- stunnel-users - stunnel.org

Re: [stunnel-users] Problem with the client certificate
by Michael Renner 31 Dec '08

31 Dec '08

On Tuesday 30 December 2008, you wrote: > Hello, Happy new year! > * are the permissions correct on your files : > - key must belong to the user and have 0600 status (read only by the user) > - cert must belong to the user. I think the permissions are OK. The file is owed by root and loaded at the start Wrote 1024 new random bytes to /root/.rnd RAND_status claims sufficient entropy for the PRNG PRNG seeded successfully Certificate: /etc/stunnel/stunnelclient.pem Certificate loaded Key file: /etc/stunnel/stunnelclient.pem Private key loaded SSL context initialized for service BreakOut > * Is the content of the cert file of this form > > -----BEGIN CERTIFICATE----- > certificate data here > -----END CERTIFICATE----- > ? > and the content of the key file this form > -----BEGIN RSA PRIVATE KEY----- > key datat here > -----END RSA PRIVATE KEY----- I made several files. According to http://www.stunnel.org/faq/certs.html#ToC5 I got a file with a certificate, a RSA Key and a DH section (I removed the password for the certificate). According to http://www.stunnel.org/examples/client_cert.html I got a different file: it has a certificate and a RSA section and between them an other section: rcnyy/AbS1YPkdggJSnw+fqzg/L/QvQB6GTT5KWJzd0= -----END RSA PRIVATE KEY----- Certificate: Data: Version: 3 (0x2) Serial Number: 5 (0x5) Signature Algorithm: sha1WithRSAEncryption Issuer: C=DE, ST=Germany, L=Munich, O=vbox4php, OU=Rektorat, CN=DE/emailAddress=michael.renner(a)gmx.de Validity Not Before: Dec 28 20:37:19 2008 GMT Not After : Dec 28 20:37:19 2009 GMT Subject: C=DE, ST=Germany, O=vbox4php, OU=stunnel, CN=boulder.vbox4php.org/[email protected] Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): 00:b1:05:47:7a:27:4f:19:2b:18:72:e3:3c:f6:a6: . . 2b:55:2d:c9:dc:96:55:14:bb Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Cert Type: SSL Server Netscape Comment: TinyCA Generated Certificate X509v3 Subject Key Identifier: 86:F6:1F:71:29:AA:A5:61:DF:B2:81:F2:34:3A:A6:9E:58:C8:6A:5E X509v3 Authority Key Identifier: keyid:72:68:1A:0C:9D:E9:93:81:07:E9:36:71:75:33:05:C6:70:35:01:BF DirName:/C=DE/ST=Germany/L=Munich/O=vbox4php/OU=Rektorat/CN=DE/[email protected] serial:BC:97:82:4E:E3:9F:FE:5A X509v3 Issuer Alternative Name: email:[email protected] X509v3 Subject Alternative Name: email:[email protected] Signature Algorithm: sha1WithRSAEncryption 49:ef:06:aa:e5:71:b1:6e:23:87:02:9d:ce:56:e1:3b:77:5a: . . 41:93:92:ee:57:23:95:f3:99:62:27:6a:a4:b7:85:b4:92:86: 22:50:79:a0 -----BEGIN CERTIFICATE----- Anyhow: it fails: 2008.12.31 17:51:07 LOG4[13056:1073809760]: VERIFY ERROR: depth=0, error=unable to get local issuer certificate: /C=DE/ST=Germany/O=vbox4php/OU=stunnel/CN=boulder.vbox4php.org/emailAddress=michael.renner(a)gmx.de 2008.12.31 17:51:07 LOG3[13056:1073809760]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned With strace I can see the the key and the cert is OK on the client side: (I assume that it is only read once): [pid 11829] open("/etc/stunnel/stunnelserver.pem", O_RDONLY) = 4 [pid 11829] fstat(4, {st_mode=S_IFREG|0600, st_size=5521, ...}) = 0 [pid 11829] mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE| MAP_ANONYMOUS, -1, 0) = 0x7f8f5f13b000 [pid 11829] read(4, "-----BEGIN RSA PRIVATE KEY-----\n"..., 4096) = 4096 [pid 11829] read(4, "VQQDEwJERTEkMCIGCSqGSIb3\nDQEJARY"..., 4096) = 1425 [pid 11829] read(4, "", 4096) = 0 [pid 11829] close(4) = 0 [pid 11829] munmap(0x7f8f5f13b000, 4096) = 0 [pid 11829] write(2, "2008.12.31 17:52:56 LOG7[11829:1"..., 682008.12.31 17:52:56 LOG7[11829:140253752059616]: Certificate loaded ) = 68 [pid 11829] write(2, "2008.12.31 17:52:56 LOG7[11829:1"..., 902008.12.31 17:52:56 LOG7[11829:140253752059616]: Key file: /etc/stunnel/stunnelserver.pem ) = 90 [pid 11829] open("/etc/stunnel/stunnelserver.pem", O_RDONLY) = 4 [pid 11829] fstat(4, {st_mode=S_IFREG|0600, st_size=5521, ...}) = 0 [pid 11829] mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE| MAP_ANONYMOUS, -1, 0) = 0x7f8f5f13b000 [pid 11829] read(4, "-----BEGIN RSA PRIVATE KEY-----\n"..., 4096) = 4096 [pid 11829] close(4) = 0 [pid 11829] munmap(0x7f8f5f13b000, 4096) = 0 [pid 11829] write(2, "2008.12.31 17:52:56 LOG7[11829:1"..., 682008.12.31 17:52:56 LOG7[11829:140253752059616]: Private key loaded While I see in the clients logfile: SSL state (connect): SSLv3 flush data SSL alert (read): fatal: bad certificate SSL_connect: 14094412: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Strange! One more hint? -- |Michael Renner E-mail: michael.renner(a)gmx.de | |D-81541 Munich Germany ICQ: #112280325 | |Germany Don't drink as root! ESC:wq

1 1

Problem with the client certificate
by Michael Renner 27 Dec '08

27 Dec '08

Moin, it seems that I understood something wrong with stunnel client certificates. First of all: until now I run stunnel 4.18 and stunnel 4.21 with debian and kubuntu without client certificates (with success). I use it to reach a proprietary application through an untrusted network. Now, I want the clients to authenticate against the server. Therefor, as a quick and dirty test, I used the same stunnel.pem file at the server and at the client side. The configuration at the server side (where the application is waiting for connections, in this example it is just a script) looks like this: cert = /etc/stunnel/stunnel.pem #chroot = /var/run/stunnel/ pid = /tmp/stunnel.pid setuid = nobody setgid = nogroup output = /var/log/stunnel4.log exec = /root/stest.sh verify = 1 [BreakOut] accept = 192.168.0.1:443 Here is the configuration at the client side, where a browser establish a connection cert = /etc/stunnel/stunnel.pem key = /etc/stunnel/stunnel.pem sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 0 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [BreakOut] accept = 127.0.0.1:8080 connect = 192.168.0.1:443 First of all: is it right to set 'verify = 1' at the server side, and 'verify = 0' at the client side? It seems right to me, because the client should authenticate, but not the other way. Anyhow: As soon as a connection is opened using this configuration it will terminate at the same second. renner@mars:~$ telnet localhost 8080 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Connection closed by foreign host. In the clients logfile I see SSL state (connect): before/connect initialization SSL state (connect): SSLv3 write client hello A SSL state (connect): SSLv3 read server hello A VERIFY IGNORE: depth=0, /C=DE/ST=Germany/L=Munich/O=vbox4php/OU=stunnel/CN=boulder.vbox4php.org/emailAddress=michael.renner(a)gmx.de VERIFY OK: depth=0, /C=DE/ST=Germany/L=Munich/O=vbox4php/OU=stunnel/CN=boulder.vbox4php.org/emailAddress=michael.renner(a)gmx.de VERIFY IGNORE: depth=0, /C=DE/ST=Germany/L=Munich/O=vbox4php/OU=stunnel/CN=boulder.vbox4php.org/emailAddress=michael.renner(a)gmx.de VERIFY OK: depth=0, /C=DE/ST=Germany/L=Munich/O=vbox4php/OU=stunnel/CN=boulder.vbox4php.org/emailAddress=michael.renner(a)gmx.de SSL state (connect): SSLv3 read server certificate A SSL state (connect): SSLv3 read server certificate request A SSL state (connect): SSLv3 read server done A SSL state (connect): SSLv3 write client certificate A SSL state (connect): SSLv3 write client key exchange A SSL state (connect): SSLv3 write certificate verify A SSL state (connect): SSLv3 write change cipher spec A SSL state (connect): SSLv3 write finished A SSL state (connect): SSLv3 flush data SSL alert (read): fatal: bad certificate SSL_connect: 14094412: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket BreakOut finished (0 left) And, more interesting, at the server side: BreakOut connected from 84.57.55.105:57987 VERIFY ERROR: depth=0, error=self signed certificate: /C=DE/ST=Germany/L=Munich/O=vbox4php/OU=stunnel/CN=boulder.vbox4php.org/emailAddress=michael.renner(a)gmx.de SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Is something wrong with my self signed certificate? In my first tests I used one that I made with tinyCA, an other was made according http://www.stunnel.org/faq/certs.html: * openssl req -new -x509 -days 365 -nodes -out stunnel.pem -keyout stunnel.pem * openssl gendh 512 >> stunnel.pem * openssl rsa -in stunnel.pem -out new.pem * edit new.pem, merge some parts with stunnel.pem and rename it Any hint? Thanks -- |Michael Renner E-mail: michael.renner(a)gmx.de | |D-81541 Munich Germany ICQ: #112280325 | |Germany Don't drink as root! ESC:wq

1 0

Windows binary kits on 64 bit 2003 server or 2008 server
by Rich Jordan 24 Dec '08

24 Dec '08

Sorry to sully the list with wintel questions, but I haven't been able to locate an answer, and without systems available to test the obvious method of finding out is not available. We're running Stunnel V4.26 on a windows 2003 32-bit server, communicating with several better platforms running Stunnel V4.20 and newer, no issues. One interested customer is running windows 2003 server, 64-bit, and plans on moving to win2008 server 64 bit in the not too distant future. I do not have access to either OS/system and they're reluctant to install without knowing ahead of time what might happen. I'm hoping someone has tried the current STunnel binary kit on either or both of those systems. Will the kit run on 64-bit windows 2003, and is it usable on windows 2008? If not is this a situation where a build from source on either/both of those windows systems will produce working code? I've also found a number of hits for reputed OpenSSL ports for 64 bit windows. Any particular ones known to be good? Thanks for any info. Rich Illuc ivi, illud feci

1 0

Re: [stunnel-users] Wrapping a CherryPy server?
by Lucas Burdick 19 Dec '08

19 Dec '08

Hmm, I guess I didn't send my previous followup to the list. After setting the log to output properly, I was able to troubleshoot my problem. The chroot directory was non-existent and therefore didn't allow my .pid to be created. I have created the directory and everything now works as it should. Thanks for the help. Sorry for the trouble. Lucas -----Original Message----- From: Michael Renner [mailto:[email protected]] Sent: December-19-08 11:07 AM To: stunnel-users(a)mirt.net; Lucas Burdick Subject: Re: [stunnel-users] Wrapping a CherryPy server? On Friday 19 December 2008, Lucas Burdick wrote: > Hi There, Moin, > I?m trying to encrypt a cherrypy web page that I?m serving up. The page > itself works just fine on port 80, but I can?t seem to get stunnel to wrap > it. I?m using 4.26 on CentOS 5.2. I?ve put in my stunnel.conf: [...] > I?ve also tried commenting out the above mentioned .conf entry. I get the > error that inetd mode needs a remote host or executable. I?m trying to run > in daemon mode but I don?t think I?m doing it right. > > Please help, or ask me questions, or tell me to elaborate or something. can you call stunnel using the forground option and check the logfile? start stunnel like this ... $ stunnel -D debug -f -o /var/log/stunnel.log ........ CU -- |Michael Renner E-mail: michael.renner(a)gmx.de | |D-81541 Munich Germany ICQ: #112280325 | |Germany Don't drink as root! ESC:wq

1 0

Log rotation patch
by Christophe Nanteuil 17 Dec '08

17 Dec '08

Hello, NB : I propose this patch in alpha version. It has been tested only on a Linux Mandriva. (in the alpha version, it's recommended to use it on logs you might loose). Why to use this patch ? One reason I have to restart periodically stunnel is to do log rotation. This patch allows log rotation while running stunnel by implementing it directly inside. Therefore, the established connections are not closed by log rotation. Patch to version : 4.26 (should work on earlier versions). Type : new feature Description : Log rotation inside stunnel How to use this patch ? 3 new options are added in config file (see manual) maxLogSize : maximum size of log file (output option in config file). If logs have to be added, a log rotation is initiated. maxLogFiles : how many log files you want to keep. Default 7. useLogCompression : specify if rotated log files kept must be compressed or not. (requires zlib to be set). Just recompile stunnel after applying patch in stunnel directory: patch -p1 < /path/to/stunnel-logrot-0.10a.patch Test results are welcomed. Regards -- Christophe Nanteuil

1 0

Re: [stunnel-users] Stunnel 4 failing to connect to gmail
by Alex Limberis 15 Dec '08

15 Dec '08

HI Asif, Unfortunately that is the way gmail works. It changes the from to the gmail address rather than the computer domain. Unfortunately, this mostly makes it useless if you are trying to use it as a smarthost. -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Asif Iqbal Sent: Monday, December 15, 2008 2:06 PM To: Scott Gifford Cc: stunnel-users(a)mirt.net; nullmailer(a)lists.untroubled.org Subject: Re: [stunnel-users] Stunnel 4 failing to connect to gmail On Mon, Dec 15, 2008 at 4:49 PM, Scott Gifford <sgifford(a)suspectclass.com> wrote: > "Asif Iqbal" <vadud3(a)gmail.com> writes: > > [...] > >> I said it too soon. It passed that bind error but it still failing in ssl. >> I am seeing `SSL alert (write): fatal: handshake failure' > > Hello again Asif, glad you decided to try out stunnel! Yep, as you suggested :-) > > Try using port 465 instead of 587. That worked! I were able to send an email and I did receive it. It says the email came from `vadud3(a)gmail.com' instead of the sender, which is me(a)myhomecomputer.domain I am using this in /etc/nullmailer/remotes file localhost smtp --port=25 --user=vadud3 --pass=s3cr3t > > It looks like Google's STARTTLS command requires an EHLO to be sent > first, which is a someqhat unusual requirement. I don't think stunnel > does that. Port 465 will start talking SSL directly, without > requiring SMTP commands first. > > Good luck! > > ----Scott. > -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] Cannot connect to SBC/yahoo to send (or telnet)
by Leandro Avila 12 Dec '08

12 Dec '08

Not sure if ranting will get you the kind of answer that you look for but it was certainly entertaining for me. Anyway... I agree, some times things can be a little frustraiting but I guess that depends on how much time on how much work you want to put into it. Sorry to hear you feel stupid. Everyone has to start from 0 at shome point and it takes time to get a good handle to how things work. The question is... do you really want to know how things work or just want them to work without having to do much? A google search of "SSL Explained" http://wildbill.nulldevice.net/presentations/sslpreso/ I liked slide 11/35 nice little diagram of SSL handshake wich helps to visualize in very general terms how an SSL connection works. The rest of the slides are good too check them out! In your particular case that forced you to change from plain-text to SSL connections to your mail server. You had a couple of options. - First and most obvious is to use SSL support build into your mail client (Thunderbird, Outlook,etc) most if not all modern mail clients support SSL natively. No need for stunnel there. - If your mail client does not support SSL then stunnel is the way to go. But your issue is on how stunnel is being used. As client. When you are a client... you always want to verify your server. You want to make sure you are connected to the right server. You want to use verify=2 in stunnel.conf How do we verify that the server I just connected is in fact the right server? That is the Certificate Authority's job. We ultimately have to trust the CA they issued the certificate for the server owner. They signed the certificate with their key. and we use the CA's certificate to verify that signature. Here is the catch... operating systems, and some programs are shipped with a prebuild collection of CA certificates. Unfortunatelly stunnel does not. However, most CAs let you download their certificates for your own use. In your particular case, looks like the server you are connecting to uses a certificate issued by Equifax Secure Certificate Authority Here they have the download page for the CA Certificates. http://www.geotrust.com/resources/root-certificates/ You pointed out that they refuse connections if the client presents a certificate. Yes, that is somehow a common practice. Mutual authentication (both server and client send certificates to each other and verify them) is impractical in some cases. Thanks ----------------- Leandro Avila

1 0

Cannot connect to SBC/yahoo to send (or telnet)
by James Moe 05 Dec '08

05 Dec '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, (I sent this yesterday but that one seems to have gotten lost....) Stunnel v4.20. When connecting to SBC/Yahoo, the session is terminated with a "bad certificate" message. See the log below. The tech folks claim all is well at their end. Is there something I am missing here? Here is the conf file: ....[ conf ].... socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 client = yes output = G:/c/voice/pmmdev/testcase/bin/stunnel.log verify = 0 debug = 7 cert = g:/c/voice/pmmdev/testcase/bin/sma-test.pem [sbc] accept = localhost:6325 connect = smtp.att.yahoo.com:465 ....[ end conf ].... ....[ connection log ].... 2008.11.11 00:14:17 LOG7[223:1737]: sbc accepted FD=15 from 127.0.0.1:61053 2008.11.11 00:14:17 LOG7[223:1737]: Creating a new thread 2008.11.11 00:14:17 LOG7[223:1737]: New thread created 2008.11.11 00:14:17 LOG7[251:1737]: sbc started 2008.11.11 00:14:17 LOG7[251:1737]: FD 15 in non-blocking mode 2008.11.11 00:14:17 LOG7[251:1737]: TCP_NODELAY option set on local socket 2008.11.11 00:14:17 LOG5[251:1737]: sbc accepted connection from 127.0.0.1:61053 2008.11.11 00:14:17 LOG7[251:1737]: FD 16 in non-blocking mode 2008.11.11 00:14:17 LOG7[251:1737]: sbc connecting 69.147.64.31:465 2008.11.11 00:14:17 LOG7[251:1737]: connect_wait: waiting 10 seconds 2008.11.11 00:14:17 LOG7[251:1737]: connect_wait: connected 2008.11.11 00:14:17 LOG5[251:1737]: sbc connected remote server from 192.168.69.14:61054 2008.11.11 00:14:17 LOG7[251:1737]: Remote FD=16 initialized 2008.11.11 00:14:17 LOG7[251:1737]: TCP_NODELAY option set on remote socket 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): before/connect initialization 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 write client hello A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 read server hello A 2008.11.11 00:14:17 LOG5[251:1737]: VERIFY IGNORE: depth=0, /C=US/ST=California/L=Santa Clara/O=Yahoo! Inc./OU=Yahoo/CN=smtp.att.yahoo.com 2008.11.11 00:14:17 LOG5[251:1737]: VERIFY OK: depth=0, /C=US/ST=California/L=Santa Clara/O=Yahoo! Inc./OU=Yahoo/CN=smtp.att.yahoo.com 2008.11.11 00:14:17 LOG5[251:1737]: VERIFY IGNORE: depth=0, /C=US/ST=California/L=Santa Clara/O=Yahoo! Inc./OU=Yahoo/CN=smtp.att.yahoo.com 2008.11.11 00:14:17 LOG5[251:1737]: VERIFY OK: depth=0, /C=US/ST=California/L=Santa Clara/O=Yahoo! Inc./OU=Yahoo/CN=smtp.att.yahoo.com 2008.11.11 00:14:17 LOG5[251:1737]: VERIFY IGNORE: depth=0, /C=US/ST=California/L=Santa Clara/O=Yahoo! Inc./OU=Yahoo/CN=smtp.att.yahoo.com 2008.11.11 00:14:17 LOG5[251:1737]: VERIFY OK: depth=0, /C=US/ST=California/L=Santa Clara/O=Yahoo! Inc./OU=Yahoo/CN=smtp.att.yahoo.com 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 read server certificate A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 read server certificate request A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 read server done A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 write client certificate A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 write client key exchange A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 write certificate verify A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 write change cipher spec A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 write finished A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 flush data 2008.11.11 00:14:18 LOG7[251:1737]: SSL alert (read): fatal: bad certificate 2008.11.11 00:14:18 LOG3[251:1737]: SSL_connect: 14094412: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate 2008.11.11 00:14:18 LOG5[251:1737]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.11.11 00:14:18 LOG7[251:1737]: sbc finished (0 left) ....[ end log ].... - -- jimoe (at) sohnen-moe (dot) com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (OS/2) iD8DBQFJGe4zzTcr8Prq0ZMRAhSPAJ4h6YHyR+/W5brb7FK1tbbW1zYZ+wCglxpC 9k2qqpP2hN99BL0TnsNhlnw= =P74g -----END PGP SIGNATURE-----

6 7

Test, test. Hello?
by James Moe 05 Dec '08

05 Dec '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, I have not received a posting for several days. Has the list really gone that quiet? - -- jimoe (at) sohnen-moe (dot) com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (OS/2) iD4DBQFJOXHezTcr8Prq0ZMRAqqQAJ0aUC0ZyZC+85WF4WZN3nntQjfrxgCY/zjt 3Jlthcur9UTtXOnNkVcPFg== =scXZ -----END PGP SIGNATURE-----

1 0

Extending stunnels connect functionality
by bernhard.czech＠nobiscum.de 24 Nov '08

24 Nov '08

Hi all, we are looking for somebody to extend stunnel's multiple connect functionality a bit as of: - adding the ability to send a configurable string to each "connect" and compare the answer against an configured expectation string - the expectation should also be able to be interpreted as an regular expression. - the testing interval should be configurable - an alternative port should be configurable - it should be possible to call a script instead of doing a connection with the connect string provided as a parameter. - a way of monitoring might all paths might be good (i.e. writing a status file on regular basis) These things are pretty much the same things that LVS ( http://www.linuxvirtualserver.org/) provides. But we would like to reduce the complexity in our environment a bit. If somebody is interested to implement this feel free to contact me. If possible with an amount of expected reward. Kind regards, Bernhard Czech -- Bernhard Czech nobisCum Individual GmbH [T] +49 (0) 931 / 79 66 7-90 44 [F] +49 (0) 931 / 79 66 7-29 [M] +49 (0)175 / 90 51 45 8 [@] Bernhard.Czech(a)nobiscum.de [URL] www.nobiscum.de [Anschrift] Sedanstraße 23, 97082 Würzburg, Germany [Registergericht] Würzburg, HRB 5159 [Geschäftsführer] Markus Frisch, Hans-Peter Holl

1 0

Tunnel traffic from a network interface
by Kjetil Holien 23 Nov '08

23 Nov '08

Hi! Is it possible to capture traffic from one network interface on one computer, tunnel it to a second computer by stunnel and then send it through a network interface on that computer? This without changing any data on the network traffic (MAC adresses, IP etc). Thanks for any answers! greetings, Kjetil

1 0

Amount of FD's per connection
by Koornstra, Reinoud 21 Nov '08

21 Nov '08

Hi, I am using stunnel compiled to use threads. I read in the faq that a connection may use 1 to 4 fd's per connection. Normally this is only one, how can I influence this, I mean making sure there is one fd per connection? I also wish to limit the amount of max connections at the same time. Perhaps the most easy way is limit the amount of fd's per process with ulimit. However, depending on how many fd's are needed per connection it is difficult to set right now. Kind Regards, Reinoud.

2 2

xforwardedfor patch for 4.26?
by Chris Charman 19 Nov '08

19 Nov '08

Has anyone done such a thing? Alternately, are there good instructions someplace for setting up transparent proxy?

1 0

Re: [stunnel-users] Cannot connect to SBC/yahoo to send (or telnet)
by James Moe 19 Nov '08

19 Nov '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 11/19/08 03:20 am, kith walls wrote: > When connecting to SBC/Yahoo you need to front the session with HTTP. > I am not clear what you mean. Would you give an example? >> Hello, >> Stunnel v4.20. >> When connecting to SBC/Yahoo, the session is > terminated >> with a "bad certificate" message. See the > log below. The tech folks claim >> all is well at their end. >> Is there something I am missing here? >> Here is the conf file: > - -- jimoe (at) sohnen-moe (dot) com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (OS/2) iD8DBQFJJEsmzTcr8Prq0ZMRAjiTAJ9n/nZO2zaZemqvsU2Y1ge30OYdJQCeN3Oc Wj0dFPjjSH7qbV5d5L/F3ck= =ijQ0 -----END PGP SIGNATURE-----

1 0

Proxy support in configuration file?
by Reinier van der Gugten 19 Nov '08

19 Nov '08

Is there proxy support for Stunnel, and if so, how do I specify the proxy server in the configuration file? If it is not supported, can you give me a price estimate on what it would cost to add it? Greetings, Reinier. E.g. I want to connect to an external location at: Myserver.com:443 The proxy is at: CustomerProxy:8080 And my application runs at the customer talking to: localhost:1433 The proxy does not require authentication. Looking at the docuemtation you linked me I found this example: CONNECT server.example.com:80 HTTP/1.1 Host: server.example.com:80 Proxy-Authorization: basic aGVsbG86d29ybGQ= Using my addresses, where goes what? CONNECT CustomerProxy:8080 HTTP/1.1 Host: Myserver.com:443 // Proxy-Authorization: basic aGVsbG86d29ybGQ= Kind regards, Reinier -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Michal Trojnara Sent: vrijdag 14 november 2008 15:04 To: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Proxy support On Fri, 14 Nov 2008 14:53:20 +0100, "Reinier van der Gugten" <info(a)rgit.eu> wrote: > Has someone got a working version of STunnel that can handle a proxy? Do you mean client mode CONNECT protocol support (RFC 2817 section 5.2)? http://www.ietf.org/rfc/rfc2817.txt It's supported in stunnel since version 4.15 (released 2006.03.11). Best regards, Mike _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

stunnel and expiring CRLs
by Jason Haar 19 Nov '08

19 Nov '08

Hi there Is stunnel capable of re-reading updated CRLs on the fly? Without needing to be restarted? I have tried both CRLfile and CRLpath (with the hashes) with no luck. It appear stunnel only reads them on startup and never refers to them again? There also seems to be no option to send a HUP or the like to force a re-read - only a full restart will make stunnel re-read the CRLs. i.e. our system works after a fresh restart until the original CRL expires, and then stunnel starts rejecting new connections with "Found CRL is expired - revoking all certificates until you get updated CRL" - even though there have been several CRL file (and hash) updates in between. Restarting stunnel makes it start working again. I've googled around and see several other people have asked similar questions over the years, and there are references by Michal Trojnara that it should work? This is stunnel-4.14-2 under CentOS5 with openssl-0.9.8b-8.3.el5_0.2. No chroot jail Thanks! -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

4 5

Connection rejected: too many clients (>=500)?
by Chris Charman 18 Nov '08

18 Nov '08

Hey folks -- Can anyone tell me where the max number of clients is configured in 4.21? I'm running okay for a while, but then I end up with repeated messages as below in the logs: 2008.11.18 19:13:33 LOG7[26491:46912520933328]: https accepted FD=512 from xx.xx.xx.xx:xxxxx 2008.11.18 19:13:33 LOG4[26491:46912520933328]: Connection rejected: too many clients (>=500) 2008.11.18 19:13:33 LOG7[26491:46912520933328]: https accepted FD=512 from xx.xx.xx.xx:xxxxx 2008.11.18 19:13:33 LOG4[26491:46912520933328]: Connection rejected: too many clients (>=500) 2008.11.18 19:13:33 LOG7[26491:46912520933328]: https accepted FD=512 from xx.xx.xx.xx:xxxxx 2008.11.18 19:13:33 LOG4[26491:46912520933328]: Connection rejected: too many clients (>=500) [...] I've only seen reports of this problem, but no solution. Anyone out there who can help? Thanks in advance! -Chris ------------- Config below ----------------- ulimit unlimited stunnel -version stunnel 4.21 on x86_64-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none uname -a Linux domU-12-31-39-01-61-B2 2.6.21.7-2.fc8xen #1 SMP Fri Feb 15 12:34:28 EST 2008 x86_64 GNU/Linux stunnel -sockets Socket option defaults: Option Accept Local Remote OS default SO_DEBUG -- -- -- 0 SO_DONTROUTE -- -- -- 0 SO_KEEPALIVE -- -- -- 0 SO_LINGER -- -- -- 0:0 SO_OOBINLINE -- -- -- 0 SO_RCVBUF -- -- -- 87380 SO_SNDBUF -- -- -- 16384 SO_RCVLOWAT -- -- -- 1 SO_SNDLOWAT -- -- -- 1 SO_RCVTIMEO -- -- -- 0:0 SO_SNDTIMEO -- -- -- 0:0 SO_REUSEADDR 1 -- -- 0 SO_BINDTODEVICE -- -- -- -- IP_TOS -- -- -- 0 IP_TTL -- -- -- 64 TCP_NODELAY -- -- -- 0 gcc -v Using built-in specs. Target: x86_64-linux-gnu Configured with: ../src/configure -v --enable-languages=c,c++,fortran,objc,obj-c++,treelang --prefix=/usr --enable-shared --with-system-zlib --libexecdir=/usr/lib --without-included-gettext --enable-threads=posix --enable-nls --with-gxx-include-dir=/usr/include/c++/4.2 --program-suffix=-4.2 --enable-clocale=gnu --enable-libstdcxx-debug --enable-objc-gc --enable-mpfr --enable-checking=release --build=x86_64-linux-gnu --host=x86_64-linux-gnu --target=x86_64-linux-gnu Thread model: posix gcc version 4.2.3 (Ubuntu 4.2.3-2ubuntu7) openssl version OpenSSL 0.9.8g 19 Oct 2007

2 2

Re: [stunnel-users] Cannot connect to SBC/yahoo to send (or telnet)
by James Moe 18 Nov '08

18 Nov '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 11/18/08 10:17 am, James Moe wrote: > Hello, > Stunnel v4.20. > When connecting to SBC/Yahoo, the session is terminated > with a "bad certificate" message. See the log below. The tech folks claim > all is well at their end. > Is there something I am missing here? > Here is the conf file: > My apologies. I lost control of the email program and it sent this message here instead of to a local host. - -- jimoe (at) sohnen-moe (dot) com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (OS/2) iD8DBQFJIvmqzTcr8Prq0ZMRAsb2AJ9ROwt9FH4GpfyNWQ020rpGmC7K/wCdGhdW Bs96qyJjjXSA9d+AwVktAac= =+UNT -----END PGP SIGNATURE-----

1 0

Proxy support
by Reinier van der Gugten 18 Nov '08

18 Nov '08

Oops.. That's exactly what I meant... However What is the correct configuration in that case? E.g. I want to connect to an external location at: Myserver.com:443 The proxy is at: CustomerProxy:8080 And my application runs at the customer talking to: localhost:1433 The proxy does not require authentication. Looking at the docuemtation you linked me I found this example: CONNECT server.example.com:80 HTTP/1.1 Host: server.example.com:80 Proxy-Authorization: basic aGVsbG86d29ybGQ= Using my addresses, where goes what? CONNECT CustomerProxy:8080 HTTP/1.1 Host: Myserver.com:443 // Proxy-Authorization: basic aGVsbG86d29ybGQ= Kind regards, Reinier -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Michal Trojnara Sent: vrijdag 14 november 2008 15:04 To: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Proxy support On Fri, 14 Nov 2008 14:53:20 +0100, "Reinier van der Gugten" <info(a)rgit.eu> wrote: > Has someone got a working version of STunnel that can handle a proxy? Do you mean client mode CONNECT protocol support (RFC 2817 section 5.2)? http://www.ietf.org/rfc/rfc2817.txt It's supported in stunnel since version 4.15 (released 2006.03.11). Best regards, Mike _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 1

Re: [stunnel-users] Help - Getting stunnel compiled on windows and using a patch
by Reinier van der Gugten 14 Nov '08

14 Nov '08

Thanks so mucht for this information! I had to make the folowing changes as well: Set the Compile with common language runtime to: No common language runtime support for each .h file If I do that, the error: Command line error D8045: cannot compile C file 'src\client.c' with the /clr option disappears (Next I got an error in the resouce.rc file with the LTEXT VERSION... So I // that out) Next I get about 121 errors, like: Error LNK2001: unresolved external symbol _main ... symbol _num_clients etc. Any ideas? Kind regards, Reinier ________________________________ From: DMILE525 [mailto:[email protected]] Sent: donderdag 13 november 2008 23:23 To: Reinier van der Gugten Subject: Re: [stunnel-users] Help - Getting stunnel compiled on windows and using a patch on Windows: install Win32 OpenSSL http://www.slproweb.com/products/Win32OpenSSL.html <wlmailhtml:{86BCE398-B6B8-40AD-8A3D-BE759753A203}mid://00000009/!x-usc: http://www.slproweb.com/products/Win32OpenSSL.html> install VS2008 (I'm using free VS2008 C++ Express Edition http://www.microsoft.com/express/download/ <wlmailhtml:{86BCE398-B6B8-40AD-8A3D-BE759753A203}mid://00000009/!x-usc: http://www.microsoft.com/express/download/> ) The first thing to do (assuming a default installation of 'C:\OpenSSL') is to go to 'C:\OpenSSL\lib\VC' and copy all of the files to your Visual C++ 'lib' directory. This directory is sometimes located in a somewhat cryptic location such as 'C:\Program Files (x86)\Microsoft Visual Studio 9.0\VC\lib' or 'C:\Program Files\Microsoft Visual Studio 9.0\VC\lib'. Next, copy everything in the 'C:\OpenSSL\include' directory to your Visual C++ 'include' directory. create new empty project add to project: stunnel.c ssl.c ctx.c verify.c file.c client.c protocol.c sthreads.c log.c options.c network.c resolver.c gui.c common.h prototypes.h resources.h stunnel.ico resources.rc "Configuration properties -> Linker -> input -> additional properties" add wsock32.lib ssleay32.lib libeay32.lib "Configuration properties -> General -> character set" set "Use Multi-Byte Character Set" in common.h after #ifndef COMMON_H #define COMMON_H add #define USE_WIN32 #define _CRT_SECURE_NO_DEPRECATE #define _CRT_NONSTDC_NO_DEPRECATE //#define HAVE_GETADDRINFO //#define HAVE_GETNAMEINFO #ifndef _MBCS #define _MBCS #endif #define VERSION "4.26" #if defined _M_IX86 #pragma comment(linker, "/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*'\"") #elif defined _M_IA64 #pragma comment(linker, "/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='ia64' publicKeyToken='6595b64144ccf1df' language='*'\"") #elif defined _M_X64 #pragma comment(linker, "/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='amd64' publicKeyToken='6595b64144ccf1df' language='*'\"") #else #pragma comment(linker, "/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='*' publicKeyToken='6595b64144ccf1df' language='*'\"") #endif On Wed, Nov 12, 2008 at 6:50 PM, Reinier van der Gugten <info(a)rgit.eu> wrote: Hello, I am trying to compile STunnel. I'd rather not, but the pre-compiled version does not support a proxy server. So I hop you will be able to help me, or point me to a good howto on how to compile stunnel using windows and a patch from the patch-list. Or does someone have a compiled (windows) version with proxy support? If so, please mail it to me. Or tell me where to find more detailed information pls. - Next thing I will try is to install linux on a computer in order to try it that way... Greetings, Reinier. _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 2

Strange CRL verification behaviour
by Christophe Nanteuil 03 Nov '08

03 Nov '08

With stunnel 4.26 (or ealier), in order to verify revocation of clients' certificates, I use this configuration file : -------------------8<------------------ CAfile=/etc/ssl/stunnel/ca_certs.pem CRLfile=/etc/ssl/stunnel/crl.pem cert=/etc/ssl/stunnel/server.pem key=/etc/ssl/stunnel/server.key sslVersion=TLSv1 verify=2 [WEB] accept=8080 connect=127.0.0.1:3128 ------------------->8------------------ 1/ If there is no CRLfile when stunnel starts, stunnel dies and logs show "Failed to load /etc/ssl/stunnel/crl.pem revocation lookup file" -> ok. 2/ If the CRLfile is correct, stunnel starts. When the CRL expires, stunnel rejects any new connection. Logs then show : " Found CRL is expired - revoking all certificates until you get updated CRL" -> ok 3/ If the CRLfile is not a valid CRL, stunnel starts and ignores the CRLfile. Then, for any new connection, logs show "CRL: verification passed". -> NOT ok, IMO. examples of wrong CRLs : a CRL issued by an unknown CA or a certificate in the PEM format. This can happen when the CRL expires (soon) and the administrator puts a "new one" but misfits files. He then restarts stunnel, which works. This behaviour can be annoying because the logs of CRL are now in level 6 (INFO) and not any more in level 5 (NOTICE). My configuration was in debug=5 and logs showed only "CRL: verification passed", I could not determine what CRL was really used. I propose the attached patch to modify behaviour in case 3/, ie if no CRL corresponding to the issuer of each certificate of the chain is found : - reject connection if CRLdir or CRLfile was specified in the config file - accept connection but warn in logs if the use of CRL was not explicitly set in the config file. NB : the source code of function "crl_check" shows "/* based on BSD-style licensed code of mod_ssl */". I looked into the code of "mod_ssl-2.8.31-1.3.41" (file pkg.sslmod/ssl_engine_kernel.c, line 1601-1769) and there is actually the same behaviour. -- Christophe Nanteuil

1 0

Spawning a shell
by Tobias Dussa 29 Oct '08

29 Oct '08

Hi everybody, maybe I'm missing something real obvious here, but I can't figure out what's going wrong. I'm trying to make stunnel spawn a regular shell when it gets a connect. As far as I understand, the pty option should allocate a virtual tty, so I ought to be able to just exec() a shell. However, this won't work; apparently some more magic is required. I do get the basic interactive functionality to work (i. e., I can enter, say, ls and get back a directory listing), but the terminal won't work properly: Unwanted echoes (stty -echo doesn't help). Furthermore, for some reason stderr is not connected to the new pty but sticks to stunnel's original pty. I have tried spawning a shell directly from stunnel (with exec), spawning a script which redirects stdin/-out/-err to the proper pty, then execs a shell, spawning a script which execs login, spawning a script which execs getty. (The latter being closest to what I want, but not good enough.) I'm running out of ideas. Anyone ever did this? Any comments? (Incidentally, if anyone has a better idea how to create the possibility to log in with an X.509 certificate without using stunnel, I'm all ears.) I'm running stunnel4 on Debian etch: --- stunnel 4.18 on i486-pc-linux-gnu with OpenSSL 0.9.8c 05 Sep 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none --- Cheers, Toby. -- The nine most terrifying words in the English language are: I'm from the government and I'm here to help. ---Ronald Reagan

3 2

Thanks for solving my problem!
by editor 20 Oct '08

20 Oct '08

Hi: Thanks! I commented out the "Verify" option within the configuration file and restarted the application. I can use it POP3S & HTTPS with the Nokia & Sony-Ericsson mobiles fine now as well as Thunderbird. I will check with Outlook next. Window's mobile is complaining it can not create a SSL session however. I think it has to do with the public certificate I use in the mail host. Godaddy uses this two part public certificate and the Network Solutions is a single file. I am hoping in a new release of Stunnel, it can support a two part public certificate. Thanks again!!! Kevin > > > > > > ------------------------------ > > > > Message: 2 > > Date: Sun, 19 Oct 2008 21:17:29 -0700 (PDT) > > From: Algol Tradent <tradent(a)yahoo.com> > > Subject: Re: [stunnel-users] Version 4.26 and using to secure IMAPS & > > POP3 > > To: stunnel-users(a)mirt.net > > Message-ID: <710279.38955.qm(a)web62003.mail.re1.yahoo.com> > > Content-Type: text/plain; charset=us-ascii > > > > Hello, > > > > I think your problem is on your config file for the server. On your config file you have the following option > > > > # Authentication stuff > > verify = 3 > > > > You probably don't want this option set. Because you are asking the client and the server to authenticate each other based on certificates... which I don;t think is the case here. > > > > On your log file there is this line which is a good indicator of your problem. > > > > routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate > > > > I hope this helps > >

1 0

Version 4.26 and using to secure IMAPS & POP3
by Editor (Kevin) 20 Oct '08

20 Oct '08

Hi: I upgraded to the current 4.26 as I was having an issue with 4.15. The idea is to secure IMAP traffic as well as inbound SMTP. The email client is the latest Thunderbird and seems to be very stable. The mail Host is a Sun E-250 with current patches for Solaris 9. Note: I am using a public certificate and as it from "godaddy.com", it is this unusual two part certificate. This may be where the problem is as I had to combine the two public certificate files together (maybe the next version of STUNNEL could do this automatically so the risk of errors is reduced!). However, using STUNNEL, I am having an issue connecting as I get a strange error message and the connection dies. Error Log: 2008.10.19 13:10:41 LOG7[2104:1]: imaps accepted FD=0 from 80.38.96.194:4129 2008.10.19 13:10:41 LOG7[2104:3]: imaps started 2008.10.19 13:10:41 LOG7[2104:3]: FD 0 in non-blocking mode 2008.10.19 13:10:41 LOG7[2104:1]: Cleaning up the signal pipe 2008.10.19 13:10:41 LOG7[2104:3]: TCP_NODELAY option set on local socket 2008.10.19 13:10:41 LOG7[2104:3]: Waiting for a libwrap process 2008.10.19 13:10:41 LOG7[2104:3]: Acquired libwrap process #0 2008.10.19 13:10:41 LOG7[2104:1]: Cleaning up the signal pipe 2008.10.19 13:10:41 LOG7[2104:3]: Releasing libwrap process #0 2008.10.19 13:10:41 LOG7[2104:3]: Released libwrap process #0 2008.10.19 13:10:41 LOG7[2104:1]: Cleaning up the signal pipe 2008.10.19 13:10:41 LOG7[2104:3]: imaps permitted by libwrap from 80.38.96.194:4129 2008.10.19 13:10:41 LOG5[2104:3]: imaps accepted connection from 80.38.96.194:4129 2008.10.19 13:10:41 LOG7[2104:3]: SSL state (accept): before/accept initialization 2008.10.19 13:10:41 LOG7[2104:3]: SSL state (accept): SSLv3 read client hello A 2008.10.19 13:10:41 LOG7[2104:3]: SSL state (accept): SSLv3 write server hello A 2008.10.19 13:10:41 LOG7[2104:1]: Cleaning up the signal pipe 2008.10.19 13:10:41 LOG7[2104:3]: SSL state (accept): SSLv3 write certificate A 2008.10.19 13:10:41 LOG7[2104:3]: SSL state (accept): SSLv3 write certificate request A 2008.10.19 13:10:41 LOG7[2104:3]: SSL state (accept): SSLv3 flush data 2008.10.19 13:10:42 LOG7[2104:3]: SSL alert (read): warning: no certificate 2008.10.19 13:10:42 LOG7[2104:1]: Cleaning up the signal pipe 2008.10.19 13:10:42 LOG7[2104:3]: SSL alert (write): fatal: handshake failure 2008.10.19 13:10:42 LOG3[2104:3]: SSL_accept: 140890C7: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate 2008.10.19 13:10:42 LOG7[2104:1]: Cleaning up the signal pipe 2008.10.19 13:10:42 LOG5[2104:3]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.10.19 13:10:42 LOG7[2104:1]: Cleaning up the signal pipe 2008.10.19 13:10:42 LOG7[2104:3]: imaps finished (0 left) See the weird no client peer handshake???? The configuration file: # more /usr/local/etc/stunnel/stunnel.conf # stunnel configuration file # Use to provide ssl protection for https, pop3 and imap # # Setting up the root jail chroot = /usr/local/var/stunnel # # The PID is created inside chroot jail pid = /stunnel.pid setuid = nobody setgid = nogroup ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /usr/local/var/lib/stunnel/ setuid = nobody setgid = nogroup ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 # Authentication stuff verify = 3 # Certicates to use # cert = /usr/local/etc/stunnel/stunnel.pem CAfile = /usr/local/etc/stunnel/_.cellmail.com.crt # SSLCertificateChainFile = /usr/local/etc/stunnel/gd_intermediate_bundle.crt # Some debugging stuff debug = 7 output = /var/log/stunnel.log # Use it for client mode #client = yes # Service-level configuration [pop3s] accept = 199.4.110.39:995 connect = 110 [imaps] accept = 199.4.110.39:993 connect = 143 [ssmtp] accept = 199.4.110.39:465 connect = frog.cellmail.com:25 # TIMEOUTclose = 0 The startup log: 2008.10.19 13:02:50 LOG7[2077:1]: Snagged 64 random bytes from /export/home/kgreene/.rnd 2008.10.19 13:02:50 LOG7[2077:1]: Wrote 1024 new random bytes to /export/home/kgreene/.rnd 2008.10.19 13:02:50 LOG7[2077:1]: RAND_status claims sufficient entropy for the PRNG 2008.10.19 13:02:50 LOG7[2077:1]: PRNG seeded successfully 2008.10.19 13:02:50 LOG7[2077:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2008.10.19 13:02:50 LOG7[2077:1]: Certificate loaded 2008.10.19 13:02:50 LOG7[2077:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2008.10.19 13:02:50 LOG7[2077:1]: Private key loaded 2008.10.19 13:02:50 LOG7[2077:1]: Loaded verify certificates from /usr/local/etc/stunnel/_.cellmail.com.crt 2008.10.19 13:02:50 LOG7[2077:1]: Loaded /usr/local/etc/stunnel/_.cellmail.com.crt revocation lookup file 2008.10.19 13:02:50 LOG7[2077:1]: SSL context initialized for service pop3s 2008.10.19 13:02:50 LOG7[2077:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2008.10.19 13:02:50 LOG7[2077:1]: Certificate loaded 2008.10.19 13:02:50 LOG7[2077:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2008.10.19 13:02:50 LOG7[2077:1]: Private key loaded 2008.10.19 13:02:50 LOG7[2077:1]: Loaded verify certificates from /usr/local/etc/stunnel/_.cellmail.com.crt 2008.10.19 13:02:50 LOG7[2077:1]: Loaded /usr/local/etc/stunnel/_.cellmail.com.crt revocation lookup file 2008.10.19 13:02:50 LOG7[2077:1]: SSL context initialized for service imaps 2008.10.19 13:02:50 LOG7[2077:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2008.10.19 13:02:50 LOG7[2077:1]: Certificate loaded 2008.10.19 13:02:50 LOG7[2077:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2008.10.19 13:02:50 LOG7[2077:1]: Private key loaded 2008.10.19 13:02:50 LOG7[2077:1]: Loaded verify certificates from /usr/local/etc/stunnel/_.cellmail.com.crt 2008.10.19 13:02:50 LOG7[2077:1]: Loaded /usr/local/etc/stunnel/_.cellmail.com.crt revocation lookup file 2008.10.19 13:02:50 LOG7[2077:1]: SSL context initialized for service ssmtp 2008.10.19 13:02:50 LOG5[2077:1]: stunnel 4.26 on sparc-sun-solaris2.9 with OpenSSL 0.9.8h 28 May 2008 2008.10.19 13:02:50 LOG5[2077:1]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.10.19 13:02:50 LOG6[2077:1]: file ulimit = 256 (can be changed with 'ulimit -n') 2008.10.19 13:02:50 LOG6[2077:1]: poll() used - no FD_SETSIZE limit for file descriptors 2008.10.19 13:02:50 LOG5[2077:1]: 125 clients allowed 2008.10.19 13:02:50 LOG7[2077:1]: FD 11 in non-blocking mode 2008.10.19 13:02:50 LOG7[2077:1]: FD 12 in non-blocking mode 2008.10.19 13:02:50 LOG7[2077:1]: FD 13 in non-blocking mode 2008.10.19 13:02:50 LOG7[2077:1]: SO_REUSEADDR option set on accept socket 2008.10.19 13:02:50 LOG7[2077:1]: pop3s bound to 199.4.110.39:995 2008.10.19 13:02:50 LOG7[2077:1]: FD 14 in non-blocking mode 2008.10.19 13:02:50 LOG7[2077:1]: SO_REUSEADDR option set on accept socket 2008.10.19 13:02:50 LOG7[2077:1]: imaps bound to 199.4.110.39:993 2008.10.19 13:02:50 LOG7[2077:1]: FD 15 in non-blocking mode 2008.10.19 13:02:50 LOG7[2077:1]: SO_REUSEADDR option set on accept socket 2008.10.19 13:02:50 LOG7[2077:1]: ssmtp bound to 199.4.110.39:465 2008.10.19 13:02:50 LOG7[2083:1]: Created pid file /stunnel.pid 2008.10.19 13:02:50 LOG7[2083:1]: Cleaning up the signal pipe

2 1

forgeground=no with pppd and pty=yes?
by Sandeep Kumar 15 Oct '08

15 Oct '08

Hi, I want to encrypt pppd, but stunnel should start in background mode. But as soon as I set foreground=no, ppp is unable to connect. Is this not possible ? -- Sandeep Kumar http://students.iiit.ac.in/~sandeep_kr

1 0

Setting up a POP3 connection through stunnel?
by Ben Stover 13 Oct '08

13 Oct '08

Assume currently I retrieve my emails from my mailbox unencrypted with the following info: pop3.mydomain.com port=110 Now I want to switch to an encrypted POP3 mail connection. with the following information pop3.mydomain.com port=777 Can I simply write now in the conf file: [myownsetup] accept = 127.0.0.1:110 connect = pop3.mydomain.com:777 Is this sufficient? Ben

2 1

Question (new user!) how to get it to work? - SQL
by Reinier van der Gugten 10 Oct '08

10 Oct '08

Hi, I read most of the messages and tutorials, but still I do not seem to get it to work. I want to achieve the following: Client side: VB application communicating to a SQL server over port 1433. Server side: Lisning on port 1433 that is lisned to by SQL 2005. However this is not allowed evrywhere, so stunnel comes into play. Client side: VB application communicating to localhost on port 1433 Stunnel installed lisning on port 1433 and passing it on to port 80 (Note for later: I would like to use SSL, so it will pass through routers, But for the test it will suffice to keep it unencrypted. Also the server is still local and could be reached directly. But it should work fine for testing.) Server: Stunnel installed as service lisning on port 80 and transmitting it to port 1433 (later to be moved to 443, as I also run a HTTP server) The config file looks like this: ------------------------------------------------- Client: ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 ;output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [SQLServer] accept = 127.0.0.1:1433 connect = 10.12.18.10:80 ------------------------------------------------- Server: ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 ;output = stunnel.log ; Use it for client mode ;client = yes ; Service-level configuration [SQL] accept = 80 connect = localhost:1433 ------------------------------------------------- As you can see, I tried to keep as close to the example file as I could. Looking forward to getting this to work and then to including ssl... Kind regards, Reinier.

1 0

Stunnel 4.26 Not working
by natalie burdick 30 Sep '08

30 Sep '08

I just upgraded from Sony to IBM laptop, in doing so, I installed latest version of Stunnel for use with my pop email client. I am running Stunnel 4.26 on Windows XP Here is my stunnel log: 2008.09.29 20:48:44 LOG5[2568:4088]: stunnel 4.26 on x86-pc-mingw32-gnu with OpenSSL 0.9.8i 15 Sep 2008 2008.09.29 20:48:44 LOG5[2568:4088]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2008.09.29 20:48:44 LOG5[2568:1628]: No limit detected for the number of clients It was working until I upgraded to this version, now when I use my client to check or send email, it just says that it's connecting to the server but never actually does. I can provide my conf

2 2

set process name support in stunnel?
by Hank Leininger 28 Sep '08

28 Sep '08

Has anybody patched stunnel to modify its name in ps output, setproctitle-style, to tell more about itself? I'm thinking a config parameter "processname" which the user can specify in the service_name stanza (or just tack the service_name onto the end of the process title). I use stunnel mostly for ad-hoc client connections, or in a script to plug a perl script that knows how to fuzz IMAP, SMTP, etc into an SSL listener. For me the stunnel 3 command-line flag usage was ideal. But, I finally gave up and switched to using stunnel v4, usually piping a dynamically-generated config in on an fd. The downside with that is now instead of 'ps' showing useful, differentiating commandline flags for each stunnel process, I just have dozens of 'stunnel -fd 0's. It's possible to track down who's going where (netstat -antp, etc) but that's painful. Being able to set an arbitrary, meaningful-to-humans process name (or extra tag, etc) from config entries would resolve this, and might be useful for people with more conventional uses for stunnel. Thanks, -- Hank Leininger <hlein(a)korelogic.com> BE5D FCCA 673B D18B 98A9 3175 896E 3D4A 1B4D C5AC

1 0

Re: [stunnel-users] Stunnel License
by Bansal, Gaurav (Gaurav) 24 Sep '08

24 Sep '08

We are compiling stunnel source without any modification for different platform supported of our product. Then we are running stunnel as a standalone process after making changes to stunnel.conf file. In stunnel.conf file we are providing location of certificates and ports to be used We would distribute stunnel binary along with our product. Given the scenario I have mentioned do you foresee legal problems in usage of stunnel. I understand that OpenSSL uses OpenSSL license but I got this for openssl website. ==================================================== On many systems including the major Linux and BSD distributions, yes (the GPL does not place restrictions on using libraries that are part of the normal operating system distribution). On other systems, the situation is less clear. Some GPL software copyright holders claim that you infringe on their rights if you use OpenSSL with their software on operating systems that don't normally include OpenSSL. If you develop open source software that uses OpenSSL, you may find it useful to choose another license than the GPL, or state explicitly that "This program is released under the GPL with the additional exemption that compiling, linking, and/or using OpenSSL is allowed." If you are using GPL software developed by others, you may want to ask the copyright holder for permission to use their software with OpenSSL. ===================================================== Specifically I am concerned if Stunnel states that compiling, linking, and/or using OpenSSL is allowed Thanks Gaurav ________________________________ From: Bansal, Gaurav (Gaurav) Sent: Wednesday, September 24, 2008 5:27 PM To: 'webmaster(a)stunnel.org'; 'stunnel-users(a)mirt.net'; 'stunnel-users-owner(a)mirt.net'; 'Michal.Trojnara(a)mirt.net' Subject: Stunnel License Hi, We are planning to use Stunnel to encrypt traffic between Apache mod_jk and AJP connector of JBoss Tomcat. It seems that Stunnel uses OpenSSL APIs. Since Stunnel is available under GPL license, the license terms prevents us from using Stunnel in our product since it exposes OpenSSL which is also available under GPL license. I would like to know if there is also a commercial license available for stunnel? I would appreciate if you can throw pointers on how to package Stunnel with a commercial product. Thank Gaurav

2 1

Stunnel License
by Bansal, Gaurav (Gaurav) 24 Sep '08

24 Sep '08

Hi, We are planning to use Stunnel to encrypt traffic between Apache mod_jk and AJP connector of JBoss Tomcat. It seems that Stunnel uses OpenSSL APIs. Since Stunnel is available under GPL license, the license terms prevents us from using Stunnel in our product since it exposes OpenSSL which is also available under GPL license. I would like to know if there is also a commercial license available for stunnel? I would appreciate if you can throw pointers on how to package Stunnel with a commercial product. Thank Gaurav

1 0

Re: [stunnel-users] Compiled Stunnel 4.25 with OpenSSL 0.9.8h
by Nelgraine 22 Sep '08

22 Sep '08

Thanks for your reply. I’ve found out that Solaris 10 machine has default OpenSSL 0.9.7d located in /usr/local/ssl/bin. Update OpenSSL 0.9.8h using this command: ../config -fPIC shared no-idea threads make depend make make test make install But unfortunately the gcc link to old openssl 0.9.7d. How to update the link in gcc? Any help would be greatly appreciated. Thanks! Regards, Nelgraine --- On Sun, 9/21/08, stunnel-users-request(a)mirt.net <stunnel-users-request(a)mirt.net> wrote: > From: stunnel-users-request(a)mirt.net <stunnel-users-request(a)mirt.net> > Subject: stunnel-users Digest, Vol 50, Issue 15 > To: stunnel-users(a)mirt.net > Date: Sunday, September 21, 2008, 6:00 PM > Send stunnel-users mailing list submissions to > stunnel-users(a)mirt.net > > To subscribe or unsubscribe via the World Wide Web, visit > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body > 'help' to > stunnel-users-request(a)mirt.net > > You can reach the person managing the list at > stunnel-users-owner(a)mirt.net > > When replying, please edit your Subject line so it is more > specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. stunnel 4.26 released (Michal Trojnara) > 2. Re: Compiled Stunnel 4.25 with OpenSSL 0.9.8h > on Solaris 10 > (Michal Trojnara) > 3. stunnel 4.26 released (Michal Trojnara) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 20 Sep 2008 23:13:50 +0200 > From: Michal Trojnara <Michal.Trojnara(a)mobi-com.net> > Subject: [stunnel-users] stunnel 4.26 released > To: 'stunnel-users(a)mirt.net' > <stunnel-users(a)mirt.net>, > stunnel-announce(a)mirt.net, openssl-users(a)openssl.org > Message-ID: > <86cf5ffd468849a8dba392b1d3bc6bb3(a)mobi-com.net> > Content-Type: text/plain; charset=US-ASCII; format=flowed > > Dear Users, > > Version 4.26, 2008.09.20, urgency: MEDIUM: > * New features > - Win32 DLLs for OpenSSL 0.9.8i. > - /etc/hosts.allow and /etc/hosts.deny no longer need to > be copied to > the chrooted directory, as the libwrap processes are no > longer > chrooted. > - A more informative error messages for invalid port > number specified > in stunnel.conf file. > - Support for Microsoft Visual C++ 9.0 Express Edition. > * Bugfixes > - Killing all libwrap processes at stunnel shutdown > fixed. > - A minor bug in stunnel.init sample SysV startup file > fixed. > > Home page/download: http://stunnel.mirt.net/ > > sha1sum for stunnel-4.24.tar.gz file: > 1c9f5dd6b21f354c356cd9100899a90a83068c68 > > Best regards, > Mike > > > > ------------------------------ > > Message: 2 > Date: Sun, 21 Sep 2008 00:13:07 +0200 > From: Michal Trojnara <Michal.Trojnara(a)mobi-com.net> > Subject: Re: [stunnel-users] Compiled Stunnel 4.25 with > OpenSSL 0.9.8h > on Solaris 10 > To: 'stunnel-users(a)mirt.net' > <stunnel-users(a)mirt.net> > Message-ID: > <6cb62b05bc25b1da1f8992ceadb133d4(a)mobi-com.net> > Content-Type: text/plain; charset=US-ASCII; format=flowed > > On 2008-09-19, at 04:36, Nelgraine wrote: > > Undefined first referenced > > symbol in file > > BIO_set_flags protocol.o > > SSL_CTX_set_info_callback ctx.o > > ld: fatal: Symbol referencing errors. No output > written to stunnel > > Is it possible that your system has more than one copy of > the OpenSSL > libraries? > Maybe gcc tries to link against the old ones instead of the > new ones? > > > 1. Should I need to upgrade OpenSSL 0.9.8h into > OpenSSL 0.9.8i? > > I don't think this could cause your problem. > > > 2. I have installed openssl 0.9.8h on Solaris 10 and > created several > > ca certificates. > > - If I will upgrade OpenSSL 0.9.8h into OpenSSL > 0.9.8i, should I > > also recreate ca certificates? > > No, you don't have to recreate your certificates. > > Best regards, > Mike > > > > ------------------------------ > > Message: 3 > Date: Sat, 20 Sep 2008 23:13:50 +0200 > From: Michal Trojnara <Michal.Trojnara(a)mobi-com.net> > Subject: [stunnel-users] stunnel 4.26 released > To: 'stunnel-users(a)mirt.net' > <stunnel-users(a)mirt.net>, > stunnel-announce(a)mirt.net, openssl-users(a)openssl.org > Message-ID: > <86cf5ffd468849a8dba392b1d3bc6bb3(a)mobi-com.net> > Content-Type: text/plain; charset=US-ASCII; format=flowed > > Dear Users, > > Version 4.26, 2008.09.20, urgency: MEDIUM: > * New features > - Win32 DLLs for OpenSSL 0.9.8i. > - /etc/hosts.allow and /etc/hosts.deny no longer need to > be copied to > the chrooted directory, as the libwrap processes are no > longer > chrooted. > - A more informative error messages for invalid port > number specified > in stunnel.conf file. > - Support for Microsoft Visual C++ 9.0 Express Edition. > * Bugfixes > - Killing all libwrap processes at stunnel shutdown > fixed. > - A minor bug in stunnel.init sample SysV startup file > fixed. > > Home page/download: http://stunnel.mirt.net/ > > sha1sum for stunnel-4.24.tar.gz file: > 1c9f5dd6b21f354c356cd9100899a90a83068c68 > > Best regards, > Mike > > ______________________________________________________________________ > OpenSSL Project > http://www.openssl.org > User Support Mailing List > openssl-users(a)openssl.org > Automated List Manager > majordomo(a)openssl.org > > > ------------------------------ > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > End of stunnel-users Digest, Vol 50, Issue 15 > *********************************************

1 0

Compiled Stunnel 4.25 with OpenSSL 0.9.8h on Solaris 10
by Nelgraine 20 Sep '08

20 Sep '08

Ive read this article Compiling Stunnel 4.21 on Solaris 10 http://stunnel.mirt.net/pipermail/stunnel-users/2008-March/001895.html I've been also experiencing this kind of problem but I've Compiled Stunnel 4.25 with OpenSSL 0.9.8h on Solaris 10. Configure: # ./configure --prefix=/usr/local/stunnel-4.25 --with-ssl=/usr/local/openssl-0.9.8h configure: **************************************** success Make Error: gcc -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/local/openssl-0.9.8h/include -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o pty.o libwrap.o -lz -ldl -lsocket -lnsl -lpthread -L/usr/local/openssl-0.9.8h/lib -lssl -lcrypto -lwrap Undefined first referenced symbol in file BIO_set_flags protocol.o SSL_CTX_set_info_callback ctx.o ld: fatal: Symbol referencing errors. No output written to stunnel My Question is: 1. Should I need to upgrade OpenSSL 0.9.8h into OpenSSL 0.9.8i? 2. I have installed openssl 0.9.8h on Solaris 10 and created several ca certificates. - If I will upgrade OpenSSL 0.9.8h into OpenSSL 0.9.8i, should I also recreate ca certificates? Any help would be greatly appreciated.

2 1

stunnel 4.26 released
by Michal Trojnara 20 Sep '08

20 Sep '08

Dear Users, Version 4.26, 2008.09.20, urgency: MEDIUM: * New features - Win32 DLLs for OpenSSL 0.9.8i. - /etc/hosts.allow and /etc/hosts.deny no longer need to be copied to the chrooted directory, as the libwrap processes are no longer chrooted. - A more informative error messages for invalid port number specified in stunnel.conf file. - Support for Microsoft Visual C++ 9.0 Express Edition. * Bugfixes - Killing all libwrap processes at stunnel shutdown fixed. - A minor bug in stunnel.init sample SysV startup file fixed. Home page/download: http://stunnel.mirt.net/ sha1sum for stunnel-4.24.tar.gz file: 1c9f5dd6b21f354c356cd9100899a90a83068c68 Best regards, Mike

1 0

Re: [stunnel-users] STunnel as a Relay server
by Ludolf Holzheid 19 Sep '08

19 Sep '08

On Thu, 2008-09-18 15:02:56 -0400, Thomas O'Hare wrote: > Ludolf > > Just got this as the main mail server was down for several days. > > The Win EXE that installs the STunnel service is what I meant. Is there > a way to edit the configuration text file to skip tunneling. There is > an ancient app on some PCs that can use only port 25 and we want to use > STunnel to do both SSL & non-SSL relays so we do not have to install & > maintain 2 different packages to basically do the same thing. Thomas, Of course, you get a clear-text port redirector if you connect two instances of stunnel running on the same machine, one acting as client, the other one as server. But again, I think this is oversized and not easier to set up than a simple TCP port redirector. Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Bug in tools stunnel.init
by Kevin A. McGrail 17 Sep '08

17 Sep '08

Hi Michael, I've upgraded to stunnel 4.25 and found a few small bugs in the init script. In stunnel.init.in, I'm pretty sure the DAEMON line should be DAEMON=@prefix@/bin/stunnel and not DAEMON=@prefix@/etc/stunnel Also, when the parent process is killed with stop, I see Sep 17 14:34:16 server stunnel: warning: can't get client address: Bad file descriptor because the child processes seem to stick around. I've modified the init script to kill the main process using the pid file and then using pidof to identify and kill the remaining child processes. Is this expected behavior? regards, KAM

2 2

Non-SSL Relay
by Thomas O'Hare 17 Sep '08

17 Sep '08

Hello I know the obvious and goes against what it was made for, but... Is there a way to use STunnel as a relay server w/o SSL? IOW, if you put STunnel in a number of installations but one or more PCs need a non-SSL server, can they use it? It would beat having to install "2" relay servers on each PC. -- Thanks, ~ Thomas O'Hare ~ Web, Wireless, Network, Database & Systems Software/Hardware Operations Manager | Virtual FoxPro User Group Tom(a)VFUG.Org | http://www.VFUG.Org/

1 0

STunnel as a Relay server
by Thomas O'Hare 16 Sep '08

16 Sep '08

I know this is against what STunnel was made for but... There are Stunnel installations on client PCs but they also need to use STunnel to also send to non-SSL entities -- since it is easier then installing 2 relay/proxy servers. Is there a way to make STunnel into a non-SSL relay server? -- Thanks, ~ Thomas O'Hare ~ Web, Wireless, Network, Database & Systems Software/Hardware Operations Manager | Virtual FoxPro User Group Tom(a)VFUG.Org | http://www.VFUG.Org/

2 1

What is the difference between "all" and "SSLv3" for sslVersion?
by Christopher Hunt 14 Sep '08

14 Sep '08

Hi there, I would like to understand the difference between specifying an sslVersion of "all" vs "SSLv3" when I see that the client is attempting SSLv3. I have a Java 1.5 ssl client connecting to an stunnel endpoint. If I specify an sslVersion of "all" in my stunnel configuration then the client is able to connect. When I see it connect, it appears to have connected as SSLv3 i.e.: 2008.09.14 15:59:20 LOG7[98326:2690846624]: https accepted FD=12 from 127.0.0.1:59812 2008.09.14 15:59:20 LOG7[98326:2952859648]: https started 2008.09.14 15:59:20 LOG7[98326:2952859648]: FD 12 in non-blocking mode 2008.09.14 15:59:20 LOG7[98326:2952859648]: TCP_NODELAY option set on local socket 2008.09.14 15:59:20 LOG7[98326:2952859648]: Waiting for a libwrap process 2008.09.14 15:59:20 LOG7[98326:2952859648]: Acquired libwrap process #0 2008.09.14 15:59:20 LOG7[98326:2952859648]: Releasing libwrap process #0 2008.09.14 15:59:20 LOG7[98326:2952859648]: Released libwrap process #0 2008.09.14 15:59:20 LOG7[98326:2952859648]: https permitted by libwrap from 127.0.0.1:59812 2008.09.14 15:59:20 LOG5[98326:2952859648]: https accepted connection from 127.0.0.1:59812 2008.09.14 15:59:20 LOG7[98326:2952859648]: SSL state (accept): before/ accept initialization 2008.09.14 15:59:21 LOG7[98326:2952859648]: SSL state (accept): SSLv3 read client hello A etc. If I substitute "SSLv3" for the value of sslVersion then I get: 2008.09.14 15:56:26 LOG7[98297:2690846624]: https accepted FD=12 from 127.0.0.1:59795 2008.09.14 15:56:26 LOG7[98297:2952859648]: https started 2008.09.14 15:56:26 LOG7[98297:2952859648]: FD 12 in non-blocking mode 2008.09.14 15:56:26 LOG7[98297:2952859648]: TCP_NODELAY option set on local socket 2008.09.14 15:56:26 LOG7[98297:2952859648]: Waiting for a libwrap process 2008.09.14 15:56:26 LOG7[98297:2952859648]: Acquired libwrap process #0 2008.09.14 15:56:26 LOG7[98297:2952859648]: Releasing libwrap process #0 2008.09.14 15:56:26 LOG7[98297:2952859648]: Released libwrap process #0 2008.09.14 15:56:26 LOG7[98297:2952859648]: https permitted by libwrap from 127.0.0.1:59795 2008.09.14 15:56:26 LOG5[98297:2952859648]: https accepted connection from 127.0.0.1:59795 2008.09.14 15:56:26 LOG7[98297:2952859648]: SSL state (accept): before/ accept initialization 2008.09.14 15:56:27 LOG3[98297:2952859648]: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number I have also tried specifying "SSLv2" (client disconnected complaining that v2 was not supported) and "TLSv1" (yields the same error as "SSLv3". My version of stunnel is: stunnel 4.25 on i686-apple-darwin9.4.0 with OpenSSL 0.9.7l 28 Sep 2006 Thank you in advance for any explanation on the difference between "all" and "SSLv3". Kind regards, Christopher

1 0

Stunnel on Vista gets "readsocket: Connection reset by peer"
by Scarsdale_James＠emc.com 10 Sep '08

10 Sep '08

Hi, I'm trying to use stunnel 4.25 on Vista over the Microsoft Loopback Adapter, but I always get the following error shown next to ">>>" below. Note that the session seems to have been negotiated okay. I found some notes about using "Run as administrator", but I still get the same behavior with this. The same setup works fine on XP. Any ideas before I start looking at code? Thanks, Jim 2008.09.10 15:27:42 LOG7[2844:692]: RAND_status claims sufficient entropy for the PRNG 2008.09.10 15:27:42 LOG7[2844:692]: PRNG seeded successfully 2008.09.10 15:27:42 LOG7[2844:692]: Certificate: stunnel.pem 2008.09.10 15:27:42 LOG7[2844:692]: Certificate loaded 2008.09.10 15:27:42 LOG7[2844:692]: Key file: stunnel.pem 2008.09.10 15:27:42 LOG7[2844:692]: Private key loaded 2008.09.10 15:27:42 LOG7[2844:692]: SSL context initialized for service smb 2008.09.10 15:27:42 LOG5[2844:692]: stunnel 4.25 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2008.09.10 15:27:42 LOG5[2844:692]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2008.09.10 15:27:42 LOG5[2844:2656]: No limit detected for the number of clients 2008.09.10 15:27:42 LOG7[2844:2656]: FD 248 in non-blocking mode 2008.09.10 15:27:42 LOG7[2844:2656]: SO_REUSEADDR option set on accept socket 2008.09.10 15:27:42 LOG7[2844:2656]: smb bound to 192.168.0.253:139 2008.09.10 15:28:13 LOG7[2844:2656]: smb accepted FD=240 from 192.168.0.253:49238 2008.09.10 15:28:13 LOG7[2844:2656]: Creating a new thread 2008.09.10 15:28:13 LOG7[2844:2656]: New thread created 2008.09.10 15:28:13 LOG7[2844:2856]: smb started 2008.09.10 15:28:13 LOG7[2844:2856]: FD 240 in non-blocking mode 2008.09.10 15:28:13 LOG7[2844:2856]: TCP_NODELAY option set on local socket 2008.09.10 15:28:13 LOG5[2844:2856]: smb accepted connection from 192.168.0.253:49238 2008.09.10 15:28:13 LOG7[2844:2856]: FD 264 in non-blocking mode 2008.09.10 15:28:13 LOG7[2844:2856]: smb connecting 128.221.79.49:10005 2008.09.10 15:28:13 LOG7[2844:2856]: connect_wait: waiting 10 seconds 2008.09.10 15:28:13 LOG7[2844:2856]: connect_wait: connected 2008.09.10 15:28:13 LOG5[2844:2856]: smb connected remote server from 128.221.79.44:49239 2008.09.10 15:28:13 LOG7[2844:2856]: Remote FD=264 initialized 2008.09.10 15:28:13 LOG7[2844:2856]: TCP_NODELAY option set on remote socket 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): before/connect initialization 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 write client hello A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 read server hello A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 read server certificate A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 read server done A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 write client key exchange A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 write change cipher spec A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 write finished A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 flush data 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 read finished A 2008.09.10 15:28:13 LOG7[2844:2856]: 1 items in the session cache 2008.09.10 15:28:13 LOG7[2844:2856]: 1 client connects (SSL_connect()) 2008.09.10 15:28:13 LOG7[2844:2856]: 1 client connects that finished 2008.09.10 15:28:13 LOG7[2844:2856]: 0 client renegotiations requested 2008.09.10 15:28:13 LOG7[2844:2856]: 0 server connects (SSL_accept()) 2008.09.10 15:28:13 LOG7[2844:2856]: 0 server connects that finished 2008.09.10 15:28:13 LOG7[2844:2856]: 0 server renegotiations requested 2008.09.10 15:28:13 LOG7[2844:2856]: 0 session cache hits 2008.09.10 15:28:13 LOG7[2844:2856]: 0 session cache misses 2008.09.10 15:28:13 LOG7[2844:2856]: 0 session cache timeouts 2008.09.10 15:28:13 LOG6[2844:2856]: SSL connected: new session negotiated 2008.09.10 15:28:13 LOG6[2844:2856]: SSL connected: new session negotiated 2008.09.10 15:28:13 LOG6[2844:2856]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 >>> 2008.09.10 15:28:44 LOG3[2844:2856]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2008.09.10 15:28:44 LOG5[2844:2856]: Connection reset: 153 bytes sent to SSL, 0 bytes sent to socket 2008.09.10 15:28:44 LOG7[2844:2856]: smb finished (0 left) Relevant info stunnel.conf on client: [smb] accept = 192.168.0.253:139 connect = [server ipaddress]:10005 Relevant info stunnel.conf on server: [smb] accept = 10005 connect = 139 ;connect = 445

1 0

Stunnel on Vista gets "readsocket: Connection reset by peer"
by Scarsdale_James＠emc.com 10 Sep '08

10 Sep '08

Hi, I'm trying to use stunnel 4.25 on Vista over the Microsoft Loopback Adapter, but I always get the following error shown next to ">>>" below. Note that the SSL session appears to have been negotiated okay. I found some notes about using "Run as adminstrator" on Vista, but I still get the same behavior with this. The same setup works fine on XP. Any ideas before I start looking at code? Thanks, Jim 2008.09.10 15:27:42 LOG7[2844:692]: RAND_status claims sufficient entropy for the PRNG 2008.09.10 15:27:42 LOG7[2844:692]: PRNG seeded successfully 2008.09.10 15:27:42 LOG7[2844:692]: Certificate: stunnel.pem 2008.09.10 15:27:42 LOG7[2844:692]: Certificate loaded 2008.09.10 15:27:42 LOG7[2844:692]: Key file: stunnel.pem 2008.09.10 15:27:42 LOG7[2844:692]: Private key loaded 2008.09.10 15:27:42 LOG7[2844:692]: SSL context initialized for service smb 2008.09.10 15:27:42 LOG5[2844:692]: stunnel 4.25 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2008.09.10 15:27:42 LOG5[2844:692]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2008.09.10 15:27:42 LOG5[2844:2656]: No limit detected for the number of clients 2008.09.10 15:27:42 LOG7[2844:2656]: FD 248 in non-blocking mode 2008.09.10 15:27:42 LOG7[2844:2656]: SO_REUSEADDR option set on accept socket 2008.09.10 15:27:42 LOG7[2844:2656]: smb bound to 192.168.0.253:139 2008.09.10 15:28:13 LOG7[2844:2656]: smb accepted FD=240 from 192.168.0.253:49238 2008.09.10 15:28:13 LOG7[2844:2656]: Creating a new thread 2008.09.10 15:28:13 LOG7[2844:2656]: New thread created 2008.09.10 15:28:13 LOG7[2844:2856]: smb started 2008.09.10 15:28:13 LOG7[2844:2856]: FD 240 in non-blocking mode 2008.09.10 15:28:13 LOG7[2844:2856]: TCP_NODELAY option set on local socket 2008.09.10 15:28:13 LOG5[2844:2856]: smb accepted connection from 192.168.0.253:49238 2008.09.10 15:28:13 LOG7[2844:2856]: FD 264 in non-blocking mode 2008.09.10 15:28:13 LOG7[2844:2856]: smb connecting [server ip]:10005 2008.09.10 15:28:13 LOG7[2844:2856]: connect_wait: waiting 10 seconds 2008.09.10 15:28:13 LOG7[2844:2856]: connect_wait: connected 2008.09.10 15:28:13 LOG5[2844:2856]: smb connected remote server from 128.221.79.44:49239 2008.09.10 15:28:13 LOG7[2844:2856]: Remote FD=264 initialized 2008.09.10 15:28:13 LOG7[2844:2856]: TCP_NODELAY option set on remote socket 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): before/connect initialization 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 write client hello A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 read server hello A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 read server certificate A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 read server done A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 write client key exchange A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 write change cipher spec A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 write finished A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 flush data 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 read finished A 2008.09.10 15:28:13 LOG7[2844:2856]: 1 items in the session cache 2008.09.10 15:28:13 LOG7[2844:2856]: 1 client connects (SSL_connect()) 2008.09.10 15:28:13 LOG7[2844:2856]: 1 client connects that finished 2008.09.10 15:28:13 LOG7[2844:2856]: 0 client renegotiations requested 2008.09.10 15:28:13 LOG7[2844:2856]: 0 server connects (SSL_accept()) 2008.09.10 15:28:13 LOG7[2844:2856]: 0 server connects that finished 2008.09.10 15:28:13 LOG7[2844:2856]: 0 server renegotiations requested 2008.09.10 15:28:13 LOG7[2844:2856]: 0 session cache hits 2008.09.10 15:28:13 LOG7[2844:2856]: 0 session cache misses 2008.09.10 15:28:13 LOG7[2844:2856]: 0 session cache timeouts 2008.09.10 15:28:13 LOG6[2844:2856]: SSL connected: new session negotiated 2008.09.10 15:28:13 LOG6[2844:2856]: SSL connected: new session negotiated 2008.09.10 15:28:13 LOG6[2844:2856]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 >>> 2008.09.10 15:28:44 LOG3[2844:2856]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2008.09.10 15:28:44 LOG5[2844:2856]: Connection reset: 153 bytes sent to SSL, 0 bytes sent to socket 2008.09.10 15:28:44 LOG7[2844:2856]: smb finished (0 left) Relevant info stunnel.conf on client: [smb] accept = 192.168.0.253:139 connect = [server ip]:10005 Relevant info stunnel.conf on server: [smb] accept = 10005 connect = 139 ;connect = 445

1 0

Building STunnel 4.25 with OpenSSL 0.9.8h on Windows
by Paul Coleman 10 Sep '08

10 Sep '08

Hi everyone, I've recently been trying to compile STunnel for Windows, but have found so many conflicting reports of the best way to do it on the website / other sites, that I'm now well and truly confused! I've got MSVS 2005, but have also tried with mingw, and cygwin - and also on Linux using mingw32. I'm unsure as to whether I need some Makefile.w32, whether I need to compile OpenSSL from source, where I need to put OpenSSL libraries when they're done, if I need to run Configure, etc etc. I'm not looking for a complete step by step guide including 'cd to x, type this' (although I wouldn't complain! :P), but a general poke in the right direction would be great. Thanks for your help, --Paul

1 0

Re: [stunnel-users] Help using stunnel for the first time
by Jilin Zhang 09 Sep '08

09 Sep '08

try: http://localhost:1515 > Hi, > > I'm trying to use stunnel for the first time (on Mac OS X 10.5), and > I'm not having much luck. > > First of all, I downloaded the source and installed stunnel > successfully. I then setup a config file as follows (where myhost is > the host i am connecting to): > > client=yes > verify=0 > [psuedo-https] > accept=1515 > connect=myhost:443 > TIMEOUTclose = 0 > > Then, I run the following on the command line: > /usr/local/bin/stunnel ./stunnel.config > > It appears that stunnel runs without error, and if I do 'ps aux | grep > stunnel' there are 4 stunnel processes running. > > Then, as a test, I try to connect to port 1515 from my web browser by > visiting https://localhost:1515, but it just hangs there... nothing. > > Any suggestions? > > Thanks! > > Ian > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > >

2 1

Help using stunnel for the first time
by Ian Baxter 09 Sep '08

09 Sep '08

Hi, I'm trying to use stunnel for the first time (on Mac OS X 10.5), and I'm not having much luck. First of all, I downloaded the source and installed stunnel successfully. I then setup a config file as follows (where myhost is the host i am connecting to): client=yes verify=0 [psuedo-https] accept=1515 connect=myhost:443 TIMEOUTclose = 0 Then, I run the following on the command line: /usr/local/bin/stunnel ./stunnel.config It appears that stunnel runs without error, and if I do 'ps aux | grep stunnel' there are 4 stunnel processes running. Then, as a test, I try to connect to port 1515 from my web browser by visiting https://localhost:1515, but it just hangs there... nothing. Any suggestions? Thanks! Ian

1 0

Re: [stunnel-users] A Calypso user needs your help with stunnel
by John Bryant 09 Sep '08

09 Sep '08

Dear Ludolf et al: Thank you very much for your recent communication. I drew up what I thought I needed, based on your answer, in the configuration file. As might be expected in that I'm a novice at this, I still have a few more questions: 1. I tried it with and without the "Authentification stuff". Either way, after modifying stunnel.conf, and running stunnel.exe, stunnel.exe bombed with the following error: "Stunnel server down" (log said: ************** 2008.09.02 14:20:17 LOG7[16442455:16274811]: RAND_status claims sufficient entropy for the PRNG 2008.09.02 14:20:17 LOG7[16442455:16274811]: PRNG seeded successfully 2008.09.02 14:20:17 LOG3[16442455:16274811]: Error loading verify certificates from certs.pem 2008.09.02 14:20:17 LOG3[16442455:16274811]: error stack: B084002 : error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib 2008.09.02 14:20:17 LOG3[16442455:16274811]: error stack: 2006D080 : error:2006D080:BIO routines:BIO_new_file:no such file 2008.09.02 14:20:17 LOG3[16442455:16274811]: SSL_CTX_load_verify_locations: 2001002: error:02001002:system library:fopen:No such file or directory 2008.09.02 14:20:17 LOG3[16442455:16274811]: Server is down What caused this? ************** 2. My other question is: Do I need to put stunnel.exe in the startup folder? Does it automatically reference stunnel.conf (that is what I was assuming)? When I get it to run correctly, automatically referencing stunnel, conf, then can I run Calypso with the settings changed to tie in with the stunnel conf file? All of the above I was assuming was true, but I'm just asking to make sure. Thanks! Lenny

3 6

Respawn stunnel
by Joe Kemp 08 Sep '08

08 Sep '08

What is the best way to setup stunnel to respawn if it crashes? I have looked at inittab (probably would have to have stunnel run in foreground?) or the procautostart.cpp utility. Any other ideas? Is there an easier way. Joe A. Kemp CapWIN Senior Systems Architect (O) 301-614-3727 (C) 301-502-1281

2 1

Re: [stunnel-users] Scripting stunnel to load automatically when OS X 10.5 server starts up -plist
by Christopher Hunt 04 Sep '08

04 Sep '08

On 04/09/2008, at 8:00 PM, stunnel-users-request(a)mirt.net wrote: > Here is my plist. I put this in /Library/LaunchDaemons. What do you > think? --Thanks, Allen Firstly have you considered using Lingon to maintain your plist? That could help you. > <?xml version="1.0" encoding="UTF-8"?> > <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd > "> > <plist version="1.0"> > <dict> > <key>KeepAlive</key> > <true/> > <key>Label</key> > <string>stunnel_startup</string> > <key>ProgramArguments</key> > <array> > <string>/opt/local/bin/stunnel</string> > </array> > <key>RunAtLoad</key> > <true/> > </dict> > </plist> The most obvious thing that stands out is that you aren't supplying a config file argument to stunnel. How's it going to locate your config file? You might want to check your system.log file using the Console application and watch for messages. You also need to use launchctl to load your plist - Lingon makes this pretty straightforward. Cheers, -C

1 0

Scripting stunnel to load automatically when OS X 10.5 server starts up -plist
by Allen 03 Sep '08

03 Sep '08

Thank you Chris and Tom, for your responses, Here is my plist. I put this in /Library/LaunchDaemons. What do you think? --Thanks, Allen <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd "> <plist version="1.0"> <dict> <key>KeepAlive</key> <true/> <key>Label</key> <string>stunnel_startup</string> <key>ProgramArguments</key> <array> <string>/opt/local/bin/stunnel</string> </array> <key>RunAtLoad</key> <true/> </dict> </plist>

1 1

Re: [stunnel-users] Scripting stunnel to load automatically when OS X 10.5 server starts up -any solution?
by Christopher Hunt 03 Sep '08

03 Sep '08

On 03/09/2008, at 8:00 PM, stunnel-users-request(a)mirt.net wrote: > Does anybody have a solution that will start up stunnel on OS X > bootup? ... Sounds to me like a launchd config error. How about sending through the plist? Cheers, -C

2 1

Starting stunnel automatically on OS X system startup
by Allen 02 Sep '08

02 Sep '08

Does anybody have a solution that will start up stunnel on OS X bootup? I've installed stunnel on a Leopard server (OS 10.4.5.4) to make a smtp SSL relay work (and it works fine). The problem is, we'd have to type in /opt/local/bin/stunnel on the command line every time the server is rebooted. Rather than having to create a /Library/ SystemStartup/diretory_structure_with_plist_etc., has somebody done this, and can lead me in the right direction, in the interest of time? I've just run out of time, and I kinda think that somebody must have done this already. Thanks! Allen

1 1

A Calypso user needs your help with stunnel
by John Bryant 02 Sep '08

02 Sep '08

Dear folks: I am trying to install stunnel so that I can have an SSL capability with Calypso. I was guided to the stunnel.org site by instructions at: http://www.windowsbbs.com/courier-email-client/35188-ssl-connection-really-…. (the instructions that I am referring to are duplicated below, under the first line of asterisks - they mention later versions of stunnel, but do not update their instructions for them adequately) I could not understand the instructions at your site that told about modifying the conf file with the LATEST version of stunnel.exe, which I did download and install and that's as far as I got - couldn't understand the options as clearly as I had the others, so uninstalled it.) (Tried downloading the OLD version, 4.05 exe, mentioned in the instructions and the two dll files,and making all the changes to THAT conf.txt file, etc, but THAT did not work because when I ran the shortcut to the conf.txt file that I had put in the Start folder, the computer gave me, when connected, a "cannot find 1 1/4 dll" message, and then an "illegal op" and a "cannot run due to restrictions on your computer" message (when not connected, just the latter two). I know you don't want to hear about old versions but it was logical for me to try since I could not figure out how to use the latest version.) So what do I do now? Thanks! Lenora (do not give up on me, I have computers in my background, etc. etc) ************** (Excerpts from the thread at the url listed above) http://www.windowsbbs.com/courier-email-client/35188-ssl-connection-really-… A week ago I provided instructions for using stunnel to provide SSL functionality for Calypso/Courier - in case your email provider requires SSL, which Calypso and Courier do not yet support. Those instructions were correct if your email provider uses the dedicated SSL ports - 465 for smtps, 995 for pop3s, 993 for imap4s. They were incomplete if your email provider uses the standard ports - 25 for smtp, 110 for pop3, [N/A - 143 for imap4]. Normally when the SSL ports are being used the entire conversation is encrypted with SSL. stunnel will initiate the session with the standard SSL protocol. However, if the standard ports are being used the session is initiated without SSL and then switches to SSL using an smtp or pop3 specific protocol (STARTTLS or STLS). stunnel needs to be told this, or it wont work on the standard ports. For the standard ports an extra line is required in the configuration file. To use stunnel do the following: 1) download the following files from http://www.stunnel.org/download/binaries.html stunnel-4.05.exe (version may be higher when you go there) libssl32.dll libeay32.dll and put them into a directory such as C:\Program Files\Stunnel\ 2) create a shortcut to stunnel-4.05.exe in the same directory [in WinXP do this by right clicking on it and selecting Create Shortcut] 3) edit the shortcut by right clicking on it and selecting Properties Modify the Target to look like this "C:\Program Files\Stunnel\stunnel-4.05.exe" stunnel-conf.txt (Optional) Rename the shortcut to remove the "Shortcut to ". 4) create the file stunnel-conf.txt in the same directory, and put the following lines in it: ----starting with next line---- # GLOBAL OPTIONS client = yes output = stunnel-log.txt debug=4 taskbar = yes # SERVICE-LEVEL OPTIONS [POP3 (ISP name)] accept = 127.0.0.1:108 connect = myISPs.POP3server.net:995 [SMTP (ISP name)] accept = 127.0.0.1:107 connect = myISPs.SMTPserver.net:465 ----ending with previous line---- Change the server names (before colons), and perhaps ports (after colons), to be correct for your ISP. Change ISP name too. Save and exit. 4b) if your email provider uses standard ports for either smtp or pop3, make either or both of the following changes to your stunnel-conf.txt file: [POP3 (ISP name)] accept = 127.0.0.1:108 connect = myISPs.POP3server.net:110 protocol = pop3 [SMTP (ISP name)] accept = 127.0.0.1:107 connect = myISPs.SMTPserver.net:25 protocol = smtp Once again, change the server names (before colons) to be correct for your ISP. Change ISP name too. Save and exit. 4c) if you have two email providers requiring SSL you can add a second set of services like so: [POP3 (2nd ISP name)] accept = 127.0.0.1:106 connect = my2ndISPs.POP3server.net:995 [SMTP (2nd ISP name)] accept = 127.0.0.1:105 connect = my2ndISPs.SMTPserver.net:465 Each email provider requires its own two ports (e.g. 108+107, 106+105), but 2 email accounts at a single provider can share the same pair of ports. However, if an email provider only uses SSL for one of smtp or pop3, you only need one of the two service sections. Once again, change the server names (before colons) to be correct for your ISP. Change ISP name too. Save and exit. 5) put a copy of that shortcut into your Start Menu's Programs/Startup folder [normally, by dragging shortcut over Start button, over Programs, over Startup, then drop it in Startup list.] 6) edit your Calypso/Courier Account Properties to change your mail servers. Incoming: Port 108 Server 127.0.0.1 Outgoing: Port 107 Server 127.0.0.1 [this is done differently for Calypso and Courier, due to Courier's new approach to SMTP servers] If an email provider only uses SSL for one of smtp or pop3, you only need to change one of the two mail servers. If you set up more than one email provider for SSL, change each account's properties to the corresponding ports. Now when you check or send email Calypso/Courier will communicate with stunnel, which will connect to your ISP's mail servers via SSL. The shortcut in Startup will rerun stunnel each time you reboot. You should just double-click on the shortcut in the program folder to run stunnel the first time. Hope this helps. Greg ************* Later addition (later on same thread): I just reinstalled all of my computer and I forgot to backup my sTunnel config! Anyway, the instructions have changed a bit as of sTunnel version 4.12... sTunnel is now distributed as an installer EXE, and the auxiliary DLLs are installed by default. The only step that really changes is step 1. All you have to do is to download the sTunnel installer and run it. There is no need to download the other files. The rest stays pretty much the same. ********** Question from somebody: First of all, I want to thank you for posting this very useful 'how to' -- this is what foruming is all about I have two questions (for anyone): 1. When using Stunnel, does it completely encrypt the user name, password, and the contents of the email, or just the contents? 2. The Stunnel website (www.stunnel.org) mentions that you'd also need the OpenSSL Libraries to make it work. But I did not download them, and still managed to make the Stunnel work with Courier. Am I (still) missing something? ************ Answer: 1. stunnel establishes an ssl tunnel (hence the name) between your computer and the email server. So every byte travelling between the two is encrypted. It's like establishing a VPN between your computer and the server. 2. As gmagana posted at the start of the month, they seem to have enhanced the installation process - such that you don't need to worry about the extra files. Isn't open source great! ********* Final comment: Looks like I can finally use Courier with Google's Gmail (http://gmail.google.com) to send/receive encrypted email. (End of excerpts)

2 1

Re: [stunnel-users] failed to build stunnel 4.25 under VS 2005
by Michal Trojnara 29 Aug '08

29 Aug '08

On Fri, 29 Aug 2008 00:00:56 +0800, "Ericdai" <pcix133(a)hotmail.com> wrote: > I try to build Stunnel 4.25 under VS2005 ,but failed Today I updated stunnel, so it can be built with Visual C++ 2008 (known also as Visual C++ 9.0). My plan is to release stunnel 4.26 next week. > prototypes.h(428) : error C2081: 'socklen_t' : name in formal > parameter list illegal I had no problem with socklen_t. Maybe it's specific to the old version of Visual C++. > I also suggest build a windows client only version > n It only can be running on windows > n It only can act as a client > n I think it can reduce the code size and runtime footprice smaller Not really. The difference would be negligible. Best regards, Mike

1 0

failed to build stunnel 4.25 under VS 2005
by Ericdai 28 Aug '08

28 Aug '08

I try to build Stunnel 4.25 under VS2005 ,but failed cl -MD -W3 -Ox -O2 -Ob2 -Gs0 -GF -Gy -GL -nologo -I"..\..\ssl\inc32" -DUSE_WIN32 -D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE -DHAVE_GETADDRINFO -DHAVE_GETNAMEINFO -D_MBCS /c stunnel.c stunnel.c prototypes.h(428) : error C2081: 'socklen_t' : name in formal parameter list illegal stunnel.c(206) : error C2065: 'socklen_t' : undeclared identifier stunnel.c(206) : error C2146: syntax error : missing ';' before identifier 'addrlen' stunnel.c(206) : error C2065: 'addrlen' : undeclared identifier I use nmake -f vc.mak to do it Anyone has build it successfully ,pls help me ! Another way ,is there a stunnel solution or project file ? I also suggest build a windows client only version n It only can be running on windows n It only can act as a client n I think it can reduce the code size and runtime footprice smaller Thanks and best regards Eric dai

1 0

Re: [stunnel-users] In chrooted environment system times defaults to UTC
by Ivan Lezhnjov Jr. 22 Aug '08

22 Aug '08

Friday 22 August 2008 you wrote: > I noticed that when running stunnel from within the jail it logs its > messages with syslong using UTC. > > My question is how would one reconcile timezone of chrooted stunnel with a > system one? > > The issue illustrated: > > Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: stunnel 4.17 on > i686-pc-linux-gnu with OpenSSL 0.9.8h 28 May 2008 > Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: Threading:PTHREAD > SSL:ENGINE Sockets:POLL,IPv4 > Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: 500 clients > allowed Aug 22 12:29:40 xerxes stunnel: LOG5[26570:3086773168]: 5101 > connected from 127.0.0.1:1469 > Aug 22 09:29:40 xerxes stunnel: LOG5[26570:3086773168]: VERIFY OK: > depth=0, /C=UA/ST=ARC/L=Simferopol/O=HOMELAB/CN=sega.localnet > > xerxes' localtime is GMT+3 and sega's too, but stunnel runs on sega in > chrooted environment and thus uses UTC (if it's not chrooted it reports > localtime to syslog facility). > > Any ideas? Jee that was simple! cp /etc/localtime /var/lib/stunnel/etc/ (on each machine where stunnel runs) and you're done :^) -- Ivan Lezhnjov Jr. Europe, Ukraine, Simferopol Running Source Mage GNU/Linux, kernel version 2.6.24 build #5 +----------------------------------------------------------------------+ Key ID 0x5811D90C Key Fingerprint 2A52 5C8C 38BE C04F D8DE A169 19E2 E49A 5811 D90C Use GPG Exercise Your Right To Privacy

1 0

In chrooted environment system times defaults to UTC
by Ivan Lezhnjov Jr. 22 Aug '08

22 Aug '08

I noticed that when running stunnel from within the jail it logs its messages with syslong using UTC. My question is how would one reconcile timezone of chrooted stunnel with a system one? The issue illustrated: Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: stunnel 4.17 on i686-pc-linux-gnu with OpenSSL 0.9.8h 28 May 2008 Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: 500 clients allowed Aug 22 12:29:40 xerxes stunnel: LOG5[26570:3086773168]: 5101 connected from 127.0.0.1:1469 Aug 22 09:29:40 xerxes stunnel: LOG5[26570:3086773168]: VERIFY OK: depth=0, /C=UA/ST=ARC/L=Simferopol/O=HOMELAB/CN=sega.localnet xerxes' localtime is GMT+3 and sega's too, but stunnel runs on sega in chrooted environment and thus uses UTC (if it's not chrooted it reports localtime to syslog facility). Any ideas? -- Ivan Lezhnjov Jr. Europe, Ukraine, Simferopol Running Source Mage GNU/Linux, kernel version 2.6.24 build #5 +----------------------------------------------------------------------+ Key ID 0x5811D90C Key Fingerprint 2A52 5C8C 38BE C04F D8DE A169 19E2 E49A 5811 D90C Use GPG Exercise Your Right To Privacy

1 0

Certificates, Servers & Clients. Clarify this please.
by Ivan Lezhnjov Jr. 22 Aug '08

22 Aug '08

Now that I've read a bunch of articles and have seen a pile of examples of how pairs of a certificate and a private key can be created I must say they all suggest different approaches and techniques to creating certificates and ultimately bewildered me. Could anyone please explain as simply as possible, in layman's terms what exactly must be done? Let's talk about simple scenario with two hosts (A & B) involved, both running stunnel. Let us assume host A is the server and host B is the client. cert = CAfile = must be created. And we use verify level 3 (verify = 3) So, what exactly do we do now? And what happens in the dialog between these two machines? -- Ivan Lezhnjov Jr. Europe, Ukraine, Simferopol Running Source Mage GNU/Linux, kernel version 2.6.24 build #5 +----------------------------------------------------------------------+ Key ID 0x5811D90C Key Fingerprint 2A52 5C8C 38BE C04F D8DE A169 19E2 E49A 5811 D90C Use GPG Exercise Your Right To Privacy

1 0

Can't start stunnel (dies mysteriously)
by Ivan Lezhnjov Jr. 19 Aug '08

19 Aug '08

Hello there I run stunnel version 4.21 and openssl version 0.9.8h. In my setup I aim to create a tunnel to send log files through to a centralized loghost. Host A (loghost) runs Source Mage GNU/Linux (with stunnel 4.21, openssl 0.9.8h) and host B runs Slackware 11 system (with stunnel 4.17, openssl 0.9.8h). The problem is that stunnel starts on host B but won't start on host A. Here's the snippet of /var/log/messages that records stunnel start-up event: root@sega:/home/users/ilj % stunnel && tail /var/log/messages -n 3 Aug 19 16:17:37 sega stunnel: LOG5[29146:3082634944]: stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.8h 28 May 2008 Aug 19 16:17:37 sega stunnel: LOG5[29146:3082634944]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Aug 19 16:17:37 sega stunnel: LOG5[29146:3082634944]: 500 clients allowed I've actually been trying to run stunnel for the first time ever so I don't really know if this output confirms that everything is alright but judging solely from what is put in log file it seems stunnel has started successfully. Unfortunately, this isn't quite true root@sega:/home/users/ilj % ps ax | grep stun 29618 pts/4 R+ 0:00 grep stun So, this is the problem I have. It doesn't start on host A. Host A has the following stunnel configuration: root@sega:/home/users/ilj % cat /etc/stunnel/stunnel.conf cert = /etc/stunnel/syslog-ng-server.pem CAfile = /etc/stunnel/syslog-ng-client.pem verify = 3 [5101] accept = 217.117.75.2:5101 connect = 127.0.0.1:1999 Host B sports a little bit different configuration file: root@xerxes:~ % cat /etc/stunnel/stunnel.conf client = yes cert = /etc/stunnel/syslog-ng-client.pem CAfile = /etc/stunnel/syslog-ng-server.pem verify = 3 [5101] accept = 127.0.0.1:1999 connect = 217.117.75.2:5101 On both hosts (A & B) I run stunnel standalone as root. > 4. Output of "stunnel -f -D 7 <your-parameters>". Erm.. it doesn't seem to work for me. There's no -D parameter according to man stunnel. The following information below is about host A only: root@sega:/home/users/ilj % stunnel -version stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.8h 28 May 2008 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /usr/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none root@sega:/home/users/ilj % uname -a Linux sega 2.6.24 #5 SMP PREEMPT Wed May 7 18:22:29 EEST 2008 i686 GNU/Linux root@sega:/home/users/ilj % gaze from /usr/lib/libc.a glibc-2.7:/usr/lib/libc.a root@sega:/home/users/ilj % gcc -v Reading specs from /usr/lib/gcc/i686-pc-linux-gnu/4.2.3/specs Target: i686-pc-linux-gnu Configured with: /usr/src/gcc-4.2.3/configure --host=i686-pc-linux-gnu --prefix=/usr --infodir=/usr/share/info --mandir=/usr/share/man --enable-threads=posix --with-system-zlib Thread model: posix gcc version 4.2.3 root@sega:/home/users/ilj % gaze installed | grep openssl openssl:20080615:installed:0.9.8h -- Ivan Lezhnjov Jr. Europe, Ukraine, Simferopol Running Source Mage GNU/Linux, kernel version 2.6.24 build #5 +----------------------------------------------------------------------+ Key ID 0x5811D90C Key Fingerprint 2A52 5C8C 38BE C04F D8DE A169 19E2 E49A 5811 D90C Use GPG Exercise Your Right To Privacy

1 0

Disable libwrap at runtime?
by Jans, Kert 16 Aug '08

16 Aug '08

Hi, Is it possible to disable libwrap support at runtime? I've reviewed the archives and documentation and cannot determine if this is possible. I know it is possible to compile-out support for libwrap by using: configure --disable-libwrap Is compiling-out support the only way? I'd like to disable support in a pre-build version of stunnel. Regards, Kert

2 1

Re: [stunnel-users] Mutual SSL Authentication
by Christopher Hunt 15 Aug '08

15 Aug '08

Ah ha - "verify = 3" - thanks! On 15/08/2008, at 9:12 AM, Brian Hatch wrote: >> > Mutual authentication uses the verify option on both > ends, rather than just on one end. Both sides verify, > and both sides present a certificate.

2 1

Re: [stunnel-users] Mutual SSL Authentication
by Christopher Hunt 14 Aug '08

14 Aug '08

On 14/08/2008, at 8:00 PM, Michal.Trojnara(a)mobi-com.net wrote: > Sure. Stunnel supports mutual SSL authentication. > Please read the fine manual for details. Hi Mike, Thanks for the reply. I did quite a lot of trawling on the web, your website and the stunnel man pages and couldn't find any guidance on mutual ssl authentication configuration. Are you able to give me a pointer, perhaps a URL to something that contains an example? Thanks again. Cheers, -C

1 0

Stunnel connection drops after four http requests
by Renner, Christopher R 13 Aug '08

13 Aug '08

With quite a bit of help from a list member here, I have stunnel 4.25 running on OSX 1.5.4 (PHP development environment). Problem is I can only get four http requests to the server before the connection is dropped. Stunnel is still running in the background.

1 0

Mutual SSL Authentication
by Christopher Hunt 13 Aug '08

13 Aug '08

Hi there, Does stunnel have any in-built support for mutual SSL authentication? If not are there plans to incorporate support? Cheers, -C

2 1

question
by Ted Ehrlich 12 Aug '08

12 Aug '08

1 0

OSX 10.5 install?
by Renner, Christopher R 11 Aug '08

11 Aug '08

> >> Hi, >> >> New list member here. I¹m going through the archives now, and have Googled >> my way to exhaustion, looking for up-to-date instructions to install stunnel >> on a Mac desktop. >> >> I do PHP web application development and need to be able to connect to a NAS >> space via stunnel on my desktop dev environment in order to simulate the live >> environment. >> >> Does anyone 1) have a link to current OSX install instructions, or 2) care to >> share such instructions with me off the top of your head? >> >> I tried working through this darwinports page ( >> http://stunnel.darwinports.com/) but 1) it sends me to Macports.org for the >> .dmg file thereby installing macports and not darwinports....and after that >> the ³port² command is unrecognized in terminal when trying to install >> stunnel. >> >> >> Thanks. >>

2 1

Socket connection status
by Jeffrey Buck 08 Aug '08

08 Aug '08

Hi, I'm running stunnel 4.04 on ia64-redhat-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003. I have basically taken a generic TCP interface and implemented a STUNNEL client/server setup to allow the connection to transfer data using SSL. I have an issue with checking the status of the connection when a connection attempt is made. We are using ObjectSpace libraries for all of our tcp related connections so I don't have the low level calls that are actually being made, but here is a brief description of what is happenning.... We create an os_tcp_socket object and call the connect_to() method. This establishes a connection to the stunnel client on my local machine....which in turn makes the connection the the stunnel server on the remote machine. The problem I'm am having is when I can't get to the remote machine. After the connect_to() call, we check the status of the socket and unless I sleep for 5-10 seconds, it always seems to think that the connection is ok...which kind-of makes sense because it is able to connect to the stunnel client port since it is local...but in fact, if there isn't access to the remote machine, eventually stunnel will close that initial connection to that socket (that where the 5-10 second delay seems to help). The status I really want is weather or not the entire connection was successful through stunnel to the remote machine. Is there a better way to do this other than putting a sleep() in. Right now I have a 10 second sleep in between the connect_to() call and the status check on the local/client stunnel TCP port. That seems to be enough time for stunnel to attept to complete the connection and kill the connection to it's local/client port so that when I check the status of it, it comes back bad. If this is the best way to do it...what is the amount of time needed for stunnel to attempt to complete it's connection to the remote machine? Thanks! Jeff

2 3

Yahoo SSL
by Bernie Murciano 29 Jul '08

29 Jul '08

1 0

Re: [stunnel-users] help with stunnell
by Ludolf Holzheid 28 Jul '08

28 Jul '08

On Thu, 2008-07-24 23:37:22 -0700, vinodsreehari(a)yahoo.com wrote: > [..] > > I configured stnnel in one server as server mode ,for accepting > connection on 8070 ,and connect to 80 . It works only if i specify > https://ipaddress:8070 This is because the default port for https is 443. If you'd configure stunnel to accept on port 443, `https://ipaddress' would work. > I have configured one client server also to accept connection on 80 > and redirect to teh 8070 of server. I want to know that is that teh > way its working . If there is a stunnel instance on the client machine accepting connections on port 80 and connecting to the web server at the https port (default or not), a user could specify `http://localhost' to connect to the web server (and the traffic between the client machine and the server would be secured). > And is it possible to implement the same in a live enviroment ,in > which teh webserver will run on different port ,but users dont need > to specify the port number . Yes. As soon as the destination port for the 'first hop' of a redirected/tunneled connection is the default port for the protocol in question, there is no need to specify the port number. The port numbers of 'intermediate hops' are configuration options for the two stunnel instances (in this case), so the user dosn't have to care about them. HTH, Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Re: [stunnel-users] Wrong documentation
by Sandeep Kumar 25 Jul '08

25 Jul '08

On Thu, Jul 24, 2008 at 9:39 PM, Brian Hatch <bri(a)stunnel.org> wrote: > In the neigborhood of 2008-07-24 09:40 +0530, Sandeep Kumar mentioned: > > > Look at this page > http://www.stunnel.org/faq/stunnel.html#configuration_file > > In service level options section, under the explanation of "CRLpath" it > is > > said that all files in it should be of the form XXXXXXXX.0. But my > stunnnel > > setup worked only when i names as XXXXXXXX.r0 instead of XXXXXXXX.0. > > What version of openssl are you running? stunnel 4.15 with OpenSSL 0.9.8b > > > > -- > Brian Hatch "Have you asked Kirk if > Systems and he'd like the job?" > Security Engineer "You can't hide from me! > http://www.ifokr.org/bri/ I will find you. > > Every message PGP signed > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.2.1 (GNU/Linux) > > iD8DBQFIiKlFVkMj8/ymYEsRAmKxAJ9CTLp0Xi8n1VxdFup/kBUuZe6scwCfcvyu > WQG8BlfrUV8RcP31/ZUEbJk= > =EBgc > -----END PGP SIGNATURE----- > > -- Sandeep Kumar http://students.iiit.ac.in/~sandeep_kr

1 0

Help on configuring Stunnel
by Patel Dippen-CDP054 24 Jul '08

24 Jul '08

I downloaded the pre-compiled Windows version of Stunnel (stunnel-4.25-installer.exe). We need to deploy this on 2 machines A and B. The way it works is: - B connects to A - then A connects to B How should I configure Stunnel on machine A, since, in the first case A is the Server and in the 2nd scenario A becomes the Client. Questions on deploying Stunnel on machine A: - Can I run just 1 instance of Stunnel on machine A? It seems I cannot since I have to set the "client = yes" in the 2nd scenario - Do I need to run multiple instances, 1 running as the Server and the 2nd as the Client? Here is the config file I used on the machine A: **************************** cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [iPerfS] accept = 5010 connect = 127.0.0.1:5001 [iPerfS] accept = 5002 connect = 12.50.0.25:5020 **************************** Here is the config file I used on the machine B: **************************** cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [iPerfC] accept = 5001 connect = 12.50.0.26:5010 [iPerfS] accept = 5020 connect = 127.0.0.1:5002 **************************** Regards, Dippen

1 0

Stunnel 4.24 patch to allow stunnel to search for the OCSP responder within an X.509 certificate's AIA extension.
by Bruce Keats 24 Jul '08

24 Jul '08

Hi all, This patch also fixes a problem with stunnel accepting an "unknown" response as "good" and allows the connection to be setup. An OCSP responder can return one of three responses (good, revoked, unknown), however the code would accept "unknown" as good. This patch fixes that problem and treats an "unknown" response as a failure. Stunnel can query an OCSP responder to determine the revocation status of a certificate when stunnel is verifying the certificate. The code works great, however it is uses a preconfigured OCSP responder. The OCSP responder's IP/hostname is specified in the stunnel configuration file as a URI. I found this rather restrictive, so I added code to extract the OCSP responder's URI from the certificate. As per RFC 3280, one of the valid extensions for X.509 certificate is the Authority Information Access (AIA) where the "accessMethod" can be "is-ad-ocsp" to identify the OCSP responders location as per RFC2560. There can be more than one OCSP responder listed in the AIA because it is a sequence. Each location is queried in the order they appear within the certificate until either a "good" or "revoked" response is received. If an "known" response or a failure then the next OCSP responder is checked. If all OCSP responder queries result in failure then the validation also fails.. A new configuration option "OCSPaia" was added. If the "OCSPaia=yes" then the stunnel will look for the OCSP responder(s) within the certificate's AIA. The locally configured "OCSP=<url>" overrides the OCSPaia option. Bruce

1 0

Wrong documentation
by Sandeep Kumar 24 Jul '08

24 Jul '08

Look at this page http://www.stunnel.org/faq/stunnel.html#configuration_file In service level options section, under the explanation of "CRLpath" it is said that all files in it should be of the form XXXXXXXX.0. But my stunnnel setup worked only when i names as XXXXXXXX.r0 instead of XXXXXXXX.0. -- Sandeep Kumar http://students.iiit.ac.in/~sandeep_kr

1 0

help with stunnel port forwarding
by vinod bhasi 23 Jul '08

23 Jul '08

Hi, Please help me with stunnel port forwarding . My apache is running at port 8000 .I want this to be forwarded to 80 so that normal users dont need to specify the port number . Can anyone help me with the configuration in both client and server side .Im confused as stunnel wont run with same port used by apache. Any help will be appreciated Thanks in advancve Vinod Bhasi Did you know? You can CHAT without downloading messenger. Go to http://in.webmessenger.yahoo.com/

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 48, Issue 13
by Patrick Dung 21 Jul '08

21 Jul '08

Message: 3 Date: Mon, 21 Jul 2008 11:34:22 +0200 From: Micha? Trojnara <Michal.Trojnara(a)mobi-com.net> Subject: Re: [stunnel-users] Problem with Solaris 10u5 x86 and Stunnel 4.25 To: stunnel-users(a)mirt.net Message-ID: <2a3f79f5f6dd65f2ced02b2e9929368b(a)mirt.net> Content-Type: text/plain; charset="UTF-8" http://stunnel.mirt.net/pipermail/stunnel-users/2008-June/002021.html Mike On Sat, 19 Jul 2008 01:53:17 -0700 (PDT), Patrick Dung <patrick_dkt(a)yahoo.com.hk> wrote: > Hi > > I use this to compile stunnel: > The gcc and openssl is from Solaris SFW. > > # export CC=/usr/sfw/bin/gcc > # ./configure --with-threads=pthread --with-ssl=/usr/sfw > --localstatedir=/var > > After installing and starting stunnel, I found there are mutiple stunnel > processes. > There is a PID file which store one of the stunnel process. > I have tried to kill that PID, stunnel is bring down. > But there other stunnel processes running. > > Any ideas? > > Regards > Patrick > > > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users I see. Thanks for reply. Yesterday, I have tried to compile stunnel with Sun Studio. It got problem linking with libwrap, so I turned off libwrap support. And it compile (without knowing there is a libwrap patch) and there is only one single running stunnel process. Regards Patrick

1 0

stunnel exits silently on startup
by Luis López de Quintana 21 Jul '08

21 Jul '08

Problem: stunnel doesn't run: ldq@ldq:~$ stunnel4 /etc/stunnel.cnf ldq@ldq:~$ ps aux | grep stunnel ldq 15683 0.0 0.0 2332 1392 pts/0 S+ 11:08 0:00 man stunnel ldq 25289 0.0 0.0 1776 608 pts/1 S+ 11:59 0:00 grep stunnel stunnel.cnf: ldq@ldq:~$ cat /etc/stunnel.cnf client = yes debug = debug [nntps] accept = 127.0.0.1:1109 connect = news.giganews.com:443 Version: stunnel 4.140-5ubuntu1 libc6 ldq@ldq:~$ uname -a Linux ldq 2.6.18.5 SMP Thu May 8 01:31:23 UTC 2008 x86_64 GNU/Linux -- LdQ

2 2

Problem with Solaris 10u5 x86 and Stunnel 4.25
by Patrick Dung 19 Jul '08

19 Jul '08

Hi I use this to compile stunnel: The gcc and openssl is from Solaris SFW. # export CC=/usr/sfw/bin/gcc # ./configure --with-threads=pthread --with-ssl=/usr/sfw --localstatedir=/var After installing and starting stunnel, I found there are mutiple stunnel processes. There is a PID file which store one of the stunnel process. I have tried to kill that PID, stunnel is bring down. But there other stunnel processes running. Any ideas? Regards Patrick

1 0

Config Sanity Check
by Caplan, Michael 19 Jul '08

19 Jul '08

Hi There, I am working through an issue with a script that builds a socket connection to stunnel. Stunnel is being used to relay to an Apache web server. I'm building a localhost TCP connection on port 54322, and writing my HTTP data. When reading data back from the socket connection in my script I'm sometimes getting nothing, and other times getting the proper result. I can confirm that the web server is always receiving the request and returning a proper response. Wireshark shows SSL data being transmitted and received, so stunnel is doing its thing. However, the response does not seem to be relayed to my script on the other side of stunnel *sometimes*. My hunch is that I am doing something wrong with my script, but I am hoping that an stunnel guru can rule out any oddities with my stunnel setup. My config is below as well as the output of my log file. Any thoughts? Thanks! Mike cert = connector.pem debug = 7 output = c:\ssl.log ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [registerserver] client = yes accept =54321 connect =www.int.ddx.com:443 [connector2server] client = yes accept =54322 connect =asd.int.ddx.com:443 [server2connector] accept = 54323 connect = 9000 2008.07.18 21:41:41 LOG7[13648:13748]: Snagged 64 random bytes from C:/.rnd 2008.07.18 21:41:41 LOG7[13648:13748]: Wrote 1024 new random bytes to C:/.rnd 2008.07.18 21:41:41 LOG7[13648:13748]: RAND_status claims sufficient entropy for the PRNG 2008.07.18 21:41:41 LOG7[13648:13748]: PRNG seeded successfully 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate loaded 2008.07.18 21:41:41 LOG7[13648:13748]: Key file: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Private key loaded 2008.07.18 21:41:41 LOG7[13648:13748]: SSL context initialized for service registerserver 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate loaded 2008.07.18 21:41:41 LOG7[13648:13748]: Key file: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Private key loaded 2008.07.18 21:41:41 LOG7[13648:13748]: SSL context initialized for service connector2server 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate loaded 2008.07.18 21:41:41 LOG7[13648:13748]: Key file: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Private key loaded 2008.07.18 21:41:41 LOG7[13648:13748]: SSL context initialized for service server2connector 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate loaded 2008.07.18 21:41:41 LOG7[13648:13748]: Key file: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Private key loaded 2008.07.18 21:41:41 LOG7[13648:13748]: SSL context initialized for service test 2008.07.18 21:41:41 LOG5[13648:13748]: stunnel 4.25 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2008.07.18 21:41:41 LOG5[13648:13748]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2008.07.18 21:41:46 LOG7[13476:13096]: Snagged 64 random bytes from C:/.rnd 2008.07.18 21:41:47 LOG7[13476:13096]: Wrote 1024 new random bytes to C:/.rnd 2008.07.18 21:41:47 LOG7[13476:13096]: RAND_status claims sufficient entropy for the PRNG 2008.07.18 21:41:47 LOG7[13476:13096]: PRNG seeded successfully 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate loaded 2008.07.18 21:41:47 LOG7[13476:13096]: Key file: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Private key loaded 2008.07.18 21:41:47 LOG7[13476:13096]: SSL context initialized for service registerserver 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate loaded 2008.07.18 21:41:47 LOG7[13476:13096]: Key file: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Private key loaded 2008.07.18 21:41:47 LOG7[13476:13096]: SSL context initialized for service connector2server 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate loaded 2008.07.18 21:41:47 LOG7[13476:13096]: Key file: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Private key loaded 2008.07.18 21:41:47 LOG7[13476:13096]: SSL context initialized for service server2connector 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate loaded 2008.07.18 21:41:47 LOG7[13476:13096]: Key file: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Private key loaded 2008.07.18 21:41:47 LOG7[13476:13096]: SSL context initialized for service test 2008.07.18 21:41:47 LOG5[13476:13096]: stunnel 4.25 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2008.07.18 21:41:47 LOG5[13476:13096]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 Please consider the environment before printing this email. E-mail messages may contain viruses, worms, or other malicious code. By reading the message and opening any attachments, the recipient accepts full responsibility for taking protective action against such code. Henry Schein is not liable for any loss or damage arising from this message. The information in this email is confidential and may be legally privileged. It is intended solely for the addressee(s). Access to this e-mail by anyone else is unauthorized.

1 0

Difference between verify level 2 and 3
by Sandeep Kumar 16 Jul '08

16 Jul '08

Hi, I searched a lot on google, in the archives, and in the FAQ page, but could not find the differences between verify levels 2 and 3, other than the one line explanation given on the FAQ/man page. Specifically, I want to ask: 1. Is verify level 3 same as 2, but asks for client certificates as well? (Seems unlikely but still..) 2. Since verify level 2 also demands CApath/CAfile to be present, then it also is ultimately verifying against locally installed certs, which is supposed to be level 3's behaviour? Thanks & regards, Sandeep Kumar http://web.iiit.ac.in/~sandeep_kr

2 2

stunnel-portforwarding
by vinod bhasi 16 Jul '08

16 Jul '08

Hi All, I am a newbie as far as stunnel is concerned. I need help urgently on how to do port forwarding with Stunnel. Any help is appreciated. Thanks and Regards, Vinod Bhasi Save all your chat conversations. Find them online at http://in.messenger.yahoo.com/webmessengerpromo.php

1 0

SSL with SMTP problem - sTunnel 4.25 Windows
by dscycler 14 Jul '08

14 Jul '08

I am using sTunnel 4.25 for Windows to send and receive e-mail from a GoldMine client. sTunnel has worked well over the years but am having an issue with a particular mail host, Live Office. They have implemented SMTP SSL on port 25. The debug log is as follows: 2008.07.14 13:45:11 LOG7[2136:5356]: smtp accepted FD=224 from 127.0.0.1:1907 2008.07.14 13:45:11 LOG7[2136:5356]: Creating a new thread 2008.07.14 13:45:11 LOG7[2136:5356]: New thread created 2008.07.14 13:45:11 LOG7[2136:4944]: smtp started 2008.07.14 13:45:11 LOG7[2136:4944]: FD 224 in non-blocking mode 2008.07.14 13:45:11 LOG5[2136:4944]: smtp accepted connection from 127.0.0.1:1907 2008.07.14 13:45:11 LOG7[2136:4944]: FD 232 in non-blocking mode 2008.07.14 13:45:11 LOG7[2136:4944]: smtp connecting 64.70.94.196:25 2008.07.14 13:45:11 LOG7[2136:4944]: connect_wait: waiting 10 seconds 2008.07.14 13:45:11 LOG7[2136:4944]: connect_wait: connected 2008.07.14 13:45:11 LOG5[2136:4944]: smtp connected remote server from 127.0.0.1:1908 2008.07.14 13:45:11 LOG7[2136:4944]: Remote FD=232 initialized 2008.07.14 13:45:11 LOG7[2136:4944]: SSL state (connect): before/connect initialization 2008.07.14 13:45:11 LOG7[2136:4944]: SSL state (connect): SSLv3 write client hello A 2008.07.14 13:45:11 LOG7[2136:4944]: SSL alert (write): fatal: handshake failure 2008.07.14 13:45:11 LOG3[2136:4944]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2008.07.14 13:45:11 LOG5[2136:4944]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.07.14 13:45:11 LOG7[2136:4944]: smtp finished (0 left) I am looking for help to troubleshoot the connection problem. Is this an sTunnel issue or a mail server issue? Are there conf file settings to address the issue? Thanks, DavidS

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 48, Issue 8
by Pietro Di Primo 10 Jul '08

10 Jul '08

Thank you for reply. I tryied it but it doesn't work because my client run some separated subprocesses and are them that contact the server so, if an extern process try to connect to 127.0.0.1:<the_found_port> while one of that subprocess has finished and the next is not yet started, it will be able to do it and also my subprocess will be pending (i tryed it). Hope i was able to explain the situation. Any suggestion? Thanks in advace > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 9 Jul 2008 13:26:03 +0200 (CEST) > From: "Pietro Di Primo" <pietro.diprimo(a)ct.infn.it> > Subject: [stunnel-users] client-server tunnelling > To: stunnel-users(a)mirt.net > Message-ID: > <2553.193.206.208.201.1215602763.squirrel(a)imapfis.ct.infn.it> > Content-Type: text/plain;charset=utf-8 > > Hi, I have a client server application, and want to tunnel it in this way: > a script select a free port in a random way, write the stunnel.conf file. > with "accept=<the_found_port>" and "connect=<my_server>" and run my client > application passing to 127.0.0.1:<the_found_port> as server address. > The problem is that i need to be sure that no other client or user can > access <the_found_port> while the application is running. > I guess that it should be possible to do it, but i wasn't able to. > > Can anybody help me? > > Thanks > > > -- > --- > > Ing. Pietro Di Primo > INFN - Istituto Nazionale di Fisica Nucleare > Grid Computing Research Area > Via S. Sofia 78 95123 CATANIA (Italy) > Voice : +39 095 378-5446/5517 > Fax. : +39 095 378 5518 > Mobile : +39 320 8591527 > E-mail : pietro.diprimo(a)ct.infn.it > Skype : pietrodiprimo > > > > ------------------------------ > > Message: 2 > Date: Wed, 9 Jul 2008 14:08:23 +0200 > From: Micha? Trojnara <Michal.Trojnara(a)mobi-com.net> > Subject: Re: [stunnel-users] client-server tunnelling > To: stunnel-users(a)mirt.net > Message-ID: <6ba9f1b703149916bb1a61fb68a1e377(a)mirt.net> > Content-Type: text/plain; charset="UTF-8" > > > Pietro Di Primo wrote: >> Hi, I have a client server application, and want to tunnel it in this > way: >> a script select a free port in a random way, write the stunnel.conf >> file. >> with "accept=<the_found_port>" and "connect=<my_server>" and run my > client >> application passing to 127.0.0.1:<the_found_port> as server address. >> The problem is that i need to be sure that no other client or user can >> access <the_found_port> while the application is running. >> I guess that it should be possible to do it, but i wasn't able to. > > Simply bind the specific network interface with: > accept=127.0.0.1:<the_found_port> > > Best regards, > Mike > > > > ------------------------------ > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > End of stunnel-users Digest, Vol 48, Issue 8 > ******************************************** > -- --- Ing. Pietro Di Primo INFN - Istituto Nazionale di Fisica Nucleare Grid Computing Research Area Via S. Sofia 78 95123 CATANIA (Italy) Voice : +39 095 378-5446/5517 Fax. : +39 095 378 5518 Mobile : +39 320 8591527 E-mail : pietro.diprimo(a)ct.infn.it Skype : pietrodiprimo

1 0

client-server tunnelling
by Pietro Di Primo 09 Jul '08

09 Jul '08

Hi, I have a client server application, and want to tunnel it in this way: a script select a free port in a random way, write the stunnel.conf file. with "accept=<the_found_port>" and "connect=<my_server>" and run my client application passing to 127.0.0.1:<the_found_port> as server address. The problem is that i need to be sure that no other client or user can access <the_found_port> while the application is running. I guess that it should be possible to do it, but i wasn't able to. Can anybody help me? Thanks -- --- Ing. Pietro Di Primo INFN - Istituto Nazionale di Fisica Nucleare Grid Computing Research Area Via S. Sofia 78 95123 CATANIA (Italy) Voice : +39 095 378-5446/5517 Fax. : +39 095 378 5518 Mobile : +39 320 8591527 E-mail : pietro.diprimo(a)ct.infn.it Skype : pietrodiprimo

1 0

FW: how to start ??
by dominique 07 Jul '08

07 Jul '08

Hello, First time I am using stunnel. 1. The issue I had is with Altiris and Exchange. All our Exchange Servers are SSL now and Altiris is not-SSL. Altiris is reading an exchange mailbox and gives back an error : "Error receiving data from socket". So the infrastructure is composed of two servers one Altiris Server not-SSL which is attempting to communicate to an Exchange Server with SSL. The Altiris Server is trying to read the email in one mailbox hosted by an Exchange SSL Server 2. Stunnel 4.25 x86-pc-mingw32-gnu with openssl 0.9.8h 28 May 2008 3. Windows 2003 Server environment 4. stunnel -d -r 5. 2008.07.07 13:34:41 LOG7[4748:1676]: RAND_status claims sufficient entropy for the PRNG 2008.07.07 13:34:41 LOG7[4748:1676]: PRNG seeded successfully 2008.07.07 13:34:41 LOG7[4748:1676]: Certificate: stunnel.pem 2008.07.07 13:34:41 LOG7[4748:1676]: Certificate loaded 2008.07.07 13:34:41 LOG7[4748:1676]: Key file: stunnel.pem 2008.07.07 13:34:41 LOG7[4748:1676]: Private key loaded 2008.07.07 13:34:41 LOG7[4748:1676]: SSL context initialized for service pop3 2008.07.07 13:34:41 LOG5[4748:1676]: stunnel 4.25 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2008.07.07 13:34:41 LOG5[4748:1676]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2008.07.07 13:34:41 LOG5[4748:3596]: No limit detected for the number of clients 2008.07.07 13:34:41 LOG7[4748:3596]: FD 284 in non-blocking mode 2008.07.07 13:34:41 LOG7[4748:3596]: SO_REUSEADDR option set on accept socket 2008.07.07 13:34:41 LOG3[4748:3596]: Error binding pop3 to 149.142.194.230:995 2008.07.07 13:34:41 LOG3[4748:3596]: bind: Can't assign requested address (WSAEADDRNOTAVAIL) (10049) 2008.07.07 13:34:41 LOG3[4748:3596]: Server is down 6. no file gcc. Thanks, Dominique Dominique_duchemin(a)hotmail.com

1 0

Using externally signed certificate with stunnel 4
by Tim Skirvin 07 Jul '08

07 Jul '08

I've got a comodo signed SSL certificate that I'm trying to use with stunnel4 to allow secure NNTP connections from a wide variety of clients. The certificate at least partially works; if I leave 'verify' off in the stunnel.conf file, then the service runs and users can connect, albeit while still having to verify the cert. But if I turn 'verify' on, then it doesn't work on *either* side. I've tried playing with CAfile and CApath without much luck. I'll attach my configuration files, the relevant pems, and some debugging information; is there something else I'm missing? I've already contacted comodo, and after several rounds of conversation they suggest I contact the list. Errors from the client side (note that I'm using a debug port here): + openssl s_client -connect news:565 -verify -debug verify depth is 0 CONNECTED(00000003) depth=2 /C=US/O=Entrust.net/OU=www.entrust.net/CPS incorp. by ref. (limits liab.)/OU=(c) 1999 Entrust.net Limited/CN=Entrust.net Secure Server Certification Authority verify error:num=19:self signed certificate in certificate chain verify return:0 6976:error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed:s3_clnt.c:951: ...and on the server, I get this: 2008.06.30 14:08:38 LOG7[10039:47679267941088]: nntps accepted FD=7 from 171.64.19.111:56122 2008.06.30 14:08:38 LOG7[10039:1073809760]: nntps started 2008.06.30 14:08:38 LOG7[10039:1073809760]: FD 7 in non-blocking mode 2008.06.30 14:08:38 LOG7[10039:1073809760]: FD 8 in non-blocking mode 2008.06.30 14:08:38 LOG7[10039:1073809760]: FD 9 in non-blocking mode 2008.06.30 14:08:38 LOG7[10039:47679267941088]: Cleaning up the signal pipe 2008.06.30 14:08:38 LOG6[10039:47679267941088]: Child process 10247 finished with code 0 2008.06.30 14:08:38 LOG7[10039:1073809760]: Connection from 171.64.19.111:56122 permitted by libwrap 2008.06.30 14:08:38 LOG5[10039:1073809760]: nntps connected from 171.64.19.111:56122 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): before/accept initialization 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): SSLv3 read client hello A 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): SSLv3 write server hello A 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): SSLv3 write certificate A 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): SSLv3 write certificate request A 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): SSLv3 flush data 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL alert (read): fatal: unknown CA 2008.06.30 14:08:38 LOG3[10039:1073809760]: SSL_accept: 14094418: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca 2008.06.30 14:08:38 LOG5[10039:1073809760]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.06.30 14:08:38 LOG7[10039:1073809760]: nntps finished (0 left) Basic Requested Information that wasn't supplied above: * stunnel 4.18-2 on Debian etch (2.6.18-6-686 #1 SMP) * Running standalone with '/usr/bin/stunnel4 /etc/news/stunnel.conf' * libc6, no gcc, OpenSSL 0.9.8c-4etch3 * The log on startup: 2008.06.30 14:00:15 LOG7[26276:3083523776]: Snagged 64 random bytes from /root/.rnd 2008.06.30 14:00:15 LOG7[26276:3083523776]: Wrote 1024 new random bytes to /root/.rnd 2008.06.30 14:00:15 LOG7[26276:3083523776]: RAND_status claims sufficient entropy for the PRNG 2008.06.30 14:00:15 LOG7[26276:3083523776]: PRNG seeded successfully 2008.06.30 14:00:15 LOG7[26276:3083523776]: Configuration SSL options: 0x01000000 2008.06.30 14:00:15 LOG7[26276:3083523776]: SSL options set: 0x01000000 2008.06.30 14:00:15 LOG7[26276:3083523776]: Certificate: /etc/ssl/certs/news-stunnel.pem 2008.06.30 14:00:15 LOG7[26276:3083523776]: Certificate loaded 2008.06.30 14:00:15 LOG7[26276:3083523776]: Key file: /etc/ssl/private/news-stunnel.key 2008.06.30 14:00:15 LOG7[26276:3083523776]: Private key loaded 2008.06.30 14:00:15 LOG7[26276:3083523776]: Loaded verify certificates from /etc/ssl/certs/comodo.cert 2008.06.30 14:00:15 LOG7[26276:3083523776]: SSL context initialized for service nntps - Tim Skirvin (tskirvin(a)stanford.edu) -- Information Technology Services http://www.stanford.edu/~tskirvin/ System Software Developer, Unix Team Stanford University

1 1

Windows setup
by Koenraad Lelong 04 Jul '08

04 Jul '08

Hello, I would like to know if it is possible to run a silent setup of the Windows-setup of stunnel. I'm including it in my own setup of my own application so I would like to avoid the interaction of the stunnel-setup. Second question is if it is bad to "install" stunnel more than once on a computer. Until now I had a setup for new installations and an update for updates of my application. This seems not to work because some users use the setup to update an existing installation and with this they run the install of stunnel for the second time. If it is bad, how do I detect the existance of stunnel, and what version it is, so I could update stunnel if it's outdated. Regards, Koenraad Lelong. P.S. If this is the wrong list for such questions I apologize. I would like to know the right list.

1 0

Re: [stunnel-users] Stunnel 4.21 99% cpu ultilization
by Fat Wallet 03 Jul '08

03 Jul '08

Hi, If anyone have a clue on what I should do to fix this issue, I would really appreciated: One of the stunnel process is running at 99% and in R state and the time just keep incrementing. [root@root]# ps auxw|grep stunnel root 781 0.0 0.0 6520 2684 ? T 11:01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 2853 0.0 0.0 3940 604 ttyp2 S+ 11:37 0:00 grep stunnel root 16554 0.0 0.0 3992 788 ? S Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 16555 0.0 0.0 3992 788 ? S Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 16556 0.0 0.0 3992 788 ? S Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 16557 0.0 0.0 3992 788 ? S Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 16558 0.0 0.0 3992 788 ? S Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 16561 0.0 0.0 6520 2684 ? Ts Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 16656 0.0 0.0 6520 2684 ? S Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 23954 0.0 0.0 6520 2684 ? S 08:00 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 23955 99.0 0.0 6520 2684 ? R 08:00 189:52 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 31521 0.0 0.0 6520 2684 ? S 10:30 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf Thanks, Mike ----- Original Message ---- From: Aron Griffis <agriffis(a)n01se.net> To: Fat Wallet <fat8wallet(a)yahoo.com> Cc: stunnel-users(a)mirt.net Sent: Monday, June 30, 2008 11:04:44 AM Subject: Re: [stunnel-users] Stunnel 4.21 99% cpu ultilization Fat Wallet wrote: [Mon Jun 30 2008, 01:28:11PM EDT] > Can someone please help with this issue? This 100% cpu > utilization issue happens randomly on multiprocess cpu. strace, ltrace, build stunnel with debugging symbols and attach gdb to the spinning process, etc. Is your name really Fat Wallet?

2 1

protect the private key, while running stunnel in server mode as a windows service
by sandeep siroya 03 Jul '08

03 Jul '08

Hi, I have stunnel in server mode running as a windows service on a Win2003 Server system. I need to give this system to a different company for testing their client against our server. How do I protect my private key on stunnel, while letting the 3rd company being able to login as administrator on stunnel's win2003 system and start/stop stunnel service? I know one can protect the private key with a passphrase in stunnel, but that does not serve my purpose as stunnel in this case should be able to start/stop without any user-intervention and I cannot store the passphrase in cleartext. thanks , ss

1 0

Peer suddenly disconnected
by victor.harutyunyan＠arca.am 02 Jul '08

02 Jul '08

Hello there, I have installed stunnel server on FreeBSD. I configure it like this cert=server_cert.pem key=private\server_key.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 verify=2 CAfile=test_cert.pem [ssl_host_proxy] accept=172.24.150.15:1234 connect=192.168.1.1:10500 TIMEOUTidle=120 Client side is not a computer it's small device. I generate client certificates in this manor: echo off del test_ck.pem /q # delete previous test.ck.pem file echo Starting New test_ck file Generation C:\OpenSSL\bin\openssl.exe req -new -x509 -newkey rsa:2048 -sha1 -out test_cert.pem -keyout test_key.pem -nodes -config sample_ck.cnf -days 1825 -batch C:\OpenSSL\bin\openssl.exe pkcs8 -in test_key.pem -topk8 -out test_pk8.pem -passout pass:"TestPassword0001" -noiter -v1 PBE-SHA1-3DES del test_key.pem /q copy test_cert.pem+test_pk8.pem test_ck.pem /y del test_pk8.pem /q Echo New test_ck.pem file has the following sections: findstr "BEGIN END" test_ck.pem pause test_cert.pem is on a stunnel server as CAfile and test_ck.pem is on my small device which is capable to connect via stunnel. And I generate other self-signed CA, and generate one certificate request and sign it via this CA, and install that key and certificate on server. cert=server_cert.pem key=private\server_key.pem All is working fine, but after one year my server certificate has expired, when I regenerate new server certificate and try to connect, I see in server log this: Child process 6094 finished with code 0 SSL state (accept): before accept initialization SSL state (accept): SSLv3 read client hello A SSL state (accept): SSLv3 write server hello A SSL state (accept): SSLv3 write certificate A SSL state (accept): SSLv3 write server done A SSL state (accept): SSLv3 flush data SSL_accept: Peer suddenly disconnected And my device can't connect to the server, I haven't any client side logs and error messages, only NOT DELIVERED in my device. :( Can you please help me to solve this problem, I am trying many many times, I was very angry.. Thank you very much. Victor Harutyunyan. P.S. Sorry for my bad english.

1 0

Peer suddenly disconnected
by victor.harutyunyan＠arca.am 02 Jul '08

02 Jul '08

Hello there, I have installed stunnel server on FreeBSD. I configure it like this cert=server_cert.pem key=private\server_key.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 verify=2 CAfile=test_cert.pem [ssl_host_proxy] accept=172.24.150.15:1234 connect=192.168.1.1:10500 TIMEOUTidle=120 Client side is not a computer it's small device. I generate client certificates in this manor: echo off del test_ck.pem /q # delete previous test.ck.pem file echo Starting New test_ck file Generation C:\OpenSSL\bin\openssl.exe req -new -x509 -newkey rsa:2048 -sha1 -out test_cert.pem -keyout test_key.pem -nodes -config sample_ck.cnf -days 1825 -batch C:\OpenSSL\bin\openssl.exe pkcs8 -in test_key.pem -topk8 -out test_pk8.pem -passout pass:"TestPassword0001" -noiter -v1 PBE-SHA1-3DES del test_key.pem /q copy test_cert.pem+test_pk8.pem test_ck.pem /y del test_pk8.pem /q Echo New test_ck.pem file has the following sections: findstr "BEGIN END" test_ck.pem pause test_cert.pem is on a stunnel server as CAfile and test_ck.pem is on my small device which is capable to connect via stunnel. And I generate other self-signed CA, and generate one certificate request and sign it via this CA, and install that key and certificate on server. cert=server_cert.pem key=private\server_key.pem All is working fine, but after one year my server certificate has expired, when I regenerate new server certificate and try to connect, I see in server log this: Child process 6094 finished with code 0 SSL state (accept): before accept initialization SSL state (accept): SSLv3 read client hello A SSL state (accept): SSLv3 write server hello A SSL state (accept): SSLv3 write certificate A SSL state (accept): SSLv3 write server done A SSL state (accept): SSLv3 flush data SSL_accept: Peer suddenly disconnected And my device can't connect to the server, I haven't any client side logs and error messages, only NOT DELIVERED in my device. :( Can you please help me to solve this problem, I am trying many many times, I was very angry.. Thank you very much. Victor Harutyunyan. P.S. Sorry for my bad english.

1 0

socket not getting closed
by Manjunath S Karikatti 02 Jul '08

02 Jul '08

Hello, We are using stunnel to wrap the tcp connetion between the our client session used by users and the server process. Due to some reason when client session terminates abruptly (either due to user's PC crash or network outage) the stunnel process does not terminate. We see that the socket on client PC is closed but stunnel process is still alive with socket for that PC in established state. This is on AIX platform. Do not know this is issue with stunnel process or something on AIX needs to be tuned (like the tcp_keepidle value). Thanks for any info and help. Thanks and Regards, Manjunath

1 0

Re: [stunnel-users] Stunnel 4.21 99% cpu ultilization
by Fat Wallet 01 Jul '08

01 Jul '08

Thanks for your reply. I was hoping to see if someone have a similar issue since there was an issue with stunnel 4.20 version. Thanks, Mike ----- Original Message ---- From: Aron Griffis <agriffis(a)n01se.net> To: Fat Wallet <fat8wallet(a)yahoo.com> Cc: stunnel-users(a)mirt.net Sent: Monday, June 30, 2008 11:04:44 AM Subject: Re: [stunnel-users] Stunnel 4.21 99% cpu ultilization Fat Wallet wrote: [Mon Jun 30 2008, 01:28:11PM EDT] > Can someone please help with this issue? This 100% cpu > utilization issue happens randomly on multiprocess cpu. strace, ltrace, build stunnel with debugging symbols and attach gdb to the spinning process, etc. Is your name really Fat Wallet?

1 0

Stunnel v4.25 vs v4.20
by James Moe 30 Jun '08

30 Jun '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, I upgraded to v4.25 and stunnel aborts right away. v4.20 works just fine. What is protocol family 47? ====[ log file ]==== 2008.06.26 11:31:01 LOG5[282:8553]: stunnel 4.25 on i386-pc-os2-emx with OpenSSL 0.9.8h 28 May 2008 2008.06.26 11:31:01 LOG5[282:8553]: Threading: SSL:ENGINE Sockets:SELECT,IPv4 2008.06.26 11:31:01 LOG3[282:8553]: Error binding pop3.sma.com_L110-R995 to 127.0.0.1:110 2008.06.26 11:31:01 LOG3[282:8553]: bind: Address family not supported by protocol family (47) ====[ conf file ]==== socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 client = yes output = G:/c/voice/pmmdev/testcase/bin/stunnel.log verify = 0 debug = 5 cert = g:/c/voice/pmmdev/testcase/bin/sma-test.pem [pop3.sma.com_L110-R995] accept = localhost:110 connect = pop3.sma.com:995 ;# protocol = pop3 [smtpauth.earthlink.net_L6025-R587] accept = localhost:6025 connect = smtpauth.earthlink.net:587 protocol = smtp [sohnen-moe.com:L6125:R587] accept = localhost:6125 connect = sohnen-moe.com:587 protocol = smtp [smtp.sma.com_L25-R587] accept = localhost:25 connect = smtp.sma.com:587 protocol = smtp - -- jimoe (at) sohnen-moe (dot) com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (OS/2) iD8DBQFIY+DkzTcr8Prq0ZMRArW+AJ4uOJFOGyluIj52DG4cM62jMPs8NACfbug2 oVsLAXJ+fH1Raj568dGn2mM= =JSCM -----END PGP SIGNATURE-----

1 1

Re: [stunnel-users] Stunnel 4.21 99% cpu ultilization
by Fat Wallet 30 Jun '08

30 Jun '08

Hi, Can someone please help with this issue? This 100% cpu utilization issue happens randomly on multiprocess cpu. Thanks! ----- Original Message ---- From: Fat Wallet <fat8wallet(a)yahoo.com> To: stunnel-users(a)mirt.net Sent: Monday, June 23, 2008 10:39:16 AM Subject: Stunnel 4.21 99% cpu ultilization Hi All, I've been googling for this issue but it seems like google is not my friend at the moment. I am running Linux with 4 cpus and top command shows stunnel at 99-100% cpu. Please help. //stunnel configuration file # PID is created inside chroot jail pid = /var/run/stunnel.pid # debug debug = 7 output = /var/log/stunnel.log # Authentication stuff verify = 2 cert = /etc/stunnel/cert.pem CAfile = /etc/stunnel/ca.pem #Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 # Use it for client mode client = yes /////////// stunnel version stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.7a Feb 19 2003 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none //openssl version OpenSSL 0.9.7a Feb 19 2003 //Redhat version Red Hat Linux release 9 (Shrike) root]#cat /proc/cpuinfo | grep processor | wc -l 4 http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

UPNP & Nat-PMP with Stunnel
by Dean Shavit 26 Jun '08

26 Jun '08

Stunnel works great for me, but with dynamic port forwarding, I've not been able to get it working. I suspect it's because stunnel is a bit confusing about which port to reply to... Anyone else found a way to crack this nut?

1 0

How do I kill stunnel?
by Grant Edwards 25 Jun '08

25 Jun '08

I've got an application that starts stunnel using equivalent of a fork/exec. The stunnel process then appears to fork off multiple copies of itself. Before the application exits, it needs to stop stunnel. I send a SIGINT to the PID that was created using the fork, but only the first "master" copy terminates -- the master stunnel process doesn't terminate its children when it exits. So I end up with a bunch of "orphaned" stunnel processes. They're not zombies, they're process that are either in state R or S (runnable or sleeping). How do I tell stunnel to not only terminate, but to terminate whatever child processes it has created? -- Grant Edwards grante Yow! Zippy's brain cells at are straining to bridge visi.com synapses ...

2 4

Stunnel config files incompatible between 4.05 and 4.21 ?
by Brian McKee 25 Jun '08

25 Jun '08

Hi All, I have a stunnel config file that works fine on an older Mandrake machine running stunnel 4.05. If I use that same config file on a new Ubuntu machine running 4.21 it just dies with "/etc/stunnel/stunnel.pem: No such file or directory" IIUC, running in client mode it doesn't need a .pem file, and I didn't create any certifcates on the Mandrake machines. Do I need to generate a cert for some reason? I've attached the config below. Brian =============================== client = yes [telnet] accept = 23 connect = some.ip.number.removed:992 [as-central] accept = 8470 connect = some.ip.number.removed:9470 [as-database] accept = 8471 connect = some.ip.number.removed:9471 [as-rmtcmd] accept = 8475 connect = some.ip.number.removed:9475

1 0

Is the "HTTP Proxy connect" feature implemented?
by alex Wright 24 Jun '08

24 Jun '08

Hey, I'm trying to use stunnel in the following scenerio: ssh-client -> stunnel (to ssl) -> Proxy -> server(ssl to ssh). I downloaded stunnel 4.25, but I hadn't noiticed any support for this. However, in the "patches" page (http://www.stunnel.org/patches/) - three patches seem to be suitable: (connect-proxy_dunbar.patch<http://www.stunnel.org/patches/patches/connect-proxy_dunbar.patch>, connect-proxy.mwald.patch<http://www.stunnel.org/patches/patches/connect-proxy.mwald.patch>) but are for version 4.05 (whichwill probably be a pain to merge with current version). When I stumbled upon the Changelog ( http://www.stunnel.org/download/ChangeLog.txt) I noticed that version 4.15, has support for "Client mode CONNECT protocol" - which is what I need - and altough i had looked hard, I haven't found any documentation to it. So, is the above feature what I want (and if so - how do I use it?) or do I need to update the patches to the current version? Thanks in advance, Alex.

1 0

Stunnel 4.21 99% cpu ultilization
by Fat Wallet 23 Jun '08

23 Jun '08

Hi All, I've been googling for this issue but it seems like google is not my friend at the moment. I am running Linux with 4 cpus and top command shows stunnel at 99-100% cpu. Please help. //stunnel configuration file # PID is created inside chroot jail pid = /var/run/stunnel.pid # debug debug = 7 output = /var/log/stunnel.log # Authentication stuff verify = 2 cert = /etc/stunnel/cert.pem CAfile = /etc/stunnel/ca.pem #Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 # Use it for client mode client = yes /////////// stunnel version stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.7a Feb 19 2003 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none //openssl version OpenSSL 0.9.7a Feb 19 2003 //Redhat version Red Hat Linux release 9 (Shrike) root]#cat /proc/cpuinfo | grep processor | wc -l 4 http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

Using Stunnel on Vista
by John Lallemand 18 Jun '08

18 Jun '08

We have a system that needs a TN3270 client and Stunnel to connect on XP. Currently, OnNet Host/Rumba is the most popular TN3270 client in use. But when we try these programs on Vista, the connection times out. 1) Is Stunnel Vista compatible? 2) If it is, does Stunnel need specific settings to work on Vista? Thank you! ------------------------------ John Lallemand Software Release Manager University of California, Santa Cruz

2 1

Problem with multiple stunnel jobs
by Carter Browne 17 Jun '08

17 Jun '08

A couple of days ago, I upgrade from 4.15 to 4.23 on a Linux system running Redhat 8. At the same time I went from openssl 0.9.8g to 0.9.8h. No changes were made to the configuration file. After the change, rather than starting a single process, it starts 6 processes. The process number of the lowest number process is the one that is put into the /var/run/stunnel.pid file. When I try to stop stunnel, using /etc/init.d/stunnel stop, the lowest number process is kill, and the highest number process seems to be running continuously - although it is not a hard cpu loop, but it keeps on accumulating run time. The number of processes may not be a new phenomenon, but the inability to kill itself is. I normally restart the stunnel on a daily basis to keep the log files manageable, but with this new behavior, the /etc/init.d/strunnel restart command fails because the ports are still in use. Any ideas on how to fix this problem. Thanks, Carter -- Carter Browne CBCS cbrowne(a)cbcs-usa.com 781-721-2890

2 1

Goldmine 8 & Advisormail SSL problems
by Stephen E. Rischall 17 Jun '08

17 Jun '08

1 0

stunnel service problems...
by Jeremy Paje 10 Jun '08

10 Jun '08

Has anyone had any problems with the windows stunnel service not starting automatically? We install stunnel as a service (stunnel.exe -install) We've had it previously installed on 600+ machines with no problems, but recently (noticed on slower machines running XP) the stunnel service does not start...but it happens randomly only on slower machines. The following errors are in the event log... Timeout (30000 milliseconds) waiting for the stunnel service to connect. (Event ID ID 7009) AND The stunnel service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. (Event ID 7000) I've tried setting the service to restart if failed, and to delay 2 minutes before restart, etc with no luck. If you start the stunnel manually all is well, it just doesn't start on bootup. Any suggestions? Thanks JP

1 0

Re: [stunnel-users] stunnel compatibility question
by Brian Hatch 09 Jun '08

09 Jun '08

Roughly around 2008-06-09 11:34 -0400, Patel Dippen-CDP054 kibitzed: > In this scenario, can Stunnel listen on the UDP port on the local No. Stunnel will not listen on UDP ports. Stunnel will not send UDP packets. Stunnel doesn't support UDP. -- Brian Hatch The problem is that you'd Systems and probably make something Security Engineer useful of my life that http://www.ifokr.org/bri/ I would never do. Every message PGP signed

2 1

Fw: Re: stunnel compatibility question
by Jeffrey Buck 06 Jun '08

06 Jun '08

1 0

Re: [stunnel-users] stunnel compatibility question
by Brian Hatch 05 Jun '08

05 Jun '08

At almost 2008-06-05 09:37 -0400, Patel Dippen-CDP054 cajoled: > I guess what I am stating is can Stunnel listen on a UDP port The answer to that question is 'no, it cannot.' -- Brian Hatch "I was looking at bringing Systems and up some new servers on Security Engineer imaginary hardware." http://www.ifokr.org/bri/ --Jason Every message PGP signed

1 0

stunnel compatibility question
by Jeffrey Buck 04 Jun '08

04 Jun '08

2 4

Re: [stunnel-users] stunnel compatibility question
by Brian Hatch 03 Jun '08

03 Jun '08

In the neigborhood of 2008-06-03 07:58 -0400, Patel Dippen-CDP054 argued: > Will Stunnel work for UDP data? Stunnel only accepts TCP connections. > We have traffic going into the Server on UDP and outbound from the Server on TCP. You'll want an actual VPN protocol to handle that then. Or consider using a better protocol - what you describe makes the firewalls cry. > My understanding is that OpenSSL implemented the DTLS protocol (TFC > 4347: to support UDP data) in version 0.9.8 (OpenSSL: a free and popular > implementation of TLS added support for DTLS with version 0.9.8.) Not supported in Stunnel currently. -- Brian Hatch Always yield to temptation, Systems and because it may not pass Security Engineer your way again. http://www.ifokr.org/bri/ Every message PGP signed

1 0

Is anyone using Stunnel for tunnelling Voip?
by Errol Samuels 03 Jun '08

03 Jun '08

Hello All, I am currently researching a solution for tunnelling VoIP traffic since VoIP is blocked in the country concerned. It appears that the ISP is targeting OpenVPN and OpenSwan and blocking them so I want to try something different. My solution based on OpenVPN worked great until it got blocked by the ISP about a week ago. It was using an OpenVPN server hosted in a US Datacenter and the VPN clients were simply routers with third party Linux firmware with the OpenVPN client embedded in the firmware. I am also investigating the possibility of tunnelling OpenVPN through SSH but I have to watch my IP overheads here because the ISP watches the upload bandwidth as well! Has anyone attempted or had any success using stunnel for a similar scenario as I have mentioned? Thanks in Advance Regards, Errol

3 9

Can I put an accept+connect pair anywhere in the conf file?
by Ben Stover 02 Jun '08

02 Jun '08

The *.conf file is divided into several sections: [imaps] .... [pop3s] .... [smtps] ..... Are these "section headers" just comments and can I put my accept+connect pair on an arbitrary place in the *.conf file (as long as they are preceeded by their own section header [foobar] ? Ben

2 1

Connecting to mySQL from Windows
by Alistair Scott 02 Jun '08

02 Jun '08

Hi everyone I have a mySQL database that I need to connect to through SSH. I have successfully setup a connection to it using Plink. However, I'm running this from a batch file and I'd like a more elegant solution - that's where stunnel comes in I think. Rather than running a batch file, I'd like to run the connection as a Windows service - which I think this is achievable with stunnel. Trouble is, I can't work out how to do it. This is what I'm trying to achieve... Windows computer connects to mySQL server through SSH. Forwards a port to the mySQL server port 3306. Application on Windows computer connects to local forwarded port & therefore connects to the mySQL db at the remote end. I was hoping that someone could give me a pointer as to how I can set this up. Thanks in advance. Al

1 0

stunnel 4.25 released
by Michal Trojnara 01 Jun '08

01 Jun '08

Dear Users, Version 4.25, 2008.06.01, urgency: MEDIUM: * New features - Win32 DLLs for OpenSSL 0.9.8h. * Bugfixes - Spawning libwrap processes delayed until privileges are dropped. - Compilation fix for systems without struct msghdr.msg_control. Home page/download: http://stunnel.mirt.net/ sha1sum for stunnel-4.24.tar.gz file: fc6d61fad996f750c76ea627c5dd9f789af0eaf6 Best regards, Mike

1 0

Re: [stunnel-users] stunnel compatibility question
by Brian Hatch 30 May '08

30 May '08

Right around 2008-05-30 13:51 -0400, Patel Dippen-CDP054 suggested: > Is the true? I have a similar issue. I have never implemented SSL or > Stunnel. But, on whatever readup I have done so far, it seems Stunnel is > a tunneling protocol (IPnIP). So, you do have to have Stunnel on the > other end to extract the IP packet. Stunnel puts data inside SSL, inside TCP. Just like HTTPS is HTTP (data) inside SSL, inside TCP. You can think of the cleartext data inside the SSL tunnel for both of those examples. Yes, the data needs to be extracted from the SSL stream in both cases, but the application that gets it doesn't need to know diddly about it. > I mean if you are saying it will work, that's great news for me. It works if Stunnel is on one side and an SSL client or server is on the other side. > Our Server will have OpenSSL implementation but we plan to deploy > Stunnel on the Client machine. That's what Stunnel is for. -- Brian Hatch "Sorry, sorry, Systems and sorry, much apologizings." Security Engineer http://www.ifokr.org/bri/ Every message PGP signed

1 0

Need class name for stunnel
by Bill Murphy 28 May '08

28 May '08

I'm using stunnel to send and receive emails in a Microsoft Access 2007 application. I would like to be able to programmatically close stunnel when the user exits a form in the application which is used for sending and receiving emails. I can close other programs running in Windows with the code in this api: http://www.mvps.org/access/api/api0025.htm This code requires the "class name" of the application while it is running in Windows in order to close it. Stunnel.exe does not appear to have a class name. I've used the following additional api to display the class names of all currently running apps: http://www.mvps.org/access/api/api0013.htm Stunnel.exe does not show up in the list of running apps produced by this code. Is there another way to determine the stunnel class name? Bill

1 0

Re: [stunnel-users] Problem with Stunnel and OpenBSD
by Juan J. Martínez 23 May '08

23 May '08

Hello, I'm debugging with openssl s_client... >From inside the box: $ openssl s_client -connect blackshell.usebox.net:995 CONNECTED(00000004) depth=0 /C=ES/ST=Valencia/L=Valencia/O=usebox.net/OU=blackshell/CN=blackshell.usebox.net verify error:num=18:self signed certificate verify return:1 depth=0 /C=ES/ST=Valencia/L=Valencia/O=usebox.net/OU=blackshell/CN=blackshell.usebox.net verify return:1 ... And works fine. >From outside: $ openssl s_client -connect blackshell.usebox.net:995 CONNECTED(00000003) (and halts for n minutes) I hope this helps, even I don't know the difference between "CONNECTED(00...4)" and "CONNECTED(00...3)". Regards, Juanjo -- desarrollo y sistemas: http://www.usebox.net/ página personal: http://www.usebox.net/jjm/

1 1

STUNNEL: Thunderbird with Exchange and only inbound port 443
by Fatma 23 May '08

23 May '08

Hello All, A quick question regarding the stunnel ability to work with the following scenario. Scenario is: I have an Exchange Server sitting on the external perimeter with Outlook Web Access (OWA) enabled and it is the frontend and backend mail server as well. And I have a remote client which has a Thunderbird Client (for example) that I need it to connect to the Exchange Server to retrieve emails. The only inbound port to the Exchange Server from a network perspective is HTTPS-443 and no other ports are open on the firewall. Now the question is how can a client thunderbird connect to the Exchange Server/OWA with only 443 port open. So what i was thinking is and tell me if this works? If i install two instances of STUNNEL one on the remote client and one on the exchange server and the following happens. on the client the stunnel listens on port 25 SMTP and encrypts and forwards to port 443 then the server recieves and listens on port 443 and decrypts and forwards to port 110 POP3 will that work actually? hmmm i wish i explained that pretty well. if not then how can it work with the given scenario. cheerz.

1 0

Re: [stunnel-users] Wrapping a mail client - multiple servers
by Ludolf Holzheid 21 May '08

21 May '08

On Wed, 2008-05-21 14:39:42 +0100, Daniel James wrote: > [..] > > Can I, for example, put multiple [SSMTP] sections and multiple [POP3S] > sections in one stunnel.conf? I don't know. But if you can, you don't want to. The section headers don't specify a protocol. They simply give the section a name (for log output, e.g.). There is no problem in naming sections [first-POP3S] and [second-POP3S]. HTH, Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Wrapping a mail client - multiple servers
by Daniel James 21 May '08

21 May '08

I use a mail client that does not directly support SSL. I can use stunnel to provide the security layer when I connect to a SSMTP and/or POP3S server (under windows). This works fine, whether I run stunnel as a background application or as a Windows service. I'd like, however, to be able to connect to multiple mail servers over SSL. I'm not sure how I might achieve this? What would be nice would be get stunnel to forward POP3/SMTP communication on different local ports to POP3S/SSMTP on different remote servers. Can I do this? It appears to be possible to run multiple copies of stunnel as applications, and to get each copy to take its configuration from a different stunnel.conf file, so that different copies of stunnel could listen on different local ports and each could proxy the traffic it receives to a different remote server (I haven't tried this -- and it's not an ideal solution -- but it looks as though it should work). It does not appear to be possible, however, to create two instances of the stunnel service running with different configuration files. Is it possible to set up multiple listening ports proxying to different remote servers in a single configuration file? If so, what's the syntax for that? Cheers, Daniel.

1 0

Stunnel 4 Multiple Processes on Ubuntu 8.04
by Armen Ayvazian 19 May '08

19 May '08

Greetings. I'm running the stock stunnel 4.21 on Ubuntu 8.04 (version and configs listed below) as a stand-alone daemon to pass connections between ssl-enabled SMTP, POP3, and IMAP clients and their respective servers, which run on the same machine as stunnel. In previous instances of Stunnel (v4.15) I've managed to successfully get the daemon to switch to a non-root user and use only a single process. I now find, however, that I get 6 processes and 5 continue to run as root with only one (albeit the one listening on the specified sockets) switching down to the specified user. Does anyone have any idea why I both can't set uid/gid and why I've now got so many processes? # ps aux | grep stunnel root 22702 0.0 0.1 3604 428 pts/1 S 11:24 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf root 22703 0.0 0.1 3604 428 pts/1 S 11:24 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf root 22704 0.0 0.1 3604 428 pts/1 S 11:24 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf root 22705 0.0 0.1 3604 428 pts/1 S 11:24 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf root 22706 0.0 0.1 3604 428 pts/1 S 11:24 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf stunnel4 22707 0.0 0.2 3720 932 ? Ss 11:24 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf # lsof -i | grep stunnel stunnel4 22707 stunnel4 11u IPv4 55934 TCP emily:pop3s (LISTEN) stunnel4 22707 stunnel4 12u IPv4 55935 TCP emily:imaps (LISTEN) stunnel4 22707 stunnel4 13u IPv4 55936 TCP emily:ssmtp (LISTEN) I'm invoking stunnel simply as /usr/sbin/stunnel4 /etc/stunnel4/stunnel.conf: cert = /etc/stunnel/stunnel.pem sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [pop3s] accept = 64.5.53.172:995 connect = 64.5.53.172:110 [imaps] accept = 64.5.53.172:993 connect = 64.5.53.172:143 [ssmtp] accept = 64.5.53.172:465 connect = 64.5.53.172:25 Version Info: stunnel 4.21 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none

1 0

stunnel and OCSP verification: strange behaviour
by Andreas Ntaflos 19 May '08

19 May '08

Hi list, [My apologies, I accidentally tried to send this message to stunnel-announce earlier.] I have a quick question regarding the use of stunnel with verification against an OCSP responder. I am using stunnel 4.20 and (for testing) 4.23 but I don't see any difference in the behaviour of both. The main problem is that stunnel accepts and establishes connections from clients even if those clients had their certificates revoked and the OCSP responder correctly informs stunnel about it. Consider the following configuration: foreground = yes CAfile = /path/to/cacert.pem cert = /path/to/stunnel_cert.pem key = /path/to/stunnel_key.pem debug = 7 [clientauth] accept = localhost:43434 connect = localhost:43433 verify = 2 OCSP = http://localhost:43435 The OCSP responder runs on localhost:43435 as you can see. Client verification is enabled. Using openssl to manually check against the responder works fine: openssl ocsp -issuer cacert.pem -CAfile cacert.pem -url \ http://localhost:43435 -cert revoked_cert.pem Response verify OK /path/to/revoked_cert.pem: revoked This Update: May 15 15:38:46 2008 GMT Next Update: May 15 17:04:32 2008 GMT Revocation Time: May 15 15:38:26 2008 GMT The relevant portion of stunnel's debug output looks like this: [...] Starting OCSP verification FD 8 in non-blocking mode connect_wait: waiting 10 seconds connect_wait: connected OCSP server connected FD 8 in blocking mode FD 8 in non-blocking mode OCSP response received OCSP verification passed: status=0, reason=-1208427072 VERIFY OK: depth=1, /CN=The CA/C=AT/ST=SomeState/L=SomeCity/O=The \ Organisation/emailAddress=camaster(a)the-organisation.invalid Starting OCSP verification FD 8 in non-blocking mode connect_wait: waiting 10 seconds connect_wait: connected OCSP server connected FD 8 in blocking mode FD 8 in non-blocking mode OCSP response received OCSP verification passed: status=1, reason=-1 VERIFY OK: depth=0, /C=AT/ST=SomeState/O=The Organisation/CN=this is a \ revoked cert SSL state (accept): SSLv3 read client certificate A [...] As far as I can see the OCSP verification works fine here, too, and at depth 0 stunnel finds the certificate to have been revoked (status=1 indicates that, I believe). The connection, however, is not rejected. Is there any way to have stunnel reject the connection when the client certificate has been revoked? Where would I configure this? The only way I have found yet was to patch src/verify.c but surely there must be a more convenient approach to this? On a related matter: if stunnel cannot and will not reject the connection upon a negative response from the OCSP, what would be the best way to script stunnel so that it rejects such a connection? I am asking because I am in the process of writing a few Python scripts that incorporate stunnel to aid in testing of some SSL-speaking components. Such a client component without a valid, non-revoked certificate must not be able to connect. I mean what good is OCSP verification if the result of the process, i.e. the responders answer "the certificate is valid" or "the certificate is no longer valid" doesn't matter to stunnel? Am I missing the point somewhere? I'd appreciate any insights on this. Kind regards, Andreas -- Andreas "daff" Ntaflos Vienna, Austria GPG Fingerprint: 6234 2E8E 5C81 C6CB E5EC 7E65 397C E2A8 090C A9B4

2 2

Reg:IPV6 support on stunnel
by Sandhya 15 May '08

15 May '08

> Stunnel version: > stunnel 4.09 on armv5tejl-unknown-linux-gnu PTHREAD+POLL+IPv6+LIBWRAP with > OpenSSL 0.9.7e 25 Oct 2004 > > My conf file Information: > cert = /usr/local/www/certs/server.pem > key = /usr/local/www/certs/privkey-server.pem > pid = /var/run/stunnel_kvm.pid > client = no > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > socket = a:TCP_NODELAY=1 > [ms] > accept = 1234 > connect = 1236 > > Please find the Config.log file attached. > > Please let me know if any other information is needed or you want me try > some commands on stunnel. > > Thanks for the help > > Sandhya R > > ----- Original Message ----- > From: "Michal Trojnara" <Michal.Trojnara(a)mobi-com.net> > To: <stunnel-users(a)mirt.net> > Sent: Wednesday, May 14, 2008 7:06 PM > Subject: Re: [stunnel-users] Reg:IPV6 support on stunnel > > >> >> Sandhya wrote: >> >>> I have enabled IPV6 ip When my client tries to connect to my ipv6 ip and >>> the port(stunnel listens) where my it is listening...Its failed to >>> connect. >> >> Please send us: >> - the output of "stunnel -version", >> - your stunnel.conf file, >> - your debug level logs. >> >> Best regards, >> Mike >> >> _______________________________________________ >> stunnel-users mailing list >> stunnel-users(a)mirt.net >> http://stunnel.mirt.net/mailman/listinfo/stunnel-users >> >

1 1

Fw: Reg:IPV6 support on stunnel
by Sandhya 14 May '08

14 May '08

----- Original Message ----- From: Sandhya To: stunnel-users(a)mirt.net Sent: Wednesday, May 14, 2008 6:43 PM Subject: [stunnel-users] Reg:IPV6 support on stunnel Hi, I am newbie to stunnel.As mentioned in some of your posts i just gone through ..how to enable ipv6 support. While configuring i did the same by giving the following command. ./configure --enable-ipv6 make make install and i ran stunnel which listens at some port and i have my own server which listens for stunnel. I have enabled IPV6 ip When my client tries to connect to my ipv6 ip and the port(stunnel listens) where my it is listening...Its failed to connect. Could you please throw some light on how to enable IPV6 support for stunnel apart from what i tried. Thanks in advance Sandhya -------------------------------------------------------------------------------- _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

Reg:IPV6 support on stunnel
by Sandhya 14 May '08

14 May '08

Hi, I am newbie to stunnel.As mentioned in some of your posts i just gone through ..how to enable ipv6 support. While configuring i did the same by giving the following command. ./configure --enable-ipv6 make make install and i ran stunnel which listens at some port and i have my own server which listens for stunnel. I have enabled IPV6 ip When my client tries to connect to my ipv6 ip and the port(stunnel listens) where my it is listening...Its failed to connect. Could you please throw some light on how to enable IPV6 support for stunnel apart from what i tried. Thanks in advance Sandhya

1 0

Reg:IPV6 support on stunnel
by Sandhya 13 May '08

13 May '08

Hi, I am newbie to stunnel.As mentioned in some of your posts i just gone through ..how to enable ipv6 support. While configuring i did the same by giving the following command. ./configure --enable-ipv6 make make install and i ran stunnel which listens at some port and i have my own server which listens for stunnel. I have enabled IPV6 ip When my client tries to connect to my ipv6 ip and the port(stunnel listens) where my it is listening...Its failed to connect. Could you please throw some light on how to enable IPV6 support for stunnel apart from what i tried. Thanks in advance Sandhya

1 0

Re: [stunnel-users] HTTPS connections aborted
by Matthias Kellermann 09 May '08

09 May '08

Hi Aleksandar, Aleksandar Lazic wrote: > The timing events at 6st position. > > http://haproxy.1wt.eu/download/1.3/doc/haproxy-en.txt > > > --- > 4.2.3) Timing events > -------------------- > . > . > . > > Other cases ('xx' means any value to be ignored) : > -1/xx/xx/xx/Tt: the client was not able to send its complete request > in time, > or that it aborted it too early. > Tq/-1/xx/xx/Tt: it was not possible to process the request, maybe because > servers were out of order. > Tq/Tw/-1/xx/Tt: the connection could not establish on the server. > Either it > refused it or it timed out after Tt-(Tq+Tw) ms. > Tq/Tw/Tc/-1/Tt: the server has accepted the connection but did not > return a > complete response in time, or it closed its connexion > unexpectedly, after Tt-(Tq+Tw+Tc) ms. thanks, I'll have a look at it. -Matthias

1 0

Feature request - verify fall-back
by Sudhaker Raj 09 May '08

09 May '08

Hi Team, I wish to use stunnel for following use-case (to create a highly-protected website which can be accessed only using a valid client-cert). gateway.example.com:443 -> public.example.com:80 (when client-cert verification fails) gateway.example.com:443 -> intranet.example.com:80 (when client-cert verification ok - normally hidden from public) As of now stunnel simply drops the connection when service is configured to verify the client certificate and verification fails. Is it possible to add a fall-back connect when verification fails. [protected-web] verify=3 accept=443 connect=intranet.example.com:80 noverify=public.example.com:80 I guess it will be a nice addition to stunnel's feature list. Thanks, Sudhaker

3 3

launch stunnel server daemon from php?
by Wesley Kenzie 05 May '08

05 May '08

I am having problems launching stunnel from a php "exec" command. I would like to have it launch as a server daemon and then have the exec command return control to the php script. The best I have been able to do is launch it in foreground with a command like "/usr/local/bin/stunnel /etc/stunnel/test.conf &" but control never returns to the php script. I do not want to use inetd mode, and would prefer to specify command line arguments, but I see they are no longer available in version 4. Any ideas? . . . . . Wesley Kenzie wkenzie(a)gmail.com

2 2

HTTPS connections aborted
by Matthias Kellermann 05 May '08

05 May '08

Hi list, I've set up a loadbalancer with haproxy and I'm using stunnel to have HTTPS on the loadbalancer. Every connection on port 443 is forwarded by stunnel to port 80 where haproxy listens. Some facts: FreeBSD 6.2 i386 stunnel 4.22 OpenSSL 0.9.7e-p1 gcc version 3.4.6 [FreeBSD] 20060305 Here is my stunnel.conf: sslVersion = all chroot = /var/tmp/stunnel setuid = stunnel setgid = nogroup pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 3 [https] cert = /usr/local/etc/stunnel/ssl/mycert.pem accept=localip:443 connect=localip:80 Some of my customers using HTTPS are claiming about aborted connections with MS Internet Explorer. They get a message about "secure and unsecure objects on this site, proceed?". When clicking yes they get a IE error message: "site not found". (Sorry, I don't know the exact english error message because customers use german version of IE). Of course there are only HTTPS objects on the page. In my logs I've lot of these entries: SSL_accept: Peer suddenly disconnected From time to time I'll get this error: SSL_read: Connection reset by peer (54) or: SSL_read: Operation timed out (60) or: SSL_write: Broken pipe (32) At the moment I have no idea where these errors come from and if they really belong to the error the customer gets with his IE browser. Any ideas what could cause these error messages? Thanks in advance, Matthias

2 1

Stunnel <=> p2p
by mluft 05 May '08

05 May '08

Hi, i just started working with stunnel, and i'm really impressed! But i've got 2 questions: * How is it realized, that a setup like this: accept = 15000 connect = 16000 also encrypts the reply of the app which listens on port 16000? Is there a kind of masquerading? * I think of a tool like tsocks or socksify: "tsocks application" redirects all traffic from application over an socks proxy. Is it possible to realize such a redirection with stunnel? So that all outgoing traffic of an application gets encrypted? I know that i can build point-to-point tunnels, but that's not possible for my scenario... Thanks & Cheers, Matthias

1 0

Stunnel 4.23 xforwardfor patch
by Rene Plattner 05 May '08

05 May '08

Dear stunnel users! I noticed that the xforwardfor patch does not work any more on version > 4.20! This is due an function renaming in stunnel! After adding xforwardfor patch for version 4.20 see options.c: Simply replace log_raw(...); to s_log(LOG_RAW,...); chears, -- Dipl.-Ing. Rene' Plattner Zentraler Informatikdienst (ZID) Universität Innsbruck, Österreich Technikerstr. 13 A-6020 Innsbruck Tel: ++43512/507-2360 Fax: ++43512/507-2944

1 0

Can stunnel be configured to listen for multiple IP addresses and access different email hosts?
by F Boyd Crow 03 May '08

03 May '08

I have attempted to use stunnel to retrieve POP3 SSL mail from two different ISPs: pop.att.yahoo.com and pop.gmail.com. I have tried putting in separate Access/Connect line pairs under [pop3s] either point to the different ports on 127.0.0.1 whch is an Exchange Server 2003 machine. I have tried pointing both to the same port. In either case, the first POP3 host is accessed but not the second. I have also tried one Access line and two separate connects. It works fine with one Access line and one Connect line but a previous post on this subject indicated I should be able to do retrievals from two separate sites and I do not see how. I am using the POP3 Connection Manager on Small Business Server 2003. I set the email server to 127.0.0.1 and use port 9995. The corresponding section of the stunnel.conf file is client = yes debug = 7 ; Service-level configuration [pop3s] accept = 9995 connect = pop.gmail.com:995 ;does not work with two separate pop3s, either with two separate accept ports or one common final comment is my own. Has anyone successfully accessed mail from two POP3 servers through stunnel or have any suggestions? Boyd

1 0

stunnel 4.23 released
by Michal Trojnara 03 May '08

03 May '08

Dear Users, I have just released a new version of stunnel. Please find below the ChangeLog entry: Version 4.23, 2008.05.03, urgency: HIGH: * Bugfixes - Local privilege escalation bug on Windows NT based systems fixed. A local user could exploit stunnel running as a service to gain localsystem privileges. Home page/download: http://stunnel.mirt.net/ sha1sum for stunnel-4.23.tar.gz file: d0fef8b518a44b9623692381a53680e0b4b01686 Best regards, Mike

1 0

Re: [stunnel-users] launch stunnel server daemon from php?
by Wesley Kenzie 02 May '08

02 May '08

No, that does not work either. I can get stunnel to start fine outside of php, but not as an exec or shell_exec from within a running script, or even from within php -a interactively. I can get other programs to work fine this way, so it is specific to the stunnel executable as best I can tell. I have tried running various forms of bash scripts too, but none do any better. Ideas? . . . . . Wesley On Fri, May 2, 2008 at 12:52 PM, Ludolf Holzheid < lholzheid(a)bihl-wiedemann.de> wrote: > On Fri, 2008-05-02 12:32:19 -0700, Wesley Kenzie wrote: > > Yes. Without this stunnel would not launch. With foreground = no and > with > > the trailing & on the command line I got it to launch, but still control > > will not return to my php script ... > > > > . . . . . > > Wesley > > > > On Fri, May 2, 2008 at 12:29 PM, Ludolf Holzheid < > > lholzheid(a)bihl-wiedemann.de> wrote: > > > > > On Fri, 2008-05-02 12:19:38 -0700, Wesley Kenzie wrote: > > > > I am having problems launching stunnel from a php "exec" command. I > > > would > > > > like to have it launch as a server daemon and then have the exec > command > > > > return control to the php script. > > > > > > Did you try to specify ``foreground = no'' in the configuration file? > > Wesley, > > I must confess that I don't know php and its `exec' command. There > must be something special about it. > > I would try to start a shell, which starts stunnel, which, in turn, > detaches itself to the background (i.e. something like "/bin/sh -c > '/usr/local/bin/stunnel /etc/stunnel/test.conf'"). So that the process > started by `exec' finishes and hopefully control returns to php. > > hth, > > Ludolf > > -- > > A: Because it messes up the order in which people normally read text. > Q: Why is top-posting such a bad thing? > A: Top-posting. > Q: What is the most annoying thing in e-mail? >

1 0

Re: [stunnel-users] launch stunnel server daemon from php?
by Wesley Kenzie 02 May '08

02 May '08

Yes. Without this stunnel would not launch. With foreground = no and with the trailing & on the command line I got it to launch, but still control will not return to my php script ... . . . . . Wesley On Fri, May 2, 2008 at 12:29 PM, Ludolf Holzheid < lholzheid(a)bihl-wiedemann.de> wrote: > On Fri, 2008-05-02 12:19:38 -0700, Wesley Kenzie wrote: > > I am having problems launching stunnel from a php "exec" command. I > would > > like to have it launch as a server daemon and then have the exec command > > return control to the php script. > > Did you try to specify ``foreground = no'' in the configuration file? > > Ludolf > > -- > > --------------------------------------------------------------- > Ludolf Holzheid Tel: +49 621 339960 > Bihl+Wiedemann GmbH Fax: +49 621 3392239 > Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de > D-68199 Mannheim, Germany > --------------------------------------------------------------- >

1 0

Verify=3 restart needed ?
by Edouard Dessioux 30 Apr '08

30 Apr '08

Hi everyone, Sorry for the repost, but in the web mailing list, my previous message appears weird, so I thought I could re-post it. I'm using stunnel v4.16 on a Windows 2003 Server, and I'm working with stunnel in verify=3 mode. I wanted to know if the stunnel needs to be restarted after a certificates has been removed ? If not, how long is the certificate considered valid after the file has been removed ? Regards, Edouard DESSIOUX Directeur de Projets Tibco Mobile 3, rue Danton - 92240 Malakoff Tél : +33 (0)1 55 58 04 59 - Fax : +33 (0)1 55 58 03 89 - Mob. +33 (0)6 34 02 61 54 E-mail : edessioux(a)tibco.fr - www.tibcomobile.fr Faites un geste pour la planète, n'imprimez ce message que si nécessaire.

3 3

to use certificate and key file in another machine
by Xiaoming Dong 29 Apr '08

29 Apr '08

Stunnel Version 4.2.1 Run in windows 2k3 When I configured stunnel to use cert from another windows machine (I already mapped the drive to this machine). Restarting stunnel got following error: 2008.04.29 10:01:32 LOG7[3568:1792]: Snagged 64 random bytes from C:/.rnd 2008.04.29 10:01:32 LOG7[3568:1792]: Wrote 1024 new random bytes to C:/.rnd 2008.04.29 10:01:32 LOG7[3568:1792]: RAND_status claims sufficient entropy for the PRNG 2008.04.29 10:01:32 LOG7[3568:1792]: PRNG seeded successfully 2008.04.29 10:01:32 LOG3[3568:1792]: V:\Program Files\client_cert\private\client_key.pem: No such process (3) 2008.04.29 10:01:32 LOG3[3568:1792]: Server is down Does anybody have any clue? Thanks, -Xiaoming ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

1 0

Will fwknop work?
by richard.woodman＠cox.net 29 Apr '08

29 Apr '08

If I understand the question correctly, isn't this what "port knocking" or single packet authorization (e.g. fwknop) is supposed to do? I have used fwknop and SSH in our lab, but only with Linux and iptables. However, I think fwknop is supposed to interface with more than just iptables on the local box (meaning you would not have to use a Linux box to replace your current firewall). I think you can use fwknop to monitor syslog and parse for specific events and then open the port. In other words, your current firewall reports to your syslog server and fwknop parses the log file for the security event associated with the reception of a SPA packet on your outside interface. Fwknop then sends your firewall (through a script?) whatever command is required to open the port you want and redirect it to the appropriate inside machine (or you could simply enable / disable a preconfigured rule). I am not a scripting guru so I may be WAY off base here and if I am, I apologize for leading you astray. Anyway, you might want to check out the following: http://cipherdyne.org/fwknop/ --> FireWall KNock Operator home page http://fwknop.darwinports.com/ --> OS X fwknop client There is also a Windows UI version that is supposed to create SPA packets without using fwknop / PERL or running under Cygwin but I have not used that. Richard On 4/29/08 7:50 PM, "jz(a)ellingtongeologic.com" <jz(a)ellingtongeologic.com> wrote: > > Good Morning Mike: > > I had a question and sent to the list (it might have not gone thru) The > question was that: is it possible for stunnel to go to the router, for > example, 10.10.1.1, to scan for a port of interest and see whether there is a > request thru that port? so the nat router would not have to forward the port > to the stunnel of my local machine, e.g. 10.10.1.188, on which stunnel is > listening for port 8888 and will relay it to 5631 of the local program. > > Thanks

1 0

how to enable TLS?
by Zhang Weiwu 26 Apr '08

26 Apr '08

Dear all I just configured stunnel for pop+ssl which works fine. What I want is actually smtp+tls. Is there a way to do so? I tried to configure thunderbird to access the port stunnel is listening to, with TLS. Then I got "Connectioin to xxx.xxx.xxx timed out". Best regards -- Real Softservice Huateng Tower, Unit 1788 Jia 302 3rd area of Jinsong, Chao Yang Tel: +86 (10) 8773 0650 ext 603 Mobile: 135 9950 2413 http://www.realss.com

1 0

Query regarding stunnel performance
by Arati.Kumar＠ubs.com 25 Apr '08

25 Apr '08

Hi, Does anyone know if there are any known issue with stunnel 4.05 and oracle 10g (especially in retrieving blobs) ? . Our application uses stunnel to communicate with oracle database. We are currently experiencing massive performance degradation after upgrading oracle from 9i to 10g (almost 6 times slower from what it was in 9i). Our application stores some data in blobs this seems to be the root cause of slower performance. Pls can someone let me know if there are any known issues with stunnel and 10g blob retrieving ? Also If an upgrade is recommended, which is the stable version we must be switching to? Thanks, Ararti Visit our website at http://www.ubs.com This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. E-mails are not encrypted and cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message which arise as a result of e-mail transmission. If verification is required please request a hard-copy version. This message is provided for informational purposes and should not be construed as a solicitation or offer to buy or sell any securities or related financial instruments. UBS Limited is a company registered in England & Wales under company number 2035362, whose registered office is at 1 Finsbury Avenue, London, EC2M 2PP, United Kingdom. UBS AG (London Branch) is registered as a branch of a foreign company under number BR004507, whose registered office is at 1 Finsbury Avenue, London, EC2M 2PP, United Kingdom. UBS Clearing and Execution Services Limited is a company registered in England & Wales under company number 03123037, whose registered office is at 1 Finsbury Avenue, London, EC2M 2PP, United Kingdom.

1 0

Linux FIPS compile libary question
by Joe Kemp 23 Apr '08

23 Apr '08

I am compiling stunnel on Centos 5 that has a regular Openssl 0.9.8b rpm installed. I have put my FIPS openssl in /usr/local/sslfips112. Configure with: ./configure --with-ssl=/usr/local/sslfips112 --enable-fips --disable-libwrap Make's linker line: /bin/sh ../libtool --tag=CC --mode=link FIPSLD_CC=gcc /usr/local/sslfips112/bin/fipsld -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/local/sslfips112/include -lldap -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o auth.o pty.o libwrap.o -lz -ldl -lutil -lnsl -lpthread -L/usr/local/sslfips112/lib -lssl -lcrypto FIPSLD_CC=gcc /usr/local/sslfips112/bin/fipsld -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/local/sslfips112/include -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o auth.o pty.o libwrap.o -lldap -lz -ldl -lutil -lnsl -lpthread -L/usr/local/sslfips112/lib -lssl -lcrypto This builds a stunnel that seems to run fine. During startup it says "stunnel is in FIPS mode." But if I run "ldd stunnel" it shows it needs /lib/libssl.so.6. While stunnel is running lsof shows it has that library open also. Why does my FIPS stunnel build still use the 0.9.8b shared library? Shouldn't all of the ssl dependencies been handled by the static FIPS openssl library during linking? The same issue exists for libcrypt.

4 6

stunnel wildcard question
by neve_capricorn＠gmx.de 17 Apr '08

17 Apr '08

hi, iam pulling my hair out with an wildcard ssl certificate / stunnel configuration. i use stunnel 4.2.2 and latest openSSL release. i have a signed wildcard certificate from comodo. when i add the .crt, .key and .ca-bundle file into an apache configuration, everything work fine in firefox and ie. when i try to use stunnel with the same certificates i got problems in firefox when i disable ; Authentication stuff ; verify =1 and when i set verify=1 i got problems in IE .7 (a dialog box pops and ask for identification the certificates). can someone maybe help me out,please? a demo is here: https://ssl1.medialib.de (works fine in firefox) https://ssl1.medialib.de (problem in IE7) thank you very much & best gary

1 0

Verify=3 cache expiration
by Edouard Dessioux 16 Apr '08

16 Apr '08

Hi everyone, I'm using stunnel v4.16 on a Windows 2003 Server, and I'm working with stunnel in verify=3 mode. I wanted to know if the stunnel needs to be restarted after a certificates has been removed ? If not, how long is the cache expiration delay before being taken into account ? Regards, Edouard DESSIOUX Directeur de Projets Tibco Mobile 3, rue Danton - 92240 Malakoff Tél : +33 (0)1 55 58 04 59 - Fax : +33 (0)1 55 58 03 89 - Mob. +33 (0)6 34 02 61 54 E-mail : edessioux(a)tibco.fr - www.tibcomobile.fr Faites un geste pour la planète, n'imprimez ce message que si nécessaire.

1 0

SCM repo?
by Alberto Giménez 12 Apr '08

12 Apr '08

Hello, Is there any public SCM (SVN, GIT, whatever) repository? I haven't seen anything on the website and I'd like to try to implement a new feature. Thanks in advance. -- Alberto Giménez

2 1

Stunnel 4.22 compiling issues on Solaris 10
by cod3fr3ak 09 Apr '08

09 Apr '08

I have sucessfully compiled Stunnel 4.22 on Solaris 10, but still recieve the sam errors during the configure. Initially I tried using Openssl-0.9.8f from Sun Freeware. Then I built and compiled Openssl-0.9.8g, but I still recieved the following errors on the build: configure: **************************************** SSL checking for SSL directory... /usr/local/ssl checking for obsolete RSAref library... no checking /usr/local/ssl/include/openssl/engine.h usability... yes checking /usr/local/ssl/include/openssl/engine.h presence... no configure: WARNING: /usr/local/ssl/include/openssl/engine.h: accepted by the compiler, rejected by the preprocessor! configure: WARNING: /usr/local/ssl/include/openssl/engine.h: proceeding with the compiler's result checking for /usr/local/ssl/include/openssl/engine.h... yes <ftp://ftp.sunfreeware.com/pub/freeware/sparc/10/openssl-0.9.8f-sol10-sparc-…>

1 0

Using stunnel + haproxy for SSL support
by Alberto Giménez 04 Apr '08

04 Apr '08

Hi, I'm having trouble using stunnel and haproxy to load balance https and http traffic. To be honest, I really don't know wether it is stunnel or haproxy related so I am going to contact both lists :) I have set up a haproxy load balancer as http proxy for two backend Apache2 webservers. It works fine. I also have stunnel on the same LB to add SSL suport (with xforwardedfor patch installed). It works fine (mostly). The issue is related to Apache trailing slash thingie. If I query https://haproxy.domain.loc/hatest/ it works perfectly, but if I omit the trailing slash: https://haproxy.domain.loc/hatest then following things happen: - Browser makes SSL connection with stunnel on port 443. - stunnel deciphers and forwards the request on the haproxy attached to LB's port 80. - haproxy (now using plain http) forwards to one of the backends. - Apache2 located on the backend replies with "301 moved permanently" to force the browser to add the trailing slash. As Apache was queried by *haproxy in plain http*, the 301 includes http:// on the Location header. HTTPS is over from now! - The client browser then rewrites the address to http://haproxy.domain.loc/hatest/ and SSL is lost forever. I've been googling and searching the lists but nothing found, just this old message: http://mirt.net/pipermail/stunnel-users/2007-January/001437.html Has anyone found a workaround for that issue? Thanks in advance. -- Alberto Giménez

2 1

Problems with Stunnel 4.22 build
by GGrant 04 Apr '08

04 Apr '08

There's a problem with the Stunnel 4.22 build as there's undefined IDs in the resources.rc file. To get around this get the resources.rc file from an earlier build (e.g. Stunnel 4.21) and replace it. It should compile happily -- View this message in context: http://www.nabble.com/Problems-with-Stunnel-4.22-build-tp16491431p16491431.… Sent from the Stunnel - Users mailing list archive at Nabble.com.

1 0

23 secs to list 5000 files using stunnel and samba on linux
by Paul Kerin 04 Apr '08

04 Apr '08

Hi I'm using the following s/w versions on RHEL3: Stunnel: 4.04 (also experimenting with 4.22, no difference so far) Samba: 3.0.9-1.3E.10 Kernel: 2.4.21-32.0.1.EL Stunnel is used to encrypt samba connections from linux clients because redhat 3 doesn't support NTLMv2 (cifs not standard and probably not an option). To list 5000 files (simply typing ls within a mounted directory on the client) it consistently takes around 20-23 seconds to return the data. Listing is almost instantaneous when using a windows client, or using a linux client without stunnel. As a side note, if I pipe the result to /dev/null it takes around 9 seconds (?). The network forwarding path from the samba client to samba server is: smbclient > localhost:924 > stunnel > remotehost:923 > stunnel > samba server (port 446) Tcpdump shows that when using stunnel about 10500 packets are generated, minus stunnel it's more like 500. I'd expect some overhead related to SSL, but 21 times the traffic seems a little excessive. I've experimented with socket options such as TCP_NODELAY, SO_LINGER, SO_RCVLOWAT, SO_OOBINLINE, etc with no improvement at all. However, my understanding of these is pretty superficial so I'm not confident I've exhausted all options here (ie perhaps combining multiple settings at once). I've got stunnel debug set to 7 on client and server. No errors and no logging at all except for the initial handshake when the mount is created. Including the tcpdump would probably be excessive at this stage. In summary, using stunnel the data gets transmitted in packets usually containing around 200 bytes, whereas without stunnel it's mostly 1408 byte packets. Any suggestions? Thanks Paul

4 4

Stunnel Newbie - Compiling Stunnel and adding patches for Windows
by GGrant 02 Apr '08

02 Apr '08

Hi, I've downloaded the Stunnel source code and I am trying to compile it with the Visual C++ compiler (cl.exe). I am not sure what to do as I cannot find the Makefile.w32. So how do I go about it? Also how do you apply a user patch to the source code/ Must I copy and paste the code to the required files? Cheers -- View this message in context: http://www.nabble.com/Stunnel-Newbie---Compiling-Stunnel-and-adding-patches… Sent from the Stunnel - Users mailing list archive at Nabble.com.

1 0

Stunnel-Openssl: Problems with certificate chain
by Pietro Di Primo 31 Mar '08

31 Mar '08

Hi, My name is Pietro Di Primo and I work on the INFN Grid project (http://grid.infn.it/) I'm trying to develop an application based on stunnel. Everything works well when I use user certificates (signed by our CA), but i need to use (on the client side) a particular proxy. This proxy contains a public and a private key, and the public key of the user that generated it (I atteched a file with a such proxy). On the server side I have the CA certificate but not the user's one, so I can't verify the client (unable to get local issuer certificate). I tried to get the user certificate using the SSL_get_peer_cert_chain function on the server, but it returns NULL. On the client side I tried SSL_CTX_use_certificate_chain_file, Also I tried to get a STACK_OF(X509) and use SSL_CTX_use_certificate (for proxy certificate), and SSL_CTX_add_extra_chain_cert (to include the user's certificate), but it still doesn't work. Can you help me please? Best Regards -- --- Ing. Pietro Di Primo INFN - Istituto Nazionale di Fisica Nucleare Grid Computing Research Area Via S. Sofia 78 95123 CATANIA (Italy) Voice : +39 095 378-5446/5517 Fax. : +39 095 378 5518 Mobile : +39 320 8591527 E-mail : pietro.diprimo(a)ct.infn.it Skype : pietrodiprimo

1 0

Re: [stunnel-users] Enhancement request - Increase thread stack size
by Mccue, Richard Alan 26 Mar '08

26 Mar '08

Michal Trojnara wrote: >> I load an engine into Stunnel to access the private key. The engine loads >> without incident, but Stunnel consistently aborts when creating a session >> with the first peer because the thread stack is too small. > > I'm not sure if it's a good idea to sacrifice stunnel scalability for > compatibility with this engine. Thread stack size is one of the main > limitations for the number of concurrent threads on 32-bit platforms. IMHO > it's better to fix the engine code to allocate its buffers on the heap.> > > What do you think? All things considered, I must agree that reducing the engine use of the stack would be the better solution. I'll look it over and see if I can find anything sizable on the stack to move. Thanks for the suggestion! - Rich

2 2

New libwrap code
by Randy McMurchy 26 Mar '08

26 Mar '08

Hi all, My apologies if this has been discussed (I've reviewed the archives since 4.21 was released), and if so please just point me in the right direction. I read in some of the messages there's been a revamp (overhaul, changes, whatever) of the libwrap code in Stunnel-4.21. I'm not having any issues using the new version, however, I'm seeing it spawn 5 processes where in every other version I've used in the past there has always only been one process spawned. Here's what I see: root 3408 1 0 17:50 pts/10 00:00:00 /usr/bin/stunnel root 3409 1 0 17:50 pts/10 00:00:00 /usr/bin/stunnel root 3410 1 0 17:50 pts/10 00:00:00 /usr/bin/stunnel root 3411 1 0 17:50 pts/10 00:00:00 /usr/bin/stunnel root 3412 1 0 17:50 pts/10 00:00:00 /usr/bin/stunnel stunnel 3413 1 0 17:50 ? 00:00:00 /usr/bin/stunnel Is this a product of the new libwrap code? I turned debug messages WAY up and I see over and over startup messages for all 5 processes. Example of one: 2008.03.25 17:50:24 LOG5[3407:3082803904]: stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.8e 23 Feb 2007 2008.03.25 17:50:24 LOG5[3407:3082803904]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Auth:LIBWRAP 2008.03.25 17:50:24 LOG6[3407:3082803904]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.03.25 17:50:24 LOG6[3407:3082803904]: poll() used - no FD_SETSIZE limit for file descriptors 2008.03.25 17:50:24 LOG5[3407:3082803904]: 500 clients allowed 2008.03.25 17:50:24 LOG7[3407:3082803904]: FD 9 in non-blocking mode 2008.03.25 17:50:24 LOG7[3407:3082803904]: FD 10 in non-blocking mode 2008.03.25 17:50:24 LOG7[3407:3082803904]: FD 11 in non-blocking mode 2008.03.25 17:50:24 LOG7[3407:3082803904]: SO_REUSEADDR option set on accept socket 2008.03.25 17:50:24 LOG7[3407:3082803904]: swat bound to 0.0.0.0:904 2008.03.25 17:50:24 LOG7[3413:3082803904]: Created pid file /run/stunnel.pid 2008.03.25 17:50:42 LOG7[3413:3082803904]: swat accepted FD=12 from 192.168.11.212:1535 2008.03.25 17:50:42 LOG7[3413:3086076816]: swat started 2008.03.25 17:50:42 LOG7[3413:3086076816]: FD 12 in non-blocking mode 2008.03.25 17:50:42 LOG7[3413:3086076816]: Waiting for a libwrap process 2008.03.25 17:50:42 LOG7[3413:3086076816]: Acquired libwrap process #0 2008.03.25 17:50:42 LOG7[3413:3086076816]: Releasing libwrap process #0 2008.03.25 17:50:42 LOG7[3413:3086076816]: Released libwrap process #0 2008.03.25 17:50:42 LOG7[3413:3086076816]: swat permitted by libwrap from 192.168.11.212:1535 2008.03.25 17:50:42 LOG5[3413:3086076816]: swat accepted connection from 192.168.11.212:1535 When I connect to swat (Samba config tool) it again goes through a process of using all 5 of the system processes. Sorry for being so verbose here. My question is: Has something changed so that there is more than one process spawned (and used) when Stunnel is started? Any help would be appreciated. -- Randy

1 0

Enhancement request - Increase thread stack size
by Mccue, Richard Alan 25 Mar '08

25 Mar '08

I load an engine into Stunnel to access the private key. The engine loads without incident, but Stunnel consistently aborts when creating a session with the first peer because the thread stack is too small. I rebuilt Stunnel 4.21 on my test machine after increasing the stack size parameter and it fixed the problem. Here is the diff: --------------------- # diff -b common.h common.h_orig 33c33 < #define STACK_SIZE 32768*4 --- > #define STACK_SIZE 32768 42c42 < #define STACK_SIZE 65536*4 --- > #define STACK_SIZE 65536 --------------------- Could this enhancement be included in the next Stunnel release? Regards, Rich

1 0

HTTPS being redirected back to HTTP
by Steven Buehler 25 Mar '08

25 Mar '08

I have tested several versions of stunnel up to version 4.21 on SLES 9 and 10. I am trying to use stunnel to implement TLS 1.0 for HTTPS on a Lotus Domino server. I am able to connect to the Domino server with a web browser with HTTPS successfully. However, once I log into the server it drops me back down to HTTP. I suspect the Domino server is sending a redirect back to HTTP during the login because if I change the URL back to HTTPS in the browser after the login, it re-establishes the HTTPS connection. I've checked with Lotus support and there is nothing that can be done on the Domino server to prevent this. Is there anyway to handle this in stunnel so that the requests remain as HTTPS requests to the browser? Here is the services section of my stunnel.conf [https] sslVersion = TLSv1 accept = gsvatestm02.er.usgs.gov:443 connect = gsvatestm02.er.usgs.gov:80 TIMEOUTclose = 0

2 1

possible stunnel memory leak
by Stefano Stabellini 25 Mar '08

25 Mar '08

Hi all, I may have found a possible memory leak in stunnel (version 4.15) when used with pthreads. What I am seeing is the memory usage going up when connections open and never going down, no matter if all the connections close. It is really easy to reproduce it: I have started two stunnel instances communicating with each other, the first one acting as a server (config file stunnel.1) and executing cat, the second one acting as a client (config file stunnel.2) and opening port 5556. Then I execute the script I have attached that simply opens 500 connections using netcat to port 5556. If you cat /proc/<stunnel pid>/status you can see that the memory usage is about 300MB. The problem is that even after all the connections are closed the memory usage stays (more or less) the same. I tried to find the bug myself using valgrind, but I couldn't get far, it seems that valgrind gets confused by openssl so doesn't print very useful informations. I really appreciate any help you can give me; just tell me if you need any other info. Best Regards, Stefano Stabellini #!/bin/bash i=1 while test $i -lt 520 do cat script | nc 127.0.0.1 5556 &>/dev/null & echo $i i=$(( $i + 1 )) done foreground = yes [test] accept = 5555 cert = /etc/ssl/certs/stunnel.pem exec = cat foreground = yes [test] accept = 5556 cert = /etc/ssl/certs/stunnel.pem client = yes connect = 5555

1 0

IMAPS stunnel on older OSX Mac: SSL3_GET_RECORD:wrong version number
by Tom Shaw 23 Mar '08

23 Mar '08

1. compiled and installed stunnel on older OSX Mac. Tried connectiong via IMAPS and POP3S using Apple OSX Mail and I get the errors shown in line 4. Process works when I change my .conf file to contain sslVersion = SSLv2. I'm a neophyte to ssl and I have no idea what is wrong or where to start or if this situation is OK. Any help is appreciated. Also this needs to be backward compatible to OSX 10.3.9 which is why the compiling on Panther. 2. stunnel version 4.20 3. standalone via sudo from command line 4. error message Mar 23 10:49:52 musky stunnel: LOG5[2941:25192960]: imaps accepted connection from 206.208.58.127:37295 Mar 23 10:49:52 musky stunnel: LOG3[2941:25192960]: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number Mar 23 10:49:52 musky stunnel: LOG5[2941:25192960]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 5. $ /usr/local/sbin/stunnel -version stunnel 4.20 on powerpc-apple-darwin7.9.0 with OpenSSL 0.9.7l 28 Sep 2006 Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv4 Auth:LIBWRAP Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none 6. $ uname -a Darwin musky.oitc.com 7.9.0 Darwin Kernel Version 7.9.0: Wed Mar 30 20:11:17 PST 2005; root:xnu/xnu-517.12.7.obj~1/RELEASE_PPC Power Macintosh powerpc 7. Your libc version if you use Linux. 8. $ gcc -v Reading specs from /usr/libexec/gcc/darwin/ppc/3.3/specs Thread model: posix gcc version 3.3 20030304 (Apple Computer, Inc. build 1666) 9. $ openssl version OpenSSL 0.9.7l 28 Sep 2006 10. My conf ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /usr/local/etc/stunnel/secure_mail.pem ;key = /usr/local/etc/stunnel/secure_mail.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv2 ; Some security enhancements for UNIX systems - comment them out on Win32 ;chroot = /usr/local/var/lib/stunnel/ ;setuid = nobody ;setgid = nobody ;setgid = nogroup ; PID is created inside chroot jail pid = /var/run/stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /usr/local/etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ;output = stunnel.log ; Use it for client mode ;client = yes ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 587 [sldap] accept = 636 connect = 389 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini

1 0

What is the stable version of Stunnel?
by Randy McMurchy 22 Mar '08

22 Mar '08

Hi all, Can anyone say for sure what is the stable version of Stunnel? On the main Stunnel web site page ( http://www.stunnel.org ) and in the announcement for the version it says the new 4.21 version is experimental. However, on the download page ( http://www.stunnel.org/download/source.html ) the 4.21 version is flagged as the stable version. Sort of confusing. -- Randy

2 1

compiling stunnel 4.21 on solaris 10
by cod3fr3ak 14 Mar '08

14 Mar '08

Is this not compatible with Openssl 0.9.8f? I think 0.9.8g only reacently came out. Is this the only thing wrong. All my other applications work with this version of openssl. BTW I am using the sunfreeware version, because I wanted to avoid having to compile a bunch of software. i was planning to only compile Stunnel, and maybe swatch. I'll compile Openssl if there is no other way but I'd rather not. Any ideas? R

1 0

bidirectional tunnel
by Leo Cherepanov 14 Mar '08

14 Mar '08

Hello. First of all - thanx a lot, I'm using stunnel every day and it helps me. It will help me even more :) if I can make bidirectional tunnel between external server S and computer C behind nat-proxy-firewall. Of course, C is initiator. I mean after tunnel is up, there is a port-forward C:port1->S:port2 (already works) _and_ S:port3->C:port4 Once again, S has an external ip, C has a private ip. Is this schema posible? Thanx en avance.

1 0

SSLV3 decompression failure???
by Earl Stenlund 13 Mar '08

13 Mar '08

I've been running into the error below: SSL_connect: 14094406: error:14094406:SSL routines:SSL3_READ_BYTES:sslv3 alert decompression failure Running Vista SP1 with stunnel 4.21 connecting to newshosting. It seems to come and go. Any ideas on what is causing this or how to fix it? Thanks, Earl

1 0

Re: [stunnel-users] Compiling Stunnel 4.21 on Solaris 10
by cod3fr3ak 13 Mar '08

13 Mar '08

Is this not compatible with Openssl 0.9.8f? I think 0.9.8g only reacently came out. Is this the only thing wrong. All my other applications work with this version of openssl. BTW I am using the sunfreeware version, because I wanted to avoid having to compile a bunch of software. i was planning to only compile Stunnel, and maybe swatch. I'll compile Openssl if there is no other way but I'd rather not. Any ideas? R

1 0

Compiling Stunnel 4.21 on Solaris 10
by cod3fr3ak 13 Mar '08

13 Mar '08

I am trying to compile Stunnel 4.21 on Solaris 10 with no luck. I am using Openssl 0.9.8f. After running configure, I run make and receive the following output: (truncated for size) ------------------------------------------------------- /bin/bash ../libtool --tag=CC --mode=link gcc -m64 -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/local/ssl/include -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o pty.o -lz -ldl -lsocket -lnsl -lpthread -L/usr/local/ssl/lib -lssl -lcrypto gcc -m64 -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/local/ssl/include -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o pty.o -lz -ldl -lsocket -lnsl -lpthread -L/usr/local/ssl/lib -lssl -lcrypto Undefined first referenced symbol in file BIO_set_flags protocol.o SSL_CTX_set_info_callback ctx.o ld: fatal: Symbol referencing errors. No output written to stunnel collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `stunnel' Current working directory /tmp/stunnel-4.20/src *** Error code 1 The following command caused the error: failcom='exit 1'; \ for f in x $MAKEFLAGS; do \ case $f in \ *=* | --[!k]*);; \ *k*) failcom='fail=yes';; \ esac; \ done; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='src doc tools'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || eval $failcom; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' I have tried Stunnel version 4.21, 4.20 with the same results. I have used Stunnel to help build several secure log servers in the past, and I've never had problems getting it compiled and installed. Any help would be greatly appreciated. cod3fr3ak

1 0

Re: [stunnel-users] stunnel not seeing ca bundle files
by Ludolf Holzheid 12 Mar '08

12 Mar '08

On Wed, 2008-03-12 09:05:17 -0700, sf.techguy(a)gmail.com wrote: > [..] > > Tried the command above on the 1st of 5 crt files (openssl pkcs12 -in > filename.crt -out filename.pem), and am getting this error: > > 19319:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong > tag:tasn_dec.c:1007: > 19319:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 > error:tasn_dec.c:305:Type=PKCS12 > > Any ideas why that might be happening? It seems your files do not contain a PKCS#12 structure (containing the key and the whole certificate chain). I should have recognize this by the fact you have one file for each certificate. Sorry. Maybe you should give the x509 openssl command a try: openssl x509 -in filename.crt -inform DES -out filename.pem HTH, Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

stunnel not seeing ca bundle files
by sf.techguy＠gmail.com 12 Mar '08

12 Mar '08

I'm running stunnel 4.14 on Darwin 7.0.0 (Mac OS X Server 10.4.11), with OpenSSL 0.9.71. I purchased a security certificate from comodo, and was able to get it installed and working (mostly) with stunnel, but when I browse to the website, I get an error that the the browser can't verify the identity of the site, due to a problem w/the security cert. I called comodo, and they the error is caused by stunnel not seeing the intermediate certificate files that they told me need to be installed in order for their certificate to work. These files were: ComodoUTNServerCA.crt UTNAddTrustServerCA.crt AddTrustExternalCARoot.crt EssentialSSLCA.crt my_server_net.crt I modified stunnel.conf, and included this line: CApath = ca-certs/ (<- dir path, relative to chroot, containing above files) But the error persists. Can anyone tell me if what comodo support is telling me is even correct? I've verified that my .key and .crt files match by running: $ openssl x509 -noout -modulus -in server.crt | openssl md5 $ openssl rsa -noout -modulus -in server.key | openssl md5 And the output of both matches. Not sure what to try next. Any help much appreciated! Thanks in advance...

3 2

(no subject)
by Eddie Castelli 11 Mar '08

11 Mar '08

Dear all, Some years ago I have installed Apache, PHP and mySQL. Now I need to update. Unfortunately I can't remember if I installed a package or individual program elements. Could please someone help me and guide me trough as I need urgently the update. Many thanks in advance. -- best regards Eddie

3 3

behaviour on remote disconnection
by Marek Jarycki 11 Mar '08

11 Mar '08

Hi. I'm using 3.26 version of stunnel. How to disallow creating local sockets (on client side) when remote (server) is not available? My application detects socket creation errors and it works without stunnel, but in stunnel the socket is always opening correctly so I have to wait for timeouts to discover network disconnection. Regards, deimoss

2 1

Re: [stunnel-users] unknown protocol error (140770FC) with xinetd
by Ian Pilcher 10 Mar '08

10 Mar '08

Ian Pilcher wrote: > ... and the (non-working) server-side stunnel configuration: > > cert = /etc/stunnel/rsyncs_cert.pem > key = /etc/stunnel/private/rsyncs_key.pem > client = no > pid = /var/run/stunnel.pid > RNDfile = /var/run/stunnel/random_seed > foreground = yes > debug = debug > output = /var/run/stunnel/stunnel.log > > exec = /usr/bin/rsync > execargs = rsync --daemon Amazing how sending off the question gets the old brain cells working (or maybe it was the second cup of coffee). The problem was "foreground = yes". Since xinet.d redirects stderr back over the network connection, the stunnel startup messages were going back to the client. For some reason, the client didn't think that was a proper SSL handshake. ;-) -- ======================================================================== Ian Pilcher arequipeno(a)gmail.com ========================================================================

1 0

unknown protocol error (140770FC) with xinetd
by Ian Pilcher 10 Mar '08

10 Mar '08

I am trying to set up rsync over SSL with stunnel. I've got things working when I run stunnel standalone on both systems, but I have been unable to get things working when I run stunnel via xinetd on the server (haven't tried using xinet on the client yet). Here is the (standalone) server configuration that works: cert = /etc/stunnel/rsyncs_cert.pem key = /etc/stunnel/private/rsyncs_key.pem client = no pid = /var/run/stunnel.pid RNDfile = /var/run/stunnel/random_seed foreground = yes debug = debug ;output = /var/run/stunnel/stunnel.log [rsyncs] accept = 2873 exec = /usr/bin/rsync execargs = rsync --daemon Here is the (non-working) server-side xinetd configuration: # default: off # description: rsync tunneled over SSL (stunnel) service rsyncs { disable = no flags = IPv4 socket_type = stream wait = no user = root server = /usr/sbin/stunnel } ... and the (non-working) server-side stunnel configuration: cert = /etc/stunnel/rsyncs_cert.pem key = /etc/stunnel/private/rsyncs_key.pem client = no pid = /var/run/stunnel.pid RNDfile = /var/run/stunnel/random_seed foreground = yes debug = debug output = /var/run/stunnel/stunnel.log exec = /usr/bin/rsync execargs = rsync --daemon Trying to connect to the non-working configuration with openssl s_client, I get: CONNECTED(00000003) write to 0x9b9e938 [0x9b9f068] (133 bytes => 133 (0x85)) 0000 - 80 83 01 03 01 00 5a 00-00 00 20 00 00 39 00 00 ......Z... ..9.. 0010 - 38 00 00 35 00 00 16 00-00 13 00 00 0a 07 00 c0 8..5............ 0020 - 00 00 33 00 00 32 00 00-2f 03 00 80 00 00 66 00 ..3..2../.....f. 0030 - 00 05 00 00 04 01 00 80-00 00 63 00 00 62 00 00 ..........c..b.. 0040 - 15 00 00 12 00 00 09 06-00 40 00 00 65 00 00 64 [email protected] 0050 - 00 00 14 00 00 11 00 00-08 00 00 06 04 00 80 00 ................ 0060 - 00 03 02 00 80 3e b4 89-34 c1 e6 93 97 2d 8d ca .....>..4....-.. 0070 - 90 e1 4c 51 e1 71 c7 54-ed 52 0c 6e 2e 47 90 9b ..LQ.q.T.R.n.G.. 0080 - 8e c6 73 3d d8 ..s=. read from 0x9b9e938 [0x9ba45c8] (7 bytes => 7 (0x7)) 0000 - 32 30 30 38 2e 30 33 2008.03 18523:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:567: The server log shows: 2008.03.10 11:32:23 LOG5[18563:3086215456]: stunnel 4.20 on i386-redhat-linux-gnu with OpenSSL 0.9.8b 04 May 2006 2008.03.10 11:32:23 LOG5[18563:3086215456]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.03.10 11:32:23 LOG7[18563:3086215456]: stunnel started 2008.03.10 11:32:23 LOG7[18563:3086215456]: FD 0 in non-blocking mode 2008.03.10 11:32:23 LOG7[18563:3086215456]: FD 1 in non-blocking mode 2008.03.10 11:32:23 LOG7[18563:3086215456]: FD 4 in non-blocking mode 2008.03.10 11:32:23 LOG7[18563:3086215456]: FD 5 in non-blocking mode 2008.03.10 11:32:23 LOG7[18563:3086215456]: Connection from 127.0.0.1:38481 permitted by libwrap 2008.03.10 11:32:23 LOG5[18563:3086215456]: stunnel accepted connection from 127.0.0.1:38481 2008.03.10 11:32:23 LOG7[18563:3086215456]: SSL state (accept): before/accept initialization 2008.03.10 11:32:23 LOG7[18563:3086215456]: SSL state (accept): SSLv3 read client hello A 2008.03.10 11:32:23 LOG7[18563:3086215456]: SSL state (accept): SSLv3 write server hello A 2008.03.10 11:32:23 LOG7[18563:3086215456]: SSL state (accept): SSLv3 write certificate A 2008.03.10 11:32:23 LOG7[18563:3086215456]: SSL state (accept): SSLv3 write server done A 2008.03.10 11:32:23 LOG3[18563:3086215456]: SSL_accept: Peer suddenly disconnected 2008.03.10 11:32:23 LOG5[18563:3086215456]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.03.10 11:32:23 LOG7[18563:3086215456]: stunnel finished (0 left) Anyone have any ideas? Thanks! -- ======================================================================== Ian Pilcher arequipeno(a)gmail.com ========================================================================

1 0

Windows FIPS compile
by Joe Kemp 10 Mar '08

10 Mar '08

I am trying to get stunnel to compile against a fips openssl. I read in install.fips that it is not yet supported. Is anyone currently working on this? If so I would love to join forces or any info on the specific issues would help get me started. Thanks. -Joe

2 2

help
by Paque Alexandre 10 Mar '08

10 Mar '08

Hi, I am writing you because I haven’t found solution on the web. In order to secure a connection between servers (1 client and 1 server stunnel), I chose the stunnel tool. However, I have an issue when I unplugged the network cable. If I unplug the network cable on the remote side, Stunnel will detect the cutting only on the local side. In fact, I would like to configure stunnel client in order to detect the unplugged network cable on server side. I tried many configurations but without success: socket = l:TCP_NODELAY=1 socket = l:SO_LINGER=1:1 socket = l:SO_KEEPALIVE=1 socket = l:SO_REUSEADDR=1 socket = r:TCP_NODELAY=1 socket = r:SO_LINGER=1:1 socket = r:SO_KEEPALIVE=1 socket = r:SO_REUSEADDR=1 Could you help me? Thanks you in advance, Alex _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

1 0

ssl mutual authentication
by Simon Santoro 09 Mar '08

09 Mar '08

Hello all. I am sure I am missing something really obvious here, but I can't get this to work. HTTP client (localhost) -> stunnel (localhost) -> HTTPS server (remote host) I'd like to user stunnel as proxy for my HTTP requests that go to a HTTPS server (apache if that makes any difference) on a remote host (fresh) that uses a cert to authenticate the request. I wrote this little ruby script[2] to test the request, and it works, so i am sure that on the server/client/cert end there is no problem. Now I'd like to use a simple wget or w3m to get the file from the remote server trough stunnel, but I keep getting SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed The only difference between the ruby script and the stunnel setup is that in the ruby script i have two different files for the crt and the key, and with stunnel I joined those files together with cat s2(a)magnesium.key s2(a)magnesium.crt >s2(a)magnesium.pam on localhost i run: $ stunnel -r fresh:443 -d localhost:11443 -c -f -D 7 -c -S 0 -p certs/s2(a)magnesium.pem -a certs/ -A certs/freshCA.crt -v 3 -P none 2008.03.09 21:21:38 LOG5[9026:3082811056]: Using 'fresh.443' as tcpwrapper service name 2008.03.09 21:21:38 LOG7[9026:3082811056]: RAND_status claims sufficient entropy for the PRNG 2008.03.09 21:21:38 LOG6[9026:3082811056]: PRNG seeded successfully 2008.03.09 21:21:38 LOG7[9026:3082811056]: Certificate: certs/s2(a)magnesium.pem Enter PEM pass phrase: 2008.03.09 21:21:40 LOG7[9026:3082811056]: cert_defaults is 0 2008.03.09 21:21:40 LOG7[9026:3082811056]: cert_dir is certs/ 2008.03.09 21:21:40 LOG7[9026:3082811056]: cert_file is certs/freshCA.crt 2008.03.09 21:21:40 LOG7[9026:3082811056]: Loaded verify certificates from certs/freshCA.crt 2008.03.09 21:21:40 LOG7[9026:3082811056]: Set verify directory to certs/ 2008.03.09 21:21:40 LOG5[9026:3082811056]: Peer certificate location certs/ 2008.03.09 21:21:40 LOG5[9026:3082811056]: stunnel 3.26 on i486-pc-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.8e 23 Feb 2007 2008.03.09 21:21:40 LOG7[9026:3082811056]: No pid file being created 2008.03.09 21:21:40 LOG5[9026:3082811056]: FD_SETSIZE=1024, file ulimit=1024 -> 500 clients allowed 2008.03.09 21:21:40 LOG7[9026:3082811056]: SO_REUSEADDR option set on accept socket 2008.03.09 21:21:40 LOG7[9026:3082811056]: fresh.443 bound to 127.0.0.1:11443 then, I try to connect to localhost:11443 with w3m, in the hope that my HTTP request is encrypted and send to fresh:443, and stunnel should check if the PEER certificate is correct, but all I get is: 2008.03.09 21:26:44 LOG7[9214:3082585776]: fresh.443 accepted FD=6 from 127.0.0.1:43888 2008.03.09 21:26:44 LOG7[9214:3082423184]: fresh.443 started 2008.03.09 21:26:44 LOG5[9214:3082423184]: fresh.443 connected from 127.0.0.1:43888 2008.03.09 21:26:44 LOG7[9214:3082423184]: fresh.443 connecting 192.168.0.2:443 2008.03.09 21:26:44 LOG7[9214:3082423184]: Remote FD=7 initialized 2008.03.09 21:26:44 LOG7[9214:3082423184]: Relying on OpenSSL RSA Blinding. 2008.03.09 21:26:44 LOG7[9214:3082423184]: SSL state (connect): before/connect initialization 2008.03.09 21:26:44 LOG7[9214:3082423184]: SSL state (connect): SSLv3 write client hello A 2008.03.09 21:26:45 LOG7[9214:3082423184]: SSL state (connect): SSLv3 read server hello A 2008.03.09 21:26:45 LOG5[9214:3082423184]: VERIFY OK: depth=1, /C=IT/O=S2 corp./CN=S2/emailAddress=s2@fresh 2008.03.09 21:26:45 LOG4[9214:3082423184]: VERIFY ERROR ONLY MY: no cert for /C=IT/O=S2 corp./CN=fresh 2008.03.09 21:26:45 LOG7[9214:3082423184]: SSL alert (write): fatal: certificate unknown 2008.03.09 21:26:45 LOG3[9214:3082423184]: SSL_connect: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed 2008.03.09 21:26:45 LOG7[9214:3082423184]: fresh.443 finished (0 left) Did I something wrong? What am I missing? Please help me, it would save me really a lot of work on the client side if I could get this going. Thanks! Simon [1] ---------------------------------------------------- #!/usr/bin/ruby SERVER_CERT_FILE = "certs/freshCA.crt" CERT_FILE = "certs/s2(a)magnesium.crt" CERT_FILE_KEY = "certs/s2(a)magnesium.key" require 'net/https' https = Net::HTTP.new('fresh', 443) https.use_ssl = true #client certificates https.cert = OpenSSL::X509::Certificate.new( File.read(CERT_FILE) ) https.key = OpenSSL::PKey::RSA.new( File.read(CERT_FILE_KEY), 'panza') #server certificate https.ca_file = SERVER_CERT_FILE https.verify_mode = OpenSSL::SSL::VERIFY_PEER #VERIFY_NONE https.read_timeout = 120 https.start do |https| request = Net::HTTP::Get.new('/notes/test_auth') # request.basic_auth 's', 'x' response = https.request(request) response.value puts response.body end ----------------------------------------------------

1 1

Connection Problem on Vista
by Earl Stenlund 08 Mar '08

08 Mar '08

I setup stunnel this afternoon to work with Newshosting. It was working fine but now I cannot connect using my desktop running Vista. I receive this message: SSL_connect: 14094406: error:14094406:SSL routines:SSL3_READ_BYTES:sslv3 alert decompression failure Stunnel connects fine on my laptop which is also running Vista. Help, Earl Stenlund

1 0

Username authentication
by Joe Kemp 07 Mar '08

07 Mar '08

I want to try to use stunnel as a "simple" client vpn. It solves all of my encryption issues but I would like to verify a username/password before it lets the traffic through. I didn't see any patches or hacks out there that did this. Has this been attempted before or am I on my own. I would also be interested in other solutions based on openssl that are not network device level VPNs clients. Already using client side certificates and I know that is the normal SSL authentication mechanism.... Thanks. -Joe

2 2

Send delay?
by Colin E 04 Mar '08

04 Mar '08

Please can you help a hardware engineer, who almost understands what he's doing. I'm using sTunnel 4.21 on a Windows 2000 machine, to provide a TCP program with SSL. This works very well. However the application is very time critical and must finish sending block of XML as quickly as possible. I suspect there is a delay in either sTunnel or openSSL, while it waits to see if there are any more characters before sending a packet. Is this correct? If it is, is there a work round. -- View this message in context: http://www.nabble.com/Send-delay--tp15826043p15826043.html Sent from the Stunnel - Users mailing list archive at Nabble.com.

2 4

Newbie
by Rod Bodden 03 Mar '08

03 Mar '08

Hello to all! I'm trying to set up Stunnel for the first time. I hope to use it with HFS. I followed directions found on HFS website and ran into a problem creating a pem file. Could someone direct me to information about installing Stunnel? Or help me directly by sharing with me how to install Stunnel? I sincerely appreciate your help!!! Rod

1 0

Bugs
by Jan.Haering＠rz-kiru.de 29 Feb '08

29 Feb '08

Hallo, I have found 2 Bugs. 1. In Version 4.21: No Taskbar Icon is displayed when the service starts. Although the taskbar ist set in config file (taskbar = yes). 2. In probably all Versions (I have testet 4.18, 4.20 and 4.21) If i started the service over Start -> Programm Files -> stunnel -> Service Start (stunnel -start) no log files are written. If i start the service over services.msc from Windows or "sc start stunnel" log files are written. The icon log displayed the following message in version 4.18 and 4.20 2007.11.09 09:41:03 LOG3[2396:2400]: stunnel.log: Broken pipe (32) 2007.11.09 09:41:03 LOG3[2396:2400]: Unable to open output file: stunnel.log Best Regards Jan

5 9

webdav with stunnel and 'net use'
by detlef oertel 26 Feb '08

26 Feb '08

Hello list, what we want to do, is mounting a webdav share via https on a windows xp box. Therefore we tried to tunnel localhost:80 to server:443 The name of the test server is here bonifax. What works is: mounting direct via http net use x: "http://bonfax/opsi-depot" mounting over stunnel with 'Add Network Place Wizard' or RunDLL32.EXE netplwiz.dll,AddNetPlaceRunDll using the address: http://localhost/opsi-depot What fails is: ---------------------------- C:\WINDOWS>net use y: "http://localhost/opsi-depot" Systemfehler 67 aufgetreten. Der Netzwerkname wurde nicht gefunden. -------- Error 67 'network name not found' ------------------------ part of stunnel.conf ------------------------ ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration verify=0 [psuedo-https] accept = 80 connect = bonifax:443 TIMEOUTclose = 0 ------------------------ This is the log: ----------------------------- 2008.02.26 20:04:11 LOG7[1560:1404]: psuedo-https accepted FD=176 from 127.0.0.1:1861 2008.02.26 20:04:11 LOG7[1560:1404]: Creating a new thread 2008.02.26 20:04:11 LOG7[1560:1404]: New thread created 2008.02.26 20:04:11 LOG7[1560:3308]: psuedo-https started 2008.02.26 20:04:11 LOG7[1560:3308]: FD 176 in non-blocking mode 2008.02.26 20:04:11 LOG7[1560:3308]: TCP_NODELAY option set on local socket 2008.02.26 20:04:11 LOG5[1560:3308]: psuedo-https accepted connection from 127.0.0.1:1861 2008.02.26 20:04:11 LOG7[1560:3308]: FD 208 in non-blocking mode 2008.02.26 20:04:11 LOG7[1560:3308]: psuedo-https connecting 192.168.1.14:443 2008.02.26 20:04:11 LOG7[1560:3308]: connect_wait: waiting 10 seconds 2008.02.26 20:04:11 LOG7[1560:3308]: connect_wait: connected 2008.02.26 20:04:11 LOG5[1560:3308]: psuedo-https connected remote server from 192.168.2.234:1862 2008.02.26 20:04:11 LOG7[1560:3308]: Remote FD=208 initialized 2008.02.26 20:04:11 LOG7[1560:3308]: TCP_NODELAY option set on remote socket 2008.02.26 20:04:11 LOG7[1560:3308]: SSL state (connect): before/connect initialization 2008.02.26 20:04:11 LOG7[1560:3308]: SSL state (connect): SSLv3 write client hello A 2008.02.26 20:04:11 LOG7[1560:3308]: SSL state (connect): SSLv3 read server hello A 2008.02.26 20:04:11 LOG5[1560:3308]: VERIFY IGNORE: depth=0, /C=DE/ST=Rheinland-Pfalz/O=uib/CN=bonifax.uib.local 2008.02.26 20:04:11 LOG5[1560:3308]: VERIFY OK: depth=0, /C=DE/ST=Rheinland-Pfalz/O=uib/CN=bonifax.uib.local 2008.02.26 20:04:11 LOG5[1560:3308]: VERIFY IGNORE: depth=0, /C=DE/ST=Rheinland-Pfalz/O=uib/CN=bonifax.uib.local 2008.02.26 20:04:11 LOG5[1560:3308]: VERIFY OK: depth=0, /C=DE/ST=Rheinland-Pfalz/O=uib/CN=bonifax.uib.local 2008.02.26 20:04:11 LOG5[1560:3308]: VERIFY IGNORE: depth=0, /C=DE/ST=Rheinland-Pfalz/O=uib/CN=bonifax.uib.local 2008.02.26 20:04:11 LOG5[1560:3308]: VERIFY OK: depth=0, /C=DE/ST=Rheinland-Pfalz/O=uib/CN=bonifax.uib.local 2008.02.26 20:04:11 LOG7[1560:3308]: SSL state (connect): SSLv3 read server certificate A 2008.02.26 20:04:11 LOG7[1560:3308]: SSL state (connect): SSLv3 read server key exchange A 2008.02.26 20:04:11 LOG7[1560:3308]: SSL state (connect): SSLv3 read server done A 2008.02.26 20:04:11 LOG7[1560:3308]: SSL state (connect): SSLv3 write client key exchange A 2008.02.26 20:04:11 LOG7[1560:3308]: SSL state (connect): SSLv3 write change cipher spec A 2008.02.26 20:04:11 LOG7[1560:3308]: SSL state (connect): SSLv3 write finished A 2008.02.26 20:04:11 LOG7[1560:3308]: SSL state (connect): SSLv3 flush data 2008.02.26 20:04:11 LOG7[1560:3308]: SSL state (connect): SSLv3 read finished A 2008.02.26 20:04:11 LOG7[1560:3308]: 1 items in the session cache 2008.02.26 20:04:11 LOG7[1560:3308]: 1 client connects (SSL_connect()) 2008.02.26 20:04:11 LOG7[1560:3308]: 1 client connects that finished 2008.02.26 20:04:11 LOG7[1560:3308]: 0 client renegotiations requested 2008.02.26 20:04:11 LOG7[1560:3308]: 0 server connects (SSL_accept()) 2008.02.26 20:04:11 LOG7[1560:3308]: 0 server connects that finished 2008.02.26 20:04:11 LOG7[1560:3308]: 0 server renegotiations requested 2008.02.26 20:04:11 LOG7[1560:3308]: 0 session cache hits 2008.02.26 20:04:11 LOG7[1560:3308]: 0 session cache misses 2008.02.26 20:04:11 LOG7[1560:3308]: 0 session cache timeouts 2008.02.26 20:04:11 LOG6[1560:3308]: SSL connected: new session negotiated 2008.02.26 20:04:11 LOG6[1560:3308]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2008.02.26 20:04:26 LOG7[1560:3308]: SSL alert (read): warning: close notify 2008.02.26 20:04:26 LOG7[1560:3308]: SSL closed on SSL_read 2008.02.26 20:04:26 LOG7[1560:3308]: Socket write shutdown 2008.02.26 20:04:26 LOG7[1560:3308]: SSL write shutdown 2008.02.26 20:04:26 LOG7[1560:3308]: SSL alert (write): warning: close notify 2008.02.26 20:04:26 LOG6[1560:3308]: SSL_shutdown successfully sent close_notify 2008.02.26 20:04:26 LOG5[1560:3308]: Connection closed: 311 bytes sent to SSL, 971 bytes sent to socket 2008.02.26 20:04:26 LOG7[1560:3308]: psuedo-https finished (0 left) ---------------------- stunnel version 4.21 Anyone any ideas what went wrong and how to go around ? regards detlef -- detlef oertel Tel. 06131 / 27561-10 Fax 06131 / 27561-22 eMail: d.oertel(a)uib.de uib umwelt informatik büro gmbh Firmensitz / Anschrift: Bonifaziusplatz 1B 55118 Mainz internet: www.uib.de Geschäftsführer: dr. detlef oertel Handelsregister: Amtsgericht Mainz HRB 6942

1 0

Sun Niagra2
by Steve Harris 25 Feb '08

25 Feb '08

Hi all, Has built stunnel on the Sun Niagra 2 platform to take advantage of the on-chip crypto? Cheers - Steve -- NOTE: This message is confidential and may not be disclosed to anyone without the express written consent of the sender. ********************************************************************* PH: 250-381-1335 xt125

1 0

Log & Timestamp question
by Edward Blake 25 Feb '08

25 Feb '08

Stunnel currently logs times in the format hh:mm:ss. Is there a way to get a more exact time, such as UTC or down to the millisecond? Edward Blake

1 0

VNC, STUNNEL & HTTPTUNNEL ----- (((VNC)SSL)HTTP)
by sean bhola 25 Feb '08

25 Feb '08

I need to connect to my PC at work from home. The firewall at work has only ports 80 (http) and 443 (https) open, I also think there is a proxy. I was wondering which scenario would work. 1: To encapsulate vnc traffic within ssl using stunnel and pass it though port 443, OR 2: To encapsulate vnc traffic within ssl using stunnel, then encapsulate that within http using httptunnel and pass through port 80 OR 3: To encapsulate vnc traffic within http, then encapsulate that within ssl using stunnel and pass through port 443 I read this article http://www.securityfocus.com/infocus/1677 but still had the concerns above. Help would be much appreciated. Thanks. Sean

2 1

running SWAT through stunnel and uid/gid question
by Wayne Sherman 24 Feb '08

24 Feb '08

(using STunnel 4.21 on gentoo) I can successfully run the samba SWAT tool through stunnel with these settings: [swat] exec = /usr/sbin/swat execargs = swat accept = 901 But, I have discovered that in order to successfully log-in to swat, I have to comment these lines in the global section of stunnel.conf: #setuid = stunnel #setgid = stunnel Is there a way to specify the UID/GID per service (like the xinetd service level option "user") instead of globally? Thanks, Wayne

1 0

Re: [stunnel-users] Stunnel Configuration
by paque_alexandre＠yahoo.fr 19 Feb '08

19 Feb '08

1 0

Web based CRL file
by Edouard Dessioux 18 Feb '08

18 Feb '08

Hi, I have several questions about the CRL file : - is the file reloaded before each connection or is it first loaded at the stunnel startup ? - do you have any idea of how to use a web-based CRL file ? Regards, Edouard DESSIOUX Directeur de Projets Tibco Mobile 3, rue Danton - 92240 Malakoff Tél : +33 (0)1 55 58 04 59 - Fax : +33 (0)1 55 58 03 89 - Mob. +33 (0)6 34 02 61 54 E-mail : edessioux(a)tibco.fr - www.tibcomobile.fr Faites un geste pour la planète, n'imprimez ce message que si nécessaire.

1 0

Installing Stunnel 4.21 on Shared Hosting Server with OpenSSL 0.9.6g
by Norbert Hoeller 17 Feb '08

17 Feb '08

I am trying to install Stunnel 4.21 on a 1&1 shared Linux server. PHP Settings claims that OpenSSL 0.9.6g is installed. I unpacked the tar file and ran "./configure" using --prefix to override the /usr/local/ install directory. I had one warning: "configure: WARNING: Openssl engine header not found". In terms of threading model, I got "configure: PTHREAD thread model detected". When I tried to run "make", I got "common.h:318: #error OpenSSL library compiled without thread support". Is there a way around this? I tried running "./configure" with --with-threads=ucontext/fork, but that gave a bunch of "OCSP_" undeclared variables and "Error 1". Thanks, Norbert

2 2

Validation of certificate
by Edouard Dessioux 12 Feb '08

12 Feb '08

Hi everyone, I'm new to this mailing list, but before my asking question, i checked the archive but did not find anything related, so, it may be out of topic. Well, for the moment, I can't provide all the informations asked like « output of ... command », but I'm not sure this is relevant for my question. The informations I can provide are : * I use stunnel to terminate a tls connection between a mobile phone and a web application server. * I use stunnel to validate my clients certificates. * The stunnel will be running on a windows 2003 server * I guess I would be using the last available version of stunnel * The certificates would be generated by a PKI different from openssl What I would like to do is : I have a PKI already deployed with many certificates, and I want only a small subset of them to be validated by the stunnel. I thought of using multiples OU fields to « tags » some users, but can this fields be checked by stunnel ? Do you guys have any feedback on this or any alternative way to do something equivalent ? Regards, Edouard DESSIOUX Directeur de Projets Tibco Mobile 3, rue Danton - 92240 Malakoff Tél : +33 (0)1 55 58 04 59 - Fax : +33 (0)1 55 58 03 89 - Mob. +33 (0)6 34 02 61 54 E-mail : edessioux(a)tibco.fr - www.tibcomobile.fr Faites un geste pour la planète, n'imprimez ce message que si nécessaire.

1 0

signal 15 terminating stunnel on start in Ubuntu
by Rick Barry 11 Feb '08

11 Feb '08

I am trying to use Stunnel 4.2 on Ubuntu 7.1. When I use this command to start Stunnel: /etc/init.d/stunnel4 start I get this output: Starting SSL tunnels: 2008.02.11 09:00:05 LOG7[6780:3082872496]: RAND_status claims sufficient entropy for the PRNG 2008.02.11 09:00:05 LOG7[6780:3082872496]: PRNG seeded successfully 2008.02.11 09:00:05 LOG7[6780:3082872496]: SSL context initialized for service nntp [Failed: /etc/stunnel/stunnel.conf] You should check that you have specified the pid= in you configuration file In the log entry @ /var/log/stunnel4/stunnel.log: 2008.02.11 08:33:54 LOG5[5468:3082974896]: stunnel 4.20 on i486-pc-linux- gnu with OpenSSL 0.9.8e 23 Feb 2007 2008.02.11 08:33:54 LOG5[5468:3082974896]: ThreadingTHREAD SSL:ENGINE SocketsOLL,IPv6 Auth:LIBWRAP 2008.02.11 08:33:54 LOG6[5468:3082974896]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.02.11 08:33:54 LOG6[5468:3082974896]: poll() used - no FD_SETSIZE limit for file descriptors 2008.02.11 08:33:54 LOG5[5468:3082974896]: 500 clients allowed 2008.02.11 08:33:54 LOG7[5468:3082974896]: FD 4 in non-blocking mode 2008.02.11 08:33:54 LOG7[5468:3082974896]: FD 5 in non-blocking mode 2008.02.11 08:33:54 LOG7[5468:3082974896]: FD 6 in non-blocking mode 2008.02.11 08:33:54 LOG7[5468:3082974896]: SO_REUSEADDR option set on accept socket 2008.02.11 08:33:54 LOG7[5468:3082974896]: nntp bound to 127.0.0.1:119 2008.02.11 08:33:54 LOG7[5517:3082974896]: Created pid file /stunnel4.pid 2008.02.11 08:39:10 LOG5[5517:3082974896]: Received signal 15; terminating 2008.02.11 08:39:10 LOG7[5517:3082974896]: removing pid file /stunnel4.pid Signal 15 seems to be the linchpin here, but my research hasn't brought up anything conclusive. Any pointers? Thank you. Rick Barry ____________________________________________________________________________________ Looking for last minute shopping deals? Find them fast with Yahoo! Search. http://tools.search.yahoo.com/newsearch/category.php?category=shopping

1 0

Stunnel Problem - 935 Maximum connections on Windows
by Iain ＠ Mobile777 11 Feb '08

11 Feb '08

We are having some difficulties when using Stunnel under load. The maximum sessions running on a Windows servers seems to be set at 935 concurrent connections. Our system uses Stunnel to route incoming SSL traffic on port 443 through Openssl to a Java application on port 26789. Both Stunnel and the Java server run on a Windows 2003 server, with between 4GB and 8GB of ram, both running Dual Intel Zeon 2Ghz processors. The problem is that when the Stunnel server is under load, the maximum connections that we can achieve is 935 concurrent connections (Windows threads between 936 and 938), before Stunnel throws errors and starts closing the connections. Here is some additional information about our system: Stunnel version 4.21 (latest Windows binaries) OpenSSL 0.9.8g Stunnel Config: ----------------------------------------------------------------------- debug = 7 output = stunnel.log # Use it for client mode #client = yes #TIMEOUTidle = 60 socket = a:TCP_NODELAY=1 socket = a:SO_LINGER=a:0 socket = r:TCP_NODELAY=1 socket = r:SO_LINGER=r:0 socket = l:TCP_NODELAY=1 socket = l:SO_LINGER=l:0 # Service-level configuration [JAVASERVER] #session = 5000 accept = 443 connect = localhost: 26789 # delay = yes #transparent = yes ----------------------------------------------------------------------- We have tried various options, such as the TIMEOUTidle and session parameters for Stunnel, but with no luck. We have even tried running Stunnel separately on a Linux distro (FC4), with even less positive results. The pertinent errors in the log files are as follows: Connection closed: 178664 bytes sent to SSL, 44646 bytes sent to socket SSL alert (write): warning: close notify _beginthread: Exec format error (8) Connection rejected: create_client failed I can mail full logs of our load tests as well. Our server will be expected to handle upwards of 10000 connections at a time, we've been researching for about a week now how to get the performance we need, but so far nothing. Iain

3 3

Stunnel + Hybrid-ircd issues
by Strykar 09 Feb '08

09 Feb '08

Hi, I'm running Hybrid-7.2 on two PCs, one of which has a dynamic IP, as Hybrid wants a static IP and not hostname in its connect section, we are trying to use stunnel to encrypt server<->server communication. Server 1 specs (To which I'm connecting) running FreeBSD 6.3: *********************************************** #stunnel -version stunnel 4.05 on amd64-unknown-freebsd5.3 PTHREAD+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 Global options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /usr/local/etc/stunnel/stunnel.pem pid = /var/tmp/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes #gcc -v Using built-in specs. Configured with: FreeBSD/amd64 system compiler Thread model: posix gcc version 3.4.6 [FreeBSD] 20060305 #uname FreeBSD 6.3-STABLE FreeBSD 6.3-STABLE #6: Tue Jan 22 13:23:51 GMT 2008 root@:/usr/obj/usr/src/sys/SVR1 amd64 Server 2 specs (From which I'm connecting via stunnel as a client) running OpenBSD 4.2: ****************************************************************** #stunnel -version stunnel 4.20 on i386-unknown-openbsd4.2 with OpenSSL 0.9.7j 04 May 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/arandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none # gcc -v Reading specs from /usr/lib/gcc-lib/i386-unknown-openbsd4.2/3.3.5/specs Configured with: Thread model: single gcc version 3.3.5 (propolice) # cat stunnel.conf: cert = /etc/ssl/private/stunnel.pem key = /etc/ssl/private/rsa.key setuid = _stunnel setgid = _stunnel pid = /var/run/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 foreground = yes [irc] client = yes accept = localhost:994 connect = xxx.xxx.xxx.xxx:994 Here's the debug logged to stderr: # stunnel 2008.02.08 19:34:54 LOG7[11904:2237644800]: Snagged 64 random bytes from /dev/arandom 2008.02.08 19:34:54 LOG7[11904:2237644800]: RAND_status claims sufficient entropy for the PRNG 2008.02.08 19:34:54 LOG7[11904:2237644800]: PRNG seeded successfully 2008.02.08 19:34:54 LOG7[11904:2237644800]: Certificate: /etc/ssl/private/stunnel.pem 2008.02.08 19:34:54 LOG7[11904:2237644800]: Certificate loaded 2008.02.08 19:34:54 LOG7[11904:2237644800]: Key file: /etc/ssl/private/rsa.key 2008.02.08 19:34:54 LOG7[11904:2237644800]: Private key loaded 2008.02.08 19:34:54 LOG7[11904:2237644800]: SSL context initialized for service irc 2008.02.08 19:34:54 LOG5[11904:2237644800]: stunnel 4.20 on i386-unknown-openbsd4.2 with OpenSSL 0.9.7j 04 May 2006 2008.02.08 19:34:54 LOG5[11904:2237644800]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.02.08 19:34:54 LOG6[11904:2237644800]: file ulimit = 128 (can be changed with 'ulimit -n') 2008.02.08 19:34:54 LOG6[11904:2237644800]: poll() used - no FD_SETSIZE limit for file descriptors 2008.02.08 19:34:54 LOG5[11904:2237644800]: 61 clients allowed 2008.02.08 19:34:54 LOG7[11904:2237644800]: FD 6 in non-blocking mode 2008.02.08 19:34:54 LOG7[11904:2237644800]: FD 7 in non-blocking mode 2008.02.08 19:34:54 LOG7[11904:2237644800]: FD 8 in non-blocking mode 2008.02.08 19:34:54 LOG7[11904:2237644800]: SO_REUSEADDR option set on accept socket 2008.02.08 19:34:54 LOG7[11904:2237644800]: irc bound to 127.0.0.1:994 2008.02.08 19:34:54 LOG7[11904:2237644800]: Created pid file /var/run/stunnel.pid 2008.02.08 19:35:15 LOG7[11904:2237644800]: irc accepted FD=9 from 127.0.0.1:8579 2008.02.08 19:35:15 LOG7[11904:2336256000]: irc started 2008.02.08 19:35:15 LOG7[11904:2336256000]: FD 9 in non-blocking mode 2008.02.08 19:35:15 LOG7[11904:2336256000]: TCP_NODELAY option set on local socket 2008.02.08 19:35:15 LOG7[11904:2336256000]: FD 10 in non-blocking mode 2008.02.08 19:35:15 LOG7[11904:2336256000]: FD 11 in non-blocking mode 2008.02.08 19:35:15 LOG7[11904:2336256000]: Connection from 127.0.0.1:8579 permitted by libwrap 2008.02.08 19:35:15 LOG5[11904:2336256000]: irc accepted connection from 127.0.0.1:8579 2008.02.08 19:35:15 LOG7[11904:2336256000]: FD 10 in non-blocking mode 2008.02.08 19:35:15 LOG7[11904:2336256000]: irc connecting 69.50.175.50:994 2008.02.08 19:35:15 LOG7[11904:2336256000]: connect_wait: waiting 10 seconds 2008.02.08 19:35:15 LOG7[11904:2237644800]: Cleaning up the signal pipe 2008.02.08 19:35:15 LOG6[11904:2237644800]: Child process 26562 finished with code 0 2008.02.08 19:35:15 LOG7[11904:2336256000]: connect_wait: connected 2008.02.08 19:35:15 LOG5[11904:2336256000]: irc connected remote server from 192.168.1.101:42954 2008.02.08 19:35:15 LOG7[11904:2336256000]: Remote FD=10 initialized 2008.02.08 19:35:15 LOG7[11904:2336256000]: TCP_NODELAY option set on remote socket 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): before/connect initialization 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 write client hello A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 read server hello A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 read server certificate A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 read server done A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 write client key exchange A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 write change cipher spec A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 write finished A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 flush data 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 read finished A 2008.02.08 19:35:15 LOG7[11904:2336256000]: 1 items in the session cache 2008.02.08 19:35:15 LOG7[11904:2336256000]: 1 client connects (SSL_connect()) 2008.02.08 19:35:15 LOG7[11904:2336256000]: 1 client connects that finished 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 client renegotiations requested 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 server connects (SSL_accept()) 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 server connects that finished 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 server renegotiations requested 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 session cache hits 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 session cache misses 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 session cache timeouts 2008.02.08 19:35:15 LOG6[11904:2336256000]: SSL connected: new session negotiated 2008.02.08 19:35:15 LOG6[11904:2336256000]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2008.02.08 19:35:15 LOG3[11904:2336256000]: SSL_read: Connection reset by peer (54) 2008.02.08 19:35:15 LOG5[11904:2336256000]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.02.08 19:35:15 LOG7[11904:2336256000]: irc finished (0 left) What is going on here with "SSL_read: Connection reset by peer (54)"? This process keeps repeating itself without the ircd's linking. - S

1 0

Verify Question
by Vlad 08 Feb '08

08 Feb '08

I'm sure that people have asked this question before, but i cannot find a way to search the archives. What is the difference between verify = 2 and verify = 3, The docs indicate that with verify = 3it will check against locally installed certs, but what does that mean, if I use =2 then what does it verify the cert against? Also a second question: I'm pretty sure that the answer is no but is it possible to do the following, have a cert A that is signed by CA cert B which itself is singed by a self-signed cert C. If the clients has C installed as a trusted cert, and it received A, is there anyway for it to validate A. I realize that these are probably pretty novice questions so I really appreciate your patience, thanks!

1 0

xforwardedfor in config
by Jill Rochelle 04 Feb '08

04 Feb '08

I am new to stunnel and the ssl world. I'm trying to get stunnel to work with haproxy for load balancing https requests. In the haproxy documentation it says that the stunnel.conf should look like this cert=/etc/stunnel/stunnel.pem setuid=stunnel setgid=proxy socket=l:TCP_NODELAY=1 socket=r:TCP_NODELAY=1 [https] accept=192.168.1.1:443 connect=192.168.1.1:80 xforwardedfor=yes However, when I try to start the stunnel service I get this Starting stunnel: file /etc/stunnel/stunnel.conf line 9: Specified option name is not valid here If I comment out the xforwardedfor parameter, it starts. Any help is greatly appreciated. Thank you, Jill Rochelle

2 2

2 secure sockets TCP (Server / Client) as posted earlier last month by khaled
by Dick van Fulpen 04 Feb '08

04 Feb '08

> Hi, > > I'm having the same question (and problem) as posted by khaled on Mon > Jan 7 19:31:03 CET 2008, subject [stunnel-users] 2 secure sockets TCP > (Server / Client). > > I think I have to send data to stunnel on the client side by a write > to localhost:1974 where stunnel is configured with this stunnel.conf: > ; Sample stunnel configuration file by Michal Trojnara 2002-2006 > ; Some options used here may not be adequate for your particular > configuration > ; Certificate/key is needed in server mode and optional in client mode > ; The default certificate is provided only for testing and should not > ; be used in a production environment > cert = stunnel.pem > ;key = stunnel.pem > > ; Some performance tunings > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > > ; Use it for client mode > ;client = yes > > ; Service-level configuration > [sip2s] > accept = 1975 > connect = 127.0.0.1:1974 > > To start stunnel only works with just stunnel. > Started from batch or in dos-box with the options -d -r etc. as > explained in the documentation does not work, error message: file not > found) > BTW: I'm using Windows XP Professional on both client and server. > Client IP = 10.4.208.159, server IP = 10.4.208.102 for a test set-up. > > On the server side it gives the same error when started with options. > stunnel.conf on the server is this: > ; Sample stunnel configuration file by Michal Trojnara 2002-2006 > ; Some options used here may not be adequate for your particular > configuration > ; Certificate/key is needed in server mode and optional in client mode > ; The default certificate is provided only for testing and should not > be used in a production environment > cert = stunnel.pem > ;key = stunnel.pem > > ; Some performance tunings > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > > ; Some debugging stuff useful for troubleshooting > debug = 7 > output = stunnel.log > > ; Use it for client mode > client = yes > > ; Service-level configuration > [sip2s] > accept = 1975 > connect = 127.0.0.1:1974 > > Reading data on TCP/IP 1974 does not display anything when the client > is sending data to localhost:1974 which is encrypted by stunnel an > forwarded on TCP/IP 1975. > At least that is my intention, but something I do is wrong. > Data sending unencrypted between client an server works fine, so > connection is possible. > > Any idea what I should do to let it work like this: > - a client sends data to a server and reads the response from this > server. > - all data on the network between client an server should be > encrypted. > As far as I could find in the stunnel manual it should be able to use > stunnel for this. > In the manual is an example using foo (client) and bar (server). > > Dick van Fulpen | Senior Software Engineer | Infor | Tel:+31 (0)73 > 6205 222 | Dick.vanFulpen(a)infor.com | Infor | Postbus 2067 | 5202 CB > 's-Hertogenbosch | Nederland | Bezoek onze website www.vubis-smart.com > | >

1 0

Connection Refused locally, SSL Proxy.
by Avner Peled 01 Feb '08

01 Feb '08

Hello! I have a game client connecting to a server using TCP over SSL. I'm trying to setup an SSL proxy using 2 stunnels on the same server like so: Client --> Stunnel-Server:20001 (decrypt)--> Stunnel-Client:901 (encrypt)---> Server:20001 Using latest stunnel-4.21-r1 on Gentoo kernel 2.6.22-gentoo-r9 I have a weird problem. The first connection after starting both stunnels works fine. Afterwards every time the client tries to connect, it gets refused once. Then it tries again and gets connected. Then the next time it will once again get refused once and then connect. I have looked at the logs and it seems the Stunnel server (the first) gets Connection Refused from localhost:901. Then it tries again and gets connected. The Stunnel client (the second) doesn't even mention the first failing local connection in the log. I have provided the config files of both stunnels and a log with debug = 7 (server ip's are censored) I have also tried the following config tweaks with no luck socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 TIMEOUTclose = 0 retry = yes Any help would be appreciated. Thanks!! -- Avner Peled. avnerus(a)gmail.com

1 1

debug level 7
by Damian Wiest 25 Jan '08

25 Jan '08

Hi, I'm new to stunnel and have run into some unexpected behavior. I'm inclined to think it's a bug, but perhaps I'm misunderstanding some things. I'm running FreeBSD 6.2 with stunnel 4.21 (installed via ports collection). I'm able to configure things properly when using stunnel in daemon mode, but am unable to run stunnel from inetd when I set the debug level to 7. Here's the config file I'm using, cert = /usr/local/CA/stunnel.pem key = /usr/local/CA/stunnel.pem sslVersion = all pid = /var/log/swat-stunnel.pid debug = 7 output = /tmp/stunnel.log exec = /usr/local/sbin/swat execargs = swat ...and the inetd.conf entry, swat stream tcp nowait.400 root /usr/local/sbin/stunnel stunnel /usr/local/etc/stunnel/swat.conf If I connect to port 901, some debug messages are written to the socket, dwiest(a)dfwdamian.vail: telnet localhost 901 Trying ::1... telnet: connect to address ::1: Connection refused Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. 2008.01.22 22:19:09 LOG7[81278:134651904]: Snagged 64 random bytes from /home/dwiest/.rnd 2008.01.22 22:19:09 LOG7[81278:134651904]: Wrote 1024 new random bytes to /home/dwiest/.rnd 2008.01.22 22:19:09 LOG7[81278:134651904]: RAND_status claims sufficient entropy for the PRNG 2008.01.22 22:19:09 LOG7[81278:134651904]: PRNG seeded successfully 2008.01.22 22:19:09 LOG7[81278:134651904]: Certificate: /usr/local/CA/stunnel.pem 2008.01.22 22:19:09 LOG7[81278:134651904]: Certificate loaded 2008.01.22 22:19:09 LOG7[81278:134651904]: Key file: /usr/local/CA/stunnel.pem 2008.01.22 22:19:09 LOG7[81278:134651904]: Private key loaded 2008.01.22 22:19:09 LOG7[81278:134651904]: SSL context initialized for service stunnel ^] telnet> q Connection closed. ...and some are written to the file I specified, dwiest(a)dfwdamian.vail: cat /tmp/stunnel.log 2008.01.22 22:19:09 LOG5[81278:134651904]: stunnel 4.21 on i386-unknown-freebsd6.2 with OpenSSL 0.9.7e-p1 25 Oct 2004 2008.01.22 22:19:09 LOG5[81278:134651904]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.01.22 22:19:09 LOG7[81278:134651904]: stunnel started 2008.01.22 22:19:09 LOG7[81278:134651904]: FD 0 in non-blocking mode 2008.01.22 22:19:09 LOG7[81278:134651904]: FD 1 in non-blocking mode 2008.01.22 22:19:09 LOG7[81278:134651904]: stunnel permitted by libwrap from 127.0.0.1:53961 2008.01.22 22:19:09 LOG5[81278:134651904]: stunnel accepted connection from 127.0.0.1:53961 2008.01.22 22:19:09 LOG7[81278:134651904]: SSL state (accept): before/accept initialization 2008.01.22 22:19:11 LOG3[81278:134651904]: SSL_accept: Peer suddenly disconnected 2008.01.22 22:19:11 LOG5[81278:134651904]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.01.22 22:19:11 LOG7[81278:134651904]: stunnel finished (0 left) If I run stunnel in daemon mode with the debug level set to 7, then the messages are printed to stderr. Shouldn't they go to either syslog, or to the file specified with the "output" option? I dug through the source code and discovered that file_putline() is being called from parse_config() before open_log() has been called. This results in file_putline() writing to stderr instead of the specified output file. If this is known behavior, then it would be nice if the man page mentioned something. -Damian

3 3

rtmps with stunnel
by David Schulberg 24 Jan '08

24 Jan '08

Hi, A while ago I reported an issue with using rtmps on linux to connect to a Red5 server through stunnel. I am having no issues on Windows. The rtmps connection is made from Flash code running in the browser. The error reported on Linux was 'SSL_accept: Peer suddenly disconnected' which occurs straight after 'SSL state (accept): before/accept initialization' . Now I am having a similar problem trying to connect from a MAC. In this case I also get 'SSL_accept: Peer suddenly disconnected' which occurs straight after 2008.01.24 16:39:31 LOG7[1608:2980]: SSL state (accept): before/accept initialization 2008.01.24 16:39:31 LOG7[1608:2980]: SSL state (accept): SSLv3 read client hello A 2008.01.24 16:39:31 LOG7[1608:2980]: SSL state (accept): SSLv3 write server hello A 2008.01.24 16:39:31 LOG7[1608:2980]: SSL state (accept): SSLv3 write certificate A 2008.01.24 16:39:31 LOG7[1608:2980]: SSL state (accept): SSLv3 write server done A 2008.01.24 16:39:31 LOG7[1608:2980]: SSL state (accept): SSLv3 flush data It seems to get further on the MAC but still fails. Regards, David

1 0

stunnel with Fedora core
by Andy 17 Jan '08

17 Jan '08

Hello everyone I am trying to configure stunnel on a Fedora Core machine, but have had little luck. The below configuration is in the /etc/stunne/stunnel.conf. I want this machine to send encrypted data to another machine via stunnel. My knowledge of stunnel is quite limited. chroot = /home/stunnel pid = /stunnel.pid setuid = stunnel setgid = stunne; debug = 7 output = /var/log/messages client = yes [ldap] accept = 389 connect = ldap.example.com:636 I have been told that this command will work. stunnel -c -d ldaps -r <LDAPSERVER>:ldaps This command does work under debian but does not work under fedora core. Can anyone help me with this? -- REGARDS, Andy

1 0

Debian Bug#460019: cert= produces output on stderr even with log= set
by Luis Rodrigo Gallardo Cruz 16 Jan '08

16 Jan '08

----- Forwarded message from Bryan Donlan <bd(a)fushizen.net> ----- Version: 3:4.21-1 With the following configuration: output = /srv/stun/log compression = zlib CApath = /srv/stun/keys cert = /srv/stun/server.pem connect = localhost:9999 verify = 3 The following is output on stderr: 2008.01.10 02:54:19 LOG5[11786:3083495088]: Peer certificate location /srv/stun/keys This confuses clients when stunnel is driven direcly from xinetd. This output, if it is produced at all, should be placed in the log file. ----- End forwarded message ----- The issue is that verify_init (verify.c:103) calls s_log(LOG_NOTICE, "Peer certificate location %s", section->ca_dir); apparently before the logfile is setup. Could the log file initialization be moved earlier in the starup sequence? Or maybe this log call's severity could be lowered.

2 6

Nessus crashes stunnel
by Joe Kemp 16 Jan '08

16 Jan '08

I am running some tests against my stunnel configuration with Nessus. I am able to get stunnel to exit silently when I run Nessus with the Nessus TCP Scan and Weak Supported SSL Cipher Suites test. I have played with a few different options but the process consistently ends when these tests are run together. Here is the config: Linux testssl.capwin.net 2.6.18-53.1.4.el5 #1 SMP Fri Nov 30 00:45:16 EST 2007 i686 i686 i386 GNU/Linux gcc version 4.1.2 20070626 (Red Hat 4.1.2-14) stunnel 4.20 on i686-pc-linux-gnu with OpenSSL 0.9.8b 04 May 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Auth:LIBWRAP OpenSSL 0.9.8b 04 May 2006 Tail of log file during nessus tests 2008.01.15 21:24:30 LOG5[10646:3086605200]: XMPP accepted connection from 10.102.11.250:41781 2008.01.15 21:24:30 LOG7[10646:3086605200]: SSL state (accept): before/accept initialization 2008.01.15 21:24:30 LOG7[10646:3086605200]: SSL alert (write): fatal: handshake failure 2008.01.15 21:24:30 LOG3[10646:3086605200]: SSL_accept: 1408A10B: error:1408A10B:SSL routines:SSL3_GET_CLIENT_HELLO:wrong version number 2008.01.15 21:24:30 LOG5[10646:3086605200]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.01.15 21:24:30 LOG7[10646:3086605200]: XMPP finished (0 left) 2008.01.15 21:24:30 LOG7[10646:3086608080]: XMPP accepted FD=7 from 10.102.11.250:41782 2008.01.15 21:24:30 LOG7[10646:3086605200]: XMPP started 2008.01.15 21:24:30 LOG7[10646:3086605200]: FD 7 in non-blocking mode 2008.01.15 21:24:30 LOG7[10646:3086605200]: TCP_NODELAY option set on local socket 2008.01.15 21:24:30 LOG7[10646:3086605200]: FD 8 in non-blocking mode 2008.01.15 21:24:30 LOG7[10646:3086605200]: FD 9 in non-blocking mode 2008.01.15 21:24:30 LOG7[10646:3086608080]: Cleaning up the signal pipe 2008.01.15 21:24:30 LOG6[10646:3086608080]: Child process 10676 finished with code 0 2008.01.15 21:24:30 LOG7[10646:3086605200]: Connection from 10.102.11.250:41782 permitted by libwrap 2008.01.15 21:24:30 LOG5[10646:3086605200]: XMPP accepted connection from 10.102.11.250:41782 2008.01.15 21:24:30 LOG7[10646:3086605200]: SSL state (accept): before/accept initialization Joe A. Kemp CapWIN Senior Systems Architect 6305 Ivy Lane Suite 300 Greenbelt, MD 20770 (P) 301-614-3727 (F) 301-614-0581

2 1

Re: [stunnel-users] stunnel automatically listening to extra ports: BAD
by Luis Rodrigo Gallardo Cruz 12 Jan '08

12 Jan '08

[You forgot to cc: the list] On Fri, Jan 11, 2008 at 03:24:32PM -0500, Alan Pinstein wrote: > On Jan 11, 2008, at 3:02 PM, Luis Rodrigo Gallardo Cruz wrote: >> On Fri, Jan 11, 2008 at 02:31:58PM -0500, Alan Pinstein wrote: >>> Hi All- >>> [ Stunnel listens on ports it shouldn't ] >>> >>> If I start up stunnel from the command line as "root" or another user >>> even, it only listens on the port listed in the conf file. >> >> Could you have some startup script that's automatically getting run >> with your logrotate scripts? >> > The problem happens the MOMENT stunnel starts. It has nothing to do with > the logrotate scripts. Oh, sorry, I got confused. (/me goes and re-reads the original mail ...) > I've done a bunch of debugging and can't figure out what's going on. > I have only one guess: stunnel automatically listens on any ports > that the process calling stunnel is listening on, in some sort of > attempt to seamlessly add SSL to existing daemons. I can't find any > docs or tell from the source code, but it's the only idea I can't > rule out... All this is in a *nix, right? The following is an educated guess: Open connections are open file descriptors, and fork()/exec() do not close open file descriptors. Thus, stunnel is inheriting the open connection. And, since it knows nothing about it, it does not close it or anything like that. So it's not that it activelly listens on it, but only that it does not bother to stop. You might check this theory by trying to connect to the port *after* apache is shut down. If I'm right you should get no answer at all. So, the solution is to have the file descriptors close when exec'ing stunnel. PHP or apache might have some option somewhere to do that (look for "close on exec" or something similarly named), but if not, you might have to write some sort of wrapper to do it. It's a messy thing, because AFAIK there's no clean way to do it short of for (i = 0; i < [some-hopefuly-large-enough-value]; i++) close(i); where the [large-enough-value] is determined by your system's file descriptor limit and your desire not to loop all the way to 2^32 or something. -- Rodrigo i-think-this-time-i-answered-the-question-asked Gallardo GPG-Fingerprint: 7C81 E60C 442E 8FBC D975 2F49 0199 8318 ADC9 BC28

5 4

Re: [stunnel-users] config socket SSL TCP
by khaled khaled 12 Jan '08

12 Jan '08

Hi,Can you send me please ( certificate+Key: Client & server) + CA.i want to try my server.The Client is a socket TCP developped on Openssl and C++.(I 'am sure that theclient work) but my config ???i want to generate a key for the client?the SSL client authenticate itself.Many thanks,FOR the server:-----BEGIN RSA PRIVATE KEY-----MIICXAIBAAKBgQDEIXwTWeacXiNOICmkgTgc+MD/i1w1sJ3LBR/lfnH+9pfs/6HBKY4SW+GHQtlSiHVx0WNQgoPQIU1J29PPWONYivIe2hdSvn1uSSmypa7gudWxUqBYuFKzzlmEMtFmUn8UG5KmV8SYQ/970C1bcEchWMyp40C+f9vkP3U/SmFBAwIDAQABAoGAQaWzkgaVWeFoj83UImveDFR2xRIwWwgyyLF+a6JXJbAESh+GVNFD7IE0i8GkXCuwo9giFeCZniCHbiFWVCC8d1/PZd/inQGfmtdTNbvr9xI7AVTTAH4D+mZTwduAuOAUdoI/r5+Ll/hyfZDdFMZuypbFHCUBspkNIfHymJ8qNwECQQD3Q16K1iuwRjZF7Pwl8YT3t8otnMawilFsV5f3RpGlxCT8yGH23liidPr9cwUCORRT4Lar98a9B77E7lTZEzQJAkEAyw+YW9pNqH13+nvcOkIVwefl1umNuU5ayye7gYi5xuccaoc2AnjtPPX8lSvM9ZNcT/0YQZSAsRfMm7YIq+dHqwJBAIZBDhRUNWSAuvc8tavkd04JfL1HYpp4f71T0i9xIaPf3DVkl8xy7a1H1v/Gc/HBDEh+urCk2EPK8Mn8nhU/WAECQAVikn3NGkYfnbDs2/hHjGAqEDRU2UdSxqGgmh5jS9n0gxJoJ4yFPHVjaKFkGflhQQ91/NCwaYFIykpO14gHiCUCQHkB8W/4zaB47skmB181p9WNiprWZRgqo4BINW6ecVQfc87s7+Jaz3GgRyCJ4QeUtbimOVd3wBO3FqzCyOnOLpY=-----END RSA PRIVATE KEY----------BEGIN CERTIFICATE-----MIICdzCCAeCgAwIBAgIBBzANBgkqhkiG9w0BAQQFADCBhDELMAkGA1UEBhMCRlIxDjAMBgNVBAgTBVBBUklTMQ4wDAYDVQQHEwVQQVJJUzEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMQ8wDQYDVQQDEwZraGFsZWQxITAfBgkqhkiG9w0BCQEWEmtraGFsZWRAaG90bWFpbC5mcjAeFw0wODAxMDgxOTQ5NDJaFw0xODAxMDUxOTQ5NDJaMDAxDzANBgNVBAMTBmNsaWVudDEdMBsGCSqGSIb3DQEJARYObmR0QHdhdmVjb20uZnIwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMQhfBNZ5pxeI04gKaSBOBz4wP+LXDWwncsFH+V+cf72l+z/ocEpjhJb4YdC2VKIdXHRY1CCg9AhTUnb089Y41iK8h7aF1K+fW5JKbKlruC51bFSoFi4UrPOWYQy0WZSfxQbkqZXxJhD/3vQLVtwRyFYzKnjQL5/2+Q/dT9KYUEDAgMBAAGjTDBKMBkGA1UdEQQSMBCBDm5kdEB3YXZlY29tLmZyMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAU2LdfcyCatRPpCalV3Qyq7RJwUjowDQYJKoZIhvcNAQEEBQADgYEAMcC80wuYfwycQF/6mbG2D4iQJkUJGXyWd2ColwPvxos5S07oUyPpy1ev+OVmHCSMZMuBpGsJ+0oNyqe39wWvvjB80pddXaKcRN4lNj7BSo2u/edy8WRoFjj75JV3Z35K5KmMAGs2MS7Np/sHa4CVlu5yd8gI0CIA5gxXwqPNJV8=-----END CERTIFICATE-----For CA ROOT:-----BEGIN RSA PRIVATE KEY-----MIICXwIBAAKBgQDCK1KTB2TkLVbNYnU9t29ZmlClEnszHa/xX8slB/VnFdazw/U2iSS01OtwXaUNTrA/hQJ50ykls14dRBguwJnNuGM8IH8zCCWNdesTMtYF0ZucCkrfSmir9210A2m6Wo1SEbKyUHErFMsW9UcxDPAGyfZQ0dIhjUDDkw9SL+fTPQIDAQABAoGBAJm3SGDjqqjFiAGC38QjM0DhXNTCA8ycxQw2xREk8s9QR6/7A2bQPcH3Cgjj6eXWFMvElggx9lJFZM2QegCRM3B7DlB4VYviCz+T5urezuRiHZkxfHp6m2T9fitcfB+FUCq3uGn3yeA+rLc/P5/dXV3JE1uNmH96p96e6kwRnorBAkEA6eDPz7dIh+2znbCcoyrX4G5tp7DqNooBH5p5gLp9an7DePgfHH15POZfCQ4oNv16VIfPhM8fF9u8tmbs5jjFsQJBANSI/OdNitlQYXCoUuDqgPbsxhnS6ajVUa7ZlMoGgkLCmuSj99gphD0q6tp/9niEhAdp36wSyerEZKvu5TEobU0CQQDZGEeOhpGbK3iJLcGYbFKLD7ZV7JDcI2o7jcavSWzVh+mmxpsKdSYu86DP5QZLVStSf+aPXzt7iAs6PXw1kAlhAkEAwywVSverdUraYFFC4qaWzaq7dMV5q4BRpYbLmwaFIneBNEva8teVR3Kc/xAZr6zJbeFs9KDAaeX2KOmV8SGV1QJBAKGPzYwD5XpW3v9NpmyNYzFf4HuzK6Gh90aZ5CLxSSdDHc9cmCZEgoXgepb6/48+qRpRELkSpeE2IWHBxmGMPa8=-----END RSA PRIVATE KEY----------BEGIN CERTIFICATE-----MIIDZTCCAs6gAwIBAgIBADANBgkqhkiG9w0BAQQFADCBhDELMAkGA1UEBhMCRlIxDjAMBgNVBAgTBVBBUklTMQ4wDAYDVQQHEwVQQVJJUzEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMQ8wDQYDVQQDEwZraGFsZWQxITAfBgkqhkiG9w0BCQEWEmtraGFsZWRAaG90bWFpbC5mcjAeFw0wODAxMDgxOTIyMTlaFw0xODAxMDUxOTIyMTlaMIGEMQswCQYDVQQGEwJGUjEOMAwGA1UECBMFUEFSSVMxDjAMBgNVBAcTBVBBUklTMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQxDzANBgNVBAMTBmtoYWxlZDEhMB8GCSqGSIb3DQEJARYSa2toYWxlZEBob3RtYWlsLmZyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCK1KTB2TkLVbNYnU9t29ZmlClEnszHa/xX8slB/VnFdazw/U2iSS01OtwXaUNTrA/hQJ50ykls14dRBguwJnNuGM8IH8zCCWNdesTMtYF0ZucCkrfSmir9210A2m6Wo1SEbKyUHErFMsW9UcxDPAGyfZQ0dIhjUDDkw9SL+fTPQIDAQABo4HkMIHhMB0GA1UdDgQWBBTYt19zIJq1E+kJqVXdDKrtEnBSOjCBsQYDVR0jBIGpMIGmgBTYt19zIJq1E+kJqVXdDKrtEnBSOqGBiqSBhzCBhDELMAkGA1UEBhMCRlIxDjAMBgNVBAgTBVBBUklTMQ4wDAYDVQQHEwVQQVJJUzEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMQ8wDQYDVQQDEwZraGFsZWQxITAfBgkqhkiG9w0BCQEWEmtraGFsZWRAaG90bWFpbC5mcoIBADAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBAUAA4GBAENN2yi1jGD87BjzQ7PfmmRiwP7psisy8GKv4ipRhho76Su353BOZJXNj1x+gyk1/gsDVeSRf0YDJTiH6bMLY2usC9UA3F7x6zvb36joVxbnKLNhxrXStYIaJgVYW+Pf8Wr3sXO/yAkiyDsCsDseofnSGrirPsMC0N9n5X5qf+ER-----END CERTIFICATE-----FOR the Client-----BEGIN CERTIFICATE-----MIICdzCCAeCgAwIBAgIBBjANBgkqhkiG9w0BAQQFADCBhDELMAkGA1UEBhMCRlIxDjAMBgNVBAgTBVBBUklTMQ4wDAYDVQQHEwVQQVJJUzEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMQ8wDQYDVQQDEwZraGFsZWQxITAfBgkqhkiG9w0BCQEWEmtraGFsZWRAaG90bWFpbC5mcjAeFw0wODAxMDgxOTQ2MzhaFw0xODAxMDUxOTQ2MzhaMDAxDzANBgNVBAMTBnNlcnZlcjEdMBsGCSqGSIb3DQEJARYOa2toQHdhdmVjb20uZnIwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAM9Sl2bn98NylY7KITLL//vJsr0OeuS79qTBdy2ticIWjz4k9/iVDQ7YmvxlxR5KtY1kSZYaSU44lXATH15ukczGWo2qy9uNfA5PhsEIUsE3SaQA+EptaicHQhsZ3QkLypz4gqNqK8Im/Nk4qvTR9Z7pturgROFOsckwOdSYbkC3AgMBAAGjTDBKMBkGA1UdEQQSMBCBDmtraEB3YXZlY29tLmZyMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAU2LdfcyCatRPpCalV3Qyq7RJwUjowDQYJKoZIhvcNAQEEBQADgYEAAfP0JXQlbi0GUIE04dYsCqug2D/l8+PtRuZ0iRUSznwhc5H7nkTeAV/i91BIBC3NtKdlhj6COcCApEVD9Jbax2dPJBm9ZCccVC41qKaD5Wi82y0aK7yIF+EvPGAieSWphhRbNH4ElF/rWADaIGMJz2PqtE0WgptDOfH5z/mn2MM=-----END CERTIFICATE----------BEGIN RSA PRIVATE KEY-----MIICXwIBAAKBgQDPUpdm5/fDcpWOyiEyy//7ybK9Dnrku/akwXctrYnCFo8+JPf4lQ0O2Jr8ZcUeSrWNZEmWGklOOJVwEx9ebpHMxlqNqsvbjXwOT4bBCFLBN0mkAPhKbWonB0IbGd0JC8qc+IKjaivCJvzZOKr00fWe6bbq4EThTrHJMDnUmG5AtwIDAQABAoGBAL00oNvXY3RJhFgV/ApBxtJhFvAW4O0S5Vsi/MMBFzG8KOoMDwob7RjZcUhbEHQ+tkXdepK0VqY+WZM4wG4L9p4IzpvU1CgLcPXf9zw7JLFZITMux1WhDCT/HEnr/sh138va7b7HXOl7TSgBrmo8xyPNktzqsye2TXiRU6rSHjjhAkEA7W+VnzA5V1T/H5N2p3V4Hy6P9Kv83nTqlq4JP9S939/1JYF2ZrdFPluNOO1Gn3PDFhuKZekFvvBdjXq8EH3H/wJBAN+IRdqFvah0smfASV3bEPbP1tl7JwsaOb8UqQciZHkwzQztHrZ7Gf3s+5HvMcQj4TMR9Dl4ad00kmB6pVnnx0kCQQCCBuOXY99jFicI8ca++jOoT+WCBlXatYhqsDBchnLdEVa9DWL76U3AUn7KOBa+57RkfPyTxsLgx91Tx20KUvedAkEAxd2+17xjMeZ6tdREHUx5K8C2kjStTuqcC0Siiqoq/gvwtmx/L1CwpVFNLtTo3JJWGfrekLDCJQkQOU7XZ0n/4QJBAOMpeKnf+ZXAuyhY9DVeCWK9G3MP/2VZuC7Z5N56P5VVk22mxe9LdyMdA2FG69fIuoaT9Uni/yD+tzRb6PJTDzM=-----END RSA PRIVATE KEY----- _________________________________________________________________ Comme 9 millions de français, créez un compte Hotmail ! http://www.windowslive.fr/hotmail/default.asp

1 0

stunnel automatically listening to extra ports: BAD
by Alan Pinstein 11 Jan '08

11 Jan '08

Hi All- I am using stunnel to secure a connection between a local python script using telnetlib and a custom sockets-based server requiring SSL, from local port 4449 to remote port 4449. This is done via: stunnel /opt/www/domains/admin.showcasere.com/showcase/classes/ opensrs-php/stunnel-app.conf where the conf file is: > client = yes > pid = /opt/www/domains/admin.showcasere.com/runtime/stunnel.pid > debug = 7 > [telnet] > accept = 4449 > connect = admin.hostedemail.com:4449 Functionally, everything works for my application, but I am experiencing a bad side-effect. stunnel is ALSO setting up listeners on HTTP and HTTPS ports, and when my daily logrotate scripts run and HUP apache, stunnel steals the web server's ports and the server won't come back up! I had 7 hours of downtime today because of this. I've done a bunch of debugging and can't figure out what's going on. I have only one guess: stunnel automatically listens on any ports that the process calling stunnel is listening on, in some sort of attempt to seamlessly add SSL to existing daemons. I can't find any docs or tell from the source code, but it's the only idea I can't rule out... Here is the debug log of the startup of stunnel (which is run from an apache/php script): Jan 11 13:10:13 bigwoody stunnel: LOG5[13964:3086333632]: stunnel 4.14 on i386-redhat-linux-gnu PTHREAD+POLL+IPv6+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 Jan 11 13:10:13 bigwoody stunnel: LOG7[13964:3086333632]: RAND_status claims sufficient entropy for the PRNG Jan 11 13:10:13 bigwoody stunnel: LOG6[13964:3086333632]: PRNG seeded successfully Jan 11 13:10:13 bigwoody stunnel: LOG6[13964:3086333632]: file ulimit = 1024 (can be changed with 'ulimit -n') Jan 11 13:10:13 bigwoody stunnel: LOG6[13964:3086333632]: poll() used - no FD_SETSIZE limit for file descriptors Jan 11 13:10:13 bigwoody stunnel: LOG5[13964:3086333632]: 500 clients allowed Jan 11 13:10:13 bigwoody stunnel: LOG7[13964:3086333632]: FD 31 in non-blocking mode Jan 11 13:10:13 bigwoody stunnel: LOG7[13964:3086333632]: FD 32 in non-blocking mode Jan 11 13:10:13 bigwoody stunnel: LOG7[13964:3086333632]: FD 33 in non-blocking mode Jan 11 13:10:13 bigwoody stunnel: LOG7[13964:3086333632]: SO_REUSEADDR option set on accept socket Jan 11 13:10:13 bigwoody stunnel: LOG7[13964:3086333632]: telnet bound to 0.0.0.0:4449 Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086333632]: Created pid file /opt/www/domains/admin.showcasere.com/runtime/stunnel.pid Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086333632]: telnet accepted FD=34 from 127.0.0.1:48335 Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: telnet started Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: FD 34 in non-blocking mode Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: FD 35 in non-blocking mode Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: FD 36 in non-blocking mode Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086333632]: Cleaning up the signal pipe Jan 11 13:10:13 bigwoody stunnel: LOG6[13965:3086333632]: Child process 13967 finished with code 0 Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: Connection from 127.0.0.1:48335 permitted by libwrap Jan 11 13:10:13 bigwoody stunnel: LOG5[13965:3086330784]: telnet connected from 127.0.0.1:48335 Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: FD 35 in non-blocking mode Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: telnet connecting 216.40.42.6:4449 Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: connect_wait: waiting 10 seconds Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: connect_wait: connected Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: Remote FD=35 initialized Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: SSL state (connect): before/connect initialization Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: SSL state (connect): SSLv3 write client hello A Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: SSL state (connect): SSLv3 read server hello A Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: SSL state (connect): SSLv3 read server certificate A Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: SSL state (connect): SSLv3 read server done A Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: SSL state (connect): SSLv3 write client key exchange A Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: SSL state (connect): SSLv3 write change cipher spec A Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: SSL state (connect): SSLv3 write finished A Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: SSL state (connect): SSLv3 flush data Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: SSL state (connect): SSLv3 read finished A Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: 1 items in the session cache Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: 1 client connects (SSL_connect()) Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: 1 client connects that finished Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: 0 client renegotiatations requested Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: 0 server connects (SSL_accept()) Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: 0 server connects that finished Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: 0 server renegotiatiations requested Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: 0 session cache hits Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: 0 session cache misses Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: 0 session cache timeouts Jan 11 13:10:13 bigwoody stunnel: LOG6[13965:3086330784]: SSL connected: new session negotiated Jan 11 13:10:13 bigwoody stunnel: LOG6[13965:3086330784]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4 (128) Mac=MD5 Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: SSL socket closed on SSL_read Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: Socket write shutdown Jan 11 13:10:13 bigwoody stunnel: LOG5[13965:3086330784]: Connection closed: 91 bytes sent to SSL, 73 bytes sent to socket Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: telnet finished (0 left) And then, you can see what stunnel is listening on: [root@bigwoody custom_img]# lsof -i | grep stunnel stunnel 13965 apache 4u IPv4 156503478 TCP static-216.114.79.43.primarynetwork.com:http (LISTEN) stunnel 13965 apache 5u IPv4 156503480 TCP static-216.114.79.43.primarynetwork.com:https (LISTEN) stunnel 13965 apache 30u IPv4 156771437 TCP localhost.localdomain:51333->localhost.localdomain:9676 (ESTABLISHED) stunnel 13965 apache 33u IPv4 156846546 TCP *:privatewire (LISTEN) If I start up stunnel from the command line as "root" or another user even, it only listens on the port listed in the conf file. Does anyone have any idea what's going on here? How can I turn off this behavior? Thanks! Alan

2 1

Re: [stunnel-users] your mail
by Brian Hatch 10 Jan '08

10 Jan '08

On or about 2008-01-10 15:34 +0100, khaled45(a)free.fr directed: > Here attached files generated. > can you send me the configuration element of SSL and Stunnel or explain me how > to generate? You sent the private keys too - you shouldn't do this. You should create new keys when done debugging this problem. I saw only 2 keys - the CA and the stunnel.pem. Your configuration specifies 3 keys, the CA, stunnel.pem, and is attempting to verify the SSL client (browser? something else) against the CA via the 'verify=' line. What is the SSL client? Did you generate a key for it? Because your config is requiring the SSL client authenticate itself, and Stunnel is dropping the connection because that phase isn't working correctly. -- Brian Hatch "So, what's the problem?" Systems and "I don't know. Security Engineer *That's* the problem." http://www.ifokr.org/bri/ Every message PGP signed

1 0

Re: [stunnel-users] your mail
by Brian Hatch 09 Jan '08

09 Jan '08

At more or less 2008-01-09 18:09 +0100, khaled45(a)free.fr squalked: > ; It's often easier to use CAfile > CAfile = ca.pem > cert = userkey.pem > debug = 7 > client = no > [apache] > accept = 4433 > connect = 192.168.1.4:433 I'd suggest using the full path for your pem files above, just to be safe. Can you shoot the public keys of the client (which is not on this machine) and the ca.pem and the public key from userkey.pem (which is actually the server's key - you may wish to rename.) There are three pems involved: * the CA key (private) and cert (public) in ca.pem * the stunnel server's key (private) and cert (public) in userkey.pem. ('userkey' is a bad name here.) * the client's key (private) and cert (public) on 192.168.1.5. Can you send the public parts here so I can verify that they're signed by the appropritate folks? -- Brian Hatch "Everybody's cute! Systems and Everybody's cute! Security Engineer Even me. But in http://www.ifokr.org/bri/ purple I'm stunning!" Every message PGP signed

1 0

TCP (Server / Client)
by khaled khaled 09 Jan '08

09 Jan '08

Hi all, I am a new STUNNEL user,I will do 2 secure sockets TCP (Server / Client). I would like to know how to set 'stunnel.conf. I tried but it does not work. Description: ---------- I created a CA root and from this I have created 2 pairs (key and certificate) one for the server and one for the client. You can send me please a config file of the server. Many thanks, Stunnel.config (serveur) ----------------------- cert = server.crt key = serverkey.key CAfile = ca.crt ;[Server] accept = 192.168.1.4:4433 connect = 192.168.1.4:4433 _________________________________________________________________ Votre contact a choisi Hotmail, l'e-mail nouvelle génération. Créez un compte. http://www.windowslive.fr/hotmail/default.asp

3 6