- stunnel-users - stunnel.org

stunnel on windows 2003
by John M. Andre 06 Jul '07

06 Jul '07

I've looked around the site, through the help file, and through the archives but I still can't find the answer to my question. I hope someone on this list can give me some insight. I am new to SSL but I have a brand new server and I'm trying to set it up to use stunnel to secure communications over POP, IMAP, SMTP, etc. However, as I look through the documentation, it is clearly written for unix admins. Is there anything that will guide someone how to setup stunnel on windows? Ideally a step-by-step but anything would be nice. Thanks, John

1 0

Out-of-band data
by Richard's Hotmail 03 Jul '07

03 Jul '07

Hi, In the Stunnel FAQ (see snippet below) it says that STUNNEL does not support OOB processing (except if OOB is set to in-line); can someone please tell me if this restriction is still in place? Does OpenSSL not support the sending and receiving of the OOB character? Some other restriction? Cheers Richard Maher Can I use stunnel to protect [insert random protocol here]? Stunnel should be able to secure any random protocol as long as the protocol satisfies the following requirements: 1.. The protocol is TCP, not UDP. 2.. The protocol doesn't use multiple connections, like ftp. 3.. The protocol doesn't depend on Out Of Band (OOB) data, 4.. Remote site can't use an application-specific protocol, like ssltelnet, where SSL is a negotiated option, save for those protocols already supported by the -n argument to Stunnel.

1 0

HTTPS Connect patches for 4.20
by Gym Crazy 02 Jul '07

02 Jul '07

Hi Folks Wonder if you can help me. A predecessor of mine set up stunnel version 4.05 on OpenBSD 3.8. He didn't leave much documentation unfortunately. He also used a patch and re-compiled it. That patch was connect-proxy.mwald.patch. We are getting some performance issues and want to of course move to the latest stable stunnel release 4.20, before asking for any help but we are in a bit of a bind. We are firstly not sure if there is an updated connect-proxy.mwald.patch that works well with stunnel 4.20 (I have searched and searched but can't seem to find any). Or else if there is a patch that performs the same type of function as connect-proxy.mwald.patch but that is stable to use with stunnel 4.20. Any help would be greatly appreciated :-D Regards Paul H ____________________________________________________________________________________ Luggage? GPS? Comic books? Check out fitting gifts for grads at Yahoo! Search http://search.yahoo.com/search?fr=oni_on_mail&p=graduation+gifts&cs=bz

1 0

Re: [stunnel-users] Certificates and public/private keys
by Dario Teixeira 28 Jun '07

28 Jun '07

> Should you not be looking at > http://httpd.apache.org/docs/2.0/ssl/ssl_howto.html > and > https://www.opensc-project.org/files/doc/apache-client-authentication(v0 > .5.1).pdf Hi, Thanks for the reply! I didn't mention it before, but I won't be using Apache or any other mainstream webserver. Most likely I will be using Ocsigen (http://www.ocsigen.org/) Now, the latest development release of Ocsigen already has basic support for SSL, but it can't handle yet client authentication. In short, I am still looking for an stunnel-based solution. Any ideas? Thanks again for your time and attention! Cheers, Dario ___________________________________________________________ Yahoo! Answers - Got a question? Someone out there knows the answer. Try it now. http://uk.answers.yahoo.com/

2 1

HTTPS Connect patches for 4.20
by Gym Crazy 28 Jun '07

28 Jun '07

Hi Folks Wonder if you can help me. A predecessor of mine set up stunnel version 4.05 on OpenBSD 3.8. He didn't leave much documentation unfortunately. He also used a patch and re-compiled it. That patch was connect-proxy.mwald.patch. We are getting some performance issues and want to of course move to the latest stable stunnel release 4.20, before asking for any help but we are in a bit of a bind. We are firstly not sure if there is an updated connect-proxy.mwald.patch that works well with stunnel 4.20 (I have searched and searched but can't seem to find any). Or else if there is a patch that performs the same type of function as connect-proxy.mwald.patch but that is stable to use with stunnel 4.20. Any help would be greatly appreciated :-D Regards Paul H ____________________________________________________________________________________ Looking for a deal? Find great prices on flights and hotels with Yahoo! FareChase. http://farechase.yahoo.com/

1 0

Certificates and public/private keys
by Dario Teixeira 26 Jun '07

26 Jun '07

Dear Stunnel users, I have a webserver running on a machine behind a firewall. I can easily punch a hole on the firewall, allowing any user on the Internet to access the webserver. However, I want to restrict access *only* to some people, those in possession of a secret key. At first sight, this seems like a job for plain ssh tunneling rather than stunnel, but as far as I understand it, ssh tunnels require that the connecting users have an account on the server machine. That won't happen here. It seems that stunnel is therefore more appropriate for this particular problem. Now, the port forwarding mechanics seem similar to those in ssh. I have no problems understanding those. The only problems I am having are figuring out the generation of keys. My excuses if I am using a terminology based on ssh or if I am way off about the capabilities of stunnel, but how can I generate the server's private and public keys? (the latter to be handed out to the clients) I have followed the instructions in the README.Debian file that accompanies the Debian stunnel4 package to produce a stunnel.pem certificate. With it, I have successfully established a stunnel connection between two machines. However, I have to use the same stunnel.pem file on both the client and the server, which strikes me as dangerous. Which parts are really needed on the client and server? Thanks in advance for your help! Cheers, Dario ___________________________________________________________ Yahoo! Answers - Got a question? Someone out there knows the answer. Try it now. http://uk.answers.yahoo.com/

2 1

Preferred way to start stunnel @boot time
by Van 26 Jun '07

26 Jun '07

So I've got stunnel running perfectly on my linux server to forward ssl requests to my pop and imap ports. I need to make sure this happens automatically if the machine is rebooted. On the stunnel site it talks about running stunnel either as a daemon or running stunnel out of xinetd. I was just wondering, which way do people using it out there think is preferable? And why? Neither seems as direct or simple as putting @reboot root /sbin/start_stunnel into my crontab, which is what I did (start_stunnel being a shell script with the proper command and some comments). Just another uneventful way to do the same thing? -Van

2 1

Java Applet Client for STUNNEL-fronted server
by Richard's Hotmail 21 Jun '07

21 Jun '07

Hi, I'm new to the list and apologize if this question is inappropriate, or quite basic, but I really hope someone can help. I currently have an intranet-resident JAVA Applet that connects back to the Application Server via standard TCP/IP sockets using the java.net.Socket class, and everything is peachy. What I'm looking at doing now is making it Internet friendly by providing host authentication (don't care about client authentication at the mo) and strong cryptography between client and server. OpenSSL and Stunnel (I don't want to have to make the Application Server SSL compatible if I don't have to) are available on the server box therefore I would dearly love an example of a JAVA client that can talk javax.net.SSL (or something else) to a Stunnel-fronted server. (Less is definitely more here - The least number of client keys and or certificate-generations the better!) Can anyone please help me with this? Obviously example-code would be ideal, as would first-hand accounts of the trials and tribulations, but I'll certainly settle for web-references to the appropriate docs or other relevant material! Are all the JSSE libraries/code reqd bundled with the JDK and runtime JVM ready? Is there a better way? (Sadly IPsec is not an option here) Maybe there's an alternate solution that can preserve the client's true IP address and present it to the Application Server's "Listen"? Cheers Richard Maher

1 0

Re: [stunnel-users] Trying to get stunnel to work for forwarding pop3sto ipop3 port
by Van 21 Jun '07

21 Jun '07

Getting closer. I now get- [van@mailserver ]$ sudo stunnel /usr/local/etc/stunnel/stunnel.conf localhost:ipop3 2007.06.21 11:51:27 LOG4[15899:3086476992]: Wrong permissions on /usr/ local/etc/stunnel/mail.pem 2007.06.21 11:51:27 LOG4[15899:3086476992]: Wrong permissions on /usr/ local/etc/stunnel/mail.pem 2007.06.21 11:51:27 LOG4[15899:3086476992]: Wrong permissions on /usr/ local/etc/stunnel/mail.pem But that doesn't make sense to me. mail.pem permissions are the same as my cert's and it works fine. [van@mailserver change_passwd]$ ls -al /usr/local/etc/stunnel/mail.pem -rw-r--r-- 1 root root 2942 Jun 20 18:21 /usr/local/etc/stunnel/ mail.pem [van@mailserver change_passwd]$ ls -al /etc/httpd/certs/www.crt -rw-r--r-- 1 root root 1074 Jun 1 12:30 /etc/httpd/certs/www.crt Is the error misleading? Or what should the mail.pem perms be? Van On Jun 20, 2007, at 9:33 PM, Kevin Cook wrote: > > If you are using a stunnel.conf file, I would replace the '-d pop3s > -r' > with the absolute path to the .conf file: > > sudo /usr/local/sbin/stunnel /usr/local/etc/stunnel/stunnel.conf > > I believe command line options were typically used more in older > versions, but now all configuration is done in the configuration file. > > > Kevin > > -----Original Message----- > From: Van [mailto:[email protected]] > Sent: Wednesday, June 20, 2007 6:03 PM > To: stunnel-users(a)mirt.net > Subject: [stunnel-users] Trying to get stunnel to work for forwarding > pop3sto ipop3 port > > Hello, > > This is my introduction to stunnel. I've inherited control of a > pop3 and > imap server running Red Hat Linux 4 that I want to access via pop3s > and > imaps. I'm starting out with securing the pop3 since most users are > using it. > > I downloaded stunnel 4.20 and compiled it according to the > instructions > on stunnel.org. > > I read the certificates section of the site and made a new .pem file > that I named mail.pem and have in the /usr/local/etc/stunnel/ > directory > that /usr/local/etc/stunnel/stunnel.conf asks for. But when I try to > run stunnel like in the Examples section I get : > > [van@mailserver ~]$ sudo /usr/local/sbin/stunnel -d pop3s -r > localhost:ipop3 > 2007.06.20 17:59:54 LOG3[25516:3086419648]: -d: No such file or > directory (2) > Syntax: > stunnel [<filename>] ] -fd <n> | -help | -version | -sockets > <filename> - use specified config file instead of /usr/local/ > etc/stunnel/stunnel.conf > -fd <n> - read the config file from a file descriptor > -help - get config file help > -version - display version and defaults > -sockets - display default socket options > > I'm a little lost here. Never dealt with a .pem file before stunnel. > I have a self-signed cert I'm successfully using for https webmail on > the server and guessing stunnel couldn't see that, I appended my file > 'mailserver.crt' into my mail.pem file and edited stunnel.conf so it > has > > ;CAfile = /usr/local/etc/stunnel/certs.pem CAfile = > /usr/local/etc/stunnel/mail.pem > > but no dice. Same result. > > Trying to debug, I find 'stunnel -V' also gives the same result. > > Can someone point out what's going wrong? > > > -Van > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > >

2 2

Trying to get stunnel to work for forwarding pop3s to ipop3 port
by Van 20 Jun '07

20 Jun '07

Hello, This is my introduction to stunnel. I've inherited control of a pop3 and imap server running Red Hat Linux 4 that I want to access via pop3s and imaps. I'm starting out with securing the pop3 since most users are using it. I downloaded stunnel 4.20 and compiled it according to the instructions on stunnel.org. I read the certificates section of the site and made a new .pem file that I named mail.pem and have in the /usr/local/etc/stunnel/ directory that /usr/local/etc/stunnel/stunnel.conf asks for. But when I try to run stunnel like in the Examples section I get : [van@mailserver ~]$ sudo /usr/local/sbin/stunnel -d pop3s -r localhost:ipop3 2007.06.20 17:59:54 LOG3[25516:3086419648]: -d: No such file or directory (2) Syntax: stunnel [<filename>] ] -fd <n> | -help | -version | -sockets <filename> - use specified config file instead of /usr/local/ etc/stunnel/stunnel.conf -fd <n> - read the config file from a file descriptor -help - get config file help -version - display version and defaults -sockets - display default socket options I'm a little lost here. Never dealt with a .pem file before stunnel. I have a self-signed cert I'm successfully using for https webmail on the server and guessing stunnel couldn't see that, I appended my file 'mailserver.crt' into my mail.pem file and edited stunnel.conf so it has ;CAfile = /usr/local/etc/stunnel/certs.pem CAfile = /usr/local/etc/stunnel/mail.pem but no dice. Same result. Trying to debug, I find 'stunnel -V' also gives the same result. Can someone point out what's going wrong? -Van

1 0

stunnel client mode and CA chains
by Domenico Andreoli 13 Jun '07

13 Jun '07

Hi, I have always successfully used openssl/stunnel but now I am facing a new problem, a variation of the usual client-side authentication documentented everywhere. I have a root CA and child CA which is signed by the root one. I have also a client certificate that is signed only by the child CA. In order to verify the certificate signature using openssl I need to specify both the CA certificates, this works as expected. What I would like to achieve is to authenticate the clients using a stunnel server having only the root CA certificate. Is there some stunnel client configuration switch that allows to push the child CA certificate? One looking interesting is (from the manpage): cert = pemfile certificate chain PEM file name A PEM is always needed in server mode. Specifying this flag in client mode will use this certificate chain as a client side certificate chain. Using client side certs is optional. The certificates must be in PEM format and must be sorted starting with the certificate to the highest level (root CA). in particular "The certificates must be in PEM format and must be sorted starting with the certificate to the highest level (root CA)" lets me hope but I am not able to understand how it works. I made many tries but on server side I always get a "VERIFY ERROR: depth=1, error=invalid CA certificate:" referring to the child CA certificate and then a "SSL3_GET_CLIENT_CERTIFICATE:no certificate returned" followed by connection shutdown. Supposing the client private key is in a separate file, if I put the certificates in the order specified by the manpage I get a key mismatching error upon stunnel startup. If instead I put the client certificate as first, then server do not authenticate it. Where am I wrong? I cannot change the server configuration, it must work as it is. I have hundreds of them and I can update them only using the SSL connection. Thanks for any help. Regards, Domenico -----[ Domenico Andreoli, aka cavok --[ http://www.dandreoli.com/gpgkey.asc ---[ 3A0F 2F80 F79C 678A 8936 4FEE 0677 9033 A20E BC50

1 0

Issue with Stunnel / TCP Wrappers
by Kevin Cook 11 Jun '07

11 Jun '07

I have been a user of Stunnel for several years, but as of recent need to be able to deny TCP/IP requests dynamically on an IP address basis. I am attempting to use TCP wrappers, but not getting it to work with Stunnel. The Solaris 9 implementation I am using currently runs in a chroot'ed environment, so I am placing the hosts.deny file in this path (/chrootpath/etc/hosts.deny), as well as /usr/etc per everything I have read. This is not working. I am using a non-standard port not defined in /etc/services (29444). Any ideas?

1 0

stunnel autostart at boot
by Grant Kohler 11 Jun '07

11 Jun '07

Has anybody created a startup script to load stunnel when a machine boots? Thanks, -Grant

1 0

Re: [stunnel-users] [PATCH?] Senting a list of accepted CAs to the client
by Kevin Martin 07 Jun '07

07 Jun '07

Has anyone any information on this? It affects the ability of Thunderbird users (in this case) to use secure communications with IMAP mail servers using TLS/SSL. Please see the bugzillas below. Thanks. Kevin Martin https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=237962 and list posting from 4/2007: Hello, stunnel currently does not send a list of accepted CAs, see e.g. https://bugzilla.mozilla.org/show_bug.cgi?id=327001 Sending the list was #if 0-ed out sometime between stunnel 3.22 and 4.00, with no change log entry AFAICS. Does anyone remember know why was it disabled, and whether it is safe to reenable (e. g. using the attached patch)? Thanks, Mirek <patch snipped>...see the list posting from 4/2007 above for the attached patch.

1 0

regarding CRLpath
by piyush tewari 07 Jun '07

07 Jun '07

Hi, I m using crl but it is woking only in the case of using CRLfile. That is when I use the CRLfile , the client having the revoked certificate is now not able to connect to the server. But when I m providing the CRLpath in the stunnel config file , the client is still able to connect. That is CRL is working in the case of CRLfile entry and not working in the case of CRLpath. The entry that i have specified is CRLpath = C:\Stunnel\debug\revoked So where is the flaw. I know that in case of the CRLfile , it is necessary to restart the stunnel , whenever the CRL changes. But in case of CRLpath , whether it is necessary to restart the stunnel or not. regards piyush --------------------------------- You snooze, you lose. Get messages ASAP with AutoCheck in the all-new Yahoo! Mail Beta.

1 0

Problem with 'verify=3'
by Koenraad Lelong 05 Jun '07

05 Jun '07

Hi, I would like to have a secure access to a Firebird database server. When I configure verify = 2 on the server I can connect, but I would like to have verify = 3 and this does not work. This is my stunnel.conf : client = no foreground = yes setuid = stunnel setgid = nogroup pid = /var/run/stunnel.pid debug = 7 output = /var/log/stunnel.log socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 3 CApath = /etc/stunnel/certs/ CAfile = /etc/stunnel/cacert.pem cert = /etc/stunnel/server.pem [firebird] accept = 3052 connect = localhost:gds_db output of stunnel -version : stunnel 4.14 on i686-suse-linux-gnu PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 Global options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /etc/stunnel/stunnel.pem pid = /var/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds I'm running OpenSuse 10.1 on the server. This is the log when I can't connect (verify = 3) : 2007.06.05 13:18:55 LOG5[15150:3083052720]: stunnel 4.14 on i686-suse-linux-gnu PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 2007.06.05 13:18:55 LOG7[15150:3083052720]: Snagged 64 random bytes from /root/.rnd 2007.06.05 13:18:55 LOG7[15150:3083052720]: Wrote 1024 new random bytes to /root/.rnd 2007.06.05 13:18:55 LOG7[15150:3083052720]: RAND_status claims sufficient entropy for the PRNG 2007.06.05 13:18:55 LOG6[15150:3083052720]: PRNG seeded successfully 2007.06.05 13:18:55 LOG7[15150:3083052720]: Certificate: /etc/stunnel/server.pem 2007.06.05 13:18:55 LOG7[15150:3083052720]: Key file: /etc/stunnel/server.pem 2007.06.05 13:18:55 LOG7[15150:3083052720]: Loaded verify certificates from /etc/stunnel/cacert.pem 2007.06.05 13:18:55 LOG7[15150:3083052720]: Verify directory set to /etc/stunnel/certs/ 2007.06.05 13:18:55 LOG5[15150:3083052720]: Peer certificate location /etc/stunnel/certs/ 2007.06.05 13:18:55 LOG6[15150:3083052720]: file ulimit = 1024 (can be changed with 'ulimit -n') 2007.06.05 13:18:55 LOG6[15150:3083052720]: poll() used - no FD_SETSIZE limit for file descriptors 2007.06.05 13:18:55 LOG5[15150:3083052720]: 500 clients allowed 2007.06.05 13:18:55 LOG7[15150:3083052720]: FD 5 in non-blocking mode 2007.06.05 13:18:55 LOG7[15150:3083052720]: FD 6 in non-blocking mode 2007.06.05 13:18:55 LOG7[15150:3083052720]: FD 7 in non-blocking mode 2007.06.05 13:18:55 LOG7[15150:3083052720]: SO_REUSEADDR option set on accept socket 2007.06.05 13:18:55 LOG7[15150:3083052720]: firebird bound to 0.0.0.0:3052 2007.06.05 13:18:55 LOG7[15150:3083052720]: Created pid file /var/run/stunnel.pid 2007.06.05 13:19:02 LOG7[15150:3083052720]: firebird accepted FD=8 from 192.168.0.13:25651 2007.06.05 13:19:02 LOG7[15150:3083049888]: firebird started 2007.06.05 13:19:02 LOG7[15150:3083049888]: FD 8 in non-blocking mode 2007.06.05 13:19:02 LOG7[15150:3083049888]: TCP_NODELAY option set on local socket 2007.06.05 13:19:02 LOG7[15150:3083049888]: FD 9 in non-blocking mode 2007.06.05 13:19:02 LOG7[15150:3083049888]: FD 11 in non-blocking mode 2007.06.05 13:19:02 LOG7[15150:3083052720]: Cleaning up the signal pipe 2007.06.05 13:19:02 LOG6[15150:3083052720]: Child process 15152 finished with code 0 2007.06.05 13:19:02 LOG7[15150:3083049888]: Connection from 192.168.0.13:25651 permitted by libwrap 2007.06.05 13:19:02 LOG5[15150:3083049888]: firebird connected from 192.168.0.13:25651 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): before/accept initialization 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 read client hello A 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write server hello A 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write certificate A 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write certificate request A 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 flush data 2007.06.05 13:19:02 LOG5[15150:3083049888]: VERIFY OK: depth=1, /C=BE/ST=Vlaams Brabant/L=Diest/O=ACE electronics n.v./OU=IT/CN=Certificate Authority/emailAddress=postmaster.ace-electronics.be 2007.06.05 13:19:02 LOG4[15150:3083049888]: VERIFY ERROR ONLY MY: no cert for /C=BE/ST=Vlaams Brabant/L=Diest/O=ACE electronics n.v./OU=IT/CN=client/emailAddress=postmaster.ace-electronics.be 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL alert (write): fatal: certificate unknown 2007.06.05 13:19:02 LOG3[15150:3083049888]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2007.06.05 13:19:02 LOG7[15150:3083049888]: firebird finished (0 left) 2007.06.05 13:19:04 LOG7[15150:3083052720]: firebird accepted FD=8 from 192.168.0.13:25653 2007.06.05 13:19:04 LOG7[15150:3083049888]: firebird started 2007.06.05 13:19:04 LOG7[15150:3083049888]: FD 8 in non-blocking mode 2007.06.05 13:19:04 LOG7[15150:3083049888]: TCP_NODELAY option set on local socket 2007.06.05 13:19:04 LOG7[15150:3083049888]: FD 9 in non-blocking mode 2007.06.05 13:19:04 LOG7[15150:3083049888]: FD 11 in non-blocking mode 2007.06.05 13:19:04 LOG7[15150:3083052720]: Cleaning up the signal pipe 2007.06.05 13:19:04 LOG6[15150:3083052720]: Child process 15154 finished with code 0 2007.06.05 13:19:04 LOG7[15150:3083049888]: Connection from 192.168.0.13:25653 permitted by libwrap 2007.06.05 13:19:04 LOG5[15150:3083049888]: firebird connected from 192.168.0.13:25653 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): before/accept initialization 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 read client hello A 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write server hello A 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write certificate A 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write certificate request A 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 flush data 2007.06.05 13:19:04 LOG5[15150:3083049888]: VERIFY OK: depth=1, /C=BE/ST=Vlaams Brabant/L=Diest/O=ACE electronics n.v./OU=IT/CN=Certificate Authority/emailAddress=postmaster.ace-electronics.be 2007.06.05 13:19:04 LOG4[15150:3083049888]: VERIFY ERROR ONLY MY: no cert for /C=BE/ST=Vlaams Brabant/L=Diest/O=ACE electronics n.v./OU=IT/CN=client/emailAddress=postmaster.ace-electronics.be 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL alert (write): fatal: certificate unknown 2007.06.05 13:19:04 LOG3[15150:3083049888]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2007.06.05 13:19:04 LOG7[15150:3083049888]: firebird finished (0 left) 2007.06.05 13:19:09 LOG3[15150:3083052720]: Received signal 2; terminating 2007.06.05 13:19:09 LOG7[15150:3083052720]: removing pid file /var/run/stunnel.pid I put the client cert in /etc/stunnel/certs and I ran 'c_rehash /etc/stunnel/certs'. What am I missing ? Thanks for any input. Regards, Koenraad Lelong.

1 0

Problem with verify = 3
by Koenraad Lelong 05 Jun '07

05 Jun '07

Hi, I would like to have a secure access to a Firebird database server. When I configure verify = 2 on the server I can connect, but I would like to have verify = 3 and this does not work. This is my stunnel.conf : client = no foreground = yes setuid = stunnel setgid = nogroup pid = /var/run/stunnel.pid debug = 7 output = /var/log/stunnel.log socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 3 CApath = /etc/stunnel/certs/ CAfile = /etc/stunnel/cacert.pem cert = /etc/stunnel/server.pem [firebird] accept = 3052 connect = localhost:gds_db output of stunnel -version : stunnel 4.14 on i686-suse-linux-gnu PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 Global options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /etc/stunnel/stunnel.pem pid = /var/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds I'm running OpenSuse 10.1 on the server. This is the log when I can't connect (verify = 3) : 2007.06.05 13:18:55 LOG5[15150:3083052720]: stunnel 4.14 on i686-suse-linux-gnu PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 2007.06.05 13:18:55 LOG7[15150:3083052720]: Snagged 64 random bytes from /root/.rnd 2007.06.05 13:18:55 LOG7[15150:3083052720]: Wrote 1024 new random bytes to /root/.rnd 2007.06.05 13:18:55 LOG7[15150:3083052720]: RAND_status claims sufficient entropy for the PRNG 2007.06.05 13:18:55 LOG6[15150:3083052720]: PRNG seeded successfully 2007.06.05 13:18:55 LOG7[15150:3083052720]: Certificate: /etc/stunnel/server.pem 2007.06.05 13:18:55 LOG7[15150:3083052720]: Key file: /etc/stunnel/server.pem 2007.06.05 13:18:55 LOG7[15150:3083052720]: Loaded verify certificates from /etc/stunnel/cacert.pem 2007.06.05 13:18:55 LOG7[15150:3083052720]: Verify directory set to /etc/stunnel/certs/ 2007.06.05 13:18:55 LOG5[15150:3083052720]: Peer certificate location /etc/stunnel/certs/ 2007.06.05 13:18:55 LOG6[15150:3083052720]: file ulimit = 1024 (can be changed with 'ulimit -n') 2007.06.05 13:18:55 LOG6[15150:3083052720]: poll() used - no FD_SETSIZE limit for file descriptors 2007.06.05 13:18:55 LOG5[15150:3083052720]: 500 clients allowed 2007.06.05 13:18:55 LOG7[15150:3083052720]: FD 5 in non-blocking mode 2007.06.05 13:18:55 LOG7[15150:3083052720]: FD 6 in non-blocking mode 2007.06.05 13:18:55 LOG7[15150:3083052720]: FD 7 in non-blocking mode 2007.06.05 13:18:55 LOG7[15150:3083052720]: SO_REUSEADDR option set on accept socket 2007.06.05 13:18:55 LOG7[15150:3083052720]: firebird bound to 0.0.0.0:3052 2007.06.05 13:18:55 LOG7[15150:3083052720]: Created pid file /var/run/stunnel.pid 2007.06.05 13:19:02 LOG7[15150:3083052720]: firebird accepted FD=8 from 192.168.0.13:25651 2007.06.05 13:19:02 LOG7[15150:3083049888]: firebird started 2007.06.05 13:19:02 LOG7[15150:3083049888]: FD 8 in non-blocking mode 2007.06.05 13:19:02 LOG7[15150:3083049888]: TCP_NODELAY option set on local socket 2007.06.05 13:19:02 LOG7[15150:3083049888]: FD 9 in non-blocking mode 2007.06.05 13:19:02 LOG7[15150:3083049888]: FD 11 in non-blocking mode 2007.06.05 13:19:02 LOG7[15150:3083052720]: Cleaning up the signal pipe 2007.06.05 13:19:02 LOG6[15150:3083052720]: Child process 15152 finished with code 0 2007.06.05 13:19:02 LOG7[15150:3083049888]: Connection from 192.168.0.13:25651 permitted by libwrap 2007.06.05 13:19:02 LOG5[15150:3083049888]: firebird connected from 192.168.0.13:25651 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): before/accept initialization 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 read client hello A 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write server hello A 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write certificate A 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write certificate request A 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 flush data 2007.06.05 13:19:02 LOG5[15150:3083049888]: VERIFY OK: depth=1, /C=BE/ST=Vlaams Brabant/L=Diest/O=ACE electronics n.v./OU=IT/CN=Certificate Authority/emailAddress=postmaster.ace-electronics.be 2007.06.05 13:19:02 LOG4[15150:3083049888]: VERIFY ERROR ONLY MY: no cert for /C=BE/ST=Vlaams Brabant/L=Diest/O=ACE electronics n.v./OU=IT/CN=client/emailAddress=postmaster.ace-electronics.be 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL alert (write): fatal: certificate unknown 2007.06.05 13:19:02 LOG3[15150:3083049888]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2007.06.05 13:19:02 LOG7[15150:3083049888]: firebird finished (0 left) 2007.06.05 13:19:04 LOG7[15150:3083052720]: firebird accepted FD=8 from 192.168.0.13:25653 2007.06.05 13:19:04 LOG7[15150:3083049888]: firebird started 2007.06.05 13:19:04 LOG7[15150:3083049888]: FD 8 in non-blocking mode 2007.06.05 13:19:04 LOG7[15150:3083049888]: TCP_NODELAY option set on local socket 2007.06.05 13:19:04 LOG7[15150:3083049888]: FD 9 in non-blocking mode 2007.06.05 13:19:04 LOG7[15150:3083049888]: FD 11 in non-blocking mode 2007.06.05 13:19:04 LOG7[15150:3083052720]: Cleaning up the signal pipe 2007.06.05 13:19:04 LOG6[15150:3083052720]: Child process 15154 finished with code 0 2007.06.05 13:19:04 LOG7[15150:3083049888]: Connection from 192.168.0.13:25653 permitted by libwrap 2007.06.05 13:19:04 LOG5[15150:3083049888]: firebird connected from 192.168.0.13:25653 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): before/accept initialization 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 read client hello A 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write server hello A 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write certificate A 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write certificate request A 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 flush data 2007.06.05 13:19:04 LOG5[15150:3083049888]: VERIFY OK: depth=1, /C=BE/ST=Vlaams Brabant/L=Diest/O=ACE electronics n.v./OU=IT/CN=Certificate Authority/emailAddress=postmaster.ace-electronics.be 2007.06.05 13:19:04 LOG4[15150:3083049888]: VERIFY ERROR ONLY MY: no cert for /C=BE/ST=Vlaams Brabant/L=Diest/O=ACE electronics n.v./OU=IT/CN=client/emailAddress=postmaster.ace-electronics.be 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL alert (write): fatal: certificate unknown 2007.06.05 13:19:04 LOG3[15150:3083049888]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2007.06.05 13:19:04 LOG7[15150:3083049888]: firebird finished (0 left) 2007.06.05 13:19:09 LOG3[15150:3083052720]: Received signal 2; terminating 2007.06.05 13:19:09 LOG7[15150:3083052720]: removing pid file /var/run/stunnel.pid I put the client cert in /etc/stunnel/certs and I ran 'c_rehash /etc/stunnel/certs'. What am I missing ? Thanks for any input. Regards, Koenraad Lelong.

1 0

certificate revocation
by piyush tewari 05 Jun '07

05 Jun '07

Hi , I am using Stunnel to protect one of my server. I am able to configure the stunnel properly with the help of stunnel. Now i am trying to use the revocation list concept in the stunnel. For using the stunnel revocation list i performed the following steps. 1. for generating the CRL file openssl ca -gencrl -keyfile ca_key -cert ca_crt -out my_crl.pem 2. for revoking the certificates openssl ca -revoke bad_crt_file -keyfile ca_key -cert ca_crt The entry specified in the stunnel.conf file is:- CRLfile = my_crl.pem Surprisingly the client is still able to connect to the server. Is it the problem in my configuration or it is a bug of stunnel. Regards, Piyush --------------------------------- Need a vacation? Get great deals to amazing places on Yahoo! Travel.

1 0

plz help me in debugging the code
by piyush tewari 04 Jun '07

04 Jun '07

Hello Friends, I am facing problems in debugging the source code of stunnel. the behaviour of the code is very unexpected for me. the return statement is not returning from the function. (Line 145 of gui.c file). Sameway when i debug line no 1266 of the options.c , that is "name=default_config_file;" , the df pointer gets it's value that means it is executing another line , line no 1305 of options.c itself "df=file_open(name, 0);". I am not getting this working of the stunnel code. And the other problem that i m facing is that during the debugging , many variables are not showing their occupied value. So please help me in understanding this working and resolving it. Thank you.. Regards Piyush --------------------------------- --------------------------------- Pinpoint customers who are looking for what you sell.

2 1

Re: [stunnel-users] stunnel-4.20 server loop on AIX 5.3
by Peter Heimann 04 Jun '07

04 Jun '07

Michal Trojnara <Michal.Trojnara(a)mobi-com.net> wrote on 31.05.2007 20:48:08: > An alternative workaround would be changing: > continue; > to: > sleep(1); > continue; If OpenSSL has been compiled with IBM cc, most new stunnel connections then result in EAGAIN once. sleep(1) seems to prevent an endless loop, but most requests now need at least one second to be processed. Compiling OpenSSL with IBM xlc_r, as you proposed, is definitely the better solution and prevents the EAGAIN errors. -- Regards Peter Heimann _______________________________________________________________ SMS schreiben mit WEB.DE FreeMail - einfach, schnell und kostenguenstig. Jetzt gleich testen! http://f.web.de/?mc=021192

1 0

Re: [stunnel-users] stunnel-4.20 server loop on AIX 5.3
by Peter Heimann 03 Jun '07

03 Jun '07

Michal Trojnara <Michal.Trojnara(a)mobi-com.net> wrote on 31.05.2007 20:48:08: > On Monday 28 May 2007 20:51, Peter Heimann wrote: > > Under heavy usage, stunnel-4.20 on AIX 5.3 enters into a loop with high > > CPU load. > > SSL_accept() returns with error, SSL_get_error() returns 5 > > (SSL_ERROR_SYSCALL). get_last_socket_error() returns EAGAIN, and the loop > > continues without end. Nevertheless, new connection requests still get > > processed. > Could it be the problem described at the end of this page: > https://www.systinet.com/doc/ssc-65/waspc/html/extlibs.install.openssl.html Indeed. Further experiments on AIX 5.3: OpenSSL 0.9.8e configured as "./Configure no-idea threads", compiled with "cc" (IBM XL C Compiler 7.0), stunnel 4.20 --> loop in init_ssl() OpenSSL 0.9.8e configured as "./Configure no-idea threads", compiled with "xlc_r" (IBM XL C Compiler 7.0, thread-safe variant), stunnel 4.20 --> no problem OpenSSL 0.9.8e configured as "./Configure no-idea threads", compiled with "gcc" (GCC version 4.1.1), stunnel 4.20 --> no problem Thanks for the hint. -- Regards Peter Heimann _______________________________________________________________ SMS schreiben mit WEB.DE FreeMail - einfach, schnell und kostenguenstig. Jetzt gleich testen! http://f.web.de/?mc=021192

1 0

Plz help the n00b (syslog-ng & stunnel)
by F.M. Taylor 31 May '07

31 May '07

Greetings all. Seemed simple enough, but I can seem to get it to work. I have obviously missed something simple. Here is the info you will need (and probably some you won't). I have tried every combination of options I can think of, and I have searched the archives and the web. It looks like it is almost working, but the server I am trying to connect to never sees the data (however "they" have it working on "their" systems, so it must be me). "They" say it connects, talks a little, no real data xfer, closes, then more data (followed by the obligatory TCP_RSTs for dead connects). [insert begging] [root@bofh stunnel-4.20]# stunnel /etc/stunnel/stunnel.conf 2007.05.25 10:43:00 LOG7[20728:182894198944]: Snagged 64 random bytes from /root/.rnd 2007.05.25 10:43:00 LOG7[20728:182894198944]: Wrote 1024 new random bytes to /root/.rnd 2007.05.25 10:43:00 LOG7[20728:182894198944]: RAND_status claims sufficient entropy for the PRNG 2007.05.25 10:43:00 LOG7[20728:182894198944]: PRNG seeded successfully 2007.05.25 10:43:00 LOG7[20728:182894198944]: Configuration SSL options: 0x00000FFF 2007.05.25 10:43:00 LOG7[20728:182894198944]: SSL options set: 0x00000FFF 2007.05.25 10:43:00 LOG7[20728:182894198944]: SSL context initialized for service 5140 [root@bofh stunnel-4.20]# tail -f /var/log/stunnel4/stunnel.log 2007.05.25 10:43:00 LOG5[20728:182894198944]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Auth:LIBWRAP 2007.05.25 10:43:00 LOG6[20728:182894198944]: file ulimit = 1024 (can be changed with 'ulimit -n') 2007.05.25 10:43:00 LOG6[20728:182894198944]: poll() used - no FD_SETSIZE limit for file descriptors 2007.05.25 10:43:00 LOG5[20728:182894198944]: 500 clients allowed 2007.05.25 10:43:00 LOG7[20728:182894198944]: FD 4 in non-blocking mode 2007.05.25 10:43:00 LOG7[20728:182894198944]: FD 5 in non-blocking mode 2007.05.25 10:43:00 LOG7[20728:182894198944]: FD 6 in non-blocking mode 2007.05.25 10:43:00 LOG7[20728:182894198944]: SO_REUSEADDR option set on accept socket 2007.05.25 10:43:00 LOG7[20728:182894198944]: 5140 bound to 127.0.0.1:5140 2007.05.25 10:43:00 LOG7[20729:182894198944]: Created pid file /var/run/stunnel4/stunnel.pid 2007.05.25 10:43:29 LOG7[20729:182894198944]: 5140 accepted FD=7 from 127.0.0.1:64820 2007.05.25 10:43:29 LOG7[20729:1073809760]: 5140 started 2007.05.25 10:43:29 LOG7[20729:1073809760]: FD 7 in non-blocking mode 2007.05.25 10:43:29 LOG7[20729:1073809760]: TCP_NODELAY option set on local socket 2007.05.25 10:43:29 LOG7[20729:1073809760]: FD 8 in non-blocking mode 2007.05.25 10:43:29 LOG7[20729:1073809760]: FD 9 in non-blocking mode 2007.05.25 10:43:29 LOG7[20729:1073809760]: Connection from 127.0.0.1:64820 permitted by libwrap 2007.05.25 10:43:29 LOG7[20729:182894198944]: Cleaning up the signal pipe 2007.05.25 10:43:29 LOG5[20729:1073809760]: 5140 accepted connection from 127.0.0.1:64820 2007.05.25 10:43:29 LOG6[20729:182894198944]: Child process 20748 finished with code 0 2007.05.25 10:43:29 LOG7[20729:1073809760]: FD 8 in non-blocking mode 2007.05.25 10:43:29 LOG7[20729:1073809760]: 5140 connecting xxx.xxx.xxx.xxx:5140 2007.05.25 10:43:29 LOG7[20729:1073809760]: connect_wait: waiting 10 seconds 2007.05.25 10:43:29 LOG7[20729:1073809760]: connect_wait: connected 2007.05.25 10:43:29 LOG5[20729:1073809760]: 5140 connected remote server from 192.168.2.23:64821 2007.05.25 10:43:29 LOG7[20729:1073809760]: Remote FD=8 initialized 2007.05.25 10:43:29 LOG7[20729:1073809760]: TCP_NODELAY option set on remote socket 2007.05.25 10:43:29 LOG7[20729:1073809760]: SSL state (connect): before/connect initialization 2007.05.25 10:43:29 LOG7[20729:1073809760]: SSL state (connect): SSLv3 write client hello A 2007.05.25 10:43:29 LOG7[20729:1073809760]: SSL state (connect): SSLv3 read server hello A 2007.05.25 10:43:29 LOG7[20729:1073809760]: SSL state (connect): SSLv3 read server certificate A 2007.05.25 10:43:29 LOG7[20729:1073809760]: SSL state (connect): SSLv3 read server done A 2007.05.25 10:43:29 LOG7[20729:1073809760]: SSL state (connect): SSLv3 write client key exchange A 2007.05.25 10:43:29 LOG7[20729:1073809760]: SSL state (connect): SSLv3 write change cipher spec A 2007.05.25 10:43:29 LOG7[20729:1073809760]: SSL state (connect): SSLv3 write finished A 2007.05.25 10:43:29 LOG7[20729:1073809760]: SSL state (connect): SSLv3 flush data 2007.05.25 10:43:29 LOG7[20729:1073809760]: SSL state (connect): SSLv3 read finished A 2007.05.25 10:43:29 LOG7[20729:1073809760]: 1 items in the session cache 2007.05.25 10:43:29 LOG7[20729:1073809760]: 1 client connects (SSL_connect()) 2007.05.25 10:43:29 LOG7[20729:1073809760]: 1 client connects that finished 2007.05.25 10:43:29 LOG7[20729:1073809760]: 0 client renegotiations requested 2007.05.25 10:43:29 LOG7[20729:1073809760]: 0 server connects (SSL_accept()) 2007.05.25 10:43:29 LOG7[20729:1073809760]: 0 server connects that finished 2007.05.25 10:43:29 LOG7[20729:1073809760]: 0 server renegotiations requested 2007.05.25 10:43:29 LOG7[20729:1073809760]: 0 session cache hits 2007.05.25 10:43:29 LOG7[20729:1073809760]: 0 session cache misses 2007.05.25 10:43:29 LOG7[20729:1073809760]: 0 session cache timeouts 2007.05.25 10:43:29 LOG6[20729:1073809760]: SSL connected: new session negotiated 2007.05.25 10:43:29 LOG6[20729:1073809760]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2007.05.25 10:43:29 LOG7[20729:1073809760]: SSL alert (read): warning: close notify 2007.05.25 10:43:29 LOG7[20729:1073809760]: SSL closed on SSL_read 2007.05.25 10:43:29 LOG7[20729:1073809760]: Socket write shutdown 2007.05.25 10:43:29 LOG7[20729:1073809760]: SSL write shutdown 2007.05.25 10:43:29 LOG7[20729:1073809760]: SSL alert (write): warning: close notify 2007.05.25 10:43:29 LOG6[20729:1073809760]: SSL_shutdown successfully sent close_notify 2007.05.25 10:43:29 LOG5[20729:1073809760]: Connection closed: 303 bytes sent to SSL, 0 bytes sent to socket 2007.05.25 10:43:29 LOG7[20729:1073809760]: 5140 finished (0 left) /etc/stunnel/stunnel.conf setuid = stunnel4 setgid = stunnel4 pid = /var/run/stunnel4/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log [5140] client = yes options = ALL accept = 127.0.0.1:5140 connect = xxx.xxx.xxx.xxx:5140 [root@bofh stunnel-4.20]# tail /var/log/syslog May 25 10:57:35 bofh syslog-ng[1926]: EOF occurred while idle; fd='11' May 25 10:57:35 bofh syslog-ng[1926]: Connection broken; time_reopen='60' May 25 10:58:37 bofh syslog-ng[1926]: EOF occurred while idle; fd='11' May 25 10:58:37 bofh syslog-ng[1926]: Connection broken; time_reopen='60' May 25 10:59:38 bofh syslog-ng[1926]: EOF occurred while idle; fd='11' May 25 10:59:38 bofh syslog-ng[1926]: Connection broken; time_reopen='60' -- ......\\|//........^^^^^........)))((........%%%%%........,,,,,...... ......(- -)........(o o)........(- o)........(0-0)........(* *)...... +--ooO-(_)-Ooo--oo0-(_)-0oo--ooO-(_)-Ooo--oo0-(_)-0oo--ooO-(_)-Ooo--+ | F.M. (Mike) Taylor........'Recedite, plebes! Gero rem imperialem!'| | 'Ecce potestas casei'..............GIAC GSEC & GCFW Certified.....| | Desk: 4-1872...........................C: 812-841-1876............| +-------------------------------------------------------------------+

1 2

Please help in difficulty in debugging the Stunnel code
by piyush tewari 31 May '07

31 May '07

Hello Friends, I am facing problems in debugging the source code of stunnel. When i debug line no 1266 of the options.c , that is "name=default_config_file;" , the df pointer gets it's value that means it is executing another line , line no 1305 of options.c itself "df=file_open(name, 0);". I am not getting this working of the stunnel code. And the other problem that i m facing is that during the debugging , many variables are not showing their occupied value. So please help me in understanding this working and resolving it. Thank you very much in advance for this help. warm regards Pkt --------------------------------- Get the free Yahoo! toolbar and rest assured with the added security of spyware protection.

1 0

stunnel-4.20 server loop on AIX 5.3
by Peter Heimann 28 May '07

28 May '07

Under heavy usage, stunnel-4.20 on AIX 5.3 enters into a loop with high CPU load. Test setup: client ------------> gateway ------------> server ApacheBench 2.0.40-dev stunnel-4.20 Apache 1.3 in server mode OpenSSL 0.9.8d stunnel 4.20 on powerpc-ibm-aix5.3.0.0 with OpenSSL 0.9.8d 28 Sep 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 ; stunnel configuration file, server mode cert = /etc/stunnel.pem setuid = stunnel setgid = stunnel pid = /tmp/stunnel.pid debug = local3.notice output = /tmp/stunnel.log [https] accept = gateway:4433 connect = server:80 The first client requests are processed without error, then some connections fail: % ab -n 1000 -c 70 https://gateway:4433/ This is ApacheBench, Version 2.0.40-dev <$Revision: 1.146 $> apache-2.0 [...] Test aborted after 10 failures Apr_socket_connect(): Invalid argument (22) Total of 705 requests completed One or more connections stay in state CLOSE_WAIT, and stunnel is chewing away CPU cycles (CPU usage >99%). % lsof -a -i -c stunnel COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME stunnel 196856 stunnel 6u IPv4 0xf100020002feeb98 0t0 TCP gateway:4433 (LISTEN) stunnel 196856 stunnel 46u IPv4 0xf100020002e98398 0t0 TCP gateway:4433 ->server:50271 (CLOSE_WAIT) In this state, attaching a debugger shows that stunnel is stuck in a loop in init_ssl() within client.c: +321 while(1) { +322 if(c->opt->option.client) +323 i=SSL_connect(c->ssl); +324 else +325 i=SSL_accept(c->ssl); +326 err=SSL_get_error(c->ssl, i); /* err==5 */ /* ... */ +349 if(err==SSL_ERROR_SYSCALL) { +350 switch(get_last_socket_error()) { +351 case EINTR: +353 case EAGAIN: /* loop continues */ +354 continue; +355 } +356 } SSL_accept() returns with error, SSL_get_error() returns 5 (SSL_ERROR_SYSCALL). get_last_socket_error() returns EAGAIN, and the loop continues without end. Nevertheless, new connection requests still get processed. Even before CPU usage goes up, for every new connection, SSL_accept() results in SSL_ERROR_SYSCALL for 20 to 1800 times before finally data is exchanged. stunnel enters this endless loop on AIX both with OpenSSL 0.9.8d and OpenSSL 0.9.8e. If I replace the AIX gateway machine with one running stunnel-4.20 on Solaris, I do not experience any problems. What might trigger this loop on AIX 5.3? How can it be avoided? -- Peter Heimann _______________________________________________________________ SMS schreiben mit WEB.DE FreeMail - einfach, schnell und kostenguenstig. Jetzt gleich testen! http://f.web.de/?mc=021192

1 0

Reconfiguration while running
by James Moe 27 May '07

27 May '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, Does Stunnel offer a way to reload the configuration file? Usually that is done with SIGHUP but the code looks like it just terminates. Does it have a way to sense that the conf has changed and reloads it? Or must Stunnel be terminated and restarted? - -- jimoe (at) sohnen-moe (dot) com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (OS/2) iD8DBQFGWhbJzTcr8Prq0ZMRAoy8AJ4ocDWfBEvEfoIYoypURg2hTxUh0gCfajo1 nVXpKD5iBFEx6ZHauPemnsU= =vGul -----END PGP SIGNATURE-----

1 0

Quick question relating to end to end encryption with hapoxy:
by lists 27 May '07

27 May '07

I'm using stunnel to decrypt HTTPS and pass it to HAPROXY to insert a cookie and it works very well and very fast. Is their a way of making HAPROXY talk to the backend servers in HTTPS? i.e.. End to end encryption. Can I re-direct it back through stunnel in reverse? Thanks in advance, Malcolm.

2 1

Brocken Connections
by Manfred Alfaré 25 May '07

25 May '07

Hi! I have some trouble using STUNNEL on WIN98 to secure connections to HFS (Http File Server), and hope, somebody can help me. I can connect to HFS with the Browser (Firefox 2.0.0.3, IE 6.0, on the same machine HFS is running, an other one in LAN and a third via internet) and download files, bat every downloaded File is corrupt. In most cases, transfer seems to terminate normally, but the downloaded file ist to short, sometimes there is popup, that tells me, that the file could not be read, because the connection is broken. The log file shows the following: ********************************* stunnel 4.20 on x86-pc-mingw32-gnu with OpenSSL 0.9.8d 28 Sep 2006 Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv4 No limit detected for the number of clients https accepted connection from 85.127.28.154:63819 https connected remote server from 127.0.0.1:1287 Connection closed: 1632 bytes sent to SSL, 476 bytes sent to socket https accepted connection from 85.127.28.154:63821 https accepted connection from 85.127.28.154:63823 https connected remote server from 127.0.0.1:1290 https connected remote server from 127.0.0.1:1291 Connection closed: 919 bytes sent to SSL, 349 bytes sent to socket Connection closed: 720 bytes sent to SSL, 402 bytes sent to socket https accepted connection from 85.127.28.154:63825 https accepted connection from 85.127.28.154:63827 https connected remote server from 127.0.0.1:1294 https connected remote server from 127.0.0.1:1295 Connection closed: 715 bytes sent to SSL, 402 bytes sent to socket Connection closed: 277 bytes sent to SSL, 402 bytes sent to socket https accepted connection from 85.127.28.154:63829 https connected remote server from 127.0.0.1:1297 Connection closed: 269 bytes sent to SSL, 402 bytes sent to socket https accepted connection from 85.127.28.154:63831 https connected remote server from 127.0.0.1:1299 Connection closed: 920 bytes sent to SSL, 349 bytes sent to socket https accepted connection from 85.127.28.154:63833 https connected remote server from 127.0.0.1:1301 https accepted connection from 85.127.28.154:63835 https connected remote server from 127.0.0.1:1303 Connection closed: 920 bytes sent to SSL, 349 bytes sent to socket readsocket: Connection reset by peer (WSAECONNRESET) (10054) Connection reset: 1289938 bytes sent to SSL, 481 bytes sent to socket ************************* My STUNNEL.CONF looks like this: ******************************** ; File with certificate and private key cert = stunnel.pem key = stunnel.pem ; Log (1= minimal, 5=recommended, 7=all) and log file) ; Preceed with a ";" to disable logging debug = 5 output = stunnel.log ; Some performance tuning socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Data compression algorithm: zlib or rle compression = zlib ; SSL bug options / NO SSL:v2 (SSLv3 and TLSv1 is enabled) options = ALL options = NO_SSLv2 ; Service-level configuration ; Stunnel listens to port 443 (HTTPS) to any IP ; and connects to port 44300 (HFS) on localhost [https] accept = 0.0.0.0:443 connect = 127.0.0.1:44300 TIMEOUTclose = 0 ************************************* Your help will be appreciated. Regards Manfred Alfare (not a native englisch speaker :-(

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 34, Issue 5
by GNUtoo＠no-log.org 23 May '07

23 May '07

> >>> in cygwin i have the following errors: >>> $ openssl req -new -x509 -days 365 -nodes -config >>> /etc/stunnel/stunnel.conf -out stunnel.pem -keyout stunnel.pem >>> Generating a 512 bit RSA private key >>> ..++++++++++++ >>> .....++++++++++++ >>> writing new private key to 'stunnel.pem' >>> ----- >>> unable to find 'distinguished_name' in config >>> problems making Certificate Request >>> 1988:error:0E06D06C:configuration file routines:NCONF_get_string:no >>> value:conf_lib.c:329:group=req name=distinguished_name >>> >>> $ /usr/bin/stunnel.exe >>> 2007.05.13 22:37:12 LOG4[2188:6422536]: Wrong permissions on >>> /etc/stunnel/mail.pem >>> 2007.05.13 22:37:12 LOG3[2188:6422536]: Error reading certificate file: >>> /etc/stunnel/stunnel.pem >>> 2007.05.13 22:37:12 LOG3[2188:6422536]: error stack: 140DC009 : >>> error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib >>> 2007.05.13 22:37:12 LOG3[2188:6422536]: >>> SSL_CTX_use_certificate_chain_file: 906D06C: error:0906D06C:PEM >>> routines:PEM_read_bio:no start line >>> >>> and i ran all as Administrator >> >> Can you please post your /etc/stunnel/stunnel.conf, and also the results >> of >> 'ls -al /etc/stunnel'. Thanks, Andrew. >> > $ ls -al /etc/stunnel/ > total 6 > drwx------+ 2 FC1 Users 0 May 13 22:37 . > drwx------+ 11 FC1 Users 0 May 13 21:56 .. > lrwxrwxrwx 1 Administrator Nessuno 11 May 13 22:37 mail.pem -> > stunnel.pem > -rwx------ 1 Administrator Nessuno 1578 May 13 22:36 stunnel.conf > -rwx------+ 1 FC1 Users 1533 May 13 22:13 stunnel.conf-sample > -rw-r--r-- 1 Administrator Nessuno 497 May 13 22:36 stunnel.pem > > > $ cat /etc/stunnel/stunnel.conf > #; Sample stunnel configuration file by Michal Trojnara 2002-2006 > #; Some options used here may not be adequate for your particular > configuration > #; Please make sure you understand them (especially the effect of chroot > jail) > > #; Certificate/key is needed in server mode and optional in client mode > #;cert = /etc/stunnel/mail.pem > key = /etc/stunnel/mail.pem > > #; Protocol version (all, SSLv2, SSLv3, TLSv1) > sslVersion = SSLv3 > > #; Some security enhancements for UNIX systems - comment them out on Win32 > chroot = /var/lib/stunnel/ > setuid = nobody > setgid = nobody > #; PID is created inside chroot jail > pid = /stunnel.pid > > #; Some performance tunings > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > #;compression = rle > > #; Workaround for Eudora bug > #;options = DONT_INSERT_EMPTY_FRAGMENTS > > #; Authentication stuff > #;verify = 2 > #; Don't forget to c_rehash CApath > #; CApath is located inside chroot jail > #;CApath = /certs > #; It's often easier to use CAfile > #;CAfile = /etc/stunnel/certs.pem > #; Don't forget to c_rehash CRLpath > #; CRLpath is located inside chroot jail > #;CRLpath = /crls > #; Alternatively you can use CRLfile > #;CRLfile = /etc/stunnel/crls.pem > > #; Some debugging stuff useful for troubleshooting > #;debug = 7 > #;output = stunnel.log > > #; Use it for client mode > #;client = yes > > #; Service-level configuration > > #;[pop3s] > #;accept = 995 > #;connect = 110 > > #;[imaps] > #;accept = 993 > #;connect = 143 > > #;[ssmtp] > #;accept = 465 > #;connect = 25 > > #;[https] > ##;accept = 443 > #;connect = 80 > #;TIMEOUTclose = 0 > > #; vim:ft=dosini > > [vnc] > accept = 127.0.0.1:5500 > connect = 192.168.1.107:443 now that i have posted the config file...do i need to post something else?

2 1

Re: [stunnel-users] Simple SMTP encryption
by Hans Werner Strube 21 May '07

21 May '07

James Moe wrote: > client = yes > > [smtps] > accept = 127.0.0.1:465 > connect = smtpauth.earthlink.net:25 > > I missed the part somewhere that tells Stunnel to issue a STARTTLS to > the smtp server before attempting to negotiate a TLS connection. Add (under [smtps]): protocol = smtp

1 0

Simple SMTP encryption
by James Moe 19 May '07

19 May '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hello, stunnel 4.20 with OpenSSL 0.9.8d 28 Sep 2006 I wish have my MUA to send messages encrypted to a secure mail server. Stunnel is set up as a client with the following configuration: client = yes [smtps] accept = 127.0.0.1:465 connect = smtpauth.earthlink.net:25 I missed the part somewhere that tells Stunnel to issue a STARTTLS to the smtp server before attempting to negotiate a TLS connection. The "failed handshake" bit is because the server is rejecting the command because of NULLs in the text stream. 501 NULL characters are not allowed in SMTP commands. Then there is the "wrong version" error. I suppose that is a side effect of the handshake failure? Here is a typical connection log: 2007.05.19 12:52:42 LOG7[232:4239]: smtps accepted FD=12 from 127.0.0.1:52672 2007.05.19 12:52:42 LOG7[232:4239]: Creating a new thread 2007.05.19 12:52:42 LOG7[232:4239]: New thread created 2007.05.19 12:52:42 LOG7[264:4239]: smtps started 2007.05.19 12:52:42 LOG7[264:4239]: FD 12 in non-blocking mode 2007.05.19 12:52:42 LOG7[264:4239]: TCP_NODELAY option set on local socket 2007.05.19 12:52:42 LOG5[264:4239]: smtps accepted connection from 127.0.0.1:52672 2007.05.19 12:52:42 LOG7[264:4239]: FD 15 in non-blocking mode 2007.05.19 12:52:42 LOG7[264:4239]: smtps connecting 207.69.189.201:25 2007.05.19 12:52:42 LOG7[264:4239]: connect_wait: waiting 10 seconds 2007.05.19 12:52:42 LOG7[264:4239]: connect_wait: connected 2007.05.19 12:52:42 LOG5[264:4239]: smtps connected remote server from 192.168.69.14:52673 2007.05.19 12:52:42 LOG7[264:4239]: Remote FD=15 initialized 2007.05.19 12:52:42 LOG7[264:4239]: TCP_NODELAY option set on remote socket 2007.05.19 12:52:42 LOG7[264:4239]: SSL state (connect): before/connect initialization 2007.05.19 12:52:42 LOG7[264:4239]: SSL state (connect): SSLv3 write client hello A 2007.05.19 12:52:42 LOG7[264:4239]: SSL alert (write): fatal: handshake failure 2007.05.19 12:52:42 LOG3[264:4239]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2007.05.19 12:52:42 LOG5[264:4239]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.05.19 12:52:42 LOG7[264:4239]: smtps finished (0 left) - -- jimoe (at) sohnen-moe (dot) com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (OS/2) iD8DBQFGT1lQzTcr8Prq0ZMRAv50AJ9Kydmi3F/VBQ8hvpr+HmodUZhJEgCfQjbz TRdvnzpATUH/y3gzA1EXMYo= =jTqm -----END PGP SIGNATURE-----

1 0

Several connections on a short period of time problem
by Teigao, Rafael Coninck 16 May '07

16 May '07

Hi, I'm running Stunnel 4.20 to connect a Win client to a Win server. On the server it runs as a service, but on the client side I call it every time a connection is requested with a different config file (I need dynamic configuration) If I connect, disconnect and connect again very quickly (say, in 10 seconds), the fourth time (usually) that I try to connect will give me error 10060 (timeout) on the client application (not Stunnel). Does Stunnel restrict the amount of connection from the same client based on time or something like that? Thanks, Rafael.

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 34, Issue 4
by GNUtoo＠no-log.org 15 May '07

15 May '07

>> in cygwin i have the following errors: >> $ openssl req -new -x509 -days 365 -nodes -config >> /etc/stunnel/stunnel.conf -out stunnel.pem -keyout stunnel.pem >> Generating a 512 bit RSA private key >> ..++++++++++++ >> .....++++++++++++ >> writing new private key to 'stunnel.pem' >> ----- >> unable to find 'distinguished_name' in config >> problems making Certificate Request >> 1988:error:0E06D06C:configuration file routines:NCONF_get_string:no >> value:conf_lib.c:329:group=req name=distinguished_name >> >> $ /usr/bin/stunnel.exe >> 2007.05.13 22:37:12 LOG4[2188:6422536]: Wrong permissions on >> /etc/stunnel/mail.pem >> 2007.05.13 22:37:12 LOG3[2188:6422536]: Error reading certificate file: >> /etc/stunnel/stunnel.pem >> 2007.05.13 22:37:12 LOG3[2188:6422536]: error stack: 140DC009 : >> error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib >> 2007.05.13 22:37:12 LOG3[2188:6422536]: >> SSL_CTX_use_certificate_chain_file: 906D06C: error:0906D06C:PEM >> routines:PEM_read_bio:no start line >> >> and i ran all as Administrator > > Can you please post your /etc/stunnel/stunnel.conf, and also the results > of > 'ls -al /etc/stunnel'. Thanks, Andrew. > $ ls -al /etc/stunnel/ total 6 drwx------+ 2 FC1 Users 0 May 13 22:37 . drwx------+ 11 FC1 Users 0 May 13 21:56 .. lrwxrwxrwx 1 Administrator Nessuno 11 May 13 22:37 mail.pem -> stunnel.pem -rwx------ 1 Administrator Nessuno 1578 May 13 22:36 stunnel.conf -rwx------+ 1 FC1 Users 1533 May 13 22:13 stunnel.conf-sample -rw-r--r-- 1 Administrator Nessuno 497 May 13 22:36 stunnel.pem $ cat /etc/stunnel/stunnel.conf #; Sample stunnel configuration file by Michal Trojnara 2002-2006 #; Some options used here may not be adequate for your particular configuration #; Please make sure you understand them (especially the effect of chroot jail) #; Certificate/key is needed in server mode and optional in client mode #;cert = /etc/stunnel/mail.pem key = /etc/stunnel/mail.pem #; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 #; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel/ setuid = nobody setgid = nobody #; PID is created inside chroot jail pid = /stunnel.pid #; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 #;compression = rle #; Workaround for Eudora bug #;options = DONT_INSERT_EMPTY_FRAGMENTS #; Authentication stuff #;verify = 2 #; Don't forget to c_rehash CApath #; CApath is located inside chroot jail #;CApath = /certs #; It's often easier to use CAfile #;CAfile = /etc/stunnel/certs.pem #; Don't forget to c_rehash CRLpath #; CRLpath is located inside chroot jail #;CRLpath = /crls #; Alternatively you can use CRLfile #;CRLfile = /etc/stunnel/crls.pem #; Some debugging stuff useful for troubleshooting #;debug = 7 #;output = stunnel.log #; Use it for client mode #;client = yes #; Service-level configuration #;[pop3s] #;accept = 995 #;connect = 110 #;[imaps] #;accept = 993 #;connect = 143 #;[ssmtp] #;accept = 465 #;connect = 25 #;[https] ##;accept = 443 #;connect = 80 #;TIMEOUTclose = 0 #; vim:ft=dosini [vnc] accept = 127.0.0.1:5500 connect = 192.168.1.107:443

1 0

certs problems in cygwin
by GNUtoo＠no-log.org 14 May '07

14 May '07

in cygwin i have the following errors: $ openssl req -new -x509 -days 365 -nodes -config /etc/stunnel/stunnel.conf -out stunnel.pem -keyout stunnel.pem Generating a 512 bit RSA private key ..++++++++++++ .....++++++++++++ writing new private key to 'stunnel.pem' ----- unable to find 'distinguished_name' in config problems making Certificate Request 1988:error:0E06D06C:configuration file routines:NCONF_get_string:no value:conf_lib.c:329:group=req name=distinguished_name $ /usr/bin/stunnel.exe 2007.05.13 22:37:12 LOG4[2188:6422536]: Wrong permissions on /etc/stunnel/mail.pem 2007.05.13 22:37:12 LOG3[2188:6422536]: Error reading certificate file: /etc/stunnel/stunnel.pem 2007.05.13 22:37:12 LOG3[2188:6422536]: error stack: 140DC009 : error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib 2007.05.13 22:37:12 LOG3[2188:6422536]: SSL_CTX_use_certificate_chain_file: 906D06C: error:0906D06C:PEM routines:PEM_read_bio:no start line and i ran all as Administrator

2 1

with the windows version it isn't better...same kind of errors
by GNUtoo＠no-log.org 13 May '07

13 May '07

C:\Programmi\openssl>openssl.exe req -new -x509 -days 365 -nodes -config stunnel .conf -out stunnel.pem -keyout stunnel.pem Loading 'screen' into random state - done Generating a 512 bit RSA private key .....++++++++++++ .......................++++++++++++ writing new private key to 'stunnel.pem' ----- unable to find 'distinguished_name' in config problems making Certificate Request 1772:error:0E06D06C:configuration file routines:NCONF_get_string:no value:./cryp to/conf/conf_lib.c:329:group=req name=distinguished_name 2007.05.13 23:05:03 LOG3[304:860]: Error resolving 'VNC_client_IP_address': Neither nodename nor servname known (EAI_NONAME) Cannot resolve 'VNC_client_IP_address:443' - delaying DNS lookup 2007.05.13 23:05:03 LOG3[304:860]: Error reading certificate file: stunnel.pem 2007.05.13 23:05:03 LOG3[304:860]: error stack: 140DC009 : error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib 2007.05.13 23:05:03 LOG3[304:860]: SSL_CTX_use_certificate_chain_file: 906D06C: error:0906D06C:PEM routines:PEM_read_bio:no start line 2007.05.13 23:05:03 LOG3[304:860]: Server is down

1 0

RTMPS
by Grant Kohler 11 May '07

11 May '07

Has anybody had any luck getting RTMP and stunnel to work together with RTMPS? Thanks, -Grant

1 0

Stunnel-Mozilla Thunderbird 2.0 and Spampal
by Jim 30 Apr '07

30 Apr '07

2 1

RE: [stunnel-users] Vista not connecting to port 139
by Neil Aggarwal 29 Apr '07

29 Apr '07

Alaric: This is strange. When I go to the Security Center, it says the McAfee Personal Firewall is on, but I can't find it in the Start menu, Services, or anywhere else. Any ideas? Thanks, Neil -- Neil Aggarwal, (832)245-7314, www.JAMMConsulting.com FREE! Eliminate junk email and reclaim your inbox. Visit http://www.spammilter.com for details. -----Original Message----- From: Alaric Dailey [mailto:[email protected]] Sent: Thursday, April 26, 2007 3:48 PM To: 'Neil Aggarwal' Subject: RE: [stunnel-users] Vista not connecting to port 139 I would check the windows firewall, or any other security suite you may have. -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Neil Aggarwal Sent: Thursday, April 26, 2007 15:30 To: stunnel-users(a)mirt.net Subject: [stunnel-users] Vista not connecting to port 139 Hello: I am trying to map a network drive over an stunnel connection. The server is Linux and the client machine is Windows Vista (Ugh!). I have stunnel installed and working. I have the following in my stunnel.conf: client = yes delay = yes [netDrives] accept = 222.222.222.222:139 connect = www.jammconsulting.com:2139 When I go to map the network drive on vista, I use this command: net use x: \\222.222.222.222\MyShare mypass /user:myuser It eventually gives me an error message about network path not found. Looking at the stunnel window, there are no messages about any connections to the stunnel. If I do: telnet 222.222.222.222 139 the telnet session connects and I see messages about a connection in the stunnel window. Any ideas why Vista is not using port 139? Thanks, Neil -- Neil Aggarwal, (832)245-7314, www.JAMMConsulting.com FREE! Eliminate junk email and reclaim your inbox. Visit http://www.spammilter.com for details. _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

Re: [stunnel-users] Handshake failure
by RUTSCHLE Yves 27 Apr '07

27 Apr '07

RUTSCHLE Yves wrote: > Argh. After removing all my debugging printf's, it turns out it doesn't seem > to work after all. Which, if it has to do with signals and timing, is only > partly surprising. Ok, nothing to do with any of that. Deep inside OpenSSL, there is a call to gmtime_r. Deep somewhere in hell (I hope), someone decided that LynxOS' gmtime_r functions would have its arguments *reversed*. REVERSED. I guess they were going for SIXPO complience. So that call would write rubbish in the stack, hence no returning from the call and segfault instead. So, nothing to do with stunnel after all. Thanks for the support anyway! :) Y. - TGIFriday

1 0

[PATCH?] Senting a list of accepted CAs to the client
by Miloslav Trmac 27 Apr '07

27 Apr '07

Hello, stunnel currently does not send a list of accepted CAs, see e.g. https://bugzilla.mozilla.org/show_bug.cgi?id=327001#c20 . Sending the list was #if 0-ed out sometime between stunnel 3.22 and 4.00, with no change log entry AFAICS. Does anyone remember know why was it disabled, and whether it is safe to reenable (e. g. using the attached patch)? Thanks, Mirek

1 0

Vista not connecting to port 139
by Neil Aggarwal 26 Apr '07

26 Apr '07

Hello: I am trying to map a network drive over an stunnel connection. The server is Linux and the client machine is Windows Vista (Ugh!). I have stunnel installed and working. I have the following in my stunnel.conf: client = yes delay = yes [netDrives] accept = 222.222.222.222:139 connect = www.jammconsulting.com:2139 When I go to map the network drive on vista, I use this command: net use x: \\222.222.222.222\MyShare mypass /user:myuser It eventually gives me an error message about network path not found. Looking at the stunnel window, there are no messages about any connections to the stunnel. If I do: telnet 222.222.222.222 139 the telnet session connects and I see messages about a connection in the stunnel window. Any ideas why Vista is not using port 139? Thanks, Neil -- Neil Aggarwal, (832)245-7314, www.JAMMConsulting.com FREE! Eliminate junk email and reclaim your inbox. Visit http://www.spammilter.com for details.

1 0

Stunnel on Vista
by Neil Aggarwal 26 Apr '07

26 Apr '07

Hello: Has anyone used stunnel on Vista? For some stupid reason, it tells me I can't save the stunnel.conf file. Thanks, Neil -- Neil Aggarwal, (214)986-3533, www.JAMMConsulting.com FREE! Eliminate junk email and reclaim your inbox. Visit http://www.spammilter.com for details.

2 2

Re: [stunnel-users] Handshake failure
by RUTSCHLE Yves 26 Apr '07

26 Apr '07

Michal Trojnara wrote: >Some systems require to reset signal handler each time a signal was >received, while for others the handler is executed recursively destroying >CPU stack of running stunnel process. Ah. That'd explain it. Thanks for the tip and the explanations! Y.

1 0

Handshake failure
by RUTSCHLE Yves 26 Apr '07

26 Apr '07

Hello, I am trying to set up a stunnel between two machines running LynxOS, which is a POSIX derivative. I've compiled OpenSSL 0.9.8e, and stunnel 4.20: stunnel 4.20 on i386-unknown-lynxos with OpenSSL 0.9.8e 23 Feb 2007 Threading:FORK SSL:ENGINE Sockets:POLL,IPv4 [...] I use the following config files: ////// server side debug=7 foreground=yes pid= CAfile=valid_certs key=privkey.pem cert=cert.pem verify=1 [SSLTunnel] accept=1235 connect=1234 ////// end server side ////// client side debug=7 foreground=yes pid= CAfile=valid_certs key=privkey.pem cert=cert.pem verify=1 client=yes [SSLTunnel] accept=4234 connect=173.16.1.10:1235 ////// end client side (It's run from different directories so the PEM files are different) After running both stunnels, I connect to the client side and see a beginning of handshake; however, it then breaks down: from afar, it looks like the client doesn't take the server certificate: ///// server trace 2007.04.25 15:33:22 LOG7[58:0]: Snagged 64 random bytes from /home/st07815/.rnd 2007.04.25 15:33:22 LOG7[58:0]: Wrote 1024 new random bytes to /home/st07815/.rnd 2007.04.25 15:33:22 LOG7[58:0]: RAND_status claims sufficient entropy for the PRNG 2007.04.25 15:33:22 LOG7[58:0]: PRNG seeded successfully 2007.04.25 15:33:22 LOG7[58:0]: Certificate: cert.pem 2007.04.25 15:33:22 LOG7[58:0]: Certificate loaded 2007.04.25 15:33:22 LOG7[58:0]: Key file: privkey.pem 2007.04.25 15:33:22 LOG7[58:0]: Private key loaded 2007.04.25 15:33:22 LOG7[58:0]: Loaded verify certificates from valid_certs 2007.04.25 15:33:22 LOG7[58:0]: Loaded valid_certs revocation lookup file 2007.04.25 15:33:22 LOG7[58:0]: SSL context initialized for service SSLTunnel 2007.04.25 15:33:22 LOG5[58:0]: stunnel 4.20 on i386-unknown-lynxos with OpenSSL 0.9.8e 23 Feb 2007 2007.04.25 15:33:22 LOG5[58:0]: Threading:FORK SSL:ENGINE Sockets:POLL,IPv4 2007.04.25 15:33:22 LOG6[58:0]: file ulimit = 64 (can be changed with 'ulimit -n') 2007.04.25 15:33:22 LOG6[58:0]: poll() used - no FD_SETSIZE limit for file descriptors 2007.04.25 15:33:22 LOG5[58:0]: 29 clients allowed 2007.04.25 15:33:22 LOG7[58:0]: FD 3 in non-blocking mode 2007.04.25 15:33:22 LOG7[58:0]: FD 4 in non-blocking mode 2007.04.25 15:33:22 LOG7[58:0]: FD 5 in non-blocking mode 2007.04.25 15:33:22 LOG7[58:0]: SO_REUSEADDR option set on accept socket 2007.04.25 15:33:22 LOG7[58:0]: SSLTunnel bound to 0.0.0.0:1235 2007.04.25 15:33:22 LOG7[58:0]: No pid file being created (end of init, waiting for connection) 2007.04.25 15:34:17 LOG7[58:0]: SSLTunnel accepted FD=6 from 173.16.1.7:1092 2007.04.25 15:34:17 LOG7[68:0]: SSLTunnel started 2007.04.25 15:34:17 LOG7[68:0]: FD 6 in non-blocking mode 2007.04.25 15:34:17 LOG5[68:0]: SSLTunnel accepted connection from 173.16.1.7:1092 2007.04.25 15:34:17 LOG7[68:0]: SSL state (accept): before/accept initialization 2007.04.25 15:34:17 LOG7[68:0]: SSL state (accept): SSLv3 read client hello A 2007.04.25 15:34:17 LOG7[68:0]: SSL state (accept): SSLv3 write server hello A 2007.04.25 15:34:17 LOG7[68:0]: SSL state (accept): SSLv3 write certificate A 2007.04.25 15:34:17 LOG7[68:0]: SSL state (accept): SSLv3 write certificate request A 2007.04.25 15:34:17 LOG7[68:0]: SSL state (accept): SSLv3 flush data 2007.04.25 15:34:19 LOG3[68:0]: SSL_accept: Peer suddenly disconnected 2007.04.25 15:34:19 LOG5[68:0]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.04.25 15:34:19 LOG7[58:0]: Cleaning up the signal pipe 2007.04.25 15:34:19 LOG7[58:0]: Process 68 finished with code 0 (0 left) ///// end server trace ///// client trace 2007.04.25 15:33:59 LOG7[12:0]: Snagged 64 random bytes from /home/st07815/.rnd 2007.04.25 15:33:59 LOG7[12:0]: Wrote 1024 new random bytes to /home/st07815/.rnd 2007.04.25 15:33:59 LOG7[12:0]: RAND_status claims sufficient entropy for the PRNG 2007.04.25 15:33:59 LOG7[12:0]: PRNG seeded successfully 2007.04.25 15:33:59 LOG7[12:0]: Certificate: cert.pem 2007.04.25 15:33:59 LOG7[12:0]: Certificate loaded 2007.04.25 15:33:59 LOG7[12:0]: Key file: privkey.pem 2007.04.25 15:33:59 LOG7[12:0]: Private key loaded 2007.04.25 15:33:59 LOG7[12:0]: Loaded verify certificates from valid_certs 2007.04.25 15:33:59 LOG7[12:0]: Loaded valid_certs revocation lookup file 2007.04.25 15:33:59 LOG7[12:0]: SSL context initialized for service SSLTunnel 2007.04.25 15:33:59 LOG5[12:0]: stunnel 4.20 on i386-unknown-lynxos with OpenSSL 0.9.8e 23 Feb 2007 2007.04.25 15:33:59 LOG5[12:0]: Threading:FORK SSL:ENGINE Sockets:POLL,IPv4 2007.04.25 15:33:59 LOG6[12:0]: file ulimit = 64 (can be changed with 'ulimit -n') 2007.04.25 15:33:59 LOG6[12:0]: poll() used - no FD_SETSIZE limit for file descriptors 2007.04.25 15:33:59 LOG5[12:0]: 29 clients allowed 2007.04.25 15:33:59 LOG7[12:0]: FD 3 in non-blocking mode 2007.04.25 15:33:59 LOG7[12:0]: FD 4 in non-blocking mode 2007.04.25 15:33:59 LOG7[12:0]: FD 5 in non-blocking mode 2007.04.25 15:33:59 LOG7[12:0]: SO_REUSEADDR option set on accept socket 2007.04.25 15:33:59 LOG7[12:0]: SSLTunnel bound to 0.0.0.0:4234 2007.04.25 15:33:59 LOG7[12:0]: No pid file being created (end of init, waiting for connection) 2007.04.25 15:34:27 LOG7[12:0]: SSLTunnel accepted FD=6 from 152.14.101.54:64752 2007.04.25 15:34:27 LOG7[27:0]: SSLTunnel started 2007.04.25 15:34:27 LOG7[27:0]: FD 6 in non-blocking mode 2007.04.25 15:34:27 LOG5[27:0]: SSLTunnel accepted connection from 152.14.101.54:64752 2007.04.25 15:34:27 LOG7[27:0]: FD 5 in non-blocking mode 2007.04.25 15:34:27 LOG7[27:0]: SSLTunnel connecting 173.16.1.10:1235 2007.04.25 15:34:27 LOG7[27:0]: connect_wait: waiting 10 seconds 2007.04.25 15:34:27 LOG7[27:0]: connect_wait: connected 2007.04.25 15:34:27 LOG5[27:0]: SSLTunnel connected remote server from 173.16.1.7:1092 2007.04.25 15:34:27 LOG7[27:0]: Remote FD=5 initialized 2007.04.25 15:34:27 LOG7[27:0]: SSL state (connect): before/connect initialization 2007.04.25 15:34:27 LOG7[27:0]: SSL state (connect): SSLv3 write client hello A 2007.04.25 15:34:27 LOG7[27:0]: SSL state (connect): SSLv3 read server hello A 2007.04.25 15:34:28 LOG7[12:0]: Cleaning up the signal pipe 2007.04.25 15:34:28 LOG7[12:0]: Process 27 terminated on signal 11 (0 left) ///// end client trace Now the strange thing is that this very same setup works on Solaris, so I have something wrong with the port of either OpenSSL or stunnel on LynxOS. If someone could give me a hint as to where to start poking, I'd greatly appreciate it. TIA, Y.

2 2

Stunnel with Goldmine 6.70.61214
by Raymond Randall 26 Apr '07

26 Apr '07

Greetings! Use Goldmine with Gmail domain services. Have set up according to Mike Casteel's instructions. However, Goldmine will not download email from the Gmail (the GMail address: rayrandall(a)ethosadvisory.com) Here is the stunnel.conf file: client=yes [pop3] accept=9995 connect=pop.gmail.com:995 [smtp] accept=465 connect=smtp.gmail.com:465 POP and SMTP set to: 127.0.0.1 Here is the stunnel report: 2007.04.26 06:32:20 LOG3[1972:1996]: Error resolving 'pop.gmail.com': Neither nodename nor servname known (EAI_NONAME) Cannot resolve 'pop.gmail.com:995' - delaying DNS lookup 2007.04.26 06:32:20 LOG3[1972:1996]: Error resolving 'smtp.gmail.com': Neither nodename nor servname known (EAI_NONAME) Cannot resolve 'smtp.gmail.com:465' - delaying DNS lookup 2007.04.26 06:32:20 LOG5[1972:1996]: stunnel 4.16 on x86-pc-mingw32-gnu with OpenSSL 0.9.7e 25 Oct 2004 2007.04.26 06:32:20 LOG5[1972:1996]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2007.04.26 06:32:24 LOG5[1972:424]: No limit detected for the number of clients 2007.04.26 07:11:56 LOG5[1972:1204]: pop3 connected from 127.0.0.1:1600 2007.04.26 07:14:01 LOG5[1972:1204]: Connection closed: 2795 bytes sent to SSL, 662451 bytes sent to socket Perhaps this is a Goldmine configuration error. Not sure, and appreciate suggestions. Ray Randall -- Ethos Advisory Services Ray Randall 617-275-5565 Fax: 877-895-3756 http://www.ethosadvisory.com Information provided by Ethos is based on sources we believe reliable. Ethos does not offer legal or accounting services. Information contained in this email message is confidential and may contain privileged information. Any review or use of the information contained in this email message by persons other than the intended recipient(s) is prohibited. Content of this email is illustrative and educational; it is not a recommendation to purchase or sell. The examples presented do not take into consideration commissions, tax implications or other transaction costs, which may significantly affect the economic consequences of a given strategy. Mutual fund investing involves risk, including the possible loss of principal. Index performance returns do not reflect any management fees, transaction costs, or expenses. Past performance does not guarantee future results.

1 0

Connecting via rtmps to Red5 server
by David Schulberg 25 Apr '07

25 Apr '07

Hi, I have been led to stunnel as the way to get a Flash application to communicate securely with Red5 server. Red5 doesn't directly support ssl connectivity but using rtmps protocol (rtmp tunnelled via https) clients should be able to connect to Red5 if stunnel handles the encrypted traffic on port 443 and passes unencrypted communications back and forth to the Red5 on a port it expects to receive rtmp communication.. (refer http://www.adobe.com/devnet/flashcom/articles/firewalls_proxy04.html) The log file I get when I attempt to talk rtmps is shown below 2007.04.25 18:19:04 LOG7[3932:3384]: New thread created 2007.04.25 18:19:04 LOG7[3932:3664]: https started 2007.04.25 18:19:04 LOG7[3932:3664]: FD 224 in non-blocking mode 2007.04.25 18:19:04 LOG7[3932:3664]: TCP_NODELAY option set on local socket 2007.04.25 18:19:04 LOG5[3932:3664]: https accepted connection from 127.0.0.1:1249 2007.04.25 18:19:04 LOG7[3932:3664]: FD 248 in non-blocking mode 2007.04.25 18:19:04 LOG7[3932:3664]: https connecting 127.0.0.1:1935 2007.04.25 18:19:04 LOG7[3932:3664]: connect_wait: waiting 10 seconds 2007.04.25 18:19:04 LOG7[3932:3664]: connect_wait: connected 2007.04.25 18:19:04 LOG5[3932:3664]: https connected remote server from 127.0.0.1:1250 2007.04.25 18:19:04 LOG7[3932:3664]: Remote FD=248 initialized 2007.04.25 18:19:04 LOG7[3932:3664]: TCP_NODELAY option set on remote socket 2007.04.25 18:19:04 LOG7[3932:3664]: SSL state (connect): before/connect initialization 2007.04.25 18:19:04 LOG7[3932:3664]: SSL state (connect): SSLv3 write client hello A 2007.04.25 18:24:04 LOG6[3932:3664]: init_ssl: s_poll_wait timeout 2007.04.25 18:24:04 LOG5[3932:3664]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.04.25 18:24:04 LOG7[3932:3664]: https finished (0 left) The stunnel.conf file has the following settings that pertain specifically to this situation client = yes [https] accept = 443 connect = 1935 What I seem to see (according to the logfile) is that an ssl connection is successfully established but no subsequent communication takes place after the connection has been made. At this point my Flash application doesn't send any messages via the ssl connection which seems to implicate my client as being the source of my problem. I would appreciate any advice on how I can best investigate this whole situation to resolve the issue. Regards, David Schulberg email: davids(a)evertech.com.au

2 2

firewall very restricted!!
by Pitoniso Rikito Rikin 17 Apr '07

17 Apr '07

Ok guys look this... my only contact with the world is trought the WEB port 80 how i can establish a ssh connection trought this port, the only method avaible is the GET or POST.... well how i do this... help --------------------------------- LLama Gratis a cualquier PC del Mundo. Llamadas a fijos y móviles desde 1 céntimo por minuto. http://es.voice.yahoo.com

2 1

Using Client Authentication
by Ravi Gowda 16 Apr '07

16 Apr '07

Hi All, I am trying to have a setup where stunnel acts as a client to a server which requires client-Authentication. This is the snapshot of my stunnel.conf # Sample stunnel configuration file # Copyright by Michal Trojnara 2002 setuid = nobody setgid = nobody output = /etc/stunnel/out cert = /etc/stunnel/rtca-client.pem key = /etc/stunnel/rtca-client.ky # Authentication stuff verify = 2 # don't forget about c_rehash CApath # it is located inside chroot jail: #CApath = /certs # or simply use CAfile instead: CAfile = /etc/stunnel/rtca.pem ciphers = DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:DES-CBC3-MD5:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-SHA:IDEA-CBC-SHA:IDEA-CBC-MD5:RC2-CBC-MD5:DHE-DSS-RC4-SHA:RC4-SHA:RC4-MD5:RC4-MD5:RC4-64-MD5:EXP1024-DHE-DSS-DES-CBC-SHA:EXP1024-DES-CBC-SHA:EXP1024-RC2-CBC-MD5:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:DES-CBC-MD5:EXP1024-DHE-DSS-RC4-SHA:EXP1024-RC4-SHA:EXP1024-RC4-MD5:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-RC2-CBC-MD5:EXP-RC4-MD5:EXP-RC4-MD5 # Some debugging stuff debug = 7 output = /etc/stunnel/stunnel.log # Use it for client mode client = yes when I try to connect to the server, I am seeing that Stunnel is sending an empty certificate..which is making my server to reject connections. Can someone please help me out?? Thanks in Advance Ravi Gowda

1 0

Re: [stunnel-users] Setting up chain certificates on Stunnel.
by Hans Werner Strube 13 Apr '07

13 Apr '07

Satyajit Das wrote: > My server certificate > signed by intermediate CA > signed by Verisign CA > > I have the Verisign certificate on my clients trusted root CAs, however I am > > not able to get the SSL communication through. I believe this is because > stunnel should send all the three certificates for authentication and I > couldnt > configure stunnel to send across all the three certificates. > > Can anybody please help install all these certificates on stunnel. Simply concatenate the certificates (in PEM format) in the file specified by "cert = ..." and supply the key of your server certificate either in the same file or in the file specified by "key = ...".

1 0

stunnel-4.20 crash on AIX
by Peter O'Gorman 12 Apr '07

12 Apr '07

Hi, We built stunnel-4.20 on solaris, hpux, aix, tru64. irix and various linux hosts, and it works fine everywhere except hpux10.20 and aix. stunnel crashes with similar backtraces on AIX-4.3,5.1,5.2 and 5.3, not on the first client connect (using stunnel client=yes, connecting to s secure daytime server on another host, because everyone needs a secure daytime server :-p) but on the second connection. We have not tried server side yet, I assume results are similar. The backtrace looks like this: GDB: Program terminated with signal 11, Segmentation fault. #0 0xd0126b1c in _sigsetmask () from /usr/lib/libpthreads.a(shr_xpg5.o) (gdb) bt #0 0xd0126b1c in _sigsetmask () from /usr/lib/libpthreads.a(shr_xpg5.o) #1 0xd0127e5c in _p_sigaction () from /usr/lib/libpthreads.a(shr_xpg5.o) #2 0xd0315544 in sigaction () from /usr/lib/libc.a(shr.o) #3 0xd038beac in signal () from /usr/lib/libc.a(shr.o) #4 0x10006200 in sigchld_handler (sig=0) at network.c:350 #5 0x00004378 in ?? () Previous frame inner to this frame (corrupt stack?) dbx: sigchld_handler(sig = 0), line 350 in "network.c" _sigsetmask(??, ??, ??) at 0xd0126b1c _p_sigaction(??, ??, ??) at 0xd0127e58 raise.sigaction(??, ??, ??) at 0xd0315540 signal(??, ??) at 0xd038bea8 sigchld_handler(sig = 0), line 350 in "network.c" _sigsetmask(??, ??, ??) at 0xd0126b1c _p_sigaction(??, ??, ??) at 0xd0127e58 raise.sigaction(??, ??, ??) at 0xd0315540 signal(??, ??) at 0xd038bea8 sigchld_handler(sig = 0), line 350 in "network.c" _sigsetmask(??, ??, ??) at 0xd0126b1c _p_sigaction(??, ??, ??) at 0xd0127e58 raise.sigaction(??, ??, ??) at 0xd0315540 signal(??, ??) at 0xd038bea8 repeated forever. Line 350 of network.c says: signal(SIGCHLD, sigchld_handler); And that is in the signal handler, it seems like a normal thing to do, and I have no idea why, on AIX, it crashes. putting an #ifndef _AIX #endif around the signal() call "fixes" the crash, alternatively setting SIGCHLD to SIG_IGN on AIX "fixes" it, but I don't think that either solution is correct. I don't believe the signal handler will get called again as we do not reset the signal. (tests that assumtion and finds answer to riddle) Okay, problem identified. The signal_handler is being called repeatedly, causing an infinite loop that can only end in a crash. According to the AIX signal man page: The signal in libc.a does not set the SA_RESTART flag. It sets the signal mask to the signal whose action is being specified, and sets flags to SA_OLDSTYLE. The Berkeley Software Distribution (BSD) version of signal sets the SA_RESTART flag and preserves the current settings of the signal mask and flags. The BSD version can be used by compiling with the Berkeley Compatibility Library (libbsd.a). And indeed, no patches are required if I add -lbsd. Another solution would probably be to use sigaction if it is available. Meanwhile, please find attached a patch to add -lbsd on aix. Thanks for bearing with me while I figured this out :-) Peter

1 0

Setting up chain certificates on Stunnel.
by Satyajit Das 12 Apr '07

12 Apr '07

Hi , I am using stunnel as a wrapper to provide SSL functionalities for my server. Right now I am having problems setting up chained certificates on stunnel. My Problem -> My server certificate > signed by intermediate CA > signed by Verisign CA I have the Verisign certificate on my clients trusted root CAs, however I am not able to get the SSL communication through. I believe this is because stunnel should send all the three certificates for authentication and I couldnt configure stunnel to send across all the three certificates. Can anybody please help install all these certificates on stunnel. Thanks in advance, Satyajit

1 0