- stunnel-users - stunnel.org

Error resolving '...' (Windows)
by Oliver Ackermann (infowing AG) 03 Aug '05

03 Aug '05

On a Windows 2000 machine I always get the following error when I try to start stunnel (4.11): Error resolving 'x.y.z.23': Neither nodename nor servname known (EAI_NONAME) The client should connect to a server using SSL. x.y.z.23 is a static IP address of the client. The client has multiple IP addresses and stunnel should use this one to connect to the server. Contents of stunnel.conf: client=yes [service] local=x.y.z.23 accept=12345 connect=server:12345 Why does stunnel try to "resolve" this IP? Is the configuration correct? Thanks for your help! Oliver

2 1

ftp support for stunnel-4.11 (still has errors, do not know why)
by ZHUANG YUYAO 03 Aug '05

03 Aug '05

hi, here is the initial patch (pre-pre-pre-alpha! just a demo/test) for adding ftp support to stunnel-4.11. Known bugs: 1) only tested under linux. debian 3.1 (testing), gcc version 3.3.5 (Debian 1:3.3.5-13) 2) ftp_alloc_port() in ftp.c is not yet finished. just a demo; 3) only works when configured with --with-threads=ucontext. does not work with --with-threads=pthread! 4) libwrap support is not tested. 5) only tested with flashfxp (3.0.2 build(1043) implicit SSL); 6) still contains memory leaks. 7) can only successfully transfer(RETR) small files whose size is less than about 90K bytes. stunnel hangs while transferring a larger file, looks like poll() in scan_waiting_queue() (network.c line 164) can not receive a POLLOUT event from ssl_wfd->fd after successfully transfered 90K bytes. the log file is also included in this mail. bug #7 really frustrats me. still do not know why. could anyone please give me some hints? Zhuang Yuyao.

1 1

some thoughts of add ftp server proxy support to stunnel4. comments required
by ZHUANG YUYAO 30 Jul '05

30 Jul '05

Hi, I am thinking about adding ftp protocol support to stunnel4. first, some restrictions to simplify the implimentation: 1) only support for stunnel running in server mode, users can use ftp clients which support ssl connection (ie. FlashFXP) to connect to the real ftp server through stunnel daemon; 2) only support standalone service mode of stunnel. (inted support may be added later, I've just read the source code related to standalone service, and have not got any clue about how to support inetd.) 3) only support FTP implicit SSL and PASSIVE mode; the code may look like this: (the real ftp server is at 192.168.10.254, listening on port 21.) 1) start a stunnel daemon nonmally with accept = 990, remote = 192.168.10.254:21, protocol = ftp; 2) when a connection come in, parse the ftp server response, search for "227 Entering Passive Mode (192,168,10,254,133,22)", then got the data connection IP: 192.168.10.254 PORT: 34070; 3) plus 1 to the data connction port 34070, then we got 34071 which will be used as stunnel accept port; 4) create a LOCAL_OPTIONS structure instance opt (prototypes.h) dynamically, set opt->accept=1, opt->local_addr same to the parent stunnel, change its port to 34071, opt->remote_addr = real data connection (IP: 192.168.10.254 PORT: 34070); opt->fd = socket(), bind(); 5) set local_option->next = opt; 6) s_poll_add (&fds, opt->fd, 1, 0); (stunnel.c) (the local variable fds needs to be changed to a global variable, by the way, I think it is also required if stunnel want real SIGHUP configuration-on-the-fly support) 7) changed server response to "227 Entering Passive Mode (STUNNEL_LOCAL_HOST,133,23)", then send back to client. 8) the client will then connect to STUNNEL_LOCAL_HOST port = 34071, negotiate SSL session and send/receive data; 9) after ftp session finished (How to know a ftp session is finished?), free the dynamic LOCAL_OPTIONS opt, remove opt->fd from fds, close the data sessoin. There are only two source file (stunnel.c, protocol.c) need to be modified to implement these functions. Any suggestions will be appreciated. Thank you. Zhuang Yuyao 2005/7/28

3 3

Configuration and startup?
by JACK ROBERT BIESIADECKI 29 Jul '05

29 Jul '05

Hi, I am new to stunnel and Linux. I am trying to set up a secure connection to a server which can be accessed from any web browser on a designated port. I need to be able to access a web browser server administration interface, this is over http, I need to make this an https connection. I have compiled and installed stunnel on a Linux machine (FC4) but can't seem to get any response from it or make it work. If anyone can explain, step by step, how to configure stunnel for general https usage, it would be greatly appreciated. I have looked through the documentation but I have not been able to get it to work. I have also noticed that webmin supports stunnel but there is nothing in it. I added this to the conf file: [https] accept = 8080 connect = 28477 TIMEOUTclose = 0 Thanks

1 0

3.x branch updates
by Brian Hatch 29 Jul '05

29 Jul '05

As y'all can probably see, I've started climbing out from the rock under which I've been living (the rock called "too many kids".) If there are folks who have issues or bugs in stunnel 3.x, let's get talking off list so we can make another release. I'd like to include only security or bug fixes. The 4.x branch is totally fine, and I see no reason to add new features to the 3.x branch. This would be one of at most a few last bug fix releases for the 3.x branch so I can lay it to rest. -- Brian Hatch "Look, somebody's got to have Systems and some damn perspective around Security Engineer here. Boom, sooner or later. http://www.ifokr.org/bri/ *BOOM*!" Every message PGP signed

1 0

Linux pppd VPN network notwork very well
by Colin McKinnon 27 Jul '05

27 Jul '05

Hi all, I've got two two LANs behind masquerading routers that I've linked via a stunnel + pppd vpn. When it works, it works, but I've got a couple of problems - has anybody out there in Stunnel Land managed to fix / workaround these? 1) The connection goes down fairly regluarly. I've setup a cron job to move a few packets back and forth to make sure that the ADSL connection at both ends stays up (pppd set not do demand stuff). There's nothing in the logs to suggest that the ADSL *is* going down, but I thought it would eliminate a lot of possibilities. (see log entries below). Currently the link is going down at lesat once per day. Uptime varies greatly. I can't see anyway of asking stunnel to try again if the pppd exits (see conf below) other than manually restarting it. I'm hoping to scale the VPN up to multiple sites - with one connection, I can just do /etc/rc.d/stunnel restart - but if I've got multiple instances of stunnel running with different configs it gets a bit messy to reset a single connection. I did think about having multiple hard links to the stunnel binary, so each VPN will have a different process name attached to it, but this strikes me as a bit of a hack. 2) bandwidth on the link is poor. I consistently get 1/4 of the bandwidth (measured using scp to copy largish files) compared with bypassing the stunnel/pppd pair (same route between LANs). While I expected some overhead, this seems rather a lot. 3) latency is a lot higher too 4) The VPN seems to stutter more regularly than the direct connection ...I mean that I don't seem to be getting any traffic for 5-10 seconds then it resumes without any loss of data (e.g. when using ssh). The routers at either end are relatively dumb so (as I understand it) there's not many options for using IPIP or GRE tunnelling). Anybody got any suggestions as to how I can make it (particularly) more reliable and (also) a bit faster? TIA, Colin McKinnon pppd -------- pppd local nodeflate nobsdcomp nodefaultroute 10.1.17.208:10.1.20.202 log entries: ---------------- Stunnel started manually: Jul 19 08:25:59 serv8 stunnel[740]: stunnel 4.05 on i686-suse-linux-gnu PTHREAD with OpenSSL 0.9.7d 17 Mar 2004 Jul 19 08:25:59 serv8 stunnel[740]: FD_SETSIZE=1024, file ulimit=1024 -> 500 clients allowed Jul 19 08:25:59 serv8 pppd[743]: pppd 2.4.2 started by stunnel, uid 100 Jul 19 08:25:59 serv8 pppd[743]: Using interface ppp0 Jul 19 08:25:59 serv8 pppd[743]: Connect: ppp0 <--> /dev/pts/1 Everything works fine (although a little slow) then... Jul 19 10:36:32 serv8 pppd[743]: No response to 4 echo-requests Jul 19 10:36:32 serv8 pppd[743]: Serial link appears to be disconnected. Jul 19 10:36:34 serv8 pppd[743]: Script /etc/ppp/ip-down finished (pid 1668), status = 0x0 Jul 19 10:36:34 serv8 ip-down: SIOCDELRT: No such process Jul 19 10:36:36 serv8 pppd[743]: Connection terminated. Jul 19 10:36:36 serv8 pppd[743]: Connect time 130.6 minutes. Jul 19 10:36:36 serv8 pppd[743]: Sent 58200 bytes, received 57227 bytes. Jul 19 10:36:36 serv8 pppd[743]: Connect time 130.6 minutes. Jul 19 10:36:36 serv8 pppd[743]: Sent 58200 bytes, received 57227 bytes. Jul 19 10:36:36 serv8 pppd[743]: Exit. Jul 19 10:36:36 serv8 stunnel[741]: readsocket: Input/output error (5) Jul 19 10:36:36 serv8 stunnel[741]: Connection reset: 68626 bytes sent to SSL, 66280 bytes sent to socket Stunnel config --------------------- foreground = no client = yes setuid = stunnel setgid = dialout CAfile = /etc/stunnel/3bCArootCert.pem cert = /etc/stunnel/system.pem verify = 2 session = 3600 [ppp] connect = remotehost:2020 exec = /usr/sbin/pppd execargs = pppd local nodeflate nobsdcomp nodefaultroute 10.1.17.208:10.1.20.202 pty = yes (converse at other end) Routing at 'cleint' end --------------------------------- Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 10.1.20.202 * 255.255.255.255 UH 0 0 0 ppp0 192.168.1.0 * 255.255.255.0 U 0 0 0 eth1 10.1.20.0 * 255.255.255.0 U 0 0 0 ppp0 10.1.17.0 * 255.255.255.0 U 0 0 0 eth2 loopback * 255.0.0.0 U 0 0 0 lo default 192.168.1.1 0.0.0.0 UG 0 0 0 eth1 (eth1 conects to the ADSL router, eth2 to the LAN)

2 2

newbie q: stunnel -d and -r options
by Jagannadha Bhattu 27 Jul '05

27 Jul '05

I was reading a book where they discussed using stunnel as client and server proxy with -d -r and -c options. I have SuSE 9.3 and the stunnel on it has different options. Then I found that we have to use config file. I used it to configure my server. I defined the following section: [myserver] accept = 12345 connect = 12323 Here my server listens on 12323. I have my server already running. Now I typed stunnel and nothing happened. I typed "pgrep stunnel" and could not see anything. Apparently I have not understood how stunnel works. Can some one let me know how can I configure to use stunnel to secure my server app and my client app which are not ssl aware. I also have a question. The book which I am reading says, stunnel acts as a proxy for a server app. If my server app is listening on A then if I want stunnel to service all clients connecting to A then how can it do it as that port is already serviced by my server app. Thanks JB

2 1

error compilation stunnel-4.11 for ARM9
by Stage Iup - Fabrice & Frederic 27 Jul '05

27 Jul '05

Hi all, I would like to compile stunnel-4.11for a board based on a ATMEL at91rm9200. I try to compile this with this commande [root@StageIup stunnel-4.11]# CC=/usr/local/arm/3.0/bin/arm-linux-gcc ./configure --host=arm-linux --prefix=/home/fabrice/dev/stunnel/stunnel-armtest --with-ssl=/home/fabrice/dev/openssl But I have the following error configure: **************************************** PTY device files checking for "/dev/ptmx"... configure: error: cannot check for file existence when cross compiling If any body have an idea about how to resolve this problem or how to compile stunnel for ARM ... Thanks -- Cordialement Fabrice -- IFOTEC Tél : 04 76 67 53 53

1 0

samba over stunnel performance
by Brian Szymanski 26 Jul '05

26 Jul '05

Howdy... I'm trying to run samba over stunnel on a wireless connection. Here's the setup: unix box <- wifi -> windows laptop Unfortunately, reading files from the shared drive is extremely slow. If I look at the stunnel box on my windows machine, it is pumping out about 20 messages/second that say: LOG7[2140:3636]: SSL_read returned WANT_READ: retrying On two >1GHz machines, this is utilizing about 5% of cpu, and 4% of the 11Mbps link. Clearly there is room for improvement here! I tried poking around with stunnel.conf on the server to no avail - specifically, I commented out the lines: ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle And restarted stunnel - same miserable performance (roughly the same throughput, and resource usage). Is there something about the SMB protocol that would cause stunnel to not deal with it well? If so, is there a configuration option somewhere I can tune, or do I have to RTFS & hack it to get decent performance here? Any tips would be greatly appreciated. Thanks in advance! Cheers, Brian Brian Szymanski Software and Systems Developer Media Matters for America ski(a)mediamatters.org aim: xbrianskix

2 2

zlib + win2000 = crash
by lascjr＠bol.com.br 26 Jul '05

26 Jul '05

Hi, I successfully installed and executed stunnel without compression and with compression RLE, but with compression ZLIB I receive the following message in the startup: 2005.07.25 08:24:28 LOG5[1408:1524]: stunnel 4.11 on x86-pc-mingw32-gnu WIN32+IPv4 with OpenSSL 0.9.7f 22 Mar 2005 2005.07.25 08:24:28 LOG3[1408:1976]: Error reading certificate file: stunnel.pem 2005.07.25 08:24:28 LOG3[1408:1976]: error stack: 25070067 : error:25070067:DSO support routines:DSO_load:could not load the shared library 2005.07.25 08:24:28 LOG3[1408:1976]: error stack: 25078067 : error:25078067:DSO support routines:WIN32_LOAD:could not load the shared library 2005.07.25 08:24:28 LOG3[1408:1976]: error stack: 25070067 : error:25070067:DSO support routines:DSO_load:could not load the shared library 2005.07.25 08:24:28 LOG3[1408:1976]: SSL_CTX_use_certificate_chain_file: 25078067: error:25078067:DSO support routines:WIN32_LOAD:could not load the shared library 2005.07.25 08:24:28 LOG3[1408:1976]: Server is down I made download of archive ZLIB1.DLL in the client and in the server, the startup is normal, but after the beginning of the communications the server crash. I use Win2000 Server SP4 in the server and Win2000 Pro in the client. thanks Luis A S C Junior

2 1

Stunnel 4.05 on arm-linux
by Stage Iup - Fabrice & Frederic 26 Jul '05

26 Jul '05

Hi all I would to use stunnel on a board based on the AT91RM9200. I'm actually trying to use Stunnel 4.05 for armv4l. I can launch it but when i try to connect to https (through a thttpd server), nothings happen. In the arm-linux terminal, i've got the following informations: [root@EmbeddedLinux sbin]$./stunnel stunnel.conf 1970.01.01 03:03:47 LOG5[488:16384]: stunnel 4.04 on armv4l-unknown-linux-gnu PTHREAD+LIBWRAP with OpenSSL 1970.01.01 03:03:47 LOG5[488:16384]: FD_SETSIZE=1024, file ulimit=1024 -> 500 clients allowed ./stunnel: relocation error: ./stunnel: undefined symbol: request_init If any body have an idea about how to resolve this problem... -- With regards Fabrice JAUME -- IFOTEC Tél : 04 76 67 53 53

2 1

Problems compiling on AIX5.2 -- ld: 0711-317 ERROR: Undefined symbol: .inflateEnd
by Claus Lund 25 Jul '05

25 Jul '05

Hi everybody, I am trying to get stunnel 4.11 compiled on my AIX boxes but I am not having much luck. I am using GCC 3.3.2 on AIX 5.2. OpenSSL has been compiled and is working on those same boxes (OpenSSL 0.9.8). I configured stunnel using: root@tax178:/tmp/stunnel/stunnel-4.11 # ./configure --sysconfdir=/etc/stunnel --prefix=/usr/local --disable-libwrap And everything seems to go OK during the config steps. When I try to build stunnel it comes up with a series of warnings and eventually dies with a bunch of errors. First the warnings: "nt.Po"; else rm -f ".deps/client.Tpo"; exit 1; fi client.c: In function `init_local': client.c:178: warning: passing arg 3 of `ngetpeername' from incompatible pointer type client.c: In function `make_sockets': client.c:894: warning: passing arg 3 of `ngetsockname' from incompatible pointer type client.c:902: warning: passing arg 3 of `naccept' from incompatible pointer type client.c: In function `connect_wait': client.c:996: warning: passing arg 5 of `getsockopt' from incompatible pointer type if gcc -DPACKAGE_NAME=\"stunnel\" -D" "/options.Po"; else rm -f ".deps/options.Tpo"; exit 1; fi options.c: In function `print_socket_options': options.c:1401: warning: passing arg 5 of `getsockopt' from incompatible pointer type if gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\"" "ps/sthreads.Tpo" ".deps/sthreads.Po"; else rm -f ".deps/sthreads.Tpo"; exit 1; fi sthreads.c: In function `stack_info': sthreads.c:343: warning: int format, long unsigned int arg (arg 4) sthreads.c:343: warning: int format, long unsigned int arg (arg 5) sthreads.c:343: warning: int format, long unsigned int arg (arg 6) sthreads.c:343: warning: int format, long unsigned int arg (arg 7) if gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\"" "tunnel.Tpo" ".deps/stunnel.Po"; else rm -f ".deps/stunnel.Tpo"; exit 1; fi stunnel.c: In function `accept_connection': stunnel.c:206: warning: passing arg 3 of `naccept' from incompatible pointer type if gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\"" And then the final errors: "/bin/sh ../libtool --tag=CC --mode=link gcc -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/local/include -o stunnel client.o log.o options.o protocol.o network.o resolver.o ssl.o sthreads.o stunnel.o pty.o -lnsl -ldl -L/usr/local/lib -lssl -lcrypto gcc -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/local/include -o stunnel client.o log.o options.o protocol.o network.o resolver.o ssl.o sthreads.o stunnel.o pty.o -lnsl -ldl -L/usr/local/lib -lssl -lcrypto ld: 0711-317 ERROR: Undefined symbol: .inflateEnd ld: 0711-317 ERROR: Undefined symbol: .deflateEnd ld: 0711-317 ERROR: Undefined symbol: .inflateInit_ ld: 0711-317 ERROR: Undefined symbol: .deflateInit_ ld: 0711-317 ERROR: Undefined symbol: .deflate ld: 0711-317 ERROR: Undefined symbol: .inflate ld: 0711-345 Use the -bloadmap or -bnoquiet option to obtain more information. collect2: ld returned 8 exit status make: 1254-004 The error code from the last command is 1." Hopefully there will be some C/AIX gurus out there who can help me get past this problem... Thank you in advance, Claus

2 3

Poll Problem
by John O'Fallon 24 Jul '05

24 Jul '05

I have confirmed that the problem I reported last week (on Mac OS X, streams are truncated with a reported "s_poll_wait returned 1, but no descriptor is ready" error) can be corrected by using the older "select" versions of the network functions. I did this by tweaking the source, but would like to make the fix as cleanly as possible, so... Sorry if this is in the docs (I couldn't find it), but what is the best way to disable the poll option? John

2 1

Re-6: [stunnel-users] Problem with mysql
by lmarcilly＠aressi.fr 22 Jul '05

22 Jul '05

Nobody has an idea?? I don't know how to resolve my problem, and i don't know where i should serach in order to resolve it... Could you help me please?? Is "-disable-libwrap" the problem? or should it work without libwrap? Thanks a lot! -------- Original Message -------- Subject: Re-5: [stunnel-users] Problem with mysql (21-juil.-2005 10:00) From: lmarcilly(a)aressi.fr To: lmarcilly(a)aressi.fr > Sorry, i doesn't look in the good stunnel.log, there is a SIGTERM because i > stop the box! > > So here is my stunnel.log : > > 2005.07.21 11:48:25 LOG5[230:1]: stunnel 4.11 on i686-pc-linux-gnu UCONTEXT+ > POLL+IPv4 with OpenSSL 0.9.7g 11 Apr 2005 > 2005.07.21 11:48:26 LOG7[230:1]: RAND_status claims sufficient entropy for > the PRNG > 2005.07.21 11:48:26 LOG6[230:1]: PRNG seeded successfully > 2005.07.21 11:48:26 LOG6[230:1]: file ulimit = 1024 (can be changed with ' > ulimit -n') > 2005.07.21 11:48:26 LOG6[230:1]: poll() used - no FD_SETSIZE limit for file > descriptors > 2005.07.21 11:48:26 LOG5[230:1]: 500 clients allowed > 2005.07.21 11:48:26 LOG7[230:1]: FD 4 in non-blocking mode > 2005.07.21 11:48:26 LOG7[230:1]: FD 5 in non-blocking mode > 2005.07.21 11:48:26 LOG7[230:1]: FD 6 in non-blocking mode > 2005.07.21 11:48:26 LOG7[230:1]: SO_REUSEADDR option set on accept socket > 2005.07.21 11:48:26 LOG7[230:1]: mysql bound to 127.0.0.1:3306 > 2005.07.21 11:48:26 LOG7[231:1]: Created pid file /stunnel.pid > > So it seems to run properly but telnet 192.168.1.121 3306 ot telnet > localhost 3306 doesn't work, i get a time out! > > I will give you more informations : > > stunnel-4.11 on an lfs system (Kernel 2.4.30 with the bridge patch and the > SSP patch) > > gcc -v : > > Reading specs from /home/lmarcilly/lfs_install/build/usr/bin/../lib/gcc-lib/ > i686-pc-linux-gnu/3.3.3/specs > Configured with: ../gcc-3.3.3/configure --prefix=/usr --enable-shared -- > enable-threads=posix --enable-__cxa_atexit --enable-clocale=gnu --enable- > languages=c,c++ --disable-nls > Thread model: posix > gcc version 3.3.3 > > When compiling : > > ./configure --prefix=/usr --disable-libwrap > make > make install > > stunnel.conf : > > chroot = /usr/var/stunnel/ > pid = /stunnel.pid > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > debug = 7 > output = /var/log/stunnel.log > client = yes > [mysql] > accept = localhost:3306 > connect = 192.168.1.104:3307 > > I've also tried with accept = 3306 and accept = 127.0.0.1:3306 but with no > success... > > I'm sorry but i have no idea and i don't know how resolve my problem so > please help me... > > Thanks in advance! > > lm. > > -------- Original Message -------- > Subject: Re-4: [stunnel-users] Problem with mysql (21-juil.-2005 9:26) > From: lmarcilly(a)aressi.fr > To: lmarcilly(a)aressi.fr > > > I try : > > > > mysql -h 192.168.1.121 --protocol=TCP -u user --password=xxx > > > > and i get this message : > > > > Can't connect to MySQL server on '192.168.1.121' > > > > I also try : > > > > telnet 192.168.1.121 3306 > > > > and i get : > > > > telnet : Unable to connect to remote host : Connection timed out > > > > Here is my stunnel.log : > > > > 2005.07.21 11:13:07 LOG5[2462:1]: stunnel 4.11 on i686-pc-linux-gnu > > UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7g 11 Apr 2005 > > 2005.07.21 11:13:07 LOG7[2462:1]: Snagged 64 random bytes from /root/.rnd > > 2005.07.21 11:13:07 LOG7[2462:1]: Wrote 1024 new random bytes to /root/.rnd > > 2005.07.21 11:13:07 LOG7[2462:1]: RAND_status claims sufficient entropy for > > > > the PRNG > > 2005.07.21 11:13:07 LOG6[2462:1]: PRNG seeded successfully > > 2005.07.21 11:13:07 LOG6[2462:1]: file ulimit = 1024 (can be changed with ' > > ulimit -n') > > 2005.07.21 11:13:07 LOG6[2462:1]: poll() used - no FD_SETSIZE limit for > > file descriptors > > 2005.07.21 11:13:07 LOG5[2462:1]: 500 clients allowed > > 2005.07.21 11:13:07 LOG7[2462:1]: FD 4 in non-blocking mode > > 2005.07.21 11:13:07 LOG7[2462:1]: FD 5 in non-blocking mode > > 2005.07.21 11:13:07 LOG7[2462:1]: FD 6 in non-blocking mode > > 2005.07.21 11:13:07 LOG7[2462:1]: SO_REUSEADDR option set on accept socket > > 2005.07.21 11:13:07 LOG7[2462:1]: mysql bound to 127.0.0.1:3306 > > 2005.07.21 11:13:07 LOG7[2463:1]: Created pid file /stunnel.pid > > 2005.07.21 11:15:58 LOG5[2463:0]: Received signal 15; terminating > > 2005.07.21 11:15:58 LOG7[2463:0]: removing pid file /stunnel.pid > > > > And i think the last 2 lines are not normal!! > > But how can i see from where come the SIGTERM ?? There is always a stunnel > > process but it doesn't work properly... > > > > Any idea? > > > > -------- Original Message -------- > > Subject: Re: Re-2: [stunnel-users] Problem with mysql (21-juil.-2005 9:13) > > From: bri(a)stunnel.org > > To: lmarcilly(a)aressi.fr > > > > > > > > > > > > How to do this? I try with : > > > > mysql --port=3306 --protocol=TCP -u user --password=xxx > > > > > > > > but it won't work... > > > > > > > > When i try telnet localhost 3306, i can't establish connection but i can on > > > > > > > > > > > > my windows box... I also try to analyse traffic with tcpdump and there is > > > > no packet when i try with stunnel... > > > > > > I've found in the past that mysql when pointing to localhost has > > > used the socket in spite of the arguments you put on the command line. > > > > > > Try pointing to the ethernet IP address instead of 127.0.0.1 and > > > see if it's happy then. You never know... > > > > > > -- > > > Brian Hatch "I've decided I'm not keen on > > > Systems and preterm labour." > > > Security Engineer "I'll write that down in our > > > http://www.ifokr.org/bri/ birthing plan..." > > > --Bree and Bri, in L&D. > > > Every message PGP signed > > > > > > > > > To: bri(a)stunnel.org > > Cc: Michal.Trojnara(a)mobi-com.net > > stunnel-users(a)mirt.net > > > > > > > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)mirt.net > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > To: lmarcilly(a)aressi.fr > bri(a)stunnel.org > Cc: stunnel-users(a)mirt.net To: lmarcilly(a)aressi.fr bri(a)stunnel.org Cc: stunnel-users(a)mirt.net

1 0

Re-5: [stunnel-users] Problem with mysql
by lmarcilly＠aressi.fr 21 Jul '05

21 Jul '05

Sorry, i doesn't look in the good stunnel.log, there is a SIGTERM because i stop the box! So here is my stunnel.log : 2005.07.21 11:48:25 LOG5[230:1]: stunnel 4.11 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7g 11 Apr 2005 2005.07.21 11:48:26 LOG7[230:1]: RAND_status claims sufficient entropy for the PRNG 2005.07.21 11:48:26 LOG6[230:1]: PRNG seeded successfully 2005.07.21 11:48:26 LOG6[230:1]: file ulimit = 1024 (can be changed with 'ulimit -n') 2005.07.21 11:48:26 LOG6[230:1]: poll() used - no FD_SETSIZE limit for file descriptors 2005.07.21 11:48:26 LOG5[230:1]: 500 clients allowed 2005.07.21 11:48:26 LOG7[230:1]: FD 4 in non-blocking mode 2005.07.21 11:48:26 LOG7[230:1]: FD 5 in non-blocking mode 2005.07.21 11:48:26 LOG7[230:1]: FD 6 in non-blocking mode 2005.07.21 11:48:26 LOG7[230:1]: SO_REUSEADDR option set on accept socket 2005.07.21 11:48:26 LOG7[230:1]: mysql bound to 127.0.0.1:3306 2005.07.21 11:48:26 LOG7[231:1]: Created pid file /stunnel.pid So it seems to run properly but telnet 192.168.1.121 3306 ot telnet localhost 3306 doesn't work, i get a time out! I will give you more informations : stunnel-4.11 on an lfs system (Kernel 2.4.30 with the bridge patch and the SSP patch) gcc -v : Reading specs from /home/lmarcilly/lfs_install/build/usr/bin/../lib/gcc-lib/i686-pc-linux-gnu/3.3.3/specs Configured with: ../gcc-3.3.3/configure --prefix=/usr --enable-shared --enable-threads=posix --enable-__cxa_atexit --enable-clocale=gnu --enable-languages=c,c++ --disable-nls Thread model: posix gcc version 3.3.3 When compiling : ./configure --prefix=/usr --disable-libwrap make make install stunnel.conf : chroot = /usr/var/stunnel/ pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel.log client = yes [mysql] accept = localhost:3306 connect = 192.168.1.104:3307 I've also tried with accept = 3306 and accept = 127.0.0.1:3306 but with no success... I'm sorry but i have no idea and i don't know how resolve my problem so please help me... Thanks in advance! lm. -------- Original Message -------- Subject: Re-4: [stunnel-users] Problem with mysql (21-juil.-2005 9:26) From: lmarcilly(a)aressi.fr To: lmarcilly(a)aressi.fr > I try : > > mysql -h 192.168.1.121 --protocol=TCP -u user --password=xxx > > and i get this message : > > Can't connect to MySQL server on '192.168.1.121' > > I also try : > > telnet 192.168.1.121 3306 > > and i get : > > telnet : Unable to connect to remote host : Connection timed out > > Here is my stunnel.log : > > 2005.07.21 11:13:07 LOG5[2462:1]: stunnel 4.11 on i686-pc-linux-gnu > UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7g 11 Apr 2005 > 2005.07.21 11:13:07 LOG7[2462:1]: Snagged 64 random bytes from /root/.rnd > 2005.07.21 11:13:07 LOG7[2462:1]: Wrote 1024 new random bytes to /root/.rnd > 2005.07.21 11:13:07 LOG7[2462:1]: RAND_status claims sufficient entropy for > the PRNG > 2005.07.21 11:13:07 LOG6[2462:1]: PRNG seeded successfully > 2005.07.21 11:13:07 LOG6[2462:1]: file ulimit = 1024 (can be changed with ' > ulimit -n') > 2005.07.21 11:13:07 LOG6[2462:1]: poll() used - no FD_SETSIZE limit for > file descriptors > 2005.07.21 11:13:07 LOG5[2462:1]: 500 clients allowed > 2005.07.21 11:13:07 LOG7[2462:1]: FD 4 in non-blocking mode > 2005.07.21 11:13:07 LOG7[2462:1]: FD 5 in non-blocking mode > 2005.07.21 11:13:07 LOG7[2462:1]: FD 6 in non-blocking mode > 2005.07.21 11:13:07 LOG7[2462:1]: SO_REUSEADDR option set on accept socket > 2005.07.21 11:13:07 LOG7[2462:1]: mysql bound to 127.0.0.1:3306 > 2005.07.21 11:13:07 LOG7[2463:1]: Created pid file /stunnel.pid > 2005.07.21 11:15:58 LOG5[2463:0]: Received signal 15; terminating > 2005.07.21 11:15:58 LOG7[2463:0]: removing pid file /stunnel.pid > > And i think the last 2 lines are not normal!! > But how can i see from where come the SIGTERM ?? There is always a stunnel > process but it doesn't work properly... > > Any idea? > > -------- Original Message -------- > Subject: Re: Re-2: [stunnel-users] Problem with mysql (21-juil.-2005 9:13) > From: bri(a)stunnel.org > To: lmarcilly(a)aressi.fr > > > > > > > > How to do this? I try with : > > > mysql --port=3306 --protocol=TCP -u user --password=xxx > > > > > > but it won't work... > > > > > > When i try telnet localhost 3306, i can't establish connection but i can on > > > > > > my windows box... I also try to analyse traffic with tcpdump and there is > > > no packet when i try with stunnel... > > > > I've found in the past that mysql when pointing to localhost has > > used the socket in spite of the arguments you put on the command line. > > > > Try pointing to the ethernet IP address instead of 127.0.0.1 and > > see if it's happy then. You never know... > > > > -- > > Brian Hatch "I've decided I'm not keen on > > Systems and preterm labour." > > Security Engineer "I'll write that down in our > > http://www.ifokr.org/bri/ birthing plan..." > > --Bree and Bri, in L&D. > > Every message PGP signed > > > > > To: bri(a)stunnel.org > Cc: Michal.Trojnara(a)mobi-com.net > stunnel-users(a)mirt.net > > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users To: lmarcilly(a)aressi.fr bri(a)stunnel.org Cc: stunnel-users(a)mirt.net

1 0

Re-4: [stunnel-users] Problem with mysql
by lmarcilly＠aressi.fr 21 Jul '05

21 Jul '05

I try : mysql -h 192.168.1.121 --protocol=TCP -u user --password=xxx and i get this message : Can't connect to MySQL server on '192.168.1.121' I also try : telnet 192.168.1.121 3306 and i get : telnet : Unable to connect to remote host : Connection timed out Here is my stunnel.log : 2005.07.21 11:13:07 LOG5[2462:1]: stunnel 4.11 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7g 11 Apr 2005 2005.07.21 11:13:07 LOG7[2462:1]: Snagged 64 random bytes from /root/.rnd 2005.07.21 11:13:07 LOG7[2462:1]: Wrote 1024 new random bytes to /root/.rnd 2005.07.21 11:13:07 LOG7[2462:1]: RAND_status claims sufficient entropy for the PRNG 2005.07.21 11:13:07 LOG6[2462:1]: PRNG seeded successfully 2005.07.21 11:13:07 LOG6[2462:1]: file ulimit = 1024 (can be changed with 'ulimit -n') 2005.07.21 11:13:07 LOG6[2462:1]: poll() used - no FD_SETSIZE limit for file descriptors 2005.07.21 11:13:07 LOG5[2462:1]: 500 clients allowed 2005.07.21 11:13:07 LOG7[2462:1]: FD 4 in non-blocking mode 2005.07.21 11:13:07 LOG7[2462:1]: FD 5 in non-blocking mode 2005.07.21 11:13:07 LOG7[2462:1]: FD 6 in non-blocking mode 2005.07.21 11:13:07 LOG7[2462:1]: SO_REUSEADDR option set on accept socket 2005.07.21 11:13:07 LOG7[2462:1]: mysql bound to 127.0.0.1:3306 2005.07.21 11:13:07 LOG7[2463:1]: Created pid file /stunnel.pid 2005.07.21 11:15:58 LOG5[2463:0]: Received signal 15; terminating 2005.07.21 11:15:58 LOG7[2463:0]: removing pid file /stunnel.pid And i think the last 2 lines are not normal!! But how can i see from where come the SIGTERM ?? There is always a stunnel process but it doesn't work properly... Any idea? -------- Original Message -------- Subject: Re: Re-2: [stunnel-users] Problem with mysql (21-juil.-2005 9:13) From: bri(a)stunnel.org To: lmarcilly(a)aressi.fr > > > > How to do this? I try with : > > mysql --port=3306 --protocol=TCP -u user --password=xxx > > > > but it won't work... > > > > When i try telnet localhost 3306, i can't establish connection but i can on > > my windows box... I also try to analyse traffic with tcpdump and there is > > no packet when i try with stunnel... > > I've found in the past that mysql when pointing to localhost has > used the socket in spite of the arguments you put on the command line. > > Try pointing to the ethernet IP address instead of 127.0.0.1 and > see if it's happy then. You never know... > > -- > Brian Hatch "I've decided I'm not keen on > Systems and preterm labour." > Security Engineer "I'll write that down in our > http://www.ifokr.org/bri/ birthing plan..." > --Bree and Bri, in L&D. > Every message PGP signed > To: bri(a)stunnel.org Cc: Michal.Trojnara(a)mobi-com.net stunnel-users(a)mirt.net

1 0

Re-2: [stunnel-users] Problem with mysql
by lmarcilly＠aressi.fr 21 Jul '05

21 Jul '05

> <lmarcilly(a)aressi.fr> wrote: > > so i think stunnel doesn't work properly... > [cut] > > 2005.07.20 14:07:13 LOG5[14715:0]: Received signal 15; terminating > > 2005.07.20 14:07:13 LOG7[14715:0]: removing pid file /stunnel.pid > > That's quite common to stop working (properly) for a process after > receiving > signal 15 (SIGTERM). 8-) > Yes but the file stunnel.pid always exist... and when i type ps aux | grep stunnel, there is always a stunnel process... > > mysql -u user --password=xyz i have : > > Can't connect to local MySQL server through socket > > '/var/run/mysqld/mysqld. > > sock' > > > > This socket doesn't exist since there is no MySQL server on the box. > > Did you configure your MySQL client to connect stunnel instead of default > /var/run/mysqld/mysqld.sock UNIX socket? > > The problem is your MySQL client configuration, *not* stunnel. How to do this? I try with : mysql --port=3306 --protocol=TCP -u user --password=xxx but it won't work... When i try telnet localhost 3306, i can't establish connection but i can on my windows box... I also try to analyse traffic with tcpdump and there is no packet when i try with stunnel... > > Best regards, > Mike > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users To: Michal.Trojnara(a)mobi-com.net stunnel-users(a)mirt.net

2 1

Question regarding SSL v2/v3
by vasudha.upadhyaya＠convergys.com 20 Jul '05

20 Jul '05

We have been using Stunnel 4.05 now for quite sometime now with OpenSSL 0.97d.I had a question regarding the SSL Version.When I look into the Stunnel.log I see Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 This means that stunnel is using AES-256-SHA1 which uses SSL v3. Is it standard for stunnel4.05 to use SSL v3 or is it dependent on the OpenSSL Version. We haven't configured anything in the stunnel.conf to use SSL v3. Thanks, Vasudha. -------------------------------------------- Vasudha Upadhyaya Convergys Speech Solutions Ph:703-885-5837 vasudha.upadhyaya(a)convergys.com -- "NOTICE: The information contained in this electronic mail transmission is intended by Convergys Corporation for the use of the named individual or entity to which it is directed and may contain information that is privileged or otherwise confidential. If you have received this electronic mail transmission in error, please delete it from your system without copying or forwarding it, and notify the sender of the error by reply email or by telephone (collect), so that the sender's address records can be corrected."

1 0

Re: [stunnel-users] Problem with mysql
by lmarcilly＠aressi.fr 20 Jul '05

20 Jul '05

I try to analyse traffic with tcpdump and when i use stunnel, there is no packets with my linux box ip so i think stunnel doesn't work properly... Here is the stunnel.log : 2005.07.20 12:58:23 LOG5[14714:1]: stunnel 4.11 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7g 11 Apr 2005 2005.07.20 12:58:23 LOG7[14714:1]: Snagged 64 random bytes from /root/.rnd 2005.07.20 12:58:23 LOG7[14714:1]: Wrote 1024 new random bytes to /root/.rnd 2005.07.20 12:58:23 LOG7[14714:1]: RAND_status claims sufficient entropy for the PRNG 2005.07.20 12:58:23 LOG6[14714:1]: PRNG seeded successfully 2005.07.20 12:58:23 LOG7[14714:1]: Certificate: /usr/etc/stunnel/stunnel.pem 2005.07.20 12:58:23 LOG7[14714:1]: Key file: /usr/etc/stunnel/stunnel.pem 2005.07.20 12:58:23 LOG6[14714:1]: file ulimit = 1024 (can be changed with 'ulimit -n') 2005.07.20 12:58:23 LOG6[14714:1]: poll() used - no FD_SETSIZE limit for file descriptors 2005.07.20 12:58:23 LOG5[14714:1]: 500 clients allowed 2005.07.20 12:58:23 LOG7[14714:1]: FD 4 in non-blocking mode 2005.07.20 12:58:23 LOG7[14714:1]: FD 5 in non-blocking mode 2005.07.20 12:58:23 LOG7[14714:1]: FD 6 in non-blocking mode 2005.07.20 12:58:23 LOG7[14714:1]: SO_REUSEADDR option set on accept socket 2005.07.20 12:58:23 LOG7[14714:1]: mysql bound to 0.0.0.0:3306 2005.07.20 12:58:23 LOG7[14715:1]: Created pid file /stunnel.pid 2005.07.20 14:07:13 LOG5[14715:0]: Received signal 15; terminating 2005.07.20 14:07:13 LOG7[14715:0]: removing pid file /stunnel.pid When i look at stunnel.pid, there is 231 in the file and it is the stunnel pid... In my stunnel.conf, i have put client=yes and [mysql] accept = 3306 connect = 192.198.10.120:3307 and on my stunnel server : [mysql] accept = 3307 connect = localhost:3306 It works with my mysql client on windows (v4.1.12a) but not with my mysql client on linux (v4.1.8a). Perhaps the difference of version is the problem but i think not... Which options are applied when windows binaries of stunnel are compiled? Perhaps i have to change option when i compile on my linux box... Thanks in advance! lm. -------- Original Message -------- Subject: [stunnel-users] Problem with mysql (20-juil.-2005 11:41) From: lmarcilly(a)aressi.fr To: lmarcilly(a)aressi.fr > Hi all, > > i try to encrypt mysql connections... > > I saw this : http://www.stunnel.org/examples/mysql.html > > but i use stunnel4.x. > > I configure it on my windows box and it work well! (mysql server is on a > linux box, i have configure stunnel as a server on this box) > > when i try mysql -u user --password=xyz it works > > but i have to made it work on a linux box. > I use the same config file for stunnel, but when i try > > mysql -u user --password=xyz i have : > Can't connect to local MySQL server through socket '/var/run/mysqld/mysqld. > sock' > > This socket doesn't exist since there is no MySQL server on the box. > > I try with --protocol=TCP but it won't work, i have : > > Can't connect to MySQL server on 'localhost' > > Do you have an idea? Do you want more details on my config file for stunnel? > > > Thanks in advance and sorry for my english! > > lm > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users To: lmarcilly(a)aressi.fr stunnel-users(a)mirt.net

2 1

Re-2: [stunnel-users] Problem with mysql
by lmarcilly＠aressi.fr 20 Jul '05

20 Jul '05

I have just remember that tcp_wrapper is not installed on my box... When compiling stunnel, i use : ./configure --prefix=/usr --disable-libwrap make make install I think libwrap is not necessary but perhaps i am wrong... Tcp wrapper is used in order to filter traffic? Could you explain me? Thanks a lot! -------- Original Message -------- Subject: Re: [stunnel-users] Problem with mysql (20-juil.-2005 14:47) From: lmarcilly(a)aressi.fr To: lmarcilly(a)aressi.fr > I try to analyse traffic with tcpdump and when i use stunnel, there is no > packets with my linux box ip so i think stunnel doesn't work properly... > Here is the stunnel.log : > > 2005.07.20 12:58:23 LOG5[14714:1]: stunnel 4.11 on i686-pc-linux-gnu > UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7g 11 Apr 2005 > 2005.07.20 12:58:23 LOG7[14714:1]: Snagged 64 random bytes from /root/.rnd > 2005.07.20 12:58:23 LOG7[14714:1]: Wrote 1024 new random bytes to /root/. > rnd > 2005.07.20 12:58:23 LOG7[14714:1]: RAND_status claims sufficient entropy > for the PRNG > 2005.07.20 12:58:23 LOG6[14714:1]: PRNG seeded successfully > 2005.07.20 12:58:23 LOG7[14714:1]: Certificate: /usr/etc/stunnel/stunnel. > pem > 2005.07.20 12:58:23 LOG7[14714:1]: Key file: /usr/etc/stunnel/stunnel.pem > 2005.07.20 12:58:23 LOG6[14714:1]: file ulimit = 1024 (can be changed with ' > ulimit -n') > 2005.07.20 12:58:23 LOG6[14714:1]: poll() used - no FD_SETSIZE limit for > file descriptors > 2005.07.20 12:58:23 LOG5[14714:1]: 500 clients allowed > 2005.07.20 12:58:23 LOG7[14714:1]: FD 4 in non-blocking mode > 2005.07.20 12:58:23 LOG7[14714:1]: FD 5 in non-blocking mode > 2005.07.20 12:58:23 LOG7[14714:1]: FD 6 in non-blocking mode > 2005.07.20 12:58:23 LOG7[14714:1]: SO_REUSEADDR option set on accept socket > 2005.07.20 12:58:23 LOG7[14714:1]: mysql bound to 0.0.0.0:3306 > 2005.07.20 12:58:23 LOG7[14715:1]: Created pid file /stunnel.pid > 2005.07.20 14:07:13 LOG5[14715:0]: Received signal 15; terminating > 2005.07.20 14:07:13 LOG7[14715:0]: removing pid file /stunnel.pid > > When i look at stunnel.pid, there is 231 in the file and it is the stunnel > pid... > > In my stunnel.conf, i have put client=yes and > > [mysql] > accept = 3306 > connect = 192.198.10.120:3307 > > and on my stunnel server : > > [mysql] > accept = 3307 > connect = localhost:3306 > > It works with my mysql client on windows (v4.1.12a) but not with my mysql > client on linux (v4.1.8a). Perhaps the difference of version is the problem > but i think not... > > Which options are applied when windows binaries of stunnel are compiled? > Perhaps i have to change option when i compile on my linux box... > > Thanks in advance! > > lm. > > -------- Original Message -------- > Subject: [stunnel-users] Problem with mysql (20-juil.-2005 11:41) > From: lmarcilly(a)aressi.fr > To: lmarcilly(a)aressi.fr > > > Hi all, > > > > i try to encrypt mysql connections... > > > > I saw this : http://www.stunnel.org/examples/mysql.html > > > > but i use stunnel4.x. > > > > I configure it on my windows box and it work well! (mysql server is on a > > linux box, i have configure stunnel as a server on this box) > > > > when i try mysql -u user --password=xyz it works > > > > but i have to made it work on a linux box. > > I use the same config file for stunnel, but when i try > > > > mysql -u user --password=xyz i have : > > Can't connect to local MySQL server through socket '/var/run/mysqld/mysqld. > > sock' > > > > This socket doesn't exist since there is no MySQL server on the box. > > > > I try with --protocol=TCP but it won't work, i have : > > > > Can't connect to MySQL server on 'localhost' > > > > Do you have an idea? Do you want more details on my config file for stunnel? > > > > > > > > Thanks in advance and sorry for my english! > > > > lm > > > > > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)mirt.net > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > To: lmarcilly(a)aressi.fr > stunnel-users(a)mirt.net To: lmarcilly(a)aressi.fr stunnel-users(a)mirt.net

1 0

Problem with mysql
by lmarcilly＠aressi.fr 20 Jul '05

20 Jul '05

Hi all, i try to encrypt mysql connections... I saw this : http://www.stunnel.org/examples/mysql.html but i use stunnel4.x. I configure it on my windows box and it work well! (mysql server is on a linux box, i have configure stunnel as a server on this box) when i try mysql -u user --password=xyz it works but i have to made it work on a linux box. I use the same config file for stunnel, but when i try mysql -u user --password=xyz i have : Can't connect to local MySQL server through socket '/var/run/mysqld/mysqld.sock' This socket doesn't exist since there is no MySQL server on the box. I try with --protocol=TCP but it won't work, i have : Can't connect to MySQL server on 'localhost' Do you have an idea? Do you want more details on my config file for stunnel? Thanks in advance and sorry for my english! lm

1 0

SSL Session Cache and HTTPS performance
by Daniel Hamburg 19 Jul '05

19 Jul '05

Hello everybody, I hope I didn't muss an existing thread about this question, but I wasn't able to find one. At least none where I found an answer, although my question is quite simple. I would like to test the performance difference between enabled and disabled SSLCaching. I use a configuration file for Stunnel 4.11 (daemon mode) where I tell it to accept incoming connections on port 444 and direct them to a local web-server on port 80. Because STunnel uses Caching by default, I tried to tell STunnel to disable SSL Caching by setting session = 0 in the configuration file, which resulted in an error when starting the program. I looked at the code and found that there is a check so that the session parameter can not be equal to 0. I disabled the check and started stunnel again which seemed to work. But taking a look at the packets exchanged via a browser and the server resulted in the conclusion that caching is still enabled. My simple question is, how I can disable the Caching. Another question is if anyone of you has made any performance tests regarding STunnel in combination with an Apache HTTP server on the same machine. I'm specially interested in modes to get this combination run faster. And now please do not tell me to use mod_ssl. :) Thanks in advance. Daniel -- ====================================================================== Dipl.-Ing. Daniel Hamburg Tel.: 0234/32-28034 Ruhr-Universität Bochum Fax.: 0234/32-08034 Arbeitsgruppe Integrierte Informationssysteme IC 4/47 Universitätsstraße 150 Web: www.iis.ruhr-uni-bochum.de D-44780 Bochum eMail: daniel.hamburg(a)iis.rub.de ======================================================================

3 5

smtps problem on Fedora Core 4
by Anders Gjerløv 19 Jul '05

19 Jul '05

Hi, I am trying to get the smtps solution described on http://www.linuxquestions.org/questions/answers.php?action=viewarticle&arti… working on my server. Basically I want my users on Windows XP boxes to get their mail from 127.0.0.1:100 and send their mail to 127.0.0.1:25 I have gotten as far as having the users able to get mails. That is I have stunnel on a windows box, with a configuration file like this: client = yes debug = debug cert = pemfile.pem [pop3s] accept = localhost:110 connect = my.domain.com:995 [smtps] accept = localhost:25 connect = my.domain.com:465 And a telnet to port 110 on the lookback interface gives me access to the pop server. Så I am guessing that the certificates etc. are working correctly. As for the smtps I am using xinetd, and have tried with various configurations. Here is one of the one's that didn't work: service smtps { disable = no socket_type = stream wait = no user = root server = /usr/sbin/stunnel server_args = -v3 -rlocalhost:25 log_on_success += HOST DURATION log_on_failure += HOST ATTEMPT } Any ideas as to how to setup my xinetd file (or is there a better solution?) # stunnel -version stunnel 4.08 on i386-redhat-linux-gnu PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7f 22 Mar 2005 Global options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /etc/stunnel/stunnel.pem pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds Kind regards, Anders

2 1

Re: [stunnel-users] HTTPS Proxy support?
by Sean Covel 17 Jul '05

17 Jul '05

Yeah, good for you. Don't we all. I'll just go shove off then. Sean Michal Trojnara wrote: > Sean, > >> $25. > > > It's not enough to allocate my time. 8-) > I usually work for $75/hour. > > Anyway I'm going to support this feature some day. > > Best regards, > Mike > > Sean Covel wrote: > Mike, > > $25. > > I have a paypal link on my development site. Rarely see a payment, but > I have seen some. Doesn't cost anything to have the link or the paypal > account. > > Sean > > Michal Trojnara wrote: > >>Sean, >> >> >>>Do you have a PayPal link somewhere? >> >> >>So far I didn't use PayPal. >>How much money would you like to spend to sponsor stunnel development? >> >>Best regards, >> Mike >> > >

1 0

Stunnel on openwrt
by Markus Mauch 15 Jul '05

15 Jul '05

Hello, I'm using stunnel on a asus router with a openwrt like linux on it. The Idea is to secure traffic from and to a thttpd web server which is running on that box as well. Problem is that stunnel only seems to be able to handle one connection at a time. Whenever it has to cope with more than one it crashes. Unfortunatelly this happens all the time because usually a web browser opens several tcp connections in order to speed things up. So whenever I browse to a web page on the router through stunnel I get only the text. The rest (e.g. the images) which is loaded via different tcp connections does not appear and stunnel won't respond to any further requests until it is restarted. My explanation to this is that the very first request is processed normally but as soon as one other connection causes stunnel to create a second process the whole thing goes to the dogs. ps reveals that there are always two instances of stunnel running after such an experiment, both hanging, of course. So my question is what could I do to keep stunnel from creating new processes when a client tries to communicate over more than one tcp connection or - better - what chould I do in the first place to prevent stunnel from hanging in such a case? Any help would be very apreciated...

1 0

Re: [stunnel-users] HTTPS Proxy support?
by seanecovel＠comcast.net 15 Jul '05

15 Jul '05

Mike, GREAT! I did see a patch out on the web that seems to add this feature. Any chance that patch will be included in MAIN? I don't want to have to patch stunnel on multiple OS especially when you are going to implement the feature yourself. What can I do to "encourage" you to add that support sooner than later? Sean -------------- Original message -------------- > "Sean E. Covel" wrote: > > Does stunnel support HTTPS Proxies with authentication? > > Currently not. > > > Could it? > > Yes, CONNECT protocol support (RFC 2817 section 5.2) is on my TODO list: > http://stunnel.mirt.net/todo_sdf.html > > Best regards, > Mike > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users

3 2

HTTPS Proxy support?
by Sean E. Covel 14 Jul '05

14 Jul '05

I am trying to use stunnel to tunnel VNC through a firewall using port 443. When I test on 2 machines on the LAN everything works fine. Nice tool! When I try to connect through the firewall I suspect the HTTPS Proxy is getting in the way. It requires authentication. Does stunnel support HTTPS Proxies with authentication? Could it? Thanks, Sean

2 1

Q: controlled access to service?
by Nardmann, Heiko 14 Jul '05

14 Jul '05

Hi, I want to control access to a through stunnel reachable service. Only those clients shall be allowed to use the service which provide a known certificate. I have found the option "CApath"; can this directory be used to collect all client certificates? Or is it absolutely necessary to have CA certs there? Another thing in this environment: I do not know or own every CA certificate used by the clients - I only get the client certificates itself. So I want to do only a one-level client cert verification. Which verify level do I need for this? 2 or 3? What about removing certificates from the CApath directory? Do I have to restart stunnel to make this change be effective? Another thing: since the client certificates are not revoked by us I am not able to use CRLs for controlling access to our service. -- Heiko Nardmann (Dipl.-Ing. Technische Informatik) secunet Security Networks AG - Sicherheit in Netzwerken (www.secunet.de) Weidenauer Str. 223-225, D-57076 Siegen Tel. : +49 271 48950-13, Fax : +49 271 48950-50

3 2

Re: [stunnel-users] Certificate renaming
by Paul Jones 13 Jul '05

13 Jul '05

>"The easiest option is to use CAfile instead of CApath." So does the CA (Certificate Authority) certificate still go in the CAfile? That would mean the CAfile contains the CA certificate and all client certificates (on the server side), right? Cheers, Paul. _________________________________________________________________ REALESTATE: biggest buy/rent/share listings http://ninemsn.realestate.com.au

1 0

debugging stunnel
by edonald1＠rochester.rr.com 12 Jul '05

12 Jul '05

Been trying to debug stunnel issues for stunnel-4.09 on Solaris 2.8. When in trouble I resort to reading documentation. It is now that I notice these two small lines in the begining of the document called INSTALL: 1. If your machine supports POSIX threads make sure your SSL library is compiled with -DTHREADS. I did not do this .... ( verify openssl is compiled with -DTHREADS). WHat is the result of not compiling openssl with THREADS? Also what version of openssl is recommended. I am using OpenSSL 0.9.6m . Thanks in advance, Liz

2 1

Solaris 2.8 stunnel stop running
by edonald1＠rochester.rr.com 12 Jul '05

12 Jul '05

Running stunnel on Solaris 2.8. Stunnel running as client quits unexpectedly . here are the lines in the log: 2005.07.12 11:01:31 LOG7[5736:1]: mod_jk_secure accepted FD=2 from 127.0.0.1:57610 2005.07.12 11:01:31 LOG7[5736:1]: FD 2 in non-blocking mode 2005.07.12 11:02:28 LOG3[5736:4]: SSL_connect: Peer suddenly disconnected 2005.07.12 11:02:28 LOG7[5736:4]: linger (remote): Invalid argument (22) 2005.07.12 11:02:28 LOG7[5736:4]: mod_jk_secure finished (1 left) 2005.07.12 11:02:28 LOG7[5736:5]: mod_jk_secure started 2005.07.12 11:02:28 LOG7[5736:5]: TCP_NODELAY option set on local socket 2005.07.12 11:02:28 LOG5[5736:5]: mod_jk_secure connected from 127.0.0.1:57610 2005.07.12 11:02:28 LOG7[5736:5]: FD 0 in non-blocking mode 2005.07.12 11:02:28 LOG7[5736:5]: mod_jk_secure connecting 150.247.130.5:51001 2005.07.12 11:02:28 LOG7[5736:5]: connect_wait: waiting 10 seconds 2005.07.12 11:02:28 LOG7[5736:1]: mod_jk_secure accepted FD=1 from 127.0.0.1:57614 2005.07.12 11:02:28 LOG7[5736:1]: FD 1 in non-blocking mode 2005.07.12 11:02:29 LOG7[5736:6]: mod_jk_secure started 2005.07.12 11:02:29 LOG7[5736:6]: TCP_NODELAY option set on local socket 2005.07.12 11:02:29 LOG5[5736:6]: mod_jk_secure connected from 127.0.0.1:57614 2005.07.12 11:02:29 LOG7[5736:6]: FD 7 in non-blocking mode 2005.07.12 11:02:29 LOG7[5736:6]: mod_jk_secure connecting 150.247.130.5:51001 2005.07.12 11:02:29 LOG7[5736:6]: connect_wait: waiting 10 seconds 2005.07.12 11:02:29 LOG7[5736:5]: connect_wait: connected 2005.07.12 11:02:29 LOG7[5736:5]: Remote FD=0 initialized 2005.07.12 11:02:29 LOG7[5736:5]: TCP_NODELAY option set on remote socket 2005.07.12 11:02:29 LOG7[5736:5]: SSL state (connect): before/connect initialization 2005.07.12 11:02:29 LOG7[5736:5]: SSL state (connect): SSLv3 write client hello A 2005.07.12 11:02:29 LOG7[5736:6]: connect_wait: connected 2005.07.12 11:02:29 LOG7[5736:6]: Remote FD=7 initialized 2005.07.12 11:02:29 LOG7[5736:6]: TCP_NODELAY option set on remote socket 2005.07.12 11:02:29 LOG7[5736:6]: SSL state (connect): before/connect initialization 2005.07.12 11:02:29 LOG7[5736:6]: SSL state (connect): SSLv3 write client hello A All ideas welcome. I happen to know that the server side stunnel is down. SHouldn't the client side keep running under these circumstances? Thanks, Liz

1 0

stunnel 4.11 relaesed
by Michal Trojnara 12 Jul '05

12 Jul '05

Dear Users, Here is the ChangeLog entry: Version 4.11, 2005.07.09, urgency: MEDIUM: * New features - New ./configure option --with-threads to select thread model. - ./configure option --with-tcp-wrappers renamed to --disable-libwrap. I hope the meaning of the option is much more clear, now. * Bugfixes - Workaround for non-standard makecontext() uc_stack.ss_sp parameter semantics on Sparc/Solaris 9 and earlier. - scan_waiting_queue() no longer drops contexts. - Inetd mode coredumps with UCONTEXT fixed. - Cleanup context is no longer used. - Releasing memory of the current context is delayed. - Win32 headers reordered for Visual Studio 7. - Some Solaris compilation warnings fixed. - Rejected inetd mode without 'connect' or 'exec'. * Release notes - UCONTEXT threading seems stable, now. Upgrade is recommended. Home page, downloads: http://stunnel.mirt.net/ sha1sum for stunnel-4.11.tar.gz file: cf57169d591fbe3371a29e432d840e7f66103a9f Best regards, Mike

3 3

Stunnel-4.10 and Stunnel-4.11 in HPUX-11.23 IPF gives coredump
by Punitha 12 Jul '05

12 Jul '05

Hello All, I'm using HP-UX11.23 IPF. I have built Stunnel-4.11 with OpenSSL - 0.9.7e. I could build it successfully but I'm failed in connecting with telnet. After a while connecting to the telnet the client gets coredump and kills the process. So the connection is no more established. Note: I had the same problem in Stunnel-4.10 also but not before that. I could very well compile and use Stunnel-4.09. My configuration file for client is: cert = /opt/iexpress/stunnel/etc/stunnel/stunnel.pem chroot = /opt/iexpress/stunnel/var/stunnel pid = setuid = root setgid = root CAfile = /opt/iexpress/stunnel/etc/stunnel/stunnel.pem debug = 7 client = yes foreground = yes verify = 3 [test1] accept = 8080 connect = 9090 For server: cert = /opt/iexpress/stunnel/etc/stunnel/stunnel.pem chroot = /opt/iexpress/stunnel/var/stunnel pid = setuid = root setgid = root CAfile = /opt/iexpress/stunnel/etc/stunnel/stunnel.pem debug = 6 client = no foreground = yes verify = 1 [test1] accept = 9090 connect = 23 The client log shows as follows: # ../../sbin/stunnel stunnel-client.conf 2005.07.10 23:39:26 LOG5[8909:1]: stunnel 4.11 on ia64-hp-hpux11.23 UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 2005.07.10 23:39:26 LOG7[8909:1]: Snagged 64 random bytes from /dev/random 2005.07.10 23:39:26 LOG7[8909:1]: RAND_status claims sufficient entropy for the PRNG 2005.07.10 23:39:26 LOG6[8909:1]: PRNG seeded successfully 2005.07.10 23:39:26 LOG7[8909:1]: Certificate: /home/punitha/stunnel1/etc/stunnel/stunnel.pem 2005.07.10 23:39:26 LOG7[8909:1]: Key file: /home/punitha/stunnel1/etc/stunnel/stunnel.pem 2005.07.10 23:39:26 LOG7[8909:1]: Loaded verify certificates from /home/punitha/stunnel1/etc/stunnel/stunnel.pem 2005.07.10 23:39:26 LOG6[8909:1]: file ulimit = 2048 (can be changed with 'ulimit -n') 2005.07.10 23:39:26 LOG6[8909:1]: poll() used - no FD_SETSIZE limit for file descriptors 2005.07.10 23:39:26 LOG5[8909:1]: 1000 clients allowed 2005.07.10 23:39:26 LOG7[8909:1]: FD 3 in non-blocking mode 2005.07.10 23:39:26 LOG7[8909:1]: FD 4 in non-blocking mode 2005.07.10 23:39:26 LOG7[8909:1]: FD 5 in non-blocking mode 2005.07.10 23:39:26 LOG7[8909:1]: SO_REUSEADDR option set on accept socket 2005.07.10 23:39:26 LOG7[8909:1]: test1 bound to 0.0.0.0:8080 2005.07.10 23:39:26 LOG7[8909:1]: No pid file being created 2005.07.10 23:40:08 LOG7[8909:1]: test1 accepted FD=8 from 127.0.0.1:49700 2005.07.10 23:40:08 LOG7[8909:1]: Creating a new context 2005.07.10 23:40:08 LOG7[8909:1]: Context 2 created 2005.07.10 23:40:08 LOG7[8909:2]: Context swap: 1 -> 2 Memory fault(coredump) # It will be helpful if anyone of you guide me in this. Thanx In Advance. Regards, Punitha, V.

2 3

Re: [stunnel-users] Poll/Descriptor Problem
by Andrew Gay 11 Jul '05

11 Jul '05

Hi I get the same/similar error messages using Stunnel 4.10 (client) on Solaris 9 (sparc). I also see some very large integer numbers (e.g. FD=2615261238) in the log which art file descriptors. Perhaps there is an issue with big/little endedness in the later Stunnel releases. I went back to using Stunnel 4.07 and the problems went away. Andrew Gay > > I am running Stunnel 4.09 on Mac OS X 10.4 to provide HTTPS service on > the standard ports (accept on 443, connect to 80). > > All connections are either truncated or dropped entirely, with the > following messages written to the log: > > ------------------------------------------ > https connected from ... > INTERNAL ERROR:s_poll_wait returned 1, but no descriptor is ready > Connection reset: XXXXXX bytes sent to SSL, XXX bytes sent to socket > ------------------------------------------ > > I've tried 4.10, but the result is exactly the same. > > Does anybody have any thoughts on what might be going on? > > Thanks, > John >

2 1

Poll/Descriptor Problem
by John O'Fallon 08 Jul '05

08 Jul '05

I am running Stunnel 4.09 on Mac OS X 10.4 to provide HTTPS service on the standard ports (accept on 443, connect to 80). All connections are either truncated or dropped entirely, with the following messages written to the log: ------------------------------------------ https connected from ... INTERNAL ERROR:s_poll_wait returned 1, but no descriptor is ready Connection reset: XXXXXX bytes sent to SSL, XXX bytes sent to socket ------------------------------------------ I've tried 4.10, but the result is exactly the same. Does anybody have any thoughts on what might be going on? Thanks, John

1 0

Re: [stunnel-users] Certificate renaming
by Paul Jones 07 Jul '05

07 Jul '05

>From the discussion here, I got the impression that it is still possible for Stunnel to run correctly and successful connections to be made if the certificate files are NOT renamed using the xxxxx.0 format, where xxxxx is the hash value of the certificate. So I simply placed the .crt files for all clients on the server (under the directory specified in the CApath field in the CONF file). Now, I've tried, tried, and tried, but it still doesn't work. I get a "bad certificate" error when attempting to connect from the client. Am I missing something? Note: I am running Stunnel on Win2K. Cheers. Paul _________________________________________________________________ Single? Start dating at Lavalife. Try our 7 day FREE trial! http://lavalife9.ninemsn.com.au/clickthru/clickthru.act?context=an99&locale…

1 0

Re: [stunnel-users] Stunnel for pop3 on solaris 2.6 (more info)
by Douglas Phillipson 06 Jul '05

06 Jul '05

Should I have "protocol = pop3" in my config file? When I do, I get this from the stunnel log: 2005.07.06 12:46:54 LOG7[18045:0]: CONTEXT 1, FD=6, (IN)->() 2005.07.06 12:46:54 LOG7[18045:0]: CONTEXT 2, FD=0, (IN)->(IN) 2005.07.06 12:46:54 LOG7[18045:0]: Waiting 300 second(s) for 3 file descriptor(s) 2005.07.06 12:46:54 LOG7[18045:0]: CONTEXT 1, FD=4, (IN)->() 2005.07.06 12:46:54 LOG7[18045:0]: CONTEXT 1, FD=6, (IN)->() 2005.07.06 12:46:54 LOG7[18045:0]: CONTEXT 2, FD=0, (IN)->(IN) 2005.07.06 12:46:54 LOG7[18045:2]: <- .g.. 2005.07.06 12:46:54 LOG3[18045:2]: Client does not want TLS 2005.07.06 12:46:54 LOG5[18045:2]: Protocol negotiation failed 2005.07.06 12:46:54 LOG3[18045:2]: Protocol negotiations failed 2005.07.06 12:46:54 LOG7[18045:2]: pop3s finished (0 left) 2005.07.06 12:46:54 LOG7[18045:2]: Context 2 closed 2005.07.06 12:46:54 LOG7[18045:0]: Waiting -1 second(s) for 2 file descriptor(s) Doug P Douglas Phillipson wrote: > I'm not sure it it applies but if I do: > > openssl s_client -connect 172.20.12.59:995 > > I get the following error: > > CONNECTED(00000003) > 17964:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:226: > > > Doug P > > > Douglas Phillipson wrote: > >> I have a Solaris 2.6 box and am trying to get pop3 over SSL running. I use: >> >> qpopper 4.0.5 >> openssl-0.9.7g >> stunnel 4.10 compiled with gcc 2.95.3 >> >> When I compiled stunnel it made a private ket and certificate in /usr/local/etc/stunnel/stunnel.pem. >> >> Do I need anything else? >> >> I have the following configuration: >> >> Inetd.conf: >> >> pop3 stream tcp nowait root /usr/local/sbin/popper qpopper -S -t /poplog >> >> stunnel.conf: >> >> cert = /usr/local/etc/stunnel/stunnel.pem >> key = /usr/local/etc/stunnel/stunnel.pem >> debug = 7 >> output = /stunnel.log >> pid = /stunnel.pid >> client = yes >> >> [pop3s] >> accept = 995 >> connect = 110 >> >> I run stunnel and get the following output: >> >> 2005.07.06 11:34:17 LOG5[17873:1]: stunnel 4.10 on sparc-sun-solaris2.6 UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7g 11 Apr 2005 >> 2005.07.06 11:34:18 LOG7[17873:1]: Snagged 64 random bytes from //.rnd >> 2005.07.06 11:34:18 LOG7[17873:1]: Wrote 1024 new random bytes to //.rnd >> 2005.07.06 11:34:18 LOG7[17873:1]: RAND_status claims sufficient entropy for the PRNG >> 2005.07.06 11:34:18 LOG6[17873:1]: PRNG seeded successfully >> 2005.07.06 11:34:18 LOG7[17873:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem >> 2005.07.06 11:34:18 LOG7[17873:1]: Key file: /usr/local/etc/stunnel/stunnel.pem >> 2005.07.06 11:34:18 LOG6[17873:1]: file ulimit = 64 (can be changed with 'ulimit -n') >> 2005.07.06 11:34:18 LOG6[17873:1]: poll() used - no FD_SETSIZE limit for file descriptors >> 2005.07.06 11:34:18 LOG5[17873:1]: 29 clients allowed >> 2005.07.06 11:34:18 LOG7[17873:1]: FD 4 in non-blocking mode >> 2005.07.06 11:34:18 LOG7[17873:1]: FD 5 in non-blocking mode >> 2005.07.06 11:34:18 LOG7[17873:1]: FD 6 in non-blocking mode >> 2005.07.06 11:34:18 LOG7[17873:1]: SO_REUSEADDR option set on accept socket >> 2005.07.06 11:34:18 LOG7[17873:1]: pop3s bound to 0.0.0.0:995 >> 2005.07.06 11:34:18 LOG7[17874:1]: Created pid file /stunnel.pid >> 2005.07.06 11:34:18 LOG7[17874:0]: Waiting -1 second(s) for 2 file descriptor(s) >> >> >> I connect via pop3 in thunderbird with ssl and qpopper always says: >> (null) at localhost (127.0.0.1): -ERR Unknown command: "". >> (nulI/O error flushing output to client at localhost [127.0.0.1]: Broken pipe (32)l) at localhost (127.0.0.1): -ERR POP EOF or I/O Error >> >> Stunnel says: >> >> 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=4, (IN)->() >> 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=6, (IN)->(IN) >> 2005.07.06 11:37:13 LOG7[17884:1]: pop3s accepted FD=0 from 172.20.10.7:45464 >> 2005.07.06 11:37:13 LOG7[17884:1]: Creating a new context >> 2005.07.06 11:37:13 LOG7[17884:1]: Context 2 created >> 2005.07.06 11:37:13 LOG7[17884:2]: pop3s started >> 2005.07.06 11:37:13 LOG7[17884:2]: FD 0 in non-blocking mode >> 2005.07.06 11:37:13 LOG7[17884:2]: TCP_NODELAY option set on local socket >> 2005.07.06 11:37:13 LOG5[17884:2]: pop3s connected from 172.20.10.7:45464 >> 2005.07.06 11:37:13 LOG7[17884:2]: FD 1 in non-blocking mode >> 2005.07.06 11:37:13 LOG7[17884:2]: pop3s connecting 127.0.0.1:110 >> 2005.07.06 11:37:13 LOG7[17884:2]: Remote FD=1 initialized >> 2005.07.06 11:37:13 LOG7[17884:2]: TCP_NODELAY option set on remote socket >> 2005.07.06 11:37:13 LOG7[17884:2]: SSL state (connect): before/connect initialization >> 2005.07.06 11:37:13 LOG7[17884:2]: SSL state (connect): SSLv3 write client hello A >> 2005.07.06 11:37:13 LOG7[17884:0]: Waiting 300 second(s) for 3 file descriptor(s) >> 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=4, (IN)->() >> 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=6, (IN)->() >> 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 2, FD=1, (IN)->(IN) >> >> The mail never gets delivered to either Thunderbird or outlook express. >> I get a certificate approval request from Thunderbird to which I grant, then nothing. If I disable ssl in thunderbird the mail gets accepted normally. >> >> What might I be doing wrong??? >> >> Thanks >> >> Doug P

1 0

Re: [stunnel-users] Stunnel for pop3 on solaris 2.6 ( Even more info)
by Douglas Phillipson 06 Jul '05

06 Jul '05

If I set "client = no" in stunnels config file I get the following from: openssl s_client -connect 172.20.12.59:995 CONNECTED(00000003) depth=0 /C=US/ST=Nevada/L=Las Vegas/O=Bechtel/OU=RSL/CN=test1 verify error:num=18:self signed certificate verify return:1 depth=0 /C=US/ST=Nevada/L=Las Vegas/O=Bechtel/OU=RSL/CN=test1 verify return:1 30463:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:226: Is a "self signed" Cert OK? I didn't sign anything though. Compiling stunnel created a cert. Installing openssl I think created a cert. Do these need to match somehow? If so how do you do that? I think I'm lost here... Regards Doug P Douglas Phillipson wrote: > I have a Solaris 2.6 box and am trying to get pop3 over SSL running. I use: > > qpopper 4.0.5 > openssl-0.9.7g > stunnel 4.10 compiled with gcc 2.95.3 > > When I compiled stunnel it made a private ket and certificate in /usr/local/etc/stunnel/stunnel.pem. > > Do I need anything else? > > I have the following configuration: > > Inetd.conf: > > pop3 stream tcp nowait root /usr/local/sbin/popper qpopper -S -t /poplog > > stunnel.conf: > > cert = /usr/local/etc/stunnel/stunnel.pem > key = /usr/local/etc/stunnel/stunnel.pem > debug = 7 > output = /stunnel.log > pid = /stunnel.pid > client = yes > > [pop3s] > accept = 995 > connect = 110 > > I run stunnel and get the following output: > > 2005.07.06 11:34:17 LOG5[17873:1]: stunnel 4.10 on sparc-sun-solaris2.6 UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7g 11 Apr 2005 > 2005.07.06 11:34:18 LOG7[17873:1]: Snagged 64 random bytes from //.rnd > 2005.07.06 11:34:18 LOG7[17873:1]: Wrote 1024 new random bytes to //.rnd > 2005.07.06 11:34:18 LOG7[17873:1]: RAND_status claims sufficient entropy for the PRNG > 2005.07.06 11:34:18 LOG6[17873:1]: PRNG seeded successfully > 2005.07.06 11:34:18 LOG7[17873:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem > 2005.07.06 11:34:18 LOG7[17873:1]: Key file: /usr/local/etc/stunnel/stunnel.pem > 2005.07.06 11:34:18 LOG6[17873:1]: file ulimit = 64 (can be changed with 'ulimit -n') > 2005.07.06 11:34:18 LOG6[17873:1]: poll() used - no FD_SETSIZE limit for file descriptors > 2005.07.06 11:34:18 LOG5[17873:1]: 29 clients allowed > 2005.07.06 11:34:18 LOG7[17873:1]: FD 4 in non-blocking mode > 2005.07.06 11:34:18 LOG7[17873:1]: FD 5 in non-blocking mode > 2005.07.06 11:34:18 LOG7[17873:1]: FD 6 in non-blocking mode > 2005.07.06 11:34:18 LOG7[17873:1]: SO_REUSEADDR option set on accept socket > 2005.07.06 11:34:18 LOG7[17873:1]: pop3s bound to 0.0.0.0:995 > 2005.07.06 11:34:18 LOG7[17874:1]: Created pid file /stunnel.pid > 2005.07.06 11:34:18 LOG7[17874:0]: Waiting -1 second(s) for 2 file descriptor(s) > > > I connect via pop3 in thunderbird with ssl and qpopper always says: > (null) at localhost (127.0.0.1): -ERR Unknown command: "". > (nulI/O error flushing output to client at localhost [127.0.0.1]: Broken pipe (32)l) at localhost (127.0.0.1): -ERR POP EOF or I/O Error > > Stunnel says: > > 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=4, (IN)->() > 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=6, (IN)->(IN) > 2005.07.06 11:37:13 LOG7[17884:1]: pop3s accepted FD=0 from 172.20.10.7:45464 > 2005.07.06 11:37:13 LOG7[17884:1]: Creating a new context > 2005.07.06 11:37:13 LOG7[17884:1]: Context 2 created > 2005.07.06 11:37:13 LOG7[17884:2]: pop3s started > 2005.07.06 11:37:13 LOG7[17884:2]: FD 0 in non-blocking mode > 2005.07.06 11:37:13 LOG7[17884:2]: TCP_NODELAY option set on local socket > 2005.07.06 11:37:13 LOG5[17884:2]: pop3s connected from 172.20.10.7:45464 > 2005.07.06 11:37:13 LOG7[17884:2]: FD 1 in non-blocking mode > 2005.07.06 11:37:13 LOG7[17884:2]: pop3s connecting 127.0.0.1:110 > 2005.07.06 11:37:13 LOG7[17884:2]: Remote FD=1 initialized > 2005.07.06 11:37:13 LOG7[17884:2]: TCP_NODELAY option set on remote socket > 2005.07.06 11:37:13 LOG7[17884:2]: SSL state (connect): before/connect initialization > 2005.07.06 11:37:13 LOG7[17884:2]: SSL state (connect): SSLv3 write client hello A > 2005.07.06 11:37:13 LOG7[17884:0]: Waiting 300 second(s) for 3 file descriptor(s) > 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=4, (IN)->() > 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=6, (IN)->() > 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 2, FD=1, (IN)->(IN) > > The mail never gets delivered to either Thunderbird or outlook express. > I get a certificate approval request from Thunderbird to which I grant, then nothing. If I disable ssl in thunderbird the mail gets accepted normally. > > What might I be doing wrong??? > > Thanks > > Doug P > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

Stunnel for pop3 on solaris 2.6
by Douglas Phillipson 06 Jul '05

06 Jul '05

I have a Solaris 2.6 box and am trying to get pop3 over SSL running. I use: qpopper 4.0.5 openssl-0.9.7g stunnel 4.10 compiled with gcc 2.95.3 When I compiled stunnel it made a private ket and certificate in /usr/local/etc/stunnel/stunnel.pem. Do I need anything else? I have the following configuration: Inetd.conf: pop3 stream tcp nowait root /usr/local/sbin/popper qpopper -S -t /poplog stunnel.conf: cert = /usr/local/etc/stunnel/stunnel.pem key = /usr/local/etc/stunnel/stunnel.pem debug = 7 output = /stunnel.log pid = /stunnel.pid client = yes [pop3s] accept = 995 connect = 110 I run stunnel and get the following output: 2005.07.06 11:34:17 LOG5[17873:1]: stunnel 4.10 on sparc-sun-solaris2.6 UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7g 11 Apr 2005 2005.07.06 11:34:18 LOG7[17873:1]: Snagged 64 random bytes from //.rnd 2005.07.06 11:34:18 LOG7[17873:1]: Wrote 1024 new random bytes to //.rnd 2005.07.06 11:34:18 LOG7[17873:1]: RAND_status claims sufficient entropy for the PRNG 2005.07.06 11:34:18 LOG6[17873:1]: PRNG seeded successfully 2005.07.06 11:34:18 LOG7[17873:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2005.07.06 11:34:18 LOG7[17873:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2005.07.06 11:34:18 LOG6[17873:1]: file ulimit = 64 (can be changed with 'ulimit -n') 2005.07.06 11:34:18 LOG6[17873:1]: poll() used - no FD_SETSIZE limit for file descriptors 2005.07.06 11:34:18 LOG5[17873:1]: 29 clients allowed 2005.07.06 11:34:18 LOG7[17873:1]: FD 4 in non-blocking mode 2005.07.06 11:34:18 LOG7[17873:1]: FD 5 in non-blocking mode 2005.07.06 11:34:18 LOG7[17873:1]: FD 6 in non-blocking mode 2005.07.06 11:34:18 LOG7[17873:1]: SO_REUSEADDR option set on accept socket 2005.07.06 11:34:18 LOG7[17873:1]: pop3s bound to 0.0.0.0:995 2005.07.06 11:34:18 LOG7[17874:1]: Created pid file /stunnel.pid 2005.07.06 11:34:18 LOG7[17874:0]: Waiting -1 second(s) for 2 file descriptor(s) I connect via pop3 in thunderbird with ssl and qpopper always says: (null) at localhost (127.0.0.1): -ERR Unknown command: "". (nulI/O error flushing output to client at localhost [127.0.0.1]: Broken pipe (32)l) at localhost (127.0.0.1): -ERR POP EOF or I/O Error Stunnel says: 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=4, (IN)->() 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=6, (IN)->(IN) 2005.07.06 11:37:13 LOG7[17884:1]: pop3s accepted FD=0 from 172.20.10.7:45464 2005.07.06 11:37:13 LOG7[17884:1]: Creating a new context 2005.07.06 11:37:13 LOG7[17884:1]: Context 2 created 2005.07.06 11:37:13 LOG7[17884:2]: pop3s started 2005.07.06 11:37:13 LOG7[17884:2]: FD 0 in non-blocking mode 2005.07.06 11:37:13 LOG7[17884:2]: TCP_NODELAY option set on local socket 2005.07.06 11:37:13 LOG5[17884:2]: pop3s connected from 172.20.10.7:45464 2005.07.06 11:37:13 LOG7[17884:2]: FD 1 in non-blocking mode 2005.07.06 11:37:13 LOG7[17884:2]: pop3s connecting 127.0.0.1:110 2005.07.06 11:37:13 LOG7[17884:2]: Remote FD=1 initialized 2005.07.06 11:37:13 LOG7[17884:2]: TCP_NODELAY option set on remote socket 2005.07.06 11:37:13 LOG7[17884:2]: SSL state (connect): before/connect initialization 2005.07.06 11:37:13 LOG7[17884:2]: SSL state (connect): SSLv3 write client hello A 2005.07.06 11:37:13 LOG7[17884:0]: Waiting 300 second(s) for 3 file descriptor(s) 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=4, (IN)->() 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=6, (IN)->() 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 2, FD=1, (IN)->(IN) The mail never gets delivered to either Thunderbird or outlook express. I get a certificate approval request from Thunderbird to which I grant, then nothing. If I disable ssl in thunderbird the mail gets accepted normally. What might I be doing wrong??? Thanks Doug P

1 4

Certificate renaming
by Paul Jones 05 Jul '05

05 Jul '05

So what you are saying is that Stunnel will still work successfully and find the correct certificates if I do NOT name the certificate files using their hash values? And since my server will only have a maximum of 16 clients, finding the correct certificate shouldn't cause too many speed issues. Right? Cheers. Paul _________________________________________________________________ Sell your car for $9 on carpoint.com.au http://www.carpoint.com.au/sellyourcar

1 0

Certificate renaming
by Paul Jones 04 Jul '05

04 Jul '05

Hi all, I understand that in order for Stunnel to find a certificate, it has to be renamed to something like xxxxxx.0 (where xxxxxx is obtained by using the "openssl x509" command on the certificate). Why is this the case? I read somewhere that this helps Stunnel find the certificate quicker (i.e. Stunnel does not need to look at every certificate file before it knows which one it wants). Can someone provide me a better explanation please? Is there any way around this? Renaming the certificate file in such a manner causes confusion when searching for the certificate of a particular client... Cheers. Paul _________________________________________________________________ REALESTATE: biggest buy/rent/share listings http://ninemsn.realestate.com.au

4 4

AW: [stunnel-users] Reporting problems
by Smith, Derek John 01 Jul '05

01 Jul '05

Hi all, sorry to have to use the list for this, but it would appear to be the last option available. This is from a previous posting from Brian Hatch ... > As the maintenance man of the 3.x branch (yes, some folks do > use it still) > the official stance is this: > > * if it's a security bug, I'll patch it. > * if it's a bug and you have a patch that works, I'll probably > apply it > * if it's a bug and you don't have a patch, I probably don't > have the cycles to investigate it, sorry. > However, the reality is different. Yes, some people still do use release 3. I have customers who prefer proven stability over new innovation. This is meant to be understood in a general way (i.e. database upgrades, OS updates etc) and not specifically to stunnel. I have mailed Brian several times about problems concerning release 3.26 and not a single reply has been received. Maybe the mails never arrived, but I doubt it very much. Also, no changes have been made to the software, so the supplied patch never got applied. In the complete absence of any proof to the contrary, I can only assume that the following statement holds:- RELEASE 3 IS DEAD !!!!!!!!!! I welcome evidence refuting this, but won't hold my breath. In the meantime, testing will start on release 4. Brian, if you're reading this, I'm not trying to start a flame war, or dissing you. A simple mail would have sufficed ... Derek

2 1

4.10 Crashes with Multiple Connections
by Eddie Atherton 30 Jun '05

30 Jun '05

Hi. Just started to use stunnel for NNTP traffic to Giga on a gateway Linux 2.4 box that sits between Windows and my cable modem. The NewsReader I use is configured to open 4 connections at the same time. Downloaded and installed 4.10, then immediately hit the -lpthread problem. Edited the Makefile, did a "make clean", "make", and "make install". Tried again. Got an immediate crash. Tried a few more times. Sometimes it crashed, other times the NewsReader reported one connection as working, one as connected, but not pulling any data, and two connections as connecting. So, it looks like everything works with only one active connection, but it segfaults when 2 or more threads are pulling data. The problem is, I can't always get it to crash. Plus, cpu use of stunnel sometimes pegs at 99%, even after closing the connections, and again this isn't consistent. When I turn debug on, it has always only used one active connection, so I don't get the crash. Plus, when debug is on, and I terminate the connections from the NewsReader, the log file expanded to 18meg in less than a minute. I then downloaded and installed 4.9, and this appears to handle the 4 active connections without any problems. Any suggestions as to what kind of information I should try and collect for this. Cheers, Eddie

1 0

SSL_read returned WANT_ - retry
by Leach, Rich 30 Jun '05

30 Jun '05

Greetings all- I'm an internet developer (mainly ColdFusion, some Windows, database stuff, etc.) and I've just inherited a Windows system that is utilizing Stunnel (I believe it's version 3.4) and in the log files I'm seeing this error all over the place: "SSL_read returned WANT_ - retry" It's usually listed around other messages in the log file such as "socket closed", "connection closed", etc. I noticed these messages in our logs because I got a call to restart our web services; everything froze up and the site would not come up. I stopped and started the web services and everything came back up. For a long time everyone around here has been blaming our ColdFusion server (version 6.1) but it looks to me like the Stunnel is throwing a wrench and halting everything - does anyone know what these errors mean or could you direct me to a place on the stunnel site that could offer some insight? I tried looking around the FAQ section but didn't see my error listed. Any help or input you could provide would be most appreciated! Many thanks in advance, Rich

1 0

win32 help
by chris rheinherren 28 Jun '05

28 Jun '05

I am running a win32 based IRC server and I wanted to add SSL to it. I have stunnel up and running. I have the necessary dlls installed. And I have found various help pages on creating the config file. And lastly my irc client is capable of connecting to SSL based servers. so here is my config file: <---- beging ------> RNDfile = C:\stunnel-prnd.txt RNDoverwrite = yes debug = 7 output = C:\stunnel.log [irc] accept = 66.98.154.87:994 connect = 127.0.0.1:994 <---- ending -----> And here is the log outup to help figure out what is wrong as well. <---- log -----> 2005.06.27 21:38:46 LOG5[2364:4084]: stunnel 4.04 on x86-pc-mingw32-gnu WIN32 with OpenSSL 0.9.7c 30 Sep 2003 2005.06.27 21:38:46 LOG7[2364:3120]: RAND_status claims sufficient entropy for the PRNG 2005.06.27 21:38:46 LOG6[2364:3120]: PRNG seeded successfully 2005.06.27 21:38:46 LOG7[2364:3120]: Certificate: stunnel.pem 2005.06.27 21:38:46 LOG7[2364:3120]: Key file: stunnel.pem 2005.06.27 21:38:46 LOG5[2364:3120]: WIN32 platform: 30000 clients allowed 2005.06.27 21:38:46 LOG7[2364:3120]: FD 132 in non-blocking mode 2005.06.27 21:38:46 LOG7[2364:3120]: SO_REUSEADDR option set on accept socket 2005.06.27 21:38:46 LOG7[2364:3120]: irc bound to 66.98.154.87:994 2005.06.27 21:39:43 LOG7[2364:3120]: irc accepted FD=144 from 12.216.55.121:1583 2005.06.27 21:39:43 LOG7[2364:3120]: FD 144 in non-blocking mode 2005.06.27 21:39:43 LOG7[2364:396]: irc started 2005.06.27 21:39:43 LOG5[2364:396]: irc connected from 12.216.55.121:1583 2005.06.27 21:39:43 LOG7[2364:396]: SSL state (accept): before/accept initialization 2005.06.27 21:39:43 LOG7[2364:396]: waitforsocket: FD=144, DIR=read 2005.06.27 21:39:43 LOG7[2364:396]: waitforsocket: ok 2005.06.27 21:39:43 LOG7[2364:396]: SSL state (accept): SSLv3 read client hello A 2005.06.27 21:39:43 LOG7[2364:396]: SSL state (accept): SSLv3 write server hello A 2005.06.27 21:39:43 LOG7[2364:396]: SSL state (accept): SSLv3 write certificate A 2005.06.27 21:39:43 LOG7[2364:396]: SSL state (accept): SSLv3 write server done A 2005.06.27 21:39:43 LOG7[2364:396]: SSL state (accept): SSLv3 flush data 2005.06.27 21:39:43 LOG7[2364:396]: waitforsocket: FD=144, DIR=read 2005.06.27 21:39:43 LOG7[2364:396]: waitforsocket: ok 2005.06.27 21:39:43 LOG7[2364:396]: SSL state (accept): SSLv3 read client key exchange A 2005.06.27 21:39:43 LOG7[2364:396]: SSL state (accept): SSLv3 read finished A 2005.06.27 21:39:43 LOG7[2364:396]: SSL state (accept): SSLv3 write change cipher spec A 2005.06.27 21:39:43 LOG7[2364:396]: SSL state (accept): SSLv3 write finished A 2005.06.27 21:39:43 LOG7[2364:396]: SSL state (accept): SSLv3 flush data 2005.06.27 21:39:43 LOG7[2364:396]: 1 items in the session cache 2005.06.27 21:39:43 LOG7[2364:396]: 0 client connects (SSL_connect()) 2005.06.27 21:39:43 LOG7[2364:396]: 0 client connects that finished 2005.06.27 21:39:43 LOG7[2364:396]: 0 client renegotiatations requested 2005.06.27 21:39:43 LOG7[2364:396]: 1 server connects (SSL_accept()) 2005.06.27 21:39:43 LOG7[2364:396]: 1 server connects that finished 2005.06.27 21:39:43 LOG7[2364:396]: 0 server renegotiatiations requested 2005.06.27 21:39:43 LOG7[2364:396]: 0 session cache hits 2005.06.27 21:39:43 LOG7[2364:396]: 0 session cache misses 2005.06.27 21:39:43 LOG7[2364:396]: 0 session cache timeouts 2005.06.27 21:39:43 LOG6[2364:396]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.06.27 21:39:43 LOG7[2364:396]: FD 164 in non-blocking mode 2005.06.27 21:39:43 LOG7[2364:396]: irc connecting 127.0.0.1:994 2005.06.27 21:39:43 LOG7[2364:396]: remote connect #1: EWOULDBLOCK: retrying 2005.06.27 21:39:43 LOG7[2364:396]: waitforsocket: FD=164, DIR=write 2005.06.27 21:44:43 LOG7[2364:396]: waitforsocket: timeout 2005.06.27 21:44:43 LOG3[2364:396]: Failed to initialize remote connection 2005.06.27 21:44:43 LOG7[2364:396]: irc finished (0 left) 2005.06.27 21:44:47 LOG7[2364:3120]: irc accepted FD=180 from 12.216.55.121:1639 2005.06.27 21:44:47 LOG7[2364:3120]: FD 180 in non-blocking mode 2005.06.27 21:44:47 LOG7[2364:768]: irc started 2005.06.27 21:44:47 LOG5[2364:768]: irc connected from 12.216.55.121:1639 2005.06.27 21:44:47 LOG7[2364:768]: SSL state (accept): before/accept initialization 2005.06.27 21:44:47 LOG7[2364:768]: waitforsocket: FD=180, DIR=read 2005.06.27 21:44:47 LOG7[2364:768]: waitforsocket: ok 2005.06.27 21:44:47 LOG7[2364:768]: SSL state (accept): SSLv3 read client hello A 2005.06.27 21:44:47 LOG7[2364:768]: SSL state (accept): SSLv3 write server hello A 2005.06.27 21:44:47 LOG7[2364:768]: SSL state (accept): SSLv3 write certificate A 2005.06.27 21:44:47 LOG7[2364:768]: SSL state (accept): SSLv3 write server done A 2005.06.27 21:44:47 LOG7[2364:768]: SSL state (accept): SSLv3 flush data 2005.06.27 21:44:47 LOG7[2364:768]: waitforsocket: FD=180, DIR=read 2005.06.27 21:44:47 LOG7[2364:768]: waitforsocket: ok 2005.06.27 21:44:47 LOG7[2364:768]: SSL state (accept): SSLv3 read client key exchange A 2005.06.27 21:44:47 LOG7[2364:768]: SSL state (accept): SSLv3 read finished A 2005.06.27 21:44:47 LOG7[2364:768]: SSL state (accept): SSLv3 write change cipher spec A 2005.06.27 21:44:47 LOG7[2364:768]: SSL state (accept): SSLv3 write finished A 2005.06.27 21:44:47 LOG7[2364:768]: SSL state (accept): SSLv3 flush data 2005.06.27 21:44:47 LOG7[2364:768]: 2 items in the session cache 2005.06.27 21:44:47 LOG7[2364:768]: 0 client connects (SSL_connect()) 2005.06.27 21:44:47 LOG7[2364:768]: 0 client connects that finished 2005.06.27 21:44:47 LOG7[2364:768]: 0 client renegotiatations requested 2005.06.27 21:44:47 LOG7[2364:768]: 2 server connects (SSL_accept()) 2005.06.27 21:44:47 LOG7[2364:768]: 2 server connects that finished 2005.06.27 21:44:47 LOG7[2364:768]: 0 server renegotiatiations requested 2005.06.27 21:44:47 LOG7[2364:768]: 0 session cache hits 2005.06.27 21:44:47 LOG7[2364:768]: 0 session cache misses 2005.06.27 21:44:47 LOG7[2364:768]: 0 session cache timeouts 2005.06.27 21:44:47 LOG6[2364:768]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.06.27 21:44:47 LOG7[2364:768]: FD 148 in non-blocking mode 2005.06.27 21:44:47 LOG7[2364:768]: irc connecting 127.0.0.1:994 2005.06.27 21:44:47 LOG7[2364:768]: remote connect #1: EWOULDBLOCK: retrying 2005.06.27 21:44:47 LOG7[2364:768]: waitforsocket: FD=148, DIR=write 2005.06.27 21:49:47 LOG7[2364:768]: waitforsocket: timeout 2005.06.27 21:49:47 LOG3[2364:768]: Failed to initialize remote connection 2005.06.27 21:49:47 LOG7[2364:768]: irc finished (0 left) 2005.06.27 21:49:51 LOG7[2364:3120]: irc accepted FD=168 from 12.216.55.121:1689 2005.06.27 21:49:51 LOG7[2364:3120]: FD 168 in non-blocking mode 2005.06.27 21:49:51 LOG7[2364:2508]: irc started 2005.06.27 21:49:51 LOG5[2364:2508]: irc connected from 12.216.55.121:1689 2005.06.27 21:49:51 LOG7[2364:2508]: SSL state (accept): before/accept initialization 2005.06.27 21:49:51 LOG7[2364:2508]: waitforsocket: FD=168, DIR=read 2005.06.27 21:49:51 LOG7[2364:2508]: waitforsocket: ok 2005.06.27 21:49:51 LOG7[2364:2508]: SSL state (accept): SSLv3 read client hello A 2005.06.27 21:49:51 LOG7[2364:2508]: SSL state (accept): SSLv3 write server hello A 2005.06.27 21:49:51 LOG7[2364:2508]: SSL state (accept): SSLv3 write certificate A 2005.06.27 21:49:51 LOG7[2364:2508]: SSL state (accept): SSLv3 write server done A 2005.06.27 21:49:51 LOG7[2364:2508]: SSL state (accept): SSLv3 flush data 2005.06.27 21:49:51 LOG7[2364:2508]: waitforsocket: FD=168, DIR=read 2005.06.27 21:49:51 LOG7[2364:2508]: waitforsocket: ok 2005.06.27 21:49:51 LOG7[2364:2508]: SSL state (accept): SSLv3 read client key exchange A 2005.06.27 21:49:51 LOG7[2364:2508]: SSL state (accept): SSLv3 read finished A 2005.06.27 21:49:51 LOG7[2364:2508]: SSL state (accept): SSLv3 write change cipher spec A 2005.06.27 21:49:51 LOG7[2364:2508]: SSL state (accept): SSLv3 write finished A 2005.06.27 21:49:51 LOG7[2364:2508]: SSL state (accept): SSLv3 flush data 2005.06.27 21:49:51 LOG7[2364:2508]: 3 items in the session cache 2005.06.27 21:49:51 LOG7[2364:2508]: 0 client connects (SSL_connect()) 2005.06.27 21:49:51 LOG7[2364:2508]: 0 client connects that finished 2005.06.27 21:49:51 LOG7[2364:2508]: 0 client renegotiatations requested 2005.06.27 21:49:51 LOG7[2364:2508]: 3 server connects (SSL_accept()) 2005.06.27 21:49:51 LOG7[2364:2508]: 3 server connects that finished 2005.06.27 21:49:51 LOG7[2364:2508]: 0 server renegotiatiations requested 2005.06.27 21:49:51 LOG7[2364:2508]: 0 session cache hits 2005.06.27 21:49:51 LOG7[2364:2508]: 0 session cache misses 2005.06.27 21:49:51 LOG7[2364:2508]: 0 session cache timeouts 2005.06.27 21:49:51 LOG6[2364:2508]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.06.27 21:49:51 LOG7[2364:2508]: FD 156 in non-blocking mode 2005.06.27 21:49:51 LOG7[2364:2508]: irc connecting 127.0.0.1:994 2005.06.27 21:49:51 LOG7[2364:2508]: remote connect #1: EWOULDBLOCK: retrying 2005.06.27 21:49:51 LOG7[2364:2508]: waitforsocket: FD=156, DIR=write 2005.06.27 21:54:51 LOG7[2364:2508]: waitforsocket: timeout 2005.06.27 21:54:51 LOG3[2364:2508]: Failed to initialize remote connection 2005.06.27 21:54:51 LOG7[2364:2508]: irc finished (0 left) 2005.06.27 21:54:55 LOG7[2364:3120]: irc accepted FD=164 from 12.216.55.121:1747 2005.06.27 21:54:55 LOG7[2364:3120]: FD 164 in non-blocking mode 2005.06.27 21:54:55 LOG7[2364:460]: irc started 2005.06.27 21:54:55 LOG5[2364:460]: irc connected from 12.216.55.121:1747 2005.06.27 21:54:55 LOG7[2364:460]: SSL state (accept): before/accept initialization 2005.06.27 21:54:55 LOG7[2364:460]: SSL state (accept): SSLv3 read client hello A 2005.06.27 21:54:55 LOG7[2364:460]: SSL state (accept): SSLv3 write server hello A 2005.06.27 21:54:55 LOG7[2364:460]: SSL state (accept): SSLv3 write certificate A 2005.06.27 21:54:55 LOG7[2364:460]: SSL state (accept): SSLv3 write server done A 2005.06.27 21:54:55 LOG7[2364:460]: SSL state (accept): SSLv3 flush data 2005.06.27 21:54:55 LOG7[2364:460]: waitforsocket: FD=164, DIR=read 2005.06.27 21:54:55 LOG7[2364:460]: waitforsocket: ok 2005.06.27 21:54:55 LOG7[2364:460]: SSL state (accept): SSLv3 read client key exchange A 2005.06.27 21:54:55 LOG7[2364:460]: SSL state (accept): SSLv3 read finished A 2005.06.27 21:54:55 LOG7[2364:460]: SSL state (accept): SSLv3 write change cipher spec A 2005.06.27 21:54:55 LOG7[2364:460]: SSL state (accept): SSLv3 write finished A 2005.06.27 21:54:55 LOG7[2364:460]: SSL state (accept): SSLv3 flush data 2005.06.27 21:54:55 LOG7[2364:460]: 4 items in the session cache 2005.06.27 21:54:55 LOG7[2364:460]: 0 client connects (SSL_connect()) 2005.06.27 21:54:55 LOG7[2364:460]: 0 client connects that finished 2005.06.27 21:54:55 LOG7[2364:460]: 0 client renegotiatations requested 2005.06.27 21:54:55 LOG7[2364:460]: 4 server connects (SSL_accept()) 2005.06.27 21:54:55 LOG7[2364:460]: 4 server connects that finished 2005.06.27 21:54:55 LOG7[2364:460]: 0 server renegotiatiations requested 2005.06.27 21:54:55 LOG7[2364:460]: 0 session cache hits 2005.06.27 21:54:55 LOG7[2364:460]: 0 session cache misses 2005.06.27 21:54:55 LOG7[2364:460]: 0 session cache timeouts 2005.06.27 21:54:55 LOG6[2364:460]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.06.27 21:54:55 LOG7[2364:460]: FD 144 in non-blocking mode 2005.06.27 21:54:55 LOG7[2364:460]: irc connecting 127.0.0.1:994 2005.06.27 21:54:55 LOG7[2364:460]: remote connect #1: EWOULDBLOCK: retrying 2005.06.27 21:54:55 LOG7[2364:460]: waitforsocket: FD=144, DIR=write 2005.06.27 21:59:55 LOG7[2364:460]: waitforsocket: timeout 2005.06.27 21:59:55 LOG3[2364:460]: Failed to initialize remote connection 2005.06.27 21:59:55 LOG7[2364:460]: irc finished (0 left) 2005.06.27 21:59:59 LOG7[2364:3120]: irc accepted FD=148 from 12.216.55.121:1813 2005.06.27 21:59:59 LOG7[2364:3120]: FD 148 in non-blocking mode 2005.06.27 21:59:59 LOG7[2364:2240]: irc started 2005.06.27 21:59:59 LOG5[2364:2240]: irc connected from 12.216.55.121:1813 2005.06.27 21:59:59 LOG7[2364:2240]: SSL state (accept): before/accept initialization 2005.06.27 21:59:59 LOG7[2364:2240]: waitforsocket: FD=148, DIR=read 2005.06.27 21:59:59 LOG7[2364:2240]: waitforsocket: ok 2005.06.27 21:59:59 LOG7[2364:2240]: SSL state (accept): SSLv3 read client hello A 2005.06.27 21:59:59 LOG7[2364:2240]: SSL state (accept): SSLv3 write server hello A 2005.06.27 21:59:59 LOG7[2364:2240]: SSL state (accept): SSLv3 write certificate A 2005.06.27 21:59:59 LOG7[2364:2240]: SSL state (accept): SSLv3 write server done A 2005.06.27 21:59:59 LOG7[2364:2240]: SSL state (accept): SSLv3 flush data 2005.06.27 21:59:59 LOG7[2364:2240]: waitforsocket: FD=148, DIR=read 2005.06.27 21:59:59 LOG7[2364:2240]: waitforsocket: ok 2005.06.27 21:59:59 LOG7[2364:2240]: SSL state (accept): SSLv3 read client key exchange A 2005.06.27 21:59:59 LOG7[2364:2240]: SSL state (accept): SSLv3 read finished A 2005.06.27 21:59:59 LOG7[2364:2240]: SSL state (accept): SSLv3 write change cipher spec A 2005.06.27 21:59:59 LOG7[2364:2240]: SSL state (accept): SSLv3 write finished A 2005.06.27 21:59:59 LOG7[2364:2240]: SSL state (accept): SSLv3 flush data 2005.06.27 21:59:59 LOG7[2364:2240]: 5 items in the session cache 2005.06.27 21:59:59 LOG7[2364:2240]: 0 client connects (SSL_connect()) 2005.06.27 21:59:59 LOG7[2364:2240]: 0 client connects that finished 2005.06.27 21:59:59 LOG7[2364:2240]: 0 client renegotiatations requested 2005.06.27 21:59:59 LOG7[2364:2240]: 5 server connects (SSL_accept()) 2005.06.27 21:59:59 LOG7[2364:2240]: 5 server connects that finished 2005.06.27 21:59:59 LOG7[2364:2240]: 0 server renegotiatiations requested 2005.06.27 21:59:59 LOG7[2364:2240]: 0 session cache hits 2005.06.27 21:59:59 LOG7[2364:2240]: 0 session cache misses 2005.06.27 21:59:59 LOG7[2364:2240]: 0 session cache timeouts 2005.06.27 21:59:59 LOG6[2364:2240]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.06.27 21:59:59 LOG7[2364:2240]: FD 180 in non-blocking mode 2005.06.27 21:59:59 LOG7[2364:2240]: irc connecting 127.0.0.1:994 2005.06.27 21:59:59 LOG7[2364:2240]: remote connect #1: EWOULDBLOCK: retrying 2005.06.27 21:59:59 LOG7[2364:2240]: waitforsocket: FD=180, DIR=write <--- end log -----> Any help that gets this working would be great. Thanks

2 1

Re: [stunnel-users] Transparent client IP on Windows
by Michal Trojnara 28 Jun '05

28 Jun '05

"Paul Jones" <jonesy_boy10(a)hotmail.com> wrote: > Apparently this can be enabled on Linux with the -T argument. Does anyone > know if (and how) this is somehow possible on Windows? Implementing a transparent proxy on Windows (Winsock) requires a process to globaly intercept Winsock API function. It's a lame, MSDOS-like solution that I'm not going to support. Best regards, Mike

1 0

Transparent client IP on Windows
by Paul Jones 28 Jun '05

28 Jun '05

Hi all, I've read (and tested for myself) on a few sites that Stunnel does not transparently pass the IP of the connecting client to the server app. My server app thinks all connecting clients are coming from IP 127.0.01. Apparently this can be enabled on Linux with the -T argument. Does anyone know if (and how) this is somehow possible on Windows? Cheers. Paul _________________________________________________________________ REALESTATE: biggest buy/rent/share listings http://ninemsn.realestate.com.au

1 0

Stunnel 4.09 exits unexpected on solaris 2.8
by edonald1＠rochester.rr.com 27 Jun '05

27 Jun '05

Hi, I am running the following version of Stunnel: ./stunnel -version stunnel 4.09 on sparc-sun-solaris2.8 PTHREAD+POLL+IPv4 with OpenSSL 0.9.6m 17 Mar 2004 Global options cert = /apps/stunnel/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:RC4+RSA:+SSLv2:@STRENGTH debug = 5 key = /apps/stunnel/etc/stunnel/stunnel.pem pid = /apps/stunnel/var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds It is compiled with pthreads and without TCPwrappers. I am using it to tunnel a mod_jk connection between apache and tomcat. It works perfectly in my Development and QA environment ( runs for weeks on end). When I moved it to production it started not to work so well. Stunnel would mysterious stop working on the server side (procesd disappears). There are no errors in the log whatsoever and the log level is set at 7. One difference in my production environment is that there are multiple clients (apache) and one server (tomcat). All Thoughts are welcome. Thank You

1 0

Errors sending email thru gmail's smtp server
by Melinda Chin 27 Jun '05

27 Jun '05

Hi, I have written an email client application to send/receive email. However, gmail accounts requires that email clients use SSL. In order to do this, I am running stunnel in the background. I am able to retrieve emails from gmail pop3 server, but I am not able To send email thru gmail smtp server. Gmail requires that email clients Support SMTP authentication, and also requires TLS. I am receiving the following errors in stunnel.log when trying to send email from gmail accounts. Attached is my stunnel.conf file. Is there something I am missing to cause these errors ? Does stunnel support SMTP authentication ? - Melinda 2005.06.27 11:26:17 LOG7[25398:81923]: <- 220 2.0.0 Ready to start TLS. 2005.06.27 11:26:17 LOG7[25398:81923]: SSL state (connect): before/connect initialization 2005.06.27 11:26:17 LOG7[25398:81923]: SSL state (connect): SSLv3 write client hello A 2005.06.27 11:26:17 LOG7[25398:81923]: waitforsocket: FD=13, DIR=read 2005.06.27 11:26:17 LOG7[25398:81923]: waitforsocket: ok 2005.06.27 11:26:17 LOG7[25398:81923]: SSL state (connect): SSLv3 read server hello A 2005.06.27 11:26:17 LOG7[25398:81923]: SSL state (connect): SSLv3 read server certificate A 2005.06.27 11:26:17 LOG7[25398:81923]: SSL state (connect): SSLv3 read server done A 2005.06.27 11:26:17 LOG7[25398:81923]: SSL state (connect): SSLv3 write client key exchange A 2005.06.27 11:26:17 LOG7[25398:81923]: SSL state (connect): SSLv3 write change cipher spec A 2005.06.27 11:26:17 LOG7[25398:81923]: SSL state (connect): SSLv3 write finished A 2005.06.27 11:26:17 LOG7[25398:81923]: SSL state (connect): SSLv3 flush data 2005.06.27 11:26:17 LOG7[25398:81923]: waitforsocket: FD=13, DIR=read 2005.06.27 11:26:17 LOG7[25398:81923]: waitforsocket: ok 2005.06.27 11:26:17 LOG7[25398:81923]: SSL state (connect): SSLv3 read finished A 2005.06.27 11:26:17 LOG7[25398:81923]: 5 items in the session cache 2005.06.27 11:26:17 LOG7[25398:81923]: 5 client connects (SSL_connect()) 2005.06.27 11:26:17 LOG7[25398:81923]: 5 client connects that finished 2005.06.27 11:26:17 LOG7[25398:81923]: 0 client renegotiatations requested 2005.06.27 11:26:17 LOG7[25398:81923]: 0 server connects (SSL_accept()) 2005.06.27 11:26:17 LOG7[25398:81923]: 0 server connects that finished 2005.06.27 11:26:17 LOG7[25398:81923]: 0 server renegotiatiations requested 2005.06.27 11:26:17 LOG7[25398:81923]: 0 session cache hits 2005.06.27 11:26:17 LOG7[25398:81923]: 0 session cache misses 2005.06.27 11:26:17 LOG7[25398:81923]: 0 session cache timeouts 2005.06.27 11:26:17 LOG6[25398:81923]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2005.06.27 11:26:18 LOG7[25398:81923]: Socket closed on read 2005.06.27 11:26:18 LOG7[25398:81923]: SSL alert (write): warning: close notify 2005.06.27 11:26:18 LOG7[25398:81923]: SSL write shutdown (output buffer empty) 2005.06.27 11:26:19 LOG7[25398:81923]: SSL socket closed on SSL_read 2005.06.27 11:26:19 LOG5[25398:81923]: Connection closed: 59 bytes sent to SSL, 165 bytes sent to socket 2005.06.27 11:26:19 LOG7[25398:81923]: ssmtp finished (1 left)

1 0

Passphrase validation
by Peter Pentes 27 Jun '05

27 Jun '05

Hi, As I understand it, Stunnel does not currently support the validation of certificate passphrases. For example, to make a connection from the client to the server, no passphrase is requested when a certificate is selected. Are there any plans for this feature to be added to Stunnel? Regards, PP __________________________________ Do you Yahoo!? Make Yahoo! your home page http://www.yahoo.com/r/hs

3 5