So I now need to sell stunnel to those that make decisions. It would be
helpful to get an understanding of how widely deployed it is. It also
would be useful to have a number of company names that I could drop,
especially if said companies were major corporations and especially if
they were players in the finance/banking industry.
thanks in advance,
-Charles
--
Using Opera's revolutionary e-mail client: http://www.opera.com/m2/
4
4
On Monday 30 of August 2004 20:38, markzero at logik.ath.cx wrote:
> To be honest, I'm just generally paranoid. I'd rather have a prospective
> attacker have to crack two passwords (the root and one wheel group) than
> one. I thought I'd write the above just so I didn't get a big lecture,
> hehe. :)
> You're not paranoid enough. You still use passwords! 8-)
I'm currently in the process of moving everything over to keypairs. I'm
not blessed with security conscious users, and it's hard to get them
to understand that a keypair is actually more convenient (especially if
you use an agent). :)
> > I recommend to use CAfile instead of CApath for simple configurations.
> > It doesn't need a hashed directory and is not relative to chroot jail.
>
> So something like:
>
> CApath = /var/stunnel/certs
> No!
> CAfile = /var/stunnel/certs/your_cert.pem
Oops, yeah I see what you mean.
> I'm paranoid that someone has been at my testing configs now. :) I
> previously had a working setup, which worries me even further as I *did*
> use a symlink.
Yes, you can use symlinks, but instead of:
ln -s /a/b/c/x /a/b/c/y
use:
cd /a/b/c
ln -s x y
Please notice (ls -l) the results are not the same!
That must have been it.
> Best regards,
> Mike
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.4 (GNU/Linux)
>
> iD8DBQFBM3dd/NU+nXTHMtERApCuAKDe+RWT1S0MQJ4Fr+FSyk8qyqwgpwCg4XED
> zBBeDZ6AU+LPU+iejancYGI=
> =8uvI
> -----END PGP SIGNATURE-----
1
0
Frustration doesn't begin to express it!
SEC Productions presents:
* THE CLIENT AND SERVER AUTH SAGA *
lets get on with it:
complete walkthrough of ssl cert creation
-----------------------------------------
By the way, please don't lecture me on ssh'ing into
machines as root, they are located on an isolated network
and of course, all logging in as root is disabled when
they are put into production. :)
There now follows a step by step account of everything so
far...
command prompt key:
ca# = certificate authority machine (or my isolated desktop,
whichever you prefer).
records# = log server
dns# = my dns server (the logging client)
(obvious output of scripts snipped)
-----------------------------------------
ca# cd /etc/ssl/misc
ca# ./CA.sh -newca
<snip>
ca# ./CA.sh -newreq
<snip>
Request (and private key) is in newreq.pem
ca# ./CA.sh -sign
Signed certificate is in newcert.pem
ca# cat newreq.pem newcert.pem > log_server.pem
Then I realised that I needed it to be passwordless.
ca# openssl rsa -in newreq.pem -out decryptedcert.pem
ca# cat decryptedcert.pem newcert.pem > log_server_np.pem
(log_server_np.pem is now passwordless)
ca# scp log_server_np.pem records:/etc/ssl/stunnel_cert/
ca# scp demoCA/cacert.pem dns:/var/stunnel/cert/cacert.pem
we'll just try with server side auth at the moment, on the
loghost:
records# cat /etc/stunnel/stunnel.conf
cert = /etc/ssl/stunnel_cert/log_server_np.pem
chroot = /var/stunnel
pid = /var/run/stunnel.pid
CApath = /certs
CRLpath = /crls
#verify = 2
debug = 7
output = stunnel.log
setuid = _stunnel
setgid = _stunnel
[syslogngs]
accept = 192.168.1.9:5514
connect = 127.0.0.1:5515
on the client:
dns# cat /etc/stunnel/stunnel.conf
#cert = /etc/stunnel/cert/clientkeycert.pem
chroot = /var/stunnel
pid = /var/run/stunnel.pid
CAfile = /certs/cacert.pem
CRLpath = /crls
debug = 7
output = stunnel.log
client = yes
setuid = _stunnel
setgid = _stunnel
[syslogngs]
accept = 127.0.0.1:5515
connect = 192.168.1.9:5514
looks good...
dns# telnet localhost 5515
(in the interests of patience and readability, the output
of stunnel.log isn't posted here, suffice to say the connection
is successful and works)
now to step up to client and server authentication.
ca# openssl req -x509 -newkey rsa:2048 -keyout clientkey.pem -out \
clientcert -days 365
(forgot to use -nodes)
ca# openssl rsa -in clientkey.pem -out client_decrypted_key.pem
ca# cat clientkey.pem clientcert.pem > clientkeycert.pem
ca# ./c_hash clientkeycert.pem
4410a4d9.0 => clientkeycert.pem
ca# scp clientkeycert.pem dns:/etc/stunnel/cert
ca# scp clientcert.pem records:/var/stunnel/certs
on the server:
records# ln -s /var/stunnel/certs/clientcert.pem \
/var/stunnel/certs/4410a4d9.0
adjust the stunnel.conf on both hosts accordingly:
records# cat /etc/stunnel/stunnel.conf
cert = /etc/ssl/stunnel_cert/log_server_np.pem
chroot = /var/stunnel
pid = /var/run/stunnel.pid
CApath = /certs
CRLpath = /crls
verify = 3
debug = 7
output = stunnel.log
setuid = _stunnel
setgid = _stunnel
[syslogngs]
accept = 192.168.1.9:5514
connect = 127.0.0.1:5515
dns# cat /etc/stunnel/stunnel.conf
cert = /etc/stunnel/cert/clientkeycert.pem
chroot = /var/stunnel
pid = /var/run/stunnel.pid
CAfile = /certs/cacert.pem
CRLpath = /crls
debug = 7
output = stunnel.log
client = yes
setuid = _stunnel
setgid = _stunnel
[syslogngs]
accept = 127.0.0.1:5515
connect = 192.168.1.9:5514
and just to show the permissions:
records# ls -al /etc/ssl/
drwx------ 2 _stunnel _stunnel 512 Aug 30 12:19 stunnel_cert
records# ls -al /etc/ssl/stunnel_cert
-rw------- 1 _stunnel _stunnel 4320 Aug 30 12:19 log_server_np.pem
records# ls -al /var/stunnel/certs/
lrwxr-xr-x 1 root _stunnel 33 Aug 30 14:33 4410a4d9.0 ->
/var/stunnel/certs/clientcert.pem
-rw------- 1 _stunnel _stunnel 1489 Aug 30 14:32 clientcert.pem
dns# ls -al /etc/stunnel/dns# ls -al /etc/stunnel/
drwx------ 3 _stunnel _stunnel 512 Aug 29 21:50 .
drwx------ 2 _stunnel _stunnel 512 Aug 30 14:18 cert
-rw------- 1 _stunnel _stunnel 301 Aug 30 14:22 stunnel.conf
-rw------- 1 _stunnel _stunnel 13401 Aug 29 22:21 stunnel.log
dns# ls -al /etc/stunnel/cert/
-rw------- 1 _stunnel _stunnel 3168 Aug 30 14:18 clientkeycert.pem
dns# ls -al /var/stunnel/
drwx------ 5 _stunnel _stunnel 512 Aug 29 21:28 .
drwx------ 2 _stunnel _stunnel 512 Aug 30 13:59 cert
drwx------ 2 _stunnel _stunnel 512 Aug 29 21:16 crl
drwx------ 3 _stunnel _stunnel 512 Aug 29 21:28 var
dns# ls -al /var/stunnel/cert/
drwx------ 2 _stunnel _stunnel 512 Aug 30 13:59 .
-rw------- 1 _stunnel _stunnel 1115 Aug 30 13:59 cacert.pem
now, to test.
records# /usr/local/sbin/stunnel /etc/stunnel/stunnel.conf
dns# /usr/local/sbin/stunnel /etc/stunnel/stunnel.conf
the log files on both show no errors, lets try a connection from
dns to records...
dns# telnet localhost 5515
Trying ::1...
telnet: connect to address ::1: Connection refused
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Connection closed by foreign host.
urgh! what went wrong?
records# cat stunnel.log
2004.08.30 14:46:43 LOG5[27205:1006690304]: stunnel 4.05 on i386-unknown-openbsd3.5 PTHREAD with OpenSSL 0.9.7c 30 Sep 2003
2004.08.30 14:46:43 LOG7[27205:1006690304]: Snagged 64 random bytes from /dev/arandom
2004.08.30 14:46:43 LOG7[27205:1006690304]: RAND_status claims sufficient entropy for the PRNG
2004.08.30 14:46:43 LOG6[27205:1006690304]: PRNG seeded successfully
2004.08.30 14:46:43 LOG7[27205:1006690304]: Certificate: /etc/ssl/stunnel_cert/log_server_np.pem
2004.08.30 14:46:43 LOG7[27205:1006690304]: Key file: /etc/ssl/stunnel_cert/log_server_np.pem
2004.08.30 14:46:43 LOG7[27205:1006690304]: Verify directory set to /certs
2004.08.30 14:46:43 LOG7[27205:1006690304]: CRL directory set to /crls
2004.08.30 14:46:43 LOG5[27205:1006690304]: Peer certificate location /certs
2004.08.30 14:46:43 LOG5[27205:1006690304]: FD_SETSIZE=1024, file ulimit=128 -> 61 clients allowed
2004.08.30 14:46:43 LOG7[27205:1006690304]: FD 10 in non-blocking mode
2004.08.30 14:46:43 LOG7[27205:1006690304]: SO_REUSEADDR option set on accept socket
2004.08.30 14:46:43 LOG7[27205:1006690304]: syslogngs bound to 192.168.1.9:5514
2004.08.30 14:46:43 LOG7[27205:1006690304]: FD 11 in non-blocking mode
2004.08.30 14:46:43 LOG7[27205:1006690304]: FD 12 in non-blocking mode
2004.08.30 14:46:43 LOG7[20297:1006690304]: Created pid file /var/run/stunnel.pid
2004.08.30 14:46:51 LOG7[20297:1006690304]: syslogngs accepted FD=13 from 192.168.1.6:7109
2004.08.30 14:46:51 LOG7[20297:1006690304]: FD 13 in non-blocking mode
2004.08.30 14:46:51 LOG7[20297:1006693376]: syslogngs started
2004.08.30 14:46:51 LOG5[20297:1006693376]: syslogngs connected from 192.168.1.6:7109
2004.08.30 14:46:51 LOG7[20297:1006693376]: SSL state (accept): before/accept initialization
2004.08.30 14:46:51 LOG7[20297:1006693376]: SSL state (accept): SSLv3 read client hello A
2004.08.30 14:46:51 LOG7[20297:1006693376]: SSL state (accept): SSLv3 write server hello A
2004.08.30 14:46:51 LOG7[20297:1006693376]: SSL state (accept): SSLv3 write certificate A
2004.08.30 14:46:51 LOG7[20297:1006693376]: SSL state (accept): SSLv3 write certificate request A
2004.08.30 14:46:51 LOG7[20297:1006693376]: SSL state (accept): SSLv3 flush data
2004.08.30 14:46:51 LOG7[20297:1006693376]: waitforsocket: FD=13, DIR=read
2004.08.30 14:46:52 LOG7[20297:1006693376]: waitforsocket: ok
2004.08.30 14:46:52 LOG4[20297:1006693376]: VERIFY ERROR: depth=0, error=self signed certificate: /C=UK/L=London/O=SI/OU=SEC/CN=LogClient/emailAddress=root@localhost
2004.08.30 14:46:52 LOG7[20297:1006693376]: SSL alert (write): fatal: bad certificate
2004.08.30 14:46:52 LOG3[20297:1006693376]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
2004.08.30 14:46:52 LOG7[20297:1006693376]: syslogngs finished (0 left)
---
dns# cat stunnel.log
2004.08.30 14:33:24 LOG5[10920:1006690304]: stunnel 4.05 on i386-unknown-openbsd3.5 PTHREAD with OpenSSL 0.9.7c 30 Sep 2003
2004.08.30 14:33:24 LOG7[10920:1006690304]: Snagged 64 random bytes from /dev/arandom
2004.08.30 14:33:24 LOG7[10920:1006690304]: RAND_status claims sufficient entropy for the PRNG
2004.08.30 14:33:24 LOG6[10920:1006690304]: PRNG seeded successfully
2004.08.30 14:33:24 LOG7[10920:1006690304]: Certificate: /etc/stunnel/cert/clientkeycert.pem
2004.08.30 14:33:24 LOG7[10920:1006690304]: Key file: /etc/stunnel/cert/clientkeycert.pem
2004.08.30 14:33:24 LOG5[10920:1006690304]: FD_SETSIZE=1024, file ulimit=128 -> 61 clients allowed
2004.08.30 14:33:24 LOG7[10920:1006690304]: FD 10 in non-blocking mode
2004.08.30 14:33:24 LOG7[10920:1006690304]: SO_REUSEADDR option set on accept socket
2004.08.30 14:33:24 LOG7[10920:1006690304]: syslogngs bound to 127.0.0.1:5515
2004.08.30 14:33:24 LOG7[10920:1006690304]: FD 11 in non-blocking mode
2004.08.30 14:33:24 LOG7[10920:1006690304]: FD 12 in non-blocking mode
2004.08.30 14:33:24 LOG7[11717:1006690304]: Created pid file /var/run/stunnel.pid
2004.08.30 14:33:30 LOG7[11717:1006690304]: syslogngs accepted FD=13 from 127.0.0.1:20109
2004.08.30 14:33:30 LOG7[11717:1006690304]: FD 13 in non-blocking mode
2004.08.30 14:33:30 LOG7[11717:1006693376]: syslogngs started
2004.08.30 14:33:30 LOG5[11717:1006693376]: syslogngs connected from 127.0.0.1:20109
2004.08.30 14:33:30 LOG7[11717:1006693376]: FD 14 in non-blocking mode
2004.08.30 14:33:30 LOG7[11717:1006693376]: syslogngs connecting 192.168.1.9:5514
2004.08.30 14:33:30 LOG7[11717:1006693376]: remote connect #1: EINPROGRESS: retrying
2004.08.30 14:33:30 LOG7[11717:1006693376]: waitforsocket: FD=14, DIR=write
2004.08.30 14:33:30 LOG7[11717:1006693376]: waitforsocket: ok
2004.08.30 14:33:30 LOG7[11717:1006693376]: Remote FD=14 initialized
2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): before/connect initialization
2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): SSLv3 write client hello A
2004.08.30 14:33:30 LOG7[11717:1006693376]: waitforsocket: FD=14, DIR=read
2004.08.30 14:33:30 LOG7[11717:1006693376]: waitforsocket: ok
2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): SSLv3 read server hello A
2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): SSLv3 read server certificate A
2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): SSLv3 read server certificate request A
2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): SSLv3 read server done A
2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): SSLv3 write client certificate A
2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): SSLv3 write client key exchange A
2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): SSLv3 write certificate verify A
2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): SSLv3 write change cipher spec A
2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): SSLv3 write finished A
2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): SSLv3 flush data
2004.08.30 14:33:30 LOG7[11717:1006693376]: waitforsocket: FD=14, DIR=read
2004.08.30 14:33:30 LOG7[11717:1006693376]: waitforsocket: ok
2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL alert (read): fatal: bad certificate
2004.08.30 14:33:30 LOG3[11717:1006693376]: SSL_connect: 14094412: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate
2004.08.30 14:33:30 LOG7[11717:1006693376]: syslogngs finished (0 left)
(sorry about the unwrapped lines)
I've also tried using ktrace, but the ktrace.out drops off before the
connection (making it useless). I don't understand what can be wrong, I've
retraced my steps over and over. I did actually have it working before, but
due to testing, reinstalled the OS and now it doesn't work. I'm loathe
to install the developement tools, as there are so many it would be a
nightmare to remove them after (prompting a reinstall, and look what
happened last time).
Any ideas? Anything I've done blindingly obviously wrong?
Why did it work before and not now?
ARGH!
cheers
mark
2
3
Hello all,
Still having trouble getting stunnel 4.05 to run on my AIX 5.2 box. Wanted
to pass along the following warning that showed up running the configure
script. Could a problem with PTHEADS be causing the failure?
Thanks
baker
checking for sys/select.h... yes
checking tcpd.h usability... no
checking tcpd.h presence... no
checking for tcpd.h... no
checking pthread.h usability... no
checking pthread.h presence... yes
configure: WARNING: pthread.h: present but cannot be compiled
configure: WARNING: pthread.h: check for missing prerequisite headers?
configure: WARNING: pthread.h: proceeding with the preprocessor's result
configure: WARNING: ## ------------------------------------ ##
configure: WARNING: ## Report this to bug-autoconf(a)gnu.org. ##
configure: WARNING: ## ------------------------------------ ##
checking for pthread.h... yes
1
0
hi ,
I get this error when i try to do ./configure on stunnel-4.05 on solaris9
config.log in attachement.
Some people could help me???
./configure
checking for a BSD-compatible install... auto/install-sh -c
checking whether build environment is sane... yes
checking whether make sets $(MAKE)... no
checking for working aclocal... missing
checking for working autoconf... missing
checking for working automake... missing
checking for working autoheader... missing
checking for working makeinfo... missing
checking build system type... sparc-sun-solaris2.9
checking host system type... sparc-sun-solaris2.9
checking for gcc... gcc
checking for C compiler default output... a.out
checking whether the C compiler works... yes
checking whether we are cross compiling... no
checking for suffix of executables...
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether gcc accepts -g... yes
checking for gcc option to accept ANSI C... none needed
checking for a BSD-compatible install... auto/install-sh -c
checking whether make sets $(MAKE)... (cached) no
checking for ld used by GCC... /usr/ccs/bin/ld
checking if the linker (/usr/ccs/bin/ld) is GNU ld... no
checking for /usr/ccs/bin/ld option to reload object files... -r
checking for BSD-compatible nm... /usr/ccs/bin/nm -p
checking for a sed that does not truncate output... /usr/bin/sed
checking whether ln -s works... yes
checking how to recognise dependent libraries... pass_all
checking command to parse /usr/ccs/bin/nm -p output... ok
checking how to run the C preprocessor... gcc -E
checking for egrep... egrep
checking for ANSI C header files... yes
checking for sys/types.h... yes
checking for sys/stat.h... yes
checking for stdlib.h... yes
checking for string.h... yes
checking for memory.h... yes
checking for strings.h... yes
checking for inttypes.h... yes
checking for stdint.h... no
checking for unistd.h... yes
checking dlfcn.h usability... yes
checking dlfcn.h presence... yes
checking for dlfcn.h... yes
checking for ranlib... :
checking for strip... :
checking for objdir... .libs
checking for gcc option to produce PIC... -fPIC
checking if gcc PIC flag -fPIC works... yes
checking if gcc static flag -static works... yes
checking if gcc supports -c -o file.o... yes
checking if gcc supports -c -o file.lo... yes
checking if gcc supports -fno-rtti -fno-exceptions... yes
checking whether the linker (/usr/ccs/bin/ld) supports shared libraries... yes
checking how to hardcode library paths into programs... immediate
checking whether stripping libraries is possible... no
checking dynamic linker characteristics... solaris2.9 ld.so
checking if libtool supports shared libraries... yes
checking whether to build shared libraries... yes
checking whether to build static libraries... no
creating libtool
checking for SSL directory... /usr/local/ssl
checking for "/dev/urandom"... yes
checking whether to disable RSA support... no
checking whether to enable DH support... no
checking for dlopen in -ldl... yes
checking for shl_load in -ldld... no
checking for gethostbyname in -lnsl... yes
checking for socket in -lsocket... yes
checking for pthread_create in -lpthread... yes
checking for pthread_create in -lc_r... no
checking for openpty in -lutil... no
checking whether to use the libwrap (TCP wrappers) library... (default)
checking for hosts_access in -lwrap... no
checking for RSAref library... no
checking for "/dev/ptmx"... yes
checking for "/dev/ptc"... no
checking grp.h usability... yes
checking grp.h presence... yes
checking for grp.h... yes
checking for unistd.h... (cached) yes
checking sys/select.h usability... yes
checking sys/select.h presence... yes
checking for sys/select.h... yes
checking tcpd.h usability... no
checking tcpd.h presence... no
checking for tcpd.h... no
checking pthread.h usability... yes
checking pthread.h presence... yes
checking for pthread.h... yes
checking sys/ioctl.h usability... yes
checking sys/ioctl.h presence... yes
checking for sys/ioctl.h... yes
checking util.h usability... no
checking util.h presence... no
checking for util.h... no
checking pty.h usability... no
checking pty.h presence... no
checking for pty.h... no
checking stropts.h usability... yes
checking stropts.h presence... yes
checking for stropts.h... yes
checking sys/filio.h usability... yes
checking sys/filio.h presence... yes
checking for sys/filio.h... yes
checking sys/resource.h usability... yes
checking sys/resource.h presence... yes
checking for sys/resource.h... yes
checking for snprintf... yes
checking for vsnprintf... yes
checking for openpty... no
checking for _getpty... no
checking for daemon... no
checking for waitpid... yes
checking for wait4... yes
checking for sysconf... yes
checking for getrlimit... yes
checking for pthread_sigmask... yes
checking for setgroups... yes
checking for localtime_r... yes
checking for chroot... yes
checking for endhostent... yes
checking for setsid... yes
checking for unsigned char... yes
checking size of unsigned char... configure: error: cannot compute sizeof (unsigned char), 77
See `config.log' for more details.
BR
Didier
1
0
Hello!
I have tried the following setup:
server: MySQL 4.0.20 with native OpenSSL 0.9.7d support on Linux
client: MySQL 4.0.20 without SSL support, through stunnel 4.0.5 on WinXP
As it can be suspected from the above, I was trying to use the
mysqld with ssl support directly as the server side of the
connection, without stunnel. I saw a pseudo-https client solution
in the stunnel docs where this approach seemed to work.
The client stunnel.conf:
cert = client-test.crt
key = client-test.key
client = yes
debug = debug
[mysqlclient]
accept = 3306
connect = server.host.fqdn:3306
The mysql client reported the following error, right after asking
for the password:
ERROR 2013: Lost connection to MySQL server during query
Here is the log from the client stunnel:
2004.08.26 17:19:43 LOG5[2396:1256]: stunnel 4.05 on x86-pc-mingw32-gnu WIN32 with OpenSSL 0.9.7d 17 Mar 2004
2004.08.26 17:19:43 LOG7[2396:1908]: RAND_status claims sufficient entropy for the PRNG
2004.08.26 17:19:43 LOG6[2396:1908]: PRNG seeded successfully
2004.08.26 17:19:43 LOG7[2396:1908]: Certificate: client-test.crt
2004.08.26 17:19:43 LOG7[2396:1908]: Key file: client-test.key
2004.08.26 17:19:43 LOG5[2396:1908]: WIN32 platform: 30000 clients allowed
2004.08.26 17:19:43 LOG7[2396:1908]: FD 1828 in non-blocking mode
2004.08.26 17:19:43 LOG7[2396:1908]: SO_REUSEADDR option set on accept socket
2004.08.26 17:19:43 LOG7[2396:1908]: mysqlclient bound to 0.0.0.0:3306
2004.08.26 17:19:52 LOG7[2396:1908]: mysqlclient accepted FD=1836 from 127.0.0.1:3269
2004.08.26 17:19:52 LOG7[2396:1908]: FD 1836 in non-blocking mode
2004.08.26 17:19:52 LOG7[2396:1908]: Creating a new thread
2004.08.26 17:19:52 LOG7[2396:1908]: New thread created
2004.08.26 17:19:52 LOG7[2396:1816]: mysqlclient started
2004.08.26 17:19:52 LOG5[2396:1816]: mysqlclient connected from 127.0.0.1:3269
2004.08.26 17:19:52 LOG7[2396:1816]: FD 1816 in non-blocking mode
2004.08.26 17:19:52 LOG7[2396:1816]: mysqlclient connecting xx.xx.xx.xx:3306
2004.08.26 17:19:52 LOG7[2396:1816]: remote connect #1: EWOULDBLOCK: retrying
2004.08.26 17:19:52 LOG7[2396:1816]: waitforsocket: FD=1816, DIR=write
2004.08.26 17:19:52 LOG7[2396:1816]: waitforsocket: ok
2004.08.26 17:19:52 LOG7[2396:1816]: remote connect #2: EINVAL: ok
2004.08.26 17:19:52 LOG7[2396:1816]: Remote FD=1816 initialized
2004.08.26 17:19:52 LOG7[2396:1816]: SSL state (connect): before/connect initialization
2004.08.26 17:19:52 LOG7[2396:1816]: SSL state (connect): SSLv3 write client hello A
2004.08.26 17:19:52 LOG7[2396:1816]: SSL alert (write): fatal: handshake failure
2004.08.26 17:19:52 LOG3[2396:1816]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
2004.08.26 17:19:52 LOG7[2396:1816]: mysqlclient finished (0 left)
What is wrong here?
Thank you!
Regards,
Szabolcs Rumi
1
0
HAH! Got it. Thanks for the help getting my debug info set up. Here is the
backtrace from gdb:
adev>#gdb /usr/local/sbin/stunnel /usr/local/ssl/core
GNU gdb 5.0-aix51-020209
Copyright 2000 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "powerpc-ibm-aix5.2.0.0"...
Core was generated by `stunnel'.
Program terminated with signal 11, Segmentation fault.
#0 0xd01199e8 in _sigsetmask ()
(gdb) backtrace
#0 0xd01199e8 in _sigsetmask ()
#1 0xffffffff in ?? () from (unknown load module)
(some reminders: I was trying to run stunnel 4.05 on AIX 5.2 with Openssl
and keep get segmentation fault. Config sent previously)
Thanks.
Baker
-----Original Message-----
From: Michal Trojnara [mailto:[email protected]]
Sent: Monday, August 23, 2004 5:05 PM
To: Baker Nelson
Subject: Re: [stunnel-users] Problem running Stunnel 4.05 on AIX 5.2
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On Monday 23 of August 2004 17:57, Baker Nelson wrote:
> Finally got a new core dump to come out, was fooling with the client.c
code
> last week and wanted to start all from scratch. But, I can not get gdb to
> work, does not find it. Is it an optional install for the gcc compiler?
Just another useful GNU programming tool. Just like binutils, make or gcc.
What about:
http://www-1.ibm.com/servers/aix/products/aixos/linux/download.html
?
Mike
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFBKlwX/NU+nXTHMtERAveDAJ0XYkD35Iq7n9rjBzp+1IDu9nFQRwCgjjpG
CmXLUwMJT9aygtsuQPWl5aY=
=4qkl
-----END PGP SIGNATURE-----
2
1
hi,
I run stunnel 4.04 on i586-suse-linux-gnu PTHREAD with OpenSSL
0.9.6i [engine].
When I open up connection to my Mailserver for fetchmail to get
mails I regularily have to wait for 1 1/2 minutes before it starts
fetching
here is part of stunnel.log (mark: 11:27:22 and 11:28:43)
2004.08.25 11:27:22 LOG7[16627:49154]: SSL state (connect):
before/connect initialization
2004.08.25 11:27:22 LOG7[16627:49154]: SSL state (connect): SSLv3
write client hello A
2004.08.25 11:27:22 LOG7[16627:49154]: waitforsocket: FD=11,
DIR=read
2004.08.25 11:28:43 LOG7[16627:49154]: waitforsocket: ok
2004.08.25 11:28:43 LOG7[16627:49154]: SSL state (connect): SSLv3
read server hello A
2004.08.25 11:28:43 LOG7[16627:49154]: waitforsocket: FD=11,
DIR=read
2004.08.25 11:28:44 LOG7[16627:49154]: waitforsocket: ok
What is the reason and can I change that.
Thanks for any advice
Hartmut
--
Hartmut Gehrke-Tschudi * +++++++++++++++++++++++++++++++++++++++++
hgtschudi(a)free.de > * ++++ on croit mourir pour la patrie++++++
Bochum * ++++ on meurt pour des industriels ++++++
BRD * +++++++ Anatol France +++++++++
* +++++++++++++++++++++++++++++++++++++++++
1
0
I'm having a problem connecting with sourcehost using stunnel w/
configuration files. The command line version from 3.x works.
Here's the command line for 3.x
./stunnel -c -p client.pem -d localhost:2401 -r
repository.sourcehosting.net:2402 -P none -f -v 3 -A cacert.pem
and the conf file from 4.x
# Some debugging stuff
debug = 7
output = stunnel.log
# Use it for client mode
client = yes
foreground = yes
verify = 3
key = client.pem
cert = cacert.pem
# Service-level configuration
[cvs]
accept = 2401
connect = repository.sourcehosting.net:2402
When I run the older version it starts:
./stunnel -c -p client.pem -d localhost:2401 -r
repository.sourcehosting.net:2402 -P none -f -v 3 -A cacert.pem
2004.08.24 21:30:18 LOG5[2221:16384]: Using
'repository.sourcehosting.net.2402' as tcpwrapper service name
Enter PEM pass phrase:
2004.08.24 21:30:24 LOG5[2221:16384]: Peer certificate location
2004.08.24 21:30:24 LOG5[2221:16384]: stunnel 3.26 on
i686-pc-linux-gnu PTHREAD with OpenSSL 0.9.7d 17 Mar 20042004.08.24
21:30:24 LOG5[2221:16384]: FD_SETSIZE=1024, file ulimit=1024 -> 500
clients allowed
But when I run the newer version (with .conf) I get:
2004.08.24 21:31:43 LOG5[2236:4144017536]: stunnel 4.05 on
i386-redhat-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003
2004.08.24 21:31:43 LOG7[2236:4144017536]: Snagged 64 random bytes
from /home/tgagne/.rnd
2004.08.24 21:31:43 LOG7[2236:4144017536]: Wrote 1024 new random
bytes to /home/tgagne/.rnd
2004.08.24 21:31:43 LOG7[2236:4144017536]: RAND_status claims
sufficient entropy for the PRNG
2004.08.24 21:31:43 LOG6[2236:4144017536]: PRNG seeded successfully
2004.08.24 21:31:43 LOG7[2236:4144017536]: Certificate: cacert.pem
2004.08.24 21:31:43 LOG7[2236:4144017536]: Key file: client.pem
2004.08.24 21:31:47 LOG3[2236:4144017536]:
SSL_CTX_use_RSAPrivateKey_file: B080074: error:0B080074:x509
certificate routines:X509_check_private_key:key values mismatch
I'm using the same cacert.pem and client.pem for both, as well as the
same passphrase.
2
1
Hi all,
I am trying to run Stunnel 4.05 on AIX 5.2 to secure our homegrown
webserver. I have been searching archives all over the place, and have yet
to find the answer, but have found many comments here and there that seem to
indicate a problem with Stunnel on AIX. The problem, in a nutshell, is that
I get an error on SSL_read in the stunnel log and it shuts down with a
segmentation fault after the first connection, no matter what I do.
Configuration info attached below. Any help anyone can give would be greatly
appreciatted.
Thanks
Baker
stunnel 4.05 on powerpc-ibm-aix5.2.0.0 FORK with OpenSSL 0.9.7d 17 Mar 2004
Global options
cert = /usr/local/etc/stunnel/stunnel.pem
ciphers = ALL:!ADH:+RC4:@STRENGTH
debug = 5
key = /usr/local/etc/stunnel/stunnel.pem
pid = /usr/local/var/run/stunnel.pid
RNDbytes = 64
RNDfile = /dev/urandom
RNDoverwrite = yes
session = 300 seconds
verify = none
Service-level options
TIMEOUTbusy = 300 seconds
TIMEOUTclose = 60 seconds
TIMEOUTidle = 43200 seconds
OpenSSL 0.9.7d 17 Mar 2004
conf-file:
cert = /usr/local/ssl/stunnel.pem
#chroot = /usr/local/var/run/stunnel/
pid = /usr/local/etc/stunnel/stunnel.pid
setuid = HTTPD
setgid = rrms
#options = DONT_INSERT_EMPTY_FRAGMENTS
# Some debugging stuff
debug = 7
output = stunnel.log
# Use it for client mode
#client = yes
foreground = yes
# Service-level configuration
[https]
accept = 443
connect = 80
TIMEOUTclose = 0
stunnel - log (from running openssl s_client command to test setup):
2004.08.19 15:22:29 LOG5[16718:0]: stunnel 4.05 on powerpc-ibm-aix5.2.0.0
FORK w
ith OpenSSL 0.9.7d 17 Mar 2004
2004.08.19 15:22:29 LOG4[16718:0]: Wrong permissions on
/usr/local/ssl/stunnel.p
em
2004.08.19 15:22:29 LOG7[16718:0]: Snagged 64 random bytes from //.rnd
2004.08.19 15:22:29 LOG7[16718:0]: Wrote 1024 new random bytes to //.rnd
2004.08.19 15:22:29 LOG7[16718:0]: RAND_status claims sufficient entropy for
the
PRNG
2004.08.19 15:22:29 LOG6[16718:0]: PRNG seeded successfully
2004.08.19 15:22:29 LOG7[16718:0]: Certificate: /usr/local/ssl/stunnel.pem
2004.08.19 15:22:29 LOG7[16718:0]: Key file: /usr/local/ssl/stunnel.pem
2004.08.19 15:22:29 LOG5[16718:0]: FD_SETSIZE=65534, file ulimit=65534 ->
31999
clients allowed
2004.08.19 15:22:29 LOG7[16718:0]: FD 4 in non-blocking mode
2004.08.19 15:22:29 LOG7[16718:0]: SO_REUSEADDR option set on accept socket
2004.08.19 15:22:29 LOG7[16718:0]: https bound to 0.0.0.0:443
2004.08.19 15:22:29 LOG7[16718:0]: FD 5 in non-blocking mode
2004.08.19 15:22:29 LOG7[16718:0]: FD 6 in non-blocking mode
2004.08.19 15:22:29 LOG7[16718:0]: Created pid file
/usr/local/etc/stunnel/stunn
el.pid
2004.08.19 15:22:30 LOG7[16718:0]: https accepted FD=7 from **ip**:33519
2004.08.19 15:22:30 LOG7[16718:0]: FD 7 in non-blocking mode
2004.08.19 15:22:30 LOG7[21344:0]: https started
2004.08.19 15:22:30 LOG5[21344:0]: https connected from **ip**:33519
2004.08.19 15:22:30 LOG7[21344:0]: SSL state (accept): before/accept
initializat
ion
2004.08.19 15:22:30 LOG7[21344:0]: SSL state (accept): SSLv3 read client
hello A
2004.08.19 15:22:30 LOG7[21344:0]: SSL state (accept): SSLv3 write server
hello
A
2004.08.19 15:22:30 LOG7[21344:0]: SSL state (accept): SSLv3 write
certificate A
2004.08.19 15:22:30 LOG7[21344:0]: SSL state (accept): SSLv3 write server
done A
2004.08.19 15:22:30 LOG7[21344:0]: SSL state (accept): SSLv3 flush data
2004.08.19 15:22:30 LOG7[21344:0]: waitforsocket: FD=7, DIR=read
2004.08.19 15:22:30 LOG7[21344:0]: waitforsocket: ok
2004.08.19 15:22:30 LOG7[21344:0]: SSL state (accept): SSLv3 read client key
exc
hange A
2004.08.19 15:22:30 LOG7[21344:0]: SSL state (accept): SSLv3 read finished A
2004.08.19 15:22:30 LOG7[21344:0]: SSL state (accept): SSLv3 write change
cipher
spec A
2004.08.19 15:22:30 LOG7[21344:0]: SSL state (accept): SSLv3 write finished
A
2004.08.19 15:22:30 LOG7[21344:0]: SSL state (accept): SSLv3 flush data
2004.08.19 15:22:30 LOG7[21344:0]: 1 items in the session cache
2004.08.19 15:22:30 LOG7[21344:0]: 0 client connects (SSL_connect())
2004.08.19 15:22:30 LOG7[21344:0]: 0 client connects that finished
2004.08.19 15:22:30 LOG7[21344:0]: 0 client renegotiatations requested
2004.08.19 15:22:30 LOG7[21344:0]: 1 server connects (SSL_accept())
2004.08.19 15:22:30 LOG7[21344:0]: 1 server connects that finished
2004.08.19 15:22:30 LOG7[21344:0]: 0 server renegotiatiations requested
2004.08.19 15:22:30 LOG7[21344:0]: 0 session cache hits
2004.08.19 15:22:30 LOG7[21344:0]: 0 session cache misses
2004.08.19 15:22:30 LOG7[21344:0]: 0 session cache timeouts
2004.08.19 15:22:30 LOG6[21344:0]: Negotiated ciphers: AES256-SHA
S
SLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1
2004.08.19 15:22:30 LOG7[21344:0]: FD 4 in non-blocking mode
2004.08.19 15:22:30 LOG7[21344:0]: https connecting 127.0.0.1:80
2004.08.19 15:22:30 LOG7[21344:0]: Remote FD=4 initialized
2004.08.19 15:22:32 LOG7[21344:0]: Socket closed on read
2004.08.19 15:22:32 LOG7[21344:0]: SSL write shutdown (output buffer empty)
2004.08.19 15:22:32 LOG7[21344:0]: SSL alert (write): warning: close notify
2004.08.19 15:22:32 LOG7[21344:0]: SSL_shutdown retrying
2004.08.19 15:22:32 LOG7[21344:0]: select timeout waiting for SSL
close_notify
2004.08.19 15:22:32 LOG5[21344:0]: Connection closed: 311 bytes sent to SSL,
9 b
ytes sent to socket
2004.08.19 15:22:32 LOG7[21344:0]: removing pid file
/usr/local/etc/stunnel/stun
nel.pid
2
3