- stunnel-users - stunnel.org

Large performance difference: Solaris vs Linux
by Cliffe, Stephen 20 Sep '10

20 Sep '10

Hi, I've just been comparing the performance of stunnel on Solaris 10 & Linux (Centos 5.5) and am seeing a big difference. I'm using stunnel 4.33 compiled with the same options on both platforms and the tcpstress benchmarking tool (http://stunnel.mirt.net/?page=perf) On a Dell 780 running Solaris 10 I got 163.31 connections/second but on an older, slower Dell 620 running Linux I got 408.01 connections/second. Both machines were otherwise idle. Does anyone know why there would be such a big difference between the two OS's? Thanks, Steve. Steve Cliffe Senior Engineer - Development Infrastructure Team Andrew Network Solutions Asia Pacific [ Address : Andrew Corporation Building (39), Northfields Avenue, Wollongong University, NSW, Australia 2500 ] [ Postal Address : PO Box U40, Wollongong University, NSW, Australia 2500 ] [ Tel : +61 2 4221 2991] [ Fax : +61 2 4221 2901 ] [ Email : Stephen.Cliffe(a)andrew.com] Visit Andrew on the Web at www.andrew.com<http://www.andrew.com/> [cid:[email protected]][cid:[email protected]]

3 5

Generically referencing file locations in stunnel.conf
by Bucci, David G 20 Sep '10

20 Sep '10

Hi - I'm back to trying to run Stunnel with a different user certificate for each user. So far, the best technique I've found is to have a separate stunnel.conf for each user (in their home directory, which is referenced by envvar %USERPROFILE%), and run stunnel using that configuration file. As part of that, I'm trying to generically reference file locations (log, user certificates) in the .conf. But I haven't found a way short of fully pathing the locations in the .conf e.g. "output=c:\users\dbucci\stunnel\stunnel.log". That's undesirable, because it means I have to make every user's .conf unique. So ... is there a generic way to accomplish this? I've tried setting the "Start In" location in the Windows shortcut to that location (via envvar %USERPROFILE%, which allows me to make every user's shortcut generic), then saying "output=.\stunnel.log", but without success - it seems to always be using c:\program files\stunnel as it's starting point for reference. Likewise, the envvar isn't usable in the .conf Note that I thought about creating a subdir per user in C:\program files\stunnel (with appropriate perms for that user), but can't, because in many of our deployment locations, users aren't permitted to write to c:\program files. Btw, this is why I'm asking about the commandline parms in Windows - I don't seem to be able to get them to work, but if I could, I could say e.g. "-o %USERPROFILE%\stunnel\stunnel.log", and that would work generically for every user. Likewise, I could use "-A %USERPROFILE&\stunnel\usercert.pem" and have a generic way of installing user certs. Heck, if I could set ALL the options via command line (-c, -r, etc.) I would love to simply do away with a user-specific .conf file. So ... sorry for rambling a bit, but any help with the intent of what I'm trying to accomplish, make as generic as possible a user-specific config setup? Thx! ---- David G. Bucci Chuck Norris can kick through all 6 degrees of separation, hitting anyone, anywhere, in the face, at any time. -- ChuckNorrisFacts.com

2 2

Command line args available on Windows version 4.33?
by Bucci, David G 20 Sep '10

20 Sep '10

Hi - are all the command line arguments documented at http://www.stunnel.org/faq/args.html#ToC1 available in the Windows 4.33 version? When you execute stunnel -V, very few are listed. And if they are available, do they take precedence over a configuration file, if one is used? (Is a .conf mandatory, or can you set all the required options via command line in the Windows version?) Thx! ---- David G. Bucci Chuck Norris can kick through all 6 degrees of separation, hitting anyone, anywhere, in the face, at any time. -- ChuckNorrisFacts.com

2 1

Accept connections only from local processes?
by Bucci, David G 20 Sep '10

20 Sep '10

Hi - I'm looking to configure Stunnel in client mode to accept connections only from the PC it's running on. Would the config option "socket = a:SO_BINDTODEVICE=lo" accomplish that? And would this work on Windows? (is there a "lo" interface on Windows?) I'm going to do some testing, but thought I'd ask in case someone already knows I'll be pounding sand. And before anyone asks, turning on a firewall isn't an option - we don't have control of all the PCs involved. ---- David G. Bucci Chuck Norris can kick through all 6 degrees of separation, hitting anyone, anywhere, in the face, at any time. -- ChuckNorrisFacts.com

2 1

(no subject)
by Sunil Karumuri 17 Sep '10

17 Sep '10

Hello- I am new to Stunnel and have a basic architecture question. I have Stunnel installed on box A where it receives http messages from multiple client processes . Stunnel sends them to box B via https (mutual ssl). We are seeing that Stunnel opens one connection for each client processes. Can we configure Stunnel to have only ONE SSL connection (or a pool of connections) between box A and B and have Stunnel use the open connection for all traffic from various clients ? We would like to avoid the overhead of SSL-handshake for each new client process. Thanks for the help. Sunil

3 2

Hey buddy, can you review a log file?
by Jay Sprenkle 08 Sep '10

08 Sep '10

Good afterrnoon, Can anyone review the stunnel log file below and see if there's any indication of a problem? What we're doing with stunnel: We're using stunnel to encrypt a tcp connection between a client and our server. What's happening: A client is reporting the connection fails. I believe it's a timeout issue on the client software. My interpretation of this log is that the session is open about 4 seconds then closed by the client. Is that correct? Thanks in advance Stunnel Log: 2010.09.08 14:34:38 LOG7[1392:2328]: Service exchange started 2010.09.08 14:34:38 LOG7[1392:2328]: FD=200 in non-blocking mode 2010.09.08 14:34:38 LOG5[1392:2328]: Service exchange accepted connection from 127.0.0.1:2340 2010.09.08 14:34:38 LOG7[1392:2328]: FD=224 in non-blocking mode 2010.09.08 14:34:38 LOG6[1392:2328]: connect_blocking: connecting xxx.242.123.150:7443 2010.09.08 14:34:38 LOG7[1392:2328]: connect_blocking: s_poll_wait xxx.242.123.150:7443: waiting 10 seconds 2010.09.08 14:34:38 LOG5[1392:2328]: connect_blocking: connected xxx.242.123.150:7443 2010.09.08 14:34:38 LOG5[1392:2328]: Service exchange connected remote server from 192.168.1.29:2341 2010.09.08 14:34:38 LOG7[1392:2328]: Remote FD=224 initialized 2010.09.08 14:34:38 LOG7[1392:2328]: SSL state (connect): before/connect initialization 2010.09.08 14:34:38 LOG7[1392:2328]: SSL state (connect): SSLv3 write client hello A 2010.09.08 14:34:38 LOG7[1392:2328]: SSL state (connect): SSLv3 read server hello A 2010.09.08 14:34:39 LOG7[1392:2328]: SSL state (connect): SSLv3 read server certificate A 2010.09.08 14:34:39 LOG7[1392:2328]: SSL state (connect): SSLv3 read server done A 2010.09.08 14:34:39 LOG7[1392:2328]: SSL state (connect): SSLv3 write client key exchange A 2010.09.08 14:34:39 LOG7[1392:2328]: SSL state (connect): SSLv3 write change cipher spec A 2010.09.08 14:34:39 LOG7[1392:2328]: SSL state (connect): SSLv3 write finished A 2010.09.08 14:34:39 LOG7[1392:2328]: SSL state (connect): SSLv3 flush data 2010.09.08 14:34:39 LOG7[1392:2328]: SSL state (connect): SSLv3 read finished A 2010.09.08 14:34:39 LOG7[1392:2328]: 1 items in the session cache 2010.09.08 14:34:39 LOG7[1392:2328]: 1 client connects (SSL_connect()) 2010.09.08 14:34:39 LOG7[1392:2328]: 1 client connects that finished 2010.09.08 14:34:39 LOG7[1392:2328]: 0 client renegotiations requested 2010.09.08 14:34:39 LOG7[1392:2328]: 0 server connects (SSL_accept()) 2010.09.08 14:34:39 LOG7[1392:2328]: 0 server connects that finished 2010.09.08 14:34:39 LOG7[1392:2328]: 0 server renegotiations requested 2010.09.08 14:34:39 LOG7[1392:2328]: 0 session cache hits 2010.09.08 14:34:39 LOG7[1392:2328]: 0 external session cache hits 2010.09.08 14:34:39 LOG7[1392:2328]: 0 session cache misses 2010.09.08 14:34:39 LOG7[1392:2328]: 0 session cache timeouts 2010.09.08 14:34:39 LOG6[1392:2328]: SSL connected: new session negotiated 2010.09.08 14:34:39 LOG6[1392:2328]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2010.09.08 14:34:44 LOG7[1392:2328]: SSL socket closed on SSL_read 2010.09.08 14:34:44 LOG7[1392:2328]: Socket write shutdown 2010.09.08 14:34:44 LOG5[1392:2328]: Connection closed: 8 bytes sent to SSL, 48 bytes sent to socket 2010.09.08 14:34:44 LOG7[1392:2328]: Service exchange finished (0 left) -- --- "Is real reporting dead? News at 11!"

1 0

Re: [stunnel-users] Individual user certs for each person who uses Windows PC
by Bucci, David G 07 Sep '10

07 Sep '10

Thx for replying, Scott ... how did you handle multiple users on the PC, though? They all shared that cert? I thought about having a single location and copying to there on user login (from a standard location in a user's home dir, e.g.) ... then firing up stunnel ... but it seems like so much can go wrong, resulting in User B accessing using User A's certificate (because the copy failed, e.g.). And we're leery of exposing User A's cert to User B - especially since stunnel doesn't support encryption of the user's key, right? So the permissions would be a little tricky and maybe fragile. Seems like there should be a straightforward way to do it, dadnabit! ________________________________ From: Scott Gifford <sgifford(a)suspectclass.com> To: Bucci, David G Cc: stunnel-users(a)mirt.net <stunnel-users(a)mirt.net> Sent: Mon Aug 30 17:41:09 2010 Subject: EXTERNAL: Re: [stunnel-users] Individual user certs for each person who uses Windows PC On Mon, Aug 30, 2010 at 3:41 PM, Bucci, David G <david.g.bucci(a)lmco.com<mailto:[email protected]>> wrote: [ ... ] I've tried using envvars in the stunnel.conf (e.g., cert = %USERPROFILE%\usercert.pem), tried adjusting the command line to include "-p %USERPROFILE%\usercert.pem" as an option ... We implemented something similar by simply making a "C:\stunnel" directory on each PC, naming the certificate the same thing on all machines, then hardcoding that path into the stunnel configuration (e.g. "C:\stunnel\usercert.pem"). Not quite as nice as %USERPROFILE%\usercert.pem, but it worked. :-) Hope this is helpful, ----Scott.

5 11

Honor --sysconfdir and --localstatedir in stunnel.conf-sample.in
by Sebastian Kayser 01 Sep '10

01 Sep '10

Hi, I am packaging stunnel for opencsw.org. Would you guys mind merging a patch [1] to make use of --sysconfdir and --localstatedir (instead of @prefix@/{etc,var}) in the sample configuration file? Currently, if --sysconfdir and --localstatedir are passed to ./configure and are not a directory below prefix, the configuration file doesn't reflect this layout. The patch is against 4.33. Fedora seems to carry the same change [2]. Sebastian [1]http://gar.svn.sf.net/svnroot/gar/csw/mgar/pkg/stunnel/trunk/files/0001-M… [2]http://lists.fedoraproject.org/pipermail/scm-commits/2010-March/413078.ht…

3 4

[[email protected]: Bug#594876: stunnel4: Fails to connect, "Input line too long"]
by Rodrigo Gallardo 31 Aug '10

31 Aug '10

----- Forwarded message from Harri Kiiskinen <harri.kiiskinen(a)utu.fi> ----- Date: Mon, 30 Aug 2010 13:26:07 +0300 From: Harri Kiiskinen <harri.kiiskinen(a)utu.fi> To: Debian Bug Tracking System <submit(a)bugs.debian.org> Subject: Bug#594876: stunnel4: Fails to connect, "Input line too long" Package: stunnel4 Version: 3:4.29-1local1 Severity: normal My Univ. recently updated their mail servers, and I could not read my mails anymore with Emacs/mew, that uses stunnel4 for encryption. It turned out the reason was, that the server responded with this string: * OK [CAPABILITY STARTTLS CAPABILITY IMAP4 IMAP4rev1 ACL QUOTA LITERAL+ NAMESPACE UIDPLUS CHILDREN BINARY UNSELECT SORT LANGUAGE IDLE XSENDER X-NETSCAPE XSERVERINFO X-SUN-SORT X-SUN-IMAP X-ANNOTATEMORE X-UNAUTHENTICATE XUM1 AUTH=PLAIN AUTH=PLAIN] Messaging Multiplexor (Sun Java(tm) System Messaging Server 7.3-11.01 (built Sep 1 2009)) It turned out that this was way much longer than what stunnel4 expects. In common.h, one finds #define STRLEN 256 When this is changed to #define STRLEN 512 and the package recompiled, everything works well. Perhaps the length of accepted strings should be increased? Or is this long a response against some standard? All the best, Harri K. -- System Information: Debian Release: squeeze/sid APT prefers testing APT policy: (990, 'testing') Architecture: i386 (i686) Kernel: Linux 2.6.32-3-686 (SMP w/1 CPU core) Locale: LANG=en_IE.UTF-8, LC_CTYPE=en_IE.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bash Versions of packages stunnel4 depends on: ii adduser 3.112 add and remove users and groups ii libc6 2.11.2-2 Embedded GNU C Library: Shared lib ii libssl0.9.8 0.9.8o-1 SSL shared libraries ii libwrap0 7.6.q-19 Wietse Venema's TCP wrappers libra ii netbase 4.42 Basic TCP/IP networking system ii openssl 0.9.8o-1 Secure Socket Layer (SSL) binary a ii perl-modules 5.10.1-14 Core Perl modules stunnel4 recommends no packages. Versions of packages stunnel4 suggests: pn logcheck-database <none> (no description available) -- Configuration Files: /etc/stunnel/stunnel.conf changed [not included] -- no debconf information ----- End forwarded message ----- -- Rodrigo Gallardo

2 1

Individual user certs for each person who uses Windows PC
by Bucci, David G 30 Aug '10

30 Aug '10

Hi, all - I've searched, but can't find any answer on this. Is it possible to configure stunnel with client certificates on, and in such a way that individual users who logon have their own individual certificate used? I've tried using envvars in the stunnel.conf (e.g., cert = %USERPROFILE%\usercert.pem), tried adjusting the command line to include "-p %USERPROFILE%\usercert.pem" as an option ... the closest I've been able to think of (and it's a pretty blunt sword) is to create individual services, one per user and listening on different ports, then having each user access a different URL (well, different port#) ... I would prefer this all work when running as a Windows service, but if it's necessary to train the users to hit a start menu entry or something (e.g., if there's a way to do it using envvars on command line parameters), then the world probably won't end ... This is on Windows, but I'd also appreciate knowing how to do the same on Linux. Thx! ---- David G. Bucci When Dr. Bruce Banner becomes angry, he changes into the Incredible Hulk; when the Incredible Hulk becomes angry, he changes into Chuck Norris. -- ChuckNorrisFacts.com

2 1

Cross-compiling stunnel woes feedback
by Martin van den Nieuwelaar 30 Aug '10

30 Aug '10

Hi everyone (again). I thought I'd post some feedback regarding cross-compiling stunnel, which I have successfully done for an Arm based embedded system we use. I had to edit the 'configure' script in order to remove three sections of code that just check for the cross compiling option, and if set simply exit (message 'cannot check for file existence when cross compiling'). This behaviour really isn't condusive to successful cross compiling. :-) So as I say I removed these sections of code. Next, I configured with './configure --host=arm-linux', then 'make' and the rest are standard as usual. Perhaps the configure script for future releases could be a little more friendly for those cross compiling? Editing the configure file shouldn't be necessary. -- R A Ward Ltd. | We take the privacy of our customers seriously. Christchurch | All sensitive E-Mail attachments MUST be encrypted. New Zealand

2 2

"stunnel -version"
by Felix E. Klee 30 Aug '10

30 Aug '10

I installed the official stunnel 4.33 binary on Windows XP/32. And, when I execute "stunnel -version", a popup window appears with the following message: --------------------------- stunnel 4.33 on Win32 (not configured) --------------------------- Stunnel server is down due to an error. You need to exit and correct the problem. Click OK to see the error log window. --------------------------- OK --------------------------- Shouldn't that just work? What may be the cause for the problem? Indeed, I didn't configure stunnel yet. But I also realized that when I change something - for example the log level - in "stunnel.conf", then this is ignored by "stunnel -version". After clicking "OK" to close the popup message, I get some more info, though meaningless to me: stunnel 4.33 on x86-pc-mingw32-gnu with OpenSSL 1.0.0 29 Mar 2010 Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 Global options debug = notice RNDbytes = 64 RNDoverwrite = yes service = stunnel taskbar = yes Service-level options cert = stunnel.pem ciphers = ALL:!aNULL:!eNULL:!SSLv2 session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Server is down

2 4

Updated stunnel version in Debian experimental
by Rodrigo Gallardo 28 Aug '10

28 Aug '10

I have just uploaded stunnel 4.33 to Debian experimental. amd64 packages will be available for download as soon as the automated processing is done (6-12 hours). Other architectures will follow as the autobuilders get time in their queues for us. Aside from the updates in stunnel itself, the packaging has been updated somewhat. In particular, the start/stop scripts in /etc/init.d have grown shinny new options to take advantage of configuration file reloading and the log rotation config takes advantage of them to avoid the long standing issue of having to either live with ever-growing logs, or killing long lived connections when rotating. I would be very glad if you would test those new scripts and report any and all bugs. To Debian's BTS, of course, as none of them are at all the fault of our most excellent upstream ;) As much as I'd have liked to upload it to unstable, the distribution is now in freeze in preparation for the upcoming release, and thus uploading a completely new version of stunnel, together with the packaging changes I made would be completely unacceptable. I will upload this version, together with any bug fixes we collect, as soon as the release is over and sid is unfrozen again. Sadly, that means that the next Debian stable will release with 4.29. For that I am sorry, and I promise to make a backport of 4.33 available as soon as possible after the release. -- Rodrigo yes-I-have-been-remise-as-maintainer Gallardo

1 0

Is it possible for stunnel to reject client connections if the server end cannot connect?
by Martin van den Nieuwelaar 27 Aug '10

27 Aug '10

Hi all. I took a look (manually) through the last year of archives, but didn't find anything on this issue. The situation is as follows. Say we have two machines set up, ClientPC and ServerPC. On ClientPC I run stunnel accepting a connection on a local port and connecting to an stunnel port on ServerPC. On ServerPC I run stunnel accepting a connection on the local stunnel port and connecting to the 'encryption unaware' server on another port on the same ServerPC machine. OK, pretty simple stuff so far. The problem is, when I connect to ClientPC with the 'encryption unaware' client app. then I always get a successful connection, even if there is no server running on ServerPC. Of course once the client has a successful connection, it then performs a write(), and that fails with 'Connection reset by peer'. Really, since there is no server running on ServerPC, I want the connect() to stunnel on ClientPC to fail. Is there a way to do this? The alternative (which is a kludge), is to make the client 'stunnel aware' (yuk!), and to tell it whether it's connecting over stunnel on a per connection basis (yuk!). Then it can know whether it needs to look at the connect() or the write() to know whether the server is not running. Yuk! Or am I overlooking something simple? :-) -- R A Ward Ltd. | We take the privacy of our customers seriously. Christchurch | All sensitive E-Mail attachments MUST be encrypted. New Zealand

1 0

Problem with 2048 bits SSL sertificate with stunnel
by Georgi Georgiev 23 Aug '10

23 Aug '10

Hello to all, We get 2048 bits wildcard certificate for our domain *.domain.com .. And we are using thawte as Certificate Authority . So they send as two certificates .. One for SSL web and one intermediate certificate .. The stunnel configuration is : [https1] cert = /etc/stunnel/domain.crt CAfile = /etc/stunnel/domain.intermediate.crt key = /etc/stunnel/domain.key.nopass verify = 0 accept = x.x.x.x:443 connect = x.x.x.x:81 xforwardedfor=yes even I use verify = 0 some of our clients still complains that on some pages ( like blabla.domain.com ) server wants some of their private certificate to be send to the server !! and it's happens only with Internet Explorer 8.0 without verify and CAfile commands IE 8.0 works fine but Mozilla Firefox claim that can find CA be trusted ! wildcard certificate cannot be reissued with 1024 bits key . So is there some mistake in my configuration ? If not what can I do about it ? Thanks in advance .. P.S.: version of stunnel is 4.20 with XForwardedFor patch ..

2 1

stunnel and loading keys from hw devices
by Victor Wagner 20 Aug '10

20 Aug '10

Hello, all I've tried to use stunnel with keys on the hardware device, supported by OpenSSL engine and encountered some minor problems: 1. Under Unix systems stunnel doesn't provide UI_METHOD for ENGINE_load_private_key. It passes NULL there and engine complains that no user interface provided. On Unix in many cases default UI_METHOD provided by OpenSSL would do So, replacing line 302 in the ctx.c (line number are given for release 4.33) from uim=NULL ; to uim=UI_OpenSSL(); would significanly improve stunnel functionality. 2. OpenSSL UI objects have two methods to pass arbitraty pointers along 1. generic ex_data based macros UI_set_app_data/UI_get_app_data 2. UI-specific UI_add_user_data/UI_get0_user_data Unfortunately app-specific pointer is set inside engine and retrieved inside a callback, which belongs to application. So author of an engine and author of an application should somehow agree on which metod to use. All engines shipped with OpenSSL (ones which do provide load_private_key method) use UI_add_user_data to pass data to the callback. stunnel's pin_cb (for Win32 version of stunnel in the gui.c) uses UI_get_app_data to retrieve ui_data. I wonder what engine was used when this code was developed and debugged. And it does no check if any meaningful pointer is obtained. I suggest to add following code after line 602 in gui.c: /* if set_app_Data haven't-return anything */ if (!ui_data) ui_data=UI_get0_user_data(ui); /* if still no avail */ if (!ui_data) { s_log(LOG_ERR,"Engine haven't passed our callback data to callback. Sorry!"); return 0; } Or instead of complaining we can use some structure, local to function pin_cb as fallback UI_DATA - just as password buffer, and check if ui_data->section is not NULL before reading ui_data->section->key in the pass_proc (line 543 of gui.c) Thus it would work even with really broken engines which do not pass userdata from ENGINE_load_private_key to UI callbacks at all. ----- End forwarded message -----

2 1

stunnel and mod_gnutls
by Yclept Nemo 15 Aug '10

15 Aug '10

I run a mod_gnutls (0.5.5)<->apache (2.2.8) webserver which behaves perfectly normally outside of stunnel: GnuTLSEnable on GnuTLSPriorities SECURE256 GnuTLSExportCertificates on .. When a connection is closed and apache signals the mod_gnutls process to quit, the log records: GnuTLS: Handshake Failed (-8) 'A record packet with illegal version was received.' Invalid method in request NS * HTTP/1.0 ::1 - - [15/Aug/2010:03:31:26 -0400] "NS * HTTP/1.0" 501 512 "-" "Apache/2.2.8 (Ubuntu) ... (internal dummy connection)" This lets me easily identify apache2 process turnovers However, when I connect to this server through stunnel, I receive random dropouts. For example, if I were to upload 200 test files to this server, on average 15 transfers would fail. Stunnel logs (excerpt): 2010.08.15 04:11:25 LOG5[29287:3074030448]: Connection reset: 94 bytes sent to SSL, 523 bytes sent to socket 2010.08.15 04:12:21 LOG5[29287:3074448240]: Connection reset: 94 bytes sent to SSL, 523 bytes sent to socket 2010.08.15 04:12:34 LOG5[29287:3074030448]: Connection reset: 94 bytes sent to SSL, 523 bytes sent to socket And my apache2 logs are flooded with: Invalid method in request \x16\x03\x01 # ... over and over and over ... Invalid method in request \x16\x03\x01 # ... this is a tls hello sequence, as though the webserver were not running mod_gnutls ::1 - - [15/Aug/2010:03:31:26 -0400] "NS * HTTP/1.0" 501 512 "-" "Apache/2.2.8 (Ubuntu) ... (internal dummy connection)" The apache logs show new apache2 processes / new ssl connections being created every 2-5 seconds. A normal connections lasts much longer. stunnel configuration debug=7 foreground=yes client=yes syslog=no pid=/absolute/path/to/stunnel.pid libwrap=no [https] accept=127.0.0.1:11111 connect=my.website.net:myport sslVersion=TLSv1 an excerpt from the stunnel log: 2010.08.15 04:11:25 LOG6[29287:3074030448]: SSL connected: previous session reused 2010.08.15 04:11:25 LOG7[29287:3073960816]: Service https started 2010.08.15 04:11:25 LOG7[29287:3073960816]: FD=19 in non-blocking mode 2010.08.15 04:11:25 LOG5[29287:3073960816]: Service https accepted connection from 127.0.0.1:52674 2010.08.15 04:11:25 LOG7[29287:3073960816]: FD=20 in non-blocking mode 2010.08.15 04:11:25 LOG6[29287:3073960816]: connect_blocking: connecting 44.205.51.83:12389 2010.08.15 04:11:25 LOG7[29287:3073960816]: connect_blocking: s_poll_wait 44.205.51.83:12389: waiting 10 seconds 2010.08.15 04:11:25 LOG5[29287:3073960816]: connect_blocking: connected 44.205.51.83:12389 2010.08.15 04:11:25 LOG5[29287:3073960816]: Service https connected remote server from 192.168.1.8:51590 2010.08.15 04:11:25 LOG7[29287:3073960816]: Remote FD=20 initialized 2010.08.15 04:11:25 LOG7[29287:3073960816]: SSL state (connect): before/connect initialization 2010.08.15 04:11:25 LOG7[29287:3073960816]: SSL state (connect): SSLv3 write client hello A 2010.08.15 04:11:25 LOG7[29287:3073960816]: SSL state (connect): SSLv3 read server hello A 2010.08.15 04:11:25 LOG7[29287:3073960816]: SSL state (connect): SSLv3 read finished A 2010.08.15 04:11:25 LOG7[29287:3073960816]: SSL state (connect): SSLv3 write change cipher spec A 2010.08.15 04:11:25 LOG7[29287:3073960816]: SSL state (connect): SSLv3 write finished A 2010.08.15 04:11:25 LOG7[29287:3073960816]: SSL state (connect): SSLv3 flush data 2010.08.15 04:11:25 LOG7[29287:3073960816]: 1 items in the session cache 2010.08.15 04:11:25 LOG7[29287:3073960816]: 42 client connects (SSL_connect()) 2010.08.15 04:11:25 LOG7[29287:3073960816]: 42 client connects that finished 2010.08.15 04:11:25 LOG7[29287:3073960816]: 0 client renegotiations requested 2010.08.15 04:11:25 LOG7[29287:3073960816]: 0 server connects (SSL_accept()) 2010.08.15 04:11:25 LOG7[29287:3073960816]: 0 server connects that finished 2010.08.15 04:11:25 LOG7[29287:3073960816]: 0 server renegotiations requested 2010.08.15 04:11:25 LOG7[29287:3073960816]: 41 session cache hits 2010.08.15 04:11:25 LOG7[29287:3073960816]: 0 external session cache hits 2010.08.15 04:11:25 LOG7[29287:3073960816]: 0 session cache misses 2010.08.15 04:11:25 LOG7[29287:3073960816]: 0 session cache timeouts 2010.08.15 04:11:25 LOG6[29287:3073960816]: SSL connected: previous session reused 2010.08.15 04:11:25 LOG3[29287:3074030448]: SSL socket closed on SSL_read with 7 byte(s) in buffer 2010.08.15 04:11:25 LOG5[29287:3074030448]: Connection reset: 94 bytes sent to SSL, 523 bytes sent to socket 2010.08.15 04:11:25 LOG7[29287:3074030448]: Service https finished (4 left) 2010.08.15 04:11:25 LOG7[29287:3073960816]: SSL socket closed on SSL_read 2010.08.15 04:11:25 LOG7[29287:3073960816]: Socket write shutdown 2010.08.15 04:11:25 LOG5[29287:3073960816]: Connection closed: 94 bytes sent to SSL, 523 bytes sent to socket 2010.08.15 04:11:25 LOG7[29287:3073960816]: Service https finished (3 left) 2010.08.15 04:11:26 LOG7[29287:3074448240]: SSL socket closed on SSL_read 2010.08.15 04:11:26 LOG7[29287:3074448240]: Socket write shutdown 2010.08.15 04:11:26 LOG5[29287:3074448240]: Connection closed: 1110 bytes sent to SSL, 77962 bytes sent to socket 2010.08.15 04:11:26 LOG7[29287:3074517872]: SSL socket closed on SSL_read 2010.08.15 04:11:26 LOG7[29287:3074517872]: Socket write shutdown 2010.08.15 04:11:26 LOG7[29287:3074448240]: Service https finished (2 left) 2010.08.15 04:11:26 LOG5[29287:3074517872]: Connection closed: 575 bytes sent to SSL, 4889 bytes sent to socket 2010.08.15 04:11:26 LOG7[29287:3074517872]: Service https finished (1 left) 2010.08.15 04:11:26 LOG7[29287:3074378608]: SSL socket closed on SSL_read 2010.08.15 04:11:26 LOG7[29287:3074378608]: Socket write shutdown 2010.08.15 04:11:26 LOG5[29287:3074378608]: Connection closed: 573 bytes sent to SSL, 48787 bytes sent to socket 2010.08.15 04:11:26 LOG7[29287:3074378608]: Service https finished (0 left) 2010.08.15 04:11:26 LOG7[29287:3074520768]: Service https accepted FD=11 from 127.0.0.1:52676 2010.08.15 04:11:26 LOG7[29287:3074378608]: Service https started 2010.08.15 04:11:26 LOG7[29287:3074378608]: FD=11 in non-blocking mode 2010.08.15 04:11:26 LOG5[29287:3074378608]: Service https accepted connection from 127.0.0.1:52676 2010.08.15 04:11:26 LOG7[29287:3074378608]: FD=12 in non-blocking mode 2010.08.15 04:11:26 LOG6[29287:3074378608]: connect_blocking: connecting 44.205.51.83:12389 2010.08.15 04:11:26 LOG7[29287:3074378608]: connect_blocking: s_poll_wait 44.205.51.83:12389: waiting 10 seconds 2010.08.15 04:11:26 LOG5[29287:3074378608]: connect_blocking: connected 44.205.51.83:12389 2010.08.15 04:11:26 LOG5[29287:3074378608]: Service https connected remote server from 192.168.1.8:51592 2010.08.15 04:11:26 LOG7[29287:3074378608]: Remote FD=12 initialized 2010.08.15 04:11:26 LOG7[29287:3074378608]: SSL state (connect): before/connect initialization 2010.08.15 04:11:26 LOG7[29287:3074378608]: SSL state (connect): SSLv3 write client hello A 2010.08.15 04:11:26 LOG7[29287:3074378608]: SSL state (connect): SSLv3 read server hello A 2010.08.15 04:11:26 LOG7[29287:3074378608]: SSL state (connect): SSLv3 read finished A 2010.08.15 04:11:26 LOG7[29287:3074378608]: SSL state (connect): SSLv3 write change cipher spec A 2010.08.15 04:11:26 LOG7[29287:3074378608]: SSL state (connect): SSLv3 write finished A 2010.08.15 04:11:26 LOG7[29287:3074378608]: SSL state (connect): SSLv3 flush data My questions are: Why does this happen (why only with stunnel), and how can I prevent/avoid this? Sincerely,

2 2

help - SSL bandwidth overhead with using different ciphers
by Slim Ben Mahmoud 30 Jul '10

30 Jul '10

Dear SSL experts, In order to assess the performances of an adaptive security algorithm using SSL, I need to measure the network overhead induced by the establishment of SSL tunnels. The experiment aims to measure the bandwidth consumptions (or throughputs) when SSL tunnels are established using the different ciphers implemented in Stunnel (AES256-SHA or RC4-SHA for instance). Do you think that I have to expect a different throughput when I use different ciphers for every tunnels or the overhead is the pretty much the same? In fact, the first results show no difference between the throughputs no matter the cipher I use. I know that SSL overhead is traditionally measured in delay or latency because of the handshake phase (the encryption process time is negligible on the new CPUs) but this is not what i want to show. I hope that my request is enough clear, let me know if it is not the case. Best regards. --Slim

2 1

Proxy for content filtering
by Raj 29 Jul '10

29 Jul '10

Hi All I want to build a proxy server, which acts as man in the middle proxy. The main intention of application is to do content filtering, whether it is an http or https request. I want to block some specified URL. Can anybody tell me what is the best approach of doing this Thanks, Raj Rajmohan SK

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 72, Issue 2
by TONY WESTENHOFER 07 Jul '10

07 Jul '10

stunnel-users-request(a)mirt.net wrote: >Send stunnel-users mailing list submissions to > stunnel-users(a)mirt.net > >To subscribe or unsubscribe via the World Wide Web, visit > http://stunnel.mirt.net/mailman/listinfo/stunnel-users >or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)mirt.net > >You can reach the person managing the list at > stunnel-users-owner(a)mirt.net > >When replying, please edit your Subject line so it is more specific >than "Re: Contents of stunnel-users digest..." > > >Today's Topics: > > 1. Re: telnetd and tcp_wrappers (Spence, Thomas Civ 844 CS/SCOX) > 2. change openssl version with configure (Bhavna Jhunjhunwala) > > >---------------------------------------------------------------------- > >Message: 1 >Date: Tue, 6 Jul 2010 08:28:11 -0400 >From: "Spence, Thomas Civ 844 CS/SCOX" <Thomas.Spence(a)pentagon.af.mil> >Subject: Re: [stunnel-users] telnetd and tcp_wrappers >To: "stunnel-users(a)mirt.net" <stunnel-users(a)mirt.net> >Message-ID: > <751B1F405F4AFF4D907BD567538A83FB04FFE0B6DA(a)tequilasunrise.pentagon.ncr.ds.af.mil> > >Content-Type: text/plain; charset="us-ascii" > >2 guys did help me and still no luck... > >Anyone who tried this: > >[tssl] >accept = 992 >exec = /usr/sbin/telnetd > >Let me know... Reason why I am asking you because when I log off the server then stunnel's process stopped running but I want it keep running after logoff. Before I changed 'exec = /usr/sbin/telnetd', it was 'connect = 23' and the stunnel's process ran great and never stop running... Strange. > >I really need your help. Thanks. > >--------------- >Tom Spence >ABIDES SYSTEM SUPPORT >844th CS/SCOX > > > >------------------------------ > >Message: 2 >Date: Tue, 6 Jul 2010 17:41:42 -0400 >From: Bhavna Jhunjhunwala <bhavnaj(a)quantitativebrokers.com> >Subject: [stunnel-users] change openssl version with configure >To: stunnel-users(a)mirt.net >Message-ID: > <AANLkTikGWuO2XbF8-rtOTMyfeHVdeUV8TZGJvmYfKekB(a)mail.gmail.com> >Content-Type: text/plain; charset="iso-8859-1" > >Hi, > >I have stunnel version as below installed on Mac: > >s*tunnel 4.33 on i386-apple-darwin10.2.0 with OpenSSL 0.9.8k 25 Mar 2009* >*Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv6 Auth:LIBWRAP* >* * >*Global options* >*debug = daemon.notice* >*pid = /usr/local/var/run/stunnel/stunnel.pid* >*RNDbytes = 64* >*RNDfile = /dev/urandom* >*RNDoverwrite = yes* >* * >*Service-level options* >*cert = /usr/local/etc/stunnel/stunnel.pem* >*ciphers = ALL:!aNULL:!eNULL:!SSLv2* >*session = 300 seconds* >*stack = 65536 bytes* >*sslVersion = SSLv3 for client, all for server* >*TIMEOUTbusy = 300 seconds* >*TIMEOUTclose = 60 seconds* >*TIMEOUTconnect = 10 seconds* >*TIMEOUTidle = 43200 seconds* >*verify = none* > >I would like to upgrade the openssl version to 1.0.0a, so I do >./configure --with-ssl=dir >make >make install > >After make install i get below error: > >*make install* >*Making install in src* >*test -z "/usr/local/bin" || ../auto/install-sh -c -d "/usr/local/bin"* >* /bin/sh ../libtool --mode=install /usr/bin/install -c 'stunnel' >'/usr/local/bin/stunnel'* >*/usr/bin/install -c stunnel /usr/local/bin/stunnel* >*test -z "/usr/local/bin" || ../auto/install-sh -c -d "/usr/local/bin"* >* /usr/bin/install -c 'stunnel3' '/usr/local/bin/stunnel3'* >*test -z "/usr/local/lib/stunnel" || ../auto/install-sh -c -d >"/usr/local/lib/stunnel"* >* /bin/sh ../libtool --mode=install /usr/bin/install -c 'libstunnel.la' >'/usr/local/lib/stunnel/libstunnel.la'* >*/usr/bin/install -c .libs/libstunnel.dylib >/usr/local/lib/stunnel/libstunnel.dylib* >*/usr/bin/install -c .libs/libstunnel.lai /usr/local/lib/stunnel/ >libstunnel.la* >*----------------------------------------------------------------------* >*Libraries have been installed in:* >* /usr/local/lib/stunnel* >* >* >*If you ever happen to want to link against installed libraries* >*in a given directory, LIBDIR, you must either use libtool, and* >*specify the full pathname of the library, or use the `-LLIBDIR'* >*flag during linking and do at least one of the following:* >* - add LIBDIR to the `DYLD_LIBRARY_PATH' environment variable* >* during execution* >* >* >*See any operating system documentation about shared libraries for* >*more information, such as the ld(1) and ld.so(8) manual pages.* >*----------------------------------------------------------------------* >*make[2]: Nothing to be done for `install-data-am'.* >*Making install in doc* >*make[2]: Nothing to be done for `install-exec-am'.* >*test -z "/usr/local/share/doc/stunnel" || ../auto/install-sh -c -d >"/usr/local/share/doc/stunnel"* >* /usr/bin/install -c -m 644 'stunnel.html' >'/usr/local/share/doc/stunnel/stunnel.html'* >* /usr/bin/install -c -m 644 'stunnel.pl.html' >'/usr/local/share/doc/stunnel/stunnel.pl.html'* >* /usr/bin/install -c -m 644 'stunnel.fr.html' >'/usr/local/share/doc/stunnel/stunnel.fr.html'* >*test -z "/usr/local/share/man/man8" || ../auto/install-sh -c -d >"/usr/local/share/man/man8"* >*mkdir: /usr/local/share/man/man8: Permission denied* >*make[2]: *** [install-man8] Error 1* >*make[1]: *** [install-am] Error 2* > > > >and when I check the stunnel version it still uses the old ssl version. >Am I doing something wrong here? > >-- >Thanks, >Bhavna >Quantitative Brokers >646 293 1808 > > >DISCLAIMER: >This e-mail and any attachments are for the confidential use of the >intended recipient. If you are not the intended recipient of this >message you are hereby notified that any review, dissemination, >distribution or copying of this message is strictly prohibited. This >communication is for information purposes only and should not be >regarded as an offer to sell or as a solicitation of an offer to buy >any investment product, an official confirmation of any transaction >or an official statement of Quantitative Brokers, LLC. > >E-mail transmissions cannot be guaranteed to be secure or error-free. >Therefore, we do not represent that this information is complete or >accurate and it should not be relied upon as such. > >All information is subject to change without notice. >Quantitative Brokers may, at its discretion, monitor and review the >content of all e-mail communications. >

1 0

problem with "verify=0"
by wujot＠home.pl 07 Jul '10

07 Jul '10

Hello everybody, The basic SSL negotiation requires the exchange of nine SSL messages. If client authentication is required, server can send additional message "certificate request". But this message is optional. I'm using stunnel ver. 4.27 for Win and 4.28 for Linux. In both cases stunnel, working as server, is sending "certificate request" message to the client, regardless of "verify" state, even with "verify=0". When "verify=0", server doesn't care about client's certificate. So, what for server sends this message? The part of my configuration and log is bellow: [test] accept = 60000 connect = 192.168.3.15:4679 client = no ;verify = 0 verify = none ciphers=DES-CBC3-SHA session = 3600 2010.07.07 12:53:35 LOG7[2412:4280]: SSL state (accept): before/accept initialization 2010.07.07 12:53:35 LOG7[2412:4280]: SSL state (accept): SSLv3 read client hello A 2010.07.07 12:53:35 LOG7[2412:4280]: SSL state (accept): SSLv3 write server hello A 2010.07.07 12:53:35 LOG7[2412:4280]: SSL state (accept): SSLv3 write certificate A 2010.07.07 12:53:35 LOG7[2412:4280]: SSL state (accept): SSLv3 write certificate request A <-------------???!!! 2010.07.07 12:53:35 LOG7[2412:4280]: SSL state (accept): SSLv3 flush data 2010.07.07 12:53:42 LOG6[2412:4280]: VERIFY IGNORE: depth=1, /C= .............. 2010.07.07 12:53:42 LOG5[2412:4280]: CRL: verification passed 2010.07.07 12:53:42 LOG5[2412:4280]: VERIFY OK: depth=1, /C= .......... 2010.07.07 12:53:42 LOG6[2412:4280]: VERIFY IGNORE: depth=0, /C= ................ 2010.07.07 12:53:42 LOG5[2412:4280]: CRL: verification passed 2010.07.07 12:53:42 LOG5[2412:4280]: VERIFY OK: depth=0, /C= .......................... 2010.07.07 12:53:42 LOG7[2412:4280]: SSL state (accept): SSLv3 read client certificate A 2010.07.07 12:53:42 LOG7[2412:4280]: SSL state (accept): SSLv3 read client key exchange a 2010.07.07 12:53:42 LOG7[2412:4280]: SSL state (accept): SSLv3 read certificate verify A 2010.07.07 12:53:42 LOG7[2412:4280]: SSL state (accept): SSLv3 read finished A 2010.07.07 12:53:42 LOG7[2412:4280]: SSL state (accept): SSLv3 write change cipher spec A 2010.07.07 12:53:42 LOG7[2412:4280]: SSL state (accept): SSLv3 write finished A So, my question is: how to remove "certificate request" message from stunnel-as-server negotiation? Regards, Wojtek

1 0

change openssl version with configure
by Bhavna Jhunjhunwala 06 Jul '10

06 Jul '10

Hi, I have stunnel version as below installed on Mac: s*tunnel 4.33 on i386-apple-darwin10.2.0 with OpenSSL 0.9.8k 25 Mar 2009* *Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv6 Auth:LIBWRAP* * * *Global options* *debug = daemon.notice* *pid = /usr/local/var/run/stunnel/stunnel.pid* *RNDbytes = 64* *RNDfile = /dev/urandom* *RNDoverwrite = yes* * * *Service-level options* *cert = /usr/local/etc/stunnel/stunnel.pem* *ciphers = ALL:!aNULL:!eNULL:!SSLv2* *session = 300 seconds* *stack = 65536 bytes* *sslVersion = SSLv3 for client, all for server* *TIMEOUTbusy = 300 seconds* *TIMEOUTclose = 60 seconds* *TIMEOUTconnect = 10 seconds* *TIMEOUTidle = 43200 seconds* *verify = none* I would like to upgrade the openssl version to 1.0.0a, so I do ./configure --with-ssl=dir make make install After make install i get below error: *make install* *Making install in src* *test -z "/usr/local/bin" || ../auto/install-sh -c -d "/usr/local/bin"* * /bin/sh ../libtool --mode=install /usr/bin/install -c 'stunnel' '/usr/local/bin/stunnel'* */usr/bin/install -c stunnel /usr/local/bin/stunnel* *test -z "/usr/local/bin" || ../auto/install-sh -c -d "/usr/local/bin"* * /usr/bin/install -c 'stunnel3' '/usr/local/bin/stunnel3'* *test -z "/usr/local/lib/stunnel" || ../auto/install-sh -c -d "/usr/local/lib/stunnel"* * /bin/sh ../libtool --mode=install /usr/bin/install -c 'libstunnel.la' '/usr/local/lib/stunnel/libstunnel.la'* */usr/bin/install -c .libs/libstunnel.dylib /usr/local/lib/stunnel/libstunnel.dylib* */usr/bin/install -c .libs/libstunnel.lai /usr/local/lib/stunnel/ libstunnel.la* *----------------------------------------------------------------------* *Libraries have been installed in:* * /usr/local/lib/stunnel* * * *If you ever happen to want to link against installed libraries* *in a given directory, LIBDIR, you must either use libtool, and* *specify the full pathname of the library, or use the `-LLIBDIR'* *flag during linking and do at least one of the following:* * - add LIBDIR to the `DYLD_LIBRARY_PATH' environment variable* * during execution* * * *See any operating system documentation about shared libraries for* *more information, such as the ld(1) and ld.so(8) manual pages.* *----------------------------------------------------------------------* *make[2]: Nothing to be done for `install-data-am'.* *Making install in doc* *make[2]: Nothing to be done for `install-exec-am'.* *test -z "/usr/local/share/doc/stunnel" || ../auto/install-sh -c -d "/usr/local/share/doc/stunnel"* * /usr/bin/install -c -m 644 'stunnel.html' '/usr/local/share/doc/stunnel/stunnel.html'* * /usr/bin/install -c -m 644 'stunnel.pl.html' '/usr/local/share/doc/stunnel/stunnel.pl.html'* * /usr/bin/install -c -m 644 'stunnel.fr.html' '/usr/local/share/doc/stunnel/stunnel.fr.html'* *test -z "/usr/local/share/man/man8" || ../auto/install-sh -c -d "/usr/local/share/man/man8"* *mkdir: /usr/local/share/man/man8: Permission denied* *make[2]: *** [install-man8] Error 1* *make[1]: *** [install-am] Error 2* and when I check the stunnel version it still uses the old ssl version. Am I doing something wrong here? -- Thanks, Bhavna Quantitative Brokers 646 293 1808 DISCLAIMER: This e-mail and any attachments are for the confidential use of the intended recipient. If you are not the intended recipient of this message you are hereby notified that any review, dissemination, distribution or copying of this message is strictly prohibited. This communication is for information purposes only and should not be regarded as an offer to sell or as a solicitation of an offer to buy any investment product, an official confirmation of any transaction or an official statement of Quantitative Brokers, LLC. E-mail transmissions cannot be guaranteed to be secure or error-free. Therefore, we do not represent that this information is complete or accurate and it should not be relied upon as such. All information is subject to change without notice. Quantitative Brokers may, at its discretion, monitor and review the content of all e-mail communications.

1 0

Re: [stunnel-users] telnetd and tcp_wrappers
by Spence, Thomas Civ 844 CS/SCOX 06 Jul '10

06 Jul '10

2 guys did help me and still no luck... Anyone who tried this: [tssl] accept = 992 exec = /usr/sbin/telnetd Let me know... Reason why I am asking you because when I log off the server then stunnel's process stopped running but I want it keep running after logoff. Before I changed 'exec = /usr/sbin/telnetd', it was 'connect = 23' and the stunnel's process ran great and never stop running... Strange. I really need your help. Thanks. --------------- Tom Spence ABIDES SYSTEM SUPPORT 844th CS/SCOX

1 0

Re: [stunnel-users] telnetd and tcp_wrappers
by Spence, Thomas Civ 844 CS/SCOX 02 Jul '10

02 Jul '10

Hi Again, I tried: [tssl] accept = 992 exec = /usr/sbin/telnetd It works. When I log into the server with no problem. When I am ready to log off then the process stopped running??? How can it stays running in process (/usr/local/bin/stunnel)? Thanks. Tom -----Original Message----- From: Spence, Thomas Civ 844 CS/SCOX Sent: Thursday, July 01, 2010 11:53 AM To: 'stunnel-users(a)mirt.net' Subject: telnetd and tcp_wrappers Hi all.. They requested us to turn off the telnetd from inetd.conf and not allowing to use tcp_wrappers... We are still using stunnel 4.33... We can't connect our server from PC with PowerTerm WebConnect because telnetd is off. Is there any way for all users to connect the server by using PowerTerm WebConnect? stunnel.conf: [tssl] accept = 992 connect = 23 (can't use telnet port) I know I can't use "connect = 22" because it doesn't work. Any idea? I really need your help... --------------- Tom Spence

2 1

telnetd and tcp_wrappers
by Spence, Thomas Civ 844 CS/SCOX 01 Jul '10

01 Jul '10

Hi all.. They requested us to turn off the telnetd from inetd.conf and not allowing to use tcp_wrappers... We are still using stunnel 4.33... We can't connect our server from PC with PowerTerm WebConnect because telnetd is off. Is there any way for all users to connect the server by using PowerTerm WebConnect? stunnel.conf: [tssl] accept = 992 connect = 23 (can't use telnet port) I know I can't use "connect = 22" because it doesn't work. Any idea? I really need your help... --------------- Tom Spence

1 0

Re: [stunnel-users] Connecting to stunnel with SQLServer
by Mohit Anchlia 30 Jun '10

30 Jun '10

Has anyone else tried using Java SSL or anything using Java that will not require stunnel on the client side? On Fri, Jun 25, 2010 at 12:13 PM, Carter Browne <cbrowne(a)cbcs-usa.com> wrote: > On 6/24/2010 11:00 PM, Mohit Anchlia wrote: >> On Thu, Jun 24, 2010 at 10:27 AM, Carter Browne <cbrowne(a)cbcs-usa.com> wrote: >> >>> On 6/24/2010 12:09 PM, Mohit Anchlia wrote: >>> >>>> On Thu, Jun 24, 2010 at 5:14 AM, Carter Browne <cbrowne(a)cbcs-usa.com> wrote: >>>> >>>> >>>>> It is very easy to do if you have stunnel running on both ends. On the >>>>> client side in the configuration file you could have: >>>>> >>>>> [MSSQL-OUT] >>>>> accept = localhost:1433 >>>>> connect = remote:20000 >>>>> client = yes >>>>> >>>>> >>>> Thanks. So if I have stunnel running on both ends how do I connect to >>>> SQL server? Just open a JDBC connection on the local port and it will >>>> automatically connect on the remote side? >>>> >>>> >>> In this example, I would define an alias using the configuration manager >>> giving it your name for the data base, and having it connect to port >>> 1433 on localhost. For my systems, >>> I usually use a dummy name defined in the 127.0.0.0/8 net and some port >>> other than 1433. This approach does require stunnel on both ends. I >>> haven't tried any other approaches. >>> MS SQL server does have some options for encrypting the traffic as well >>> - I did not think they would work for my mixed Linux/Windows >>> environment, but it might work for your environment. >>> >>> >>> >>>> Also, are there any other options? We have 20 servers from which we >>>> need to connect. I was trying to avoid install of another binary and >>>> relying on it for being up and running. Is it possible to use Java >>>> SSL? Or is that too complicated and not proven to work? Not sure if >>>> there is any other option. >>>> >>>> >>>> >>>>> on the remote side have: >>>>> >>>>> [MSSQL-IN] >>>>> accept = 20000 >>>>> connect = 1433 >>>>> client = no >>>>> >>>>> In this example port 20000 would have to be open to any firewalls >>>>> including the Windows firewall and assumes you are using the standard >>>>> MSSQL port on the server. >>>>> >>>>> You would probably want to use the SQL Server Configuration Manager on >>>>> the client computer to add an alias for your data base. >>>>> >>>>> >> Our client will be on Linux box. I am trying to understand if I am >> using JDBC the connection URL is something like: >> >> jdbc:sqlserver://[serverName[\instanceName][:portNumber]][;property=value[;property=value]] >> >> So if I use stunnel on both sides then how will this work? What will I >> give in my connection string? >> > > I don't have a Java DB connection, so I cannot speak from experience. > For both the Windows and the Linux ODBC drivers, using the example above > the server name would be > localhost:1433. The Instance name and any properties that you send > would not change. Again, using the values in the example, stunnel is > simply mapping localhost:1433 to remote:1433. > > Carter >> >>>>> Carter >>>>> >>>>> Carter Browne >>>>> CBCS >>>>> cbrowne(a)cbcs-usa.com >>>>> 781-721-2890 >>>>> >>>>> >>>>> On 6/23/2010 11:32 PM, Mohit Anchlia wrote: >>>>> >>>>> >>>>>> We have a requirement to connect to a SQLServer that is connected >>>>>> through stunnel on the other end. Can I use java SSL to talk to >>>>>> stunnel? What are my options? >>>>>> _______________________________________________ >>>>>> stunnel-users mailing list >>>>>> stunnel-users(a)mirt.net >>>>>> http://stunnel.mirt.net/mailman/listinfo/stunnel-users >>>>>> >>>>>> >>>>>> >>>>>> >>>>> >>>> >>> >> >

1 1

stunnel question and behaviour
by eni-urgence 25 Jun '10

25 Jun '10

Hello all. I want to use stunnel as ssl terminatation for https and pass httpd request to haproxy. I have compiled stunnel (source http://www.stunnel.org/download/stunnel/src/stunnel-4.32.tar.gz ) and apply this patch http://haproxy.1wt.eu/download/patches/stunnel-4.32-xforwarded-for.diff. I have placed the binary in /usr/local/bin . I want to use the heartbeat capabilities and start stunnel only if VIP is on the node. In order to make that, the init script of stunnel must be LSB compatible like said http://www.linux-ha.org/LSBResourceAgent. When i made a /etc/init.d/stunnel stop then a /etc/init.d/stunnel start, the service wont start . in order to reproduce make a //etc/init.d/stunnel start/ /ps -ef/ said stunnel 30301 1 0 13:21 pts/2 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf stunnel 30302 1 0 13:21 pts/2 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf stunnel 30303 1 0 13:21 pts/2 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf stunnel 30304 1 0 13:21 pts/2 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf stunnel 30305 1 0 13:21 pts/2 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf stunnel 30306 1 0 13:21 ? 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf Is it normal there is many process of stunnel ? And only the last pid process with ? in place of pts/2 is on the pid file. //etc/init.d/stunnel stop/ /ps -ef /said /stunnel 30306 1 0 13:21 ? 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf/ /and / //etc/init.d/stunnel start/ / DÃ©marrage de stunnel :Reading configuration from file /etc/stunnel/stunnel.conf FIPS mode disabled RAND_status claims sufficient entropy for the PRNG PRNG seeded successfully Certificate: /path_to_mycrt Certificate loaded Key file: /path_to_my_key Private key loaded SSL context initialized for servicemy_domaine_name Configuration successful No limit detected for the number of clients FD=9 in non-blocking mode FD=10 in non-blocking mode FD=11 in non-blocking mode Option SO_REUSEADDR set on accept socket Error binding secure.scan-prod.com to 192.168.100.156:443 bind: Address already in use (98)/ return code 1 after stop there is a remaining stunnel process. It appears that this process is the one which the pid had been added to pidfile a /file /usr/local/bin/stunnel /said //usr/local/bin/stunnel: ELF 64-bit LSB executable, AMD x86-64, version 1 (SYSV), for GNU/Linux 2.6.9, dynamically linked (uses shared libs), for GNU/Linux 2.6.9, stripped/ /usr/local/bin/stunnel -version said /stunnel 4.32 on x86_64-unknown-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008/ /Threading:PTHREAD SSL:ENGINE,FIPS Sockets:POLL,IPv6 Auth:LIBWRAP/ /Global options/ /debug = daemon.notice/ /pid = /usr/local/var/run/stunnel/stunnel.pid/ /RNDbytes = 64/ /RNDfile = /dev/urandom/ /RNDoverwrite = yes/ /Service-level options/ /cert = /usr/local/etc/stunnel/stunnel.pem/ /ciphers = FIPS/ /session = 300 seconds/ /stack = 65536 bytes/ /sslVersion = TLSv1/ /TIMEOUTbusy = 300 seconds/ /TIMEOUTclose = 60 seconds/ /TIMEOUTconnect = 10 seconds/ /TIMEOUTidle = 43200 seconds/ /verify = none/ my stunnel.conf is like that /; Protocol version (all, SSLv2, SSLv3, TLSv1)/ /sslVersion = all/ /setuid = stunnel/ /setgid = stunnel/ /chroot = /var/chroot/stunnel/ /pid = /var/run/stunnel.pid/ /output = /var/log/stunnel.log/ /debug = 5/ /fips = no/ /socket=l:TCP_NODELAY=1/ /socket=r:TCP_NODELAY=1/ /[my_domain]/ /key = /path_to_my_key/ /cert = /path_to_mycrt/ /accept = 192.168.100.156:443/ /connect = 192.168.100.156:10443/ /xforwardedfor = yes/ /TIMEOUTclose = 0 Thanks for your help /

1 0

stunnel and heartbeat
by eni-urgence 25 Jun '10

25 Jun '10

Hello all. I want to use stunnel as ssl terminatation for https and pass httpd request to haproxy. I have compiled stunnel (source http://www.stunnel.org/download/stunnel/src/stunnel-4.32.tar.gz ) and apply this patch http://haproxy.1wt.eu/download/patches/stunnel-4.32-xforwarded-for.diff. I have placed the binary in /usr/local/bin . I want to use the heartbeat capabilities and start stunnel only if VIP is on the node. In order to make that, the init script of stunnel must be LSB compatible like said http://www.linux-ha.org/LSBResourceAgent. When i made a /etc/init.d/stunnel stop then a /etc/init.d/stunnel start, the service wont start . in order to reproduce make a //etc/init.d/stunnel start/ /ps -ef/ said stunnel 30301 1 0 13:21 pts/2 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf stunnel 30302 1 0 13:21 pts/2 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf stunnel 30303 1 0 13:21 pts/2 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf stunnel 30304 1 0 13:21 pts/2 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf stunnel 30305 1 0 13:21 pts/2 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf stunnel 30306 1 0 13:21 ? 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf Is it normal there is many process of stunnel ? And only the last pid process with ? in place of pts/2 is on the pid file. //etc/init.d/stunnel stop/ /ps -ef /said /stunnel 30306 1 0 13:21 ? 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf/ /and / //etc/init.d/stunnel start/ / DÃ©marrage de stunnel :Reading configuration from file /etc/stunnel/stunnel.conf FIPS mode disabled RAND_status claims sufficient entropy for the PRNG PRNG seeded successfully Certificate: /path_to_mycrt Certificate loaded Key file: /path_to_my_key Private key loaded SSL context initialized for servicemy_domaine_name Configuration successful No limit detected for the number of clients FD=9 in non-blocking mode FD=10 in non-blocking mode FD=11 in non-blocking mode Option SO_REUSEADDR set on accept socket Error binding secure.scan-prod.com to 192.168.100.156:443 bind: Address already in use (98)/ return code 1 after stop there is a remaining stunnel process. It appears that this process is the one which the pid had been added to pidfile a /file /usr/local/bin/stunnel /said //usr/local/bin/stunnel: ELF 64-bit LSB executable, AMD x86-64, version 1 (SYSV), for GNU/Linux 2.6.9, dynamically linked (uses shared libs), for GNU/Linux 2.6.9, stripped/ /usr/local/bin/stunnel -version said /stunnel 4.32 on x86_64-unknown-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008/ /Threading:PTHREAD SSL:ENGINE,FIPS Sockets:POLL,IPv6 Auth:LIBWRAP/ /Global options/ /debug = daemon.notice/ /pid = /usr/local/var/run/stunnel/stunnel.pid/ /RNDbytes = 64/ /RNDfile = /dev/urandom/ /RNDoverwrite = yes/ /Service-level options/ /cert = /usr/local/etc/stunnel/stunnel.pem/ /ciphers = FIPS/ /session = 300 seconds/ /stack = 65536 bytes/ /sslVersion = TLSv1/ /TIMEOUTbusy = 300 seconds/ /TIMEOUTclose = 60 seconds/ /TIMEOUTconnect = 10 seconds/ /TIMEOUTidle = 43200 seconds/ /verify = none/ my stunnel.conf is like that /; Protocol version (all, SSLv2, SSLv3, TLSv1)/ /sslVersion = all/ /setuid = stunnel/ /setgid = stunnel/ /chroot = /var/chroot/stunnel/ /pid = /var/run/stunnel.pid/ /output = /var/log/stunnel.log/ /debug = 5/ /fips = no/ /socket=l:TCP_NODELAY=1/ /socket=r:TCP_NODELAY=1/ /[my_domain]/ /key = /path_to_my_key/ /cert = /path_to_mycrt/ /accept = 192.168.100.156:443/ /connect = 192.168.100.156:10443/ /xforwardedfor = yes/ /TIMEOUTclose = 0 Thanks for your help /

1 0

error during multithreaded operation
by Bhavna Jhunjhunwala 24 Jun '10

24 Jun '10

Hi Users, I am having the same problem as listed in below thread. Is there a resolution? Appreciate any help in this matter! http://stunnel.mirt.net/pipermail/stunnel-users/2009-April/002353.html open ssl version: OpenSSL 0.9.8k 25 Mar 2009 stunnel version: stunnel -version stunnel 4.33 on i386-apple-darwin10.2.0 with OpenSSL 0.9.8k 25 Mar 2009 Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv6 Auth:LIBWRAP Global options debug = daemon.notice pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!aNULL:!eNULL:!SSLv2 session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none -- Thanks, Bhavna Quantitative Brokers DISCLAIMER: This e-mail and any attachments are for the confidential use of the intended recipient. If you are not the intended recipient of this message you are hereby notified that any review, dissemination, distribution or copying of this message is strictly prohibited. This communication is for information purposes only and should not be regarded as an offer to sell or as a solicitation of an offer to buy any investment product, an official confirmation of any transaction or an official statement of Quantitative Brokers, LLC. E-mail transmissions cannot be guaranteed to be secure or error-free. Therefore, we do not represent that this information is complete or accurate and it should not be relied upon as such. All information is subject to change without notice. Quantitative Brokers may, at its discretion, monitor and review the content of all e-mail communications.

1 0

Connecting to stunnel with SQLServer
by Mohit Anchlia 24 Jun '10

24 Jun '10

We have a requirement to connect to a SQLServer that is connected through stunnel on the other end. Can I use java SSL to talk to stunnel? What are my options?

1 0

transfer() loop executes not transferring any data
by Nelson 22 Jun '10

22 Jun '10

I just setup stunnel to partner with haproxy to handle https. My concern is I saw the logs below on my stunnel logs. I don't know if I need to worry about this since my testing using https is doing fine. stunnel is forwarding https request to haproxy. 2010.06.22 07:57:27 LOG3[1363:2083728]: transfer() loop executes not transferring any data 2010.06.22 07:57:27 LOG3[1363:2083728]: please report the problem to Michal.Trojnara(a)mirt.net 2010.06.22 07:57:27 LOG3[1363:2083728]: protocol=TLSv1, check_SSL_pending=no 2010.06.22 07:57:27 LOG3[1363:2083728]: socket open: rd=yes wr=no, ssl open: rd=no wr=yes 2010.06.22 07:57:27 LOG3[1363:2083728]: socket ready: rd=no wr=no, ssl ready: rd=yes wr=no 2010.06.22 07:57:27 LOG3[1363:2083728]: wants: SSL_read rd=no wr=no, SSL_write rd=no wr=yes, SSL_shutdown rd=no wr=no 2010.06.22 07:57:27 LOG3[1363:2083728]: socket input buffer: 16384 byte(s), ssl input buffer: 0 byte(s) Thanks, Nelson

1 0

"choose a digital certificate" pop-up in IE
by KumpelJ 21 Jun '10

21 Jun '10

Hello I have browsed the archives but have not found the answer to this question... I have stunnel set up to handle https connections. It sits on a Debian server alongside HAProxy and works fine with every browser except for Internet Explorer. When I connect with Internet Explorer, I get a blank "Please choose a digital certificate" pop-up. How do we turn off the request for the client certificate in IE? Here are my details....thanks in advance. #vi /etc/stunnel/stunnel.conf verify=0 CAfile=/etc/ssl/certs/chain.pem cert=/etc/ssl/certs/multidomain.pem CApath=/etc/ssl/certs/ pid = /etc/stunnel/stunnel.pid debug = 3 output = /etc/stunnel/stunnel.log socket=l:TCP_NODELAY=1 socket=r:TCP_NODELAY=1 client=no [https] accept=192.168.11.32:443 connect=localhost:444 TIMEOUTclose=0 xforwardedfor=yes #usr/local/bin/stunnel -version stunnel 4.32 on x86_64-unknown-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Global options debug = daemon.notice pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none -- View this message in context: http://old.nabble.com/%22choose-a-digital-certificate%22-pop-up-in-IE-tp286… Sent from the Stunnel - Users mailing list archive at Nabble.com.

4 8

stunnel dies on logoff
by Bhavna Jhunjhunwala 17 Jun '10

17 Jun '10

Hi, I am using quickfix application to connect to an exchange and receive market data. The connectivity to exchange is through SSL and am using stunnel 4.15. I see that stunnel dies, every time my quickfix application is restarted or sends a logout to server. Please let me know if a solution is in place. *Below is the stunnel.conf file:* cert = /home/bhavna/workspace/stunnel/str10100str.pem key = /home/bhavna/workspace/stunnel/str10100str.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 output = /home/bhavna/workspace/stunnel/stunnel.log pid = /home/bhavna/workspace/stunnel/stunnel.pid ; Use it for client mode client = yes ; Service-level configuration [currenex_stream] ;accept = 127.0.0.1:1109 accept = 1110 ;prod details connect = server_IP:port TIMEOUTclose = 10 *Below are the version details of stunnel:* > ./stunnel -version stunnel 4.15 on x86_64-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none *Logs:* 2010.06.16 18:59:23 LOG7[6401:1084586304]: SSL alert (read): warning: close notify 2010.06.16 18:59:23 LOG7[6401:1084586304]: SSL closed on SSL_read 2010.06.16 18:59:23 LOG7[6401:1084586304]: Socket write shutdown 2010.06.16 18:59:23 LOG7[6401:1084586304]: SSL write shutdown 2010.06.16 18:59:23 LOG7[6401:1084586304]: SSL alert (write): warning: close notify 2010.06.16 18:59:23 LOG6[6401:1084586304]: SSL_shutdown successfully sent close_notify 2010.06.16 18:59:23 LOG5[6401:1084586304]: Connection closed: 109 bytes sent to SSL, 129 bytes sent to socket 2010.06.16 18:59:23 LOG7[6401:1084586304]: currenex_stream finished (0 left) -- Thanks, Bhavna DISCLAIMER: This e-mail and any attachments are for the confidential use of the intended recipient. If you are not the intended recipient of this message you are hereby notified that any review, dissemination, distribution or copying of this message is strictly prohibited. This communication is for information purposes only and should not be regarded as an offer to sell or as a solicitation of an offer to buy any investment product, an official confirmation of any transaction or an official statement of Quantitative Brokers, LLC. E-mail transmissions cannot be guaranteed to be secure or error-free. Therefore, we do not represent that this information is complete or accurate and it should not be relied upon as such. All information is subject to change without notice. Quantitative Brokers may, at its discretion, monitor and review the content of all e-mail communications.

1 1

Re: [stunnel-users] Stunnel supports ECC certificate?
by Bao, Robert 08 Jun '10

08 Jun '10

To those who may find it useful: Mike came to rescure. He provided some new code and gave me the modified file to try out. It worked very well so far, problem solved. He plans to release the change in the next revision. Thanks a lot Mike. Robert Bao > _____________________________________________ > From: Bao, Robert > Sent: Thursday, June 03, 2010 2:14 PM > To: 'stunnel-users(a)mirt.net' > Subject: Stunnel supports ECC certificate? > > I searched the entire archive, couldn't find the answer/solution I am > looking for. I have to post to this group, and appreciate any > help/suggestion from any you. > > I use the latest 1.0.0 OpenSSL and 4.33 Stunnel. > > I used OpenSSL commands that very similar to what is described in the > following link to create the ECC certificate and the private key file. > http://src.opensolaris.org/source/xref/sfw/usr/src/lib/openssl/openssl > -0.9.8n/demos/ssltest-ecc/ECC-RSAcertgen.sh > > Start Stunnel, see the following errors: > Key file: (actual path to the private key file)\HOST.KEY > error stack: 140B3009 : error:140B3009:SSL > routines:SSL_CTX_use_RSAPrivateKey_file:PEM lib > SSL_CTX_use_RSAPrivateKey_file: 607907F: error:0607907F:digital > envelope routines:EVP_PKEY_get1_RSA:expecting an rsa key > > There was a similar posting 4-5 years ago, and Mike answered it (the > answer was: Stunnel didn't support ECC at that time). > http://stunnel.mirt.net/pipermail/stunnel-users/2005-October/000817.ht > ml > > Seems like this is still true today. Then, when the ECC support will > be added to Stunnel? > > If Stunnel already supports ECC certificate, how do I make it work? > > Thanks. > > Robert Bao > Software House > Tyco International > 978-577-4202 > > Explore our new Tyco Online Learning Center Web-based Training Bundles > at: www.swhouse.com/support/tyco_online_learning_center.aspx > > This e-mail may contain or have attached to it information or > technology the export or re-export of which is restricted by U.S. laws > and regulations. By viewing this e-mail and any attachments, the > recipient agrees to the following: (i) the recipient's use of the > contents of this e-mail and any attachments shall comply with all > applicable laws, rules and regulations, including, without limitation, > U.S. international trade laws and regulations, and (ii) the recipient > may not transfer or otherwise export or re-export any information or > technology contained in this e-mail or any attachment except in full > compliance with the export controls administered by the U.S. and other > countries and any applicable import and use restrictions. >

1 0

STunnel client on Android?
by Marcel Bokhorst 08 Jun '10

08 Jun '10

Hi, Is it possible to use STunnel as client on Android? Regards, Marcel

2 1

stunnel 4.33 stops (crashes?) after undetermined running time
by Markus Borst 07 Jun '10

07 Jun '10

Hi, I have a strange problem with current stunnel (4.33): It just crashes after some time. The time is variable, I suspect it stops after a number of connections. System: - Windows Server 2003 SP2 (also happens on Windows Server 2008R2) - stunnel runs as service - stunnel is configured to run as ssl server for imap and pop3 with our certificate (including key-chain) stunnel was running fine for years on the Windows Server 2003. After upgrade to stunnel 4.33, the stunnel service process first worked fine, the just stopped working after some time: - The windows service "stunnel" was stopped - the stunnel.log (standard debug level) showed not error or other entry at the time of the stop. - The windows eventlog shows: ====== Event 7034, Service Control Manager The stunnel service terminated unexpectedly. It has done this 1 time(s). ====== (I'm not 100% sure, whether this event log message corresponds to the stunnel crash I described or to another crash.) I have downgrade to version 4.32, the stunnel service now runs uninterrupted as before. Since the time of crash varies somewhat, seemingly with the current load of the server, I suspect that stunnel crashes after a certain amount of ssl connections, but I'm not sure. This has happened on two different servers (Windows Server 2003 SP2 and Windows Server 2008 R2). Is this a known problem? I'd love to do some further tests, but since this is a production system, I cannot test it in our normal environment. A program to generate random ssl connections would come handy to further analyze the problem. Greetings Markus Borst -- TU Darmstadt Hochschulrechenzentrum (HRZ) Markus Borst Adresse: Petersentrasse 30, 64287 Darmstadt, Germany Tel.: 06151/16-2056 Email: M.Borst(a)hrz.tu-darmstadt.de

2 2

Three patches: DNS CommonName verification support, separated stderr/foreground options, and support for minimal ssl libs
by Tristan Schmelcher 07 Jun '10

07 Jun '10

Hello, Recently I started using stunnel in an embedded Linux product and I had need to add several features that I think other users would benefit from. I have attached them as separate patches against 4.33. I hereby release them into the public domain. Here is a description of each: stunnel-4.33-handle-minimal-ssl-libs.patch: Add support for building against a libssl/libcrypo that has had various non-essential features removed via the "no-<feature>" Configure options for openssl. This requires disabling non-essential Stunnel features at compile-time if they have dependencies on disabled libssl/libcrypto features. For memory-constrained embedded systems, this is a big win. With this patch I was able to cut the memory footprint of stunnel+openssl by about a third simply by disabling openssl features that I didn't need. stunnel-4.33-separate-stderr-option.patch This splits the stderr logging effect of the "foreground" option into a separate option named "stderr", so that users have the freedom to enable foreground without stderr logging, or vice versa. For backwards compatibility though, specifying foreground = yes implies stderr = yes unless followed in the config by stderr = no. This is useful on embedded Linux systems that lack an implementation of fork() (due to the processor not having an MMU), because on such systems every daemon has to be launched in a foreground mode and pre-daemonized with the simpler vfork() function, e.g. using "&" from a shell. In this mode, logging to stderr does not make sense, because in reality the process is still a daemon so the logging clutters the terminal. stunnel-4.33-dns-commonname-verify-support.patch: I saved the best for last. ;) This adds a "verify_dns" option to check the CommonName in peer certificates against their DNS name when verifying, much as web browsers do. I have seen posts from users asking for this feature in the past, so I think it's value is self-evident. I'd also like to take this opportunity to say that I'm a long-time user of Stunnel on my personal Linux desktop machine and it is a really excellent piece of software. Thank you for making it free and open source.

3 8

Stunnel supports ECC certificate?
by Bao, Robert 03 Jun '10

03 Jun '10

I searched the entire archive, couldn't find the answer/solution I am looking for. I have to post to this group, and appreciate any help/suggestion from any you. I use the latest 1.0.0 OpenSSL and 4.33 Stunnel. I used OpenSSL commands that very similar to what is described in the following link to create the ECC certificate and the private key file. http://src.opensolaris.org/source/xref/sfw/usr/src/lib/openssl/openssl-0 .9.8n/demos/ssltest-ecc/ECC-RSAcertgen.sh Start Stunnel, see the following errors: Key file: (actual path to the private key file)\HOST.KEY error stack: 140B3009 : error:140B3009:SSL routines:SSL_CTX_use_RSAPrivateKey_file:PEM lib SSL_CTX_use_RSAPrivateKey_file: 607907F: error:0607907F:digital envelope routines:EVP_PKEY_get1_RSA:expecting an rsa key There was a similar posting 4-5 years ago, and Mike answered it (the answer was: Stunnel didn't support ECC at that time). http://stunnel.mirt.net/pipermail/stunnel-users/2005-October/000817.html Seems like this is still true today. Then, when the ECC support will be added to Stunnel? If Stunnel already supports ECC certificate, how do I make it work? Thanks. Robert Bao Software House Tyco International 978-577-4202 Explore our new Tyco Online Learning Center Web-based Training Bundles at: www.swhouse.com/support/tyco_online_learning_center.aspx This e-mail may contain or have attached to it information or technology the export or re-export of which is restricted by U.S. laws and regulations. By viewing this e-mail and any attachments, the recipient agrees to the following: (i) the recipient's use of the contents of this e-mail and any attachments shall comply with all applicable laws, rules and regulations, including, without limitation, U.S. international trade laws and regulations, and (ii) the recipient may not transfer or otherwise export or re-export any information or technology contained in this e-mail or any attachment except in full compliance with the export controls administered by the U.S. and other countries and any applicable import and use restrictions.

1 0

deploy stunnel
by Arko-Quick, Patricia K 02 Jun '10

02 Jun '10

Is there a way to deploy stunnel to all users versus the current user logged in? I would like to deploy it with sms to all users of the machine.

1 0

Default for TIMEOUTidle?
by Markus Borst 27 May '10

27 May '10

I want to modify TIMEOUTidle in our configuration. To be sure to set it to sensible values, I need to know the default value, but I can't find it in the docs. Greetings Markus Borst -- TU Darmstadt Hochschulrechenzentrum (HRZ) Markus Borst Adresse: Petersentrasse 30, 64287 Darmstadt, Germany Tel.: 06151/16-2056 Email: M.Borst(a)hrz.tu-darmstadt.de

1 0

Transparent mode, alternative env.c
by Hans Werner Strube 25 May '10

25 May '10

The method for passing the remote address and port to an exec'ed program through getenv() calls in the preloaded libstunnel.so fails for programs that clean the environment initially. This can be circumvented placing getenv() in an _init() function and storing the results in static variables. Here is my alternative env.c (without the copyright and license), which I have been using for more than a year: * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * /* getpeername() can't be declared in the following includes */ #define getpeername no_getpeername #include <sys/types.h> #include <sys/socket.h> /* for AF_INET */ #include <netinet/in.h> #include <arpa/inet.h> /* for inet_addr() */ #include <stdlib.h> /* for getenv() */ #ifdef __BEOS__ #include <be/bone/arpa/inet.h> /* for AF_INET */ #include <be/bone/sys/socket.h> /* for AF_INET */ #else #include <sys/socket.h> /* for AF_INET */ #endif #undef getpeername static uint32_t rem_host=0; static uint16_t rem_port=0; /* Requires shared-library linking by ld, not cc (except with gcc -nostdlib) */ void _init() { char *value; if((value=getenv("REMOTE_HOST")) && *value != '\0') rem_host = inet_addr(value); if((value=getenv("REMOTE_PORT")) && *value != '\0') rem_port = htons(atoi(value)); } int getpeername(int s, struct sockaddr_in *name, int *len) { char *value; name->sin_family = AF_INET; name->sin_addr.s_addr = rem_host; name->sin_port = rem_port; return 0; } /* End of env.c */

1 0

STRLEN in common.h may be too small
by Hans Werner Strube 25 May '10

25 May '10

In common.h of stunnel-4.x, the parameter STRLEN (used for many buffers) is set to 256. This is insufficient in some cases, e.g., the CAPABILITY response of an IMAP server or the pathname of a file may be too long, resulting in errors. If you encounter such cases (e.g., messages "Input line too long"), increase STRLEN, e.g., to 512.

1 0

Using stunnel to RDP into a SSL-enabled Windows box
by Daren Krive 11 May '10

11 May '10

Hi everyone, First of all I apologize if this has been asked before or if I am totally misunderstanding the purpose of stunnel altogether. If so please bear with my ignorance. I am an IT consultant and I manage about 20+ Windows-based servers. Some of these servers are accessible via VPN while others are accessible directly via RDP over the Internet. For those that are exposed to the net I am using the SSL certificate feature of Remote Desktop by going into “Terminal Services Configuration” and configuring the connection to use an SSL (most of the time a self-signed cert). I can connect to these machines no problem from Windows and I get a “lock” icon in my RDP client. However I cannot connect to these machines using rdestkop under Ubuntu. I have determined that if I turn off the requirement to use SSL on the server side (and instead allow the connection to use the built-in encryption of RDP) then I am able to connect with rdesktop. I would very much like to avoid rebooting just to connect to these servers. I am also not willing to remove the requirement for the SSL connection. Is there a way I can use stunnel on my Ubuntu box to first establish a secure SSL connection and then use rdesktop over that connection? I have searched high and low for info on this and found nothing. I have found instructions on how to use the Windows version of stunnel to secure RDP but that isn’t what I am trying to do. The server is already using an SSL cert to encrypt the connection (not sure how many people know Windows 2003 and up can do this). I am looking to get around the apparent lack of SSL support in rdesktop. Best regards, Daren.

3 3

running as a windows service
by Graham Chiu 10 May '10

10 May '10

I downloaded and ran the windows binary 4.33. When I use the stunnel.pem it runs fine as a service. I created my own pem ( using Openssl on OpenSolaris ) and it won't run now as a service. I get a timeout message. If I then uninstall it as a service, and run it as an application, it works. Ideas on getting to run as a service with my pem? The log says nothing of note. -- Graham Chiu

2 1

Safari SSL Problems
by Rene Plattner 05 May '10

05 May '10

Hi, has anyone Problems with Safari? I habe Problems with Safari 3 + 4 on Windows with stunnel Version 4.27 + 4.33 Everytime if I want to connect to an SSL terminated (stunnel) webservice, Safari asks for an client certificate, allthough I set the option verify to default (=none). Kind regards, René Plattner -- -------------------------------------------------------------- Dipl.-Ing. René Plattner Zentraler Informatikdienst (Central IT-Services) Universität Innsbruck Technikerstrasse 23 Tel: ++43512/507-2360 6020 Innsbruck Fax: ++43512/507-2944 Austria E-Mail: rene.plattner(a)uibk.ac.at Homepage: http://www.uibk.ac.at/zid -------------------------------------------------------------- D92E 1AE3 A8AA 9A57 8E5B 9204 F5D0 95DB 4030 742D http://homepage.uibk.ac.at/~c1021058/keys/0x4030742D.pub --------------------------------------------------------------

1 0

zlib error in build for W32
by J F 04 May '10

04 May '10

Hi, I'm trying to build from source stunnel-4.33 for W32 in a machine with Debian lenny following the guidelines provided in INSTALL.W32. First I received complains from the compiler about zlib.h not found. Then I copied the zlib headers from /usr/include in include directory under openssl tree. Now openssl 1.0 compiles smoothly but when I try to compile stunnel I received the following error: i586-mingw32msvc-gcc -s -o stunnel.exe file.obj client.obj log.obj options.obj protocol.obj network.obj resolver.obj ssl.obj ctx.obj verify.obj sthreads.obj stunnel.obj gui.obj resources.obj -L/usr/src/openssl-1.0.0 -lzdll -lcrypto.dll -lssl.dll -lws2_32 -lgdi32 -mwindows /usr/lib/gcc/i586-mingw32msvc/4.2.1-sjlj/../../../../i586-mingw32msvc/bin/ld: cannot find -lzdll collect2: ld returned 1 exit status make: *** [stunnel.exe] Error 1 Am I doing some basic mistake? JF

2 1

How to start windows service with realtime priority?
by Ryan Dunn 20 Apr '10

20 Apr '10

I've been trying to figure out how to start the stunnel service on windows with a realtime priority, and so far, all attempts have failed. I've tried setting the ImagePath to 'start /realtime "C:\Program Files\stunnel\stunnel.exe" -service -install' and inserting that into a bat file and calling that instead, but that didn't work either. Does anyone know how to specify the startup priority of a windows service? Is that something that the program would need to support? Thanks, Ryan

1 0

newb: setting up and debugging a windows stunnel
by Jay Sprenkle 19 Apr '10

19 Apr '10

Good afternoon, I'm trying to use stunnel to secure a legacy application's communications. I can't seem to get it setup and working. Can anyone provide any hints where I'm going wrong? Here's what I'm trying to accomplish: A windows service on a client machine connects to a server on port 7000 using TCP. I'd like to encrypt the communication between client and server. Here's what I've tried: Created a new server that accepts ssl connections on port 7443. Got a certificate for the server and installed it. Installed stunnel on my windows machine (version 7.43 from the distribution archive file). Installed libssl32.dll and libeay32.dll in the same directory as stunnel.exe ( from the openssl-0.9.8h-1 binary distribution). Installed it as a service using "stunnel -install" Configured stunnel as follows: debug=7 output=C:\p4\internal\Utility\Proxy\proxy.log service=Proxy taskbar=no [exchange] accept=7000 client=yes connect=proxy.blah.com:7443 I changed my hosts file to trick the old application: server.blah.com 127.0.0.1 proxy.blah.com IP-address-of-server.blah.com "server.blah.com" now resolves to the machine it's running on (i.e. stunnel). "proxy.blah.com" goes to the real server. stunnel should connect to the server. I start the stunnel service and try to connect. It looks like it's working but the stunnel service just shuts down with no message. 2010.04.19 13:16:21 LOG5[4924:3716]: stunnel 4.33 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2010.04.19 13:16:21 LOG5[4924:3716]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2010.04.19 13:16:49 LOG5[4924:3748]: Service exchange accepted connection from 127.0.0.1:4134 2010.04.19 13:16:49 LOG6[4924:3748]: connect_blocking: connecting x.80.60.32:7443 2010.04.19 13:16:49 LOG5[4924:3748]: connect_blocking: connected x.80.60.32:7443 2010.04.19 13:16:49 LOG5[4924:3748]: Service exchange connected remote server from x.253.120.19:4135 2010.04.19 13:20:24 LOG5[3668:3856]: Reading configuration from file stunnel.conf 2010.04.19 13:20:24 LOG7[3668:3856]: Snagged 64 random bytes from C:/.rnd 2010.04.19 13:20:24 LOG7[3668:3856]: Wrote 1024 new random bytes to C:/.rnd 2010.04.19 13:20:24 LOG7[3668:3856]: RAND_status claims sufficient entropy for the PRNG 2010.04.19 13:20:24 LOG7[3668:3856]: PRNG seeded successfully 2010.04.19 13:20:24 LOG7[3668:3856]: SSL context initialized for service exchange 2010.04.19 13:20:24 LOG5[3668:3856]: Configuration successful 2010.04.19 13:20:24 LOG5[3668:3856]: No limit detected for the number of clients 2010.04.19 13:20:24 LOG7[3668:3856]: FD=312 in non-blocking mode 2010.04.19 13:20:24 LOG7[3668:3856]: Option SO_REUSEADDR set on accept socket 2010.04.19 13:20:24 LOG7[3668:3856]: Service exchange bound to 0.0.0.0:7000 2010.04.19 13:20:24 LOG7[3668:3856]: Service exchange opened FD=312 2010.04.19 13:20:24 LOG5[3668:3856]: stunnel 4.33 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2010.04.19 13:20:24 LOG5[3668:3856]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2010.04.19 13:21:02 LOG7[3668:4556]: Service exchange accepted FD=372 from 127.0.0.1:4156 2010.04.19 13:21:02 LOG7[3668:4556]: Creating a new thread 2010.04.19 13:21:02 LOG7[3668:4556]: New thread created 2010.04.19 13:21:02 LOG7[3668:3756]: Service exchange started 2010.04.19 13:21:02 LOG7[3668:3756]: FD=372 in non-blocking mode 2010.04.19 13:21:02 LOG5[3668:3756]: Service exchange accepted connection from 127.0.0.1:4156 2010.04.19 13:21:02 LOG7[3668:3756]: FD=396 in non-blocking mode 2010.04.19 13:21:02 LOG6[3668:3756]: connect_blocking: connecting x.80.60.32:7443 2010.04.19 13:21:02 LOG7[3668:3756]: connect_blocking: s_poll_wait x.80.60.32:7443: waiting 10 seconds 2010.04.19 13:21:02 LOG5[3668:3756]: connect_blocking: connected x.80.60.32:7443 2010.04.19 13:21:02 LOG5[3668:3756]: Service exchange connected remote server from x.253.120.19:4157 2010.04.19 13:21:02 LOG7[3668:3756]: Remote FD=396 initialized 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): before/connect initialization 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 write client hello A 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 read server hello A 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 read server certificate A 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 read server done A 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 write client key exchange A 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 write change cipher spec A 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 write finished A 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 flush data 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 read finished A The client thinks the connection is closed: No connection could be made because the target machine actively refused it 127.0.0.1:7000 at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot, SocketAddress socketAddress) at System.Net.Sockets.Socket.Connect(EndPoint remoteEP) at Service.ConnUtility.Connect() Any suggestions? Thanks

1 0

Stunnel connection from A to B but direction from B to A?
by Carsten Krüger 13 Apr '10

13 Apr '10

Hi, is it possible with stunnel to connect from host A to host B but to have the port redirection the other way? host A has a webserver on 127.0.0.1:80 host A connects to Host B (example.dyndns.org:8000) Host B opens a browser on page http://127.0.0.1:80 and reaches the webserver on A If yes, how do I have to configure A and B? The manpage didn't enlighten me. The normal way A connects to B and A reaches webserver on B works perfectly. greetings Carsten

2 1

multiple systems
by tony westenhofer 12 Apr '10

12 Apr '10

Hello, My currently working setup is using verify=2 (at client only )and the server1's info is in my .pem on the clients. This works fine, but if need to have server2 act as backup when server1 is down. Can I just add server2's info to the .pem or do I need to setup multiple files for the different keys? Thanks in advance for saving me some lab time! Noob _________________________________________________________________ The New Busy think 9 to 5 is a cute idea. Combine multiple calendars with Hotmail. http://www.windowslive.com/campaign/thenewbusy?tile=multicalendar&ocid=PID2…

1 0