- stunnel-users - stunnel.org

Stunnel with a enterprise proxy server
by Vandooren, Pascal 16 Nov '09

16 Nov '09

Hello, I have a problem ... on my network i have more than one proxy server, and y use Stunnel for a remote RDP. if my computer is directly connected to internet there is no problem. If i connect my computer on my domain with my proxies servers i'm not able to connect me on RDP to my remote RDP server. Is it possible to indicate my proxy server to user ? Kind regards PascalV --------------------------------------------------------------------------- This e-mail is confidential. If you are not the addressee or an authorized recipient of this message, any distribution, copying, publication or use of this information for any purpose is prohibited. Please notify the sender immediately by e-mail and then delete this message. Ce message est confidentiel. Si vous n'etes pas le destinataire designe de ce message ou une personne autorisee a l'utiliser, toute distribution, copie, publication ou usage a quelques fins que ce soit des informations contenues dans ce message sont interdits. Merci d'informer immediatement l'expediteur par messagerie electronique et d'ensuite detruire ce message. ---------------------------------------------------------------------------

1 0

Error installing Stunnel-4.28
by th＠ftlabs.com 13 Nov '09

13 Nov '09

I could not get Stunnel-4.27 to work as described in a previous post on Mon Nov 9 17:12:38 CET 2009 to which nobody responded. So I tried installing the latest version, Stunnel-4.28, and received the following error when running the 'make' command... options.c: In function ‘service_options’: options.c:1139: error: ‘SSL_OP_NO_TICKET’ undeclared (first use in this function) options.c:1139: error: (Each undeclared identifier is reported only once options.c:1139: error: for each function it appears in.) options.c: In function ‘parse_ssl_option’: options.c:1709: error: ‘SSL_OP_NO_TICKET’ undeclared (first use in this function) make[1]: *** [options.o] Error 1 make[1]: Leaving directory `/tmp/stunnel-4.28/src' make: *** [all-recursive] Error 1 The output for 'openssl version' is: OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 Can anyone help me with either problems please?

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 64, Issue 8
by Michael Wilson 12 Nov '09

12 Nov '09

Thanks Ludholf, Re Q2 - Solved. Re Q1 - Thanks, but I should have been clearer, I wanted an automated solution. My nightly Blat e-mails come from a command line .cmd file. I have recently added a javascript to check if stunnel is active and, if not, start it before my e-mails. Now I would like to create a similar script that, if stunnel is running, stops it after my e-mail. I may just have to use Windows Script Host's Terminate. Mike On Thu, Nov 12, 2009 at 6:00 AM, <stunnel-users-request(a)mirt.net> wrote: > Send stunnel-users mailing list submissions to > stunnel-users(a)mirt.net > > To subscribe or unsubscribe via the World Wide Web, visit > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)mirt.net > > You can reach the person managing the list at > stunnel-users-owner(a)mirt.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. Vista questions (Michael Wilson) > 2. Re: Vista questions (Ludolf Holzheid) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 11 Nov 2009 13:22:53 -0500 > From: Michael Wilson <michael.r.wilson(a)gmail.com> > Subject: [stunnel-users] Vista questions > To: stunnel-users(a)mirt.net > Message-ID: > <6d39888c0911111022r39c898c5je24d6808075bc0ba(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > I am running 4.27 on Vista and can successfully start it and use Blat > to e-mail via my gmail account using stunnel. > > However, I have two questions: > > Q1: I would like to close down stunnel after sending my e-mails. How > can I do that on Vista? > > Q2: Why do I get the following when I enter "stunnel -help" at the command line > > A window with the heading "Stunnel 4.27 on Win32 (not configured)" that says: > Stunnel server is down due to an error. > You will need to exit and correct the problem > Click OK to see the error log window > > The error log is: > > Global options > compression = zlib|rle compression type > debug = [facility].level (e.g. daemon.info) > EGD = path to Entropy Gathering Daemon socket > engine = auto|engine_id > engineCtrl = cmd[:arg] > output = file to append log messages > RNDbytes = bytes to read from random seed files > RNDfile = path to file with random seed data > RNDoverwrite = yes|no overwrite seed datafiles with new random data > service = service name > socket = a|l|r:option=value[:value] > set an option on accept/local/remote socket > taskbar = yes|no enable the taskbar icon > > Service-level options > accept = [host:]port accept connections on specified host:port > CApath = CA certificate directory for 'verify' option > CAfile = CA certificate file for 'verify' option > cert = certificate chain > ciphers = list of permitted SSL ciphers > client = yes|no client mode (remote service uses SSL) > connect = [host:]port connect remote host:port > CRLpath = CRL directory > CRLfile = CRL file > delay = yes|no delay DNS lookup for 'connect' option > engineNum = number of engine to read the key from > failover = rr|prio chose failover strategy > ident = username for IDENT (RFC 1413) checking > key = certificate private key > local = IP address to be used as source for remote connections > ocsp = OCSP server URL > OCSPflag = OCSP server flags > options = SSL option > set an SSL option > protocol = protocol to negotiate before SSL initialization > currently supported: cifs, connect, nntp, pop3, smtp > protocolAuthentication = authentication type for protocol negotiations > protocolHost = host:port for protocol negotiations > protocolPassword = password for protocol negotiations > protocolUsername = username for protocol negotiations > session = session cache timeout (in seconds) > stack = thread stack size (in bytes) > sslVersion = all|SSLv2|SSLv3|TLSv1 SSL method > TIMEOUTbusy = seconds to wait for expected data > TIMEOUTclose = seconds to wait for close_notify (set to 0 for buggy MSIE) > TIMEOUTconnect = seconds to connect remote host > TIMEOUTidle = seconds to keep an idle connection > verify = level of peer certificate verification > level 1 - verify peer certificate if present > level 2 - require valid peer certificate always > level 3 - verify peer with locally installed certificate > > 2009.11.11 13:03:36 LOG3[5440:5128]: Server is down > > > ------------------------------ > > Message: 2 > Date: Wed, 11 Nov 2009 20:06:20 +0100 > From: Ludolf Holzheid <lholzheid(a)bihl-wiedemann.de> > Subject: Re: [stunnel-users] Vista questions > To: stunnel-users(a)mirt.net > Message-ID: <20091111190620.GD29581(a)svr5.bihl-wiedemann.de> > Content-Type: text/plain; charset=iso-8859-1 > > On Wed, 2009-11-11 13:22:53 -0500, Michael Wilson wrote: >> I am running 4.27 on Vista and can successfully start it and use Blat >> to e-mail via my gmail account using stunnel. >> >> However, I have two questions: >> >> Q1: I would like to close down stunnel after sending my e-mails. How >> can I do that on Vista? > > Michael, > > did you try to right-click on the stunnel icon in the systray and select "Exit"? > >> Q2: Why do I get the following when I enter "stunnel -help" at the command line > > This is stunnel's way to output the help message (or other messages) > on windows. > > If stunnel used stdio for messages, you would have seen the help > message in the command prompt window you entered "stunnel -help" > in. However, there isn't necessarily a command prompt window stunnel > is attached to. Imagine to invoke "stunnel -help" via [start]->[run]. > > Ludolf > > -- > > --------------------------------------------------------------- > Ludolf Holzheid Tel: +49 621 339960 > Bihl+Wiedemann GmbH Fax: +49 621 3392239 > Flo?w?rthstra?e 41 e-mail: lholzheid(a)bihl-wiedemann.de > D-68199 Mannheim, Germany > --------------------------------------------------------------- > > > > ------------------------------ > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > End of stunnel-users Digest, Vol 64, Issue 8 > ******************************************** >

2 1

Vista questions
by Michael Wilson 11 Nov '09

11 Nov '09

I am running 4.27 on Vista and can successfully start it and use Blat to e-mail via my gmail account using stunnel. However, I have two questions: Q1: I would like to close down stunnel after sending my e-mails. How can I do that on Vista? Q2: Why do I get the following when I enter "stunnel -help" at the command line A window with the heading "Stunnel 4.27 on Win32 (not configured)" that says: Stunnel server is down due to an error. You will need to exit and correct the problem Click OK to see the error log window The error log is: Global options compression = zlib|rle compression type debug = [facility].level (e.g. daemon.info) EGD = path to Entropy Gathering Daemon socket engine = auto|engine_id engineCtrl = cmd[:arg] output = file to append log messages RNDbytes = bytes to read from random seed files RNDfile = path to file with random seed data RNDoverwrite = yes|no overwrite seed datafiles with new random data service = service name socket = a|l|r:option=value[:value] set an option on accept/local/remote socket taskbar = yes|no enable the taskbar icon Service-level options accept = [host:]port accept connections on specified host:port CApath = CA certificate directory for 'verify' option CAfile = CA certificate file for 'verify' option cert = certificate chain ciphers = list of permitted SSL ciphers client = yes|no client mode (remote service uses SSL) connect = [host:]port connect remote host:port CRLpath = CRL directory CRLfile = CRL file delay = yes|no delay DNS lookup for 'connect' option engineNum = number of engine to read the key from failover = rr|prio chose failover strategy ident = username for IDENT (RFC 1413) checking key = certificate private key local = IP address to be used as source for remote connections ocsp = OCSP server URL OCSPflag = OCSP server flags options = SSL option set an SSL option protocol = protocol to negotiate before SSL initialization currently supported: cifs, connect, nntp, pop3, smtp protocolAuthentication = authentication type for protocol negotiations protocolHost = host:port for protocol negotiations protocolPassword = password for protocol negotiations protocolUsername = username for protocol negotiations session = session cache timeout (in seconds) stack = thread stack size (in bytes) sslVersion = all|SSLv2|SSLv3|TLSv1 SSL method TIMEOUTbusy = seconds to wait for expected data TIMEOUTclose = seconds to wait for close_notify (set to 0 for buggy MSIE) TIMEOUTconnect = seconds to connect remote host TIMEOUTidle = seconds to keep an idle connection verify = level of peer certificate verification level 1 - verify peer certificate if present level 2 - require valid peer certificate always level 3 - verify peer with locally installed certificate 2009.11.11 13:03:36 LOG3[5440:5128]: Server is down

2 1

FIPS_mode_set error
by th＠ftlabs.com 09 Nov '09

09 Nov '09

I just installed Stunnel-4.27 on a Linux box and cannot get it to start with a test config that works on another box running same version of Stunnel. I get the following output... [root@dvl stunnel]# stunnel stunnel.conf-test 2009.11.07 11:07:43 LOG7[31671:46968864029472]: Snagged 64 random bytes from stunnel-test.rnd 2009.11.07 11:07:43 LOG7[31671:46968864029472]: Wrote 1024 new random bytes to stunnel-test.rnd 2009.11.07 11:07:43 LOG7[31671:46968864029472]: RAND_status claims sufficient entropy for the PRNG 2009.11.07 11:07:43 LOG7[31671:46968864029472]: PRNG seeded successfully 2009.11.07 11:07:43 LOG7[31671:46968864029472]: SSL context initialized for service Test 2009.11.07 11:07:43 LOG3[31671:46968864029472]: FIPS_mode_set: 2D06C06E: error:2D06C06E:FIPS routines:FIPS_mode_set:fingerprint does not match Does anybody have a clue what may be causing this and how to fix it? Please pardon my ignorance regarding OpenSSL.

1 0

Stunnel 4.28 released
by Michal Trojnara 08 Nov '09

08 Nov '09

The ChangeLog entry: Version 4.28, 2009.11.08, urgency: MEDIUM: * New features - Win32 DLLs for OpenSSL 0.9.8l. - Transparent proxy support on Linux kernels >=2.6.28. See the manual for details. - New socket options to control TCP keepalive on Linux: TCP_KEEPCNT, TCP_KEEPIDLE, TCP_KEEPINTVL. - SSL options updated for the recent version of OpenSSL library. * Bugfixes - A serious bug in asynchronous shutdown code fixed. - Data alignment updated in libwrap.c. - Polish manual encoding fixed. - Notes on compression implementation in OpenSSL added to the manual. SHA-1 value for stunnel-4.28.tar.gz: 868cba9ec56ed6a02c8ecfa2a87614b4d433611b Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Michal Trojnara

1 0

Update docs to remove RLE as compression choice
by Joe Kemp 06 Nov '09

06 Nov '09

I just confirmed that RLE compression is not truly implemented in OpenSSL. It would be helpful to remove it from the stunnel docs so people don't think it's an option to compress data. ZLIB is it. And yes I spent a good bit of time last year with Wireshark to determine RLE vs ZLIB compression ratios in stunnel. Shockingly ZLIB was always better... One other note that may be important for some people is that 0.9.7 openssl is not compatible with 0.9.8 with respect to zlib compression. Joe A. Kemp CapWIN Senior Systems Architect (O) 301-614-3727 (C) 301-502-1281

2 1

Is PSK supported with openssl-1.0.0-beta3 ?
by anders nilsson 05 Nov '09

05 Nov '09

Hello I am running x64 Linux 2.6.18-92.1.22.el5 and installed OpenSSL 1.0.0-beta3 15 Jul 2009 My stunnel -version is: stunnel 4.15 on x86_64-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 I would like to run the ciphers TLS_PSK_WITH_3DES_EDE_CBC_SHA or TLS_PSK_WITH_AES_128_CBC_SHA and I wonder how I do that. My stunnel.conf contains: ciphers = PSK-AES128-CBC-SHA:PSK-3DES-EDE-CBC-SHA and the error I get is: 2009.11.05 11:32:32 LOG3[29268:47461015826624]: SSL_CTX_set_cipher_list: 1410D0B9: error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match Do I compile in the latest OpenSSL to stunnel? Isnt it a problem that the stunnel.conf does not even have the syntax to read PSK-key parameters since its most often run with RSA keys. _________________________________________________________________ Windows Live: Gör det enklare för dina vänner att se vad du håller på med på Facebook. http://www.microsoft.com/sverige/windows/windowslive/see-it-in-action/socia…

1 0

Is PSK supported with openssl-1.0.0-beta3 ?
by anders nilsson 05 Nov '09

05 Nov '09

Hello I am running x64 Linux 2.6.18-92.1.22.el5 and installed OpenSSL 1.0.0-beta3 15 Jul 2009 My stunnel -version is: stunnel 4.15 on x86_64-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 I would like to run the ciphers TLS_PSK_WITH_3DES_EDE_CBC_SHA or TLS_PSK_WITH_AES_128_CBC_SHA and I wonder how I do that. My stunnel.conf contains: ciphers = PSK-AES128-CBC-SHA:PSK-3DES-EDE-CBC-SHA and the error I get is: 2009.11.05 11:32:32 LOG3[29268:47461015826624]: SSL_CTX_set_cipher_list: 1410D0B9: error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match Do I compile in the latest OpenSSL to stunnel? Isnt it a problem that the stunnel.conf does not even have the syntax to read PSK-key parameters since its most often run with RSA keys. Another question is that if there is no support for PSK, how much work is it to download the source and add support for it given that I know C++/C. _________________________________________________________________ Hitta hetaste singlarna på MSN Dejting! http://dejting.se.msn.com/channel/index.aspx?trackingid=1002952

1 0

Tunneling udp over stunnel
by D-503 03 Nov '09

03 Nov '09

Hi, I'm trying to setup some kind of DNS-encryption with the usage of stunnel: https://www.privacyfoundation.de/wiki/HTTPS-DNS/TLS-DNS . This setup is working but pretty pretty slow. One DNS-request takes really long, about 5-6 seconds! I'm wondering why this happens. On the server is running stunnel 4.22 and on the client stunnel 4.25. The config is as described in the link above. What happens in the logs when I do one dns-request, you can see in the attachments of this mail. Something interesting is, if I do a: dig @localhost google.com it takes 5-6 seconds to finish. But if I execute it, abort it directly and execute it again, I get immediatly an answer! This works reproducably. Have you any idea? Could the error be with open/closed connections or some timeouts in stunnel? greetings D-503

1 0