7 99 8...(,Q.&.D?.1.. SSL_connect:SSLv3 read finished A --- Certificate chain 0 s:/C=pt/ST=Xxxxx/L=Xxxxx/O=Xxxx/OU=Xxxx/CN=Xxxx i:/C=pt/ST=Xxxxx/L=Xxxxx/O=Xxxx/OU=Xxxx/CN=Xxxx --- Server certificate -----BEGIN CERTIFICATE----- MIICKzCCAZQCCQDrc9AkQvGjNjANBgkqhkiG9w0BAQQFADBaMQswCQYDVQQGEwJw dDEOMAwGA1UECBMFRXZvcmExDjAMBgNVBAcTBUV2b3JhMQ0wCwYDVQQKEwROZWVp MQ0wCwYDVQQLEwROZWVpMQ0wCwYDVQQDEwROZWVpMB4XDTA1MTIyNjAxMDEzMVoX DTA2MDEyNTAxMDEzMVowWjELMAkGA1UEBhMCcHQxDjAMBgNVBAgTBUV2b3JhMQ4w DAYDVQQHEwVFdm9yYTENMAsGA1UEChMETmVlaTENMAsGA1UECxMETmVlaTENMAsG A1UEAxMETmVlaTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAnuef8t5znnnV dkzZg2OUUxLojXNDnQmxSNZpBV0xHSSnvdaPoHlKHHPceHWbZgvcCyei/k9KC2d3 1JY0yIE/Sm2mUPVq8PpT+O2691HFJ3F3z8uVhYP4osArCsJWuW7R+uQacqBYakGZ ul48dQyXD2fik6VIsRoYnCLPQSt17AUCAwEAATANBgkqhkiG9w0BAQQFAAOBgQCM 72Tv0GKNxXdoACjVxhjQyBfSxJplQEx7yLtdWwOv2+YAxz9aoKLVkLzrd8KHiOJq JQnJ9jxHJbKFkNOiolFSJnpQs/Tjope56r0xGVvIcLzDAY7qC6LVW2BkzWU3YGOU jY9yStNPCqO+yLTw+mCDsjD1WUdFLlCiLxdSDNkj0Q== -----END CERTIFICATE----- subject=/C=pt/ST=Xxxxx/L=Xxxxx/O=Xxxx/OU=Xxxx/CN=Xxxx issuer=/C=pt/ST=Xxxxx/L=Xxxxx/O=Xxxx/OU=Xxxx/CN=Xxxx --- No client certificate CA names sent --- SSL handshake has read 721 bytes and written 346 bytes --- New, TLSv1/SSLv3, Cipher is AES256-SHA Server public key is 1024 bit SSL-Session: Protocol : TLSv1 Cipher : AES256-SHA Session-ID: C3777B355B05DA220F14470021E396D85B57045DB17560FA726249192A0D12AF Session-ID-ctx: Master-Key: 89A9BC55E2B4700DDA80F799A1B5B958CAF9BFEF8970921A7158CB6EFE3F352693B500BA258CA508B3B2A25517941FD6 Key-Arg : None Start Time: 1135779714 Timeout : 300 (sec) Verify return code: 18 (self signed certificate) --- read from 080A6E20 [080AC3C8] (5 bytes => -1 (0xFFFFFFFF)) read:errno=104 write to 080A6E20 [080B0BD8] (37 bytes => -1 (0xFFFFFFFF)) configs: inetd.conf: pop3s stream tcp nowait root /usr/local/sbin/stunnel stunnel /etc/stunnel/pop3s.conf pop3s.conf: exec = /usr/sbin/popa3d execargs = popa3d output = /var/log/stunnel.log debug = 7 cert = /etc/stunnel/stunnel.pem Versions: OpenSSL 0.9.7g 11 Apr 2005 stunnel: stunnel 4.11 on i386-unknown-openbsd3.8 PTHREAD+POLL+IPv6+LIBWRAP with OpenSSL 0.9.7g 11 Apr 2005 Global options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /etc/stunnel/stunnel.pem pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/arandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds $ uname -a OpenBSD xxx.xxx.xxx.xxx 3.8 GENERIC#138 i386 Thanks in advance for helping me =) Pedro Gouveia

1 0

stunnel connect success even if remote side do not exist
by Nadav, Erez 28 Dec '05

28 Dec '05

i have a question: I conbfigure the stunnel to work as tcp wrapper. I configure stunnel for accept on 2003 and connect to 10.1.1.1:2003 (not exist address). I see that any TCP connect to 2003 always succeed. I expect that the TCP connect will fail if the remote side connection failed. Is there a way to make it happen Nadav Erez R&D Verint Systems Inc Phone: +972+9-9624753 Cellular: +972-54-7784753 Email: Erez.Nadav(a)verint.com Web: www.verint.com <http://www.verint.com/> __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

2 1

online stunnel configuration
by Nadav, Erez 26 Dec '05

26 Dec '05

hi, i have a question: How can i change the stunnel service configuration (add/change accept/connect values) without stop and start the stunnel service ? Nadav Erez R&D Verint Systems Inc Phone: +972+9-9624753 Cellular: +972-54-7784753 Email: Erez.Nadav(a)verint.com Web: www.verint.com <http://www.verint.com/> __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

1 0

(Other) client to stunnel server 4.14
by Jurgen Tessers 24 Dec '05

24 Dec '05

Hi all, I'm in a situation where Biztalk has to communicatie through Stunnel with a broker on a other site (both on Win XP). Now the only way to reach this broker is through a proxy, and that seems the problem with Stunnel, you can't configure a proxy. Is there another way, or another client that have the possibility to configure a proxy and can connect to a Stunnel server. With regards, Jurgen

1 0

Transparency issues
by Alaric Dailey 16 Dec '05

16 Dec '05

I am trying to run stunnel on my linux machine every works fine, until I set transparent = yes then stunnel doesn't work at all, I am running stunnel 4.09 on a debian sarge box, can anyone offer a suggestion?

1 0

Can not estabilish stunnel
by McDouglas 13 Dec '05

13 Dec '05

Hi, I have difficulties setting up a tunnel between two linux box I administrate. Right now its only in test phase, i would like to make an stunnel connection to the smpt server at 195.56.52.140. My final goal is to set up syslog through stunnel, thats why the port name/numbers. Config file for the server: cert = /usr/local/etc/stunnel/stunnel.pem pid = /usr/local/etc/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /usr/local/etc/stunnel/stunnel.log [ssyslog] accept = 195.56.52.140:2514 connect = 10.10.2.1:25 Config file for the client: cert = /usr/local/etc/stunnel/stunnel.pem pid = /usr/local/etc/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /usr/local/etc/stunnel/stunnel.log client = yes [ssyslog] accept = 2514 connect = 195.56.52.140:2514 I get the following messages in the logs after, executing a "telnet 127.0.0.1 2514" command at the client machine (of course, smtp works on the other side, and i set iptables to allow incomming connections on 2514 dport) Server: 2005.12.13 09:09:22 LOG5[11505:1]: stunnel 4.14 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7e 25 Oct 2004 2005.12.13 09:09:22 LOG7[11505:1]: Snagged 64 random bytes from /root/.rnd 2005.12.13 09:09:22 LOG7[11505:1]: Wrote 1024 new random bytes to /root/.rnd 2005.12.13 09:09:22 LOG7[11505:1]: RAND_status claims sufficient entropy for the PRNG 2005.12.13 09:09:22 LOG6[11505:1]: PRNG seeded successfully 2005.12.13 09:09:22 LOG7[11505:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2005.12.13 09:09:22 LOG7[11505:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2005.12.13 09:09:22 LOG6[11505:1]: file ulimit = 1024 (can be changed with 'ulimit -n') 2005.12.13 09:09:22 LOG6[11505:1]: poll() used - no FD_SETSIZE limit for file descriptors 2005.12.13 09:09:22 LOG5[11505:1]: 500 clients allowed 2005.12.13 09:09:22 LOG7[11505:1]: FD 6 in non-blocking mode 2005.12.13 09:09:22 LOG7[11505:1]: FD 8 in non-blocking mode 2005.12.13 09:09:22 LOG7[11505:1]: FD 9 in non-blocking mode 2005.12.13 09:09:22 LOG7[11505:1]: SO_REUSEADDR option set on accept socket 2005.12.13 09:09:22 LOG7[11505:1]: ssyslog bound to 195.56.52.140:2514 2005.12.13 09:09:22 LOG7[11506:1]: Created pid file /usr/local/etc/stunnel/stunnel.pid 2005.12.13 09:09:22 LOG7[11506:0]: Waiting -1 second(s) for 2 file descriptor(s) 2005.12.13 09:11:23 LOG7[11506:0]: CONTEXT 1, FD=6, (IN)->() 2005.12.13 09:11:23 LOG7[11506:0]: CONTEXT 1, FD=9, (IN)->(IN) 2005.12.13 09:11:23 LOG7[11506:1]: ssyslog accepted FD=10 from 81.183.222.1:35225 2005.12.13 09:11:23 LOG7[11506:1]: Creating a new context 2005.12.13 09:11:23 LOG7[11506:1]: Context 2 created 2005.12.13 09:11:23 LOG7[11506:2]: Context swap: 1 -> 2 2005.12.13 09:11:23 LOG7[11506:2]: ssyslog started 2005.12.13 09:11:23 LOG7[11506:2]: FD 10 in non-blocking mode 2005.12.13 09:11:23 LOG7[11506:2]: TCP_NODELAY option set on local socket 2005.12.13 09:11:23 LOG5[11506:2]: ssyslog connected from 81.183.222.1:35225 2005.12.13 09:11:23 LOG7[11506:2]: SSL state (accept): before/accept initialization 2005.12.13 09:11:23 LOG7[11506:0]: Waiting 300 second(s) for 3 file descriptor(s) 2005.12.13 09:11:23 LOG7[11506:0]: CONTEXT 1, FD=6, (IN)->() 2005.12.13 09:11:23 LOG7[11506:0]: CONTEXT 1, FD=9, (IN)->() 2005.12.13 09:11:23 LOG7[11506:0]: CONTEXT 2, FD=10, (IN)->(IN) 2005.12.13 09:11:23 LOG7[11506:2]: SSL state (accept): SSLv3 read client hello A 2005.12.13 09:11:23 LOG7[11506:2]: SSL state (accept): SSLv3 write server hello A 2005.12.13 09:11:23 LOG7[11506:2]: SSL state (accept): SSLv3 write certificate A 2005.12.13 09:11:23 LOG7[11506:2]: SSL state (accept): SSLv3 write server done A 2005.12.13 09:11:23 LOG7[11506:2]: SSL state (accept): SSLv3 flush data 2005.12.13 09:11:23 LOG7[11506:0]: Waiting 300 second(s) for 3 file descriptor(s) 2005.12.13 09:11:25 LOG7[11506:0]: CONTEXT 1, FD=6, (IN)->() 2005.12.13 09:11:25 LOG7[11506:0]: CONTEXT 1, FD=9, (IN)->() 2005.12.13 09:11:25 LOG7[11506:0]: CONTEXT 2, FD=10, (IN)->(IN) 2005.12.13 09:11:25 LOG7[11506:2]: SSL state (accept): SSLv3 read client key exchange A 2005.12.13 09:11:25 LOG7[11506:2]: SSL state (accept): SSLv3 read finished A 2005.12.13 09:11:25 LOG7[11506:2]: SSL state (accept): SSLv3 write change cipher spec A 2005.12.13 09:11:25 LOG7[11506:2]: SSL state (accept): SSLv3 write finished A 2005.12.13 09:11:25 LOG7[11506:2]: SSL state (accept): SSLv3 flush data 2005.12.13 09:11:25 LOG7[11506:2]: 1 items in the session cache 2005.12.13 09:11:25 LOG7[11506:2]: 0 client connects (SSL_connect()) 2005.12.13 09:11:25 LOG7[11506:2]: 0 client connects that finished 2005.12.13 09:11:25 LOG7[11506:2]: 0 client renegotiatations requested 2005.12.13 09:11:25 LOG7[11506:2]: 1 server connects (SSL_accept()) 2005.12.13 09:11:25 LOG7[11506:2]: 1 server connects that finished 2005.12.13 09:11:25 LOG7[11506:2]: 0 server renegotiatiations requested 2005.12.13 09:11:25 LOG7[11506:2]: 0 session cache hits 2005.12.13 09:11:25 LOG7[11506:2]: 0 session cache misses 2005.12.13 09:11:25 LOG7[11506:2]: 0 session cache timeouts 2005.12.13 09:11:25 LOG6[11506:2]: SSL accepted: new session negotiated 2005.12.13 09:11:25 LOG6[11506:2]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.12.13 09:11:25 LOG7[11506:2]: FD 11 in non-blocking mode 2005.12.13 09:11:25 LOG7[11506:2]: ssyslog connecting 10.10.2.1:25 2005.12.13 09:11:25 LOG7[11506:2]: connect_wait: waiting 10 seconds 2005.12.13 09:11:25 LOG7[11506:0]: Waiting 10 second(s) for 3 file descriptor(s) 2005.12.13 09:11:35 LOG7[11506:0]: CONTEXT 1, FD=6, (IN)->() 2005.12.13 09:11:35 LOG7[11506:0]: CONTEXT 1, FD=9, (IN)->() 2005.12.13 09:11:35 LOG7[11506:0]: CONTEXT 2, FD=11, (INOUT)->() 2005.12.13 09:11:35 LOG6[11506:2]: connect_wait: s_poll_wait timeout 2005.12.13 09:11:35 LOG3[11506:2]: Failed to initialize remote connection 2005.12.13 09:11:35 LOG7[11506:2]: ssyslog finished (0 left) 2005.12.13 09:11:35 LOG5[11506:2]: stack_info: size=65536, current=4204 (6%), maximum=4204 (6%) 2005.12.13 09:11:35 LOG7[11506:2]: Context 2 closed 2005.12.13 09:11:35 LOG7[11506:0]: Waiting -1 second(s) for 2 file descriptor(s) Client: 2005.12.13 09:05:26 LOG5[17901:1]: stunnel 4.14 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7 31 Dec 2002 2005.12.13 09:05:26 LOG7[17901:1]: Snagged 64 random bytes from /root/.rnd 2005.12.13 09:05:26 LOG7[17901:1]: Wrote 1024 new random bytes to /root/.rnd 2005.12.13 09:05:26 LOG7[17901:1]: RAND_status claims sufficient entropy for the PRNG 2005.12.13 09:05:26 LOG6[17901:1]: PRNG seeded successfully 2005.12.13 09:05:26 LOG7[17901:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2005.12.13 09:05:26 LOG7[17901:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2005.12.13 09:05:26 LOG6[17901:1]: file ulimit = 1024 (can be changed with 'ulimit -n') 2005.12.13 09:05:26 LOG6[17901:1]: poll() used - no FD_SETSIZE limit for file descriptors 2005.12.13 09:05:26 LOG5[17901:1]: 500 clients allowed 2005.12.13 09:05:26 LOG7[17901:1]: FD 5 in non-blocking mode 2005.12.13 09:05:26 LOG7[17901:1]: FD 7 in non-blocking mode 2005.12.13 09:05:26 LOG7[17901:1]: FD 8 in non-blocking mode 2005.12.13 09:05:26 LOG7[17901:1]: SO_REUSEADDR option set on accept socket 2005.12.13 09:05:26 LOG7[17901:1]: ssyslog bound to 0.0.0.0:2514 2005.12.13 09:05:26 LOG7[17902:1]: Created pid file /usr/local/etc/stunnel/stunnel.pid 2005.12.13 09:05:26 LOG7[17902:0]: Waiting -1 second(s) for 2 file descriptor(s) 2005.12.13 09:07:03 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->() 2005.12.13 09:07:03 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->(IN) 2005.12.13 09:07:03 LOG7[17902:1]: ssyslog accepted FD=9 from 127.0.0.1:40024 2005.12.13 09:07:03 LOG7[17902:1]: Creating a new context 2005.12.13 09:07:03 LOG7[17902:1]: Context 2 created 2005.12.13 09:07:03 LOG7[17902:2]: Context swap: 1 -> 2 2005.12.13 09:07:03 LOG7[17902:2]: ssyslog started 2005.12.13 09:07:03 LOG7[17902:2]: FD 9 in non-blocking mode 2005.12.13 09:07:03 LOG7[17902:2]: TCP_NODELAY option set on local socket 2005.12.13 09:07:03 LOG5[17902:2]: ssyslog connected from 127.0.0.1:40024 2005.12.13 09:07:03 LOG7[17902:2]: FD 10 in non-blocking mode 2005.12.13 09:07:03 LOG7[17902:2]: ssyslog connecting 195.56.52.140:2514 2005.12.13 09:07:03 LOG7[17902:2]: connect_wait: waiting 10 seconds 2005.12.13 09:07:03 LOG7[17902:0]: Waiting 10 second(s) for 3 file descriptor(s) 2005.12.13 09:07:03 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->() 2005.12.13 09:07:03 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->() 2005.12.13 09:07:03 LOG7[17902:0]: CONTEXT 2, FD=10, (INOUT)->(OUT) 2005.12.13 09:07:03 LOG7[17902:2]: connect_wait: connected 2005.12.13 09:07:03 LOG7[17902:2]: Remote FD=10 initialized 2005.12.13 09:07:03 LOG7[17902:2]: TCP_NODELAY option set on remote socket 2005.12.13 09:07:03 LOG7[17902:2]: SSL state (connect): before/connect initialization 2005.12.13 09:07:03 LOG7[17902:2]: SSL state (connect): SSLv3 write client hello A 2005.12.13 09:07:03 LOG7[17902:0]: Waiting 300 second(s) for 3 file descriptor(s) 2005.12.13 09:07:06 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->() 2005.12.13 09:07:06 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->() 2005.12.13 09:07:06 LOG7[17902:0]: CONTEXT 2, FD=10, (IN)->(IN) 2005.12.13 09:07:06 LOG7[17902:2]: SSL state (connect): SSLv3 read server hello A 2005.12.13 09:07:06 LOG7[17902:2]: SSL state (connect): SSLv3 read server certificate A 2005.12.13 09:07:06 LOG7[17902:2]: SSL state (connect): SSLv3 read server done A 2005.12.13 09:07:06 LOG7[17902:2]: SSL state (connect): SSLv3 write client key exchange A 2005.12.13 09:07:06 LOG7[17902:2]: SSL state (connect): SSLv3 write change cipher spec A 2005.12.13 09:07:06 LOG7[17902:2]: SSL state (connect): SSLv3 write finished A 2005.12.13 09:07:06 LOG7[17902:2]: SSL state (connect): SSLv3 flush data 2005.12.13 09:07:06 LOG7[17902:0]: Waiting 300 second(s) for 3 file descriptor(s) 2005.12.13 09:07:08 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->() 2005.12.13 09:07:08 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->() 2005.12.13 09:07:08 LOG7[17902:0]: CONTEXT 2, FD=10, (IN)->(IN) 2005.12.13 09:07:08 LOG7[17902:2]: SSL state (connect): SSLv3 read finished A 2005.12.13 09:07:08 LOG7[17902:2]: 1 items in the session cache 2005.12.13 09:07:08 LOG7[17902:2]: 1 client connects (SSL_connect()) 2005.12.13 09:07:08 LOG7[17902:2]: 1 client connects that finished 2005.12.13 09:07:08 LOG7[17902:2]: 0 client renegotiatations requested 2005.12.13 09:07:08 LOG7[17902:2]: 0 server connects (SSL_accept()) 2005.12.13 09:07:08 LOG7[17902:2]: 0 server connects that finished 2005.12.13 09:07:08 LOG7[17902:2]: 0 server renegotiatiations requested 2005.12.13 09:07:08 LOG7[17902:2]: 0 session cache hits 2005.12.13 09:07:08 LOG7[17902:2]: 0 session cache misses 2005.12.13 09:07:08 LOG7[17902:2]: 0 session cache timeouts 2005.12.13 09:07:08 LOG6[17902:2]: SSL connected: new session negotiated 2005.12.13 09:07:08 LOG6[17902:2]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.12.13 09:07:08 LOG7[17902:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.12.13 09:07:10 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->() 2005.12.13 09:07:10 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->() 2005.12.13 09:07:10 LOG7[17902:0]: CONTEXT 2, FD=9, (IN)->(IN) 2005.12.13 09:07:10 LOG7[17902:0]: CONTEXT 2, FD=10, (IN)->() 2005.12.13 09:07:10 LOG7[17902:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.12.13 09:07:10 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->() 2005.12.13 09:07:10 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->() 2005.12.13 09:07:10 LOG7[17902:0]: CONTEXT 2, FD=9, (IN)->() 2005.12.13 09:07:10 LOG7[17902:0]: CONTEXT 2, FD=10, (INOUT)->(OUT) 2005.12.13 09:07:10 LOG7[17902:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.12.13 09:07:11 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->() 2005.12.13 09:07:11 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->() 2005.12.13 09:07:11 LOG7[17902:0]: CONTEXT 2, FD=9, (IN)->(IN) 2005.12.13 09:07:11 LOG7[17902:0]: CONTEXT 2, FD=10, (IN)->() 2005.12.13 09:07:11 LOG7[17902:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.12.13 09:07:11 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->() 2005.12.13 09:07:11 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->() 2005.12.13 09:07:11 LOG7[17902:0]: CONTEXT 2, FD=9, (IN)->() 2005.12.13 09:07:11 LOG7[17902:0]: CONTEXT 2, FD=10, (INOUT)->(OUT) 2005.12.13 09:07:11 LOG7[17902:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.12.13 09:07:16 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->() 2005.12.13 09:07:16 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->() 2005.12.13 09:07:16 LOG7[17902:0]: CONTEXT 2, FD=9, (IN)->() 2005.12.13 09:07:16 LOG7[17902:0]: CONTEXT 2, FD=10, (IN)->(INERRHUP) 2005.12.13 09:07:16 LOG3[17902:2]: SSL_read: Connection reset by peer (104) 2005.12.13 09:07:16 LOG5[17902:2]: Connection reset: 4 bytes sent to SSL, 0 bytes sent to socket 2005.12.13 09:07:16 LOG7[17902:2]: ssyslog finished (0 left) 2005.12.13 09:07:16 LOG5[17902:2]: stack_info: size=65536, current=4180 (6%), maximum=4180 (6%) 2005.12.13 09:07:16 LOG7[17902:2]: Context 2 closed 2005.12.13 09:07:16 LOG7[17902:0]: Waiting -1 second(s) for 2 file descriptor(s) Strange thing, i did set up a windows box for testing, and i get the exact same error mesages when trying to connect to the server. Any ideas?

1 0

stunnel closing on first packet
by justin alexander 11 Dec '05

11 Dec '05

I have a client application on a windows machine, which tunnels through stunnel v4.14 to launch and inetd through stunnel v4.09 on a Linux box. The Linux side INETD successfully sends a packet of 25B to the client. The client (windows) receives this packet and returns a 12B packet. The packet IS received by the INETD but then stunnel immediately closes the socket. Why is it doing this? I'm including all configs and longs.

1 0

windows stunnel
by Noel Sanchez 09 Dec '05

09 Dec '05

Hello List. What I'd like to do is use stunnel on a Windows server behind the firewall then forward the data that comes in to the Windows server to another machine (another public ip behind the firewall) that's running an app that needs the original data. For example, I have a device out in the field that is using ssl to send data on port 4000 to my server in the office that has stunnel installed and listens on port 4000. Once the data is sent to the Windows server using stunnel, I'd like the Windows server to send the data to another computer that needs it but that doesn't have stunnel on it. The encryption will happen from the field device to the Windows server in the office, then that Windows server will have to forward the data to another computer that needs the data. I am at a lost on how to do this if at all possible. Any help would be great! Device using ssl out in the field sending data on port 4000---------firewall forwarding traffic from port 4000 to Windows server running stunnel behind firewall-----------Windows server receives stunnel data then forwards to another computer-------system that needs data---- Regards

1 0

Re: Windows config with both SSL listen and non-SSL listen
by Han Jun Li 08 Dec '05

08 Dec '05

Paul, This is a temporary solution but it works. What you need to do is run two instances of Stunnel--one instance configured in client mode and the other in server mode. If you want to run both as services, you can install the standard one with the "-install" switch. For the second instance, you need to use some other binary to install it with a different name and change the imagepath to point to the executable. /han >_____ > >From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] >On Behalf Of Paul Hethmon >Sent: Wednesday, December 07, 2005 2:50 PM >To: stunnel-users(a)mirt.net >Subject: [stunnel-users] Windows config with both SSL listen and >non-SSLlisten > > >I'm trying to set up using the Windows service the ability to listen in SSL >mode on one port (5102) and forward to non-SSL port (5010) and then also >listen on one port (5101) in non-SSL mode and forward to a remote port >(5102) in SSL mode. What I have currently in the config is: > >[inbound] >accept = 5102 >connect = 5010 > >[outbound] >accept = 5101 >connect = x.x.x.x:5102 > >The first STunnel example on the website talks about doing this, sort of, >but I don't see any options to specify on a service configuration level >whether the listen port is in SSL or non-SSL mode. The use of a service name >like [pop3] vs [pop3s] seems to imply a difference, but I've got a custom >application I'm trying to tunnel two way, not a standard IETF service. > >A perusal of the last year's mailing list archives didn't yield anything. I >guess the next step is to look at the source and see if it's supported >unless someone here can tell me one way or the other. If it's not supported, >I guess I'll add it in. > >thanks, > >Paul > > >Paul Hethmon >Senior Engineer >ClareityT Security >SAFEMLST Security Education, Consulting and Solutions >http://www.SAFEMLS.com <http://www.safemls.com/> >paul.hethmon(a)callclareity.com >work: 865.671.6630 >cell: 865.250.3517 > >

1 0

RE: [stunnel-users] Windows config with both SSL listen andnon-SSLlisten
by Paul Hethmon 07 Dec '05

07 Dec '05

Michal, Ok, the next obvious questions then: 1. When is 4.15 expected? 2. If not in the next 7 days, what can I do to help? I've done C/C++ and sockets for the last 10 years. I've looked at the code briefly so far, but have not set up a build environment yet. I need it in the next week so if there is any coding I can do which would help you, let me know your thoughts and where to put stuff. Also, just a public thanks for putting the package together. I started coding my own a couple of days ago and then thought there must have been someone else who just needed an SSL tunnel (and not a full blown SSH setup). Thanks, Paul -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Michal Trojnara Sent: Wednesday, December 07, 2005 9:03 AM To: stunnel-users(a)mirt.net Subject: RE: [stunnel-users] Windows config with both SSL listen andnon-SSLlisten Paul, This feature is going to be supported in the next release (4.15). Your config will look like this: [inbound] client = no accept = 5102 connect = 5010 [outbound] client = yes accept = 5101 connect = x.x.x.x:5102 Best regards, Mike ________________________________ From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Paul Hethmon Sent: Wednesday, December 07, 2005 2:50 PM To: stunnel-users(a)mirt.net Subject: [stunnel-users] Windows config with both SSL listen and non-SSLlisten I'm trying to set up using the Windows service the ability to listen in SSL mode on one port (5102) and forward to non-SSL port (5010) and then also listen on one port (5101) in non-SSL mode and forward to a remote port (5102) in SSL mode. What I have currently in the config is: [inbound] accept = 5102 connect = 5010 [outbound] accept = 5101 connect = x.x.x.x:5102 The first STunnel example on the website talks about doing this, sort of, but I don't see any options to specify on a service configuration level whether the listen port is in SSL or non-SSL mode. The use of a service name like [pop3] vs [pop3s] seems to imply a difference, but I've got a custom application I'm trying to tunnel two way, not a standard IETF service. A perusal of the last year's mailing list archives didn't yield anything. I guess the next step is to look at the source and see if it's supported unless someone here can tell me one way or the other. If it's not supported, I guess I'll add it in. thanks, Paul Paul Hethmon Senior Engineer ClareityT Security SAFEMLST Security Education, Consulting and Solutions http://www.SAFEMLS.com <http://www.safemls.com/> paul.hethmon(a)callclareity.com work: 865.671.6630 cell: 865.250.3517 _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

Windows config with both SSL listen and non-SSL listen
by Paul Hethmon 07 Dec '05

07 Dec '05

I'm trying to set up using the Windows service the ability to listen in SSL mode on one port (5102) and forward to non-SSL port (5010) and then also listen on one port (5101) in non-SSL mode and forward to a remote port (5102) in SSL mode. What I have currently in the config is: [inbound] accept = 5102 connect = 5010 [outbound] accept = 5101 connect = x.x.x.x:5102 The first STunnel example on the website talks about doing this, sort of, but I don't see any options to specify on a service configuration level whether the listen port is in SSL or non-SSL mode. The use of a service name like [pop3] vs [pop3s] seems to imply a difference, but I've got a custom application I'm trying to tunnel two way, not a standard IETF service. A perusal of the last year's mailing list archives didn't yield anything. I guess the next step is to look at the source and see if it's supported unless someone here can tell me one way or the other. If it's not supported, I guess I'll add it in. thanks, Paul Paul Hethmon Senior Engineer Clareity(tm) Security SAFEMLS(tm) Security Education, Consulting and Solutions http://www.SAFEMLS.com <http://www.safemls.com/> paul.hethmon(a)callclareity.com work: 865.671.6630 cell: 865.250.3517

2 1

stunnel install failure
by James.Bartkowicz＠bedbath.com 05 Dec '05

05 Dec '05

Pretty new to stunnel and not very familiar with compiling programs at all: 1. Description: Installation of stunnel 4.14 failing on a Solaris 9 box. #>make Making all in src /bin/bash ../libtool --tag=CC --mode=link gcc -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/local/ssl/include -o libstunnel.la -rpath /usr/local/lib -avoid-version env.lo -lz -ldl -lsocket -lnsl -L/usr/local/ssl/lib -lssl -lcrypto -lwrap gcc -shared -Wl,-h -Wl,libstunnel.so -o .libs/libstunnel.so .libs/env.o -lz -ldl -lsocket -lnsl -L/usr/local/ssl/lib -lssl -lcrypto -lwrap -lc ld: fatal: library -lwrap: not found ld: fatal: File processing errors. No output written to .libs/libstunnel.so collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `libstunnel.la' Current working directory /local1/home/stunnel/stunnel-4.14/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' ******************************************* James Bartkowicz Bed Bath & Beyond Server Administration Team - UNIX 908-688-0888 ext.4441 ******************************************* ------------------------------------------------------ CONFIDENTIALITY NOTICE: This e-mail, and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain confidential information. If you are not the intended recipient of this e-mail, you are hereby notified that any dissemination, distribution or copying of this e-mail, and any attachments thereto, is strictly prohibited. If you have received this e-mail in error, please permanently delete the original and any copy of any e-mail and any printout thereof. Thank you for your compliance.

2 1

Server connecting back to client?
by Joshua Kugler 02 Dec '05

02 Dec '05

I've looked through the man pages, FAQ's, examples, and found one post (without a reply: http://stunnel.mirt.net/pipermail/stunnel-users/2005-May/000487.html) about this, but still don't have my question answered. I have a machine outside the firewall (let's call it outThere) that needs to connect back to a machine inside the firewall (let's call in inHere) for backup procedures. Now, because of the firewall, outThere cannot connect to inHere, but inHere can connect to anything on outThere that it wants. Can I initiate an stunnel connection from inHere to outThere, and then have stunnel on outThere listen on a localhost port, which, when connected to, would actually forward the connection (over SSL) back to a configured port on inHere? Is this at all doable? j----- k----- -- Joshua Kugler CDE System Administrator http://distance.uaf.edu/

2 1