- stunnel-users - stunnel.org

Help using stunnel for the first time
by Ian Baxter 09 Sep '08

09 Sep '08

Hi, I'm trying to use stunnel for the first time (on Mac OS X 10.5), and I'm not having much luck. First of all, I downloaded the source and installed stunnel successfully. I then setup a config file as follows (where myhost is the host i am connecting to): client=yes verify=0 [psuedo-https] accept=1515 connect=myhost:443 TIMEOUTclose = 0 Then, I run the following on the command line: /usr/local/bin/stunnel ./stunnel.config It appears that stunnel runs without error, and if I do 'ps aux | grep stunnel' there are 4 stunnel processes running. Then, as a test, I try to connect to port 1515 from my web browser by visiting https://localhost:1515, but it just hangs there... nothing. Any suggestions? Thanks! Ian

1 0

Re: [stunnel-users] A Calypso user needs your help with stunnel
by John Bryant 09 Sep '08

09 Sep '08

Dear Ludolf et al: Thank you very much for your recent communication. I drew up what I thought I needed, based on your answer, in the configuration file. As might be expected in that I'm a novice at this, I still have a few more questions: 1. I tried it with and without the "Authentification stuff". Either way, after modifying stunnel.conf, and running stunnel.exe, stunnel.exe bombed with the following error: "Stunnel server down" (log said: ************** 2008.09.02 14:20:17 LOG7[16442455:16274811]: RAND_status claims sufficient entropy for the PRNG 2008.09.02 14:20:17 LOG7[16442455:16274811]: PRNG seeded successfully 2008.09.02 14:20:17 LOG3[16442455:16274811]: Error loading verify certificates from certs.pem 2008.09.02 14:20:17 LOG3[16442455:16274811]: error stack: B084002 : error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib 2008.09.02 14:20:17 LOG3[16442455:16274811]: error stack: 2006D080 : error:2006D080:BIO routines:BIO_new_file:no such file 2008.09.02 14:20:17 LOG3[16442455:16274811]: SSL_CTX_load_verify_locations: 2001002: error:02001002:system library:fopen:No such file or directory 2008.09.02 14:20:17 LOG3[16442455:16274811]: Server is down What caused this? ************** 2. My other question is: Do I need to put stunnel.exe in the startup folder? Does it automatically reference stunnel.conf (that is what I was assuming)? When I get it to run correctly, automatically referencing stunnel, conf, then can I run Calypso with the settings changed to tie in with the stunnel conf file? All of the above I was assuming was true, but I'm just asking to make sure. Thanks! Lenny

3 6

Respawn stunnel
by Joe Kemp 08 Sep '08

08 Sep '08

What is the best way to setup stunnel to respawn if it crashes? I have looked at inittab (probably would have to have stunnel run in foreground?) or the procautostart.cpp utility. Any other ideas? Is there an easier way. Joe A. Kemp CapWIN Senior Systems Architect (O) 301-614-3727 (C) 301-502-1281

2 1

Re: [stunnel-users] Scripting stunnel to load automatically when OS X 10.5 server starts up -plist
by Christopher Hunt 04 Sep '08

04 Sep '08

On 04/09/2008, at 8:00 PM, stunnel-users-request(a)mirt.net wrote: > Here is my plist. I put this in /Library/LaunchDaemons. What do you > think? --Thanks, Allen Firstly have you considered using Lingon to maintain your plist? That could help you. > <?xml version="1.0" encoding="UTF-8"?> > <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd > "> > <plist version="1.0"> > <dict> > <key>KeepAlive</key> > <true/> > <key>Label</key> > <string>stunnel_startup</string> > <key>ProgramArguments</key> > <array> > <string>/opt/local/bin/stunnel</string> > </array> > <key>RunAtLoad</key> > <true/> > </dict> > </plist> The most obvious thing that stands out is that you aren't supplying a config file argument to stunnel. How's it going to locate your config file? You might want to check your system.log file using the Console application and watch for messages. You also need to use launchctl to load your plist - Lingon makes this pretty straightforward. Cheers, -C

1 0

Scripting stunnel to load automatically when OS X 10.5 server starts up -plist
by Allen 03 Sep '08

03 Sep '08

Thank you Chris and Tom, for your responses, Here is my plist. I put this in /Library/LaunchDaemons. What do you think? --Thanks, Allen <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd "> <plist version="1.0"> <dict> <key>KeepAlive</key> <true/> <key>Label</key> <string>stunnel_startup</string> <key>ProgramArguments</key> <array> <string>/opt/local/bin/stunnel</string> </array> <key>RunAtLoad</key> <true/> </dict> </plist>

1 1

Re: [stunnel-users] Scripting stunnel to load automatically when OS X 10.5 server starts up -any solution?
by Christopher Hunt 03 Sep '08

03 Sep '08

On 03/09/2008, at 8:00 PM, stunnel-users-request(a)mirt.net wrote: > Does anybody have a solution that will start up stunnel on OS X > bootup? ... Sounds to me like a launchd config error. How about sending through the plist? Cheers, -C

2 1

Starting stunnel automatically on OS X system startup
by Allen 02 Sep '08

02 Sep '08

Does anybody have a solution that will start up stunnel on OS X bootup? I've installed stunnel on a Leopard server (OS 10.4.5.4) to make a smtp SSL relay work (and it works fine). The problem is, we'd have to type in /opt/local/bin/stunnel on the command line every time the server is rebooted. Rather than having to create a /Library/ SystemStartup/diretory_structure_with_plist_etc., has somebody done this, and can lead me in the right direction, in the interest of time? I've just run out of time, and I kinda think that somebody must have done this already. Thanks! Allen

1 1

A Calypso user needs your help with stunnel
by John Bryant 02 Sep '08

02 Sep '08

Dear folks: I am trying to install stunnel so that I can have an SSL capability with Calypso. I was guided to the stunnel.org site by instructions at: http://www.windowsbbs.com/courier-email-client/35188-ssl-connection-really-…. (the instructions that I am referring to are duplicated below, under the first line of asterisks - they mention later versions of stunnel, but do not update their instructions for them adequately) I could not understand the instructions at your site that told about modifying the conf file with the LATEST version of stunnel.exe, which I did download and install and that's as far as I got - couldn't understand the options as clearly as I had the others, so uninstalled it.) (Tried downloading the OLD version, 4.05 exe, mentioned in the instructions and the two dll files,and making all the changes to THAT conf.txt file, etc, but THAT did not work because when I ran the shortcut to the conf.txt file that I had put in the Start folder, the computer gave me, when connected, a "cannot find 1 1/4 dll" message, and then an "illegal op" and a "cannot run due to restrictions on your computer" message (when not connected, just the latter two). I know you don't want to hear about old versions but it was logical for me to try since I could not figure out how to use the latest version.) So what do I do now? Thanks! Lenora (do not give up on me, I have computers in my background, etc. etc) ************** (Excerpts from the thread at the url listed above) http://www.windowsbbs.com/courier-email-client/35188-ssl-connection-really-… A week ago I provided instructions for using stunnel to provide SSL functionality for Calypso/Courier - in case your email provider requires SSL, which Calypso and Courier do not yet support. Those instructions were correct if your email provider uses the dedicated SSL ports - 465 for smtps, 995 for pop3s, 993 for imap4s. They were incomplete if your email provider uses the standard ports - 25 for smtp, 110 for pop3, [N/A - 143 for imap4]. Normally when the SSL ports are being used the entire conversation is encrypted with SSL. stunnel will initiate the session with the standard SSL protocol. However, if the standard ports are being used the session is initiated without SSL and then switches to SSL using an smtp or pop3 specific protocol (STARTTLS or STLS). stunnel needs to be told this, or it wont work on the standard ports. For the standard ports an extra line is required in the configuration file. To use stunnel do the following: 1) download the following files from http://www.stunnel.org/download/binaries.html stunnel-4.05.exe (version may be higher when you go there) libssl32.dll libeay32.dll and put them into a directory such as C:\Program Files\Stunnel\ 2) create a shortcut to stunnel-4.05.exe in the same directory [in WinXP do this by right clicking on it and selecting Create Shortcut] 3) edit the shortcut by right clicking on it and selecting Properties Modify the Target to look like this "C:\Program Files\Stunnel\stunnel-4.05.exe" stunnel-conf.txt (Optional) Rename the shortcut to remove the "Shortcut to ". 4) create the file stunnel-conf.txt in the same directory, and put the following lines in it: ----starting with next line---- # GLOBAL OPTIONS client = yes output = stunnel-log.txt debug=4 taskbar = yes # SERVICE-LEVEL OPTIONS [POP3 (ISP name)] accept = 127.0.0.1:108 connect = myISPs.POP3server.net:995 [SMTP (ISP name)] accept = 127.0.0.1:107 connect = myISPs.SMTPserver.net:465 ----ending with previous line---- Change the server names (before colons), and perhaps ports (after colons), to be correct for your ISP. Change ISP name too. Save and exit. 4b) if your email provider uses standard ports for either smtp or pop3, make either or both of the following changes to your stunnel-conf.txt file: [POP3 (ISP name)] accept = 127.0.0.1:108 connect = myISPs.POP3server.net:110 protocol = pop3 [SMTP (ISP name)] accept = 127.0.0.1:107 connect = myISPs.SMTPserver.net:25 protocol = smtp Once again, change the server names (before colons) to be correct for your ISP. Change ISP name too. Save and exit. 4c) if you have two email providers requiring SSL you can add a second set of services like so: [POP3 (2nd ISP name)] accept = 127.0.0.1:106 connect = my2ndISPs.POP3server.net:995 [SMTP (2nd ISP name)] accept = 127.0.0.1:105 connect = my2ndISPs.SMTPserver.net:465 Each email provider requires its own two ports (e.g. 108+107, 106+105), but 2 email accounts at a single provider can share the same pair of ports. However, if an email provider only uses SSL for one of smtp or pop3, you only need one of the two service sections. Once again, change the server names (before colons) to be correct for your ISP. Change ISP name too. Save and exit. 5) put a copy of that shortcut into your Start Menu's Programs/Startup folder [normally, by dragging shortcut over Start button, over Programs, over Startup, then drop it in Startup list.] 6) edit your Calypso/Courier Account Properties to change your mail servers. Incoming: Port 108 Server 127.0.0.1 Outgoing: Port 107 Server 127.0.0.1 [this is done differently for Calypso and Courier, due to Courier's new approach to SMTP servers] If an email provider only uses SSL for one of smtp or pop3, you only need to change one of the two mail servers. If you set up more than one email provider for SSL, change each account's properties to the corresponding ports. Now when you check or send email Calypso/Courier will communicate with stunnel, which will connect to your ISP's mail servers via SSL. The shortcut in Startup will rerun stunnel each time you reboot. You should just double-click on the shortcut in the program folder to run stunnel the first time. Hope this helps. Greg ************* Later addition (later on same thread): I just reinstalled all of my computer and I forgot to backup my sTunnel config! Anyway, the instructions have changed a bit as of sTunnel version 4.12... sTunnel is now distributed as an installer EXE, and the auxiliary DLLs are installed by default. The only step that really changes is step 1. All you have to do is to download the sTunnel installer and run it. There is no need to download the other files. The rest stays pretty much the same. ********** Question from somebody: First of all, I want to thank you for posting this very useful 'how to' -- this is what foruming is all about I have two questions (for anyone): 1. When using Stunnel, does it completely encrypt the user name, password, and the contents of the email, or just the contents? 2. The Stunnel website (www.stunnel.org) mentions that you'd also need the OpenSSL Libraries to make it work. But I did not download them, and still managed to make the Stunnel work with Courier. Am I (still) missing something? ************ Answer: 1. stunnel establishes an ssl tunnel (hence the name) between your computer and the email server. So every byte travelling between the two is encrypted. It's like establishing a VPN between your computer and the server. 2. As gmagana posted at the start of the month, they seem to have enhanced the installation process - such that you don't need to worry about the extra files. Isn't open source great! ********* Final comment: Looks like I can finally use Courier with Google's Gmail (http://gmail.google.com) to send/receive encrypted email. (End of excerpts)

2 1

Re: [stunnel-users] failed to build stunnel 4.25 under VS 2005
by Michal Trojnara 29 Aug '08

29 Aug '08

On Fri, 29 Aug 2008 00:00:56 +0800, "Ericdai" <pcix133(a)hotmail.com> wrote: > I try to build Stunnel 4.25 under VS2005 ,but failed Today I updated stunnel, so it can be built with Visual C++ 2008 (known also as Visual C++ 9.0). My plan is to release stunnel 4.26 next week. > prototypes.h(428) : error C2081: 'socklen_t' : name in formal > parameter list illegal I had no problem with socklen_t. Maybe it's specific to the old version of Visual C++. > I also suggest build a windows client only version > n It only can be running on windows > n It only can act as a client > n I think it can reduce the code size and runtime footprice smaller Not really. The difference would be negligible. Best regards, Mike

1 0

failed to build stunnel 4.25 under VS 2005
by Ericdai 28 Aug '08

28 Aug '08

I try to build Stunnel 4.25 under VS2005 ,but failed cl -MD -W3 -Ox -O2 -Ob2 -Gs0 -GF -Gy -GL -nologo -I"..\..\ssl\inc32" -DUSE_WIN32 -D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE -DHAVE_GETADDRINFO -DHAVE_GETNAMEINFO -D_MBCS /c stunnel.c stunnel.c prototypes.h(428) : error C2081: 'socklen_t' : name in formal parameter list illegal stunnel.c(206) : error C2065: 'socklen_t' : undeclared identifier stunnel.c(206) : error C2146: syntax error : missing ';' before identifier 'addrlen' stunnel.c(206) : error C2065: 'addrlen' : undeclared identifier I use nmake -f vc.mak to do it Anyone has build it successfully ,pls help me ! Another way ,is there a stunnel solution or project file ? I also suggest build a windows client only version n It only can be running on windows n It only can act as a client n I think it can reduce the code size and runtime footprice smaller Thanks and best regards Eric dai

1 0

Re: [stunnel-users] In chrooted environment system times defaults to UTC
by Ivan Lezhnjov Jr. 22 Aug '08

22 Aug '08

Friday 22 August 2008 you wrote: > I noticed that when running stunnel from within the jail it logs its > messages with syslong using UTC. > > My question is how would one reconcile timezone of chrooted stunnel with a > system one? > > The issue illustrated: > > Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: stunnel 4.17 on > i686-pc-linux-gnu with OpenSSL 0.9.8h 28 May 2008 > Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: Threading:PTHREAD > SSL:ENGINE Sockets:POLL,IPv4 > Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: 500 clients > allowed Aug 22 12:29:40 xerxes stunnel: LOG5[26570:3086773168]: 5101 > connected from 127.0.0.1:1469 > Aug 22 09:29:40 xerxes stunnel: LOG5[26570:3086773168]: VERIFY OK: > depth=0, /C=UA/ST=ARC/L=Simferopol/O=HOMELAB/CN=sega.localnet > > xerxes' localtime is GMT+3 and sega's too, but stunnel runs on sega in > chrooted environment and thus uses UTC (if it's not chrooted it reports > localtime to syslog facility). > > Any ideas? Jee that was simple! cp /etc/localtime /var/lib/stunnel/etc/ (on each machine where stunnel runs) and you're done :^) -- Ivan Lezhnjov Jr. Europe, Ukraine, Simferopol Running Source Mage GNU/Linux, kernel version 2.6.24 build #5 +----------------------------------------------------------------------+ Key ID 0x5811D90C Key Fingerprint 2A52 5C8C 38BE C04F D8DE A169 19E2 E49A 5811 D90C Use GPG Exercise Your Right To Privacy

1 0

In chrooted environment system times defaults to UTC
by Ivan Lezhnjov Jr. 22 Aug '08

22 Aug '08

I noticed that when running stunnel from within the jail it logs its messages with syslong using UTC. My question is how would one reconcile timezone of chrooted stunnel with a system one? The issue illustrated: Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: stunnel 4.17 on i686-pc-linux-gnu with OpenSSL 0.9.8h 28 May 2008 Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: 500 clients allowed Aug 22 12:29:40 xerxes stunnel: LOG5[26570:3086773168]: 5101 connected from 127.0.0.1:1469 Aug 22 09:29:40 xerxes stunnel: LOG5[26570:3086773168]: VERIFY OK: depth=0, /C=UA/ST=ARC/L=Simferopol/O=HOMELAB/CN=sega.localnet xerxes' localtime is GMT+3 and sega's too, but stunnel runs on sega in chrooted environment and thus uses UTC (if it's not chrooted it reports localtime to syslog facility). Any ideas? -- Ivan Lezhnjov Jr. Europe, Ukraine, Simferopol Running Source Mage GNU/Linux, kernel version 2.6.24 build #5 +----------------------------------------------------------------------+ Key ID 0x5811D90C Key Fingerprint 2A52 5C8C 38BE C04F D8DE A169 19E2 E49A 5811 D90C Use GPG Exercise Your Right To Privacy

1 0

Certificates, Servers & Clients. Clarify this please.
by Ivan Lezhnjov Jr. 22 Aug '08

22 Aug '08

Now that I've read a bunch of articles and have seen a pile of examples of how pairs of a certificate and a private key can be created I must say they all suggest different approaches and techniques to creating certificates and ultimately bewildered me. Could anyone please explain as simply as possible, in layman's terms what exactly must be done? Let's talk about simple scenario with two hosts (A & B) involved, both running stunnel. Let us assume host A is the server and host B is the client. cert = CAfile = must be created. And we use verify level 3 (verify = 3) So, what exactly do we do now? And what happens in the dialog between these two machines? -- Ivan Lezhnjov Jr. Europe, Ukraine, Simferopol Running Source Mage GNU/Linux, kernel version 2.6.24 build #5 +----------------------------------------------------------------------+ Key ID 0x5811D90C Key Fingerprint 2A52 5C8C 38BE C04F D8DE A169 19E2 E49A 5811 D90C Use GPG Exercise Your Right To Privacy

1 0

Can't start stunnel (dies mysteriously)
by Ivan Lezhnjov Jr. 19 Aug '08

19 Aug '08

Hello there I run stunnel version 4.21 and openssl version 0.9.8h. In my setup I aim to create a tunnel to send log files through to a centralized loghost. Host A (loghost) runs Source Mage GNU/Linux (with stunnel 4.21, openssl 0.9.8h) and host B runs Slackware 11 system (with stunnel 4.17, openssl 0.9.8h). The problem is that stunnel starts on host B but won't start on host A. Here's the snippet of /var/log/messages that records stunnel start-up event: root@sega:/home/users/ilj % stunnel && tail /var/log/messages -n 3 Aug 19 16:17:37 sega stunnel: LOG5[29146:3082634944]: stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.8h 28 May 2008 Aug 19 16:17:37 sega stunnel: LOG5[29146:3082634944]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Aug 19 16:17:37 sega stunnel: LOG5[29146:3082634944]: 500 clients allowed I've actually been trying to run stunnel for the first time ever so I don't really know if this output confirms that everything is alright but judging solely from what is put in log file it seems stunnel has started successfully. Unfortunately, this isn't quite true root@sega:/home/users/ilj % ps ax | grep stun 29618 pts/4 R+ 0:00 grep stun So, this is the problem I have. It doesn't start on host A. Host A has the following stunnel configuration: root@sega:/home/users/ilj % cat /etc/stunnel/stunnel.conf cert = /etc/stunnel/syslog-ng-server.pem CAfile = /etc/stunnel/syslog-ng-client.pem verify = 3 [5101] accept = 217.117.75.2:5101 connect = 127.0.0.1:1999 Host B sports a little bit different configuration file: root@xerxes:~ % cat /etc/stunnel/stunnel.conf client = yes cert = /etc/stunnel/syslog-ng-client.pem CAfile = /etc/stunnel/syslog-ng-server.pem verify = 3 [5101] accept = 127.0.0.1:1999 connect = 217.117.75.2:5101 On both hosts (A & B) I run stunnel standalone as root. > 4. Output of "stunnel -f -D 7 <your-parameters>". Erm.. it doesn't seem to work for me. There's no -D parameter according to man stunnel. The following information below is about host A only: root@sega:/home/users/ilj % stunnel -version stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.8h 28 May 2008 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /usr/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none root@sega:/home/users/ilj % uname -a Linux sega 2.6.24 #5 SMP PREEMPT Wed May 7 18:22:29 EEST 2008 i686 GNU/Linux root@sega:/home/users/ilj % gaze from /usr/lib/libc.a glibc-2.7:/usr/lib/libc.a root@sega:/home/users/ilj % gcc -v Reading specs from /usr/lib/gcc/i686-pc-linux-gnu/4.2.3/specs Target: i686-pc-linux-gnu Configured with: /usr/src/gcc-4.2.3/configure --host=i686-pc-linux-gnu --prefix=/usr --infodir=/usr/share/info --mandir=/usr/share/man --enable-threads=posix --with-system-zlib Thread model: posix gcc version 4.2.3 root@sega:/home/users/ilj % gaze installed | grep openssl openssl:20080615:installed:0.9.8h -- Ivan Lezhnjov Jr. Europe, Ukraine, Simferopol Running Source Mage GNU/Linux, kernel version 2.6.24 build #5 +----------------------------------------------------------------------+ Key ID 0x5811D90C Key Fingerprint 2A52 5C8C 38BE C04F D8DE A169 19E2 E49A 5811 D90C Use GPG Exercise Your Right To Privacy

1 0

Disable libwrap at runtime?
by Jans, Kert 16 Aug '08

16 Aug '08

Hi, Is it possible to disable libwrap support at runtime? I've reviewed the archives and documentation and cannot determine if this is possible. I know it is possible to compile-out support for libwrap by using: configure --disable-libwrap Is compiling-out support the only way? I'd like to disable support in a pre-build version of stunnel. Regards, Kert

2 1

Re: [stunnel-users] Mutual SSL Authentication
by Christopher Hunt 15 Aug '08

15 Aug '08

Ah ha - "verify = 3" - thanks! On 15/08/2008, at 9:12 AM, Brian Hatch wrote: >> > Mutual authentication uses the verify option on both > ends, rather than just on one end. Both sides verify, > and both sides present a certificate.

2 1

Re: [stunnel-users] Mutual SSL Authentication
by Christopher Hunt 14 Aug '08

14 Aug '08

On 14/08/2008, at 8:00 PM, Michal.Trojnara(a)mobi-com.net wrote: > Sure. Stunnel supports mutual SSL authentication. > Please read the fine manual for details. Hi Mike, Thanks for the reply. I did quite a lot of trawling on the web, your website and the stunnel man pages and couldn't find any guidance on mutual ssl authentication configuration. Are you able to give me a pointer, perhaps a URL to something that contains an example? Thanks again. Cheers, -C

1 0

Stunnel connection drops after four http requests
by Renner, Christopher R 13 Aug '08

13 Aug '08

With quite a bit of help from a list member here, I have stunnel 4.25 running on OSX 1.5.4 (PHP development environment). Problem is I can only get four http requests to the server before the connection is dropped. Stunnel is still running in the background.

1 0

Mutual SSL Authentication
by Christopher Hunt 13 Aug '08

13 Aug '08

Hi there, Does stunnel have any in-built support for mutual SSL authentication? If not are there plans to incorporate support? Cheers, -C

2 1

question
by Ted Ehrlich 12 Aug '08

12 Aug '08

1 0

OSX 10.5 install?
by Renner, Christopher R 11 Aug '08

11 Aug '08

> >> Hi, >> >> New list member here. I¹m going through the archives now, and have Googled >> my way to exhaustion, looking for up-to-date instructions to install stunnel >> on a Mac desktop. >> >> I do PHP web application development and need to be able to connect to a NAS >> space via stunnel on my desktop dev environment in order to simulate the live >> environment. >> >> Does anyone 1) have a link to current OSX install instructions, or 2) care to >> share such instructions with me off the top of your head? >> >> I tried working through this darwinports page ( >> http://stunnel.darwinports.com/) but 1) it sends me to Macports.org for the >> .dmg file thereby installing macports and not darwinports....and after that >> the ³port² command is unrecognized in terminal when trying to install >> stunnel. >> >> >> Thanks. >>

2 1

Socket connection status
by Jeffrey Buck 08 Aug '08

08 Aug '08

Hi, I'm running stunnel 4.04 on ia64-redhat-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003. I have basically taken a generic TCP interface and implemented a STUNNEL client/server setup to allow the connection to transfer data using SSL. I have an issue with checking the status of the connection when a connection attempt is made. We are using ObjectSpace libraries for all of our tcp related connections so I don't have the low level calls that are actually being made, but here is a brief description of what is happenning.... We create an os_tcp_socket object and call the connect_to() method. This establishes a connection to the stunnel client on my local machine....which in turn makes the connection the the stunnel server on the remote machine. The problem I'm am having is when I can't get to the remote machine. After the connect_to() call, we check the status of the socket and unless I sleep for 5-10 seconds, it always seems to think that the connection is ok...which kind-of makes sense because it is able to connect to the stunnel client port since it is local...but in fact, if there isn't access to the remote machine, eventually stunnel will close that initial connection to that socket (that where the 5-10 second delay seems to help). The status I really want is weather or not the entire connection was successful through stunnel to the remote machine. Is there a better way to do this other than putting a sleep() in. Right now I have a 10 second sleep in between the connect_to() call and the status check on the local/client stunnel TCP port. That seems to be enough time for stunnel to attept to complete the connection and kill the connection to it's local/client port so that when I check the status of it, it comes back bad. If this is the best way to do it...what is the amount of time needed for stunnel to attempt to complete it's connection to the remote machine? Thanks! Jeff

2 3

Yahoo SSL
by Bernie Murciano 29 Jul '08

29 Jul '08

1 0

Re: [stunnel-users] help with stunnell
by Ludolf Holzheid 28 Jul '08

28 Jul '08

On Thu, 2008-07-24 23:37:22 -0700, vinodsreehari(a)yahoo.com wrote: > [..] > > I configured stnnel in one server as server mode ,for accepting > connection on 8070 ,and connect to 80 . It works only if i specify > https://ipaddress:8070 This is because the default port for https is 443. If you'd configure stunnel to accept on port 443, `https://ipaddress' would work. > I have configured one client server also to accept connection on 80 > and redirect to teh 8070 of server. I want to know that is that teh > way its working . If there is a stunnel instance on the client machine accepting connections on port 80 and connecting to the web server at the https port (default or not), a user could specify `http://localhost' to connect to the web server (and the traffic between the client machine and the server would be secured). > And is it possible to implement the same in a live enviroment ,in > which teh webserver will run on different port ,but users dont need > to specify the port number . Yes. As soon as the destination port for the 'first hop' of a redirected/tunneled connection is the default port for the protocol in question, there is no need to specify the port number. The port numbers of 'intermediate hops' are configuration options for the two stunnel instances (in this case), so the user dosn't have to care about them. HTH, Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Re: [stunnel-users] Wrong documentation
by Sandeep Kumar 25 Jul '08

25 Jul '08

On Thu, Jul 24, 2008 at 9:39 PM, Brian Hatch <bri(a)stunnel.org> wrote: > In the neigborhood of 2008-07-24 09:40 +0530, Sandeep Kumar mentioned: > > > Look at this page > http://www.stunnel.org/faq/stunnel.html#configuration_file > > In service level options section, under the explanation of "CRLpath" it > is > > said that all files in it should be of the form XXXXXXXX.0. But my > stunnnel > > setup worked only when i names as XXXXXXXX.r0 instead of XXXXXXXX.0. > > What version of openssl are you running? stunnel 4.15 with OpenSSL 0.9.8b > > > > -- > Brian Hatch "Have you asked Kirk if > Systems and he'd like the job?" > Security Engineer "You can't hide from me! > http://www.ifokr.org/bri/ I will find you. > > Every message PGP signed > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.2.1 (GNU/Linux) > > iD8DBQFIiKlFVkMj8/ymYEsRAmKxAJ9CTLp0Xi8n1VxdFup/kBUuZe6scwCfcvyu > WQG8BlfrUV8RcP31/ZUEbJk= > =EBgc > -----END PGP SIGNATURE----- > > -- Sandeep Kumar http://students.iiit.ac.in/~sandeep_kr

1 0

Help on configuring Stunnel
by Patel Dippen-CDP054 24 Jul '08

24 Jul '08

I downloaded the pre-compiled Windows version of Stunnel (stunnel-4.25-installer.exe). We need to deploy this on 2 machines A and B. The way it works is: - B connects to A - then A connects to B How should I configure Stunnel on machine A, since, in the first case A is the Server and in the 2nd scenario A becomes the Client. Questions on deploying Stunnel on machine A: - Can I run just 1 instance of Stunnel on machine A? It seems I cannot since I have to set the "client = yes" in the 2nd scenario - Do I need to run multiple instances, 1 running as the Server and the 2nd as the Client? Here is the config file I used on the machine A: **************************** cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [iPerfS] accept = 5010 connect = 127.0.0.1:5001 [iPerfS] accept = 5002 connect = 12.50.0.25:5020 **************************** Here is the config file I used on the machine B: **************************** cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [iPerfC] accept = 5001 connect = 12.50.0.26:5010 [iPerfS] accept = 5020 connect = 127.0.0.1:5002 **************************** Regards, Dippen

1 0

Stunnel 4.24 patch to allow stunnel to search for the OCSP responder within an X.509 certificate's AIA extension.
by Bruce Keats 24 Jul '08

24 Jul '08

Hi all, This patch also fixes a problem with stunnel accepting an "unknown" response as "good" and allows the connection to be setup. An OCSP responder can return one of three responses (good, revoked, unknown), however the code would accept "unknown" as good. This patch fixes that problem and treats an "unknown" response as a failure. Stunnel can query an OCSP responder to determine the revocation status of a certificate when stunnel is verifying the certificate. The code works great, however it is uses a preconfigured OCSP responder. The OCSP responder's IP/hostname is specified in the stunnel configuration file as a URI. I found this rather restrictive, so I added code to extract the OCSP responder's URI from the certificate. As per RFC 3280, one of the valid extensions for X.509 certificate is the Authority Information Access (AIA) where the "accessMethod" can be "is-ad-ocsp" to identify the OCSP responders location as per RFC2560. There can be more than one OCSP responder listed in the AIA because it is a sequence. Each location is queried in the order they appear within the certificate until either a "good" or "revoked" response is received. If an "known" response or a failure then the next OCSP responder is checked. If all OCSP responder queries result in failure then the validation also fails.. A new configuration option "OCSPaia" was added. If the "OCSPaia=yes" then the stunnel will look for the OCSP responder(s) within the certificate's AIA. The locally configured "OCSP=<url>" overrides the OCSPaia option. Bruce

1 0

Wrong documentation
by Sandeep Kumar 24 Jul '08

24 Jul '08

Look at this page http://www.stunnel.org/faq/stunnel.html#configuration_file In service level options section, under the explanation of "CRLpath" it is said that all files in it should be of the form XXXXXXXX.0. But my stunnnel setup worked only when i names as XXXXXXXX.r0 instead of XXXXXXXX.0. -- Sandeep Kumar http://students.iiit.ac.in/~sandeep_kr

1 0

help with stunnel port forwarding
by vinod bhasi 23 Jul '08

23 Jul '08

Hi, Please help me with stunnel port forwarding . My apache is running at port 8000 .I want this to be forwarded to 80 so that normal users dont need to specify the port number . Can anyone help me with the configuration in both client and server side .Im confused as stunnel wont run with same port used by apache. Any help will be appreciated Thanks in advancve Vinod Bhasi Did you know? You can CHAT without downloading messenger. Go to http://in.webmessenger.yahoo.com/

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 48, Issue 13
by Patrick Dung 21 Jul '08

21 Jul '08

Message: 3 Date: Mon, 21 Jul 2008 11:34:22 +0200 From: Micha? Trojnara <Michal.Trojnara(a)mobi-com.net> Subject: Re: [stunnel-users] Problem with Solaris 10u5 x86 and Stunnel 4.25 To: stunnel-users(a)mirt.net Message-ID: <2a3f79f5f6dd65f2ced02b2e9929368b(a)mirt.net> Content-Type: text/plain; charset="UTF-8" http://stunnel.mirt.net/pipermail/stunnel-users/2008-June/002021.html Mike On Sat, 19 Jul 2008 01:53:17 -0700 (PDT), Patrick Dung <patrick_dkt(a)yahoo.com.hk> wrote: > Hi > > I use this to compile stunnel: > The gcc and openssl is from Solaris SFW. > > # export CC=/usr/sfw/bin/gcc > # ./configure --with-threads=pthread --with-ssl=/usr/sfw > --localstatedir=/var > > After installing and starting stunnel, I found there are mutiple stunnel > processes. > There is a PID file which store one of the stunnel process. > I have tried to kill that PID, stunnel is bring down. > But there other stunnel processes running. > > Any ideas? > > Regards > Patrick > > > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users I see. Thanks for reply. Yesterday, I have tried to compile stunnel with Sun Studio. It got problem linking with libwrap, so I turned off libwrap support. And it compile (without knowing there is a libwrap patch) and there is only one single running stunnel process. Regards Patrick

1 0

stunnel exits silently on startup
by Luis López de Quintana 21 Jul '08

21 Jul '08

Problem: stunnel doesn't run: ldq@ldq:~$ stunnel4 /etc/stunnel.cnf ldq@ldq:~$ ps aux | grep stunnel ldq 15683 0.0 0.0 2332 1392 pts/0 S+ 11:08 0:00 man stunnel ldq 25289 0.0 0.0 1776 608 pts/1 S+ 11:59 0:00 grep stunnel stunnel.cnf: ldq@ldq:~$ cat /etc/stunnel.cnf client = yes debug = debug [nntps] accept = 127.0.0.1:1109 connect = news.giganews.com:443 Version: stunnel 4.140-5ubuntu1 libc6 ldq@ldq:~$ uname -a Linux ldq 2.6.18.5 SMP Thu May 8 01:31:23 UTC 2008 x86_64 GNU/Linux -- LdQ

2 2

Problem with Solaris 10u5 x86 and Stunnel 4.25
by Patrick Dung 19 Jul '08

19 Jul '08

Hi I use this to compile stunnel: The gcc and openssl is from Solaris SFW. # export CC=/usr/sfw/bin/gcc # ./configure --with-threads=pthread --with-ssl=/usr/sfw --localstatedir=/var After installing and starting stunnel, I found there are mutiple stunnel processes. There is a PID file which store one of the stunnel process. I have tried to kill that PID, stunnel is bring down. But there other stunnel processes running. Any ideas? Regards Patrick

1 0

Config Sanity Check
by Caplan, Michael 19 Jul '08

19 Jul '08

Hi There, I am working through an issue with a script that builds a socket connection to stunnel. Stunnel is being used to relay to an Apache web server. I'm building a localhost TCP connection on port 54322, and writing my HTTP data. When reading data back from the socket connection in my script I'm sometimes getting nothing, and other times getting the proper result. I can confirm that the web server is always receiving the request and returning a proper response. Wireshark shows SSL data being transmitted and received, so stunnel is doing its thing. However, the response does not seem to be relayed to my script on the other side of stunnel *sometimes*. My hunch is that I am doing something wrong with my script, but I am hoping that an stunnel guru can rule out any oddities with my stunnel setup. My config is below as well as the output of my log file. Any thoughts? Thanks! Mike cert = connector.pem debug = 7 output = c:\ssl.log ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [registerserver] client = yes accept =54321 connect =www.int.ddx.com:443 [connector2server] client = yes accept =54322 connect =asd.int.ddx.com:443 [server2connector] accept = 54323 connect = 9000 2008.07.18 21:41:41 LOG7[13648:13748]: Snagged 64 random bytes from C:/.rnd 2008.07.18 21:41:41 LOG7[13648:13748]: Wrote 1024 new random bytes to C:/.rnd 2008.07.18 21:41:41 LOG7[13648:13748]: RAND_status claims sufficient entropy for the PRNG 2008.07.18 21:41:41 LOG7[13648:13748]: PRNG seeded successfully 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate loaded 2008.07.18 21:41:41 LOG7[13648:13748]: Key file: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Private key loaded 2008.07.18 21:41:41 LOG7[13648:13748]: SSL context initialized for service registerserver 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate loaded 2008.07.18 21:41:41 LOG7[13648:13748]: Key file: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Private key loaded 2008.07.18 21:41:41 LOG7[13648:13748]: SSL context initialized for service connector2server 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate loaded 2008.07.18 21:41:41 LOG7[13648:13748]: Key file: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Private key loaded 2008.07.18 21:41:41 LOG7[13648:13748]: SSL context initialized for service server2connector 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate loaded 2008.07.18 21:41:41 LOG7[13648:13748]: Key file: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Private key loaded 2008.07.18 21:41:41 LOG7[13648:13748]: SSL context initialized for service test 2008.07.18 21:41:41 LOG5[13648:13748]: stunnel 4.25 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2008.07.18 21:41:41 LOG5[13648:13748]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2008.07.18 21:41:46 LOG7[13476:13096]: Snagged 64 random bytes from C:/.rnd 2008.07.18 21:41:47 LOG7[13476:13096]: Wrote 1024 new random bytes to C:/.rnd 2008.07.18 21:41:47 LOG7[13476:13096]: RAND_status claims sufficient entropy for the PRNG 2008.07.18 21:41:47 LOG7[13476:13096]: PRNG seeded successfully 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate loaded 2008.07.18 21:41:47 LOG7[13476:13096]: Key file: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Private key loaded 2008.07.18 21:41:47 LOG7[13476:13096]: SSL context initialized for service registerserver 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate loaded 2008.07.18 21:41:47 LOG7[13476:13096]: Key file: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Private key loaded 2008.07.18 21:41:47 LOG7[13476:13096]: SSL context initialized for service connector2server 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate loaded 2008.07.18 21:41:47 LOG7[13476:13096]: Key file: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Private key loaded 2008.07.18 21:41:47 LOG7[13476:13096]: SSL context initialized for service server2connector 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate loaded 2008.07.18 21:41:47 LOG7[13476:13096]: Key file: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Private key loaded 2008.07.18 21:41:47 LOG7[13476:13096]: SSL context initialized for service test 2008.07.18 21:41:47 LOG5[13476:13096]: stunnel 4.25 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2008.07.18 21:41:47 LOG5[13476:13096]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 Please consider the environment before printing this email. E-mail messages may contain viruses, worms, or other malicious code. By reading the message and opening any attachments, the recipient accepts full responsibility for taking protective action against such code. Henry Schein is not liable for any loss or damage arising from this message. The information in this email is confidential and may be legally privileged. It is intended solely for the addressee(s). Access to this e-mail by anyone else is unauthorized.

1 0

Difference between verify level 2 and 3
by Sandeep Kumar 16 Jul '08

16 Jul '08

Hi, I searched a lot on google, in the archives, and in the FAQ page, but could not find the differences between verify levels 2 and 3, other than the one line explanation given on the FAQ/man page. Specifically, I want to ask: 1. Is verify level 3 same as 2, but asks for client certificates as well? (Seems unlikely but still..) 2. Since verify level 2 also demands CApath/CAfile to be present, then it also is ultimately verifying against locally installed certs, which is supposed to be level 3's behaviour? Thanks & regards, Sandeep Kumar http://web.iiit.ac.in/~sandeep_kr

2 2

stunnel-portforwarding
by vinod bhasi 16 Jul '08

16 Jul '08

Hi All, I am a newbie as far as stunnel is concerned. I need help urgently on how to do port forwarding with Stunnel. Any help is appreciated. Thanks and Regards, Vinod Bhasi Save all your chat conversations. Find them online at http://in.messenger.yahoo.com/webmessengerpromo.php

1 0

SSL with SMTP problem - sTunnel 4.25 Windows
by dscycler 14 Jul '08

14 Jul '08

I am using sTunnel 4.25 for Windows to send and receive e-mail from a GoldMine client. sTunnel has worked well over the years but am having an issue with a particular mail host, Live Office. They have implemented SMTP SSL on port 25. The debug log is as follows: 2008.07.14 13:45:11 LOG7[2136:5356]: smtp accepted FD=224 from 127.0.0.1:1907 2008.07.14 13:45:11 LOG7[2136:5356]: Creating a new thread 2008.07.14 13:45:11 LOG7[2136:5356]: New thread created 2008.07.14 13:45:11 LOG7[2136:4944]: smtp started 2008.07.14 13:45:11 LOG7[2136:4944]: FD 224 in non-blocking mode 2008.07.14 13:45:11 LOG5[2136:4944]: smtp accepted connection from 127.0.0.1:1907 2008.07.14 13:45:11 LOG7[2136:4944]: FD 232 in non-blocking mode 2008.07.14 13:45:11 LOG7[2136:4944]: smtp connecting 64.70.94.196:25 2008.07.14 13:45:11 LOG7[2136:4944]: connect_wait: waiting 10 seconds 2008.07.14 13:45:11 LOG7[2136:4944]: connect_wait: connected 2008.07.14 13:45:11 LOG5[2136:4944]: smtp connected remote server from 127.0.0.1:1908 2008.07.14 13:45:11 LOG7[2136:4944]: Remote FD=232 initialized 2008.07.14 13:45:11 LOG7[2136:4944]: SSL state (connect): before/connect initialization 2008.07.14 13:45:11 LOG7[2136:4944]: SSL state (connect): SSLv3 write client hello A 2008.07.14 13:45:11 LOG7[2136:4944]: SSL alert (write): fatal: handshake failure 2008.07.14 13:45:11 LOG3[2136:4944]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2008.07.14 13:45:11 LOG5[2136:4944]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.07.14 13:45:11 LOG7[2136:4944]: smtp finished (0 left) I am looking for help to troubleshoot the connection problem. Is this an sTunnel issue or a mail server issue? Are there conf file settings to address the issue? Thanks, DavidS

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 48, Issue 8
by Pietro Di Primo 10 Jul '08

10 Jul '08

Thank you for reply. I tryied it but it doesn't work because my client run some separated subprocesses and are them that contact the server so, if an extern process try to connect to 127.0.0.1:<the_found_port> while one of that subprocess has finished and the next is not yet started, it will be able to do it and also my subprocess will be pending (i tryed it). Hope i was able to explain the situation. Any suggestion? Thanks in advace > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 9 Jul 2008 13:26:03 +0200 (CEST) > From: "Pietro Di Primo" <pietro.diprimo(a)ct.infn.it> > Subject: [stunnel-users] client-server tunnelling > To: stunnel-users(a)mirt.net > Message-ID: > <2553.193.206.208.201.1215602763.squirrel(a)imapfis.ct.infn.it> > Content-Type: text/plain;charset=utf-8 > > Hi, I have a client server application, and want to tunnel it in this way: > a script select a free port in a random way, write the stunnel.conf file. > with "accept=<the_found_port>" and "connect=<my_server>" and run my client > application passing to 127.0.0.1:<the_found_port> as server address. > The problem is that i need to be sure that no other client or user can > access <the_found_port> while the application is running. > I guess that it should be possible to do it, but i wasn't able to. > > Can anybody help me? > > Thanks > > > -- > --- > > Ing. Pietro Di Primo > INFN - Istituto Nazionale di Fisica Nucleare > Grid Computing Research Area > Via S. Sofia 78 95123 CATANIA (Italy) > Voice : +39 095 378-5446/5517 > Fax. : +39 095 378 5518 > Mobile : +39 320 8591527 > E-mail : pietro.diprimo(a)ct.infn.it > Skype : pietrodiprimo > > > > ------------------------------ > > Message: 2 > Date: Wed, 9 Jul 2008 14:08:23 +0200 > From: Micha? Trojnara <Michal.Trojnara(a)mobi-com.net> > Subject: Re: [stunnel-users] client-server tunnelling > To: stunnel-users(a)mirt.net > Message-ID: <6ba9f1b703149916bb1a61fb68a1e377(a)mirt.net> > Content-Type: text/plain; charset="UTF-8" > > > Pietro Di Primo wrote: >> Hi, I have a client server application, and want to tunnel it in this > way: >> a script select a free port in a random way, write the stunnel.conf >> file. >> with "accept=<the_found_port>" and "connect=<my_server>" and run my > client >> application passing to 127.0.0.1:<the_found_port> as server address. >> The problem is that i need to be sure that no other client or user can >> access <the_found_port> while the application is running. >> I guess that it should be possible to do it, but i wasn't able to. > > Simply bind the specific network interface with: > accept=127.0.0.1:<the_found_port> > > Best regards, > Mike > > > > ------------------------------ > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > End of stunnel-users Digest, Vol 48, Issue 8 > ******************************************** > -- --- Ing. Pietro Di Primo INFN - Istituto Nazionale di Fisica Nucleare Grid Computing Research Area Via S. Sofia 78 95123 CATANIA (Italy) Voice : +39 095 378-5446/5517 Fax. : +39 095 378 5518 Mobile : +39 320 8591527 E-mail : pietro.diprimo(a)ct.infn.it Skype : pietrodiprimo

1 0

client-server tunnelling
by Pietro Di Primo 09 Jul '08

09 Jul '08

Hi, I have a client server application, and want to tunnel it in this way: a script select a free port in a random way, write the stunnel.conf file. with "accept=<the_found_port>" and "connect=<my_server>" and run my client application passing to 127.0.0.1:<the_found_port> as server address. The problem is that i need to be sure that no other client or user can access <the_found_port> while the application is running. I guess that it should be possible to do it, but i wasn't able to. Can anybody help me? Thanks -- --- Ing. Pietro Di Primo INFN - Istituto Nazionale di Fisica Nucleare Grid Computing Research Area Via S. Sofia 78 95123 CATANIA (Italy) Voice : +39 095 378-5446/5517 Fax. : +39 095 378 5518 Mobile : +39 320 8591527 E-mail : pietro.diprimo(a)ct.infn.it Skype : pietrodiprimo

1 0

FW: how to start ??
by dominique 07 Jul '08

07 Jul '08

Hello, First time I am using stunnel. 1. The issue I had is with Altiris and Exchange. All our Exchange Servers are SSL now and Altiris is not-SSL. Altiris is reading an exchange mailbox and gives back an error : "Error receiving data from socket". So the infrastructure is composed of two servers one Altiris Server not-SSL which is attempting to communicate to an Exchange Server with SSL. The Altiris Server is trying to read the email in one mailbox hosted by an Exchange SSL Server 2. Stunnel 4.25 x86-pc-mingw32-gnu with openssl 0.9.8h 28 May 2008 3. Windows 2003 Server environment 4. stunnel -d -r 5. 2008.07.07 13:34:41 LOG7[4748:1676]: RAND_status claims sufficient entropy for the PRNG 2008.07.07 13:34:41 LOG7[4748:1676]: PRNG seeded successfully 2008.07.07 13:34:41 LOG7[4748:1676]: Certificate: stunnel.pem 2008.07.07 13:34:41 LOG7[4748:1676]: Certificate loaded 2008.07.07 13:34:41 LOG7[4748:1676]: Key file: stunnel.pem 2008.07.07 13:34:41 LOG7[4748:1676]: Private key loaded 2008.07.07 13:34:41 LOG7[4748:1676]: SSL context initialized for service pop3 2008.07.07 13:34:41 LOG5[4748:1676]: stunnel 4.25 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2008.07.07 13:34:41 LOG5[4748:1676]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2008.07.07 13:34:41 LOG5[4748:3596]: No limit detected for the number of clients 2008.07.07 13:34:41 LOG7[4748:3596]: FD 284 in non-blocking mode 2008.07.07 13:34:41 LOG7[4748:3596]: SO_REUSEADDR option set on accept socket 2008.07.07 13:34:41 LOG3[4748:3596]: Error binding pop3 to 149.142.194.230:995 2008.07.07 13:34:41 LOG3[4748:3596]: bind: Can't assign requested address (WSAEADDRNOTAVAIL) (10049) 2008.07.07 13:34:41 LOG3[4748:3596]: Server is down 6. no file gcc. Thanks, Dominique Dominique_duchemin(a)hotmail.com

1 0

Using externally signed certificate with stunnel 4
by Tim Skirvin 07 Jul '08

07 Jul '08

I've got a comodo signed SSL certificate that I'm trying to use with stunnel4 to allow secure NNTP connections from a wide variety of clients. The certificate at least partially works; if I leave 'verify' off in the stunnel.conf file, then the service runs and users can connect, albeit while still having to verify the cert. But if I turn 'verify' on, then it doesn't work on *either* side. I've tried playing with CAfile and CApath without much luck. I'll attach my configuration files, the relevant pems, and some debugging information; is there something else I'm missing? I've already contacted comodo, and after several rounds of conversation they suggest I contact the list. Errors from the client side (note that I'm using a debug port here): + openssl s_client -connect news:565 -verify -debug verify depth is 0 CONNECTED(00000003) depth=2 /C=US/O=Entrust.net/OU=www.entrust.net/CPS incorp. by ref. (limits liab.)/OU=(c) 1999 Entrust.net Limited/CN=Entrust.net Secure Server Certification Authority verify error:num=19:self signed certificate in certificate chain verify return:0 6976:error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed:s3_clnt.c:951: ...and on the server, I get this: 2008.06.30 14:08:38 LOG7[10039:47679267941088]: nntps accepted FD=7 from 171.64.19.111:56122 2008.06.30 14:08:38 LOG7[10039:1073809760]: nntps started 2008.06.30 14:08:38 LOG7[10039:1073809760]: FD 7 in non-blocking mode 2008.06.30 14:08:38 LOG7[10039:1073809760]: FD 8 in non-blocking mode 2008.06.30 14:08:38 LOG7[10039:1073809760]: FD 9 in non-blocking mode 2008.06.30 14:08:38 LOG7[10039:47679267941088]: Cleaning up the signal pipe 2008.06.30 14:08:38 LOG6[10039:47679267941088]: Child process 10247 finished with code 0 2008.06.30 14:08:38 LOG7[10039:1073809760]: Connection from 171.64.19.111:56122 permitted by libwrap 2008.06.30 14:08:38 LOG5[10039:1073809760]: nntps connected from 171.64.19.111:56122 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): before/accept initialization 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): SSLv3 read client hello A 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): SSLv3 write server hello A 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): SSLv3 write certificate A 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): SSLv3 write certificate request A 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): SSLv3 flush data 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL alert (read): fatal: unknown CA 2008.06.30 14:08:38 LOG3[10039:1073809760]: SSL_accept: 14094418: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca 2008.06.30 14:08:38 LOG5[10039:1073809760]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.06.30 14:08:38 LOG7[10039:1073809760]: nntps finished (0 left) Basic Requested Information that wasn't supplied above: * stunnel 4.18-2 on Debian etch (2.6.18-6-686 #1 SMP) * Running standalone with '/usr/bin/stunnel4 /etc/news/stunnel.conf' * libc6, no gcc, OpenSSL 0.9.8c-4etch3 * The log on startup: 2008.06.30 14:00:15 LOG7[26276:3083523776]: Snagged 64 random bytes from /root/.rnd 2008.06.30 14:00:15 LOG7[26276:3083523776]: Wrote 1024 new random bytes to /root/.rnd 2008.06.30 14:00:15 LOG7[26276:3083523776]: RAND_status claims sufficient entropy for the PRNG 2008.06.30 14:00:15 LOG7[26276:3083523776]: PRNG seeded successfully 2008.06.30 14:00:15 LOG7[26276:3083523776]: Configuration SSL options: 0x01000000 2008.06.30 14:00:15 LOG7[26276:3083523776]: SSL options set: 0x01000000 2008.06.30 14:00:15 LOG7[26276:3083523776]: Certificate: /etc/ssl/certs/news-stunnel.pem 2008.06.30 14:00:15 LOG7[26276:3083523776]: Certificate loaded 2008.06.30 14:00:15 LOG7[26276:3083523776]: Key file: /etc/ssl/private/news-stunnel.key 2008.06.30 14:00:15 LOG7[26276:3083523776]: Private key loaded 2008.06.30 14:00:15 LOG7[26276:3083523776]: Loaded verify certificates from /etc/ssl/certs/comodo.cert 2008.06.30 14:00:15 LOG7[26276:3083523776]: SSL context initialized for service nntps - Tim Skirvin (tskirvin(a)stanford.edu) -- Information Technology Services http://www.stanford.edu/~tskirvin/ System Software Developer, Unix Team Stanford University

1 1

Windows setup
by Koenraad Lelong 04 Jul '08

04 Jul '08

Hello, I would like to know if it is possible to run a silent setup of the Windows-setup of stunnel. I'm including it in my own setup of my own application so I would like to avoid the interaction of the stunnel-setup. Second question is if it is bad to "install" stunnel more than once on a computer. Until now I had a setup for new installations and an update for updates of my application. This seems not to work because some users use the setup to update an existing installation and with this they run the install of stunnel for the second time. If it is bad, how do I detect the existance of stunnel, and what version it is, so I could update stunnel if it's outdated. Regards, Koenraad Lelong. P.S. If this is the wrong list for such questions I apologize. I would like to know the right list.

1 0

Re: [stunnel-users] Stunnel 4.21 99% cpu ultilization
by Fat Wallet 03 Jul '08

03 Jul '08

Hi, If anyone have a clue on what I should do to fix this issue, I would really appreciated: One of the stunnel process is running at 99% and in R state and the time just keep incrementing. [root@root]# ps auxw|grep stunnel root 781 0.0 0.0 6520 2684 ? T 11:01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 2853 0.0 0.0 3940 604 ttyp2 S+ 11:37 0:00 grep stunnel root 16554 0.0 0.0 3992 788 ? S Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 16555 0.0 0.0 3992 788 ? S Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 16556 0.0 0.0 3992 788 ? S Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 16557 0.0 0.0 3992 788 ? S Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 16558 0.0 0.0 3992 788 ? S Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 16561 0.0 0.0 6520 2684 ? Ts Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 16656 0.0 0.0 6520 2684 ? S Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 23954 0.0 0.0 6520 2684 ? S 08:00 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 23955 99.0 0.0 6520 2684 ? R 08:00 189:52 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 31521 0.0 0.0 6520 2684 ? S 10:30 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf Thanks, Mike ----- Original Message ---- From: Aron Griffis <agriffis(a)n01se.net> To: Fat Wallet <fat8wallet(a)yahoo.com> Cc: stunnel-users(a)mirt.net Sent: Monday, June 30, 2008 11:04:44 AM Subject: Re: [stunnel-users] Stunnel 4.21 99% cpu ultilization Fat Wallet wrote: [Mon Jun 30 2008, 01:28:11PM EDT] > Can someone please help with this issue? This 100% cpu > utilization issue happens randomly on multiprocess cpu. strace, ltrace, build stunnel with debugging symbols and attach gdb to the spinning process, etc. Is your name really Fat Wallet?

2 1

protect the private key, while running stunnel in server mode as a windows service
by sandeep siroya 03 Jul '08

03 Jul '08

Hi, I have stunnel in server mode running as a windows service on a Win2003 Server system. I need to give this system to a different company for testing their client against our server. How do I protect my private key on stunnel, while letting the 3rd company being able to login as administrator on stunnel's win2003 system and start/stop stunnel service? I know one can protect the private key with a passphrase in stunnel, but that does not serve my purpose as stunnel in this case should be able to start/stop without any user-intervention and I cannot store the passphrase in cleartext. thanks , ss

1 0

Peer suddenly disconnected
by victor.harutyunyan＠arca.am 02 Jul '08

02 Jul '08

Hello there, I have installed stunnel server on FreeBSD. I configure it like this cert=server_cert.pem key=private\server_key.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 verify=2 CAfile=test_cert.pem [ssl_host_proxy] accept=172.24.150.15:1234 connect=192.168.1.1:10500 TIMEOUTidle=120 Client side is not a computer it's small device. I generate client certificates in this manor: echo off del test_ck.pem /q # delete previous test.ck.pem file echo Starting New test_ck file Generation C:\OpenSSL\bin\openssl.exe req -new -x509 -newkey rsa:2048 -sha1 -out test_cert.pem -keyout test_key.pem -nodes -config sample_ck.cnf -days 1825 -batch C:\OpenSSL\bin\openssl.exe pkcs8 -in test_key.pem -topk8 -out test_pk8.pem -passout pass:"TestPassword0001" -noiter -v1 PBE-SHA1-3DES del test_key.pem /q copy test_cert.pem+test_pk8.pem test_ck.pem /y del test_pk8.pem /q Echo New test_ck.pem file has the following sections: findstr "BEGIN END" test_ck.pem pause test_cert.pem is on a stunnel server as CAfile and test_ck.pem is on my small device which is capable to connect via stunnel. And I generate other self-signed CA, and generate one certificate request and sign it via this CA, and install that key and certificate on server. cert=server_cert.pem key=private\server_key.pem All is working fine, but after one year my server certificate has expired, when I regenerate new server certificate and try to connect, I see in server log this: Child process 6094 finished with code 0 SSL state (accept): before accept initialization SSL state (accept): SSLv3 read client hello A SSL state (accept): SSLv3 write server hello A SSL state (accept): SSLv3 write certificate A SSL state (accept): SSLv3 write server done A SSL state (accept): SSLv3 flush data SSL_accept: Peer suddenly disconnected And my device can't connect to the server, I haven't any client side logs and error messages, only NOT DELIVERED in my device. :( Can you please help me to solve this problem, I am trying many many times, I was very angry.. Thank you very much. Victor Harutyunyan. P.S. Sorry for my bad english.

1 0

Peer suddenly disconnected
by victor.harutyunyan＠arca.am 02 Jul '08

02 Jul '08

Hello there, I have installed stunnel server on FreeBSD. I configure it like this cert=server_cert.pem key=private\server_key.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 verify=2 CAfile=test_cert.pem [ssl_host_proxy] accept=172.24.150.15:1234 connect=192.168.1.1:10500 TIMEOUTidle=120 Client side is not a computer it's small device. I generate client certificates in this manor: echo off del test_ck.pem /q # delete previous test.ck.pem file echo Starting New test_ck file Generation C:\OpenSSL\bin\openssl.exe req -new -x509 -newkey rsa:2048 -sha1 -out test_cert.pem -keyout test_key.pem -nodes -config sample_ck.cnf -days 1825 -batch C:\OpenSSL\bin\openssl.exe pkcs8 -in test_key.pem -topk8 -out test_pk8.pem -passout pass:"TestPassword0001" -noiter -v1 PBE-SHA1-3DES del test_key.pem /q copy test_cert.pem+test_pk8.pem test_ck.pem /y del test_pk8.pem /q Echo New test_ck.pem file has the following sections: findstr "BEGIN END" test_ck.pem pause test_cert.pem is on a stunnel server as CAfile and test_ck.pem is on my small device which is capable to connect via stunnel. And I generate other self-signed CA, and generate one certificate request and sign it via this CA, and install that key and certificate on server. cert=server_cert.pem key=private\server_key.pem All is working fine, but after one year my server certificate has expired, when I regenerate new server certificate and try to connect, I see in server log this: Child process 6094 finished with code 0 SSL state (accept): before accept initialization SSL state (accept): SSLv3 read client hello A SSL state (accept): SSLv3 write server hello A SSL state (accept): SSLv3 write certificate A SSL state (accept): SSLv3 write server done A SSL state (accept): SSLv3 flush data SSL_accept: Peer suddenly disconnected And my device can't connect to the server, I haven't any client side logs and error messages, only NOT DELIVERED in my device. :( Can you please help me to solve this problem, I am trying many many times, I was very angry.. Thank you very much. Victor Harutyunyan. P.S. Sorry for my bad english.

1 0

socket not getting closed
by Manjunath S Karikatti 02 Jul '08

02 Jul '08

Hello, We are using stunnel to wrap the tcp connetion between the our client session used by users and the server process. Due to some reason when client session terminates abruptly (either due to user's PC crash or network outage) the stunnel process does not terminate. We see that the socket on client PC is closed but stunnel process is still alive with socket for that PC in established state. This is on AIX platform. Do not know this is issue with stunnel process or something on AIX needs to be tuned (like the tcp_keepidle value). Thanks for any info and help. Thanks and Regards, Manjunath

1 0

Re: [stunnel-users] Stunnel 4.21 99% cpu ultilization
by Fat Wallet 01 Jul '08

01 Jul '08

Thanks for your reply. I was hoping to see if someone have a similar issue since there was an issue with stunnel 4.20 version. Thanks, Mike ----- Original Message ---- From: Aron Griffis <agriffis(a)n01se.net> To: Fat Wallet <fat8wallet(a)yahoo.com> Cc: stunnel-users(a)mirt.net Sent: Monday, June 30, 2008 11:04:44 AM Subject: Re: [stunnel-users] Stunnel 4.21 99% cpu ultilization Fat Wallet wrote: [Mon Jun 30 2008, 01:28:11PM EDT] > Can someone please help with this issue? This 100% cpu > utilization issue happens randomly on multiprocess cpu. strace, ltrace, build stunnel with debugging symbols and attach gdb to the spinning process, etc. Is your name really Fat Wallet?

1 0

Stunnel v4.25 vs v4.20
by James Moe 30 Jun '08

30 Jun '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, I upgraded to v4.25 and stunnel aborts right away. v4.20 works just fine. What is protocol family 47? ====[ log file ]==== 2008.06.26 11:31:01 LOG5[282:8553]: stunnel 4.25 on i386-pc-os2-emx with OpenSSL 0.9.8h 28 May 2008 2008.06.26 11:31:01 LOG5[282:8553]: Threading: SSL:ENGINE Sockets:SELECT,IPv4 2008.06.26 11:31:01 LOG3[282:8553]: Error binding pop3.sma.com_L110-R995 to 127.0.0.1:110 2008.06.26 11:31:01 LOG3[282:8553]: bind: Address family not supported by protocol family (47) ====[ conf file ]==== socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 client = yes output = G:/c/voice/pmmdev/testcase/bin/stunnel.log verify = 0 debug = 5 cert = g:/c/voice/pmmdev/testcase/bin/sma-test.pem [pop3.sma.com_L110-R995] accept = localhost:110 connect = pop3.sma.com:995 ;# protocol = pop3 [smtpauth.earthlink.net_L6025-R587] accept = localhost:6025 connect = smtpauth.earthlink.net:587 protocol = smtp [sohnen-moe.com:L6125:R587] accept = localhost:6125 connect = sohnen-moe.com:587 protocol = smtp [smtp.sma.com_L25-R587] accept = localhost:25 connect = smtp.sma.com:587 protocol = smtp - -- jimoe (at) sohnen-moe (dot) com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (OS/2) iD8DBQFIY+DkzTcr8Prq0ZMRArW+AJ4uOJFOGyluIj52DG4cM62jMPs8NACfbug2 oVsLAXJ+fH1Raj568dGn2mM= =JSCM -----END PGP SIGNATURE-----

1 1

Re: [stunnel-users] Stunnel 4.21 99% cpu ultilization
by Fat Wallet 30 Jun '08

30 Jun '08

Hi, Can someone please help with this issue? This 100% cpu utilization issue happens randomly on multiprocess cpu. Thanks! ----- Original Message ---- From: Fat Wallet <fat8wallet(a)yahoo.com> To: stunnel-users(a)mirt.net Sent: Monday, June 23, 2008 10:39:16 AM Subject: Stunnel 4.21 99% cpu ultilization Hi All, I've been googling for this issue but it seems like google is not my friend at the moment. I am running Linux with 4 cpus and top command shows stunnel at 99-100% cpu. Please help. //stunnel configuration file # PID is created inside chroot jail pid = /var/run/stunnel.pid # debug debug = 7 output = /var/log/stunnel.log # Authentication stuff verify = 2 cert = /etc/stunnel/cert.pem CAfile = /etc/stunnel/ca.pem #Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 # Use it for client mode client = yes /////////// stunnel version stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.7a Feb 19 2003 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none //openssl version OpenSSL 0.9.7a Feb 19 2003 //Redhat version Red Hat Linux release 9 (Shrike) root]#cat /proc/cpuinfo | grep processor | wc -l 4 http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

UPNP & Nat-PMP with Stunnel
by Dean Shavit 26 Jun '08

26 Jun '08

Stunnel works great for me, but with dynamic port forwarding, I've not been able to get it working. I suspect it's because stunnel is a bit confusing about which port to reply to... Anyone else found a way to crack this nut?

1 0