- stunnel-users - stunnel.org

patch: round robin load balancing
by Luke Deller 08 Jan '07

08 Jan '07

Hi, I noticed that stunnel already does round-robin load balancing of connections when the DNS name specified by the "connect" option resolves to multiple IP addresses. Here is a simple patch which allows the "connect" option to accept a comma separated list of names instead of just a single name. This can be used to load balance tunnelled connections across several servers. For example, to load balance HTTPS connections across 3 HTTP servers (localhost:80, anotherhost:8080 and anotherhost:8081), we could specify: [https] accept = 443 connect = 80,anotherhost:8080,anotherhost:8081 Regards, Luke. ********************************************************************************************** Important Note This email (including any attachments) contains information which is confidential and may be subject to legal privilege. If you are not the intended recipient you must not use, distribute or copy this email. If you have received this email in error please notify the sender immediately and delete this email. Any views expressed in this email are not necessarily the views of XPlan Technology. It is the duty of the recipient to virus scan and otherwise test the information provided before loading onto any computer system. Xplan Technology does not warrant that the information is free of a virus or any other defect or error. **********************************************************************************************

1 0

re: I am clearly doing something wrong
by David Chase 06 Jan '07

06 Jan '07

Foolishly, I trusted it to create /usr/local/var/lib/stunnel/ with the correct permissions. The directory that appeared had these permissions: ls -ld /usr/local/var/lib/stunnel/ drwxrwx--T 2 root wheel 68 Jan 5 16:55 /usr/local/var/lib/stunnel/ When I replaced it with this directory ls -ld /usr/local/var/lib/stunnel/ drwxrwxrwx 3 root wheel 102 Jan 5 20:43 /usr/local/var/lib/stunnel/ Suddenly, when I ran stunnel, it continued to run. I'd call this a bug. Still not doing quite what I want, (not connecting to elsewhere.com like I expect) but I'm closer. David Chase

1 0

I am clearly doing something wrong
by David Chase 05 Jan '07

05 Jan '07

But I think the documentation has some serious gaps in it, too. I compiled stunnel, installed it, created certificates, and even turned on debugging in the configuration file. Now, all I want to do is forward port 443 locally to port 80 elsewhere. Says my config file: cert = /usr/local/etc/stunnel/mail.pem ;key = /usr/local/etc/stunnel/mail.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /usr/local/var/lib/stunnel/ setuid = nobody setgid = nogroup ; PID is created inside chroot jail pid = /stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode ; client = yes ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 25 [https] accept = 443 connect = elsewhere.com:80 TIMEOUTclose = 0 and when I run it, it says: sudo /usr/local/sbin/stunnel Password: 2007.01.05 18:51:01 LOG7[13470:2684415368]: Snagged 64 random bytes from /Users/chase/.rnd 2007.01.05 18:51:01 LOG7[13470:2684415368]: Wrote 1024 new random bytes to /Users/chase/.rnd 2007.01.05 18:51:01 LOG7[13470:2684415368]: RAND_status claims sufficient entropy for the PRNG 2007.01.05 18:51:01 LOG7[13470:2684415368]: PRNG seeded successfully 2007.01.05 18:51:01 LOG7[13470:2684415368]: Certificate: /usr/local/ etc/stunnel/mail.pem 2007.01.05 18:51:01 LOG7[13470:2684415368]: Certificate loaded 2007.01.05 18:51:01 LOG7[13470:2684415368]: Key file: /usr/local/etc/ stunnel/mail.pem 2007.01.05 18:51:01 LOG7[13470:2684415368]: Private key loaded 2007.01.05 18:51:01 LOG7[13470:2684415368]: SSL context initialized for service pop3s 2007.01.05 18:51:01 LOG7[13470:2684415368]: Certificate: /usr/local/ etc/stunnel/mail.pem 2007.01.05 18:51:01 LOG7[13470:2684415368]: Certificate loaded 2007.01.05 18:51:01 LOG7[13470:2684415368]: Key file: /usr/local/etc/ stunnel/mail.pem 2007.01.05 18:51:01 LOG7[13470:2684415368]: Private key loaded 2007.01.05 18:51:01 LOG7[13470:2684415368]: SSL context initialized for service imaps 2007.01.05 18:51:01 LOG7[13470:2684415368]: Certificate: /usr/local/ etc/stunnel/mail.pem 2007.01.05 18:51:01 LOG7[13470:2684415368]: Certificate loaded 2007.01.05 18:51:01 LOG7[13470:2684415368]: Key file: /usr/local/etc/ stunnel/mail.pem 2007.01.05 18:51:01 LOG7[13470:2684415368]: Private key loaded 2007.01.05 18:51:01 LOG7[13470:2684415368]: SSL context initialized for service ssmtp 2007.01.05 18:51:01 LOG7[13470:2684415368]: Certificate: /usr/local/ etc/stunnel/mail.pem 2007.01.05 18:51:01 LOG7[13470:2684415368]: Certificate loaded 2007.01.05 18:51:01 LOG7[13470:2684415368]: Key file: /usr/local/etc/ stunnel/mail.pem 2007.01.05 18:51:01 LOG7[13470:2684415368]: Private key loaded 2007.01.05 18:51:01 LOG7[13470:2684415368]: SSL context initialized for service https I see nothing that looks like a complaint, but when I go looking for a stunnel process, there is not one, nor is anyone listening on port 443 at localhost. I cannot be the first person who wanted to do this, but I found both the FAQ and the documentation to be uninformative. How do I keep stunnel running and listening for connections on 443? I tried client=yes, that didn't seem to help. I am running Stunnel 4.20 on MacOS 10.4.8 David Chase

1 0

STunnel transparent + Solaris
by Corey Johnston 05 Jan '07

05 Jan '07

The documentation mentions that Solaris should support transparent mode for stunnel, yet I receive bind errors when I try to do this. "bind transparent: Cannot assign requested adddress (126)" Seems to suggest that either its actually not possible, or I've got to include something beyond "transparent = yes" in the conf file, or during compilation. Does anybody know if there's anything else special to make this work? Thanks in advance, Corey

2 1

Red Hat 7.0, Stunnel 4.20, and my Transparent Proxy Woes
by Richard Anderson 03 Jan '07

03 Jan '07

All, I'm attempting to setup Stunnel 4.20 on a RH7.0 box in transparent mode to essentially act as an SSL accelerator. I've gotten the SSL accelerator part to work (which means RH and Stunnel are working fine). But it's when I enable the transparent feature of stunnel I start having problems. The error it returns is : bind transparent: Cannot assign requested address (99) What I know is this: For transparent option to work with stunnel you must be using linux kernel 2.2. (check...red hat 7.0) Transparent proxy option must be enabled in kernel. (check, enabled, recompiled, and booted off that image) IP_FORWARD must be enabled. (check, set this in the sysctl.conf to do it on bootup) But it still won't work. Does anybody have any other ideas as to what I'm missing? thanks, rich _________________________________________________________________ Get FREE Web site and company branded e-mail from Microsoft Office Live http://clk.atdmt.com/MRT/go/mcrssaub0050001411mrt/direct/01/

1 0

Problem with certificates using smtp /pop
by Klaas 29 Dec '06

29 Dec '06

Hello, I have installed stunnel 4.20 on Windows2003 server and have created my private key as follow: openssl req -new -days 365 -nodes -config stunnel.cnf -out certreq.pem -keyout stunnel.pem After that I have send certreq.pem to my own CA and have received a certnew.cer file. But what I have to do next because I still receive the message that the CN-name of the certificate is not the same with the given name. I append this certificate (certnew.cer) to my stunnel.pem file like: -----BEGIN RSA PRIVATE KEY----- data here -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- data here -----END CERTIFICATE----- But this doesn't work. Still receive the message that I also read on the stunnel.conf must I config something here? cert = stunnel.pem key = stunnel.pem ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem Can anyone tell me what certificate I place where and how config the stunnel.conf so I get this working?

1 0

Avira Anti-Vir Detects stunnel as virus
by Daniel Tschinder 26 Dec '06

26 Dec '06

I'm using Avira AntiVir (www.free-av.de) and it detects stunnel 4.20 as virus APPL/Stunnel.A . I do not know what to do against it... as you can see in this list, stunnel was added to the signatures Database of AntiVir: http://www.avira.de/en/threats/section/vdfhistory/vdf_no/6.37.00.53/6.37.00… Maybe one of the devs can check back with avira.... best regards, daniel

2 1

Benchmarks
by Michal Trojnara 17 Dec '06

17 Dec '06

Dear Users, I have updated stunnel performance benchmarks: http://stunnel.mirt.net/perf.html I hope you'll find them useful. The funny thing I currently have 2 hardware accelerator cards, but none of them works: - one of them is too obsolete and its proprietary drivers are no longer available; - the other one is too modern and its PCI-X slot does not work with my ASUS P5WDG2 WS Professional motherboard. I'm pretty sure most users won't even be able to utilize the performance provided by software implementation. The bottleneck will most likely be network connection or the destination server performance. Best regards, Mike

1 0

service reconfiguration by SIGHUP
by Matthew Eaton 15 Dec '06

15 Dec '06

Hi, I've created a patch to Stunnel that reloads all accepting connections from the config file. This will not work for privileged ports in the current implementation. Test at your own risk :) Feedback welcome. Best regards, Matthew diff -urb stunnel-orig/stunnel-4.20/src/stunnel.c stunnel-4.20/src/stunnel.c --- stunnel-orig/stunnel-4.20/src/stunnel.c 2006-11-30 15:47:45.000000000 -0500 +++ stunnel-4.20/src/stunnel.c 2006-12-12 03:34:36.000000000 -0500 @@ -53,12 +53,12 @@ #endif int volatile num_clients=0; /* Current number of clients */ +int volatile conf_updated=0; /* Conf updated ? */ /* Functions */ #ifndef USE_WIN32 int main(int argc, char* argv[]) { /* execution begins here 8-) */ - main_initialize(argc>1 ? argv[1] : NULL, argc>2 ? argv[2] : NULL); signal(SIGPIPE, SIG_IGN); /* avoid 'broken pipe' signal */ @@ -78,12 +78,17 @@ } #endif +char *cfg_arg1 = NULL; +char *cfg_arg2 = NULL; + void main_initialize(char *arg1, char *arg2) { ssl_init(); /* initialize SSL library */ sthreads_init(); /* initialize critical sections & SSL callbacks */ parse_config(arg1, arg2); log_open(); stunnel_info(0); + cfg_arg1 = arg1; + cfg_arg2 = arg2; } void main_execute(void) { @@ -105,6 +110,7 @@ SOCKADDR_UNION addr; s_poll_set fds; LOCAL_OPTIONS *opt; + int i; get_limits(); s_poll_zero(&fds); #if !defined(USE_WIN32) && !defined(USE_OS2) @@ -173,6 +179,42 @@ accept_connection(opt); } + if(conf_updated) { + for(i=0; i<fds.nfds; i++) + close(fds.ufds[i].fd); + + /* re-bind local ports */ + for(opt=local_options.next; opt; opt=opt->next) { + if(!opt->option.accept) /* no need to bind this service */ + continue; + memcpy(&addr, &opt->local_addr.addr[0], sizeof(SOCKADDR_UNION)); + if((opt->fd=socket(addr.sa.sa_family, SOCK_STREAM, 0))<0) { + sockerror("local socket"); + exit(1); + } + if(alloc_fd(opt->fd)) + exit(1); + if(set_socket_options(opt->fd, 0)<0) + exit(1); + s_ntop(opt->local_address, &addr); + if(bind(opt->fd, &addr.sa, addr_len(addr))) { + s_log(LOG_ERR, "Error binding %s to %s", + opt->servname, opt->local_address); + sockerror("bind"); + exit(1); + } + s_log(LOG_DEBUG, "%s bound to %s", opt->servname, opt->local_address); + if(listen(opt->fd, 5)) { + sockerror("listen"); + exit(1); + } +#ifdef FD_CLOEXEC + fcntl(opt->fd, F_SETFD, FD_CLOEXEC); /* close socket in child execvp */ +#endif + s_poll_add(&fds, opt->fd, 1, 0); + } + conf_updated = 0; + } } s_log(LOG_ERR, "INTERNAL ERROR: End of infinite loop 8-)"); } @@ -413,9 +455,16 @@ } static void signal_handler(int sig) { /* signal handler */ + if((sig==SIGHUP) && local_options.next) { /* only in service mode */ + s_log(LOG_NOTICE, "Re-reading configuration"); + parse_config(cfg_arg1, cfg_arg2); + conf_updated = 1; + } + else { s_log(sig==SIGTERM ? LOG_NOTICE : LOG_ERR, "Received signal %d; terminating", sig); exit(3); + } } #endif /* !defined USE_WIN32 */

1 2

stunnel patch to support URL lookups for parameters (take 2)
by Dan Jakubiec 13 Dec '06

13 Dec '06

Attached is a patch which extends the "connect=" and "CApath=" options to allow these parameters to be obtained dynamically at connect-time via a URL lookup, rather than statically from the stunnel configuration file. It is a generalization of an earlier patch to 4.04 submitted by Jan Piet-Mens which does something similar using LDAP lookups. Feedback is appreciated! Here is a summary of the functionality, along with some notes: 1. The patch was written to allow stunnel to dynamically route and authenticate incoming connections based on parameters found in the client's certificate. 2. Routing and authentication information is obtained by issuing a URL lookup, so the information can be obtained from a variety of local or remote sources. 3. It is particularly useful in high-volume, load-balancing scenarios where many copies of stunnel are running on multiple front-end servers. It allows the destination socket and client certificate verification info to be obtained on-the-fly from a centralized database. 4. Although primarily intended for use with HTTP, this patch uses the libcurl URL library and should work with all of its supported protocols: HTTP, HTTPS, FTP, FTPS, TFTP, DICT, TELNET, LDAP or FILE. As a brief example, an end-user might configure their stunnel as follows: cert = id.pem verify = 2 CApath = ca_dir CAlookup = http://database.stunnel.org/map_client.php?hash=%h [dynamic] accept = 50000 connect = @http://database.stunnel.org/map_client.php?common_name=%n In this scenario, an incoming stunnel connection would obtain it's connect info from database.stunnel.org by sending an HTTP request and passing the common name found in the client certificate. Similarly, the client's certificate would be verified using CA certificates obtained via HTTP lookup to the same host. Comments are appreciated. Thanks, Dan Jakubiec

1 0

stunnel patch to support URL lookups for parameters
by Dan Jakubiec 13 Dec '06

13 Dec '06

Attached is a patch which extends the "connect=" and "CApath=" options to allow these parameters to be obtained dynamically at connect-time via a URL lookup, rather than statically from the stunnel configuration file. It is a generalization of an earlier patch to 4.04 submitted by Jan Piet-Mens which does something similar using LDAP lookups. Feedback is appreciated! Here is a summary of the functionality, along with some notes: 1. The patch was written to allow stunnel to dynamically route and authenticate incoming connections based on parameters found in the client's certificate. 2. Routing and authentication information is obtained by issuing a URL lookup, so the information can be obtained from a variety of local or remote sources. 3. It is particularly useful in high-volume, load-balancing scenarios where many copies of stunnel are running on multiple front-end servers. It allows the destination socket and client certificate verification info to be obtained on-the-fly from a centralized database. 4. Although primarily intended for use with HTTP, this patch uses the libcurl URL library and should work with all of its supported protocols: HTTP, HTTPS, FTP, FTPS, TFTP, DICT, TELNET, LDAP or FILE. As a brief example, an end-user might configure their stunnel as follows: cert = id.pem verify = 2 CApath = ca_dir CAlookup = http://database.stunnel.org/map_client.php?hash=%h <http://database.stunnel.org/map_client.php?hash=%25h> [dynamic] accept = 50000 connect = @http://database.stunnel.org/map_client.php?common_name=%n<http://database.stunnel.org/map_client.php?common_name=%25n> In this scenario, an incoming stunnel connection would obtain it's connect info from database.stunnel.org by sending an HTTP request and passing the common name found in the client certificate. Similarly, the client's certificate would be verified using CA certificates obtained via HTTP lookup to the same host. Comments are appreciated. Thanks, Dan Jakubiec

1 0

Re: [stunnel-users] service reconfiguration by SIGHUP
by Hans Werner Strube 13 Dec '06

13 Dec '06

Matthew Eaton wrote: > I've created a patch to Stunnel that reloads all accepting connections > from the config file. This will not work for privileged ports in the > current implementation. Please explain why it will not work for privileged ports. Does this hold even if the master stunnel process runs as root? And what happens to active connections on SIGHUP? Are they simply broken?

2 1

Re: [stunnel-users] STunnel performance Issues
by Michal Trojnara 11 Dec '06

11 Dec '06

"Jones Scott - sjones" <Scott.Jones(a)acxiom.com> wrote: > But during load testing the system starts breaking down. It takes about > 1/5 the load to break down apache and stunnel, than directly against my > jboss node. Could you elaborate on "break down", please? Is there an error? A core dump? What is the error message? A core dump stack backtrace? First performance recommendation is to disable libwrap support: ./configure --disable-libwrap && make clean && make && make install Best regards, Mike

1 0

STunnel performance Issues
by Jones Scott - sjones 11 Dec '06

11 Dec '06

I am having problems will apache and stunnel being able to handle load. I am using stunnel to encrypt my ajp traffic from apache to jboss. This helps me bridge our internal firewall. But during load testing the system starts breaking down. It takes about 1/5 the load to break down apache and stunnel, than directly against my jboss node. Any performance tuning recommendations would be great. I am using stunnel straight out of the box. I will place the configuration file below. Thanks. ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode ;cert = /usr/local/stunnel/etc/stunnel/mail.pem ;key = /usr/local/stunnel/etc/stunnel/mail.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /usr/local/stunnel/var/lib/stunnel/ setuid = nobody setgid = nogroup ; PID is created inside chroot jail pid = /stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail CApath = certificates ; It's often easier to use CAfile CAfile = /usr/local/stunnel/etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/stunnel/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [ajp] accept = 8009 connect = xxxx2:8009 [sql] accept = 1433 connect = XXXX1:443 *************************************************************************** The information contained in this communication is confidential, is intended only for the use of the recipient named above, and may be legally privileged. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please resend this communication to the sender and delete the original message or any copy of it from your computer system. Thank You. ****************************************************************************

1 0

SSL_accept: Peer suddenly disconnected
by James Brown 08 Dec '06

08 Dec '06

I'm trying to send an email through stunnel (which is running on the mail server), but I keep getting an error. $ sudo /usr/local/sbin/stunnel 2006.12.07 15:35:27 LOG7[6092:2684407744]: Snagged 64 random bytes from /Users/jlbrown/.rnd 2006.12.07 15:35:27 LOG7[6092:2684407744]: Wrote 1024 new random bytes to /Users/jlbrown/.rnd 2006.12.07 15:35:27 LOG7[6092:2684407744]: RAND_status claims sufficient entropy for the PRNG 2006.12.07 15:35:27 LOG7[6092:2684407744]: PRNG seeded successfully 2006.12.07 15:35:27 LOG7[6092:2684407744]: Certificate: /etc/postfix/ smtpd.cert 2006.12.07 15:35:27 LOG7[6092:2684407744]: Certificate loaded 2006.12.07 15:35:27 LOG7[6092:2684407744]: Key file: /etc/postfix/ smtpd.key 2006.12.07 15:35:27 LOG7[6092:2684407744]: Private key loaded 2006.12.07 15:35:27 LOG7[6092:2684407744]: SSL context initialized for service ssmtp 2006.12.07 15:35:27 LOG5[6092:2684407744]: stunnel 4.19 on i686-apple- darwin8.8.1 with OpenSSL 0.9.7l 28 Sep 2006 2006.12.07 15:35:27 LOG5[6092:2684407744]: Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv4 Auth:LIBWRAP 2006.12.07 15:35:27 LOG6[6092:2684407744]: file ulimit = 256 (can be changed with 'ulimit -n') 2006.12.07 15:35:27 LOG6[6092:2684407744]: FD_SETSIZE = 1024 (some systems allow to increase this value) 2006.12.07 15:35:27 LOG5[6092:2684407744]: 125 clients allowed 2006.12.07 15:35:27 LOG7[6092:2684407744]: FD 6 in non-blocking mode 2006.12.07 15:35:27 LOG7[6092:2684407744]: FD 7 in non-blocking mode 2006.12.07 15:35:27 LOG7[6092:2684407744]: FD 8 in non-blocking mode 2006.12.07 15:35:27 LOG7[6092:2684407744]: SO_REUSEADDR option set on accept socket 2006.12.07 15:35:27 LOG7[6092:2684407744]: ssmtp bound to 0.0.0.0:465 2006.12.07 15:35:27 LOG7[6093:2684407744]: Created pid file /usr/ local/var/run/stunnel/stunnel.pid 2006.12.07 15:35:52 LOG7[6093:2684407744]: ssmtp accepted FD=9 from 192.168.1.4:62929 2006.12.07 15:35:52 LOG7[6093:25188864]: ssmtp started 2006.12.07 15:35:52 LOG7[6093:25188864]: FD 9 in non-blocking mode 2006.12.07 15:35:52 LOG7[6093:25188864]: TCP_NODELAY option set on local socket 2006.12.07 15:35:52 LOG7[6093:25188864]: FD 10 in non-blocking mode 2006.12.07 15:35:52 LOG7[6093:25188864]: FD 11 in non-blocking mode 2006.12.07 15:35:52 LOG7[6093:25188864]: Connection from 192.168.1.4:62929 permitted by libwrap 2006.12.07 15:35:52 LOG7[6093:2684407744]: Cleaning up the signal pipe 2006.12.07 15:35:52 LOG5[6093:25188864]: ssmtp accepted connection from 192.168.1.4:62929 2006.12.07 15:35:52 LOG6[6093:2684407744]: Child process 6094 finished with code 0 2006.12.07 15:35:52 LOG7[6093:25188864]: SSL state (accept): before/ accept initialization 2006.12.07 15:35:52 LOG7[6093:25188864]: SSL state (accept): SSLv3 read client hello A 2006.12.07 15:35:52 LOG7[6093:25188864]: SSL state (accept): SSLv3 write server hello A 2006.12.07 15:35:52 LOG7[6093:25188864]: SSL state (accept): SSLv3 write certificate A 2006.12.07 15:35:52 LOG7[6093:25188864]: SSL state (accept): SSLv3 write server done A 2006.12.07 15:35:52 LOG7[6093:25188864]: SSL state (accept): SSLv3 flush data 2006.12.07 15:35:52 LOG3[6093:25188864]: SSL_accept: Peer suddenly disconnected 2006.12.07 15:35:52 LOG5[6093:25188864]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.12.07 15:35:52 LOG7[6093:25188864]: ssmtp finished (0 left) My stunnel.conf is: cert = /etc/postfix/smtpd.cert key = /etc/postfix/smtpd.key sslVersion = all socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel.log [ssmtp] client = no accept = 465 connect = 25 Does this mean that the SMTP proxy listening on port 25 is not accepting the connection from stunnel? Thanks, James.

2 4

Installing stunnel without need a compiler
by Boxall, John 05 Dec '06

05 Dec '06

Mike et al, I want to be able to automate the installation of stunnel in the same manner that I've already automated our openssh installation, however, I've run into a problem (lack of knowledge) with the "make install" step. This is for Solaris (2.5.1 to 10) and AIX (5.1 to 5.3). I'm not quite ready to create the packages in either Solaris (pkg) or AIX (rpm) formats. At a high level, here is what I would like to achieve: - On a build server (per OS version) - transfer all of the necessary stuff (gcc, openssl, stunnel source, etc.) - install the necessary stuff (gcc, openssl, etc.) - un'tar the stunnel package - run configure (with the appropriate options and paths) - run "make" - tar the stunnel directory & transfer it to a holding system - Put together the necessary pieces on the holding system to install stunnel on all targets. - On a target system (per OS version) - transfer all of the necessary stuff (libgcc, openssl, tar'ed stunnel directory, etc.) - install the necessary stuff (libgcc, openssl, zlib, etc.) - un-tar the stunnel file - run "make install" Using the same flow with our openssh packages, I do not have to install a compiler (gcc) and its support packages. What, if anything, can I do with the stunnel installation to not have to install a compiler? Regards, John Boxall

2 1

Re: [stunnel-users] Win: sometines don't connect
by Miroslav Geisselreiter 04 Dec '06

04 Dec '06

Hi My comments inline .... >>>>>> Miroslav Geisselreiter <mg(a)intar.cz> 12/01/06 8:04 PM >>> <SNIP> someotherpc config is here: service = stunnel cert = stunnel.pem CAfile = cacerts.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 3 taskbar = yes [VNC] accept = 5600 connect = localhost:5900 I doubt how the "connect" option can be configured like this? should n't it be "connect = <yourfirstPC>:5900" and the accpet option should be "somotherpc:5600" <SNIP> Hope this helps! Regards Prem I think it is correct. On the first PC stunnel listens on localhost:5900 and passes securelly to second PC to port 5600. VNC on first PC connect to localhost port 5900. On the second PC stunnel accepts connection from any PC on port 5600 and passes to localhost (still second PC) to port 5900. VNC on second PC listens on port 5900. Miroslav Geisselreiter -- Odchozi zprava neobsahuje viry. Zkontrolovano AVG. Verze: 7.5.432 / Virova baze: 268.15.6/566 - datum vydani: 3.12.2006 16:36

1 0

performance configuration for rehl3 & JBoss
by Jones Scott - sjones 01 Dec '06

01 Dec '06

I am having problems will apache and stunnel being able to handle load. I am using stunnel to encrypt my ajp traffic from apache to jboss. This helps me bridge our internal firewall. But during load testing the system starts breaking down. It takes about 1/5 the load to break down apache and stunnel, than directly against my jboss node. Any performance tuning recommendations would be great. I am using stunnel straight out of the box. I will place the configuration file below. Thanks. ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode ;cert = /usr/local/stunnel/etc/stunnel/mail.pem ;key = /usr/local/stunnel/etc/stunnel/mail.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /usr/local/stunnel/var/lib/stunnel/ setuid = nobody setgid = nogroup ; PID is created inside chroot jail pid = /stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail CApath = certificates ; It's often easier to use CAfile CAfile = /usr/local/stunnel/etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/stunnel/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [ajp] accept = 8009 connect = xxxx2:8009 [sql] accept = 1433 connect = XXXX1:443 ************************************************************************* The information contained in this communication is confidential, is intended only for the use of the recipient named above, and may be legally privileged. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please resend this communication to the sender and delete the original message or any copy of it from your computer system. Thank you. *************************************************************************

1 0

Win: sometines don't connect
by Miroslav Geisselreiter 01 Dec '06

01 Dec '06

Hi, I use stunnel 4.16 on Windows 2000 and XP with this simple config: cert = stunnel.pem CAfile = cacerts.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 client = yes verify = 3 [VNC2] accept = localhost:5900 connect = someotherpc:5600 When I start stunnel (as Win service), sometimes it forwards to someotherpc:5600 (it is correct) but sometimes it doesn't. Here is the debug 7 info: 2006.12.01 14:52:32 LOG7[3676:4060]: RAND_status claims sufficient entropy for the PRNG 2006.12.01 14:52:32 LOG7[3676:4060]: PRNG seeded successfully 2006.12.01 14:52:32 LOG7[3676:4060]: Certificate: stunnel.pem 2006.12.01 14:52:32 LOG7[3676:4060]: Certificate loaded 2006.12.01 14:52:32 LOG7[3676:4060]: Key file: stunnel.pem 2006.12.01 14:52:32 LOG7[3676:4060]: Private key loaded 2006.12.01 14:52:32 LOG7[3676:4060]: Loaded verify certificates from cacerts.pem 2006.12.01 14:52:32 LOG7[3676:4060]: SSL context initialized for service VNC2 2006.12.01 14:52:32 LOG5[3676:4060]: stunnel 4.16 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.12.01 14:52:32 LOG5[3676:4060]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.12.01 14:52:32 LOG5[3676:3108]: No limit detected for the number of clients 2006.12.01 14:52:32 LOG7[3676:3108]: FD 180 in non-blocking mode 2006.12.01 14:52:32 LOG7[3676:3108]: SO_REUSEADDR option set on accept socket 2006.12.01 14:52:32 LOG7[3676:3108]: VNC2 bound to 127.0.0.1:5900 When it doesn't work correcly, it stops here, otherwise continues: 2006.12.01 14:52:34 LOG7[3676:3108]: VNC2 accepted FD=188 from 127.0.0.1:1364 2006.12.01 14:52:34 LOG7[3676:3108]: Creating a new thread 2006.12.01 14:52:34 LOG7[3676:3108]: New thread created 2006.12.01 14:52:34 LOG7[3676:4008]: VNC2 started 2006.12.01 14:52:34 LOG7[3676:4008]: FD 188 in non-blocking mode 2006.12.01 14:52:34 LOG7[3676:4008]: TCP_NODELAY option set on local socket 2006.12.01 14:52:34 LOG5[3676:4008]: VNC2 connected from 127.0.0.1:1364 2006.12.01 14:52:34 LOG7[3676:4008]: FD 212 in non-blocking mode 2006.12.01 14:52:34 LOG7[3676:4008]: VNC2 connecting 192.168.1.172:5600 2006.12.01 14:52:34 LOG7[3676:4008]: connect_wait: waiting 10 seconds 2006.12.01 14:52:34 LOG7[3676:4008]: connect_wait: connected 2006.12.01 14:52:34 LOG7[3676:4008]: Remote FD=212 initialized 2006.12.01 14:52:34 LOG7[3676:4008]: TCP_NODELAY option set on remote socket 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): before/connect initialization 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 write client hello A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 read server hello A 2006.12.01 14:52:34 LOG6[3676:4008]: *** starting OCSP verification *** 2006.12.01 14:52:34 LOG5[3676:4008]: VERIFY OK: depth=0, some info .... 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 read server certificate A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 read server certificate request A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 read server done A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 write client certificate A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 write client key exchange A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 write certificate verify A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 write change cipher spec A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 write finished A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 flush data 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 read finished A 2006.12.01 14:52:34 LOG7[3676:4008]: 1 items in the session cache 2006.12.01 14:52:34 LOG7[3676:4008]: 1 client connects (SSL_connect()) 2006.12.01 14:52:34 LOG7[3676:4008]: 1 client connects that finished 2006.12.01 14:52:34 LOG7[3676:4008]: 0 client renegotiations requested 2006.12.01 14:52:34 LOG7[3676:4008]: 0 server connects (SSL_accept()) 2006.12.01 14:52:34 LOG7[3676:4008]: 0 server connects that finished 2006.12.01 14:52:34 LOG7[3676:4008]: 0 server renegotiations requested 2006.12.01 14:52:34 LOG7[3676:4008]: 0 session cache hits 2006.12.01 14:52:34 LOG7[3676:4008]: 0 session cache misses 2006.12.01 14:52:34 LOG7[3676:4008]: 0 session cache timeouts 2006.12.01 14:52:34 LOG6[3676:4008]: SSL connected: new session negotiated 2006.12.01 14:52:34 LOG6[3676:4008]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 someotherpc config is here: service = stunnel cert = stunnel.pem CAfile = cacerts.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 3 taskbar = yes [VNC] accept = 5600 connect = localhost:5900 It runs as win service too. Please help. -- Miroslav Geisselreiter -- Odchozi zprava neobsahuje viry. Zkontrolovano AVG. Verze: 7.5.432 / Virova baze: 268.15.3/562 - datum vydani: 1.12.2006 13:12

2 1

HTTPS proxy authentication
by Brett.Carroll＠bpd.treas.gov 01 Dec '06

01 Dec '06

I am trying to get stunnel to work through a HTTPS proxy but the current version doesn't seem to include the patch for this. Does the latest version (4.20) include https proxying support?

1 0

Problem in Stunnel with too many connections
by ~ Kunal Sharma ~ 01 Dec '06

01 Dec '06

Hi Friends, I've just joined this group. I would take this as an oppurtunity to discuss a problem I've been facing in using Stunnel. I've been using Stunnel for quite some time now. It has worked very well all this while. Recently, I had to shift our webserver onto the Internet and Stunnel accepts the https connections on the server's behalf. The problem is there are about 4.5 million clients out there in the field and there's a client coming up to the server atleast every second, if not less. Stunnel accepts the connections and after a while (like an hour) it just dies ! I see that at a point there are about 950 active connections and thats the maximum I could see before it dies. Could someone help me diagnose the problem (or better to fix it) - Is there any performance related issue thats a known problem and I don't know of ? - What I can look at to see what could be the possible cause ? - I haven't had a chance to look at the logs yet. Probably they might tell me something. - Any other pointers / inputs / suggestions would be heartily welcome. I've not been to my office so I won't be able to attach the necessary information like the version of stunnel, the logs, configuration options etc. But promise to send them as soon as I'm back on Monday after Thanksgiving. Thanks and Regards, Kunal

4 8

stunnel 4.20 released
by Michal Trojnara 30 Nov '06

30 Nov '06

Dear Users, I have just released a new version of stunnel. Here is the ChangeLog entry: Version 4.20, 2006.11.30, urgency: MEDIUM: * Release notes - The new transfer() function has been well tested. I recommend upgrading any previous version with this one. * Bugfixes - Fixed support for encrypted passphases (broken in 4.19). - Reduced amount of debug logs. - A minor man page update. Home page/download: http://stunnel.mirt.net/ sha1sum for stunnel-4.20.tar.gz fie: a9a449b28a4f34ab22f6b4bfaa81c1904a5883c4 Best regards, Mike

1 0

Adding header to SMTP msgs
by Eric B. 27 Nov '06

27 Nov '06

Hi, I am looking at stunnel as a way to add SSL/TLS to an SMTP server, but my issue is that the SMTP server must be able to determine the address of the incoming connection to perform RBL checks, reverse MX record checks, PTR checks, etc. From what I can understand, however, the SMTP server will only see the client side of the pipe (localhost) as the originating address, instead of the originating machine IP. Is there any way to get the SMTP server to see that original IP address? Or baring that, is there anyway that stunnel can insert a header into the mail indicating the original IP address? Thanks! Eric

2 4

must restart stunnel to add a new cert before it recognized it...
by Rami Michael 22 Nov '06

22 Nov '06

Hello everyone, My stunnel setup is working fine, got mysql being hit from a couple of boxes but my question is this... I have stunnel setup so i copy the cert created from the remote client over to the local server so remote connections are authenticated. Now that works fine and dandy, the issue is, if i am adding a new remote client, i add the cert from the client to my certs.pem locally but i need to restart the stunnel process before stunnel will "read in" the new cert. I know this does not sound like a big deal, but if i have 20 machines connected through stunnel to this local box and i need to restart stunnel whenever i need to add a new box or take off an old one, i don't think its good. I use stunnel for mysql so i got these guys doing inserts and a broken connection would really mess things up for me... i think maybe there is a flag i can set? or maybe send the process some type of command to reload the certs? Any help would be appreciated... all relevant info included below. All requested info for posts to the group are found below Here is my stunnel.conf verify = 3 CAfile = /etc/stunnel/certs.pem cert = /etc/stunnel/stunnel.pem setuid = nobody setgid = nobody pid = /tmp/stunnel.pid debug = 7 output = /var/log/stunnel.log client = no [mysqls] accept = 3309 connect = 3306 Some output from the stunnel.log at high debug level 2006.11.13 23:03:10 LOG5[32244:3086689984]: stunnel 4.05 on i686-redhat-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 2006.11.13 23:03:10 LOG7[32244:3086689984]: Snagged 64 random bytes from /dev/urandom 2006.11.13 23:03:10 LOG7[32244:3086689984]: RAND_status claims sufficient entropy for the PRNG 2006.11.13 23:03:10 LOG6[32244:3086689984]: PRNG seeded successfully 2006.11.13 23:03:10 LOG7[32244:3086689984]: Certificate: /etc/stunnel/stunnel.pem 2006.11.13 23:03:10 LOG7[32244:3086689984]: Key file: /etc/stunnel/stunnel.pem 2006.11.13 23:03:10 LOG7[32244:3086689984]: Loaded verify certificates from /etc/stunnel/certs.pem 2006.11.13 23:03:10 LOG5[32244:3086689984]: FD_SETSIZE=1024, file ulimit=1024 -> 500 clients allowed 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 4 in non-blocking mode 2006.11.13 23:03:10 LOG7[32244:3086689984]: SO_REUSEADDR option set on accept socket 2006.11.13 23:03:10 LOG7[32244:3086689984]: mysqls bound to 0.0.0.0:3309 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 5 in non-blocking mode 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 6 in non-blocking mode 2006.11.13 23:03:10 LOG7[32245:3086689984]: Created pid file /tmp/stunnel.pid stunnel -V 2006.11.13 23:03:14 LOG3[32248:3086505664]: -V: No such file or directory (2) Syntax: stunnel [filename] | -fd [n] | -help | -version | -sockets filename - use specified config file instead of /etc/stunnel/stunnel.conf -fd n - read the config file from specified file descriptor -help - get config file help -version - display version and defaults -sockets - display default socket options uname -a Linux ramison 2.6.9-42.0.3.EL #1 Fri Oct 6 05:59:54 CDT 2006 i686 i686 i386 GNU/Linux gcc -v Reading specs from /usr/lib/gcc/i386-redhat-linux/3.4.6/specs Configured with: ../configure --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --enable-shared --enable-threads=posix --disable-checking --with-system-zlib --enable-__cxa_atexit --disable-libunwind-exceptions --enable-java-awt=gtk --host=i386-redhat-linux Thread model: posix gcc version 3.4.6 20060404 (Red Hat 3.4.6-3) openssl version OpenSSL 0.9.7a Feb 19 2003

4 7

s_poll_wait timeout errors
by James Brown 17 Nov '06

17 Nov '06

I'm trying to set up an SSL connection from stunnel to Postfix, but can not get it to work. stunnel log says: 2006.11.16 11:35:31 LOG7[5240:25188864]: ssmtp started 2006.11.16 11:35:31 LOG7[5240:25188864]: FD 9 in non-blocking mode 2006.11.16 11:35:31 LOG7[5240:25188864]: TCP_NODELAY option set on local socket 2006.11.16 11:35:31 LOG7[5240:25188864]: FD 10 in non-blocking mode 2006.11.16 11:35:31 LOG7[5240:25188864]: FD 11 in non-blocking mode 2006.11.16 11:35:31 LOG7[5240:25188864]: Connection from 192.168.1.12:51469 permitted by libwrap 2006.11.16 11:35:31 LOG5[5240:25188864]: ssmtp connected from 192.168.1.12:51469 2006.11.16 11:35:31 LOG7[5240:25188864]: FD 10 in non-blocking mode 2006.11.16 11:35:31 LOG7[5240:25188864]: ssmtp connecting 127.0.0.1:25 2006.11.16 11:35:31 LOG7[5240:25188864]: connect_wait: waiting 10 seconds 2006.11.16 11:35:31 LOG7[5240:25188864]: connect_wait: connected 2006.11.16 11:35:31 LOG7[5240:25188864]: Remote FD=10 initialized 2006.11.16 11:35:31 LOG7[5240:25188864]: TCP_NODELAY option set on remote socket 2006.11.16 11:35:31 LOG5[5240:25188864]: Negotiations for smtp (client side) started 2006.11.16 11:35:31 LOG7[5240:2684415368]: Cleaning up the signal pipe 2006.11.16 11:35:31 LOG6[5240:2684415368]: Child process 5251 finished with code 0 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 220 mail3.bordo.com.au ESMTP Postfix 2006.11.16 11:35:31 LOG7[5240:25188864]: -> 220 mail3.bordo.com.au ESMTP Postfix 2006.11.16 11:35:31 LOG7[5240:25188864]: -> EHLO localhost 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-mail3.bordo.com.au 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-SIZE 10240000 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-ETRN 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-AUTH PLAIN LOGIN 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-AUTH=PLAIN LOGIN 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-XFORWARD NAME ADDR PROTO HELO SOURCE 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-ENHANCEDSTATUSCODES 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-8BITMIME 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250 DSN 2006.11.16 11:35:31 LOG7[5240:25188864]: -> STARTTLS 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 220 2.0.0 Ready to start TLS 2006.11.16 11:35:31 LOG5[5240:25188864]: Protocol negotiations succeded 2006.11.16 11:35:31 LOG7[5240:25188864]: SSL state (connect): before/ connect initialization 2006.11.16 11:35:31 LOG7[5240:25188864]: SSL state (connect): SSLv2/ v3 write client hello A 2006.11.16 11:40:31 LOG6[5240:25188864]: init_ssl: s_poll_wait timeout 2006.11.16 11:40:31 LOG5[5240:25188864]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.11.16 11:40:31 LOG7[5240:25188864]: ssmtp finished (0 left) 2006.11.16 11:35:31 LOG7[5240:25188864]: ssmtp started Postfix's log shows: Nov 16 11:35:31 Fax-Machine postfix/smtpd[5252]: connect from localhost[127.0.0.1] Nov 16 11:35:31 Fax-Machine postfix/smtpd[5252]: setting up TLS connection from localhost[127.0.0.1] Nov 16 11:40:31 Fax-Machine postfix/smtpd[5252]: SSL_accept error from localhost[127.0.0.1]: -1 Nov 16 11:40:31 Fax-Machine postfix/smtpd[5252]: lost connection after STARTTLS from localhost[127.0.0.1] Nov 16 11:40:31 Fax-Machine postfix/smtpd[5252]: disconnect from localhost[127.0.0.1] stunnel.conf is: ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = /etc/postfix/smtpd.cert key = /etc/postfix/smtpd.key debug=7 output=/dev/stdout ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 ;output = stunnel.log ; Use it for client mode ;client = yes ; Service-level configuration protocol = smtp sslVersion = all ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 [ssmtp] client = yes accept = 465 connect = 25 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini Does anyone have any idea where I am going wrong? Thanks, James.

3 4

stunnel : remote connection refused
by Arunkumar Arumugam 16 Nov '06

16 Nov '06

Hi I am using stunnel 3.26 on i386 redhat -linux-gnu with PTHREAD+LIBWRAP with openssl 0.9.6b engine I am getting the following error when try to use stunnel to a remote ipadress on specific port Lets say the remote ip address be a.b.c.d and port P1 and local ipaddess e.f.g.h and port P2 e.f.g.h:P2 ------> a.b.c.d:P1 my logs say that a.b.c.d:p1 started a.b.c.d:p1 connected from 127.0.0.1:xxxxx a.b.c.d:p1 connecting a.b.c.d:p1 remote connect: connection refused (111) failed to initialize remote desccriptor abcd:p1 finished (0 left) I do not understand why after connecting from local host to a.b.c.d , a.b.c.d tries to reconnect to itself. I have the same setup in another server, it works fine. This one was working fine, until i rebooted the machine. Regards Arun A -- ARUN ARUMUGAM Galbraith's Law of Human Nature: Faced with the choice between changing ones' mind and proving that there is no need to do so, almost everybody gets busy on the proof.

1 0

Testing stunnel 4.19
by Michal Trojnara 15 Nov '06

15 Nov '06

Dear Users, Please test stunnel 4.19 in you environments and post any problem to the list, so I can fix it in stunnel 4.20 (to be released soon). I expect stunnel 4.20 to be the recommended stable release for quite a long time. 8-) Best regards, Mike

1 0

Re: [stunnel-users] No way to keep the key encrypted?
by Michal Trojnara 15 Nov '06

15 Nov '06

On Wednesday 15 November 2006 16:30, joe(a)strout.net wrote: > That's good news! ...But, how do I use it (in daemon mode)? I tried > launching stunnel with an encrypted key, and it simply failed saying > that the pass phrase was wrong. But it never asked me for a pass > phrase. How do I make it do so? I confirm it's broken in stunnel 4.19. I'll fix it in 4.20. 4.18 works fine. Best regards, Mike

1 1

Re: [stunnel-users] No way to keep the key encrypted?
by Hans Werner Strube 15 Nov '06

15 Nov '06

Michal Trojnara wrote: > Obviously private key encryption should not be used in inetd mode. It > works fine in daemon mode and on Win32 platform. Yes, but only when stunnel is started manually. When started automatically on system boot, there is usually nobody present to enter the password of the encrypted private key (except when the key is stored somewhere and its input provided by some script or program - again a security hole). This is not a special problem of stunnel but of all SSL-using servers.

1 0

Re: [stunnel-users] No way to keep the key encrypted?
by Michal Trojnara 15 Nov '06

15 Nov '06

Joe Strout wrote: > The private key cannot be encrypted [cut] > This seems very dangerous to me; This paragraph of the manual was obsolete so I've removed it. Obviously private key encryption should not be used in inetd mode. It works fine in daemon mode and on Win32 platform. Best regards, Mike

1 0

"wrong version number" error
by joe＠strout.net 15 Nov '06

15 Nov '06

With a cleartext key (see previous thread), I'm able to get stunnel to actually run. However, it's failing when I try to connect to my server with https, generating the following output: 2006.11.15 09:10:11 LOG5[18343:25188864]: https accepted connection from 67.174.105.26:39907 2006.11.15 09:10:11 LOG7[18343:25188864]: SSL state (accept): before/accept initialization 2006.11.15 09:10:11 LOG3[18343:25188864]: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2006.11.15 09:10:11 LOG5[18343:25188864]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.11.15 09:10:11 LOG7[18343:25188864]: https finished (0 left) The important part here I suppose is "SSL routines:SSL3_GET_RECORD:wrong version number". Can anyone elaborate on what this means, and what I can do about it? Thank you, - Joe -- Joe Strout -- joe(a)strout.net Verified Express, LLC "Making the Internet a Better Place" http://www.verex.com/

1 0

No way to keep the key encrypted?
by joe＠strout.net 15 Nov '06

15 Nov '06

I see from the manual: "Two things are important when generating certificate-key pairs for stunnel. The private key cannot be encrypted, because the server has no way to obtain the password from the user. To produce an unencrypted key add the -nodes option when running the req command from the OpenSSL kit." This seems very dangerous to me; anybody who gets ahold of that key file will then be able to impersonate my server, right? Symbian SSL Proxy will simply ask me for my pass phrase when I launch it. Is there any way to get stunnel to do something equivalent -- maybe by decrypting it on the fly and piping it to stunnel on launch, so that there is never a decrypted file on disk? Or maybe I can decrypt the key to a file, launch stunnel, and then immediately delete that file? How have others dealt with this? Thanks, - Joe -- Joe Strout -- joe(a)strout.net Verified Express, LLC "Making the Internet a Better Place" http://www.verex.com/

1 0

[RE][stunnel-users] ciphers=EDH-RSA-DES-CBC3-SHA
by algol sigfrid 15 Nov '06

15 Nov '06

2 1

Stunnel 4.19 released
by Michal Trojnara 15 Nov '06

15 Nov '06

Dear Users, A new version of stunnel has just been released. Version 4.19, 2006.11.11, urgency: LOW/EXPERIMENTAL: * Release notes - There are a lot of new features in this version. I recommend to test it well before upgrading your mission-critical systems. * New features - New service-level option to specify OCSP server flag: OCSPflag = <flag> - "protocolCredentials" option changed to "protocolUsername" and "protocolPassword" - NTLM support to be enabled with the new service-level option: protocolAuthentication = NTLM - imap protocol negotiation support added. - Passphrase cache was added so the user does not need to reenter the same passphrase for each defined service any more. - New service-level option to retry connect+exec section: retry = yes|no - Local IP and port is logged for each established connection. - Win32 DLLs for OpenSSL 0.9.8d. * Bugfixes - Serious problem with SSL_WANT_* retries fixed. The new code requires extensive testing! Homepage: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ sha1sum for stunnel-4.19.tar.gz: d58da8117278d71598279c77935585de81b74394 Best regards, Mike

2 1

Error when I try adding compression to stunnel.conf
by Rami Michael 15 Nov '06

15 Nov '06

So it seems i found the answer to my own question... compression was added in stunnel 4.06. I am using 4.05 :)

1 0

Does stunnel supports IPv6
by Ravi Gowda 14 Nov '06

14 Nov '06

Hi All, Can we use ipv6 addresses in stunnel? The problem that I am facing is I want to have secure ldap sessions using two IPv6 systems but none of them speak SSL... How to go about it??? Thanks in Advance Ravi Gowda

2 1

Error when I try adding compression to stunnel.conf
by Rami Michael 14 Nov '06

14 Nov '06

Hey everyone, I was going through the stunnel FAQ when I noticed you could add compression. I was very excited and wanted to give it a try but when I tried to add compression = zlib to my stunnel.cong I got this error when starting stunnel... Starting stunnel: file /etc/stunnel/stunnel.conf line 10: Specified option name is not valid here Line 10 is the exact place where i stuck this name value pair. I don't know where else i could put it, i tried putting it everywhere! All requested info for posts to the group are found below Here is my stunnel.conf verify = 3 CAfile = /etc/stunnel/certs.pem cert = /etc/stunnel/stunnel.pem setuid = nobody setgid = nobody pid = /tmp/stunnel.pid debug = 7 output = /var/log/stunnel.log client = no compression = zlib [mysqls] accept = 3309 connect = 3306 I am using centOS and installed stunnel and openssl via the available rpms, using yum. zlib is installed as well, but i don't think this is a zlib issue, it seems like it just doesn't like "compression". Was compression added in a version later than 4.05? Am i missing something incredinbly simple? Some output from the stunnel.log at high debug level 2006.11.13 23:03:10 LOG5[32244:3086689984]: stunnel 4.05 on i686-redhat-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 2006.11.13 23:03:10 LOG7[32244:3086689984]: Snagged 64 random bytes from /dev/urandom 2006.11.13 23:03:10 LOG7[32244:3086689984]: RAND_status claims sufficient entropy for the PRNG 2006.11.13 23:03:10 LOG6[32244:3086689984]: PRNG seeded successfully 2006.11.13 23:03:10 LOG7[32244:3086689984]: Certificate: /etc/stunnel/stunnel.pem 2006.11.13 23:03:10 LOG7[32244:3086689984]: Key file: /etc/stunnel/stunnel.pem 2006.11.13 23:03:10 LOG7[32244:3086689984]: Loaded verify certificates from /etc/stunnel/certs.pem 2006.11.13 23:03:10 LOG5[32244:3086689984]: FD_SETSIZE=1024, file ulimit=1024 -> 500 clients allowed 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 4 in non-blocking mode 2006.11.13 23:03:10 LOG7[32244:3086689984]: SO_REUSEADDR option set on accept socket 2006.11.13 23:03:10 LOG7[32244:3086689984]: mysqls bound to 0.0.0.0:3309 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 5 in non-blocking mode 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 6 in non-blocking mode 2006.11.13 23:03:10 LOG7[32245:3086689984]: Created pid file /tmp/stunnel.pid stunnel -V 2006.11.13 23:03:14 LOG3[32248:3086505664]: -V: No such file or directory (2) Syntax: stunnel [filename] | -fd [n] | -help | -version | -sockets filename - use specified config file instead of /etc/stunnel/stunnel.conf -fd n - read the config file from specified file descriptor -help - get config file help -version - display version and defaults -sockets - display default socket options uname -a Linux ramison 2.6.9-42.0.3.EL #1 Fri Oct 6 05:59:54 CDT 2006 i686 i686 i386 GNU/Linux gcc -v Reading specs from /usr/lib/gcc/i386-redhat-linux/3.4.6/specs Configured with: ../configure --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --enable-shared --enable-threads=posix --disable-checking --with-system-zlib --enable-__cxa_atexit --disable-libunwind-exceptions --enable-java-awt=gtk --host=i386-redhat-linux Thread model: posix gcc version 3.4.6 20060404 (Red Hat 3.4.6-3) openssl version OpenSSL 0.9.7a Feb 19 2003

1 0

setting up HTTPS service?
by joe＠strout.net 13 Nov '06

13 Nov '06

Complete newbie here, so please bear with me. I want to set up HTTPS service on a Mac OS X (10.4.7) machine running a custom web server. I imagine that Stunnel could be made to listen on the standard HTTPS port (443), do the encryption/decryption, and pass the resulting data to/from the HTTP port (80, or a custom port I specify). This is probably very easy, but none of the documentation or examples I found covered this. Has anyone done this? Or if not, can you sketch out how I would go about it? Any gotchas or caveats I should be aware of? Many thanks, - Joe

3 3

resending FD_SETSIZE and file ulimit
by Arunkumar Arumugam 10 Nov '06

10 Nov '06

Hi Guys - I have a stunnel setup in a linux box kernel 2.4 Advanced sever release 2.1AS (pensacola) . I am trying to increase the number of file descriptors with which stunnel could handle. So I did a ulimit -n 4096 for root and restarted the stunnel process. Now in the stunnel logs i see, ..... FD_SETSIZE=1024, file ulimit=4096- > 500 clients allowed. I dont completely understand the relation between FD_SETSIZE and file ulimit. I also read that a single stunnel connection might use around 2 or 3 file descriptors. So what is the cap on the number of file descriptors used by stunnel. To make it use , around 4096 file descriptors should i recompile the stunnel again with FD_SETSIZE set to 4096.? -- ARUN ARUMUGAM Galbraith's Law of Human Nature: Faced with the choice between changing ones' mind and proving that there is no need to do so, almost everybody gets busy on the proof.

1 0

stunnel on Windows with pkcs11
by Neil M. 10 Nov '06

10 Nov '06

Can anyone provide more details in how to get this setup working? I've setup stunnel in client mode just fine for normal SSL operations, but now I need to load a client certificate from a token. I've looked at the example in the documentation and changed the paths accordingly, but that doesn't seem to work, stunnel errors out complaining about a DSO. Neil

1 0

FD_SETSIZE and file ulimit
by Arunkumar Arumugam 10 Nov '06

10 Nov '06

Hi Guys - I have a stunnel setup in a linux box kernel 2.4 Advanced sever release 2.1AS (pensacola) . I am trying to increase the number of file descriptors with which stunnel could handle. So I did a ulimit -n 4096 for root and restarted the stunnel process. Now in the stunnel logs i see, ..... FD_SETSIZE=1024, file ulimit=4096- > 500 clients allowed. I dont completely understand the relation between FD_SETSIZE and file ulimit. I also read that a single stunnel connection might use around 2 or 3 file descriptors. So what is the cap on the number of file descriptors used by stunnel. To make it use , around 4096 file descriptors should i recompile the stunnel again with FD_SETSIZE set to 4096.? -- ARUN ARUMUGAM Galbraith's Law of Human Nature: Faced with the choice between changing ones' mind and proving that there is no need to do so, almost everybody gets busy on the proof.

2 1

stunnel 4.16 wrapped around an ldap server causing very slow binds
by Mark McCoy 05 Nov '06

05 Nov '06

Hey all, I have an instance of stunnel 4.16 on Solaris 10 that I am trying to use to wrap Sun Directory Server LDAP traffic in SSL. LDAP 'binds' take over 2 minutes to complete using stunnel, but only a split second (as they should) when using an SSH tunnel. I have disabled tcpwrappers per the stunnel FAQ with no results, and tried settting delay = "yes" and "no", with no differences in the results. An interesting thing is that if I try to bind using the wrong password, the "Invalid Credentials" error returns immediately. Using the correct password, the bind hangs for over 2 minutes. Any ideas on what to look for? ------------- Output of stunnel -version: stunnel 4.16 on sparc-sun-solaris2.10 with OpenSSL 0.9.8c 05 Sep 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Global options debug = 5 pid = /usr/local/stunnel/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/stunnel/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /usr/local/stunnel/etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none -------------- -- Mark McCoy -- Professional Unix geek Here in America we are descended in blood and in spirit from revolutionists and rebels - men and women who dared to dissent from accepted doctrine. As their heirs, may we never confuse honest dissent with disloyal subversion. -- Dwight D. Eisenhower

2 1

newbie sendmail + smtp question
by Fred nietzsche 03 Nov '06

03 Nov '06

My ISP requires all my mail to go to mail.myISP.net via SSL to port 465. I have sendmail compiled with STARTTLS, configured authinfo and I've set up sendmail's smarthost to send everything to mail.myISP.net I run stunnel like this. stunnel /etc/stunnel/stunnel.conf -c -d 25 -r mail.myISP.net:465 There are no errors in the log. I can see stunnel listening on 25 with netstat. When I try to send mail I get: bash-3.00# sendmail -v sc00b123(a)yahoo.com <test sc00b123(a)yahoo.com... Connecting to [127.0.0.1] via relay... Which just hangs for ever. My stunnel.conf looks like: cert = /etc/stunnel/mail.pem chroot = /var/stunnel/ setuid = nobody setgid = nogroup pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel.log [smtp] accept = 25 connect = 465 Thanks for any help, hints, etc.. --------------------------------- Low, Low, Low Rates! Check out Yahoo! Messenger's cheap PC-to-Phone call rates.

1 0

stunnel[2840]: Error binding pop3s to 0.0.0.0:995
by fxper 02 Nov '06

02 Nov '06

I'm trying to use stunnel on a redhat machine to securely check email, via xinetd via pop3d. My /etc/xinetd.d/pop3s looks like this: service pop3s { socket_type = stream wait = no user = root server = /usr/sbin/stunnel log_on_success += USERID log_on_failure += USERID disable = no } And netstat just shows xinetd on 995: netstat -apn|grep 995 tcp 0 0 0.0.0.0:995 0.0.0.0:* LISTEN 2797/xinetd When I try to check mail with my client hitting port 995, I get this in /var/log/secure using debug level 7: Nov 1 16:17:24 myhostname xinetd[2797]: START: pop3s pid=2840 from=x.x.x.x Nov 1 16:17:54 myhostname stunnel[2840]: stunnel 4.04 on i386-redhat-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 Nov 1 16:17:54 myhostname stunnel[2840]: Snagged 64 random bytes from /dev/urandom Nov 1 16:17:54 myhostname stunnel[2840]: RAND_status claims sufficient entropy for the PRNG Nov 1 16:17:54 myhostname stunnel[2840]: PRNG seeded successfully Nov 1 16:17:54 myhostname stunnel[2840]: Certificate: /usr/share/ssl/certs/stunnel.pem Nov 1 16:17:54 myhostname stunnel[2840]: Key file: /usr/share/ssl/certs/stunnel.pem Nov 1 16:17:54 myhostname stunnel[2840]: FD_SETSIZE=1024, file ulimit=1024 -> 500 clients allowed Nov 1 16:17:54 myhostname stunnel[2840]: FD 4 in non-blocking mode Nov 1 16:17:54 myhostname stunnel[2840]: SO_REUSEADDR option set on accept socket Nov 1 16:17:54 myhostname stunnel[2840]: Error binding pop3s to 0.0.0.0:995 Nov 1 16:17:54 myhostname stunnel[2840]: bind: Address already in use (98) Any suggestions? Thanks! --------------------------------- Want to start your own business? Learn how on Yahoo! Small Business.

1 0

How to disable SSLv2
by Tommi Nieminen 30 Oct '06

30 Oct '06

I'm using Stunnel 4.18. I would like to disable SSLv2, but allow SSLv3 and TLSv1. Is this currently possible in Stunnel? I've tried two things so far: first I tried to use the option options = SSL_OP_NO_SSLv2 (from "man SSL_CTX_set_options") It didn't work. This is what I got: 2006.10.27 18:32:48 LOG7[6358:3082897088]: Snagged 64 random bytes from /root/.rnd 2006.10.27 18:32:48 LOG7[6358:3082897088]: Wrote 1024 new random bytes to /root/.rnd 2006.10.27 18:32:48 LOG7[6358:3082897088]: RAND_status claims sufficient entropy for the PRNG 2006.10.27 18:32:48 LOG7[6358:3082897088]: PRNG seeded successfully file /etc/stunnel/stunnel.conf line 18: Illegal SSL option Nothing gets logged, the above is the response to the startup command. The other thing I tried, though I really didn't expect it to work, was replacing the "options" option with sslVersion = SSLv3 TLSv1 This option seems to accept only one version at a time, or alternatively all of them with "all" on the right hand side, so this failed, stunnel didn't start. Any suggestions? The only thing I can think of is that the SSL option SSL_OP_NO_SSLv2 is something that should have been when configuring the OpenSSL installation, and since I have a readily wrapped package, it has not been included there. In that case I could install OpenSSL from the scratch. But before I try that, I thought I would ask if somebody were already familiar with the problem. Tommi Nieminen --------------------------------------------------- Here is the stunnel config file I was using: CAfile = /etc/stunnel/root-cert.pem cert = /etc/stunnel/device-cert.pem key = /etc/stunnel/device-key.pem output = /var/log/stunnel/stunnel.log pid = /var/run/stunnel/stunnel.pid debug = 7 client = no [https] accept = 443 connect = 192.168.10.17:5010 verify = 1 options = SSL_OP_NO_SSLv2 ;sslVersion = SSLv3 TLSv1

2 2

stunnel patch for extra logging
by Steven Van Acker 29 Oct '06

29 Oct '06

Hi, we use stunnel in server-mode where an SSL enabled client can connect to our stunnel, and then stunnel connects to a non-SSL backend server. The backend server logs incoming connections from stunnel (source IP and port), but stunnel doesn't log the same information. This makes it difficult to match logs between stunnel and the backend. This patch solves exactly this problem. I rewrote the patch so that it can be cleanly applied to any future (and past) version of stunnel. >From the website: "How do I get a patch included into the release versions of Stunnel? Only patches released into the public domain stand a chance of getting into the actual Stunnel source. This means revised BSD patches are likely acceptable. Original BSD and GNU patches are not for example." Since I would like very much that this patch makes it into the next release, I'll release it into the public domain or any other license that makes this possible. kind regards, Steven -- My amazon wishlist: http://www.amazon.com/gp/registry/1DB4XNEIEQBPB

2 1

Re: [stunnel-users] Fork Error
by Michal Trojnara 29 Oct '06

29 Oct '06

On Friday 27 October 2006 22:39, John O'Fallon wrote: > I do believe, though, that the problem is due to a change in Stunnel > between version 4.15 and 4.17, since the crash occurs when running > 4.17, but reverting to 4.15 on exactly the same system clears it up. > I have seen this on at least 2 different Mac servers. Please make some tests for me: 1. Try: ./configure --disable-libwrap make clean make make install 2. Check if there are some zombies produced by stunnel. 3. Include your configuration file and the output of "stunnel -version" with your next email. Best regards, Mike

1 0

SMTP & TLS
by Eric B. 27 Oct '06

27 Oct '06

Hi, I've been looking over using stunnel to secure SMTP connections, but am a little confused about how the protocol works. From what I've read, the STARTTLS command is used to allow a client/server to upgrade a connection from plaintext to SSL secured. Further to that, from what I understand, the concept is to allow/use a single port to initiate all connections - ex: port 25. >From what I can tell from stunnel however, is that once stunnel issues the STARTTLS command, if the client doesn't respond in kind, then the connection is terminated. I've tried reading the RFC, but can't seem to find what happens in the case where the client rejects or does not respond to the STARTTLS command. Logicially, I would expect the SMTP connection to continue normally in plaintext. Apparently, this is not how stunnel works. Can someone please help fill in the blanks for me please? What is supposed to happen if the client refuses the STARTTLS request from the server? If the connection is supposed to die, why bother with the STARTTLS request at all, and not just impose the SSL encrypted tunnel from the very beginning (as per the old SSMTP specs)? Thanks, Eric

1 0

Fork Error
by John O'Fallon 27 Oct '06

27 Oct '06

Since upgrading to Stunnel 4.17, I occasionally get the following error: 2006.10.18 23:08:45 LOG3[7007:25232896]: fork: Resource temporarily unavailable (35) 2006.10.18 23:08:45 LOG5[7007:25232896]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket The problem doesn't occur right away, but after some number of hits on the server. Reverting to Stunnel 4.15 corrects the problem. This is an OS X 10.4 Mac. I haven't confirmed the problem with 4.18, because the release notes indicate mainly changes relevant to Win32. Has any one else seen the problem? Michal, any thoughts? TIA, John

2 1

Stunnel hangs on big flows of data
by Dario Mariani 27 Oct '06

27 Oct '06

Hi... I'm deploying stunnel on some servers. I did some tests, and i never had problems. For example, i tried 5k parallel connections, and i didn't have any problem. But, i have problems when a small number of connections wants to transfer big chunks of information; the connection hangs. This is a snippet of logs: Server side: 2006.10.20 16:00:58 LOG7[20302:1]: oracle11521 accepted FD=226 from 192.168.22.10:39721 2006.10.20 16:00:58 LOG7[20302:200]: oracle11521 started 2006.10.20 16:00:58 LOG7[20302:200]: FD 226 in non-blocking mode 2006.10.20 16:00:58 LOG7[20302:200]: TCP_NODELAY option set on local socket 2006.10.20 16:00:58 LOG5[20302:200]: oracle11521 connected from 192.168.22.10:39721 2006.10.20 16:00:58 LOG7[20302:200]: SSL state (accept): before/ accept initialization 2006.10.20 16:00:58 LOG7[20302:200]: SSL state (accept): SSLv3 read client hello A 2006.10.20 16:00:58 LOG7[20302:200]: SSL state (accept): SSLv3 write server hello A 2006.10.20 16:00:58 LOG7[20302:200]: SSL state (accept): SSLv3 write change cipher spec A 2006.10.20 16:00:58 LOG7[20302:200]: SSL state (accept): SSLv3 write finished A 2006.10.20 16:00:58 LOG7[20302:200]: SSL state (accept): SSLv3 flush data 2006.10.20 16:00:58 LOG7[20302:200]: SSL state (accept): SSLv3 read finished A 2006.10.20 16:00:58 LOG7[20302:200]: 3 items in the session cache 2006.10.20 16:00:58 LOG7[20302:200]: 0 client connects (SSL_connect ()) 2006.10.20 16:00:58 LOG7[20302:200]: 0 client connects that finished 2006.10.20 16:00:58 LOG7[20302:200]: 0 client renegotiations requested 2006.10.20 16:00:58 LOG7[20302:200]: 199 server connects (SSL_accept()) 2006.10.20 16:00:58 LOG7[20302:200]: 194 server connects that finished 2006.10.20 16:00:58 LOG7[20302:200]: 0 server renegotiations requested 2006.10.20 16:00:58 LOG7[20302:200]: 173 session cache hits 2006.10.20 16:00:58 LOG7[20302:200]: 0 session cache misses 2006.10.20 16:00:58 LOG7[20302:200]: 18 session cache timeouts 2006.10.20 16:00:58 LOG6[20302:200]: SSL accepted: previous session reused 2006.10.20 16:00:58 LOG7[20302:200]: FD 227 in non-blocking mode 2006.10.20 16:00:58 LOG7[20302:200]: oracle11521 connecting 192.168.22.13:1521 2006.10.20 16:00:58 LOG7[20302:200]: connect_wait: waiting 10 seconds 2006.10.20 16:00:58 LOG7[20302:200]: connect_wait: connected 2006.10.20 16:00:58 LOG7[20302:200]: Remote FD=227 initialized 2006.10.20 16:00:58 LOG7[20302:200]: TCP_NODELAY option set on remote socket 2006.10.20 16:00:58 LOG7[20302:75]: SSL_read returned WANT_READ: retrying 2006.10.20 16:00:58 LOG7[20302:75]: SSL_read returned WANT_READ: retrying 2006.10.20 16:00:58 LOG7[20302:75]: SSL_read returned WANT_READ: retrying client side: 2006.10.20 16:16:01 LOG6[12415:91]: SSL connected: new session negotiated 2006.10.20 16:16:01 LOG6[12415:91]: Negotiated ciphers: DES-CBC3- SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2006.10.20 16:16:01 LOG7[12415:91]: Socket closed on read 2006.10.20 16:16:01 LOG7[12415:91]: SSL write shutdown 2006.10.20 16:16:01 LOG7[12415:91]: SSL alert (write): warning: close notify 2006.10.20 16:16:01 LOG7[12415:91]: SSL_shutdown retrying 2006.10.20 16:16:01 LOG7[12415:91]: SSL doesn't need to read or write 2006.10.20 16:16:01 LOG7[12415:91]: SSL alert (read): warning: close notify 2006.10.20 16:16:01 LOG7[12415:91]: SSL closed on SSL_read 2006.10.20 16:16:01 LOG7[12415:91]: Socket write shutdown 2006.10.20 16:16:01 LOG5[12415:91]: Connection closed: 3663 bytes sent to SSL, 5239 bytes sent to socket 2006.10.20 16:16:01 LOG7[12415:91]: oracle11521 finished (3 left) The timings are shifted, i don't know if the delta of time is related to a misconfiguration of clock on the machines, or are snippets taken from different events... i don't have direct access to the machines. I tried to make a test (client and server on the same machine) client: nc localhost 10001 >>/dev/null stunnel accept on 10001 and connect to localhost:11521 on the server side: stunnel accept on 11521 and connect on 1521 cat 230megsfile | nc -l -p 1521 & 2>&1 >>/dev/null so, when the nc on client side connects, the server starts the cat. It did complete correctly within a pair of minutes on an ibook 64 1.33 1g ram, but with LOADS of want_read and want_write errors on both sides of stunnel. The server and client are working on "big iron", i mean some superdome hardware with 30-40 cpu on both sides, and with an estimated traffic of 10gig/day And, important... the version of the stunnel instances is 4.15 Can you help me? Bye, dario.

2 4

Fwd: [stunnel-users] Stunnel client not sending data
by Jeremiah Martell 26 Oct '06

26 Oct '06

I forgot to send this to the entire group. My server program was listening on the wrong port. :-) Thanks, - Jeremiah ---------- Forwarded message ---------- From: Jeremiah Martell <inlovewithgod(a)gmail.com> Date: Oct 25, 2006 8:59 AM Subject: Re: [stunnel-users] Stunnel client not sending data To: Carter Browne <cbrowne(a)cbcs-usa.com> HA! Such a simple thing, but yes, that was the problem. I had the wrong port. :-) Thanks, - Jeremiah On 10/25/06, Carter Browne <cbrowne(a)cbcs-usa.com> wrote: > Jeremiah, > > I set the debug level on a stunnel configuration to 7 to understand better where you are failing. You have established > good connection to stunnel, but stunnel cannot get to 127.0.0.1:10000. So is your application listening on > 127.0.0.1:10000? Have you tried running netstat -an to establish that there is a process listening to the port? > > Carter > > Jeremiah Martell wrote: > > Carter, > > > > You're right. That was a typo error on my part. My config says 1.2.3.70. > > > > Anything other ideas? > > > > Thanks, > > - Jeremiah > > > > On 10/25/06, Carter Browne <cbrowne(a)cbcs-usa.com> wrote: > >> On the server side, I think you should be receiving on 1.2.3.70 (since > >> that is where you are sending the data). > >> > >> Carter > >> > >> Jeremiah Martell wrote: > >> > Hello, > >> > > >> > I have a program that opens up a connection to port 10000 of a server > >> > and sends it some data. It works normally. I'm trying to "stunnel" > >> > both ends. > >> > > >> > In my program I create a socket, connect to local port 7033, send my > >> > data, and close the socket. I verified that every function call > >> > returns success (socket, setsockopt (for TCP_NODELAY), gethostbyname, > >> > connect, and send). > >> > > >> >> From what the logs show below, it seems that server stunnel gets the > >> > connection from the client stunnel, they successfully negotiate the > >> > SSL stuff, then the client stunnel waits for any data to proxy to the > >> > server stunnel. The server stunnel is waiting too, and after 10 > >> > seconds of no data, it closes the socket. > >> > > >> > For some reason the client stunnel is not getting my data and > >> > therefore doesn't forward anything over to the server stunnel. I'm not > >> > sure why this is happening, because my program works normally and I've > >> > verified that everything returned success. > >> > > >> > Any ideas? > >> > > >> > - Jeremiah > >> > > >> > ----------------------------- > >> > > >> > ON CLIENT (1.2.3.60) > >> > > >> > Linux > >> > stunnel 4.16 > >> > OpenSSL 0.9.7c > >> > > >> > stunnel.conf is... > >> > pid = > >> > client = yes > >> > > >> > [7033] > >> > accept = 127.0.0.1:7033 > >> > connect = 1.2.3.70:7033 > >> > > >> > ----------------------------- > >> > > >> > ON SERVER (1.2.3.70) > >> > > >> > Windows > >> > stunnel 4.16 windows binary installer (Aug 31 2006) > >> > > >> > stunnel.conf is... > >> > > >> > cert = stunnel.pem > >> > socket = l:TCP_NODELAY=1 > >> > socket = r:TCP_NODELAY=1 > >> > debug = 7 > >> > > >> > [7033] > >> > accept = 1.2.3.60:7033 > >> > connect = 127.0.0.1:10000 > >> > > >> > ----------------------------- > >> > > >> > On client I see this debug... > >> > > >> > Oct 24 14:38:22 stunnel: LOG5[2892:258]: 7033 connected from > >> > 127.0.0.1:10251 > >> > Oct 24 14:38:32 stunnel: LOG3[2892:258]: SSL_read: Connection reset by > >> > peer (104) > >> > Oct 24 14:38:32 stunnel: LOG5[2892:258]: Connection reset: 56 bytes > >> > sent to SSL, 0 bytes send to socket > >> > > >> > ----------------------------- > >> > > >> > On server I see this debug... > >> > > >> > 2006.10.24 14:43:08 LOG7[2596:4068]: 7033 accepted FD=196 from > >> > 1.2.3.60:10252 > >> > 2006.10.24 14:43:08 LOG7[2596:4068]: Creating a new thread > >> > 2006.10.24 14:43:09 LOG7[2596:4068]: New thread created > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 7033 started > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: FD 196 in non-blocking mode > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: TCP_NODELAY option set on local > >> socket > >> > 2006.10.24 14:43:09 LOG5[2596:2372]: 7033 connected from 1.2.3.60:10252 > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): before/accept > >> > initialization > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 read > >> > client hello A > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write > >> > server hello A > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write > >> > certificate A > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write > >> > server done A > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 flush > >> data > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 read > >> > client key exchange A > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 read > >> > finished A > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write > >> > change cipher spec A > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write > >> > finished A > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 flush > >> data > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 3 items in the session cache > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 0 client connects > >> (SSL_connect()) > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 0 client connects that finished > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 0 client renegotiations > >> requested > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 5 server connects > >> (SSL_accept()) > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 5 server connects that finished > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 0 server renegotiations > >> requested > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 1 session cache hits > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 1 session cache misses > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 1 session cache timeouts > >> > 2006.10.24 14:43:09 LOG6[2596:2372]: SSL accepted: new session > >> negotiated > >> > 2006.10.24 14:43:09 LOG6[2596:2372]: Negotiated ciphers: AES256-SHA > >> > SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: FD 180 in non-blocking mode > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 7033 connecting 127.0.0.1:10000 > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: connect_wait: waiting 10 seconds > >> > 2006.10.24 14:43:19 LOG6[2596:2372]: connect_wait: s_poll_wait timeout > >> > 2006.10.24 14:43:19 LOG5[2596:2372]: Connection reset: 0 bytes sent to > >> > SSL, 0 bytes sent to socket > >> > 2006.10.24 14:43:19 LOG7[2596:2372]: 7033 finished (0 left) > >> > _______________________________________________ > >> > stunnel-users mailing list > >> > stunnel-users(a)mirt.net > >> > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > >> > > >> > >> > >> > > > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > >

1 0

Trying to redirect with stunnel - seems to hang
by Len DiMaggio 26 Oct '06

26 Oct '06

'Evening everyone, I'm wondering if anyone has already seen a problem like this. Background - I'm trying to use stunnel to act as an SSL server and redirect connections so that I can use the JMeter script recorder to build automated tests for an app's web GUI. (The recorder does not support SSL.) The software versions are: stunnel 4.15 on i686-redhat-linux-gnu with OpenSSL 0.9.8b 04 May 2006 I'm able to set up the redirection, and everything in the stunnel log looks OK - and, this is just making the connection manually - without JMeter - but trying to access the target app just hangs in the browser with a "connecting to..." status message. Here's the stunnel config file that I'm using - the log is attached. client=yes output=/tmp/stunnel.log debug=debug [8084] accept=hostname:8079 connect=hostname:8084 Interestingly - when I kill the stunnel process, the browser displays (most of) the target app's top level page. Thanks in advance, Len DiMaggio ldimaggi(a)redhat.com The stunnel log sez: 2006.10.24 04:58:33 LOG5[5869:3086362304]: stunnel 4.15 on i686-redhat-linux-gnu with OpenSSL 0.9.8b 04 May 2006 2006.10.24 04:58:33 LOG5[5869:3086362304]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2006.10.24 04:58:33 LOG6[5869:3086362304]: file ulimit = 1024 (can be changed with 'ulimit -n') 2006.10.24 04:58:33 LOG6[5869:3086362304]: poll() used - no FD_SETSIZE limit for file descriptors 2006.10.24 04:58:33 LOG5[5869:3086362304]: 500 clients allowed 2006.10.24 04:58:33 LOG7[5869:3086362304]: FD 4 in non-blocking mode 2006.10.24 04:58:33 LOG7[5869:3086362304]: FD 5 in non-blocking mode 2006.10.24 04:58:33 LOG7[5869:3086362304]: FD 6 in non-blocking mode 2006.10.24 04:58:33 LOG7[5869:3086362304]: SO_REUSEADDR option set on accept socket 2006.10.24 04:58:33 LOG7[5869:3086362304]: 8084 bound to 10.15.49.274:8079 2006.10.24 04:58:33 LOG7[5870:3086362304]: Created pid file /var/run/stunnel.pid 2006.10.24 04:58:52 LOG7[5870:3086362304]: 8084 accepted FD=7 from 172.16.83.99:58417 2006.10.24 04:58:52 LOG7[5870:3086359440]: 8084 started 2006.10.24 04:58:52 LOG7[5870:3086359440]: FD 7 in non-blocking mode 2006.10.24 04:58:52 LOG7[5870:3086359440]: FD 8 in non-blocking mode 2006.10.24 04:58:52 LOG7[5870:3086359440]: FD 9 in non-blocking mode 2006.10.24 04:58:52 LOG7[5870:3086362304]: Cleaning up the signal pipe 2006.10.24 04:58:52 LOG6[5870:3086362304]: Child process 5874 finished with code 0 2006.10.24 04:58:52 LOG7[5870:3086359440]: Connection from 172.16.83.99:58417 permitted by libwrap 2006.10.24 04:58:52 LOG5[5870:3086359440]: 8084 connected from 172.16.83.99:58417 2006.10.24 04:58:52 LOG7[5870:3086359440]: FD 8 in non-blocking mode 2006.10.24 04:58:52 LOG7[5870:3086359440]: 8084 connecting 10.15.49.274:8084 2006.10.24 04:58:52 LOG7[5870:3086359440]: connect_wait: waiting 10 seconds 2006.10.24 04:58:52 LOG7[5870:3086359440]: connect_wait: connected 2006.10.24 04:58:52 LOG7[5870:3086359440]: Remote FD=8 initialized 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): before/connect initialization 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 write client hello A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 read server hello A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 read server certificate A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 read server done A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 write client key exchange A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 write change cipher spec A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 write finished A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 flush data 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 read finished A 2006.10.24 04:58:52 LOG7[5870:3086359440]: 1 items in the session cache 2006.10.24 04:58:52 LOG7[5870:3086359440]: 1 client connects (SSL_connect()) 2006.10.24 04:58:52 LOG7[5870:3086359440]: 1 client connects that finished 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 client renegotiations requested 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 server connects (SSL_accept()) 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 server connects that finished 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 server renegotiations requested 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 session cache hits 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 session cache misses 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 session cache timeouts 2006.10.24 04:58:52 LOG6[5870:3086359440]: SSL connected: new session negotiated 2006.10.24 04:58:52 LOG6[5870:3086359440]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 -- Len DiMaggio (ldimaggi(a)redhat.com) Red Hat USA 10 Technology Park Drive Westford, MA 01886 tel: 978.392.3179 cell: 617.872.3673 http://www.redhat.com

3 2

status of www.stunnel.org
by Steven Van Acker 26 Oct '06

26 Oct '06

Hi, I noticed how the website http://www.stunnel.org is out of sync with the latest releases of stunnel. Are there plans to update this site ? And if not, would it be possible to redirect its visitors to http://stunnel.mirt.net/ automatically ? kind regards, -- Steven Van Acker -- My amazon wishlist: http://www.amazon.com/gp/registry/1DB4XNEIEQBPB

2 1

Stunnel client not sending data
by Jeremiah Martell 26 Oct '06

26 Oct '06

Hello, I have a program that opens up a connection to port 10000 of a server and sends it some data. It works normally. I'm trying to "stunnel" both ends. In my program I create a socket, connect to local port 7033, send my data, and close the socket. I verified that every function call returns success (socket, setsockopt (for TCP_NODELAY), gethostbyname, connect, and send). >From what the logs show below, it seems that server stunnel gets the connection from the client stunnel, they successfully negotiate the SSL stuff, then the client stunnel waits for any data to proxy to the server stunnel. The server stunnel is waiting too, and after 10 seconds of no data, it closes the socket. For some reason the client stunnel is not getting my data and therefore doesn't forward anything over to the server stunnel. I'm not sure why this is happening, because my program works normally and I've verified that everything returned success. Any ideas? - Jeremiah ----------------------------- ON CLIENT (1.2.3.60) Linux stunnel 4.16 OpenSSL 0.9.7c stunnel.conf is... pid = client = yes [7033] accept = 127.0.0.1:7033 connect = 1.2.3.70:7033 ----------------------------- ON SERVER (1.2.3.70) Windows stunnel 4.16 windows binary installer (Aug 31 2006) stunnel.conf is... cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 [7033] accept = 1.2.3.60:7033 connect = 127.0.0.1:10000 ----------------------------- On client I see this debug... Oct 24 14:38:22 stunnel: LOG5[2892:258]: 7033 connected from 127.0.0.1:10251 Oct 24 14:38:32 stunnel: LOG3[2892:258]: SSL_read: Connection reset by peer (104) Oct 24 14:38:32 stunnel: LOG5[2892:258]: Connection reset: 56 bytes sent to SSL, 0 bytes send to socket ----------------------------- On server I see this debug... 2006.10.24 14:43:08 LOG7[2596:4068]: 7033 accepted FD=196 from 1.2.3.60:10252 2006.10.24 14:43:08 LOG7[2596:4068]: Creating a new thread 2006.10.24 14:43:09 LOG7[2596:4068]: New thread created 2006.10.24 14:43:09 LOG7[2596:2372]: 7033 started 2006.10.24 14:43:09 LOG7[2596:2372]: FD 196 in non-blocking mode 2006.10.24 14:43:09 LOG7[2596:2372]: TCP_NODELAY option set on local socket 2006.10.24 14:43:09 LOG5[2596:2372]: 7033 connected from 1.2.3.60:10252 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): before/accept initialization 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 read client hello A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write server hello A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write certificate A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write server done A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 flush data 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 read client key exchange A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 read finished A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write change cipher spec A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write finished A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 flush data 2006.10.24 14:43:09 LOG7[2596:2372]: 3 items in the session cache 2006.10.24 14:43:09 LOG7[2596:2372]: 0 client connects (SSL_connect()) 2006.10.24 14:43:09 LOG7[2596:2372]: 0 client connects that finished 2006.10.24 14:43:09 LOG7[2596:2372]: 0 client renegotiations requested 2006.10.24 14:43:09 LOG7[2596:2372]: 5 server connects (SSL_accept()) 2006.10.24 14:43:09 LOG7[2596:2372]: 5 server connects that finished 2006.10.24 14:43:09 LOG7[2596:2372]: 0 server renegotiations requested 2006.10.24 14:43:09 LOG7[2596:2372]: 1 session cache hits 2006.10.24 14:43:09 LOG7[2596:2372]: 1 session cache misses 2006.10.24 14:43:09 LOG7[2596:2372]: 1 session cache timeouts 2006.10.24 14:43:09 LOG6[2596:2372]: SSL accepted: new session negotiated 2006.10.24 14:43:09 LOG6[2596:2372]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2006.10.24 14:43:09 LOG7[2596:2372]: FD 180 in non-blocking mode 2006.10.24 14:43:09 LOG7[2596:2372]: 7033 connecting 127.0.0.1:10000 2006.10.24 14:43:09 LOG7[2596:2372]: connect_wait: waiting 10 seconds 2006.10.24 14:43:19 LOG6[2596:2372]: connect_wait: s_poll_wait timeout 2006.10.24 14:43:19 LOG5[2596:2372]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.10.24 14:43:19 LOG7[2596:2372]: 7033 finished (0 left)

3 4

[OT] Questions about OpenSSL
by Gonzalo Diethelm 25 Oct '06

25 Oct '06

Hello everyone, I have a slightly off-topic question but one I think stunnel's developers are in a good position to assist me with. I need to implement what amounts to an embedded web server for a process that will be deployed on a "hostile" server (Win32), meaning that I don't want the people in that server to mess around with either the process or the network traffic to/from the process. The goal is to deploy a binary and a set of DLLs to the hostile server (no configuration files). To this effect, I have found a couple of usable HTTP server libraries, and I have implemented the functionality I need over clean HTTP. Now, I would like to use SSL to encrypt the data coming and going to my process; alas, I have not found any open source HTTP library that also supports HTTPS. Therefore, I have come to the conclusion that I will have to integrate OpenSSL into one of the HTTP libraries myself. The first question is: how difficult is it to integrate OpenSSL in "server mode" into an application? I tried taking a peek at Apache's mod_ssl, but being unfamiliar with Apache's internals, I was completely lost. Then it occurred to me that stunnel must do something similar to what I need, and indeed I could follow the code in stunnel to a point; before going any further, I wanted to first hear comments, opinions and hints from the developers. It also occurred to me that I could do what I need if stunnel offered some kind of "in process" handling of requests: instead of forwarding to a certain host:port the requests it gets, maybe stunnel itself could be configured to process the requests somehow, generate the responses and send them back; for instance, what I need to do is basically query a MySQL DB and send some records back. I am pretty sure this is not supported in stunnel today, but if it is something that anyone (besides me) sees as useful, I could volunteer to do at least part of the development. Alternatively, please feel free to educate me on why this is a moronic idea... In any case, thanks for a great product and best regards, -- Gonzalo Diethelm gonzalo.diethelm(a)aditiva.com

1 0

Connection problems and TCP frame checksum errors
by Tommi Nieminen 23 Oct '06

23 Oct '06

I have the following kind of test environment: SSL clients call a public ip address from which the calls are forwarded to a linux server with Stunnel. The linux server is in a private network. Stunnel decrypts the data and sends it forward. I have been testing this with a browser, monitoring the traffic on the server to see that Stunnel forwards the calls. Some strange things happen there that I can't explain. First of all: sometimes the calls go through the server as expected, sometimes the server doesn't respond in any way to the client. If I have two terminal windows open, one with tcpdump and another with tail -f stunnel.log - nothing comes into the log in spite of the incoming connections attempts. Then on other occasions when the calls come to the server, it forwards them beautifully to the address and port set in the configuration file. Does anyone have any clue, what this could be due to? I haven't been able to explain why it sometimes works and sometimes doesn't. Another thing that bothers me is, that sometimes there are TCP frames with incorrect checksum. I've monitored with Ethereal and tcpdump. Both show incorrect frames, and they are always from the stunnel-end of the connection. What could be the cause of those broken frames? Tommi Nieminen -------------------------------------------------------- My stunnel.conf looks like this: (any constructive criticism would be welcome :-)) CAfile = /home/tommi/cert/7/demoCA/cacert.pem cert = /home/tommi/cert/7/newcert.pem key = /home/tommi/cert/7/newkey.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 output = /var/log/stunnel/stunnel.log pid = /var/run/stunnel/stunnel.pid debug = 7 client = no [https] accept = 443 connect = 192.168.10.17:5010 TIMEOUTclose = 0 -------------------------------------------------------- A succesful connection from stunnel.log: 2006.10.09 18:01:43 LOG7[11889:3083744960]: https accepted FD=7 from 131.177.254.92:2689 2006.10.09 18:01:43 LOG7[11889:3083742128]: https started 2006.10.09 18:01:43 LOG7[11889:3083742128]: FD 7 in non-blocking mode 2006.10.09 18:01:43 LOG7[11889:3083742128]: TCP_NODELAY option set on local socket 2006.10.09 18:01:43 LOG5[11889:3083742128]: https connected from 131.177.254.92:2689 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): before/accept initialization 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 read client hello A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 write server hello A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 write certificate A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 write server done A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 flush data 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 read client key exchange A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 read finished A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 write change cipher spec A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 write finished A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 flush data 2006.10.09 18:01:43 LOG7[11889:3083742128]: 2 items in the session cache 2006.10.09 18:01:43 LOG7[11889:3083742128]: 0 client connects (SSL_connect()) 2006.10.09 18:01:43 LOG7[11889:3083742128]: 0 client connects that finished 2006.10.09 18:01:43 LOG7[11889:3083742128]: 0 client renegotiations requested 2006.10.09 18:01:43 LOG7[11889:3083742128]: 8 server connects (SSL_accept()) 2006.10.09 18:01:43 LOG7[11889:3083742128]: 7 server connects that finished 2006.10.09 18:01:43 LOG7[11889:3083742128]: 0 server renegotiations requested 2006.10.09 18:01:43 LOG7[11889:3083742128]: 4 session cache hits 2006.10.09 18:01:43 LOG7[11889:3083742128]: 1 session cache misses 2006.10.09 18:01:43 LOG7[11889:3083742128]: 1 session cache timeouts 2006.10.09 18:01:43 LOG6[11889:3083742128]: SSL accepted: new session negotiated 2006.10.09 18:01:43 LOG6[11889:3083742128]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2006.10.09 18:01:43 LOG7[11889:3083742128]: FD 8 in non-blocking mode 2006.10.09 18:01:43 LOG7[11889:3083742128]: https connecting 192.168.10.17:5010 2006.10.09 18:01:43 LOG7[11889:3083742128]: connect_wait: waiting 10 seconds 2006.10.09 18:01:43 LOG7[11889:3083742128]: connect_wait: connected 2006.10.09 18:01:43 LOG7[11889:3083742128]: Remote FD=8 initialized 2006.10.09 18:01:43 LOG7[11889:3083742128]: TCP_NODELAY option set on remote socket 2006.10.09 18:02:45 LOG7[11889:3083742128]: Socket closed on read 2006.10.09 18:02:45 LOG7[11889:3083742128]: SSL write shutdown 2006.10.09 18:02:45 LOG7[11889:3083742128]: SSL alert (write): warning: close notify 2006.10.09 18:02:45 LOG7[11889:3083742128]: SSL_shutdown retrying 2006.10.09 18:02:45 LOG7[11889:3083742128]: SSL doesn't need to read or write 2006.10.09 18:02:45 LOG6[11889:3083742128]: s_poll_wait timeout: connection close 2006.10.09 18:02:45 LOG5[11889:3083742128]: Connection closed: 0 bytes sent to SSL, 405 bytes sent to socket 2006.10.09 18:02:45 LOG7[11889:3083742128]: https finished (0 left) (and the failed connections leave also no mark in the log, but tcpdump sees the attempts on the server) -------------------------------------------------------- A sample of tcpdump's output with incorrect checksum: 18:02:45.150656 IP (tos 0x0, ttl 64, id 11218, offset 0, flags [DF], proto: TCP (6), length: 77) 192.168.20.18.https > 131.177.254.92.2689: P, cksum 0x5708 (incorrect (-> 0xf1bf), 1035:1072(37) ack 756 win 7504

2 6

Thank you very much for all your donations
by Michal Trojnara 21 Oct '06

21 Oct '06

Dear Users, I want you to know how much grateful I am for all your donations. Thank you very much. Some day stunnel may be full-time job. 8-) Even now sponsored features make a substantial addition to my budget. BTW: I have updated currency to USD. I hope it's more convenient. http://stunnel.mirt.net/ Best regards, Mike

1 0

error 1703, service already exists.
by Joop Blokker 20 Oct '06

20 Oct '06

Hello, I'm using sTunnel v4.18 under Windows XP as a client. I start the serv= ice with sTunnel -install -quiet If, for any reason, the same command is given again then the error mes= sage "Create service; error 1703; the specified service already exists= " pops up. In that case the -quiet parameter does not work. I do not w= ant to see that error message; if the service is running then it's oka= y. Q:. How can I suppress that error message? If that is not an option, h= ow can I detect that the sTunnel service is installed already? I'm programming in PowerBASIC - I know how to detect sTunnel once it h= as started with -start -quiet Thanks in advance for any idea! Joop. +++ Too far East is West. - Proverb (English) +++

2 1

stunnel client without any configuration
by Thomas Stegbauer 18 Oct '06

18 Oct '06

hi ml, i searched the list about an idea, but didn't find the complete answer, so i would ask: i am thinking about a https website (with logon), where you can download a completly preconfigured package (java-applet?) which checks HTTP_PROXY on unix and the msie registry settings on windows and connect a local port to a remote running stunnel, listening on port 443 (the stunnel ist running on a different ip). currently there are imho two points, which need solved: 1.) there is no proxy support, without a patch 2.) it is currently not possible to download a preconfigured package are there some thoughts? greetings thomas -- # Thomas Stegbauer # https://keyserver1.pgp.com/vkd/DownloadKey.event?keyid=0x9A3F1866FC68E91D # Key fingerprint = 5A2D FEDC 8A50 F1BB 25FB 967B 9A3F 1866 FC68 E91D

2 1

Infinite client timeout
by Dario Mariani 18 Oct '06

18 Oct '06

Hi all, i'm a new user :) I'm deploying stunnel into a big enterprise, so i have met a lot of interesting details about Stunnel :) I have a little problem now: a Stunnel channel connecting BEA Weblogic -> Oracle listener. BEA has the BIG problem of _completely locking_ when the connection goes down: when the connection comes up again, bea doesn't work. This is not an issue, because there's a keepalive feature that can be activated in BEA. In a case, we _cannot_ activate the keepalive, so we must try to keep the BEA -> stunnel client conection open indefinitely. I think this must apply to the other parts of the connection, but i'm not sure (if the bea -> client connection remains active, the client then can renegotiate the connection without bea noticing it? and the server -> oracle connection?) Ok, i'm a little confused here :) Can you help me with this issue? Bye, dario.

1 0

New feature - PayPal donations
by Michal Trojnara 16 Oct '06

16 Oct '06

Dear Users, Since PayPal finally decided to provide full support for users in Poland I've added a donation button on the web page. http://stunnel.mirt.net/ I really appreciate each donation. 8-) Best regards, Mike

1 0

"Peer suddenly disconnected" after upgrade to 4.18
by Asarian 13 Oct '06

13 Oct '06

Hello, I'm a long time user of stunnel. Yesterday I finally upgraded to stunnel 4.18. Can't get it to work anymore, though. :( Here is the relevant part of my config: ----------------------- cert = /etc/stunnel.pem key = /etc/stunnel.pem ciphers = ALL:!ADH:RC4+RSA:+SSLv2:@STRENGTH sslVersion = SSLv2 setuid = nobody setgid = nobody socket = l:TCP_NODELAY=1 debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none [pop3s] accept = 995 exec = /usr/local/libexec/inet-qpopper execargs = inet-qpopper -s transparent = yes [imaps] accept = 993 exec = /usr/local/libexec/imapd execargs = imapd transparent = yes ----------------------- With the exception of a few keyword changes, this is the config I've always used. But I always get these errors now: Oct 14 00:57:40 asarian-host stunnel: LOG5[49682:134621184]: pop3s connected from 192.168.79.4:2576 Oct 14 00:57:40 asarian-host stunnel: LOG3[49682:134621184]: SSL_accept: Peer suddenly disconnected Oct 14 00:57:40 asarian-host stunnel: LOG3[49682:134621184]: SSL_accept: Peer suddenly disconnected Oct 14 00:57:40 asarian-host stunnel: LOG5[49682:134621184]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Oct 14 00:57:40 asarian-host stunnel: LOG5[49682:134621184]: pop3s connected from 192.168.1.4:2579 Oct 14 00:57:40 asarian-host stunnel: LOG3[49682:134621184]: SSL_accept: Peer suddenly disconnected Oct 14 00:57:40 asarian-host stunnel: LOG5[49682:134621184]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket The cert and key are good (I use em for Apache, too). I also tried SSLv3, but got this error: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number But I like to get it working with SSLv2 first; then I'll worry about the other thing later. :) I hope someone can tell me what I'm doing wrong. Thanks, - Mark

1 0

SegFault with stunnel
by Beyerle, Christian 12 Oct '06

12 Oct '06

Hello Everyone, I try to encrypt a Mysql-Connection between two host which run Suse Linux 10.1. On the Server runs a mysql database, on the client runs barnyard (a plugin for snort) which should write into the mysql database. I installed stunnel 4.14 on x86_64-suse-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 on both servers. The Configuration file on the Server (mysql) looks like: client = no debug = 7777777 output = /var/log/stunnel.log [mysqls] accept = 10439 connect = 127.0.0.1:3306 Stunnel seems to run well: lsof -i -n | grep stunnel stunnel 25330 stunnel 6u IPv4 371490 TCP *:10439 (LISTEN) On the client: [mysqls] client = yes accept = 127.0.0.1:3306 connect = 172.16.1.80:10439 Stunnel seems to run as well as on the server: stunnel 16634 stunnel 6u IPv4 22487 TCP 127.0.0.1:mysql (LISTEN) If i start barnyard that should connect to port 3306, barnyard cannot open the port and quits. I looked in my syslog and found the following entry: Oct 12 14:10:28 CLIENT kernel: stunnel[10991]: segfault at 0000000055697fb0 rip 000055555555b793 rsp 00005555556b0520 error 4 Oct 12 14:10:28 CLIENT barnyard[10997]: FATAL ERROR: Failed to connect to database snort:[email protected]/sensors: Lost connection to MySQL server during query Oct 12 14:10:28 CLIENT barnyard[10997]: Exiting I find no log of stunnel which help me to understand the reason of the crash. After this stunnel not too seem runnign anymore on the port: lsof -i -n | grep stunnel (no output) Does anybody have an idea??? Thank you for the help, -- Chris

1 0

[stunnel-users]Plan for new authorisation method in Stunnel
by Thomas Thiele 11 Oct '06

11 Oct '06

Hello Stunnel Users, I am planning to develop a new authorisation method for Stunnel which I need for work. This method will be an addition to the existing methods for checking certificates. The idea is to use the subject names and the alternative names of the certificates to allow or drop connections. The subject and alternative names of the machines/clients that are allowed to connect to the server will be written into the Stunnel config. While checking the certificates, the subject and alternative names from the Stunnel config will be compared with the subject and alternative names in the certirficate from the connection request. If one of the names from the Stunnel config matches with the names from the certificate then the connection will be allowed. This is the basic idea of my project. Is anyone already working on something like that or do you have any ideas or suggestions for me? Best Regards, Thomas Thiele -- GMX DSL-Flatrate 0,- Euro* - Überall, wo DSL verfügbar ist! NEU: Jetzt bis zu 16.000 kBit/s! http://www.gmx.net/de/go/dsl

2 1

libstunnel.so
by Andrew Schulman 05 Oct '06

05 Oct '06

The Debian stunnel (actually stunnel4) package includes /usr/lib/libstunnel.so. I have two questions about this file: (1) What is its purpose? ldd shows that /usr/bin/stunnel doesn't depend on it. So is this the shared library referred to in stunnel(1), under the 'transparent' option? The man page says that to use 'transparent' one has to LD_PRELOAD env.so, but I don't find any env.so. I see that env.c is used in building libstunnel.a, so I'm guessing that the man page meant to say libstunnel.so instead of env.so. (2) How does one build it? configure includes a --with-shared-libs option, but even when that's enabled I don't get a libstunnel.so when I build. And I can't find any make targets for any .so files. Yet Debian includes this file. Thanks, Andrew.

1 0

Configure can't find openssl in Ubuntu
by Tommi Nieminen 04 Oct '06

04 Oct '06

Hello, I have an Ubuntu 6.06.1 (Dapper) where I'm trying to install Stunnel. First I tried to install Stunnel using Ubuntu's package manager (apt-get install stunnel4). The installation went very smoothly but the fact that stunnel didn't recognize the -V switch left me with an uneasy feeling that something else might be lacking, too. The Ubuntu package in question contains Stunnel 4.14. Stunnel 3.26, installed from another package, does recognize the -V switch. So then I tried several times installing stunnel from source. A few obstacles I managed to overcome, but now that the configure script stops telling that it can't find SSL directory checking for SSL directory... Not found Couldn't find your SSL library installation dir Use --with-ssl option to fix this problem I'm out of resources. The script seems to check the existence of ssl.h file: checkssldir() { : if test -f "$1/include/openssl/ssl.h" Despite the fact that I have OpenSSL 0.9.8a on my machine, I don't have ssl.h file anywhere, I checked that with find. I tried installing Linux headers, but that didn't help (well I didn't expect it to help, but I couldn't think of anything). Is there some package I should get, that doesn't come with the openssl package or how should I solve this problem? Any ideas? Another problem that I had when I was experimenting with Stunnel 3.26 was the fact, that I couldn't start it up. It kept asking for the -r or -l switch. What I want to do with Stunnel is to decrypt the traffic coming in on one interface and then forward it to another machine through another interface. I tried several different configuration files, this is one of them (without indentations): cert = stunnel.pem key = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 1 debug = 7 output = stunnel.log client = no [https] accept = 443 connect = 192.168.10.17:5010 TIMEOUTclose = 0 I didn't get any debug information and -f switch didn't give anything more. I tried the Windows version (4.18) on another pc and it seemed to do exactly what I wanted. (the config file may have been slightly different, at least no debug was set. I really would like to get this working on a Linux box, too. Tommi Nieminen

3 3

Convert to SSL
by Bob 04 Oct '06

04 Oct '06

Hello all, I have been looking online at the examples but can't seem to quite figure out how to do this. We are currently using stunnel to receive SSL message and redirect them as regular messages but now I need to go the other way first. Is it possible to setup stunnel to receive an non-SSL messages and redirect it as an SSL message? and can this be done in the current config file or do I have to run 2 stunnel daemons? Also, the new one has to validate certificates. -- _______________________________________________________________________ Thanks, Bob (bobif(a)adelphia.net) YahooIM: bobifx AOLIM: bobifmd ICQ: 111083556

1 0

"SSL3_GET_RECORD:wrong version number" error
by James Brown 04 Oct '06

04 Oct '06

I am having problems connecting to stunnel and was hoping someone could help me. When starting stunnel and then trying to send an SSL-encrypted email through it I get: $ sudo /usr/local/sbin/stunnel /sw/etc/stunnel/stunnel.conf -D 465 -r 25 2006.10.04 11:03:28 LOG7[29230:2684415368]: Snagged 64 random bytes from /Users/jlbrown/.rnd 2006.10.04 11:03:28 LOG7[29230:2684415368]: Wrote 1024 new random bytes to /Users/jlbrown/.rnd 2006.10.04 11:03:28 LOG7[29230:2684415368]: RAND_status claims sufficient entropy for the PRNG 2006.10.04 11:03:28 LOG7[29230:2684415368]: PRNG seeded successfully 2006.10.04 11:03:28 LOG7[29230:2684415368]: Certificate: /Users/ jlbrown/%1.pem 2006.10.04 11:03:28 LOG7[29230:2684415368]: Certificate loaded 2006.10.04 11:03:28 LOG7[29230:2684415368]: Key file: /Users/jlbrown/% 1.pem 2006.10.04 11:03:28 LOG7[29230:2684415368]: Private key loaded 2006.10.04 11:03:28 LOG7[29230:2684415368]: SSL context initialized for service ssmtp 2006.10.04 11:03:28 LOG5[29230:2684415368]: stunnel 4.18 on powerpc- apple-darwin8.8.0 with OpenSSL 0.9.7i 14 Oct 2005 2006.10.04 11:03:28 LOG5[29230:2684415368]: Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv4 Auth:LIBWRAP 2006.10.04 11:03:28 LOG6[29230:2684415368]: file ulimit = 256 (can be changed with 'ulimit -n') 2006.10.04 11:03:28 LOG6[29230:2684415368]: FD_SETSIZE = 1024 (some systems allow to increase this value) 2006.10.04 11:03:28 LOG5[29230:2684415368]: 125 clients allowed 2006.10.04 11:03:28 LOG7[29230:2684415368]: FD 6 in non-blocking mode 2006.10.04 11:03:28 LOG7[29230:2684415368]: FD 7 in non-blocking mode 2006.10.04 11:03:28 LOG7[29230:2684415368]: FD 8 in non-blocking mode 2006.10.04 11:03:28 LOG7[29230:2684415368]: SO_REUSEADDR option set on accept socket 2006.10.04 11:03:28 LOG7[29230:2684415368]: ssmtp bound to 0.0.0.0:465 James-Browns-Computer-2:~/stunnel-4.18 jlbrown$ 2006.10.04 11:03:28 LOG7[29231:2684415368]: Created pid file /usr/local/var/run/stunnel/ stunnel.pid 2006.10.04 11:08:08 LOG7[29231:2684415368]: ssmtp accepted FD=9 from 127.0.0.1:64235 2006.10.04 11:08:08 LOG7[29231:25188864]: ssmtp started 2006.10.04 11:08:08 LOG7[29231:25188864]: FD 9 in non-blocking mode 2006.10.04 11:08:08 LOG7[29231:25188864]: TCP_NODELAY option set on local socket 2006.10.04 11:08:08 LOG7[29231:25188864]: FD 10 in non-blocking mode 2006.10.04 11:08:08 LOG7[29231:25188864]: FD 11 in non-blocking mode 2006.10.04 11:08:08 LOG7[29231:25188864]: Connection from 127.0.0.1:64235 permitted by libwrap 2006.10.04 11:08:08 LOG5[29231:25188864]: ssmtp connected from 127.0.0.1:64235 2006.10.04 11:08:08 LOG7[29231:2684415368]: Cleaning up the signal pipe 2006.10.04 11:08:08 LOG7[29231:25188864]: FD 10 in non-blocking mode 2006.10.04 11:08:08 LOG7[29231:25188864]: ssmtp connecting 127.0.0.1:25 2006.10.04 11:08:08 LOG7[29231:25188864]: connect_wait: waiting 10 seconds 2006.10.04 11:08:08 LOG6[29231:2684415368]: Child process 29421 finished with code 0 2006.10.04 11:08:08 LOG7[29231:25188864]: connect_wait: connected 2006.10.04 11:08:08 LOG7[29231:25188864]: Remote FD=10 initialized 2006.10.04 11:08:08 LOG7[29231:25188864]: TCP_NODELAY option set on remote socket 2006.10.04 11:08:08 LOG7[29231:25188864]: SSL state (connect): before/ connect initialization 2006.10.04 11:08:08 LOG7[29231:25188864]: SSL state (connect): SSLv3 write client hello A 2006.10.04 11:08:08 LOG7[29231:25188864]: SSL alert (write): fatal: handshake failure 2006.10.04 11:08:08 LOG3[29231:25188864]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2006.10.04 11:08:08 LOG5[29231:25188864]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.10.04 11:08:08 LOG7[29231:25188864]: ssmtp finished (0 left) Any suggestions as to what is causing this and how I can fix it? I got the same thing on another machine, with stunnel 4.04 and OpenSSL 0.9.7d. My stunnel.conf file is: cert = /Users/jlbrown/%1.pem key = /Users/jlbrown/%1.pem debug=7 output=/dev/stdout ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Service-level configuration [ssmtp] client = yes accept = 465 connect = 192.168.1.31:25 Thanks, James.

2 1

Thanks
by Eric S. Eberhard 03 Oct '06

03 Oct '06

For the help ... I believe I got it. Was I got that debug bug fixed I could tell what was going on. In the end I just stopped fighting it and downloaded prngd and ran it for a while. Interestingly, once I did this, it continues to work fine w/out prngd up and running. It did something I don't understand to my random file (apparently the old one was not good enough) and now it works!##$ Don't understand it, but it works! I still have some other application problem but I appear to get responses now. Thanks, Eric This email sent by: Eric S. Eberhard (928) 567-3727 Voice (928) 567-6122 Fax 928-301-7537 -- you may call any time day or night, I turn it off when I sleep :-) Please try to use a land line first (reception often poor). Note the change in the domain from vicspdi.com to vicsmba.com !!!! For Metropolis support and VICS MBA Support!!!! http://www.vicsmba.com Completely updated web site of personal pictures with many new pictures! Includes horses, dogs, Corvairs, and more. http://www.vicsmba.com/ourpics/index.html Corvair pictures including the Judson setup on our 62 Sedan and lots of pictures of Cheryl's 62 Monza Wagon and our 62 Spyder convertible. http://www.vicsmba.com/ourpics/corvairs.html My younger brother Martin has started a very serious car company. A hot rod (very fast) electric roadster is the first offering. The chassis is built by Lotus to their specs. Check it out: http://www.teslamotors.com

1 0

Re: [stunnel-users] Help please - debug and random file
by Eric S. Eberhard 02 Oct '06

02 Oct '06

Mike, Ah -- you are an expert! Amazing product in that I last download this in 2000 and have used it without incident ever since. Too bad I am forced to upgrade. I have hunted down the problem some more -- it has to do with the randomness. Using dbx I have found that it is blocking on a socked read for DEVRANDOM_EGD ... I did not specifically set up any sockets for randomness anyplace. Or set any options. I don't really want a socket, I was perfectly happy with my little 1024 byte .rnd file. If I copy a file (at random :-) ) and specify that it use that file for randomness, it reads it and sets it to zero bytes (unless I tell it not to overwrite). It then goes to read the socket and hangs. I suspect this is more an openssl problem than stunnel unless you can think of a way to 1) make it not wipe out my random file 2) make it not try and access a socket I hope you put my little fix in to s_log. Thanks, Eric At 01:51 PM 10/2/2006, you wrote: >On Monday 02 October 2006 21:19, you wrote: > > Are you an openssl/stunnel expert? > >I wrote stunnel. I could say I'm an expert (who an expert is otherwise?). > > > If I gave you access to my rs6000 > > and paid you, could you get this to work for me? Since I only need > > to compil this every 5-10 years, it makes little sense for me to > > invest a lot of time learning it! > >Good idea. > >Best regards, > Mike > This email sent by: Eric S. Eberhard (928) 567-3727 Voice (928) 567-6122 Fax 928-301-7537 -- you may call any time day or night, I turn it off when I sleep :-) Please try to use a land line first (reception often poor). Note the change in the domain from vicspdi.com to vicsmba.com !!!! For Metropolis support and VICS MBA Support!!!! http://www.vicsmba.com Completely updated web site of personal pictures with many new pictures! Includes horses, dogs, Corvairs, and more. http://www.vicsmba.com/ourpics/index.html Corvair pictures including the Judson setup on our 62 Sedan and lots of pictures of Cheryl's 62 Monza Wagon and our 62 Spyder convertible. http://www.vicsmba.com/ourpics/corvairs.html My younger brother Martin has started a very serious car company. A hot rod (very fast) electric roadster is the first offering. The chassis is built by Lotus to their specs. Check it out: http://www.teslamotors.com

1 0

Help please - debug and random file
by Eric S. Eberhard 02 Oct '06

02 Oct '06

Hello everyone. I have not been on the list for a long time. I last compiled openssl and stunnel in 2000 or so and have been using the same code ever since. I use it very simply in client mode ... I have an application to authorize credit cards and it connect to stunnel in inetd mode (with -c in the command line). visanet is now requiring version 2 SSL so I have to change so I got all the new stuff and compiled it up and made a .conf file. I have two problems (for now :-) ): 1) No matter what I do it seems that at least some debug is coming back through the socket, and no debug is going to my debug file 2) The debug I am getting is very strange -- the first time it says "Snagged 64 from bytes from stunnel.rnd" The second time it says "Unable to retrieve any random data from stunnel.rnd" When I examine the file it has a current date and zero bytes. If I copy back my old (2000) stunnel.rnd it always reads once, and then writes it back out with zero bytes. I am AIX 4.3.3 and I compiled with xlc and the only option I used that was not default was to not link in the wrappers. I did get a ton of warnings that the "-pthreaded" option was not valid ... but it executes and responds so I am not sure that matters? Or should I do something (what?) about that? My configuration files for the service (visanet) is: output = /tmp/stunnel.log debug = 7 RNDfile = /visanet/ssl/stunnel.rnd [visanet] client = yes connect = ssllab.pgs.wcom.net:443 sslVersion = SSLv2 protocol = smtp cert = /viasanet/ssl/stunnel.pem The rnd file and cert file are from 2000 (old old old!). I would have expected a file /tmp/stunnel.log -- the file is not even created! The old inetd line was: (blah blah) stunnel -r ssllab.pgs.wcom.net:443 -c -R /visanet/sslold/stunnel.rnd What stupid thing am I doing wrong? Does anyone else have experience using stunnel with visanet and can they give me any pointers? Thanks! Eric This email sent by: Eric S. Eberhard (928) 567-3727 Voice (928) 567-6122 Fax 928-301-7537 -- you may call any time day or night, I turn it off when I sleep :-) Please try to use a land line first (reception often poor). Note the change in the domain from vicspdi.com to vicsmba.com !!!! For Metropolis support and VICS MBA Support!!!! http://www.vicsmba.com Completely updated web site of personal pictures with many new pictures! Includes horses, dogs, Corvairs, and more. http://www.vicsmba.com/ourpics/index.html Corvair pictures including the Judson setup on our 62 Sedan and lots of pictures of Cheryl's 62 Monza Wagon and our 62 Spyder convertible. http://www.vicsmba.com/ourpics/corvairs.html My younger brother Martin has started a very serious car company. A hot rod (very fast) electric roadster is the first offering. The chassis is built by Lotus to their specs. Check it out: http://www.teslamotors.com

2 3

One bug solved/fixed -- bug in log.c or perhaps options.c
by Eric S. Eberhard 02 Oct '06

02 Oct '06

Because I am using inetd mode, any unintended output by stunnel to stdout is BAD as this is accepted as input through inetd to my calling program. The problem with stunnel is that in main it does main_initialize which has the final function "log_open" However, somewhere in "parse_config" a call is made to "s_log" (with the text "Snagged 64 bytes from ..." and since this is before the log_open, the output ends up on stdout rather than being logged. Rather than try and hunt down the function that outputs the premature error message, I modified s_log to open the log files itself if not already open. I fixed it as follows (suggest you put in to the release?): void s_log(int level, const char *format, ...) { va_list arglist; char text[STRLEN], timestamped[STRLEN]; time_t gmt; struct tm *timeptr; #if defined(HAVE_LOCALTIME_R) && defined(_REENTRANT) struct tm timestruct; #endif if(level>options.debug_level) return; va_start(arglist, format); #ifdef HAVE_VSNPRINTF vsnprintf(text, STRLEN, format, arglist); #else vsprintf(text, format, arglist); #endif va_end(arglist); #if !defined (USE_WIN32) && !defined (__vms) /******************** NEW CODE, NEXT 2 LINES *******/ if(!outfile && options.output_file) /* 'output' option specified, not open */ log_open(); if(!outfile && options.option.syslog) { syslog(level, "LOG%d[%lu:%lu]: %s", So now I don't get the "Snagged" message back on stdout ... but it still does not work for me (yet :-) ) Eric This email sent by: Eric S. Eberhard (928) 567-3727 Voice (928) 567-6122 Fax 928-301-7537 -- you may call any time day or night, I turn it off when I sleep :-) Please try to use a land line first (reception often poor). Note the change in the domain from vicspdi.com to vicsmba.com !!!! For Metropolis support and VICS MBA Support!!!! http://www.vicsmba.com Completely updated web site of personal pictures with many new pictures! Includes horses, dogs, Corvairs, and more. http://www.vicsmba.com/ourpics/index.html Corvair pictures including the Judson setup on our 62 Sedan and lots of pictures of Cheryl's 62 Monza Wagon and our 62 Spyder convertible. http://www.vicsmba.com/ourpics/corvairs.html My younger brother Martin has started a very serious car company. A hot rod (very fast) electric roadster is the first offering. The chassis is built by Lotus to their specs. Check it out: http://www.teslamotors.com

1 0

Setting up TLS for SMTP
by James Brown 01 Oct '06

01 Oct '06

I am trying to set up stunnel so that it accepts SSL encrypted traffic from the internet on port 2525 and sends it to my mail server on port 25. To create the certificate, I used: sudo openssl req -new -outform PEM -out smtpd.cert \ -newkey rsa:2048 -nodes -keyout smtpd.key -keyform PEM \ -days 365 -x509 My stunnel.conf is: ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment ;cert = stunnel.pem cert = /smtpd.cert ;key = stunnel.pem key = /smtpd.key ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 ;output = stunnel.log ; Use it for client mode ;client = yes ; Service-level configuration ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini I am trying it in standalone mode. Using Stunnel 4.04. OpenSSL 0.9.7i 14 Oct 2005 Output of gcc -v is: Using built-in specs. Target: powerpc-apple-darwin8 Configured with: /private/var/tmp/gcc/gcc-5341.obj~1/src/configure -- disable-checking -enable-werror --prefix=/usr --mandir=/share/man -- enable-languages=c,objc,c++,obj-c++ --program-transform-name=/^[cg] [^.-]*$/s/$/-4.0/ --with-gxx-include-dir=/include/c++/4.0.0 --with- slibdir=/usr/lib --build=powerpc-apple-darwin8 --host=powerpc-apple- darwin8 --target=powerpc-apple-darwin8 Thread model: posix gcc version 4.0.1 (Apple Computer, Inc. build 5341) Whenever I try to start Stunnel, I get a message saying that there is no such file. Eg: $ stunnel -p /smtpd.cert -d 2525 -r 25 2006.10.01 00:36:46 LOG3[638:2684415368]: -p: No such file or directory (2) Syntax: stunnel [filename] | -help | -version | -sockets filename - use specified config file instead of /sw/etc/ stunnel/stunnel.conf -help - get config file help -version - display version and defaults -sockets - display default socket options I am using Mac OS X 10.4.8, Stunnel was built using Fink. Does anybody have any suggestions as to what I am doing wrong? Thanks, James.

1 0

stunnel on osX
by fmgre-dell＠yahoo.fr 30 Sep '06

30 Sep '06

>From: Michal Trojnara <Michal.Trojnara(a)mobi-com.net> >Subject: Re: [stunnel-users] Tr: failure notice >To: stunnel-users(a)mirt.net >Message-ID: <200609292118.57291.Michal.Trojnara(a)mobi-com.net> >Content-Type: text/plain; charset="utf-8" >On Friday 29 September 2006 16:11, fmgre-dell(a)yahoo.fr wrote: >> We have been using stunnel for 2 years now. >> We need to renew our keys, and we usually proceed to a >> software upgrade at the same time. >> Â >> - I have noticed changes in stunnel-client ( 4.16 ) >> running on OSX : now, stunnel asks for the key >> password for each service it is launching. > >Just password from your private key. 8-) > Hello, What i mean is that we have 8 different services running. they are all locked with the same key. We distribute the private key to other non-computer persons, who don t know how to remove a password from a key ( and we 'd like to keep the key locked ) With the former version of stunnel, we could unlock the 8 services with typing the password only once With the latest version, we need to type in the keyword once for every service ( i.e. 8 times !!! ) Is there any way to 'ease' the use of the latest version while keeping the key passworded ? bon week end fred ___________________________________________________________________________ Découvrez un nouveau moyen de poser toutes vos questions quelque soit le sujet ! Yahoo! Questions/Réponses pour partager vos connaissances, vos opinions et vos expériences. http://fr.answers.yahoo.com

2 1

Help please - debug and random file
by Eric S. Eberhard 29 Sep '06

29 Sep '06

Hello everyone. I have not been on the list for a long time. I last compiled openssl and stunnel in 2000 or so and have been using the same code ever since. I use it very simply in client mode ... I have an application to authorize credit cards and it connect to stunnel in inetd mode (with -c in the command line). visanet is now requiring version 2 SSL so I have to change so I got all the new stuff and compiled it up and made a .conf file. I have two problems (for now :-) ): 1) No matter what I do it seems that at least some debug is coming back through the socket, and no debug is going to my debug file 2) The debug I am getting is very strange -- the first time it says "Snagged 64 from bytes from stunnel.rnd" The second time it says "Unable to retrieve any random data from stunnel.rnd" When I examine the file it has a current date and zero bytes. If I copy back my old (2000) stunnel.rnd it always reads once, and then writes it back out with zero bytes. I am AIX 4.3.3 and I compiled with xlc and the only option I used that was not default was to not link in the wrappers. I did get a ton of warnings that the "-pthreaded" option was not valid ... but it executes and responds so I am not sure that matters? Or should I do something (what?) about that? My configuration files for the service (visanet) is: output = /tmp/stunnel.log debug = 7 RNDfile = /visanet/ssl/stunnel.rnd [visanet] client = yes connect = ssllab.pgs.wcom.net:443 sslVersion = SSLv2 protocol = smtp cert = /viasanet/ssl/stunnel.pem The rnd file and cert file are from 2000 (old old old!). I would have expected a file /tmp/stunnel.log -- the file is not even created! The old inetd line was: (blah blah) stunnel -r ssllab.pgs.wcom.net:443 -c -R /visanet/sslold/stunnel.rnd What stupid thing am I doing wrong? Does anyone else have experience using stunnel with visanet and can they give me any pointers? Thanks! Eric This email sent by: Eric S. Eberhard (928) 567-3727 Voice (928) 567-6122 Fax 928-301-7537 -- you may call any time day or night, I turn it off when I sleep :-) Please try to use a land line first (reception often poor). Note the change in the domain from vicspdi.com to vicsmba.com !!!! For Metropolis support and VICS MBA Support!!!! http://www.vicsmba.com Completely updated web site of personal pictures with many new pictures! Includes horses, dogs, Corvairs, and more. http://www.vicsmba.com/ourpics/index.html Corvair pictures including the Judson setup on our 62 Sedan and lots of pictures of Cheryl's 62 Monza Wagon and our 62 Spyder convertible. http://www.vicsmba.com/ourpics/corvairs.html My younger brother Martin has started a very serious car company. A hot rod (very fast) electric roadster is the first offering. The chassis is built by Lotus to their specs. Check it out: http://www.teslamotors.com

1 0

Tr: failure notice
by fmgre-dell＠yahoo.fr 29 Sep '06

29 Sep '06

Hello, We have been using stunnel for 2 years now. We need to renew our keys, and we usually proceed to a software upgrade at the same time. - I have noticed changes in stunnel-client ( 4.16 ) running on OSX : now, stunnel asks for the key password for each service it is launching. - a collegue is running stunnel ( client ) on windows and told me that the 4.15 and 4.16 version keeps on crashing on windows. Anybody with the same symptoms ( and possiby a workaround ? ) :-) ( we use keys which are protected by a password, we launch the stunnel ( client ) manually and type in the password for the service to start ) Sincerely, Fred ___________________________________________________________________________ Découvrez un nouveau moyen de poser toutes vos questions quelque soit le sujet ! Yahoo! Questions/Réponses pour partager vos connaissances, vos opinions et vos expériences. http://fr.answers.yahoo.com

2 1

create_client failed
by James 29 Sep '06

29 Sep '06

I am running Debian 3.1 (stable) with stunnel 3.26 (Debian package) to wrap my qmail pop3 daemon. Stunnel works properly for a good amount of time, but at a point (I am unable to find any specific influencing factors) it begins to fail with the error, "Connection reject: create_client failed" (see below for more info). To fix the error I have to kill and restart stunnel. I have adjusted the timeouts for both stunnel and the pop3 daemon, but nothing appears to have a lasting affect. When stunnel errors out the pop3 daemon is still available and can be connected to, so it does not appear to be an issue related to stunnel not being able to talk to the pop3 daemon. Below I have some of the debugging and system information regarding the system and problem. I would be more than appreciative if anyone had some input. Thank you. # Error stunnel[2500]: pop3 accepted FD=9 ###.###.###.### stunnel[2500]: Connection rejected: create_client failed # strace -p select(7, [4 6], NULL, NULL, NULL) = 1 (in [6]) fcntl64(6, F_GETFL) = 0x2 (flags O_RDWR) fcntl64(6, F_SETFL, O_RDWR|O_NONBLOCK) = 0 accept(6, {sa_family=AF_INET, sin_port=htons(63759), sin_addr=inet_addr("###.###.###.###")}, [16]) = 9 fcntl64(6, F_SETFL, O_RDWR) = 0 fcntl64(9, F_SETFD, FD_CLOEXEC) = 0 rt_sigprocmask(SIG_BLOCK, [HUP INT QUIT TERM CHLD], [], 8) = 0 mmap2(NULL, 8388608, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = -1 ENOMEM (Cannot allocate memory) rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 close(9) = 0 time([1159535901]) = 1159535901 getpid() = 21864 rt_sigaction(SIGPIPE, {0x40253a70, [], 0}, {SIG_IGN}, 8) = 0 send(3, "<27>Sep 29 09:18:21 stunnel[2186"..., 77, 0) = 77 rt_sigaction(SIGPIPE, {SIG_IGN}, NULL, 8) = 0 close(9) = -1 EBADF (Bad file descriptor) # uname -a 2.6.8-3-686-smp #1 SMP Thu Sep 7 04:39:15 UTC 2006 i686 GNU/Linux # libc version GNU C Library stable release version 2.3.2 # Command Running /usr/sbin/stunnel -d pop3s -r pop3 -p /etc/ssl/certs/pop3d.pem -R /dev/urandom -s nobody -g root # stunnel -V stunnel 3.26 on i386-pc-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 Default behaviour: run in inetd mode (unless -d used) run in background (unless -f used) run in ssl server mode (unless -c used) Compile time defaults: -v level no verify -a directory /etc/ssl/certs -A file (none) -S sources 3 -t timeout 300 seconds -B bytes 64 -D level 5 -P pid dir /var/run/stunnel/ -p pemfile in server mode: /etc/ssl/certs/stunnel.pem in client mode: none Socket option defaults: Option Accept Local Remote OS default SO_DEBUG -- -- -- 0 SO_DONTROUTE -- -- -- 0 SO_KEEPALIVE -- -- -- 0 SO_LINGER -- -- -- 0:0 SO_OOBINLINE -- -- -- 0 SO_RCVBUF -- -- -- 87380 SO_SNDBUF -- -- -- 16384 SO_RCVLOWAT -- -- -- 1 SO_SNDLOWAT -- -- -- 1 SO_RCVTIMEO -- -- -- 0:0 SO_SNDTIMEO -- -- -- 0:0 SO_REUSEADDR 1 -- -- 0 SO_BINDTODEVICE -- -- -- -- IP_TOS -- -- -- 0 IP_TTL -- -- -- 64 TCP_NODELAY -- -- -- 0

1 0

SSL and keep alive
by Alex Turner 29 Sep '06

29 Sep '06

All, I am load testing stunnel as a front end to a web server. The problem I have is that the connection is dropping even though JMeter is set to keep-alive on the http sampler. I was wondering if anyone knew if this was a JMeter issue – IE it does not do http1.1 properly with SSL or should I dig deeper? The stunnel log just shows the socket being closed down at the end of each request. Now – as stunnel should not care what data is going over ssl, then there must be something from JMeter that is triggering it to drop the socket. My thinking is that this is either an SSL session end or an actual FIN. In the absence of any feedback – I think I will try using stunnel in both client and server modes and, as I already know JMeter is OK at keep-alive non https – I should thus find out where the issue lays. Thanks for any info AJ PS – I am working on XP both ends with JMeter 2.2 and the latest stunnel. PPS – Naturally, once I have this figured I will post the method and results to nerds-central Alexander J Turner Ph.D. HYPERLINK "http://www.deployview.com"www.deployview.com HYPERLINK "http://www.nerds-central.blogspot.com"www.nerds-central.blogspot.com HYPERLINK "http://www.project-network.com"www.project-network.com -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.405 / Virus Database: 268.12.9/457 - Release Date: 26/09/2006

2 3

Zombies in 4.17?
by Pete Resnick 28 Sep '06

28 Sep '06

I'm running 4.17 on a Mac Mini (Intel) running MacOSX 10.4.7 and I'm seeing a slew of zombies. Anything I can do to track down what the problem is? pr -- Pete Resnick <http://www.episteme-software.com/> All connections to the world are tenuous at best

2 2

stunnel 4.18 released
by Michal Trojnara 26 Sep '06

26 Sep '06

Version 4.18, 2006.09.26, urgency: MEDIUM: * Bugfixes - GPF on entering private key pass phrase on Win32 fixed. - Updated Win32 OpenSSL DLLs. - Minor configure script update. Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ sha1sum for stunnel-4.18.tar.gz: 3ed3eaefae91d80fcfcbb29dd285d0f773756397 Best regards, Mike

1 0

Windows OpenSSL DLL Version
by algol sigfrid 26 Sep '06

26 Sep '06

2 1

seg fault stunnel 4-14 on SLES10
by Jon Howse 22 Sep '06

22 Sep '06

Hi, I am getting a seg fault with stunnel on an installation of SLES10. This is the first SLES10 server I have set up after having set up many SLES9 servers (approx twelve) which all communicate through stunnel to a central syslog server. The version of stunnel we are using on SLES9 is: stunnel-4.05-20.1. The other machines are a mix of 32bit and 64bit Xeons. The seg fault seems to happen when syslog starts to talk through stunnel. The program is a binary rpm install for 64bit SLES10 and is being run in standalone mode as a client connecting to a stunnel/syslog server running SLES9. OS:- SLES10 x86_64 Packages:- Stunnel 4-14-14.2 Syslog-ng-1.6.8-20.4 Openssl-0.9.8a-18.4 uname -a: Linux server 2.6.16.21-0.15-smp #1 SMP Tue Jul 25 15:28:49 UTC 2006 x86_64 x86_64 x86_64 GNU/Linux libc version: libc.so.6 => /lib64/libc.so.6 (0x00002ae068cf2000) openssl version: OpenSSL 0.9.8a 11 Oct 2005 stunnel.conf:- # Copyright by Michal Trojnara 2002-2004 # --with changes for SuSE package # client = yes | no # client mode (remote service uses SSL) # default: no (server mode) client = yes # # chroot + user (comment out to disable) # chroot = /var/lib/stunnel/ setuid = stunnel setgid = nogroup # note about the chroot feature and the "exec" keyword to start other # services... # while the init script /etc/init.d/stunnel will copy the binaries and libraries # into the chroot jail, more files might be needed in the jail (configuration files etc.) pid = /var/run/stunnel.pid # # debugging # debug = 7 output = /var/log/stunnel.log # # Some performance tunings # # disable Nagle algorithm (a.k.a. tinygram prevention, see man 7 tcp) socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 # compression = rle # Workaround for Eudora bug #options = DONT_INSERT_EMPTY_FRAGMENTS # Authentication stuff # verify = 2 # Don't forget to c_rehash CApath; CApath is located inside chroot jail: # CApath = /certs # It's often easier to use CAfile: # CAfile = /etc/stunnel/certs.pem # Don't forget to c_rehash CRLpath; CRLpath is located inside chroot jail: # CRLpath = /crls # Alternatively you can use CRLfile: # CRLfile = /etc/stunnel/crls.pem CAfile = /etc/openldap/rootcert.pem cert = /etc/ssl/certs/thorincert.pem key = /etc/ssl/certs/thorinkey.pem verify = 2 [5140] accept = 127.0.0.1:514 connect = xxx.xxx.xxx.xxx:5140 /var/log/messages:- kernel: Kernel logging (proc) stopped. Sep 21 13:51:00 thorin kernel: Kernel log daemon terminating. Sep 21 13:51:01 thorin syslog-ng[3146]: syslog-ng version 1.6.8 going down Sep 21 13:51:01 thorin syslog-ng[3769]: syslog-ng version 1.6.8 starting Sep 21 13:51:01 thorin syslog-ng[3769]: Changing permissions on special file /dev/tty10 Sep 21 13:51:01 thorin syslog-ng[3769]: Connection broken to AF_INET(127.0.0.1:514), reopening in 60 seconds Sep 21 13:51:06 thorin kernel: klogd 1.4.1, log source = /proc/kmsg started. Sep 21 13:51:06 thorin kernel: stunnel[3739]: segfault at 000000005569a9f0 rip 000055555555b793 rsp 00005555556b2f60 error 4 var/log/stunnel.log:- stunnel 4.14 on x86_64-suse-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 2006.09.21 13:48:25 LOG7[3396:1]: RAND_status claims sufficient entropy for the PRNG 2006.09.21 13:48:25 LOG6[3396:1]: PRNG seeded successfully 2006.09.21 13:48:25 LOG7[3396:1]: Certificate: /etc/ssl/certs/thorincert.pem 2006.09.21 13:48:25 LOG7[3396:1]: Key file: /etc/ssl/certs/thorinkey.pem 2006.09.21 13:48:25 LOG7[3396:1]: Loaded verify certificates from /etc/openldap/rootcert.pem 2006.09.21 13:48:25 LOG6[3396:1]: file ulimit = 1024 (can be changed with 'ulimit -n') 2006.09.21 13:48:25 LOG6[3396:1]: poll() used - no FD_SETSIZE limit for file descriptors 2006.09.21 13:48:25 LOG5[3396:1]: 500 clients allowed 2006.09.21 13:48:25 LOG7[3396:1]: FD 4 in non-blocking mode 2006.09.21 13:48:25 LOG7[3396:1]: FD 5 in non-blocking mode 2006.09.21 13:48:25 LOG7[3396:1]: FD 6 in non-blocking mode 2006.09.21 13:48:25 LOG7[3396:1]: SO_REUSEADDR option set on accept socket 2006.09.21 13:48:25 LOG7[3396:1]: 5140 bound to 127.0.0.1:514 2006.09.21 13:48:25 LOG7[3397:1]: Created pid file /var/run/stunnel.pid 2006.09.21 13:48:25 LOG7[3397:0]: Waiting -1 second(s) for 2 file descriptor(s) 2006.09.21 13:49:20 LOG7[3397:0]: CONTEXT 1, FD=4, (IN)->() 2006.09.21 13:49:20 LOG7[3397:0]: CONTEXT 1, FD=6, (IN)->(IN) 2006.09.21 13:49:20 LOG7[3397:1]: 5140 accepted FD=7 from 127.0.0.1:7323 2006.09.21 13:49:20 LOG7[3397:1]: Creating a new context 2006.09.21 13:49:20 LOG7[3397:1]: Context 2 created 2006.09.21 13:49:20 LOG7[3397:2]: Context swap: 1 -> 2 It waits at the last entry until syslog tries to connect. And that's where the useful logging stops, after that it's a seg fault. Hope you can point me in the right direction... Jon Howse ---------------------------------------------------------------------------- St Brendan's Sixth Form College --- STAFF e-mail Please consider the environment before printing this email. This e-mail is confidential and intended solely for the use of the individual to whom it is addressed. Any views or opinions presented are solely those of the author and do not necessarily represent those of St Brendan's Sixth Form College. If you are not the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing, or copying of this e-mail is strictly prohibited. If you have received this e-mail in error please contact the sender. Please report any abuse of this e-mail service to postmaster(a)stbrn.ac.uk ---------------------------------------------------------------------------- *** This e-mail has been scanned by Symantec Anti-Virus software. ***

1 0

Would you plz help me? I have problem with defining ciphers in stunnel
by hjanzadeh＠sinamicro.com 19 Sep '06

19 Sep '06

1 0

4.17 stunnel with syslog-ng
by Jason Englander 15 Sep '06

15 Sep '06

I have a logging server at home set up with syslog-ng and stunnel. Earlier this morning, I upgraded stunnel on a logging client machine from 4.15 to 4.17, no problems. I upgraded the server from 4.15 to 4.17 and stunnel seemed to hang (run, but not detach) on startup. Very long story short (it was too early, I hadn't had enough coffee yet <g>), stunnel was trying to log to syslog, which wasn't running yet. Putting aside that I should've been using "output = /var/log/stunnel.log" instead, for a log server of all things :-), did something change in stunnel or did I screw something up that I don't remember doing? My startup script has been starting stunnel, then syslog-ng for years. I haven't downgraded to verify that it does/doesn't happen starting with a particular version, but I might do that later today out of curiosity. (before fixing, upgrading "important" machines) Also, FYI - configure created a file named "6," in the source directory with this in it: no LIBS=-lz -ldl -lutil -lpthread -L/usr/local/ssl/lib -lssl -lcrypto This seems to be the offending line in configure: echo "${ECHO_T}no" >&6, LIBS="$saved_LIBS" -> echo "${ECHO_T}no" >&6; LIBS="$saved_LIBS" I ran 'autoreconf -f -i' (autoconf 2.60, automake 1.9.6) and the line isn't in the new ./configure any more. Jason -- Jason Englander <jason(a)englanders.cc> 394F 7E02 C105 7268 777A 3F5A 0AC0 C618 0675 80CA

2 1

cannot compile stunnel on solaris 10 in a zone
by tomvo＠absi.be 15 Sep '06

15 Sep '06

Hi, I'm trying to compile stunnel on a solaris 10 (06/06 release) in a normal (non-global) zone. the compile fails at the mknod command. How do I install stunnel ? I could ofcourse create the device myself in the global zone, but i think it was in /usr/local/var/lib/stunnel/dev, I don't think that our user zone will have access to this device if we create it in the global zone. Anyone else struggled with the same problem ? thx, Tom. --------------------------------------------------------------------------- Tom Van Overbeke - ABSI Service Delivery Coordinator email: tomvo(a)absi.be Tel: +32 2 333 40 00 - Fax: +32 2 333 40 60 website: http://www.absi.be ---------------------------------------------------------------------------

1 0

stunnel problem on hp-ux 11.11
by matt.miller＠accenture.com 13 Sep '06

13 Sep '06

System specs: HP-UX 11.11 Stunnel 4.15 OpenSSL 0.8.7i Config File: ; Certificate/key is needed in server mode and optional in client mode ;cert = /opt/iexpress/stunnel/etc/stunnel/mail.pem ;key = /opt/iexpress/stunnel/etc/stunnel/mail.pem ; Some security enhancements for UNIX systems - comment them out on Win32 ;chroot = /opt/iexpress/stunnel/var/lib/stunnel/ ;setuid = nobody ;setgid = nogroup ; PID is created inside chroot jail pid = /tmp/stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /opt/iexpress/stunnel/etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /opt/iexpress/stunnel/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ;foreground = yes output = stunnel.log ; Service-level configuration [pop3s] ; Use it for client mode client = yes ;accept = 995 ;connect = 110 accept = localhost:110 connect = POP3S.MAILSERVER:995 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini Problem: When I try to execute the following command "telnet localhost 110" I get an entry in the stunnel log file and I am unable to connect to the secure pop3 server. I know that this is not a firewall issue because I can telnet directly to the POP3S.MAILSERVER on port 995 and establish a connection, I also know that the server works fine because I set up stunnel on my windows xp machine and that did not have a problem establishing a connection. Any help on this issue would be great. Here is the log I am getting 2006.08.10 18:23:03 LOG5[16138:1]: stunnel 4.15 on hppa2.0w-hp-hpux11.11 with Op 2006.08.10 09:43:55 LOG5[7158:1]: 2000 clients allowed 2006.08.10 09:43:55 LOG7[7158:1]: FD 4 in non-blocking mode 2006.08.10 09:43:55 LOG7[7158:1]: FD 5 in non-blocking mode 2006.08.10 09:43:55 LOG7[7158:1]: FD 6 in non-blocking mode 2006.08.10 09:43:55 LOG7[7158:1]: SO_REUSEADDR option set on accept socket 2006.08.10 09:43:55 LOG7[7158:1]: pop3s bound to 127.0.0.1:110 2006.08.10 09:43:55 LOG7[7263:1]: Created pid file /tmp/stunnel.pid 2006.08.10 16:15:45 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57040 2006.08.10 16:15:45 LOG3[7263:1]: Connection rejected: create_client failed 2006.08.10 16:30:34 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57156 2006.08.10 16:30:34 LOG3[7263:1]: Connection rejected: create_client failed 2006.08.10 16:45:34 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57275 2006.08.10 16:45:34 LOG3[7263:1]: Connection rejected: create_client failed 2006.08.10 17:00:36 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57401 2006.08.10 17:00:36 LOG3[7263:1]: Connection rejected: create_client failed 2006.08.10 17:15:36 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57506 2006.08.10 17:15:36 LOG3[7263:1]: Connection rejected: create_client failed 2006.08.10 17:30:35 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57614 2006.08.10 17:30:35 LOG3[7263:1]: Connection rejected: create_client failed Matt T. Miller Accenture Minneapolis, MN USA 612-277-1826 aim: mttmiller8 email: matt.miller(a)accenture.com This message is for the designated recipient only and may contain privileged, proprietary, or otherwise private information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the email by you is prohibited.

1 0

RE: [stunnel-users] stunnel and AJP
by Jones Scott - sjones 13 Sep '06

13 Sep '06

Any chance you could send me a sample configuration file? :) Just got it install and going to start trying to get it setup. I am going to try to end the tunnel on a BigIP box. So just set it up on the apache server and hope it can end on the BigIP box. Thanks -----Original Message----- From: Richard.Hall [mailto:[email protected]] Sent: Friday, August 25, 2006 4:08 PM To: Jones Scott - sjones Cc: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] stunnel and AJP Jason, On Fri, 25 Aug 2006, Jones Scott - sjones wrote: > Has anyone used stunnel to secure AJP traffic from apache to jboss Short answer: Yes. - Apache + mod_jk configured to talk to stunnel client on localhost rather than to JBoss AJP13 port - stunnel client talks to remote stunnel server - stunnel server talks to JBoss AJP13 port on _its_ localhost. Works a treat :-) We've even done it with a third machine in the middle, running an stunnel server and client back-to-back. Just don't ask why! HTH, Richard ************************************************************************* The information contained in this communication is confidential, is intended only for the use of the recipient named above, and may be legally privileged. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please resend this communication to the sender and delete the original message or any copy of it from your computer system. Thank you. *************************************************************************

2 1

stunnel going to BigIP ssl
by Jones Scott - sjones 13 Sep '06

13 Sep '06

Has anyone used stunnel to end at a BipIP to decode the ssl traffic? If so, any issues or concerns? Thanks *************************************************************************** The information contained in this communication is confidential, is intended only for the use of the recipient named above, and may be legally privileged. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please resend this communication to the sender and delete the original message or any copy of it from your computer system. Thank You. ****************************************************************************

1 0

"SSL_read returned WANT_READ: retrying" at 30Hz
by Vincent Lascaux 12 Sep '06

12 Sep '06

Hi, I'm trying to use rsync (2.6.8) through STunnel (4.16) to synchronize two PC over the internet (they both have the same version of stunnel and rsync). On the server, I have STunnel running with this configuration: cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=0 socket = r:TCP_NODELAY=0 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log [rsync] accept = 273 connect = 873 On the client I have this configuration: cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=0 socket = r:TCP_NODELAY=0 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log client = yes [rsync] accept = 873 connect = UrlOfMyServer:273 Then I connect with rsync using rsync -a -h --progress --stats --partial Account@localhost::RemotePath LocalPath I think the connection is not really stable. RSync sometimes hang. The log file on the client side show 2006.09.11 21:33:11 LOG7[2008:1468]: SSL_read returned WANT_READ: retrying at 30Hz (that's right, it means 30 times a second). My log file nearly gets bigger faster than my downloaded file ;) Is it expected? What does this line mean? I turned TCP_NODELAY to 0 thinking that it my give me synchronous sockets and that it would remove that error, but it didn't... Any help appreciated, Thanks -- Vincent

2 3

Stunnel 4.17 released
by Michal Trojnara 10 Sep '06

10 Sep '06

This is a bugfix release. Upgrade is recommended. Version 4.17, 2006.09.10, urgency: MEDIUM: * New features - Win32 DLLs for OpenSSL 0.9.8c. * Bugfixes - Problem with detecting getaddrinfo() in ./configure fixed. - Compilation problem due to misplaced #endif in ssl.c fixed. - Duplicate 220 in smtp_server() function in protocol.c fixed. - Minor os2.mak update. - Minor update of safestring()/safename() macros. sha1sum for stunnel-4.17.tar.gz file: 7a0ea800935e798bf938756000b57d002a99c280 Homepage and download: http://stunnel.mirt.net/ Best regards, Mike

1 0

Multiple HTTPS endpoints
by Andrew Culross 07 Sep '06

07 Sep '06

Can I use stunnel to connect mutiple https endpoints? I'm wondering if a config file like the below would work: [https] accept = 9876 connect = xxx.xxx.xxx.xxx:443 [https] accept = 9875 connect =yyy.yyy.yyy.yyy:443 Thanks in advance ! Andrew Culross TwoFour Systems (914) 220-8849 www.TwoFour.Com The views and opinions expressed in this e-mail message are the sender's own and do not necessarily represent the views and opinions of {TwoFour Systems, LLC or F-O-R Software, LLC}

1 0

Re: [stunnel-users] RFC 2487 test in smtp_server not reliable
by Hans Werner Strube 07 Sep '06

07 Sep '06

Hans Werner Strube wrote: > Michal Trojnara wrote: ... > > I'm going to do it the hard way and add another parameter to > > s_poll_wait() function. > > > > IMHO the timeout should be between 100ms and 500ms. What do you think? > > I have not tested the minimum required. However, it should be as short > as possible, since for a client using TLS, the full delay will always > occur on starting a connection. ... I have now done some measurements using snoop on a Solaris Ultra 2 SMTP server (100 MBit/s) with a Windows XP SP2 client (AMD Duron 1 GHz, 56 kBit/s phone-line modem, SeaMonkey 1.04 mail sender [equivalent to Thunderbird 1.5.x]). The delays between the end of initial connection handshake and the first nonzero data packet for six connections were usually between 10 and 100 ms but once reached 150 ms. Thus, 200 ms may be a reasonable value (although the sample is too small to rule out rare failures).

1 0

windows load levels
by Alex Turner 05 Sep '06

05 Sep '06

Guys, Bit of a newbie question here - but very import to me at least. We are looking to secure a web server that does no currently support SSL. One reason for this is that we want to be able to run the server on multiple hosts and doing so means sharing the sessions etc :-( So - I am interested if anyone has tested the stuffing out of stunnel on windows. IE seeing how well it could handle several hundred sockets simultaneously. Not only from a resource point of view, but from a scaling (n, n**2 etc) point of view. Any input at all will be very welcome. Soon I will be starting some test of my own using JMeter to load test. If anyone is interested in the results I will be happy to post. Cheers AJ Alexander J Turner Ph.D. HYPERLINK "http://www.deployview.com"www.deployview.com HYPERLINK "http://www.nerds-central.blogspot.com"www.nerds-central.blogspot.com HYPERLINK "http://www.project-network.com"www.project-network.com -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.405 / Virus Database: 268.11.7/437 - Release Date: 04/09/2006

2 1

Stunnel and CryptoApi
by Marco Aldegheri 05 Sep '06

05 Sep '06

Hello list! Someone knows if there is any way to integrate a Windows stunnel in client mode with the Windows Certificate Store? As OpenVPN does with the cryptoapicert parameter in my opinion it would be very useful because: 1. the private key would not just reside in a pem file but could be set not exportable. 2. the private key could be saved on a smartcard. I found a japaneese wstunnel project that seems to do it but I couldn't find any document about it in english and the gui is only in japaneese. Any hints? Thank you, Marco Aldegheri __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Real address of client
by Gonzalo Diethelm 03 Sep '06

03 Sep '06

Hello, linux: Linux asus-gonzo 2.6.15-26-686 #1 SMP PREEMPT Thu Aug 3 03:13:28 UTC 2006 i686 GNU/Linux stunnel: stunnel 4.14 on i486-pc-linux-gnu PTHREAD+POLL+IPv6+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 apache: Apache/2.0.55 I am using stunnel in Ubuntu to provide https serving to an http-only Apache installation. The stunnel config is: cert = /home/gonzo/src/bg/run/SSL/server.crt key = /home/gonzo/src/bg/run/SSL/server.crt chroot = /var/run/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = no [https] accept = 443 connect = 80 TIMEOUTclose = 0 Everything works perfectly, except for one minor detail: on the server, my PHP scripts do not have access to the real IP address of the client, and they always see this value as 127.0.0.1. I am aware the manual says that, if you use -l or -L, there will be an additional REMOTE_HOST environment variable with the desired IP address, but I am not sure how to make this work from a setup like mine, where the http server process is already running. Any help or hints are greatly appreciated. Best regards, -- Gonzalo Diethelm gonzalo.diethelm(a)aditiva.com

2 1

4.16 compilation fails for openssl without engine
by Hans Werner Strube 01 Sep '06

01 Sep '06

When openssl was compiled without engine support, compilation of src/ssl.c in stunnel-4.16 fails because of a misplaced #endif. Patch: --- src/ssl.c.ORI Thu Jun 29 23:12:03 2006 +++ src/ssl.c Fri Sep 1 11:30:25 2006 @@ -286,8 +286,6 @@ s_log(LOG_DEBUG, "Engine %d initialized", current_engine+1); } -#endif - ENGINE *get_engine(int i) { if(i<1 || i>current_engine) return NULL; @@ -294,4 +292,6 @@ return engines[i-1]; } +#endif + /* End of ssl.c */

1 0

Duplicate 220 in protocol.c, smtp_server
by Hans Werner Strube 01 Sep '06

01 Sep '06

At least since stunnel 4.15 - but not yet in 4.09 (don't know about the intermediate versions) - there is a (cosmetic only?) bug in the "welcome" forwarding of the smtp_server in protocol.c (lines 177-187 in 4.16): fdgetline(c, c->remote_fd.fd, line); if(!isprefix(line, "220")) { s_log(LOG_ERR, "Unknown server welcome"); longjmp(c->err, 1); } fdprintf(c, c->local_wfd.fd, "220%s + stunnel", line); fdgetline(c, c->local_rfd.fd, line); if(!isprefix(line, "EHLO ")) { s_log(LOG_ERR, "Unknown client EHLO"); longjmp(c->err, 1); } Although the line read from remote_fd.fd already starts with "220", another 220 is prepended in forwarding to local_wfd.fd, line 182. This seems to haveno adverse effects, but this line should better be changed to: fdprintf(c, c->local_wfd.fd, "%s + stunnel", line);

1 0

stunnel 4.16 released
by Michal Trojnara 01 Sep '06

01 Sep '06

A new version of stunnel has been released. Version 4.16, 2006.08.31, urgency: MEDIUM: * New features sponsored by Hewlett-Packard - A new global option to control engine: engineCtrl = <command>[:<parameter>] - A new service-level option to select engine to read private key: engineNum = <engine number> - OCSP support: ocsp = <URL> * New features - A new option to select version of SSL protocol: sslVersion = all|SSLv2|SSLv3|TLSv1 - Visual Studio vc.mak by David Gillingham <dgillingham(a)gmail.com>. - OS2 support by Paul Smedley (http://smedley.info) * Bugfixes - An ordinary user can install stunnel again. - Compilation problem with --enable-dh fixed. - Some minor compilation warnings fixed. - Service-level CRL cert store implemented. - GPF on protocol negotiations fixed. - Problem detecting addrinfo() on Tru64 fixed. - Default group is now detected by configure script. - Check for maximum number of defined services added. - OpenSSL_add_all_algorithms() added to SSL initialization. - configure script sections reordered to detect pthread library funcions. - RFC 2487 autodetection improved (thx to Hans Werner Strube). High resolution s_poll_wait() not currently supported by UCONTEXT threading. - More precise description of cert directory file names (thx to Muhammad Muquit). * Other changes - Maximum number of services increased from 64 to 256 when poll() is used. Homepage: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ sha1 hash for stunnel-4.16.tar.gz file: 6772e0c7f26c2596564ba66978597db8cd229a72 Best regards, Mike

2 1

Windows simultaneous sockets
by Alex 26 Aug '06

26 Aug '06

Guys, Bit of a newbie question here - but very import to me at least. We are looking to secure a web server that does no currently support SSL. One reason for this is that we want to be able to run the server on multiple hosts and doing so means sharing the sessions etc :-( So - I am interested if anyone has tested the stuffing out of stunnel on windows. IE seeing how well it could handle several hundred sockets simultaneously. Not only from a resource point of view, but from a scaling (n, n**2 etc) point of view. Any input at all will be very welcome. Soon I will be starting some test of my own using JMeter to load test. If anyone is interested in the results I will be happy to post. Cheers AJ -- www.deployview.com www.nerds-central.com www.project-network.com

1 0

stunnel and AJP
by Jones Scott - sjones 25 Aug '06

25 Aug '06

Has anyone used stunnel to secure AJP traffic from apache to jboss *************************************************************************** The information contained in this communication is confidential, is intended only for the use of the recipient named above, and may be legally privileged. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please resend this communication to the sender and delete the original message or any copy of it from your computer system. Thank You. ****************************************************************************

2 1

stunnel 4-15 through proxy server
by Ingvar Tjøstheim 25 Aug '06

25 Aug '06

Hello I am on a network at work behind a firewall and a proxy server. I can connect to my friends linux computer with putty using proxy configuration and port 443. My friend set up his SSH server on port 443, of course. Yesterday, back home, I installed the following on my Windows2000 computer: Win32OpenSSL-v0.9.8b stunnel ver 4-14 FreeProxy version 3.92 This is the stunnel config file for my home computer: client=no verify=0 [wow] accept = 443 connect = 127.0.0.1:3456 TIMEOUTclose = 0 I set up my router to forward port 443 to this computer. I also registered a DynDNS domain and set up a client to update it. Then, still at home, I prepared another computer which I brought to work today. I installed the following on an XP machine: Win32OpenSSL-v0.9.8b stunnel ver 4-14 (which I upgraded to 4.15 today) SockScap_sc32r238 I set up SockScap to connect to 127.0.0.1 on port 2345 and used it to tunnel a program to the internet through my LAN and this Win2K computer. This was working fine when I was at home. My network at home has no proxy server, and I changed stunnel on my XP computer once at work to version 4-15. Then I added the two protocol lines in the config file as you see below. This is the config file on my XP computer at work: verify = 0 client = yes [wow] accept = 2345 protocol = connect protocolHost = www-proxy.DOMAINNAME.no:80 connect = MYDOMAINNAME.dnsalias.com:443 TIMEOUTclose = 0 Now, the funny thing is that it doesn't work. I used to have a SSH server on my computer at home (which is not running now), and I could connect to it from work. I know the setup could work if I just did things right. I know the FreeProxy and SockScap stuff works, cause it did at home. stunnel and the network is the only difference. Still I get these messages on the XP machine running stunnel as client at work when the SockScap program connects to it: 2006.08.25 10:02:29 LOG5[1280:2940]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.08.25 10:02:29 LOG5[1280:2940]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.08.25 10:02:29 LOG5[1280:2156]: No limit detected for the number of clients 2006.08.25 10:02:59 LOG5[1280:664]: wow connected from 127.0.0.1:3723 2006.08.25 10:03:05 LOG5[1280:972]: wow connected from 127.0.0.1:3725 2006.08.25 10:03:09 LOG5[1280:664]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.08.25 10:03:15 LOG5[1280:972]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket ...and it doesn't work. The program I try using through the tunnel never manages to connect. Anyone have a clue? Thank you very much!

1 0

Re: [stunnel-users] safestring and safename insecure
by Hans Werner Strube 24 Aug '06

24 Aug '06

Michal Trojnara wrote: > Assuming on some systems isprint(x) != isprint(x&0xff): any idea how to > exploit this "insecure" code? > > BTW: At least on Linux and Mac OS X isprint() returns 0 in both cases. The same holds for Solaris. I did not actually encounter an error but just got the idea that something may be insecure here by looking at the lines. After all, isprint etc. are often table-based macros without range-checking the argument. And "man isprint" clearly says that the character is unsigned: (Solaris:) The macro isascii() is defined on all integer values; the rest are defined only where the argument is an int, the value of which is representable as an unsigned char, or EOF, (Linux:) These functions check whether c, which must have the value of an unsigned char or EOF, falls into a certain character class according to the current locale.

1 0

safestring and safename insecure
by Hans Werner Strube 24 Aug '06

24 Aug '06

The macros safestring and safename in common.h are insecure if called for a character with high bit set, because (int)*p will sign-extend the byte on machines where char is signed. Possible patch (here for safestring; for safename correspondingly with isprint -> isalnum): do {char *p; for(p=(s); *p; p++) if(!isprint((int)*(unsigned char *)p)) *p='.';} while(0)

2 1

Re: [stunnel-users] accept is not allowed in inetd mode
by Tomasz Feliksiak 24 Aug '06

24 Aug '06

> I'm afraid I won't be able to tell you what's wrong with your > /etc/stunnel/smtps.conf without your /etc/stunnel/smtps.conf file. > 8-) > I guess you didn't define any service section. > > BTW. Please make sure to read the fine manual. There's also a Polish > version. > http://stunnel.mirt.net/static/stunnel.pl.html > > Greetings from Poland, > Mike You were right. I only define ports but dont uncomment protocol names in [] (like [pop3s]). [pop3s] accept = 995 connect = 110 ;[imaps] ;accept = 993 ;connect = 143 [ssmtp] accept = 465 connect = 25 Now it looks like this and it's working (earlier i have two configs, one per service). Poor thing about this is that it don't log anything before you dont uncomment this [] :P - hope no one other make this mistake. When I uncomment everything else was simple cause I have log :) and know what's going on. There was a problem with binding to ports cause I try to run it by inetd but I find your post at google to not run it by inetd. I change stunnel-inetd-4.15-1 to stunnel-standalone-4.15-1 (PLD Rulez :P) and problems gone. Is possible to run stunnel by inetd??? Thanks for help Michal. Stunnel is great :) Ps. I read the manual, english version. Sad thing is that I dont find out where I make mistake and when I read Polish wersion I do. Good thing is that it will be help for others who make this simple mistake. -- Pozdrawiam Tomasz Feliksiak vonom(a)intertel.net.pl

2 2

Stunnel Crash: Gmail SMTP over TLS
by Shatadal Ghosh 23 Aug '06

23 Aug '06

Hi, I am using stunnel 4.15 on Windows XP SP1 with Mozilla Thunderbird as the e-mail client. I do not have openSSL installed locally. I do have the libssl32.dll and libeay32.dll in the same directory as stunnel.exe (C:\Program Files\stunnel). I am running stunnel as a service. Stunnel crashes when I use it to send e-mail (SMTP via TLS) via gmail. According to the e-mail client configuration page on the gmail website http://mail.google.com/support/bin/answer.py?answer=13287&topic=1555 I tried to use SMTP over TLS to connect to smtp.gmail.com:587 My gmail-smtps block in stunnel.conf was ; SMTP service, listens on localhost:250 [gmail-smtps] protocol=smtp accept=localhost:250 connect=smtp.gmail.com:587 On trying to send an e-mail message via the above configuration stunnel crashed. The log file is as follows 2006.06.14 03:17:15 LOG5[3956:3512]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.06.14 03:17:15 LOG5[3956:3512]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.06.14 03:17:15 LOG5[3956:3600]: No limit detected for the number of clients 2006.06.14 03:17:15 LOG7[3956:3600]: FD 172 in non-blocking mode 2006.06.14 03:17:15 LOG7[3956:3600]: SO_REUSEADDR option set on accept socket 2006.06.14 03:17:15 LOG7[3956:3600]: gmail-pop3s bound to 127.0.0.1:1100 2006.06.14 03:17:15 LOG7[3956:3600]: FD 180 in non-blocking mode 2006.06.14 03:17:15 LOG7[3956:3600]: SO_REUSEADDR option set on accept socket 2006.06.14 03:17:15 LOG7[3956:3600]: gmail-smtps bound to 127.0.0.1:250 ....# info about other mail connections 2006.06.14 03:17:26 LOG7[3956:3600]: gmail-smtps accepted FD=236 from 127.0.0.1:3665 2006.06.14 03:17:26 LOG7[3956:3600]: Creating a new thread 2006.06.14 03:17:26 LOG7[3956:3600]: New thread created 2006.06.14 03:17:26 LOG7[3956:2812]: gmail-smtps started 2006.06.14 03:17:26 LOG7[3956:2812]: FD 236 in non-blocking mode 2006.06.14 03:17:26 LOG7[3956:2812]: TCP_NODELAY option set on local socket 2006.06.14 03:17:26 LOG5[3956:2812]: gmail-smtps connected from 127.0.0.1:3665 2006.06.14 03:17:26 LOG7[3956:2812]: FD 268 in non-blocking mode 2006.06.14 03:17:26 LOG7[3956:2812]: gmail-smtps connecting 64.233.167.111:587 2006.06.14 03:17:26 LOG7[3956:2812]: connect_wait: waiting 10 seconds 2006.06.14 03:17:26 LOG7[3956:2812]: connect_wait: connected 2006.06.14 03:17:26 LOG7[3956:2812]: Remote FD=268 initialized 2006.06.14 03:17:26 LOG7[3956:2812]: TCP_NODELAY option set on remote socket 2006.06.14 03:17:26 LOG5[3956:2812]: Negotiations for smtp (client side) started 2006.06.14 03:17:26 LOG7[3956:2812]: <- 220 mx.gmail.com ESMTP w66sm450524pyw 2006.06.14 03:17:26 LOG7[3956:2812]: -> 220 mx.gmail.com ESMTP w66sm450524pyw <logfile ends> What mistake am I making? Fortunately it seems that gmail supports SMTP over SSL too (smtp.gmail.com:465) and I am using that. However I am also facing this problem with another account which unfortunately allows SMTP only over TLS. Thanks, Shatadal. --- avast! Antivirus: Outbound message clean. Virus Database (VPS): 0624-1, 06/13/2006 Tested on: 6/14/2006 6:22:04 AM avast! - copyright (c) 2000-2006 ALWIL Software. http://www.avast.com _________________________________________________________________ Is your PC infected? Get a FREE online computer virus scan from McAfee® Security. http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963

2 1

Re: [stunnel-users] RFC 2487 test in smtp_server not reliable
by Hans Werner Strube 23 Aug '06

23 Aug '06

Michal Trojnara wrote: > On 2006-08-22, at 10:55, Hans Werner Strube wrote: > > Instead of waiting, a better method would > > be to have a finer timeout resolution than 1 sec in > > s_poll_wait(...,...); > > setting the timeout to 1 (sec) would be too embarrassing for TLS > > connections. But this would require major changes in the sources. > > I'm going to do it the hard way and add another parameter to > s_poll_wait() function. > > IMHO the timeout should be between 100ms and 500ms. What do you think? I have not tested the minimum required. However, it should be as short as possible, since for a client using TLS, the full delay will always occur on starting a connection. It should be documented somewhere how this new constant could be configured in compilation.

1 0

RFC 2487 test in smtp_server not reliable
by Hans Werner Strube 23 Aug '06

23 Aug '06

In protocol.c, function smtp_server(), a test for plain SSL or STARTTLS usage (RFC 2487) is based on the availability of data from the client (c->local_rfd.fd). This works well in fast LANs but often fails for WAN connections through slow V90 modems. Especially with new Mozilla-based clients (also KMail and Evolution reported by other users) under Windows XP SP2 the test for data fails almost always, incorrectly resulting in an RFC 2487 handshake with error "Unknown client EHLO". This depends to some extent on the client: Outlook Express mostly works, Mozilla 1.7.x often worked after initial failure, SeaMonkey 1.x always fails. This seems to be a timing problem. I tried inserting a "usleep(50000);" before the switch(s_poll_wait(...)), which made SSL work with SeaMonkey (but often not for the first mail-sending attempt). Unfortunately, in Solaris 7 (where I tested stunnel), usleep is not yet thread-safe, maybe nanosleep(...,...) is preferable. Instead of waiting, a better method would be to have a finer timeout resolution than 1 sec in s_poll_wait(...,...); setting the timeout to 1 (sec) would be too embarrassing for TLS connections. But this would require major changes in the sources.

2 1

accept is not allowed in inetd mode
by vonom 23 Aug '06

23 Aug '06

Hello When i try to run stunnel by scripts or by hand stunnel /etc/stunnel/stunnel.conf (or other config) i see something like that: -bash-3.1# stunnel /etc/stunnel/pop3s.conf 2006.08.23 01:45:17 LOG7[24189:3083933376]: RAND_status claims sufficient entropy for the PRNG 2006.08.23 01:45:17 LOG6[24189:3083933376]: PRNG seeded successfully 2006.08.23 01:45:17 LOG7[24189:3083933376]: Certificate: /etc/stunnel/host-cert.pem 2006.08.23 01:45:17 LOG7[24189:3083933376]: Key file: /etc/stunnel/host-key.pem 2006.08.23 01:45:17 LOG7[24189:3083933376]: SSL context initialized for service stunnel file /etc/stunnel/pop3s.conf line 64: accept is not allowed in inetd mode No stunnel sesion, open ports or anything. I was very happy when I find out that I have stunnel-inetd-4.15-1 in my disto and it runs and ports are open. Everything great but when i try to send or receive email (postfix) it dont work. I spend a lot of time and a while ago i write telnet localhost 465 (or 995), ehlo hostname and see: -bash-3.1# telnet localhost 465 Trying 127.0.0.1.465... Connected to localhost. Escape character is '^]'. 2006.08.23 01:56:20 LOG7[24343:3083708096]: RAND_status claims sufficient entropy for the PRNG 2006.08.23 01:56:20 LOG6[24343:3083708096]: PRNG seeded successfully 2006.08.23 01:56:20 LOG7[24343:3083708096]: Certificate: /etc/stunnel/host-cert.pem 2006.08.23 01:56:20 LOG7[24343:3083708096]: Key file: /etc/stunnel/host-key.pem 2006.08.23 01:56:20 LOG7[24343:3083708096]: SSL context initialized for service stunnel file /etc/stunnel/smtps.conf line 64: accept is not allowed in inetd mode Connection closed by foreign host. When I write telnet localhost 25 -bash-3.1# telnet localhost 25 Trying 127.0.0.1.25... Connected to localhost. Escape character is '^]'. 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-STARTTLS 250 8BITMIME So It's OK I think. file /etc/stunnel/smtps.conf line 64: accept is not allowed in inetd mode Connection closed by foreign host. -line 64 point just last line of config file. I have no idea what it could be. Anyone know how to fix that?

2 1

Protocol using Connect
by Hutchison, Alan 21 Aug '06

21 Aug '06

I am trying to use the protocol entries in the config file as shown below (xyz substituted to protect employer & vendor). Below is the log. Stunnel abends as it is trying to authenticate to our corporate proxy. The network guys are seeing the attempt to authenticate but it does not appear to complete. Any thoughts? key=maxstpb.crt debug=7 output=stunnel.log client=yes [MarketAxess] accept=127.0.0.1:12345 delay=yes TIMEOUTbusy=120 TIMEOUTconnect=120 connect=xyz.xyz.com:80 protocol=connect protocolHost=xyz.xyz.com:443 protocolCredentials=xyz:xyz 2006.08.21 15:13:24 LOG5[2520:1312]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.08.21 15:13:24 LOG5[2520:1312]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv4 2006.08.21 15:13:24 LOG5[2520:3184]: No limit detected for the number of clients 2006.08.21 15:13:24 LOG7[2520:3184]: FD 192 in non-blocking mode 2006.08.21 15:13:24 LOG7[2520:3184]: SO_REUSEADDR option set on accept socket 2006.08.21 15:13:24 LOG7[2520:3184]: MarketAxess bound to 127.0.0.1:12345 2006.08.21 15:14:00 LOG7[2520:3184]: MarketAxess accepted FD=200 from 127.0.0.1:4200 2006.08.21 15:14:00 LOG7[2520:3184]: Creating a new thread 2006.08.21 15:14:00 LOG7[2520:3184]: New thread created 2006.08.21 15:14:00 LOG7[2520:2560]: MarketAxess started 2006.08.21 15:14:00 LOG7[2520:2560]: FD 200 in non-blocking mode 2006.08.21 15:14:00 LOG5[2520:2560]: MarketAxess connected from 127.0.0.1:4200 2006.08.21 15:14:00 LOG7[2520:2560]: FD 416 in non-blocking mode 2006.08.21 15:14:00 LOG7[2520:2560]: MarketAxess connecting xyz.xyz.xyz.xyz:80 2006.08.21 15:14:00 LOG7[2520:2560]: connect_wait: waiting 120 seconds 2006.08.21 15:14:00 LOG7[2520:2560]: connect_wait: connected 2006.08.21 15:14:00 LOG7[2520:2560]: Remote FD=416 initialized 2006.08.21 15:14:00 LOG5[2520:2560]: Negotiations for connect (client side) started 2006.08.21 15:14:00 LOG7[2520:2560]: -> CONNECT xyz.xyz.com:443 HTTP/1.1 Alan R. Hutchison 515-362-1272 -----Message Disclaimer----- This e-mail message is intended only for the use of the individual or entity to which it is addressed, and may contain information that is privileged, confidential and exempt from disclosure under applicable law. If you are not the intended recipient, any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by reply email to Connect(a)principal.com and delete or destroy all copies of the original message and attachments thereto. Email sent to or from the Principal Financial Group or any of its member companies may be retained as required by law or regulation. Nothing in this message is intended to constitute an Electronic signature for purposes of the Uniform Electronic Transactions Act (UETA) or the Electronic Signatures in Global and National Commerce Act ("E-Sign") unless a specific statement to the contrary is included in this message. While this communication may be used to promote or market a transaction or an idea that is discussed in the publication, it is intended to provide general information about the subject matter covered and is provided with the understanding that The Principal is not rendering legal, accounting, or tax advice. It is not a marketed opinion and may not be used to avoid penalties under the Internal Revenue Code. You should consult with appropriate counsel or other advisors on all matters pertaining to legal, tax, or accounting obligations and requirements.

1 0

limit connections per certificate
by Eric H. Jung 14 Aug '06

14 Aug '06

Hi, I'd like to limit the number of connections to stunnel (in server mode) by client certificate. In other words, I want all clients to only have 1 open socket connection to the server at a time. Is this possible with stunnel out-of-the-box, or must I write a patch to handle it? Thank you, grimholtz

1 0

stunnel through xinetd: process not terminating after use
by Alex Forrow 07 Aug '06

07 Aug '06

Hi, Im using stunnel through xinetd to forward some local unencrypted ldap connections to our ssl ldap server. Seems to work ok but after each use the stunnel process does not terminate, so I end up with losts of processes not doing anything. After a few days, these processes reach a limit and connections fail. As you can see, the connection has finished, but the process still exists: [root@lynx stunnel]# ps -e | grep stunnel 2396 ? 00:00:00 stunnel 2517 ? 00:00:00 stunnel 2575 ? 00:00:00 stunnel 2576 ? 00:00:00 stunnel [root@lynx stunnel]# netstat -p | grep stunnel tcp 0 0 lynx.seekit.co.uk:ldaplo lynx.seekit.co.uk:60390 CLOSE_WAIT 2396/stunnel unix 2 [ ] DGRAM 3204569 2576/stunnel unix 2 [ ] DGRAM 3204562 2575/stunnel unix 2 [ ] DGRAM 3203127 2517/stunnel unix 2 [ ] DGRAM 3202108 2396/stunnel Heres the xinetd configuration for stunnel (/etc/xinetd.d/ldaplo): # default: on # description: Stunnel to connect to LDAP for an insecure local session service ldaplo { disable = no #flags = REUSE port = 390 socket_type = stream wait = no user = nobody server = /usr/sbin/stunnel server_args = /etc/stunnel/ldap.conf # log_on_failure += USERID } Heres the stunnel configuration file (/etc/stunnel/ldap.conf): client = yes connect = 636 Cheers, Alex Forrow

1 0

Stunnel without certificates
by Shane 04 Aug '06

04 Aug '06

Hi, I am new to this group and also to Stunnel utility. I would like to use Stunnel to secure my http connections. Here is a twist. I just want to encrypt the link and don't bother much about the authentication. 1. Can I use Stunnel without certificates? 2. If certificate is mandatory, can I use only the file which contains "keys" but not use other authentication credentials? 3. Can I use anonymous DH Ciphers so that authentication phase is assumed done and both client and servers generate the keys? Any help and guidance will useful. Thanks, -Ravi Joshi __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

TIMEOUTbusy
by Martin Beauchamp 02 Aug '06

02 Aug '06

Hi List, I'm running Stunnel 4.15 under win32 in client mode. Can someone give me a better idea about what TIMEOUTbusy does? The docs state that it is "time to wait for expected data." But what does Stunnel do after this period? Does it disconnect from the remote server? Does it attempt another SSL session after some interval? Thanks for any addition information! Martin -- Martín Beauchamp Systems Engineer Park Slope Food Coop, Inc. (718) 783-2187 (718) 622-5685 Fax

1 0

stunnel crashing on connect
by Kevin King 24 Jul '06

24 Jul '06

Hi, I am attempting to run stunnel on Windows XP Pro but it is crashing as soon as anything connects to it. I am using it to create a secure TLS tunnel in front of an SMTP mail server and from what I read I should be able to do this and stunnel will handle the STARTLS commands. I downloaded the following windows binary: 562589 Mar 11 13:02:35 2006 stunnel-4.15-installer.exe I made minimal changes to stunnel.conf: 1) added the line "protocol = smtp" 2) uncommented the debug lines (still crashes if I leave these lines alone) I then start stunnel, either as a service or from cmd line - same thing happens >From a command prompt I then "telnet localhost 465" and send "EHLO mydomain.com hi" Stunnel responds with "250-EHLO mydomain.com hi Welcome". I am also running hMailServer on the same machine listening on port 25. It looks like stunnel is forwarded the initial EHLO to hMailServer, then hMailServer responds correctly and stunnel forwards that response back to me. Then stunnel crashes immediatly. Following is the log: 2006.07.20 10:28:41 LOG7[112:1656]: RAND_status claims sufficient entropy for the PRNG 2006.07.20 10:28:41 LOG6[112:1656]: PRNG seeded successfully 2006.07.20 10:28:41 LOG7[112:1656]: Certificate: stunnel.pem 2006.07.20 10:28:41 LOG7[112:1656]: Key file: stunnel.pem 2006.07.20 10:28:41 LOG7[112:1656]: SSL context initialized for service pop3s 2006.07.20 10:28:41 LOG7[112:1656]: Certificate: stunnel.pem 2006.07.20 10:28:41 LOG7[112:1656]: Key file: stunnel.pem 2006.07.20 10:28:41 LOG7[112:1656]: SSL context initialized for service imaps 2006.07.20 10:28:41 LOG7[112:1656]: Certificate: stunnel.pem 2006.07.20 10:28:41 LOG7[112:1656]: Key file: stunnel.pem 2006.07.20 10:28:41 LOG7[112:1656]: SSL context initialized for service ssmtp 2006.07.20 10:28:41 LOG5[112:1656]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.07.20 10:28:41 LOG5[112:1656]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.07.20 10:28:41 LOG5[112:2564]: No limit detected for the number of clients 2006.07.20 10:28:41 LOG7[112:2564]: FD 1884 in non-blocking mode 2006.07.20 10:28:41 LOG7[112:2564]: SO_REUSEADDR option set on accept socket 2006.07.20 10:28:41 LOG7[112:2564]: pop3s bound to 0.0.0.0:995 2006.07.20 10:28:41 LOG7[112:2564]: FD 1872 in non-blocking mode 2006.07.20 10:28:41 LOG7[112:2564]: SO_REUSEADDR option set on accept socket 2006.07.20 10:28:41 LOG7[112:2564]: imaps bound to 0.0.0.0:993 2006.07.20 10:28:41 LOG7[112:2564]: FD 1864 in non-blocking mode 2006.07.20 10:28:41 LOG7[112:2564]: SO_REUSEADDR option set on accept socket 2006.07.20 10:28:41 LOG7[112:2564]: ssmtp bound to 0.0.0.0:465 2006.07.20 10:28:59 LOG7[112:2564]: ssmtp accepted FD=1840 from 127.0.0.1:1543 2006.07.20 10:28:59 LOG7[112:2564]: Creating a new thread 2006.07.20 10:28:59 LOG7[112:2564]: New thread created 2006.07.20 10:28:59 LOG7[112:2936]: ssmtp started 2006.07.20 10:28:59 LOG7[112:2936]: FD 1840 in non-blocking mode 2006.07.20 10:28:59 LOG7[112:2936]: TCP_NODELAY option set on local socket 2006.07.20 10:28:59 LOG5[112:2936]: ssmtp connected from 127.0.0.1:1543 2006.07.20 10:28:59 LOG7[112:2936]: FD 1812 in non-blocking mode 2006.07.20 10:28:59 LOG7[112:2936]: ssmtp connecting 127.0.0.1:25 2006.07.20 10:28:59 LOG7[112:2936]: connect_wait: waiting 10 seconds 2006.07.20 10:28:59 LOG7[112:2936]: connect_wait: connected 2006.07.20 10:28:59 LOG7[112:2936]: Remote FD=1812 initialized 2006.07.20 10:28:59 LOG7[112:2936]: TCP_NODELAY option set on remote socket 2006.07.20 10:28:59 LOG5[112:2936]: Negotiations for smtp (server side) started 2006.07.20 10:28:59 LOG7[112:2936]: RFC 2487 detected 2006.07.20 10:28:59 LOG7[112:2936]: <- 220 hmailserver ESMTP 2006.07.20 10:28:59 LOG7[112:2936]: -> 220220 hmailserver ESMTP + stunnel 2006.07.20 10:29:09 LOG7[112:2936]: <- EHLO mydomain.com hi 2006.07.20 10:29:09 LOG7[112:2936]: -> 250-EHLO mydomain.com hi Welcome Here is the output of stunnel -version: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 Global options debug = 5 RNDbytes = 64 RNDoverwrite = yes service = stunnel taskbar = yes Service-level options cert = stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = stunnel.pem session = 300 seconds TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none 2006.07.20 10:25:04 LOG3[3256:3456]: Server is down I tried building the source and debugging it but I only found some batch files refering to the MS embedded compiler. Why would I want to compile this for an embedded or mobile device? That is what that compiler is for. What makefile or compiler should I be using on windows if I wish to build stunnel on windows? Which I would rather not have to do, I would like to just use the binary but it is crashing before I ever get a chance to test it. Any help would greatly be appreciated. thanks, -Kevin

1 0

stunnel version issue?
by NobbyNoMates 22 Jul '06

22 Jul '06

Dear all - I am trying to set up an stunnel connection on an Ubuntu Dapper box. This system seems to give me (stunnel -V) : stunnel 3.26 on i486-pc-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 and no matter where I look. I cannot seem to find an option to specify a config file when starting stunnel. Unfortunately, the instructions which I have received for setting up my (Direct Connect) client, contain such a config file which is supposed to be needed. It contains the following: client = yes delay = yes output = stunnel.log debug = notice pid = stunnel.pid [DC Server] connect = server.address.org:AAAAA accept = 127.0.0.1:BBBBB where of course the AAAA and BBBB are port numbers. Now I wonder if there is any way to make my stunnel version function in the specified way without the config file? Or is there some alternative way to specify this kind of config? Any suggestion would be much appreciated! Best regards, Erik

2 2

Clearer and Detailed version of the mail Stunnel for HTTP encription
by LoopBack Inc 20 Jul '06

20 Jul '06

Hello. I rewrote some parts of the question, and illustrated it by a small ASCII picture to clearifiy the whole situation. I don't know why I haven't got a single answer, because over 350 people are subscribed to the list, so I hope that I'll get some help now. It would be grateful. I use SocksCap to forward the iexplore cnnections to another port, a port on which stunnel listens. On PC1, the client, stunnel is listening on port 500. So when I start iexplore.exe with SocksCap every connection goes to 127.0.0.1:500. PC1 connects to PC2, with connect = 192.168.0.2:123 On PC2, the server, stunnel listens on port 500. then is connects to the internet with connect = 127.0.0.1:80. Here is the problem, stunnel doesn't connect to the internet over 127.0.0.1:80. I don't know why, but it doesnt. ---Stunnel.conf SERVER--- .. [inet] accept = 127.0.0.1:123 connect = 127.0.0.1:80 ---Stunnel.conf CLIENT--- .. [inet] accept = 127.0.0.1:500 connect = 192.168.0.2:123 LOGs from the SERVER: 2006.07.18 16:56:07 LOG7[2332:2720]: inet accepted FD=208 from 192.168.0.1:2156 2006.07.18 16:56:07 LOG7[2332:2720]: Creating a new thread 2006.07.18 16:56:07 LOG7[2332:2720]: New thread created 2006.07.18 16:56:07 LOG7[2332:1880]: inet started 2006.07.18 16:56:07 LOG7[2332:1880]: FD 208 in non-blocking mode 2006.07.18 16:56:07 LOG5[2332:1880]: inet connected from 192.168.0.1:2156 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): before/accept initialization 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 read client hello A 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 write server hello A 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 write change cipher spec A 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 write finished A 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 flush data 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 read finished A 2006.07.18 16:56:07 LOG7[2332:1880]: 1 items in the session cache 2006.07.18 16:56:07 LOG7[2332:1880]: 0 client connects (SSL_connect()) 2006.07.18 16:56:07 LOG7[2332:1880]: 0 client connects that finished 2006.07.18 16:56:07 LOG7[2332:1880]: 0 client renegotiations requested 2006.07.18 16:56:07 LOG7[2332:1880]: 7 server connects (SSL_accept()) 2006.07.18 16:56:07 LOG7[2332:1880]: 7 server connects that finished 2006.07.18 16:56:07 LOG7[2332:1880]: 0 server renegotiations requested 2006.07.18 16:56:07 LOG7[2332:1880]: 5 session cache hits 2006.07.18 16:56:07 LOG7[2332:1880]: 1 session cache misses 2006.07.18 16:56:07 LOG7[2332:1880]: 1 session cache timeouts 2006.07.18 16:56:07 LOG6[2332:1880]: SSL accepted: previous session reused 2006.07.18 16:56:07 LOG7[2332:1880]: FD 244 in non-blocking mode 2006.07.18 16:56:07 LOG7[2332:1880]: inet connecting 127.0.0.1:80 2006.07.18 16:56:07 LOG7[2332:1880]: connect_wait: waiting 10 seconds 2006.07.18 16:56:07 LOG7[2332:1880]: connect_wait: connected 2006.07.18 16:56:07 LOG7[2332:1880]: Remote FD=244 initialized After nothing happend for 52 seconds I aborted in the iexplore.exe to open the page. 2006.07.18 16:56:59 LOG7[2332:1880]: SSL alert (read): warning: close notify 2006.07.18 16:56:59 LOG7[2332:1880]: SSL closed on SSL_read 2006.07.18 16:56:59 LOG7[2332:1880]: Socket write shutdown 2006.07.18 16:56:59 LOG7[2332:1880]: SSL write shutdown 2006.07.18 16:56:59 LOG7[2332:1880]: SSL alert (write): warning: close notify 2006.07.18 16:56:59 LOG6[2332:1880]: SSL_shutdown successfully sent close_notify 2006.07.18 16:56:59 LOG5[2332:1880]: Connection closed: 0 bytes sent to SSL, 3 bytes sent to socket 2006.07.18 16:56:59 LOG7[2332:1880]: inet finished (0 left) LOGs from the CLIENT: 2006.07.18 17:10:11 LOG7[1756:4756]: inet accepted FD=444 from 127.0.0.1:2284 2006.07.18 17:10:11 LOG7[1756:4756]: Creating a new thread 2006.07.18 17:10:11 LOG7[1756:4756]: New thread created 2006.07.18 17:10:11 LOG7[1756:2840]: inet started 2006.07.18 17:10:11 LOG7[1756:2840]: FD 444 in non-blocking mode 2006.07.18 17:10:11 LOG7[1756:2840]: TCP_NODELAY option set on local socket 2006.07.18 17:10:11 LOG5[1756:2840]: inet connected from 127.0.0.1:2284 2006.07.18 17:10:11 LOG7[1756:2840]: FD 348 in non-blocking mode 2006.07.18 17:10:11 LOG7[1756:2840]: inet connecting 192.168.0.2:123 2006.07.18 17:10:11 LOG7[1756:2840]: connect_wait: waiting 10 seconds 2006.07.18 17:10:11 LOG7[1756:2840]: connect_wait: connected 2006.07.18 17:10:11 LOG7[1756:2840]: Remote FD=348 initialized 2006.07.18 17:10:11 LOG7[1756:2840]: TCP_NODELAY option set on remote socket 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): before/connect initialization 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 write client hello A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 read server hello A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 read finished A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 write change cipher spec A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 write finished A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 flush data 2006.07.18 17:10:11 LOG7[1756:2840]: 17 items in the session cache 2006.07.18 17:10:11 LOG7[1756:2840]: 65 client connects (SSL_connect()) 2006.07.18 17:10:11 LOG7[1756:2840]: 65 client connects that finished 2006.07.18 17:10:11 LOG7[1756:2840]: 0 client renegotiations requested 2006.07.18 17:10:11 LOG7[1756:2840]: 0 server connects (SSL_accept()) 2006.07.18 17:10:11 LOG7[1756:2840]: 0 server connects that finished 2006.07.18 17:10:11 LOG7[1756:2840]: 0 server renegotiations requested 2006.07.18 17:10:11 LOG7[1756:2840]: 48 session cache hits 2006.07.18 17:10:11 LOG7[1756:2840]: 0 session cache misses 2006.07.18 17:10:11 LOG7[1756:2840]: 0 session cache timeouts 2006.07.18 17:10:11 LOG6[1756:2840]: SSL connected: previous session reused Nothing happendend, I aborted iexplore.exe 2006.07.18 17:10:25 LOG7[1756:2840]: Socket closed on read 2006.07.18 17:10:25 LOG7[1756:2840]: SSL write shutdown 2006.07.18 17:10:25 LOG7[1756:2840]: SSL alert (write): warning: close notify 2006.07.18 17:10:25 LOG7[1756:2840]: SSL_shutdown retrying 2006.07.18 17:10:25 LOG7[1756:2840]: SSL doesn't need to read or write 2006.07.18 17:10:25 LOG7[1756:2840]: SSL alert (read): warning: close notify 2006.07.18 17:10:26 LOG7[1756:2840]: SSL closed on SSL_read 2006.07.18 17:10:26 LOG7[1756:2840]: Socket write shutdown 2006.07.18 17:10:26 LOG5[1756:2840]: Connection closed: 3 bytes sent to SSL, 0 bytes sent to socket 2006.07.18 17:10:26 LOG7[1756:2840]: inet finished (0 left) So the problem is that stunnel doesn't connect to the internet on PC2. I think i have to use something different than connect = 127.0.0.1:80 on PC2, but not sure. The version of stunnel is 4.15 I'm using Windows. _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today - it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

4 3

Re: [stunnel-users] Clearer and Detailed version of the mail Stunnelfor HTTP enc
by Ian 20 Jul '06

20 Jul '06

On 20 Jul 2006 at 14:50, LoopBack Inc wrote: > Hello Ian, > > > Yes thats excatly what I want to do. > > In fact, if possible, this I haven't described yes, I would like to encript > every program I want through PC2, used as a proxy, like you said. > But if it would work with the http it wouldn't be bad. > > Thank you for your reply. Hi, Ok, this has clarified things for me. Another question, do you have a copy of the proxy program (SocksCap ?) running on PC2? If not then this is the problem. I believe that stunnel does not itself act as a proxy. It simply acts as a tunnel. >From your description of your config I suspect that you should have a second copy of SocksCap listenening on PC2 which will forward data onto the internet. A quick example: PC1: SocksCap listening on port 8080 ( for example) forwards to 127.0.0.1:500 stunnel listening on port 500, forwarded any data to PC2 port 500 PC2: stunnel listening on port 500 forwards data to 127.0.0.1:8080 SocksCap listening on port 8080 forwards data out to the internet. This will encrypt data between PC1 & PC2 but after that it will be back in plain. In order to test this I would break it down into its individual components and test each stage. I recommend downloading netcat (http://netcat.sourceforge.net/ or google for it) and learn how to use it. Sorry I can't help you with this bit, its better if you learn it yourself - and once you have you will wonder how you ever managed without it ;) Regards Ian --

1 0

Stunnel for HTTP encription
by LoopBack Inc 18 Jul '06

18 Jul '06

Hello! I'm tring to encript HTTP. I use two PCs, PC1 and PC2. PC1 is a client PC2 is a server. IP of PC1:192.168.0.1 IP of PC2:192.168.0.2 I use SocksCap to forward the iexplore cnnections to another port, a port on which stunnel listens. On PC1, the client, stunnel is listening on port 500. So when I start iexplore.exe with SocksCap every connection goes to 127.0.0.1:500. PC1 connects to PC2, with connect = 192.168.0.2:123 On PC2, the server, stunnel listens on port 500. then is connects to the internet with connect = 127.0.0.1:80. Here is the problem, stunnel doesn't connect to the internet over 127.0.0.1:80. I don't know why, but it doesnt. LOGs from the SERVER: 2006.07.18 16:56:07 LOG7[2332:2720]: inet accepted FD=208 from 192.168.0.1:2156 2006.07.18 16:56:07 LOG7[2332:2720]: Creating a new thread 2006.07.18 16:56:07 LOG7[2332:2720]: New thread created 2006.07.18 16:56:07 LOG7[2332:1880]: inet started 2006.07.18 16:56:07 LOG7[2332:1880]: FD 208 in non-blocking mode 2006.07.18 16:56:07 LOG5[2332:1880]: inet connected from 192.168.0.1:2156 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): before/accept initialization 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 read client hello A 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 write server hello A 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 write change cipher spec A 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 write finished A 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 flush data 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 read finished A 2006.07.18 16:56:07 LOG7[2332:1880]: 1 items in the session cache 2006.07.18 16:56:07 LOG7[2332:1880]: 0 client connects (SSL_connect()) 2006.07.18 16:56:07 LOG7[2332:1880]: 0 client connects that finished 2006.07.18 16:56:07 LOG7[2332:1880]: 0 client renegotiations requested 2006.07.18 16:56:07 LOG7[2332:1880]: 7 server connects (SSL_accept()) 2006.07.18 16:56:07 LOG7[2332:1880]: 7 server connects that finished 2006.07.18 16:56:07 LOG7[2332:1880]: 0 server renegotiations requested 2006.07.18 16:56:07 LOG7[2332:1880]: 5 session cache hits 2006.07.18 16:56:07 LOG7[2332:1880]: 1 session cache misses 2006.07.18 16:56:07 LOG7[2332:1880]: 1 session cache timeouts 2006.07.18 16:56:07 LOG6[2332:1880]: SSL accepted: previous session reused 2006.07.18 16:56:07 LOG7[2332:1880]: FD 244 in non-blocking mode 2006.07.18 16:56:07 LOG7[2332:1880]: inet connecting 127.0.0.1:80 2006.07.18 16:56:07 LOG7[2332:1880]: connect_wait: waiting 10 seconds 2006.07.18 16:56:07 LOG7[2332:1880]: connect_wait: connected 2006.07.18 16:56:07 LOG7[2332:1880]: Remote FD=244 initialized After nothing happend for 52 seconds I aborted in the iexplore.exe to open the page. 2006.07.18 16:56:59 LOG7[2332:1880]: SSL alert (read): warning: close notify 2006.07.18 16:56:59 LOG7[2332:1880]: SSL closed on SSL_read 2006.07.18 16:56:59 LOG7[2332:1880]: Socket write shutdown 2006.07.18 16:56:59 LOG7[2332:1880]: SSL write shutdown 2006.07.18 16:56:59 LOG7[2332:1880]: SSL alert (write): warning: close notify 2006.07.18 16:56:59 LOG6[2332:1880]: SSL_shutdown successfully sent close_notify 2006.07.18 16:56:59 LOG5[2332:1880]: Connection closed: 0 bytes sent to SSL, 3 bytes sent to socket 2006.07.18 16:56:59 LOG7[2332:1880]: inet finished (0 left) LOGs from the CLIENT: 2006.07.18 17:10:11 LOG7[1756:4756]: inet accepted FD=444 from 127.0.0.1:2284 2006.07.18 17:10:11 LOG7[1756:4756]: Creating a new thread 2006.07.18 17:10:11 LOG7[1756:4756]: New thread created 2006.07.18 17:10:11 LOG7[1756:2840]: inet started 2006.07.18 17:10:11 LOG7[1756:2840]: FD 444 in non-blocking mode 2006.07.18 17:10:11 LOG7[1756:2840]: TCP_NODELAY option set on local socket 2006.07.18 17:10:11 LOG5[1756:2840]: inet connected from 127.0.0.1:2284 2006.07.18 17:10:11 LOG7[1756:2840]: FD 348 in non-blocking mode 2006.07.18 17:10:11 LOG7[1756:2840]: inet connecting 192.168.0.2:123 2006.07.18 17:10:11 LOG7[1756:2840]: connect_wait: waiting 10 seconds 2006.07.18 17:10:11 LOG7[1756:2840]: connect_wait: connected 2006.07.18 17:10:11 LOG7[1756:2840]: Remote FD=348 initialized 2006.07.18 17:10:11 LOG7[1756:2840]: TCP_NODELAY option set on remote socket 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): before/connect initialization 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 write client hello A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 read server hello A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 read finished A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 write change cipher spec A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 write finished A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 flush data 2006.07.18 17:10:11 LOG7[1756:2840]: 17 items in the session cache 2006.07.18 17:10:11 LOG7[1756:2840]: 65 client connects (SSL_connect()) 2006.07.18 17:10:11 LOG7[1756:2840]: 65 client connects that finished 2006.07.18 17:10:11 LOG7[1756:2840]: 0 client renegotiations requested 2006.07.18 17:10:11 LOG7[1756:2840]: 0 server connects (SSL_accept()) 2006.07.18 17:10:11 LOG7[1756:2840]: 0 server connects that finished 2006.07.18 17:10:11 LOG7[1756:2840]: 0 server renegotiations requested 2006.07.18 17:10:11 LOG7[1756:2840]: 48 session cache hits 2006.07.18 17:10:11 LOG7[1756:2840]: 0 session cache misses 2006.07.18 17:10:11 LOG7[1756:2840]: 0 session cache timeouts 2006.07.18 17:10:11 LOG6[1756:2840]: SSL connected: previous session reused Nothing happendend, I aborted iexplore.exe 2006.07.18 17:10:25 LOG7[1756:2840]: Socket closed on read 2006.07.18 17:10:25 LOG7[1756:2840]: SSL write shutdown 2006.07.18 17:10:25 LOG7[1756:2840]: SSL alert (write): warning: close notify 2006.07.18 17:10:25 LOG7[1756:2840]: SSL_shutdown retrying 2006.07.18 17:10:25 LOG7[1756:2840]: SSL doesn't need to read or write 2006.07.18 17:10:25 LOG7[1756:2840]: SSL alert (read): warning: close notify 2006.07.18 17:10:26 LOG7[1756:2840]: SSL closed on SSL_read 2006.07.18 17:10:26 LOG7[1756:2840]: Socket write shutdown 2006.07.18 17:10:26 LOG5[1756:2840]: Connection closed: 3 bytes sent to SSL, 0 bytes sent to socket 2006.07.18 17:10:26 LOG7[1756:2840]: inet finished (0 left) So the problem is that stunnel doesn't connect to the internet on PC2. I think i have to use something different than connect = 127.0.0.1:80 on PC2, but not sure. I'm using Windwos. Thanks for helping. _________________________________________________________________ On the road to retirement? Check out MSN Life Events for advice on how to get there! http://lifeevents.msn.com/category.aspx?cid=Retirement

1 0

exclusively TLS
by Richard Kotal 17 Jul '06

17 Jul '06

Hey, I had the same problem. I solved this problem. You must download my patch: http://www.aolserver.cz/, or http://www.aolserver.cz/download/stunnel-4.15_patch.tgz Richard Kotal info(a)waplikace.cz www.aolserver.cz prepis.waplikace.cz www.nvp.cz /> I need to talk to a server that is requiring pure TLS. It seems that > STUNNEL always starts with SSL. How do I get STUNNEL to start the client //> //side conversation with TLS? //> / /> // //> //John Moehrke //> //Enterprise Security Architect //> //GE Healthcare //> //T 262 293 1667 //> //W126 N7449 Flint Road, Suite 200, Menomonee Falls, WI 53051 //> / <http://stunnel.mirt.net/mailman/listinfo/stunnel-users>/John.Moehrke at med.ge.com <http://stunnel.mirt.net/mailman/listinfo/stunnel-users> <mailto:John.Moehrke at med.ge.com <http://stunnel.mirt.net/mailman/listinfo/stunnel-users>> //> //www.gehealthcare.com <http://www.gehealthcare.com/> //> //What I may see or hear in the course of the treatment or even outside of //> //the treatment in regard to the life of men, which on no account one must //> //spread abroad, I will keep to myself, holding such things shameful to be //> //spoken about. (One Portion of the Hippocratic Oath - Hippocrates, circa //> //400 B.C.) /

1 0

configure/compile issue on AIX
by Boxall, John 13 Jul '06

13 Jul '06

I'm trying to get stunnel working on AIX 5.3. I'm running the configure with "--prefix=/opt/freeware", however, when I start stunnel it is looking for the stunnel.conf file in /usr/local/etc/stunnel. Shouldn't it be looking for it in "/opt/freeware/etc/stunnel", which is where the "make install" put it? Regards, John Boxall

3 4

newbie: stunnel works but do not encrypt
by Gallas Róbert 13 Jul '06

13 Jul '06

Hello, I setup stunnel( v4.15 win32 port ) on both side, client and server. Connection is working but does not encrypt. Setup is done for ORACLE and WEB. Oracle`s listener is setup with "USE_SHARED_SOCKET = TRUE" variable and works fine with OpenSSH with PUTTY I use default configuration just with the needed basic customization: # ##Client cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = stunnel.log client = yes [web] accept = 3128 connect = 10.160.1.220:3128 [oracle] accept = 1521 connect = 10.160.1.220:4892 ### Server: cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [web] accept = 3128 connect = 10.160.0.4:3128 [oracle] accept = 4892 connect = 10.160.1.220:1521 Any good sugestions? Thanks for your answers Regards Robert

2 4

(no subject)
by Gallas Róbert 12 Jul '06

12 Jul '06

Hello, I setup stunnel( v4.15 win32 port ) on both side, client and server. Connection is working but does not encrypt. Setup is done for ORACLE and WEB. Oracle`s listener is setup with "USE_SHARED_SOCKET = TRUE" variable and works fine with OpenSSH with PUTTY I use default configuration just with the needed basic customization: # ##Client cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = stunnel.log client = yes [web] accept = 3128 connect = 10.160.1.220:3128 [oracle] accept = 1521 connect = 10.160.1.220:4892 ### Server: cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [web] accept = 3128 connect = 10.160.0.4:3128 [oracle] accept = 4892 connect = 10.160.1.220:1521 Any good sugestions? Thanks for your answers Regards Robert

1 0

Follow-up: Bad certificate? (was Expired certificate?)
by Boxall, John 11 Jul '06

11 Jul '06

Mike, et al, The problem I was having with stunnel on a Windows box connecting with stunnel on a Unix server (Solaris in this case) turned out to be a mis-configuration of the syslog-ng server on Unix. I took a sample syslog-ng.conf from somewhere else and didn't know the impact of "max-connections(1)". Though I assume it is intended as a limit on the number of connections to the localhost (127.0.0.1:514), it effectively limits the number of in-bound connections from remote logging clients to 1 (in this case using port 5140). Removing this parameter allowed all of my test clients to simultaneously log to the server. Mike, the OpenSSL-generated cert works fine. Thanks. Regards, John Boxall

1 0

libssl.so.0.9.8 error running stunnel
by Michael Tyrrell 10 Jul '06

10 Jul '06

I have a Solaris 10 SPARC server running stunnel 4.15 with openssl version "OpenSSL 0.9.8b 04 May 2006". When I try to run /usr/local/sbin/stunnel I get the following error. ld.so.1: stunnel: fatal: libssl.so.0.9.8: open failed: No such file or directory Killed In the stunnel.conf file I have debug set to 7 but it will not write to the stunnel.log file. I also get the same error if I run stunnel -version. Thanks for any help you could give.

2 1

stunnel and gmail (Windows)
by Al Oomens 08 Jul '06

08 Jul '06

I've gotten an older version of stunnel to work the way I want by starting it from a command prompt like: stunnel -c -d 110 -r pop.gmail.com:995 How do I specify this in the config file for the newest version of stunnel, in order to use it as a service on Windows? -- Al Oomens Wheaton, IL. aloomens(a)gmail.com

2 1

Wildcard outbound IP matching...
by Jeff Roberts 07 Jul '06

07 Jul '06

Is there a way to configure Stunnel to capture outbound packets for *any* IP, but for a specific port? My SMTP server can be configured to connect directly to the final SMTP server. I can configure the outbound port to some other port other than 25, so I'd like to say something like - [smtpclient] protocol=smtp accept = *:2210 connect = *:25 Suggestions? ->Jeff RAD Game Tools

2 1

Bad certificate? (was Expired certificate?)
by Boxall, John 30 Jun '06

30 Jun '06

Mike, I've created a self-signed certificate on my Windows test box using OpenSSL 0.9.7j (the version from Shining Light). I created the key file with the following command: "openssl genrsa 1024 > \host.key Here is the command I used to create the self-signed cert: "openssl req -new -x509 -nodes -sha1 -days 9999 -key \host.key > \host.cert" I then copied the key/cert to the appropriate file in the stunnel directory. I then copied the cert to the Solaris server and included it with all other client certs. Here is the Windows configuration file: ; ;CLIENT-ONLY stunnel configuration file ; client = yes cert = C:\Program Files\stunnel\stunnel.pem-client-certificate CAfile = C:\Program Files\stunnel\stunnel.pem-server-certificate ;chroot = /var/run/stunnel ;pid = /usr/local/var/run/stunnel/stunnel.pid ;setuid = stunnel ;setgid = stunnel verify = 3 ;foreground = yes debug = 7 output = C:\Program Files\stunnel\stunnel.log [5140] accept = 127.0.0.1:514 connect = 172.17.99.143:5140 Here is the Solaris configuration file: ; ;SERVER-ONLY stunnel configuration file ; cert = /usr/local/etc/stunnel/stunnel.pem-server-certificate CAfile = /usr/local/etc/stunnel/stunnel.pem-all-client-certificates ;chroot = /var/run/stunnel ;pid = /var/run/stunnel/run/stunnel.pid ;setuid = stunnel ;setgid = stunnel verify = 3 ;foreground = yes debug = 7 output=/stunnel.log [5140] accept = 172.17.99.143:5140 connect = 127.0.0.1:514 The following happens on the Windows box when I first launch stunnel: 2006.06.30 09:51:31 LOG5[516:360]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.06.30 09:51:31 LOG5[516:360]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.06.30 09:51:31 LOG5[516:392]: No limit detected for the number of clients 2006.06.30 09:51:31 LOG7[516:392]: FD 1904 in non-blocking mode 2006.06.30 09:51:31 LOG7[516:392]: SO_REUSEADDR option set on accept socket 2006.06.30 09:51:31 LOG7[516:392]: 5140 bound to 127.0.0.1:514 Nothing happens on the Solaris box. When I start EventReporter, the following happens, in a continuous loop (until I stop EventReporter): 2006.06.30 10:16:26 LOG7[296:700]: 5140 accepted FD=156 from 127.0.0.1:1154 2006.06.30 10:16:26 LOG7[296:700]: Creating a new thread 2006.06.30 10:16:26 LOG7[296:700]: New thread created 2006.06.30 10:16:27 LOG7[296:1204]: 5140 started 2006.06.30 10:16:27 LOG7[296:1204]: FD 156 in non-blocking mode 2006.06.30 10:16:27 LOG5[296:1204]: 5140 connected from 127.0.0.1:1154 2006.06.30 10:16:27 LOG7[296:1204]: FD 188 in non-blocking mode 2006.06.30 10:16:27 LOG7[296:1204]: 5140 connecting 172.17.99.143:5140 2006.06.30 10:16:27 LOG7[296:1204]: connect_wait: waiting 10 seconds 2006.06.30 10:16:27 LOG7[296:1204]: connect_wait: connected 2006.06.30 10:16:27 LOG7[296:1204]: Remote FD=188 initialized 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): before/connect initialization 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 write client hello A 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 read server hello A 2006.06.30 10:16:27 LOG5[296:1204]: VERIFY OK: depth=0, /C=CA/ST=ONTARIO/L=TORONTO/O=BANK OF MONTREAL/OU=LMG-DTS/CN=jdb2u10 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 read server certificate A 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 read server certificate request A 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 read server done A 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 write client certificate A 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 write client key exchange A 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 write certificate verify A 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 write change cipher spec A 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 write finished A 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 flush data 2006.06.30 10:16:27 LOG3[296:1204]: SSL_connect: Peer suddenly disconnected 2006.06.30 10:16:27 LOG5[296:1204]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.06.30 10:16:27 LOG7[296:1204]: 5140 finished (0 left) On the Solaris box, here is the matching entry, also in a continuous loop: 2006.06.30 10:16:47 LOG7[1214:1]: 5140 accepted FD=2 from 172.17.99.150:1155 2006.06.30 10:16:47 LOG7[1214:800]: 5140 started 2006.06.30 10:16:47 LOG7[1214:800]: FD 2 in non-blocking mode 2006.06.30 10:16:47 LOG5[1214:800]: 5140 connected from 172.17.99.150:1155 2006.06.30 10:16:47 LOG7[1214:800]: SSL state (accept): before/accept initialization 2006.06.30 10:16:47 LOG7[1214:800]: SSL state (accept): SSLv3 read client hello A 2006.06.30 10:16:47 LOG7[1214:800]: SSL state (accept): SSLv3 write server hello A 2006.06.30 10:16:47 LOG7[1214:800]: SSL state (accept): SSLv3 write certificate A 2006.06.30 10:16:47 LOG7[1214:800]: SSL state (accept): SSLv3 write certificate request A 2006.06.30 10:16:47 LOG7[1214:800]: SSL state (accept): SSLv3 flush data 2006.06.30 10:16:48 LOG4[1214:800]: VERIFY ERROR: depth=0, error=self signed certificate: /C=CA/ST=ONTARIO/L=TORONTO/O=BMO/OU=LMG-DTS/CN=jdb1winxp 2006.06.30 10:16:48 LOG7[1214:800]: SSL alert (write): fatal: bad certificate 2006.06.30 10:16:48 LOG3[1214:800]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2006.06.30 10:16:48 LOG5[1214:800]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.06.30 10:16:48 LOG7[1214:800]: 5140 finished (1 left) It appears the server cert is ok, but "something" is wrong with the client (Windows box) cert. Any chance you could post the command used in the "make install" to kick off the creation of the self-signed cert on Unix? I grep'd for it, but couldn't find it. Regards, John Boxall

1 0

Stunnel 4.15 cannot handle PKCS8 format private keys
by David Gillingham 29 Jun '06

29 Jun '06

In modifying stunnel to work with the OpenSSL FIPS-certified module, I found out that private keys cannot be in the default OpenSSL format; they must be in PKCS8 format (due to the MD5 algorithm being disabled in FIPS mode). Talking to Dr. Henson of the OpenSSL group I was able to convert my private keys from the default format to PKCS8, but I found that stunnel was not able to handle these keys. I got the following error output (note that server.pem contains a PKCS8 private key and a PKCS7 public cert): 2006.06.08 17:49:38 LOG7[1120:616]: Certificate: server.pem 2006.06.08 17:49:38 LOG7[1120:616]: Key file: server.pem 2006.06.08 17:49:42 LOG3[1120:616]: error stack: 140B3009 : error:140B3009:SSL routines:SSL_CTX_use_RSAPrivateKey_file:PEM lib 2006.06.08 17:49:42 LOG3[1120:616]: error stack: 906700D : error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1 lib 2006.06.08 17:49:42 LOG3[1120:616]: error stack: 2306A075 : error:2306A075:PKCS12 routines:PKCS12_DECRYPT_D2I:pkcs12 pbe crypt error 2006.06.08 17:49:42 LOG3[1120:616]: error stack: 23077073 : error:23077073:PKCS12 routines:PKCS12_pbe_crypt:pkcs12 algor cipherinit error 2006.06.08 17:49:42 LOG3[1120:616]: SSL_CTX_use_RSAPrivateKey_file: 6074079: error:06074079:digital envelope routines:EVP_PBE_CipherInit:unknown pbe algorithm 2006.06.08 17:49:42 LOG3[1120:616]: Server is down Continuing with Dr. Henson, he informed me that this ssl error output meant that "the PBE table has not been initialized in the application". I corrected this by adding a call to OpenSSL_add_all_algorithms() into ssl_init() in ssl.c. This fixed my error with the PEM files. I am posting this so that this bug may be fixed for the next stunnel release. Additionally, I'd like verification that my fix makes sense given the structure of the stunnel code. From doing some searches in the stunnel source, I could not find any existing code that initialized the PBE table so adding the call to ssl_init() made sense _to me_. Michal: do you agree?

2 1

Expired certificate?
by Boxall, John 29 Jun '06

29 Jun '06

Michal, et al, When attempting to connect from a Windows box to a Solaris box (as the server), the Solaris stunnel log (debug = 7) shows that the certificate on the Windows box (included with the download) has expired. I can connect from a Solaris 9 client box with no problems. The Solaris box is running as an NTP client to an internal NTP server. The Windows box isn't logged into a domain, but the time is within 5 minutes of the Solaris box. Solaris server: Solaris 9 (2004/09, no patches) OpenSSL 0.9.8a Stunnel 4.15 Application: Syslog-ng 1.6.11 (working fine on a client Solaris 9 box) Windows client: Windows XP Stunnel 4.15 Application: EventReporter 8.0.268/8.0.219 stunnel.conf: (borrowed and modified from a Solaris client box) ; ;CLIENT-ONLY stunnel configuration file ; client = yes cert = C:\Program Files\stunnel\stunnel.pem-client-certificate CAfile = C:\Program Files\stunnel\stunnel.pem-server-certificate ;chroot = /var/run/stunnel ;pid = /usr/local/var/run/stunnel/stunnel.pid ;setuid = stunnel ;setgid = stunnel verify = 3 ;foreground = yes debug = 7 output = C:\Program Files\stunnel\stunnel.log [5140] accept = 127.0.0.1:514 connect = 192.168.0.143:5140 If the certificate has truly expired, could you post a new one? If not, any suggestions? Regards, John Boxall

2 1

Re: [stunnel-users] patch to build stunnel 4.15 with VS2005
by David Gillingham 29 Jun '06

29 Jun '06

Surely. Here are the contents of the patch file for vs.mak. >cat 4.15-MSVC2005.patch diff -cr stunnel-4.15-orig/src/vc.mak stunnel-4.15/src/vc.mak *** stunnel-4.15-orig/src/vc.mak Sat Jan 21 10:17:32 2006 --- stunnel-4.15/src/vc.mak Thu Jun 29 17:31:43 2006 *************** *** 1,2 **** ! # makefile for VC is not ready... --- 1,42 ---- ! # Simple Makefile.w32 for stunnel.exe by Michal Trojnara 1998-2006 ! # ! # Modified by David Gillingham (dgillingham(a)gmail.com) for Visual ! # Studio + # Modify this to point to your actual openssl compile directory + # (You did already compile openssl, didn't you???) + SSLDIR=..\openssl-0.9.7j + + OBJS=stunnel.obj ssl.obj ctx.obj file.obj client.obj protocol.obj \ + sthreads.obj log.obj options.obj network.obj resolver.obj \ + gui.obj + + CC=cl + CFLAGS=-MD -W3 -Ox -O2 -Ob2 -Gs0 -GF -Gy -GL -nologo \ + -I"$(SSLDIR)\inc32" $(DEFINES) + DEFINES=-DUSE_WIN32 -D_CRT_SECURE_NO_DEPRECATE \ + -D_CRT_NONSTDC_NO_DEPRECATE -DHAVE_GETADDRINFO \ + -DHAVE_GETNAMEINFO -D_MBCS + + LINK=link + LDFLAGS=-INCREMENTAL:NO -NOLOGO -SUBSYSTEM:WINDOWS -OPT:REF \ + -OPT:ICF -LTCG -MACHINE:X86 -ERRORREPORT:PROMPT + LIBS=-LIBPATH:"$(SSLDIR)\out32dll" wsock32.lib ssleay32.lib \ + libeay32.lib user32.lib gdi32.lib shell32.lib comdlg32.lib \ + advapi32.lib + + all: stunnel.exe + + clean: + del $(OBJS) resources.res + del *.manifest + del stunnel.exe + + stunnel.exe: $(OBJS) resources.res + $(LINK) $(LDFLAGS) $(LIBS) -OUT:$@ $** + IF EXIST [email protected] mt -nologo -manifest [email protected] -outputresource:$@;1 + + resources.res: resources.rc resources.h stunnel.ico + rc -fo $@ resources.rc + + $(OBJS): *.h vc.mak On 6/29/06, Michal Trojnara <Michal.Trojnara(a)mobi-com.net> wrote: > > That's possible. Could you prepare a patch with a minimal set of > changes (not including anything needed to build those Unix-specific files?).

1 0

patch to build stunnel 4.15 with VS2005
by David Gillingham 29 Jun '06

29 Jun '06

All-- I have created a patch that will allow stunnel 4.15 to be built with Visual Studio 2005's command line environment. I have only tested it with VS2k5, but it should work for all Visual Studio .NET versions (that is, VS 7.0 or later). After you apply this patch to the source tree, you will need to run the makefile from a Visual Studio Command prompt (Start->Programs->Visual Studio->Visual Studio Tools->Visual Studio Command Prompt). From there, change the working directory to the stunnel\src folder and execute the command "nmake -f vs.mak all". After the build process has completed, you will have a working stunnel.exe. This patch will modify vc.mak to a working makefile for nmake (mimicing the basic structure of mingw.mak), common.h to include a couple missing headers for the I/O functions in pty.c, and env.c to include the winsock headers under the Win32 environment (replicating how it was done in common.h). This patch that is a result of internal testing/development I've done here at work and am releasing it to this list (and the stunnel developers) so that these changes could possibly be included in future stunnel releases. To the stunnel devs: if there's any additional work that can be done to get this integrated by the next release, just mention it. The other day, I tried sending the patch to the list as an attachment, but my message never showed up on either the mirt.net or google groups mirrors. I can only assume it was rejected because of the attachment. What follows is the full text of my patch file. > cat 4.15-MSVC2005.patch diff -cr stunnel-4.15-orig/src/common.h stunnel-4.15/src/common.h *** stunnel-4.15-orig/src/common.h Fri Mar 10 08:54:56 2006 --- stunnel-4.15/src/common.h Fri Jun 23 21:41:00 2006 *************** *** 153,158 **** --- 153,164 ---- #endif #include <windows.h> + /* include Visual Studio headers needed for I/O manipulation */ + #ifdef _MSC_VER + #include <io.h> + #include <fcntl.h> + #endif + #define ECONNRESET WSAECONNRESET #define ENOTSOCK WSAENOTSOCK #define ENOPROTOOPT WSAENOPROTOOPT diff -cr stunnel-4.15-orig/src/env.c stunnel-4.15/src/env.c *** stunnel-4.15-orig/src/env.c Sat Jan 7 13:47:36 2006 --- stunnel-4.15/src/env.c Mon Jun 26 21:11:25 2006 *************** *** 31,45 **** /* getpeername() can't be declared in the following includes */ #define getpeername no_getpeername #include <sys/types.h> #include <sys/socket.h> /* for AF_INET */ #include <netinet/in.h> #include <arpa/inet.h> /* for inet_addr() */ #include <stdlib.h> /* for getenv() */ #ifdef __BEOS__ #include <be/bone/arpa/inet.h> /* for AF_INET */ #include <be/bone/sys/socket.h> /* for AF_INET */ - #else - #include <sys/socket.h> /* for AF_INET */ #endif #undef getpeername --- 31,52 ---- /* getpeername() can't be declared in the following includes */ #define getpeername no_getpeername #include <sys/types.h> + #ifdef USE_WIN32 + #ifdef _WIN32_WCE + #include <winsock.h> + #else + #include <winsock2.h> + #include <ws2tcpip.h> + #endif /* _WIN32_WCE */ + #else /* USE_WIN32 */ #include <sys/socket.h> /* for AF_INET */ #include <netinet/in.h> #include <arpa/inet.h> /* for inet_addr() */ + #endif /* USE_WIN32 */ #include <stdlib.h> /* for getenv() */ #ifdef __BEOS__ #include <be/bone/arpa/inet.h> /* for AF_INET */ #include <be/bone/sys/socket.h> /* for AF_INET */ #endif #undef getpeername diff -cr stunnel-4.15-orig/src/vc.mak stunnel-4.15/src/vc.mak *** stunnel-4.15-orig/src/vc.mak Sat Jan 21 10:17:32 2006 --- stunnel-4.15/src/vc.mak Tue Jun 27 21:02:15 2006 *************** *** 1,2 **** ! # makefile for VC is not ready... --- 1,45 ---- ! # Simple Makefile.w32 for stunnel.exe by Michal Trojnara 1998-2006 ! # ! # Modified by David Gillingham (dgillingham(a)gmail.com) for Visual ! # Studio ! ! # Modify this to point to your actual openssl compile directory ! # (You did already compile openssl, didn't you???) ! SSLDIR=..\..\openssl-0.9.7j ! ! DEFINES=-DUSE_WIN32 -D_CRT_SECURE_NO_DEPRECATE \ ! -D_CRT_NONSTDC_NO_DEPRECATE -DHAVE_GETADDRINFO \ ! -DHAVE_GETNAMEINFO -D_MBCS ! CC=cl ! CFLAGS=-MD -W3 -Ox -O2 -Ob2 -Gs0 -GF -Gy -GL -nologo \ ! -I"$(SSLDIR)\inc32" $(DEFINES) ! ! LINK=link ! LDFLAGS=-INCREMENTAL:NO -NOLOGO -SUBSYSTEM:WINDOWS -OPT:REF \ ! -OPT:ICF -LTCG -MACHINE:X86 -ERRORREPORT:PROMPT ! LIBS=-LIBPATH:"$(SSLDIR)\out32dll" wsock32.lib ssleay32.lib \ ! libeay32.lib user32.lib gdi32.lib shell32.lib comdlg32.lib \ ! advapi32.lib ! ! OBJS=stunnel.obj ssl.obj ctx.obj file.obj client.obj protocol.obj \ ! sthreads.obj log.obj options.obj network.obj resolver.obj \ ! gui.obj ! ! ! all: stunnel.exe ! ! clean: ! del $(OBJS) resources.res ! del *.manifest ! del stunnel.exe ! ! stunnel.exe: $(OBJS) resources.res ! $(LINK) $(LDFLAGS) $(LIBS) -OUT:$@ $** ! IF EXIST [email protected] mt -manifest [email protected] -outputresource:$@;1 ! ! resources.res: resources.rc resources.h stunnel.ico ! rc /fo $@ resources.rc ! ! $(OBJS): $*.c *.h ! $(CC) $(CFLAGS) -c $*.c

2 1

stunnel in proxy mode won't start
by Dave Hinz 28 Jun '06

28 Jun '06

I'm trying to run stunnel in proxy mode, to accept connections on port 443, and forward them to an application listening at port 9999 on the same box. I believe I have the configuration correct, but I'm obviously overlooking something. Environment: stunnel 4.15 on sparc-sun-solaris2.9 with OpenSSL 0.9.7g 11 Apr 2005 I have built an stunnel.conf file, and a stunnel.pem file which are located in the correct place with the right permissions. I verified that by moving or changing permissions and seeing that errors were produced. I've changed the debug level to 7, and the following information is displayed when I try to start stunnel: cert# stunnel 2006.06.28 13:01:14 LOG7[9088:1]: Snagged 64 random bytes from /users/dave/.rnd 2006.06.28 13:01:14 LOG7[9088:1]: Wrote 1024 new random bytes to /users/dave/.rnd 2006.06.28 13:01:14 LOG7[9088:1]: RAND_status claims sufficient entropy for the PRNG 2006.06.28 13:01:14 LOG6[9088:1]: PRNG seeded successfully 2006.06.28 13:01:14 LOG7[9088:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2006.06.28 13:01:14 LOG7[9088:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2006.06.28 13:01:14 LOG7[9088:1]: Verify directory set to / 2006.06.28 13:01:14 LOG5[9088:1]: Peer certificate location / 2006.06.28 13:01:14 LOG7[9088:1]: SSL context initialized for service test cert# Same thing if I run it as stunnel stunnel.conf -fd The prompt comes back immediately, ps -ef shows no stunnel running, and nothing is answering on port 443 which is where I'm telling it to listen: stunnel.conf file: cert = /usr/local/etc/stunnel/stunnel.pem chroot = /usr/local/etc/stunnel # PID is created inside chroot jail pid = /pid/stunnel.pid #setuid = nobody #setgid = nogroup # Authentication stuff verify = 3 # don't forget about c_rehash CApath # it is located inside chroot jail: CApath = / # Some debugging stuff debug = 7 output = stunnel.log # Use it for client mode client = no # Service-level configuration [test] accept = 127.0.0.1:443 connect = 127.0.0.1:9999 #TIMEOUTclose = 0 ---end stunnel.conf file--- The pem files are located in the same directory as the stunnel.conf, hence the "/" for the pathname above. What am I overlooking please?

1 0

stunnel.cfg file
by Dheeraj Sehrawat 28 Jun '06

28 Jun '06

Hi All, I am looking at a problem and found the system is using stunnel with web server. From my google search I have understood that stunnel is used to make the application SSL enable. Please validate my understanding. I found following stunnel.cfg file in properties directory Port0 Enabled=0 ExternalPort=0 LocalPort=0 SSLEnabled=0 UDP=0 Port1 Enabled=1 ExternalPort=1500 LocalPort=10080 SSLEnabled=0 Port2 Enabled=0 ExternalPort=1600 LocalPort=10080 SSLEnabled=1 ------------------------------------------------------ I have the following questions: 1] what is the meaning of ExternalPort and LocalPort ? How does these ports relate with each other? Please help me in understanding this configuration file. Thanks, Dheeraj __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Re: enabling zlib compression
by ahall＠madasafish.com 27 Jun '06

27 Jun '06

I'd really like to get this working, but I'm not sure what other information you require? All other posts on this subject refer to making sure zlib is included when openssl is compiled. Well, I've confirmed that it is. Would a strace of stunnel attempting to start up help? FYI - The output of stunnel -version displays... stunnel 4.15 on i686-pc-linux-gnu with OpenSSL 0.9.7a Feb 19 2003 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Auth:LIBWRAP Could someone please provide me with some suggestions. Thanks very much. On Mon, 26 Jun 2006 13:09:36 , <ahall(a)madasafish.com> sent: >OK - after checking the OpenSSL src-rpm I can confirm that zlib is compiled... > >./Configure \ > --prefix=%{_prefix} --openssldir=%{_datadir}/ssl ${sslflags} \ > zlib no-idea no-mdc2 no-rc5 no-ec shared \ > --with-krb5-flavor=MIT \ > -I%{_prefix}/kerberos/include -L%{_prefix}/kerberos/%{_lib} \ > ${sslarch} > >Any ideas why the "compression=zlib" option still produces the "Failed to add >zlib compression method" error? > >Thanks very much. > > >>On Fri, 23 Jun 2006 17:01:24 , ahall(a)madasafish.com> sent: >> >>>Hi there, >>> >>>When I try to enable zlib compression at the server I get this error when >>>starting it up... >>> >>>2006.06.23 15:44:39 LOG3[3426:3086293504]: Failed to add zlib compression method >>> >>>How do I get zlib to work? Do I need to compile OpenSSL with zlib? >>> >>>I'm using Fedora Core 3 with stunnel-4.15, and OpenSSL and zlib are from RPM's. >>> >>>Thanks very much. > >---- - Madasafish - Voted Best Heavy Consumer Broadband Provider in the 2006 Internet Industry Awards http://www.madasafish.com/ ---- - Madasafish - Voted Best Heavy Consumer Broadband Provider in the 2006 Internet Industry Awards http://www.madasafish.com/

1 0

Patch to fix compile errors under MS Visual C++ 2005
by David Gillingham 26 Jun '06

26 Jun '06

Attached is a patch for stunnel 4.15 that allows the source to be built under Microsoft Visual Studio 2005. Here's a rundown of what's been changed: In common.h, I included io.h and fcntl.h so that pty.c would build without error. In env.c, I included the winsock headers (replicating how it was done for common.h), and removed a duplicate include of sys/socket.h. The latter change wasn't necessary for compiliation with MSVC, but I thought I'd remove what looked like an unncessary line. To get stunnel to build without warning, I defined the following preprocessor definitions: USE_WIN32 _CRT_SECURE_NO_DEPRECATE _CRT_NONSTDC_NO_DEPRECATE HAVE_GETADDRINFO HAVE_GETNAMEINFO _MBCS Later in the week, I'll post a patch to vs.mak to automate the build process (I'm still building with a solution file at the moment). To the stunnel developers: If there's anything extra I can do to ensure these changes are incorporated into the next release, please let me know.

1 0

Re: enabling zlib compression
by ahall＠madasafish.com 26 Jun '06

26 Jun '06

OK - after checking the OpenSSL src-rpm I can confirm that zlib is compiled... ./Configure \ --prefix=%{_prefix} --openssldir=%{_datadir}/ssl ${sslflags} \ zlib no-idea no-mdc2 no-rc5 no-ec shared \ --with-krb5-flavor=MIT \ -I%{_prefix}/kerberos/include -L%{_prefix}/kerberos/%{_lib} \ ${sslarch} Any ideas why the "compression=zlib" option still produces the "Failed to add zlib compression method" error? Thanks very much. >On Fri, 23 Jun 2006 17:01:24 , ahall(a)madasafish.com> sent: > >>Hi there, >> >>When I try to enable zlib compression at the server I get this error when >>starting it up... >> >>2006.06.23 15:44:39 LOG3[3426:3086293504]: Failed to add zlib compression method >> >>How do I get zlib to work? Do I need to compile OpenSSL with zlib? >> >>I'm using Fedora Core 3 with stunnel-4.15, and OpenSSL and zlib are from RPM's. >> >>Thanks very much. ---- - Madasafish - Voted Best Heavy Consumer Broadband Provider in the 2006 Internet Industry Awards http://www.madasafish.com/

1 0

Re: enabling zlib compression
by ahall＠madasafish.com 26 Jun '06

26 Jun '06

I have checked the OpenSSL INSTALL file and zlib /should/ be enabled by default... zlib-dynamic Like "zlib", but has OpenSSL load the zlib library dynamically when needed. This is only supported on systems where loading of shared libraries is supported. This is the default choice. If I can assume that Linux supports the loading of shared libraries, then can someone please help me to get zlib compression working over the stunnel. Thanks very much. On Fri, 23 Jun 2006 17:01:24 , <ahall(a)madasafish.com> sent: >Hi there, > >When I try to enable zlib compression at the server I get this error when >starting it up... > >2006.06.23 15:44:39 LOG3[3426:3086293504]: Failed to add zlib compression method > >How do I get zlib to work? Do I need to compile OpenSSL with zlib? > >I'm using Fedora Core 3 with stunnel-4.15, and OpenSSL and zlib are from RPM's. > >Thanks very much. > >---- - Madasafish - Voted Best Heavy Consumer Broadband Provider in the 2006 Internet Industry Awards http://www.madasafish.com/ ---- - Madasafish - Voted Best Heavy Consumer Broadband Provider in the 2006 Internet Industry Awards http://www.madasafish.com/

1 0

Solaris9/Sparc runtime library problems
by Dave Hinz 23 Jun '06

23 Jun '06

This is probably a very basic problem, but I've checked the FAQ and googled through the mailing list's archives and I'm not seeing what appears to be a match for this problem. I'm completely new to stunnel. It built and runs just fine on one of my linux dev boxes, but on Solaris, I can't get it to run. Attempting to run /usr/local/sbin/stunnel, I get the following: ---begin output--- jabba% ./stunnel ld.so.1: ./stunnel: fatal: libssl.so.0.9.7: open failed: No such file or directory Killed ---end output--- The various debug switches to stunnel give the same output - it's dying before anything can be started, apparently. libssl.so.0.9.7 is located on that box at /usr/local/ssl/lib/libssl.so.0.9.7and other ssl functions of the system appear to work normally. I suspect that stunnel just doesn't know how to find it, but I'm at a loss as to how to tell it where to look. Can someone suggest my next steps please? Thank you, Dave Hinz

2 1

Patch for stunnel 4.15 to support pgsql protocol
by Peter Kuma 23 Jun '06

23 Jun '06

Hi I've written a short patch for stunnel 4.15 adding support for PostgreSQL SSL negotiation. I hope it'll be useful. http://vcielka.rec.uniba.sk/~peter/stunnel-pgsql.patch PostgreSQL documentation explaining how to establish SSL connection: http://www.postgresql.org/docs/8.1/interactive/protocol-flow.html#AEN60652 http://www.postgresql.org/docs/8.1/interactive/protocol-message-formats.html Regards Peter Kuma

1 0

enabling zlib compression
by ahall＠madasafish.com 23 Jun '06

23 Jun '06

Hi there, When I try to enable zlib compression at the server I get this error when starting it up... 2006.06.23 15:44:39 LOG3[3426:3086293504]: Failed to add zlib compression method How do I get zlib to work? Do I need to compile OpenSSL with zlib? I'm using Fedora Core 3 with stunnel-4.15, and OpenSSL and zlib are from RPM's. Thanks very much. ---- - Madasafish - Voted Best Heavy Consumer Broadband Provider in the 2006 Internet Industry Awards http://www.madasafish.com/

1 0

Re: CRLPath not working (Michal Trojnara)
by Nagasundaram, Sekhar 15 Jun '06

15 Jun '06

Michael: We will give this also a shot. The workaround worked however. Much thanks Sekhar ---------------- Message: 4 Date: Tue, 13 Jun 2006 23:44:50 +0200 From: Michal Trojnara <Michal.Trojnara(a)mobi-com.net> Subject: Re: [stunnel-users] CRLPath not working To: stunnel-users(a)mirt.net Message-ID: <200606132344.53413.Michal.Trojnara(a)mobi-com.net> Content-Type: text/plain; charset="utf-8" On Tuesday 13 June 2006 02:14, Nagasundaram, Sekhar wrote: > Here are the configuration and the log files as you requested.... Thank you. Please try the following change: --- ctx.old 2006-06-13 23:33:29.000000000 +0200 +++ ctx.c 2006-06-13 23:35:33.000000000 +0200 @@ -460,6 +460,7 @@ s_log(LOG_DEBUG, "Loaded CRLs from %s", section->crl_file); } if(section->crl_dir) { + section->revocation_store->cache=0; lookup=X509_STORE_add_lookup(section->revocation_store, X509_LOOKUP_hash_dir()); if(!lookup) { BTW: Did my workaround work? Best regards, Mike

1 0

RE: [stunnel-users] Is there a limit to the number of services youcanhave defined on a client?
by Lund, Claus 14 Jun '06

14 Jun '06

Well, we need about 100+ in our current environment. So how about increasing it to maybe 256? -Claus -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Michal Trojnara Sent: Wednesday, June 14, 2006 4:23 PM To: <stunnel-users(a)mirt.net> <stunnel-users(a)mirt.net> Subject: Re: [stunnel-users] Is there a limit to the number of services youcanhave defined on a client? On 2006-06-14, at 22:18, Lund, Claus wrote: > Any chance the default could be increased? Really, what's 4MB of RAM > between friends (for the example in your answer)? :-) Okay. What value do you recommend? > And maybe implement an error/warning message when the limit is > exceeded? Good idea. I'll do it. Best regards, Mike _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

RE: [stunnel-users] Is there a limit to the number of services youcan have defined on a client?
by Lund, Claus 14 Jun '06

14 Jun '06

Thanks Mike. Any chance the default could be increased? Really, what's 4MB of RAM between friends (for the example in your answer)? :-) And maybe implement an error/warning message when the limit is exceeded? -Claus -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Michal Trojnara Sent: Wednesday, June 14, 2006 4:11 PM To: <stunnel-users(a)mirt.net> <stunnel-users(a)mirt.net> Subject: Re: [stunnel-users] Is there a limit to the number of services youcan have defined on a client? On 2006-06-14, at 21:20, Lund, Claus wrote: > I ran > some quick tests and it looks like it's impossible to have more than > 64 services defined? Here is your answer: http://stunnel.mirt.net/pipermail/stunnel-users/2006-April/001099.html Best regards, Mike _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

Is there a limit to the number of services you can have defined on a client?
by Lund, Claus 14 Jun '06

14 Jun '06

We have a bunch of middle-tier servers for an application and we're using stunnel to encrypt the traffic between the windows clients and those middle-tier servers. The clients have stunnel.conf files with a large number of services defined and it seems like we're hitting some limit in stunnel. I ran some quick tests and it looks like it's impossible to have more than 64 services defined? If I have a config file with about 100 services defined then everything works fine up until I try to connect to service number 65. When I try to connect to that service then the client just hangs forever (and there's no output in the log file on the client). We are using version 4.14 but I tested this on 4.15 as well and I am getting the same result there. Here's a piece of the config file I am using for testing: "client = yes ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log [blah] accept = 13806 connect = tax187a:13806 [blah1] accept = 13807 connect = tax187a:13806" Then followed by blah2 - blah100. Things work fine when connect to "blah63" and lower. Anything higher than that cause the stunnel client to just hang. Thank you in advance, Claus ____________________________________________ Claus Lund Systems Developer NEW EMAIL ADDRESS: Claus.Lund(a)state.vt.us Department of Taxes Information Systems 133 State Street Montpelier, Vermont 05633-1401 (802) 828-3735

2 1

CRLPath not working
by Nagasundaram, Sekhar 13 Jun '06

13 Jun '06

Mike: Here are the configuration and the log files as you requested.... ---------------------------------------------BEGIN CONFIG --------------------------------- # switch-simulator stunnel configuration file # Copyright by Michal Trojnara 2002 # Certs and keys cert = /etc/certs/demoedge2-cert.pem key = /etc/keys/demoedge2-key.pem # PID is created inside chroot jail pid = /var/opt/stunnel/stunnel_server.pid # Authentication stuff verify = 2 options = NO_SSLv2 # don't forget about c_rehash CApath # it is located inside chroot jail: CApath = /etc/CApath # CRL path or file (inside chroot jail): CRLpath = /etc/crl # Some debugging stuff debug = local4.5 output = /var/opt/log/pras_test_server.log # Use it for client mode #client = no # Service-level configuration [APF] accept = 10.172.86.128:51101 connect = 127.0.0.1:50111 ----------------------------------------------END CONFIG ---------------------------------- --------------------------------------------- BEGIN LOG FILE ------------------------------- 2006.06.11 19:27:25 LOG5[8839:7]: CA CRL: Issuer: /C=US/O=VISA CRL ISSUER>, lastUpdate: Jun 9 07:00:02 2006 GMT, nextUpdate: Jun 10 08:00:02 2006 GMT 2006.06.11 19:27:25 LOG4[8839:7]: Found CRL is expired - revoking all certificates until you get updated CRL 2006.06.11 19:27:25 LOG3[8839:7]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2006.06.11 19:27:25 LOG5[8839:7]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.06.12 17:41:52 LOG5[8839:8]: APF connected from 10.172.86.96:35225 2006.06.12 17:41:52 LOG5[8839:8]: VERIFY OK: depth=2, /C=US/O=VISA/OU=Visa International Service Association/CN=TEST Visa Info Delivery Root CA 2006.06.12 17:41:52 LOG5[8839:8]: CA CRL: Issuer: /C=US/O=VISA CRL ISSUER>, , lastUpdate: Jun 9 07:00:02 2006 GMT, nextUpdate: Jun 10 08:00:02 2006 GMT 2006.06.12 17:41:52 LOG4[8839:8]: Found CRL is expired - revoking all certificates until you get updated CRL 2006.06.12 17:41:52 LOG3[8839:8]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2006.06.12 17:41:52 LOG5[8839:8]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.06.12 23:01:08 LOG5[8839:9]: APF connected from 10.172.86.96:35371 2006.06.12 23:01:08 LOG5[8839:9]: VERIFY OK: depth=2, <VISA CA> 2006.06.12 23:01:08 LOG5[8839:9]: CA CRL: Issuer: /C=US/O=VISA CRL ISSUER>, lastUpdate: Jun 9 07:00:02 2006 GMT, nextUpdate: Jun 10 08:00:02 2006 GMT 2006.06.12 23:01:08 LOG4[8839:9]: Found CRL is expired - revoking all certificates until you get updated CRL 2006.06.12 23:01:08 LOG3[8839:9]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2006.06.12 23:01:08 LOG5[8839:9]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket ------------------------------------------- END LOG FILE -------------------------------------- On 2006-06-12, at 22:17, Nagasundaram, Sekhar wrote: > We download crls everyday from a CRL server using LDAP and a cronjob. > These CRLs are stored in the CRLpath directory along with its hash. > It appears that the stunnel is not refreshing its cache, and it > still shows "Found CRL is expired - revoking all certificates until > you get updated CRL" when we try to connect to it even though there is > a > New and valid CRL in the CRLPath folder. Is there a special option > In Stunnel configuration for it to recognize/cache/add the new hash > file Just to make sure: the problem disappears after restarting stunnel, right? The simple workaround could be disabling all SSL caches: ./configure --with-threads=fork make clean make make install Can you send your stunnel.conf and debug log? TIA, Mike Sekhar Nagasundaram <<Nagasundaram, Sekhar.vcf>>

2 1

Modifying STunnel to use OpenSSL FIPS
by David Gillingham 13 Jun '06

13 Jun '06

As part of an internal project at work, I'm investigating a Windows tunneling solution using STunnel. As a requirement of my work, I am to modify STunnel to use OpenSSL's FIPS APIs. And, with only a couple of speedbumps, I was able to achieve this. However I'd like to make my code a little more robust--to provide some notification to the user if OpenSSL's FIPS mode is active or not. To this point I've not been able to figure out a way to do this. In my copy of the STunnel source, I've modified the routine ssl_init() in ssl.c to make a call to FIPS_mode_set(1) (as demonstrated on page 33 of http://www.openssl.org/docs/fips/UserGuide-1.0.pdf) Below is a copy of my current copy of ssl_init(): void ssl_init(void) { /* to keep CLI structure for verify callback */ #if defined(OPENSSL_FIPS) && defined(USE_FIPS) if (!FIPS_mode_set(1)) { s_log(LOG_CRIT, "Could not set FIPS mdoe!"); } else { s_log(LOG_INFO, "In FIPS mode."); } #endif /* rest of ssl_init() from original source */ } As I've found out, the s_log calls do nothing because the STunnel window has not been displayed yet. Ideally, in the case where the FIPS_mode_set() call fails, I'd like to invoke an error handler to cause the STunnel service to fail to start. But trying to make a call to something like sslerror() caused a program crash. Any ideas on how to make these changes?

2 3

RE: [stunnel-users] socket closed after SSL_write
by Srilalitha Muralidhara(HCL Capital Market Services) 13 Jun '06

13 Jun '06

Thanks Michal. How do I disable the socket from sending TCP RST and instead make it send TCP FIN? It might be a very basic question. Sorry about that. Thanks Sri Srilalitha Muralidhara Rates IT Report Server HCL Capital Market Services ( 91.80.4190.6689 + 33/1,The Senate, Ulsoor Road, Bangalore. India. This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorized copying, disclosure or distribution of the material in this e-mail is strictly forbidden. -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Michal Trojnara Sent: Monday, June 12, 2006 11:08 PM To: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] socket closed after SSL_write On Monday 12 June 2006 12:01, Srilalitha Muralidhara wrote: > 2006.06.12 10:47:45 LOG7[19699:28]: SSL alert (write): warning: close > notify Clean SSL shutdown alert was received. > 2006.06.12 10:47:50 LOG3[19699:28]: SSL_read: Connection reset by peer > (131) ... and then TCP RST! Strange. It looks like your application has set SO_LINGER option on its socket, so it sends TCP RST instead of TCP FIN packet. Best regards, Mike Disclaimer: *********** The contents of this E-mail (including the contents of the enclosure(s) or attachment(s) if any) are privileged and confidential material of HCL Capital Market Services and should not be disclosed to, used by or copied in any manner by anyone other than the intended addressee(s). In case you are not the desired addressee, you should delete this message and/or re-direct it to the sender. The views expressed in this E-mail message (including the enclosure(s) or attachment(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of HCL Capital Market Services. This e-mail message including attachment/(s), if any, is believed to be free of any virus. However, it is the responsibility of the recipient to ensure that it is virus free and HCL Capital Market Services is not responsible for any loss or damage arising in any way from its use.

2 1

CRLPath not working
by Nagasundaram, Sekhar 12 Jun '06

12 Jun '06

All: We download crls everyday from a CRL server using LDAP and a cronjob. These CRLs are stored in the CRLpath directory along with its hash. It appears that the stunnel is not refreshing its cache, and it still shows "Found CRL is expired - revoking all certificates until you get updated CRL" when we try to connect to it even though there is a New and valid CRL in the CRLPath folder. Is there a special option In Stunnel configuration for it to recognize/cache/add the new hash file All help is appreciated. Thanks Sekhar

2 1

Re: [stunnel-users] Comparing with BarracudaDrive and Proxytunnel
by Michal Trojnara 12 Jun '06

12 Jun '06

On 2006-06-11, at 21:39, http s wrote: > I am curious if anyone has made a comparison of Stunnel with the > BarracudaDrive HTTPS tunnel and/or Proxytunnel? > > http://barracudaserver.com/examples/BarracudaDrive/HttpsTunnel/ > index.html 1. BarracudaDrive is *not* a free software (even though its home page claims so). See http://www.gnu.org/philosophy/free-sw.html for details. 2. It only works on Windows, Linux, QNX and Mac OS X. Compare it to the list on http://stunnel.mirt.net/. 3. BarracudaDrive is designed to be used for file transfer, while stunnel is a universal tool for encrypting TCP streams. As the result stunnel is much more flexible, but it won't perform any file transfer by itself. > http://proxytunnel.sourceforge.net 1. It's not really an encryption tool, but rather an extension for OpenSSH client. It has some optional basic SSL code (as for version 1.6.0), but it's currently broken. The code incorrectly assumes that SSL_read() only needs to read from a file descriptor and SSL_write() only needs to wrote to a file descriptor. 2. Proxytunnel supports NTLM authentication that is not currently supported by stunnel. 3. It looks like an interesting addition to stunnel on a Unix platform. The client configuration should be something like: [Proxytunnel] client = yes accept = 12345 exec = /path/to/proxytunnel execargs = proxytunnel -p proxy:8080 -u user -s pass -d mybox.athome.nl:443 4. Optional use of stunnel is recommended in README file of Proxytunnel 1.6.0. 8-) Best regards, Mike

1 0

socket closed after SSL_write
by Srilalitha Muralidhara(HCL Capital Market Services) 12 Jun '06

12 Jun '06

Hi, I work on a client-server application that needs to be supported on both UNIX and windows platforms. Currently, we keep one socket open for all communication from client to server (during which many read-write operations take place) For user authentication and security purposes, we are planning to implement SSL-Stunnel. I have developed a small ssl client (based on sclient.c example) which connects to the Stunnel Server. Upon the first SSL_write, SSL is closing the underlying socket. Hence the contents written by subsequent SSL_write operations are not visible in the server log. I saw lot of posts on the same problem. But couldn't find the solution. Any help is greatly appreciated. Please note that: 1. Due platform independency issues, I use RWSocket (a Roguewave library class) instead of the BSD socket in conjunction with SSL. A potion of stunnel server log 2006.06.12 10:47:43 LOG7[19699:28]: FD 1 in non-blocking mode 2006.06.12 10:47:43 LOG7[19699:28]: rssvr connecting 127.0.0.1:28091 2006.06.12 10:47:43 LOG7[19699:28]: Remote FD=1 initialized 2006.06.12 10:47:43 LOG7[19699:28]: TCP_NODELAY option set on remote socket 2006.06.12 10:47:45 LOG7[19699:28]: Socket closed on read 2006.06.12 10:47:45 LOG7[19699:28]: SSL write shutdown 2006.06.12 10:47:45 LOG7[19699:28]: SSL alert (write): warning: close notify 2006.06.12 10:47:45 LOG7[19699:28]: SSL_shutdown retrying 2006.06.12 10:47:45 LOG7[19699:28]: SSL doesn't need to read or write 2006.06.12 10:47:50 LOG3[19699:28]: SSL_read: Connection reset by peer (131) 2006.06.12 10:47:50 LOG5[19699:28]: Connection reset: 0 bytes sent to SSL, 26 bytes sent to socket 2006.06.12 10:47:50 LOG7[19699:28]: linger (remote): Invalid argument (22) 2006.06.12 10:47:50 LOG7[19699:28]: linger (local): Invalid argument (22) 2006.06.12 10:47:50 LOG7[19699:28]: rssvr finished (0 left) Thanks Sri Srilalitha Muralidhara This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorized copying, disclosure or distribution of the material in this e-mail is strictly forbidden. Disclaimer: *********** The contents of this E-mail (including the contents of the enclosure(s) or attachment(s) if any) are privileged and confidential material of HCL Capital Market Services and should not be disclosed to, used by or copied in any manner by anyone other than the intended addressee(s). In case you are not the desired addressee, you should delete this message and/or re-direct it to the sender. The views expressed in this E-mail message (including the enclosure(s) or attachment(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of HCL Capital Market Services. This e-mail message including attachment/(s), if any, is believed to be free of any virus. However, it is the responsibility of the recipient to ensure that it is virus free and HCL Capital Market Services is not responsible for any loss or damage arising in any way from its use.

2 1

Reposting...RE: stunnel-users Digest, Vol 23, Issue 2
by Nagasundaram, Sekhar 09 Jun '06

09 Jun '06

Any one... Is there a way to have Stunnel not stop accepting new connections after CRL expiry? See my questions below.. Any help is appreciated... Much thanks Sekhar ---------------------------------------------------------------------- Message: 1 Date: Tue, 6 Jun 2006 15:41:08 -0700 From: "Nagasundaram, Sekhar" <snagasun(a)visa.com> Subject: [stunnel-users] Processing during CRL expiry and refresh To: <stunnel-users(a)mirt.net> Message-ID: <F64762DF94A15C4EA22D250B28D98BE610093C(a)sw720ex064.visa.com> Content-Type: text/plain; charset="US-ASCII" All: I have 2 questions: 1. Is there a way to have Stunnel continue processing and accepting connections after the CRL expiry? Currently it gives a "revoking all certificates" error and stops accepting new connections. 2. Is there a configurable parameter through which we can have the CRL list refresh itself such that 1 above does not happen? Much Thanks in advance.. Sekhar ------------------------------ _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users End of stunnel-users Digest, Vol 23, Issue 2 ********************************************

1 0

syslog-ng over stunnel does not work for me
by Christoph Pleger 08 Jun '06

08 Jun '06

Hello, I set up a server and a client machine to test the combination of stunnel and syslog-ng. I followed the instructions in the example at http://www.stunnel.org/examples/syslog-ng.html, but the log messages are not sent correcly. The log on the server says: ****: syslog started ****: syslog connected from ###.###.###.###:51646 ****: SSL state (accept): before/accept initialization ****: SSL_accept: 140B544E: error: 140B544E: SSL routines:SSL_GET_NEW_SESSION:ssl session id callback failed ****: syslog finished (-1 left) The log on the client says: ****: syslog started ****: syslog connected from 127.0.0.1:3524 ****: FD 8 in non-blocking mode ****: syslog connecting ###.###.###.###:514 ****: connect_wait: waiting 10 seconds ****: connect_wait: connected ****: Remote FD=8 initialized ****: SSL state (connect): before/accept initialization ****: SSL state (connect): SSLv3 write client hello A ****: SSL_connect: Peer suddenly disconnected ****: syslog finished (0 left) Please help. Regards Christoph

1 1

Connection Reset by Peer
by Srilalitha Muralidhara(HCL Capital Market Services) 08 Jun '06

08 Jun '06

Hi, My stunnel server is unable to send data correctly to my application running the same machine. This happens when the client is run from windows platform. When client is run from UNIX everything works fine. The Stunnel Server log file says: 2006.06.05 11:54:54 LOG7[23141:8]: rssvr connecting 127.0.0.1:28091 2006.06.05 11:54:54 LOG7[23141:8]: Remote FD=1 initialized 2006.06.05 11:54:54 LOG7[23141:8]: TCP_NODELAY option set on remote socket 2006.06.05 11:54:54 LOG3[23141:8]: SSL_read: Connection reset by peer (131) 2006.06.05 11:54:54 LOG5[23141:8]: Connection reset: 0 bytes sent to SSL, 13 bytes sent to socket 2006.06.05 11:54:54 LOG5[23141:8]: linger (local): Invalid argument (22) 2006.06.05 11:54:54 LOG7[23141:8]: rssvr finished (0 left) ------------------------------------------------------------------------ -------------------------------------------------------------------- Does anybody know the cause of the problem? And hopefully the solution? Thanks Sri Disclaimer: *********** The contents of this E-mail (including the contents of the enclosure(s) or attachment(s) if any) are privileged and confidential material of HCL Capital Market Services and should not be disclosed to, used by or copied in any manner by anyone other than the intended addressee(s). In case you are not the desired addressee, you should delete this message and/or re-direct it to the sender. The views expressed in this E-mail message (including the enclosure(s) or attachment(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of HCL Capital Market Services. This e-mail message including attachment/(s), if any, is believed to be free of any virus. However, it is the responsibility of the recipient to ensure that it is virus free and HCL Capital Market Services is not responsible for any loss or damage arising in any way from its use.

1 0

decryption failed or bad record mac
by Trent Townsend 07 Jun '06

07 Jun '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I've emailed about this once already, but am just giving a *little* more info. It seems similar problems with SSL proliferate the web. The problem is below (message from the client and server posted). I thought it may be a bug reported with SSL and zlib (which a fix isn't due out until the next version of OpenSSL). However, I can successfully start up a openssl s_server and talk to it with a s_client, so I think that eliminates OpenSSL. Has anyone seen this before (I'm sure this is the case) and figured it out? Client: SSL_connect: 140943FC: error:140943FC:SSL routines:SSL3_READ_BYTES:sslv3 alert bad record mac Server: SSL_accept: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac I'm using stunnel 4.11 (tried 4.15 also) and Openssl 0.9.8a. Thanks. -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.6 (Build 6060) iQA/AwUBRIcbw40HAxBKv2yIEQI5XQCg2ylvhIBlZ57euv9/wu8fM5vI40cAoKKk L2bMgFZDc23T6ED6CGJJn8oy =+PA6 -----END PGP SIGNATURE-----

1 0

RE: [stunnel-users] stunnel error
by Nadav, Erez 07 Jun '06

07 Jun '06

Hi, It seems that the problem occur when the client write large buffers (30-40Kbytes) on each write. Any idea how to solve it Thanks Erez ________________________________ From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Nadav, Erez Sent: Wednesday, June 07, 2006 6:00 PM To: stunnel-users(a)mirt.net Subject: [stunnel-users] stunnel error Hi, I use stunnel 4.14 and face this error when performing buffer writes from client to remote side SSL_write: 140D5042: error:140D5042:SSL routines:SSL3_CTRL:called a function you should not call Does anybody know how can I overcome this ??? Thanks Erez ________________________________________________________________________ __________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1). __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

1 0

stunnel error
by Nadav, Erez 07 Jun '06

07 Jun '06

Hi, I use stunnel 4.14 and face this error when performing buffer writes from client to remote side SSL_write: 140D5042: error:140D5042:SSL routines:SSL3_CTRL:called a function you should not call Does anybody know how can I overcome this ??? Thanks Erez __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

1 0

Processing during CRL expiry and refresh
by Nagasundaram, Sekhar 06 Jun '06

06 Jun '06

All: I have 2 questions: 1. Is there a way to have Stunnel continue processing and accepting connections after the CRL expiry? Currently it gives a "revoking all certificates" error and stops accepting connections. 2. Is there a configurable parameter through which we can have the CRL list refresh itself such that 1 above does not happen? Much Thanks in advance.. Sekhar

1 0

unsecure configuration
by Robert Bator 01 Jun '06

01 Jun '06

Hi , I am trying to set up stunnel to accept unsecure calls on port 1001 from inside and secure calls on port 1000 from internet. All calls are forwarded to machin B The configuration like this: secure --> 1000 machine A unsecure --> 1002 machine B unsecure --> 1001 machine A unsecure --> 1002 machine B Is this setup possible i stunnel? PS. I use "stone repeater" and this rules are easy to setup. Best Regards, Robert Bator

1 0

stunnel and bad rsa signature
by Trent Townsend 30 May '06

30 May '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On a test environment, I successfully had stunnel securing MySQL traffic between 2 systems using a verify level of 3. However, with the production system and what I would call an identical setup (albeit with new certificates), I get the following errors (see log below.) The version I'm running of stunnel is 4.11. I saw the "bad rsa signature" message in the server's output, so I regenerated the private key file to be sure I'd used the right one. Everything seems to be in order, but it will not work. Any ideas? Client: 2006.05.30 09:20:21 LOG5[21951:1]: stunnel 4.11 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 2006.05.30 09:20:21 LOG5[21951:1]: 499 clients allowed 2006.05.30 09:20:25 LOG5[21951:2]: stunnel_mysql connected from 127.0.0.1:32853 2006.05.30 09:20:25 LOG3[21951:2]: SSL_connect: 14094410: error: 14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure 2006.05.30 09:20:25 LOG5[21951:2]: stack_info: size=65536, current=15296 (23%), maximum=15296 (23%) Server: 2006.05.30 09:19:42 LOG7[19964:3086334176]: RAND_status claims sufficient entropy for the PRNG 2006.05.30 09:19:42 LOG6[19964:3086334176]: PRNG seeded successfully 2006.05.30 09:19:42 LOG7[19964:3086334176]: Certificate: /usr/KRB5/ openssl/ssl/private/server.key 2006.05.30 09:19:42 LOG7[19964:3086334176]: Key file: /usr/KRB5/ openssl/ssl/private/server.key 2006.05.30 09:19:42 LOG7[19964:3086334176]: Verify directory set to / usr/KRB5/openssl/ssl/certs 2006.05.30 09:19:42 LOG5[19964:3086334176]: Peer certificate location /usr/KRB5/openssl/ssl/certs 2006.05.30 09:19:42 LOG7[19964:3086334176]: SSL context initialized for service stunnel_mysqld 2006.05.30 09:19:42 LOG5[19964:3086334176]: stunnel 4.15 on i686-pc- linux-gnu with OpenSSL 0.9.7a Feb 19 2003 2006.05.30 09:19:42 LOG5[19964:3086334176]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Auth:LIBWRAP 2006.05.30 09:19:42 LOG6[19964:3086334176]: file ulimit = 1022 (can be changed with 'ulimit -n') 2006.05.30 09:19:42 LOG6[19964:3086334176]: poll() used - no FD_SETSIZE limit for file descriptors 2006.05.30 09:19:42 LOG5[19964:3086334176]: 499 clients allowed 2006.05.30 09:19:42 LOG7[19964:3086334176]: FD 4 in non-blocking mode 2006.05.30 09:19:42 LOG7[19964:3086334176]: FD 5 in non-blocking mode 2006.05.30 09:19:42 LOG7[19964:3086334176]: FD 6 in non-blocking mode 2006.05.30 09:19:42 LOG7[19964:3086334176]: SO_REUSEADDR option set on accept socket 2006.05.30 09:19:42 LOG7[19964:3086334176]: stunnel_mysqld bound to 0.0.0.0:606 2006.05.30 09:19:42 LOG7[19964:3086334176]: Created pid file /usr/ local/var/stunnel/stunnel.pid 2006.05.30 09:20:40 LOG7[19964:3086334176]: stunnel_mysqld accepted FD=7 from xxx.xxx.xxx.xxx:32854 2006.05.30 09:20:40 LOG7[19964:3086330800]: stunnel_mysqld started 2006.05.30 09:20:40 LOG7[19964:3086330800]: FD 7 in non-blocking mode 2006.05.30 09:20:40 LOG7[19964:3086330800]: FD 8 in non-blocking mode 2006.05.30 09:20:40 LOG7[19964:3086330800]: FD 9 in non-blocking mode 2006.05.30 09:20:40 LOG7[19964:3086330800]: Connection from xxx.xxx.xxx.xxx:32854 permitted by libwrap 2006.05.30 09:20:40 LOG5[19964:3086330800]: stunnel_mysqld connected from xxx.xxx.xxx.xxx:32854 2006.05.30 09:20:40 LOG7[19964:3086334176]: Cleaning up the signal pipe 2006.05.30 09:20:40 LOG6[19964:3086334176]: Child process 19967 finished with code 0 2006.05.30 09:20:40 LOG5[19964:3086330800]: VERIFY OK: depth=2, ... (Root CA) 2006.05.30 09:20:40 LOG5[19964:3086330800]: VERIFY OK: depth=1, ... (CA) 2006.05.30 09:20:40 LOG5[19964:3086330800]: VERIFY OK: depth=0, ... (client) 2006.05.30 09:20:40 LOG3[19964:3086330800]: error stack: 1408807A : error:1408807A:SSL routines:SSL3_GET_CERT_VERIFY:bad rsa signature 2006.05.30 09:20:40 LOG3[19964:3086330800]: SSL_accept: 4077068: error:04077068:rsa routines:RSA_verify:bad signature 2006.05.30 09:20:40 LOG5[19964:3086330800]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.05.30 09:20:40 LOG7[19964:3086330800]: stunnel_mysqld finished (0 left) Thanks. -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.6 (Build 6060) iQA/AwUBRHx+bI0HAxBKv2yIEQIJ1wCcCVJ+9ZqXdxWGTBAS8y7ldUv+J4UAn1al ZYIA5gmw38iwsYuE7tG9esAk =ljGb -----END PGP SIGNATURE-----

1 0

Problem getting stunnel to chroot on Suse 10
by Paul Stepowski 29 May '06

29 May '06

Hi list, I'm using stunnel package that comes standard with Suse 10.0 stunnel 4.10 on i686-suse-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7g 11 Apr 2005 I can tunnel ports over ssl using stunnel but the chroot directive doesn't seem to be working. E.g. my pid file is being created under / rather than /var/lib/stunnel-syslogng. The other paths in the config file are taken by stunnel as relative to / rather than the chroot directory. What am I missing? Here's my stunnel config. I'm not passing any other flags when running stunnel. ---snip--- client = no #debug = 7 #foreground = yes chroot = /var/lib/stunnel-syslogng setuid = stunnel setgid = nogroup pid = /stunnel.pid #output = stunnel.log socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 #compression = rle #options = DONT_INSERT_EMPTY_FRAGMENTS #verify = 2 #CApath = /certs #CAfile = /certs/stunnel.pem #CRLpath = /crls #CRLfile = /etc/stunnel/crls.pem cert = /var/lib/stunnel-syslogng/certs/stunnel.pem ---snip--- Thanks, Paul

1 0

Re: [stunnel-users] stunnel-4.15 segfaulting and looping under FreeBSD-CURRENT
by Michael Weiser 26 May '06

26 May '06

On Wed, May 17, 2006 at 06:01:37PM +0200, Michael Weiser wrote: > > I'm now retrying with a freshly compiled openssl-0.9.8b to see if that has > > anything to do with anything. > The problem persists with openssl-0.9.8b: > # gdb src/stunnel --core stunnel.core --batch -ex "thread apply all bt > full" -ex "quit" > Core was generated by `stunnel'. > Program terminated with signal 11, Segmentation fault. > #0 0x280d07b5 in SSL_get_peer_certificate () from > ../bin/openssl-0.9.8b/lib/libssl.so.0.9.8 > [New LWP 100077] The problem is triggered by a change to src/client.c in stunnel-4.15. client() now loops over calls to run_client() instead of doing it just once. The first, successful (!) call to run_client() seems to leave the ssl context in an undefined state which makes the following calls to run_client() segfault in the forked child which in turn produces the core file. My guess is, that it's not actually supposed to loop if the call to run_client() is successful. Reverting client.c to roughly 4.14 fixes the problem for me. A patch is attached. Any insights and a more permanent fix would be highly appreciated. BTW: I configured stunnel with --with-threads=pthread. By default, ucontext is detected, which is broken in stunnel-4.14 as well. After finishing, 4.14 hangs in s_poll_wait waiting for -1 seconds on 0 fds (!?). I can provide debugging log and gdb output if needed. -- bye, Michael

1 0

DNS Spoofing
by Happy Manocha 25 May '06

25 May '06

Hello All, >From Website I came to know Stunnel can help in DNS spoofing. Can someone redirect to know how this can be achieved. Stunnel can help: Protect interception of data Prevent manipulation of data And, if compiled with libwrap support: Defend against IP source routing, (one host sending packets as if they came from somewhere else) DNS spoofing (an attacker forging name server records) Regds Happy Manocha

1 0

stunnel + socks v5
by Carlos E. Mansilla G. 25 May '06

25 May '06

I need to know please, if can I accept connections from sock5 clients in stunnel4.. thnx. Carlos Mansilla

1 0

stunnel + socks v5
by Carlos E. Mansilla G. 25 May '06

25 May '06

I need to know please, if can I accept connections from sock5 clients in stunnel4.. thnx. Carlos Mansilla

1 0

libwrap support
by Happy Manocha 24 May '06

24 May '06

Hello All, Can someone throw some light on libwrap support feature of stunnel? What it is and how it can be used? Thanks in advance. Regds Happy Manocha

1 0

Using a signed *.domain.com with ssl - Getting "unable to get local issuer certificate"
by Pritesh Mehta 24 May '06

24 May '06

Hello all, I have had a good hunt around and am having trouble finding a solution. I am using stunnel to provide encrypted pop3 access to our mail server, and we have recently purchased a signed *.XXX.com certificate from godaddy. This has been great since I can use the same cert on all our servers, and this has worked cleanly with the webservices. However, I am having some issues with the stunnel and pop3 service. I am not entirely certain whether it is caused by the *.XXX.com certificate (although I think it unlikely) but was hoping someone more knowledgeable could enlighten me? I currently have stunnel configured thusly: stunnel -f \ -A /etc/stunnel/certs/sf_issuing.pem \ -p /etc/stunnel/certs/wildcard.XXX.com.stunnel.pem \ -r 127.0.0.1:110 Unfortunately my users are getting warnings, and using the openssl client I get: $ openssl s_client -connect mail.XXX.com:995 CONNECTED(00000003) depth=1 /C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./OU=http://www.starfieldtech.com/repository/CN=Starfield Secure Certification Authority/emailAddress=practices(a)starfieldtech.com verify error:num=20:unable to get local issuer certificate verify return:0 --- Certificate chain 0 s:/O=*.XXX.com/OU=Domain Control Validated/CN=*.XXX.com i:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./OU=http://www.starfieldtech.com/repository/CN=Starfield Secure Certification Authority/emailAddress=practices(a)starfieldtech.com 1 s:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./OU=http://www.starfieldtech.com/repository/CN=Starfield Secure Certification Authority/emailAddress=practices(a)starfieldtech.com i:/L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 2 Policy Validation Authority/CN=http://www.valicert.com//[email protected] --- Server certificate -----BEGIN CERTIFICATE----- [snip] -----END CERTIFICATE----- subject=/O=*.XXX.com/OU=Domain Control Validated/CN=*.XXX.com issuer=/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./OU=http://www.starfieldtech.com/repository/CN=Starfield Secure Certification Authority/emailAddress=practices(a)starfieldtech.com --- No client certificate CA names sent --- SSL handshake has read 2381 bytes and written 340 bytes --- New, TLSv1/SSLv3, Cipher is AES256-SHA Server public key is 1024 bit Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1 Cipher : AES256-SHA Session-ID: 4E550C07BDA9661C4B532A28110E5616549CB9FA72D37E5C979E3C6579F8FB99 Session-ID-ctx: Master-Key: 2E588101AA098463FA40C0353009F5842FA19B1C3D48D9A0000EB2E241EFB70BB10D52FE9BC444344D49653B9FEB25F4 Key-Arg : None Start Time: 1148463445 Timeout : 300 (sec) Verify return code: 20 (unable to get local issuer certificate) --- I am positive this must have been covered before somewhere, but I haven't been able to find anything conclusive. Apologies if I'm covering well trodden ground :) TIA, -- Pritesh Mehta <pmehta(a)gnr.com> Global Name Registry _____________________________________________________ Information contained herein is Global Name Registry Proprietary Information and/or Registry Sensitive Information and is made available to you because of your interest in or affiliation with our company. This information is submitted in confidence and its disclosure to you is not intended to constitute public disclosure or authorization for disclosure to other parties. Should you have received this email and are not an intended recipient, please delete this email in its entirety. Global Name Registry is registered with the Office of the UK Information Commissioner.

1 0

<Stunnel> multiple connection
by aliquippa1 23 May '06

23 May '06

Hello I have problem with stunnel. I want to use feature which I'm not sure if is available. I want to accept connection from a host and then connect to a few hosts. I want to have something like this: accept = xxx.xxx.xxx.xxx:xxxx connect = yyy.yyy.yyy.yyy:yyyy connect = zzz.zzz.zzz.zzz:zzzz connect = vvv.vvv.vvv.vvv:vvv Now I want to get such situation: 1.accept connection from xxx. 2.try to connect to yyy. 3 if it doesn't work try to connect to zzz. 4 if it doesn't work try to connect to vvv. I wonder if it's possible, because if I use stunnel and connect from xxx it connects me only to the first host and when I connect from xxx again it connects me to the second host and after the third trial from xxx it connects me to vvv. Thanx Agnes

1 0

SSL23_GET_CLIENT_HELLO:unknown protocol
by Srilalitha Muralidhara(HCL Capital Market Services) 22 May '06

22 May '06

Hi I am getting SSL23_GET_CLIENT_HELLO:unknown protocol error stunnel. Any guesses about the cause of the problem? Here is the complete log 2006.05.22 07:01:55 LOG5[734:1]: stunnel 4.15 on sparc-sun-solaris2.6 with OpenSSL 0.9.8b 04 May 2006 2006.05.22 07:01:55 LOG5[734:1]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Auth:LIBWRAP 2006.05.22 07:01:55 LOG6[734:1]: file ulimit = 64 (can be changed with 'ulimit -n') 2006.05.22 07:01:55 LOG6[734:1]: poll() used - no FD_SETSIZE limit for file descriptors 2006.05.22 07:01:55 LOG5[734:1]: 29 clients allowed 2006.05.22 07:01:55 LOG7[734:1]: FD 5 in non-blocking mode 2006.05.22 07:01:55 LOG7[734:1]: FD 6 in non-blocking mode 2006.05.22 07:01:55 LOG7[734:1]: FD 7 in non-blocking mode 2006.05.22 07:01:55 LOG7[734:1]: SO_REUSEADDR option set on accept socket 2006.05.22 07:01:55 LOG7[734:1]: rssvr bound to 10.140.42.11:25433 2006.05.22 07:01:55 LOG7[735:1]: Created pid file /home/sri/stunnel/var/lib/stunnel/stunnel.pid 2006.05.22 07:04:09 LOG7[735:1]: rssvr accepted FD=0 from 10.140.42.11:44360 2006.05.22 07:04:09 LOG7[735:4]: rssvr started 2006.05.22 07:04:09 LOG7[735:4]: FD 0 in non-blocking mode 2006.05.22 07:04:09 LOG7[735:4]: TCP_NODELAY option set on local socket 2006.05.22 07:04:09 LOG7[735:4]: FD 1 in non-blocking mode 2006.05.22 07:04:09 LOG7[735:4]: FD 2 in non-blocking mode 2006.05.22 07:04:09 LOG7[735:4]: Connection from 10.140.42.11:44360 permitted by libwrap 2006.05.22 07:04:09 LOG5[735:4]: rssvr connected from 10.140.42.11:44360 2006.05.22 07:04:09 LOG7[735:1]: Cleaning up the signal pipe 2006.05.22 07:04:09 LOG6[735:1]: Child process 938 finished with code 0 2006.05.22 07:04:09 LOG7[735:4]: SSL state (accept): before/accept initialization 2006.05.22 07:04:09 LOG3[735:4]: SSL_accept: 140760FC: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol 2006.05.22 07:04:09 LOG5[735:4]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.05.22 07:04:09 LOG7[735:4]: rssvr finished (0 left) Thanks, Sri Disclaimer: *********** The contents of this E-mail (including the contents of the enclosure(s) or attachment(s) if any) are privileged and confidential material of HCL Capital Market Services and should not be disclosed to, used by or copied in any manner by anyone other than the intended addressee(s). In case you are not the desired addressee, you should delete this message and/or re-direct it to the sender. The views expressed in this E-mail message (including the enclosure(s) or attachment(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of HCL Capital Market Services. This e-mail message including attachment/(s), if any, is believed to be free of any virus. However, it is the responsibility of the recipient to ensure that it is virus free and HCL Capital Market Services is not responsible for any loss or damage arising in any way from its use.

1 0

stunnel-4.15 segfaulting and looping under FreeBSD-CURRENT
by Michael Weiser 17 May '06

17 May '06

Hi, I've run into the problem mentioned in: > Scott Tuc Ellentuch at T-B-O-H ml at t-b-o-h.net > Fri Apr 21 23:45:11 CEST 2006 > Hi, > I just did a portupgrade in FreeBSD from 4.14 to 4.15, and now it > seems to be looping the command that I asked it, instead of just doing > it once. Has there been an option added I need to tell it to just do > once? > Thanks, Tuc I'm running stunnel in client mode. It execs uucico which receives and sends uucp jobs via stdin/stdout. The first call to uucico actually succeeds. It seems like stunnel is segfaulting and then re-exec-ing when it would normally quit. A core file is created in the current directory. But stunnel never quits and indefinitely continues to re-exec itself. Has there been any progress in solving this problem? -- Thanks, Michael

2 3

FW: [stunnel-users] Re: Re:Need a help in installation (Craig)
by Craig 17 May '06

17 May '06

Oops, mailed it directly to Peng :-0, Sorry for that ;-) Re:Need a help in installation (Craig) >Thanks a lot! Craig. I use your method: > ./configure --prefix=/stunnel2 No Problem ;-) >It seems that installation is successful. It successfully generate a >directory ./stunnel2, in which there are six subdirectories: etc lib man >sbin share var That looks right >But when I run stunnel command in the teminal window. It does not take it as >a command. Is it supposed to run stunnel command after the installation or >not? Is there anything missing in the Mac machine before it can run stunnel? If you go to the directory " /stunnel2/sbin " without quotes, do you see 2 files named stunnel and stunnel3? If you see these files, you can execute the stunnel file with something like ./stunnel --help To display the options available to you for the daemon to run. Let me know if there is something else you require ;) Regards, Craig >Thanks >Peng > From: <stunnel-users-request(a)mirt.net> > Reply-To: <stunnel-users(a)mirt.net> > Date: Mon, 15 May 2006 12:00:06 +0200 (CEST) > To: <stunnel-users(a)mirt.net> > Subject: stunnel-users Digest, Vol 22, Issue 12 > > Send stunnel-users mailing list submissions to > stunnel-users(a)mirt.net > > To subscribe or unsubscribe via the World Wide Web, visit > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)mirt.net > > You can reach the person managing the list at > stunnel-users-owner(a)mirt.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. RE: Need a help in installation (Craig) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 15 May 2006 08:15:36 +0200 > From: "Craig" <stunnel(a)rsw.co.za> > Subject: RE: [stunnel-users] Need a help in installation > To: <stunnel-users(a)mirt.net> > Message-ID: > <!&!AAAAAAAAAAAYAAAAAAAAADayToAwUd9AsHeKl2eRVAnCgAAAEAAAALWLI73av7VKpv9V31ec nQ > wBAAAAAA==(a)rsw.co.za> > > Content-Type: text/plain; charset="us-ascii" > > Don't know Mac, but can't u pass a prefix like in Linux to specify another > directory, for example your home directory? > > > > ./configure --prefix=/your/destination/directory > > > > Hope this helps > > > > Craig > > > > _____ > > From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] > On Behalf Of Peng He > Sent: 12 May 2006 11:45 PM > To: stunnel-users(a)mirt.net > Subject: [stunnel-users] Need a help in installation > > > > Hi, > > I want to install Stunnel 4.15 into MAC OS X machine. Somehow I do not have > the right to make any directory in /usr so I can not install Stunnel in > /usr/local. How do I install Stunnel into different directory? > > Thanks > Peng > >

1 0

Re: Re:Need a help in installation (Craig)
by Peng He 16 May '06

16 May '06

Thanks a lot! Craig. I use your method: ./configure --prefix=/stunnel2 It seems that installation is successful. It successfully generate a directory ./stunnel2, in which there are six subdirectories: etc lib man sbin share var But when I run stunnel command in the teminal window. It does not take it as a command. Is it supposed to run stunnel command after the installation or not? Is there anything missing in the Mac machine before it can run stunnel? Thanks Peng > From: <stunnel-users-request(a)mirt.net> > Reply-To: <stunnel-users(a)mirt.net> > Date: Mon, 15 May 2006 12:00:06 +0200 (CEST) > To: <stunnel-users(a)mirt.net> > Subject: stunnel-users Digest, Vol 22, Issue 12 > > Send stunnel-users mailing list submissions to > stunnel-users(a)mirt.net > > To subscribe or unsubscribe via the World Wide Web, visit > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)mirt.net > > You can reach the person managing the list at > stunnel-users-owner(a)mirt.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. RE: Need a help in installation (Craig) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 15 May 2006 08:15:36 +0200 > From: "Craig" <stunnel(a)rsw.co.za> > Subject: RE: [stunnel-users] Need a help in installation > To: <stunnel-users(a)mirt.net> > Message-ID: > <!&!AAAAAAAAAAAYAAAAAAAAADayToAwUd9AsHeKl2eRVAnCgAAAEAAAALWLI73av7VKpv9V31ecnQ > wBAAAAAA==(a)rsw.co.za> > > Content-Type: text/plain; charset="us-ascii" > > Don't know Mac, but can't u pass a prefix like in Linux to specify another > directory, for example your home directory? > > > > ./configure --prefix=/your/destination/directory > > > > Hope this helps > > > > Craig > > > > _____ > > From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] > On Behalf Of Peng He > Sent: 12 May 2006 11:45 PM > To: stunnel-users(a)mirt.net > Subject: [stunnel-users] Need a help in installation > > > > Hi, > > I want to install Stunnel 4.15 into MAC OS X machine. Somehow I do not have > the right to make any directory in /usr so I can not install Stunnel in > /usr/local. How do I install Stunnel into different directory? > > Thanks > Peng > >

1 0

Need a help in installation
by Peng He 15 May '06

15 May '06

Hi, I want to install Stunnel 4.15 into MAC OS X machine. Somehow I do not have the right to make any directory in /usr so I can not install Stunnel in /usr/local. How do I install Stunnel into different directory? Thanks Peng

2 1

SSL2Proxy
by Steve Cohen 12 May '06

12 May '06

Hello all, I'm tyring to get around content based(notHostBased) int*rn*t cen$0ring. (don't want this page to be indexed with that keyword, so please don't wite it in your response). This is what I need to do: Set Browser on client machine to use <proxyX:port>, but I want content to be encrypted. The proxy is trusted(ownedByMe), everything else in between is not, after the proxy everything is trusted. So this would be the setup: SetupA: ClientBroswer <> STunnelOnRemoteServer <> LocalProxyServerOnSameServer(Squid) <> RestOfTheInternet And NOT this: SetupB: Browser<>LocalSTunnel<>RemoteSTunnel<>Proxy<>RestOfTheInternet Because I don't want any special kind of configuration on the client's local machine except for setting the proxy.(I am currently doing this via ssh tunneling) -I have squid running on remote server listening on 3128 and it works -I have stunnel running on remote server listening on 8686 and forwarding to localhost:3128, -I have Firefox set to use <myServer:8686> as proxy But when trying to use it, Firefox says connection reset.... Please tell me why this is happening and what I need to do. Feel free to make any suggestions you want, I won't be annoyed if you tell me something I already know. Thanks.

2 1

certificate unknown - error:14094416
by Ludovic DUFLOT 12 May '06

12 May '06

Hi, I tried to use stunnel to connect in SSL to a LDAP server. But I can't and I've got this error message: certificate unknown The certificate is self-signed. If I use stunnel for establishing connexion with IMAPS server with a self-signed certificate too, all is right but not for LDAP connexion. I searched on the list's archives and with google but I can't find any solution... Help !!! Ludo ps: these are the stunnel.conf and the log: *************************** cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Some debugging stuff useful for troubleshooting debug = 7 ;output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [ldaps] accept = 389 connect = 10.0.0.1:636 verify = 0 [imaps] accept = 143 connect = 10.0.0.2:993 *************************** 2006.05.03 07:52:50 LOG7[4436:5780]: ldaps connecting 10.0.0.1:636 2006.05.03 07:52:50 LOG7[4436:5780]: connect_wait: waiting 10 seconds 2006.05.03 07:52:50 LOG7[4436:5780]: connect_wait: connected 2006.05.03 07:52:50 LOG7[4436:5780]: Remote FD=244 initialized 2006.05.03 07:52:50 LOG7[4436:5780]: TCP_NODELAY option set on remote socket 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): before/connect initialization 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write client hello A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 read server hello A 2006.05.03 07:52:50 LOG5[4436:5780]: VERIFY IGNORE: depth=1, /C=FR/ST=Savoie/L=Chambery/O=Universite de Savoie/OU=DSI/CN=DSI CA/emailAddress=admin(a)univ-savoie.fr 2006.05.03 07:52:50 LOG5[4436:5780]: VERIFY IGNORE: depth=1, /C=FR/ST=Savoie/L=Chambery/O=Universite de Savoie/OU=DSI/CN=DSI CA/emailAddress=admin(a)univ-savoie.fr 2006.05.03 07:52:50 LOG5[4436:5780]: VERIFY IGNORE: depth=1, /C=FR/ST=Savoie/L=Chambery/O=Universite de Savoie/OU=DSI/CN=DSI CA/emailAddress=admin(a)univ-savoie.fr 2006.05.03 07:52:50 LOG5[4436:5780]: VERIFY IGNORE: depth=0, /C=FR/ST=Savoie/L=Chambery/O=Universite de Savoie/OU=DSI/CN=ldap-bourget.univ-savoie.fr 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 read server certificate A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 read server certificate request A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 read server done A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write client certificate A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write client key exchange A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write certificate verify A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write change cipher spec A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write finished A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 flush data 2006.05.03 07:52:50 LOG7[4436:5780]: SSL alert (read): fatal: certificate unknown 2006.05.03 07:52:50 LOG3[4436:5780]: SSL_connect: 14094416: error:14094416:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate unknown 2006.05.03 07:52:50 LOG5[4436:5780]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.05.03 07:52:50 LOG7[4436:5780]: ldaps finished (0 left)

1 0

need HELP!! HELP!! with stunnel compile
by Nadav, Erez 10 May '06

10 May '06

Hi all, Hi all stunnel users. I want to debug and fix some TLS bugs with stunnel. I loaded stunnel 4.14 sources but i failed to compile it with visual studio 6, under windows 2000 environment. 1. Does anybody has the dsp file to be used under VC6++ for proper stunnel compilation ??? 2. Do I need any other libraries beside openssl to link ? I will appreciate any help Regards Erez __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

1 0

RE: [stunnel-users] stunnel use with TLS
by Nadav, Erez 10 May '06

10 May '06

I am using simple tcp/ip connection, which fail on the first hello message -----Original Message----- From: Scott Gifford [mailto:[email protected]] Sent: Wednesday, May 10, 2006 4:46 AM To: Nadav, Erez Cc: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] stunnel use with TLS "Nadav, Erez" <Erez.Nadav(a)verint.com> writes: > > > Hi all, > > > > 1. Can I use stunnel as a client which connects in TLS protocol ? Assuming you mean over a channel that starts of plaintext and is later converted to encryption, the command to start TLS is usually specific to the application protocol. What protocol are you using? For example, SMTP, IMAP, ?... ---Scott. __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

1 0

problems installing stunnel 4.15
by David Arques Perolada 10 May '06

10 May '06

I get the following message after doing "make" /usr/lib/gcc/i586-suse-linux/4.0.2/../../../../i586-suse-linux/bin/ld: cannot find -lwrap collect2: ld returned 1 exit status make[1]: *** [stunnel] Error 1 make[1]: Leaving directory `/root/Stunnel/stunnel-4.15/src' make: *** [all-recursive] Error 1 All help will be welcome Thanks in advance David Arques i Perolada E-Mail : darques(a)uoc.edu

1 0

stunnel use with TLS
by Nadav, Erez 10 May '06

10 May '06

Hi all, 1. Can I use stunnel as a client which connects in TLS protocol ? 2. I am using Stunnel 4.14 in client mode and trying to connect in TLS protocol to certain server. The connection failed with the following log file: 2006.05.03 10:42:52 LOG7[2388:1756]: connect_wait: waiting 10 seconds 2006.05.03 10:42:52 LOG7[2388:1756]: connect_wait: connected 2006.05.03 10:42:52 LOG7[2388:1756]: Remote FD=244 initialized 2006.05.03 10:42:52 LOG7[2388:1756]: TCP_NODELAY option set on remote socket 2006.05.03 10:42:52 LOG7[2388:1756]: SSL state (connect): before/connect initialization 2006.05.03 10:42:52 LOG7[2388:1756]: SSL state (connect): SSLv3 write client hello A 2006.05.03 10:42:52 LOG7[2388:1756]: SSL alert (write): fatal: handshake failure 2006.05.03 10:42:52 LOG3[2388:1756]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number I had tried to configure stunnel configuration file with options = NO_SSLv3, but nothing changed. Did I miss anything ? Can anybody help ? Thanks Nadav Erez R&D Verint Systems Ltd. Phone: +972-9-962-4753 Cell: +972-54-778-4753 Email: erez.nadav(a)verint.com <mailto:[email protected]@verint.com> Web: www.verint.com <http://www.verint.com/> __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

2 1

Installing Stunnel on AIX5.3
by Shinoy 09 May '06

09 May '06

Hi, I want to install Stunnel on AIX 5.3 and configure it. I was trying to find some documentation and also know if it will work on AIX 5.3. Any help is greatly appreciated. --------------------------------- Yahoo! India Answers: Share what you know. Learn something new. Click here Send instant messages to your online friends - NOW

2 1

RE: [stunnel-users] Stunnel configuration
by Moehrke, John (GE Healthcare) 09 May '06

09 May '06

I would further like to ask: Is it true that the proper way to get to TLSv1 is to start with SSLv3? Is there a reference that someone can point me at? John _____ From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Nadav, Erez Sent: Monday, May 08, 2006 11:55 AM To: stunnel-users(a)mirt.net Subject: [stunnel-users] Stunnel configuration Hi all, How can I configure my stunnel client application (windows) with the following parameter : TLSv1only = yes Nadav Erez R&D Verint Systems Ltd. Phone: +972-9-962-4753 Cell: +972-54-778-4753 Email: erez.nadav(a)verint.com <mailto:[email protected]@verint.com> Web: www.verint.com <http://www.verint.com/> ________________________________________________________________________ __________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

1 0

Trying to load stunnel sources
by Nadav, Erez 09 May '06

09 May '06

Hi all, I am a programmer and I want to compile the stunnel for windows application in order to try to fix some non working TLS issues. I having problem when accessing http://www.stunnel.org/download/source.html address. I have the following questions: 1. Where and How can I load all stunnel sources ? 2. How should I compile it on windows machine ? 3. How should I use the mentioned PGP key Thanks Erez __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

1 0

Stunnel configuration
by Nadav, Erez 08 May '06

08 May '06

Hi all, How can I configure my stunnel client application (windows) with the following parameter : TLSv1only = yes Nadav Erez R&D Verint Systems Ltd. Phone: +972-9-962-4753 Cell: +972-54-778-4753 Email: erez.nadav(a)verint.com <mailto:[email protected]@verint.com> Web: www.verint.com <http://www.verint.com/> __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

1 0

client certificate authentication
by Srilalitha Muralidhara(HCL Capital Market Services) 08 May '06

08 May '06

Hi, I am new to stunnel. My application listens on 6 socket ports. External applications either dump data on these socket ports or send requests on these socket ports to receive data. Thus, my application is a server and external applications are clients. We got to authenticate these external applications before accepting the requests/data. So I am planning to use client certificate authentication of stunnel. In this case, should the server have a certificate as well? Will the server be authenticated? Is it necessary for all the external applications to be using the same certificate? Thanks, Sri Disclaimer: *********** The contents of this E-mail (including the contents of the enclosure(s) or attachment(s) if any) are privileged and confidential material of HCL Capital Market Services and should not be disclosed to, used by or copied in any manner by anyone other than the intended addressee(s). In case you are not the desired addressee, you should delete this message and/or re-direct it to the sender. The views expressed in this E-mail message (including the enclosure(s) or attachment(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of HCL Capital Market Services. This e-mail message including attachment/(s), if any, is believed to be free of any virus. However, it is the responsibility of the recipient to ensure that it is virus free and HCL Capital Market Services is not responsible for any loss or damage arising in any way from its use.

1 0

Performance Problems.
by Don Werve 05 May '06

05 May '06

After a fair bit of poking, prodding, and googling, I have yet to find the solution to my problem. So, here goes: stunnel looks to be running slowly. Very slowly. We're starting to analyze it with gprof to see where it spends all of its time when we're trying to do content negotiation, and I've whipped up a quick-and-dirty Ruby script that grabs data from the server and then spits out the performace results; I'm sitting on my own T1, so our connectivity is pretty good. The results with this script are similar with 'delay=yes', 'session=600', and 'compression=zlib'. So, here's what happens when I nab data from our stunnel-ed server with said script (I can supply the script if anyone is interested): #File Size time thrpht time thrprt multiple ---------------------------------------------------------------------- index.html 7k http 0.1548 ( 46k/s) https 0.7449 ( 9k/s) * 4.8131 test1.jpg 1k http 0.0928 ( 12k/s) https 0.6379 ( 1k/s) * 6.8726 test2.jpg 10k http 0.1812 ( 59k/s) https 0.6743 ( 16k/s) * 3.7208 test3.jpg 19k http 0.2236 ( 85k/s) https 0.7677 ( 24k/s) * 3.4338 test4.jpg 53k http 0.5668 ( 94k/s) https 1.1543 ( 46k/s) * 2.0365 test5.jpg 97k http 0.7861 (123k/s) https 2.1974 ( 44k/s) * 2.7954 test6.jpg 214k http 1.4061 (152k/s) https 2.3735 ( 90k/s) * 1.6880 test7.jpg 140k http 0.9434 (149k/s) https 1.9331 ( 72k/s) * 2.0491 test8.jpg 470k http 2.8590 (164k/s) https 3.7696 (124k/s) * 1.3185 ('multiple' is the number of times 'slower' https is versus http). And, here's my stunnel config: *** cert = /etc/certs/combined.pem setuid = nobody setgid = nobody pid = /var/run/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 0 output = /var/log/stunnel [https] local = 64.40.110.16 accept = 443 connect = 64.40.110.16:80 TIMEOUTclose = 0 *** So, any ideas why stunnel is working so slowly? I mean, I know there's the overhead of the SSL negotiation, and I've heard some things about a stunnel session cache, but nothing about enabling/using it (unless 'session = something bigger than zero' does so?). Any suggestions to improve performance, especially for large batches of small transfers? Thanks-in-advance! -- Don Werve <donw(a)iradeon.net> Chief Systems Administrator / Systems Architect

1 0

Using stunnel to add https support to ONE virtual host
by Gonzalo Diethelm 05 May '06

05 May '06

Hello, I have Apache serving plain http pages for several domains running as virtual hosts on one machine (debian). I know SSL will not work with this setup, and I understand the reasons why (at least I think I do). Let's say the virtual hosts are www.server1.com www.server2.com www.server3.com I would like to use stunnel to add https capabilities to ONE of the virtual hosts (say, www.server3.com) In other words, I would like to configure stunnel in server mode with a certificate file, listening on www.server3.com:443, so that if I use a browser to visit https://www.server3.com/ then stunnel will accept the connection and forward all traffic to www.server3.com:80, letting Apache handle it; in particular, this would have to allow Apache to recognize which of the virtual hosts is being visited; I wouldn't like to have www.server1.com respond to my requests instead of www.server3.com. Is this possible? Any caveats, hints, recommendations? Thanks in advance, and best regards, -- Gonzalo Diethelm gonzalo.diethelm(a)aditiva.com

2 1

Using stunnel to add https support to ONE virtual host
by Gonzalo Diethelm 04 May '06

04 May '06

Hello, I have Apache serving plain http pages for several domains running as virtual hosts on one machine (debian). I know SSL will not work with this setup, and I understand the reasons why (at least I think I do). Let's say the virtual hosts are www.server1.com www.server2.com www.server3.com I would like to use stunnel to add https capabilities to ONE of the virtual hosts (say, www.server3.com) In other words, I would like to configure stunnel in server mode with a certificate file, listening on www.server3.com:443, so that if I use a browser to visit https://www.server3.com/ then stunnel will accept the connection and forward all traffic to www.server3.com:80, letting Apache handle it; in particular, this would have to allow Apache to recognize which of the virtual hosts is being visited; I wouldn't like to have www.server1.com respond to my requests instead of www.server3.com. Is this possible? Any caveats, hints, recommendations? Thanks in advance, and best regards, -- Gonzalo Diethelm gonzalo.diethelm(a)aditiva.com

1 0

Re: stunnel 4.15 crashes with vnc server 4.1.1
by Harry Boeck 04 May '06

04 May '06

Hallo stunnel-users, @Michal Trojnara: Thanks for your help, Mike! The solution came overnight when i remembered my own message: > and the screen on the server side should remove the background image > and visual effects). Well: I disabled the desktop modifications in vnc and it runs. Something is incompatible in the stunnel GUI with the removal of global windows GUI behaviour (despite the fact, that i have not a single one of them in use - to the best of my knowledge), what has nothing to do with the dedication of stunnel. Maybe there's a simple GUI message not handled correctly? As this seems to be something common to all windows versions, could this possibly happen in windows xp, too? (I don't use one, so somone would have to investigate this.) It's another motivation to start compiling in cygnus. But unfortunally at this very moment i'm occupied with other tasks. May be some other guy has the fancy to look at this matter... Mit freundlichem Gruß Harry Boeck

1 0

stunnel install issues with mknod command
by Trishul Shah 04 May '06

04 May '06

Hi, I was wondering if you could help me, I am trying to install stunnel on a machine running solaris 10, but the catch is that I am trying to install it within a zone in solaris 10, unfortunately during the installation process after the source is compiled I see the following error: Making install in src test -z "/usr/local/lib" || /bin/bash ../auto/mkinstalldirs "/usr/local/lib" /bin/bash ../libtool --mode=install ../auto/install-sh -c 'libstunnel.la' '/usr/local/lib/libstunnel.la' ../auto/install-sh -c .libs/libstunnel.so /usr/local/lib/libstunnel.so chmod +x /usr/local/lib/libstunnel.so ../auto/install-sh -c .libs/libstunnel.lai /usr/local/lib/libstunnel.la ---------------------------------------------------------------------- Libraries have been installed in: /usr/local/lib If you ever happen to want to link against installed libraries in a given directory, LIBDIR, you must either use libtool, and specify the full pathname of the library, or use the `-LLIBDIR' flag during linking and do at least one of the following: - add LIBDIR to the `LD_LIBRARY_PATH' environment variable during execution - use the `-RLIBDIR' linker flag See any operating system documentation about shared libraries for more information, such as the ld(1) and ld.so(8) manual pages. ---------------------------------------------------------------------- test -z "/usr/local/sbin" || /bin/bash ../auto/mkinstalldirs "/usr/local/sbin" /bin/bash ../libtool --mode=install ../auto/install-sh -c 'stunnel' '/usr/local/sbin/stunnel' ../auto/install-sh -c stunnel /usr/local/sbin/stunnel test -z "/usr/local/sbin" || /bin/bash ../auto/mkinstalldirs "/usr/local/sbin" ../auto/install-sh -c 'stunnel3' '/usr/local/sbin/stunnel3' Making install in doc test -z "/usr/local/share/doc/stunnel" || /bin/bash ../auto/mkinstalldirs "/usr/local/share/doc/stunnel" ../auto/install-sh -c -m 644 'stunnel.html' '/usr/local/share/doc/stunnel/stunnel.html' ../auto/install-sh -c -m 644 'stunnel.pl.html' '/usr/local/share/doc/stunnel/stunnel.pl.html' ../auto/install-sh -c -m 644 'stunnel.fr.html' '/usr/local/share/doc/stunnel/stunnel.fr.html' test -z "/usr/local/man/man8" || /bin/bash ../auto/mkinstalldirs "/usr/local/man/man8" ../auto/install-sh -c -m 644 './stunnel.8' '/usr/local/man/man8/stunnel.8' ../auto/install-sh -c -m 644 './stunnel.pl.8' '/usr/local/man/man8/stunnel.pl.8' ../auto/install-sh -c -m 644 './stunnel.fr.8' '/usr/local/man/man8/stunnel.fr.8' Making install in tools test -z "/usr/local/etc/stunnel" || /bin/bash ../auto/mkinstalldirs "/usr/local/etc/stunnel" ../auto/install-sh -c -m 644 'stunnel.conf-sample' '/usr/local/etc/stunnel/stunnel.conf-sample' if test ! -r /usr/local/etc/stunnel/stunnel.pem; then \ if test -r "/dev/urandom"; then \ dd if="/dev/urandom" of=stunnel.rnd bs=256 count=1; \ RND="-rand stunnel.rnd"; \ else \ RND=""; \ fi; \ /usr/local/bin/openssl req -new -x509 -days 365 -nodes $RND \ -config ./stunnel.cnf \ -out stunnel.pem -keyout stunnel.pem; \ test -eq 0 || /usr/local/bin/openssl gendh $RND 512 >> stunnel.pem; \ /usr/local/bin/openssl x509 -subject -dates -fingerprint -noout -in stunnel.pem; \ ../auto/install-sh -c -m 600 stunnel.pem /usr/local/etc/stunnel/stunnel.pem; \ rm stunnel.pem; \ fi mkdir -p /usr/local/var/stunnel chmod a=rwx,+t /usr/local/var/stunnel if uname | grep SunOS; then \ mkdir -p /usr/local/var/stunnel/dev; \ chmod u=rwx,go=rx /usr/local/var/stunnel/dev; \ mknod /usr/local/var/stunnel/dev/zero c 13 12; \ chmod a=rw /usr/local/var/stunnel/dev/zero; \ fi SunOS mknod: Not owner *** Error code 2 make: Fatal error: Command failed for target `install-data-local' Current working directory /export/home/playtech/stunnel-4.14/tools *** Error code 1 The following command caused the error: make install-exec-am install-data-am make: Fatal error: Command failed for target `install-am' Current working directory /export/home/playtech/stunnel-4.14/tools *** Error code 1 The following command caused the error: failcom='exit 1'; \ for f in x $MAKEFLAGS; do \ case $f in \ *=* | --[!k]*);; \ *k*) failcom='fail=yes';; \ esac; \ done; \ dot_seen=no; \ target=`echo install-recursive | sed s/-recursive//`; \ list='src doc tools'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || eval $failcom; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `install-recursive' After much digging around I have discovered that the mknod command cannot be used within a solaris 10 zone, I have gotten round this previously by installing stunnel from the global zone but that intertwines the parent zone with the child zone and ideally we would like to keep these as independent of each other as possible as we use these zones for 3rs party applications and hence we have a lot of other user traffic on these zones. Thanks in advance for your help. Kind Regards, Trishul Shah Blue Square Tel: 020 7288 7920 Mob: 07789 982 688 Fax: 020 7288 7955

1 0

stunnel 4.15 crashes with vnc server 4.1.1
by Harry Boeck 04 May '06

04 May '06

Hallo stunnel users, i'm learning to use ssl and ssh tools to get secured access to my home server from work and other places. I already have a working ssh installation but stumbled over stunnel ba accident. I would like to use it, because i still have computers in use with win98 (both for myself and among my clients) and this little program is exactly all what i would need to use vnc over a secured connection. SSH to the contrary needs a little bit more setup (over a cygwin that serves the only purpose of aquiring such tools like SSH), needs its own crypto library compilation and so on. Now, there is the problem that stunnel 4.15 crashes at the moment, when the vnc server 4.1.1 tries to deliver its first screen to the client. Stunnel was downloaded from http://www.stunnel.org/download/binaries.html, vnc was downloaded from http://www.realvnc.com (already some times ago). Both where downloaded as binaries, for the typical help hints on forums for the question "i have a compile problem on windows" being "how dare you"... Both machines i'm using for testing use win98 as operating system. The crash happens both when testing a configuration on one machine with stunnel running both as server and as client, as well as when using it to connect two machines with stunnel running as server on the machine with vnc server and as client on the machine with vnc client. VNC runs correct for itself as well as via an ssh secured connection. Stunnel is startet with only the server versus the client configuration file as command line parameter. The configuration files are: http://harryboeck.dyndns.org/Sicherheit/stunnel-server.ini http://harryboeck.dyndns.org/Sicherheit/stunnel-client.ini Stunnel delivers correctly the data between vnc server and client (including connection establishment and authentication) until the point of first screen transfer (when the screen on the client side turns black and the screen on the server side should remove the background image and visual effects). The output of stunnel server and client is: http://harryboeck.dyndns.org/Sicherheit/stunnel-server.log http://harryboeck.dyndns.org/Sicherheit/stunnel-client.log The output of "stunnel -version" is: http://harryboeck.dyndns.org/Sicherheit/stunnel-version.txt I have no clue what '6. Output of "uname -a"' should mean, if that is somehow important for hints, please let me know. openssl version is: OpenSSL 0.9.8a 11 Oct 2005 I would appreciate any suggestions or hints on the interaction of vnc and stunnel. with best regards Harry Boeck

2 1

certificate unknown
by Ludovic DUFLOT 03 May '06

03 May '06

Hi, I tried to use stunnel to connect in SSL to a LDAP server. But I can't and I've got this error message: certificate unknown I use stunnel for establishing connexion with IMAPS server and all is right but not for LDAP connexion. The certificate is self-signate. I searched on the list's archives and with google but I can't find any solution... Help !!! Ludo ps: these are the stunnel.conf and the log: *************************** cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Some debugging stuff useful for troubleshooting debug = 7 ;output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [ldaps] accept = 389 connect = 10.0.0.1:636 verify = 0 [imaps] accept = 143 connect = 10.0.0.2:993 *************************** 2006.05.03 07:52:40 LOG7[4436:2436]: RAND_status claims sufficient entropy for the PRNG 2006.05.03 07:52:40 LOG6[4436:2436]: PRNG seeded successfully 2006.05.03 07:52:40 LOG7[4436:2436]: Certificate: stunnel.pem 2006.05.03 07:52:40 LOG7[4436:2436]: Key file: stunnel.pem 2006.05.03 07:52:40 LOG7[4436:2436]: SSL context initialized for service ldaps 2006.05.03 07:52:40 LOG7[4436:2436]: Certificate: stunnel.pem 2006.05.03 07:52:40 LOG7[4436:2436]: Key file: stunnel.pem 2006.05.03 07:52:40 LOG7[4436:2436]: SSL context initialized for service imaps 2006.05.03 07:52:40 LOG7[4436:2436]: Certificate: stunnel.pem 2006.05.03 07:52:40 LOG7[4436:2436]: Key file: stunnel.pem 2006.05.03 07:52:40 LOG7[4436:2436]: SSL context initialized for service https 2006.05.03 07:52:40 LOG5[4436:2436]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7f 22 Mar 2005 2006.05.03 07:52:40 LOG5[4436:2436]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.05.03 07:52:40 LOG5[4436:4612]: No limit detected for the number of clients 2006.05.03 07:52:40 LOG7[4436:4612]: FD 192 in non-blocking mode 2006.05.03 07:52:40 LOG7[4436:4612]: SO_REUSEADDR option set on accept socket 2006.05.03 07:52:40 LOG7[4436:4612]: ldaps bound to 0.0.0.0:389 2006.05.03 07:52:40 LOG7[4436:4612]: FD 196 in non-blocking mode 2006.05.03 07:52:40 LOG7[4436:4612]: SO_REUSEADDR option set on accept socket 2006.05.03 07:52:40 LOG7[4436:4612]: imaps bound to 0.0.0.0:143 2006.05.03 07:52:40 LOG7[4436:4612]: FD 212 in non-blocking mode 2006.05.03 07:52:40 LOG7[4436:4612]: SO_REUSEADDR option set on accept socket 2006.05.03 07:52:40 LOG7[4436:4612]: https bound to 0.0.0.0:443 2006.05.03 07:52:50 LOG7[4436:4612]: ldaps accepted FD=220 from 127.0.0.1:2893 2006.05.03 07:52:50 LOG7[4436:4612]: Creating a new thread 2006.05.03 07:52:50 LOG7[4436:4612]: New thread created 2006.05.03 07:52:50 LOG7[4436:5780]: ldaps started 2006.05.03 07:52:50 LOG7[4436:5780]: FD 220 in non-blocking mode 2006.05.03 07:52:50 LOG7[4436:5780]: TCP_NODELAY option set on local socket 2006.05.03 07:52:50 LOG5[4436:5780]: ldaps connected from 127.0.0.1:2893 2006.05.03 07:52:50 LOG7[4436:5780]: FD 244 in non-blocking mode 2006.05.03 07:52:50 LOG7[4436:5780]: ldaps connecting 10.0.0.1:636 2006.05.03 07:52:50 LOG7[4436:5780]: connect_wait: waiting 10 seconds 2006.05.03 07:52:50 LOG7[4436:5780]: connect_wait: connected 2006.05.03 07:52:50 LOG7[4436:5780]: Remote FD=244 initialized 2006.05.03 07:52:50 LOG7[4436:5780]: TCP_NODELAY option set on remote socket 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): before/connect initialization 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write client hello A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 read server hello A 2006.05.03 07:52:50 LOG5[4436:5780]: VERIFY IGNORE: depth=1, /C=FR/ST=Savoie/L=Chambery/O=Universite de Savoie/OU=DSI/CN=DSI CA/emailAddress=admin(a)univ-savoie.fr 2006.05.03 07:52:50 LOG5[4436:5780]: VERIFY IGNORE: depth=1, /C=FR/ST=Savoie/L=Chambery/O=Universite de Savoie/OU=DSI/CN=DSI CA/emailAddress=admin(a)univ-savoie.fr 2006.05.03 07:52:50 LOG5[4436:5780]: VERIFY IGNORE: depth=1, /C=FR/ST=Savoie/L=Chambery/O=Universite de Savoie/OU=DSI/CN=DSI CA/emailAddress=admin(a)univ-savoie.fr 2006.05.03 07:52:50 LOG5[4436:5780]: VERIFY IGNORE: depth=0, /C=FR/ST=Savoie/L=Chambery/O=Universite de Savoie/OU=DSI/CN=ldap-bourget.univ-savoie.fr 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 read server certificate A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 read server certificate request A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 read server done A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write client certificate A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write client key exchange A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write certificate verify A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write change cipher spec A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write finished A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 flush data 2006.05.03 07:52:50 LOG7[4436:5780]: SSL alert (read): fatal: certificate unknown 2006.05.03 07:52:50 LOG3[4436:5780]: SSL_connect: 14094416: error:14094416:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate unknown 2006.05.03 07:52:50 LOG5[4436:5780]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.05.03 07:52:50 LOG7[4436:5780]: ldaps finished (0 left)

1 0

Wrapping interclient connections outbound to many servers
by Matthew Case 02 May '06

02 May '06

Hello all, I have searched high and low for a solution to this problem, but I haven't found anything so I am coming here in hopes someone will be able to help me. I have to wrap the interclient protocol (>1024 to 3060) in some manner of encryption to appease one of my clients. I have already wrapped the ajp13 protocol between the apache server and the tomcat server, but now the tomcat server (which acts as an stunnel server in the ajp13 setup) must also act as a client and wrap all outbound and return traffic to 10 servers to and from port 3060. Making large modifications to the source code is not going to be feasible given my current time crunch (it must be implemented in two weeks). Has anyone run into anything like this and does anyone have any tips? Thanks in advance! - Matt

1 0

Stunnel + Snort + MySQL
by Steven 02 May '06

02 May '06

I have a problem that I have been unsuccessful in solve thus far with Stunnel, Snort, and MySQL. Stunnel (client & server): 4.04 Snort: 2.4.4 on the client MySQL Ver 11.18 Distrib 3.23.58, for redhat-linux-gnu (i386) [not the latest and greatest by any means] I setup stunnel so that traffic destined for localhost 3306 (mysql) on the client goes to port 3307 on the server. Stunnel on the server is setup to take traffic from 3307 and send it to 3306 locally. This connection works fine. I can fire up Snort and have events properly log to my snort database on the server from the client. However, if stunnel is stopped/restarted on either the client or the server Snort is not able to keep writing to the database unless it is restarted. I just get this error: May 2 12:44:03 box snort[44126]: database: Problem inserting a new signature 'Test Snort Signature' May 2 12:44:03 box1 snort[44126]: database: mysql_error: MySQL server has gone away SQL=INSERT INTO event (sid,cid,signature,timestamp) VALUES ('4', '22', '0', '2006-05-02 16:44:03.322') May 2 12:44:03 box snort[44126]: database: mysql_error: MySQL server has gone away SQL=ROLLBACK Whenever I close stunnel it sends traffic to the other end. I can restart it and open up new connections just fine. However, Snort will not even try and connect to port 3306. Once stunnel has been stopped (or even restarted) it just immediately fails to even try and connect to the port. It seems there's some kind of signal sent that kills the connection (and all future connections?). I cannot figure oout why this happens. Any ideas? Thanks Steven

1 0

stunnel broken?
by Smith, Brian C1 (N-ASGARD AVIONICS) 28 Apr '06

28 Apr '06

does anyone know what this error message means and how to fix it? SSL_read (SSL_ERROR_SYSCALL): Operation would block (246) Brian Smith brian.c1.smith(a)lmco.com

1 0

SSL_read (SSL_ERROR_SYSCALL): Operation would block (246)
by Smith, Brian C1 (N-ASGARD AVIONICS) 26 Apr '06

26 Apr '06

Hello all, I am having a problem using stunnel to connect web application in java to a UniData Database server. The setup is working fine, traffic passes over the tunnel from webserver to database without a problem except when a large query is sent over the tunnel. Normal queries get responses no problem. I am running HP-UX 11.00. Stunnel is running in daemon mode on both servers. Any ideas why this might happen? Is there a buffer limit or something for stunnel? Thanks in advance! Here's the stunnel.conf files for them: database side: ------------------------------------------------------ RNDfile=/opt/hpws/apache/stunnel/.stunnel.rnd pid = /opt/hpws/apache/logs/stunnel.pid debug = 7 output = /opt/hpws/apache/logs/stunnel.log client = no foreground = no [unidata] accept = 5555 connect = 127.0.0.1:31438 ------------------------------------------------------ webserver side: ------------------------------------------------------ RNDfile=/opt/hpws/apache/stunnel/.stunnel.rnd pid = /opt/hpws/apache/logs/stunnel.pid debug = 7 output = /opt/hpws/apache/logs/stunnel.log client = yes foreground = no [unidata] accept = 127.0.0.1:5555 connect = dbserver:5555 ------------------------------------------------------ Here is my stunnel -version output: ------------------------------------------------------ stunnel 4.04 on hppa2.0w-hp-hpux11.00 PTHREAD with OpenSSL 0.9.7g 11 Apr 2005 Global options cert = /opt/hpws/apache/stunnel/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /opt/hpws/apache/stunnel/etc/stunnel/stunnel.pem pid = /opt/hpws/apache/stunnel/var/run/stunnel.pid RNDbytes = 64 RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTidle = 43200 seconds ------------------------------------------------------ Here is the error from the client: ------------------------------------------------------ 2006.04.26 10:47:11 LOG7[1862:1]: unidata accepted FD=0 from 127.0.0.1:49644 2006.04.26 10:47:11 LOG7[1862:1]: FD 0 in non-blocking mode 2006.04.26 10:47:11 LOG7[1862:8]: unidata started 2006.04.26 10:47:11 LOG5[1862:8]: unidata connected from 127.0.0.1:49644 2006.04.26 10:47:11 LOG7[1862:8]: FD 1 in non-blocking mode 2006.04.26 10:47:11 LOG7[1862:8]: unidata connecting 141.240.76.34:5555 2006.04.26 10:47:11 LOG7[1862:8]: remote connect #1: EINPROGRESS: retrying 2006.04.26 10:47:11 LOG7[1862:8]: waitforsocket: FD=1, DIR=write 2006.04.26 10:47:11 LOG7[1862:8]: waitforsocket: ok 2006.04.26 10:47:11 LOG7[1862:8]: Remote FD=1 initialized 2006.04.26 10:47:11 LOG7[1862:8]: SSL state (connect): before/connect initialization 2006.04.26 10:47:11 LOG7[1862:8]: SSL state (connect): SSLv3 write client hello A 2006.04.26 10:47:11 LOG7[1862:8]: SSL state (connect): SSLv3 read server hello A 2006.04.26 10:47:11 LOG7[1862:8]: SSL state (connect): SSLv3 read server certificate A 2006.04.26 10:47:11 LOG7[1862:8]: SSL state (connect): SSLv3 read server done A 2006.04.26 10:47:11 LOG7[1862:8]: SSL state (connect): SSLv3 write client key exchange A 2006.04.26 10:47:11 LOG7[1862:8]: SSL state (connect): SSLv3 write change cipher spec A 2006.04.26 10:47:11 LOG7[1862:8]: SSL state (connect): SSLv3 write finished A 2006.04.26 10:47:11 LOG7[1862:8]: SSL state (connect): SSLv3 flush data 2006.04.26 10:47:11 LOG7[1862:8]: SSL state (connect): SSLv3 read finished A 2006.04.26 10:47:11 LOG7[1862:8]: 3 items in the session cache 2006.04.26 10:47:11 LOG7[1862:8]: 7 client connects (SSL_connect()) 2006.04.26 10:47:11 LOG7[1862:8]: 7 client connects that finished 2006.04.26 10:47:11 LOG7[1862:8]: 0 client renegotiatations requested 2006.04.26 10:47:11 LOG7[1862:8]: 0 server connects (SSL_accept()) 2006.04.26 10:47:11 LOG7[1862:8]: 0 server connects that finished 2006.04.26 10:47:11 LOG7[1862:8]: 0 server renegotiatiations requested 2006.04.26 10:47:11 LOG7[1862:8]: 4 session cache hits 2006.04.26 10:47:11 LOG7[1862:8]: 0 session cache misses 2006.04.26 10:47:11 LOG7[1862:8]: 0 session cache timeouts 2006.04.26 10:47:11 LOG6[1862:8]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2006.04.26 10:47:12 LOG3[1862:8]: SSL_read (SSL_ERROR_SYSCALL): Operation would block (246) 2006.04.26 10:47:12 LOG5[1862:8]: Connection reset: 744 bytes sent to SSL, 539 bytes sent to socket 2006.04.26 10:47:12 LOG7[1862:8]: unidata finished (0 left) --------------------------------------------------------- Here is the error from the server: --------------------------------------------------------- 2006.04.26 10:48:24 LOG7[18850:1]: unidata accepted FD=0 from 141.240.76.29:49645 2006.04.26 10:48:24 LOG7[18850:1]: FD 0 in non-blocking mode 2006.04.26 10:48:24 LOG7[18850:6]: unidata started 2006.04.26 10:48:24 LOG5[18850:6]: unidata connected from 141.240.76.29:49645 2006.04.26 10:48:24 LOG7[18850:6]: SSL state (accept): before/accept initialization 2006.04.26 10:48:24 LOG7[18850:6]: SSL state (accept): SSLv3 read client hello A 2006.04.26 10:48:24 LOG7[18850:6]: SSL state (accept): SSLv3 write server hello A 2006.04.26 10:48:24 LOG7[18850:6]: SSL state (accept): SSLv3 write certificate A 2006.04.26 10:48:24 LOG7[18850:6]: SSL state (accept): SSLv3 write server done A 2006.04.26 10:48:24 LOG7[18850:6]: SSL state (accept): SSLv3 flush data 2006.04.26 10:48:24 LOG7[18850:6]: SSL state (accept): SSLv3 read client key exchange A 2006.04.26 10:48:24 LOG7[18850:6]: SSL state (accept): SSLv3 read finished A 2006.04.26 10:48:24 LOG7[18850:6]: SSL state (accept): SSLv3 write change cipher spec A 2006.04.26 10:48:24 LOG7[18850:6]: SSL state (accept): SSLv3 write finished A 2006.04.26 10:48:24 LOG7[18850:6]: SSL state (accept): SSLv3 flush data 2006.04.26 10:48:24 LOG7[18850:6]: 1 items in the session cache 2006.04.26 10:48:24 LOG7[18850:6]: 0 client connects (SSL_connect()) 2006.04.26 10:48:24 LOG7[18850:6]: 0 client connects that finished 2006.04.26 10:48:24 LOG7[18850:6]: 0 client renegotiatations requested 2006.04.26 10:48:24 LOG7[18850:6]: 5 server connects (SSL_accept()) 2006.04.26 10:48:24 LOG7[18850:6]: 5 server connects that finished 2006.04.26 10:48:24 LOG7[18850:6]: 0 server renegotiatiations requested 2006.04.26 10:48:24 LOG7[18850:6]: 3 session cache hits 2006.04.26 10:48:24 LOG7[18850:6]: 1 session cache misses 2006.04.26 10:48:24 LOG7[18850:6]: 1 session cache timeouts 2006.04.26 10:48:24 LOG6[18850:6]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2006.04.26 10:48:24 LOG7[18850:6]: FD 1 in non-blocking mode 2006.04.26 10:48:24 LOG7[18850:6]: unidata connecting 127.0.0.1:31438 2006.04.26 10:48:24 LOG7[18850:6]: Remote FD=1 initialized 2006.04.26 10:48:25 LOG3[18850:6]: SSL_read (SSL_ERROR_SYSCALL): Connection reset by peer (232) 2006.04.26 10:48:25 LOG5[18850:6]: Connection reset: 9477 bytes sent to SSL, 744 bytes sent to socket 2006.04.26 10:48:25 LOG7[18850:6]: unidata finished (0 left) ---------------------------------------------------------- Brian Smith brian.c1.smith(a)lmco.com

1 0

NSIS Installer Script
by Ryan O'Horo 25 Apr '06

25 Apr '06

I'm looking to distribute stunnel for Windows in such a manner that stunnel installs with a client certificate already configured. Is the original NSIS installer script available for use? Ryan O'Horo

2 1

New behaviour under 4.15?
by Scott Tuc Ellentuch＠T-B-O-H 24 Apr '06

24 Apr '06

Hi, I just did a portupgrade in FreeBSD from 4.14 to 4.15, and now it seems to be looping the command that I asked it, instead of just doing it once. Has there been an option added I need to tell it to just do once? Thanks, Tuc

3 2

too many file descriptors
by Sligar, Benjamin 22 Apr '06

22 Apr '06

I'm working on upgrading from stunnel 4.04 to the 4.15 to utilize the per port specification of a certificate. On my initial testing, I ran with only a few ports, specified the different certs, and, everything seems to work fine. I'm ran into a problem, though, when trying to use the same config file in regards to the number of configured ports. I have 104 inbound ports setup, and, when it hits the 69th configured port, I get the following message for this, and every port that follows: s_poll_add failed for FD=69: too many file descriptors I checked the code, and, this is what I found: #define MAX_FD 64 I didn't find a relation to any configurable options, so I made a change to this parameter in the code, recompiled, and, I was able to start up all of my listens without error. I just wanted to pass this along, and, if it does tie into a configurable parameter, my apologies for not finding it....if someone knows it, please pass that on. Thanks! **************************************** Benjamin Sligar Senior Development Support Specialist Transaction Network Services, Inc P: 703.453.8324 F: 703.453.8391 AIM: dagdromer88 **************************************** This e-mail message is for the sole use of the intended recipient(s) and may contain confidential and privileged information of Transaction Network Services. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

2 1

Stunnel with TPM engine !!!
by dinesh.kallath＠bt.com 19 Apr '06

19 Apr '06

Hello I am new to Stunnel and would like to know how to integrate the engine with Stunnel 4.15. I am trying to integrate a Trusted Platform Module (TPM) engine which is compatible with OpenSSL to use with Stunnel so that the private key for SSL connection can be retrieved and stored in the hardware. I was able to configure the Stunnel config file to use the engine and it is loading the engine fine. The problem I am facing now is the key which stunnel tries to load can be loaded only by the engine, I mean it has to be loaded into the TPM to use it and stunnel tried to load it in the normal way. Please find the debug output bellow, # ./stunnel stunnel-engine.conf 2006.04.19 13:39:22 LOG7[1261:3086812864]: Enabling support for engine 'tpm' DEBUG e_tpm_err.c:295 ERR_load_TPM_strings DEBUG e_tpm_err.c:298 TPM_lib_error_code is 136 2006.04.19 13:39:22 LOG7[1261:3086812864]: Initializing engine DEBUG e_tpm.c:336 tpm_engine_init LOG_DEBUG TSPI ../tcsd_api/clntside.c:58 Sending TSP packet to host localhost. LOG_DEBUG TSPI ../tcsd_api/clntside.c:74 Connecting to 127.0.0.1 LOG_DEBUG TSPI ../tcsd_api/tcstp.c:390 TCS_OpenContext_RPC_TP: Received TCS Context: 0xa0ef791d 2006.04.19 13:39:22 LOG7[1261:3086812864]: Engine initialized 2006.04.19 13:39:22 LOG7[1261:3086812864]: Engine closed 2006.04.19 13:39:22 LOG7[1261:3086812864]: Snagged 64 random bytes from /root/.rnd DEBUG e_tpm.c:1151 tpm_rand_bytes getting 1024 bytes LOG_DEBUG TSPI ../tcsd_api/tcstp.c:2488 TCSP_GetRandom_TP: TCS Context: 0xa0ef791d 2006.04.19 13:39:23 LOG7[1261:3086812864]: Wrote 1024 new random bytes to /root/.rnd DEBUG e_tpm.c:1171 tpm_rand_status 2006.04.19 13:39:23 LOG7[1261:3086812864]: RAND_status claims sufficient entropy for the PRNG 2006.04.19 13:39:23 LOG6[1261:3086812864]: PRNG seeded successfully DEBUG e_tpm.c:736 tpm_rsa_init 2006.04.19 13:39:23 LOG7[1261:3086812864]: Certificate: /root/dk/CVS/070406/applications/openssl_tpm_engine/TpmKey.crt 2006.04.19 13:39:23 LOG7[1261:3086812864]: Key file: /root/dk/CVS/070406/applications/openssl_tpm_engine/TpmKey.key 2006.04.19 13:39:23 LOG3[1261:3086812864]: error stack: 140B3009 : error:140B3009:SSL routines:SSL_CTX_use_RSAPrivateKey_file:PEM lib 2006.04.19 13:39:23 LOG3[1261:3086812864]: SSL_CTX_use_RSAPrivateKey_file: 906D06C: error:0906D06C:PEM routines:PEM_read_bio:no start line It is obvious from the debug that the Stunnel expect a private key file in PEM format but the whole issue is that the private key I have (created using TPM) is not in a PEM format, it is an encrypted file with root key used to encrypt stays inside the TPM hardware. I suppose we need to provide a key load function which loads the key into the TPM rather than using Stunnel. It will be a great help if someone could provide me with some pointers on how to solve this, or please let me know if I am missing out something. Also do ask me if you need any further clarifications. Many thanks, Dinesh Kallath, CISSP Research Professional, Security Research Centre BT Group Chief Technology Office ___________________________ Tel : +44 (0) 1473 643476 Fax : +44 (0) 1473 646886 Mob: +44 (0) 7952144553 Email: dinesh.kallath(a)bt.com Post : PP:2A, B28, Adastral Park, Ipswich IP5 3RE. British Telecommunications plc Registered office: 81 Newgate Street London EC1A 7AJ Registered in England no. 1800000 This electronic message contains information from British Telecommunications plc which may be privileged or confidential. The information is intended to be for the use of the individual(s) or entity named above. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by telephone or email (to the numbers or address above) immediately. Activity and use of the British Telecommunications plc email system is monitored to secure its effective operation and for other lawful business purposes. Communications using this system will also be monitored and may be recorded to secure effective operation and for other lawful business purposes.

1 0

stunnel-4.15 doesn't work on Mac OS X 10.4.6
by SUENAGA Hiroki 18 Apr '06

18 Apr '06

Dear all, I found a problem that the stunnel-4.15 doesn't work on the Mac OS X 10.4.6. I think this is a BUG. My environment is: - OS: Mac OS X 10.4.6/Intel - Compiler: gcc 4.0.1 (from XCode 2.2) - OpenSSL: 0.9.7i (Mac OS X original version) - Usage: connect to the submission port. The detail of BUG is the following: In protocol.c::smtp_client() line 138, fdputline() called with argument line = "EHLO localhost." This is a string literal. 130 static void smtp_client(CLI *c) { ... 138 fdputline(c, c->remote_fd.fd, "EHLO localhost"); ... In network.c::fdputline() line 565, the literal is passed to 1st argument of safeconcat(). 556 void fdputline(CLI *c, int fd, char *line) { .... 565 safeconcat(line, crlf); ... In common.h line 311, safeconcat() is #define'ed as: 311 #define safeconcat(dst, src) \ 312 (dst[STRLEN-1]='\0', strncat((dst), (src), \ STRLEN-strlen(dst)-1)) This means the macro safeconcat() write to string literal. This is the BUG. In Mac OS X envoronment, string literal is NOT writable. So protection fault occurs at this code. On the other environment, this breaks somewhere in the heap or in the stack. This may also cause a crash. In stunnel-4.14, fdprintf() is used instead of fdputline(). fdprint() have own writable buffers on stack, and the string literal is copied to the stack. This works fine. The work around is using own writable buffers in fdputline() like fdprint() in stunnel-4.14. But it seems to be a performance tuning why fdputline() is used. So I don't know what is the correct way to fix this BUG.... I hope this BUG is fixed in the future release. If this was already reported, please ignore this mail. Thank you. Rgards, ---------- Internet Initiative Japan Inc. Research & Development Section, Product Development Division, SEIL Business Unit SUENAGA Hiroki <hsuenaga(a)iij.ad.jp>

2 2

STunnel and the MAC
by Bryan Bearden 15 Apr '06

15 Apr '06

I am working on setting up a mac server and having trouble getting the stunnel to work on the mac. I installed Darwin Ports and am running it under there. It appears to be running and my stunnel.conf file appears to be correct, but I cannot get it to use stunnel. Any ideas? I'm trying to connect to MySQL 4. thanks... Bryan

1 0