Hi,
I have difficulties setting up a tunnel between two linux box I
administrate. Right now its only in test phase, i would like to make an
stunnel connection to the smpt server at 195.56.52.140. My final goal is
to set up syslog through stunnel, thats why the port name/numbers.
Config file for the server:
cert = /usr/local/etc/stunnel/stunnel.pem
pid = /usr/local/etc/stunnel/stunnel.pid
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
debug = 7
output = /usr/local/etc/stunnel/stunnel.log
[ssyslog]
accept = 195.56.52.140:2514
connect = 10.10.2.1:25
Config file for the client:
cert = /usr/local/etc/stunnel/stunnel.pem
pid = /usr/local/etc/stunnel/stunnel.pid
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
debug = 7
output = /usr/local/etc/stunnel/stunnel.log
client = yes
[ssyslog]
accept = 2514
connect = 195.56.52.140:2514
I get the following messages in the logs after, executing a "telnet
127.0.0.1 2514" command at the client machine (of course, smtp works on
the other side, and i set iptables to allow incomming connections on
2514 dport)
Server:
2005.12.13 09:09:22 LOG5[11505:1]: stunnel 4.14 on i686-pc-linux-gnu
UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7e 25 Oct 2004
2005.12.13 09:09:22 LOG7[11505:1]: Snagged 64 random bytes from /root/.rnd
2005.12.13 09:09:22 LOG7[11505:1]: Wrote 1024 new random bytes to
/root/.rnd
2005.12.13 09:09:22 LOG7[11505:1]: RAND_status claims sufficient entropy
for the PRNG
2005.12.13 09:09:22 LOG6[11505:1]: PRNG seeded successfully
2005.12.13 09:09:22 LOG7[11505:1]: Certificate:
/usr/local/etc/stunnel/stunnel.pem
2005.12.13 09:09:22 LOG7[11505:1]: Key file:
/usr/local/etc/stunnel/stunnel.pem
2005.12.13 09:09:22 LOG6[11505:1]: file ulimit = 1024 (can be changed
with 'ulimit -n')
2005.12.13 09:09:22 LOG6[11505:1]: poll() used - no FD_SETSIZE limit for
file descriptors
2005.12.13 09:09:22 LOG5[11505:1]: 500 clients allowed
2005.12.13 09:09:22 LOG7[11505:1]: FD 6 in non-blocking mode
2005.12.13 09:09:22 LOG7[11505:1]: FD 8 in non-blocking mode
2005.12.13 09:09:22 LOG7[11505:1]: FD 9 in non-blocking mode
2005.12.13 09:09:22 LOG7[11505:1]: SO_REUSEADDR option set on accept socket
2005.12.13 09:09:22 LOG7[11505:1]: ssyslog bound to 195.56.52.140:2514
2005.12.13 09:09:22 LOG7[11506:1]: Created pid file
/usr/local/etc/stunnel/stunnel.pid
2005.12.13 09:09:22 LOG7[11506:0]: Waiting -1 second(s) for 2 file
descriptor(s)
2005.12.13 09:11:23 LOG7[11506:0]: CONTEXT 1, FD=6, (IN)->()
2005.12.13 09:11:23 LOG7[11506:0]: CONTEXT 1, FD=9, (IN)->(IN)
2005.12.13 09:11:23 LOG7[11506:1]: ssyslog accepted FD=10 from
81.183.222.1:35225
2005.12.13 09:11:23 LOG7[11506:1]: Creating a new context
2005.12.13 09:11:23 LOG7[11506:1]: Context 2 created
2005.12.13 09:11:23 LOG7[11506:2]: Context swap: 1 -> 2
2005.12.13 09:11:23 LOG7[11506:2]: ssyslog started
2005.12.13 09:11:23 LOG7[11506:2]: FD 10 in non-blocking mode
2005.12.13 09:11:23 LOG7[11506:2]: TCP_NODELAY option set on local socket
2005.12.13 09:11:23 LOG5[11506:2]: ssyslog connected from
81.183.222.1:35225
2005.12.13 09:11:23 LOG7[11506:2]: SSL state (accept): before/accept
initialization
2005.12.13 09:11:23 LOG7[11506:0]: Waiting 300 second(s) for 3 file
descriptor(s)
2005.12.13 09:11:23 LOG7[11506:0]: CONTEXT 1, FD=6, (IN)->()
2005.12.13 09:11:23 LOG7[11506:0]: CONTEXT 1, FD=9, (IN)->()
2005.12.13 09:11:23 LOG7[11506:0]: CONTEXT 2, FD=10, (IN)->(IN)
2005.12.13 09:11:23 LOG7[11506:2]: SSL state (accept): SSLv3 read client
hello A
2005.12.13 09:11:23 LOG7[11506:2]: SSL state (accept): SSLv3 write
server hello A
2005.12.13 09:11:23 LOG7[11506:2]: SSL state (accept): SSLv3 write
certificate A
2005.12.13 09:11:23 LOG7[11506:2]: SSL state (accept): SSLv3 write
server done A
2005.12.13 09:11:23 LOG7[11506:2]: SSL state (accept): SSLv3 flush data
2005.12.13 09:11:23 LOG7[11506:0]: Waiting 300 second(s) for 3 file
descriptor(s)
2005.12.13 09:11:25 LOG7[11506:0]: CONTEXT 1, FD=6, (IN)->()
2005.12.13 09:11:25 LOG7[11506:0]: CONTEXT 1, FD=9, (IN)->()
2005.12.13 09:11:25 LOG7[11506:0]: CONTEXT 2, FD=10, (IN)->(IN)
2005.12.13 09:11:25 LOG7[11506:2]: SSL state (accept): SSLv3 read client
key exchange A
2005.12.13 09:11:25 LOG7[11506:2]: SSL state (accept): SSLv3 read
finished A
2005.12.13 09:11:25 LOG7[11506:2]: SSL state (accept): SSLv3 write
change cipher spec A
2005.12.13 09:11:25 LOG7[11506:2]: SSL state (accept): SSLv3 write
finished A
2005.12.13 09:11:25 LOG7[11506:2]: SSL state (accept): SSLv3 flush data
2005.12.13 09:11:25 LOG7[11506:2]: 1 items in the session cache
2005.12.13 09:11:25 LOG7[11506:2]: 0 client connects (SSL_connect())
2005.12.13 09:11:25 LOG7[11506:2]: 0 client connects that finished
2005.12.13 09:11:25 LOG7[11506:2]: 0 client renegotiatations requested
2005.12.13 09:11:25 LOG7[11506:2]: 1 server connects (SSL_accept())
2005.12.13 09:11:25 LOG7[11506:2]: 1 server connects that finished
2005.12.13 09:11:25 LOG7[11506:2]: 0 server renegotiatiations requested
2005.12.13 09:11:25 LOG7[11506:2]: 0 session cache hits
2005.12.13 09:11:25 LOG7[11506:2]: 0 session cache misses
2005.12.13 09:11:25 LOG7[11506:2]: 0 session cache timeouts
2005.12.13 09:11:25 LOG6[11506:2]: SSL accepted: new session negotiated
2005.12.13 09:11:25 LOG6[11506:2]: Negotiated ciphers:
AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1
2005.12.13 09:11:25 LOG7[11506:2]: FD 11 in non-blocking mode
2005.12.13 09:11:25 LOG7[11506:2]: ssyslog connecting 10.10.2.1:25
2005.12.13 09:11:25 LOG7[11506:2]: connect_wait: waiting 10 seconds
2005.12.13 09:11:25 LOG7[11506:0]: Waiting 10 second(s) for 3 file
descriptor(s)
2005.12.13 09:11:35 LOG7[11506:0]: CONTEXT 1, FD=6, (IN)->()
2005.12.13 09:11:35 LOG7[11506:0]: CONTEXT 1, FD=9, (IN)->()
2005.12.13 09:11:35 LOG7[11506:0]: CONTEXT 2, FD=11, (INOUT)->()
2005.12.13 09:11:35 LOG6[11506:2]: connect_wait: s_poll_wait timeout
2005.12.13 09:11:35 LOG3[11506:2]: Failed to initialize remote connection
2005.12.13 09:11:35 LOG7[11506:2]: ssyslog finished (0 left)
2005.12.13 09:11:35 LOG5[11506:2]: stack_info: size=65536, current=4204
(6%), maximum=4204 (6%)
2005.12.13 09:11:35 LOG7[11506:2]: Context 2 closed
2005.12.13 09:11:35 LOG7[11506:0]: Waiting -1 second(s) for 2 file
descriptor(s)
Client:
2005.12.13 09:05:26 LOG5[17901:1]: stunnel 4.14 on i686-pc-linux-gnu
UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7 31 Dec 2002
2005.12.13 09:05:26 LOG7[17901:1]: Snagged 64 random bytes from /root/.rnd
2005.12.13 09:05:26 LOG7[17901:1]: Wrote 1024 new random bytes to
/root/.rnd
2005.12.13 09:05:26 LOG7[17901:1]: RAND_status claims sufficient entropy
for the PRNG
2005.12.13 09:05:26 LOG6[17901:1]: PRNG seeded successfully
2005.12.13 09:05:26 LOG7[17901:1]: Certificate:
/usr/local/etc/stunnel/stunnel.pem
2005.12.13 09:05:26 LOG7[17901:1]: Key file:
/usr/local/etc/stunnel/stunnel.pem
2005.12.13 09:05:26 LOG6[17901:1]: file ulimit = 1024 (can be changed
with 'ulimit -n')
2005.12.13 09:05:26 LOG6[17901:1]: poll() used - no FD_SETSIZE limit for
file descriptors
2005.12.13 09:05:26 LOG5[17901:1]: 500 clients allowed
2005.12.13 09:05:26 LOG7[17901:1]: FD 5 in non-blocking mode
2005.12.13 09:05:26 LOG7[17901:1]: FD 7 in non-blocking mode
2005.12.13 09:05:26 LOG7[17901:1]: FD 8 in non-blocking mode
2005.12.13 09:05:26 LOG7[17901:1]: SO_REUSEADDR option set on accept socket
2005.12.13 09:05:26 LOG7[17901:1]: ssyslog bound to 0.0.0.0:2514
2005.12.13 09:05:26 LOG7[17902:1]: Created pid file
/usr/local/etc/stunnel/stunnel.pid
2005.12.13 09:05:26 LOG7[17902:0]: Waiting -1 second(s) for 2 file
descriptor(s)
2005.12.13 09:07:03 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->()
2005.12.13 09:07:03 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->(IN)
2005.12.13 09:07:03 LOG7[17902:1]: ssyslog accepted FD=9 from
127.0.0.1:40024
2005.12.13 09:07:03 LOG7[17902:1]: Creating a new context
2005.12.13 09:07:03 LOG7[17902:1]: Context 2 created
2005.12.13 09:07:03 LOG7[17902:2]: Context swap: 1 -> 2
2005.12.13 09:07:03 LOG7[17902:2]: ssyslog started
2005.12.13 09:07:03 LOG7[17902:2]: FD 9 in non-blocking mode
2005.12.13 09:07:03 LOG7[17902:2]: TCP_NODELAY option set on local socket
2005.12.13 09:07:03 LOG5[17902:2]: ssyslog connected from 127.0.0.1:40024
2005.12.13 09:07:03 LOG7[17902:2]: FD 10 in non-blocking mode
2005.12.13 09:07:03 LOG7[17902:2]: ssyslog connecting 195.56.52.140:2514
2005.12.13 09:07:03 LOG7[17902:2]: connect_wait: waiting 10 seconds
2005.12.13 09:07:03 LOG7[17902:0]: Waiting 10 second(s) for 3 file
descriptor(s)
2005.12.13 09:07:03 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->()
2005.12.13 09:07:03 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->()
2005.12.13 09:07:03 LOG7[17902:0]: CONTEXT 2, FD=10, (INOUT)->(OUT)
2005.12.13 09:07:03 LOG7[17902:2]: connect_wait: connected
2005.12.13 09:07:03 LOG7[17902:2]: Remote FD=10 initialized
2005.12.13 09:07:03 LOG7[17902:2]: TCP_NODELAY option set on remote socket
2005.12.13 09:07:03 LOG7[17902:2]: SSL state (connect): before/connect
initialization
2005.12.13 09:07:03 LOG7[17902:2]: SSL state (connect): SSLv3 write
client hello A
2005.12.13 09:07:03 LOG7[17902:0]: Waiting 300 second(s) for 3 file
descriptor(s)
2005.12.13 09:07:06 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->()
2005.12.13 09:07:06 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->()
2005.12.13 09:07:06 LOG7[17902:0]: CONTEXT 2, FD=10, (IN)->(IN)
2005.12.13 09:07:06 LOG7[17902:2]: SSL state (connect): SSLv3 read
server hello A
2005.12.13 09:07:06 LOG7[17902:2]: SSL state (connect): SSLv3 read
server certificate A
2005.12.13 09:07:06 LOG7[17902:2]: SSL state (connect): SSLv3 read
server done A
2005.12.13 09:07:06 LOG7[17902:2]: SSL state (connect): SSLv3 write
client key exchange A
2005.12.13 09:07:06 LOG7[17902:2]: SSL state (connect): SSLv3 write
change cipher spec A
2005.12.13 09:07:06 LOG7[17902:2]: SSL state (connect): SSLv3 write
finished A
2005.12.13 09:07:06 LOG7[17902:2]: SSL state (connect): SSLv3 flush data
2005.12.13 09:07:06 LOG7[17902:0]: Waiting 300 second(s) for 3 file
descriptor(s)
2005.12.13 09:07:08 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->()
2005.12.13 09:07:08 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->()
2005.12.13 09:07:08 LOG7[17902:0]: CONTEXT 2, FD=10, (IN)->(IN)
2005.12.13 09:07:08 LOG7[17902:2]: SSL state (connect): SSLv3 read
finished A
2005.12.13 09:07:08 LOG7[17902:2]: 1 items in the session cache
2005.12.13 09:07:08 LOG7[17902:2]: 1 client connects (SSL_connect())
2005.12.13 09:07:08 LOG7[17902:2]: 1 client connects that finished
2005.12.13 09:07:08 LOG7[17902:2]: 0 client renegotiatations requested
2005.12.13 09:07:08 LOG7[17902:2]: 0 server connects (SSL_accept())
2005.12.13 09:07:08 LOG7[17902:2]: 0 server connects that finished
2005.12.13 09:07:08 LOG7[17902:2]: 0 server renegotiatiations requested
2005.12.13 09:07:08 LOG7[17902:2]: 0 session cache hits
2005.12.13 09:07:08 LOG7[17902:2]: 0 session cache misses
2005.12.13 09:07:08 LOG7[17902:2]: 0 session cache timeouts
2005.12.13 09:07:08 LOG6[17902:2]: SSL connected: new session negotiated
2005.12.13 09:07:08 LOG6[17902:2]: Negotiated ciphers:
AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1
2005.12.13 09:07:08 LOG7[17902:0]: Waiting 43200 second(s) for 4 file
descriptor(s)
2005.12.13 09:07:10 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->()
2005.12.13 09:07:10 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->()
2005.12.13 09:07:10 LOG7[17902:0]: CONTEXT 2, FD=9, (IN)->(IN)
2005.12.13 09:07:10 LOG7[17902:0]: CONTEXT 2, FD=10, (IN)->()
2005.12.13 09:07:10 LOG7[17902:0]: Waiting 43200 second(s) for 4 file
descriptor(s)
2005.12.13 09:07:10 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->()
2005.12.13 09:07:10 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->()
2005.12.13 09:07:10 LOG7[17902:0]: CONTEXT 2, FD=9, (IN)->()
2005.12.13 09:07:10 LOG7[17902:0]: CONTEXT 2, FD=10, (INOUT)->(OUT)
2005.12.13 09:07:10 LOG7[17902:0]: Waiting 43200 second(s) for 4 file
descriptor(s)
2005.12.13 09:07:11 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->()
2005.12.13 09:07:11 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->()
2005.12.13 09:07:11 LOG7[17902:0]: CONTEXT 2, FD=9, (IN)->(IN)
2005.12.13 09:07:11 LOG7[17902:0]: CONTEXT 2, FD=10, (IN)->()
2005.12.13 09:07:11 LOG7[17902:0]: Waiting 43200 second(s) for 4 file
descriptor(s)
2005.12.13 09:07:11 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->()
2005.12.13 09:07:11 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->()
2005.12.13 09:07:11 LOG7[17902:0]: CONTEXT 2, FD=9, (IN)->()
2005.12.13 09:07:11 LOG7[17902:0]: CONTEXT 2, FD=10, (INOUT)->(OUT)
2005.12.13 09:07:11 LOG7[17902:0]: Waiting 43200 second(s) for 4 file
descriptor(s)
2005.12.13 09:07:16 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->()
2005.12.13 09:07:16 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->()
2005.12.13 09:07:16 LOG7[17902:0]: CONTEXT 2, FD=9, (IN)->()
2005.12.13 09:07:16 LOG7[17902:0]: CONTEXT 2, FD=10, (IN)->(INERRHUP)
2005.12.13 09:07:16 LOG3[17902:2]: SSL_read: Connection reset by peer (104)
2005.12.13 09:07:16 LOG5[17902:2]: Connection reset: 4 bytes sent to
SSL, 0 bytes sent to socket
2005.12.13 09:07:16 LOG7[17902:2]: ssyslog finished (0 left)
2005.12.13 09:07:16 LOG5[17902:2]: stack_info: size=65536, current=4180
(6%), maximum=4180 (6%)
2005.12.13 09:07:16 LOG7[17902:2]: Context 2 closed
2005.12.13 09:07:16 LOG7[17902:0]: Waiting -1 second(s) for 2 file
descriptor(s)
Strange thing, i did set up a windows box for testing, and i get the
exact same error mesages when trying to connect to the server.
Any ideas?
1
0
I have a client application on a windows machine, which tunnels through
stunnel v4.14 to launch and inetd through stunnel v4.09 on a Linux box.
The Linux side INETD successfully sends a packet of 25B to the client.
The client (windows) receives this packet and returns a 12B packet. The
packet IS received by the INETD but then stunnel immediately closes the
socket.
Why is it doing this?
I'm including all configs and longs.
1
0
Hello List. What I'd like to do is use stunnel on a Windows server
behind the firewall then forward the data that comes in to the Windows
server to another machine (another public ip behind the firewall) that's
running an app that needs the original data. For example, I have a
device out in the field that is using ssl to send data on port 4000 to
my server in the office that has stunnel installed and listens on port
4000. Once the data is sent to the Windows server using stunnel, I'd
like the Windows server to send the data to another computer that needs
it but that doesn't have stunnel on it. The encryption will happen from
the field device to the Windows server in the office, then that Windows
server will have to forward the data to another computer that needs the
data. I am at a lost on how to do this if at all possible. Any help
would be great!
Device using ssl out in the field sending data on port
4000---------firewall forwarding traffic from port 4000 to Windows
server running stunnel behind firewall-----------Windows server receives
stunnel data then forwards to another computer-------system that needs
data----
Regards
1
0
Paul,
This is a temporary solution but it works. What you need to do is
run two instances of Stunnel--one instance configured in client mode and
the other in server mode. If you want to run both as services, you can
install the standard one with the "-install" switch. For the second
instance, you need to use some other binary to install it with a different
name and change the imagepath to point to the executable.
/han
>_____
>
>From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]]
>On Behalf Of Paul Hethmon
>Sent: Wednesday, December 07, 2005 2:50 PM
>To: stunnel-users(a)mirt.net
>Subject: [stunnel-users] Windows config with both SSL listen and
>non-SSLlisten
>
>
>I'm trying to set up using the Windows service the ability to listen in SSL
>mode on one port (5102) and forward to non-SSL port (5010) and then also
>listen on one port (5101) in non-SSL mode and forward to a remote port
>(5102) in SSL mode. What I have currently in the config is:
>
>[inbound]
>accept = 5102
>connect = 5010
>
>[outbound]
>accept = 5101
>connect = x.x.x.x:5102
>
>The first STunnel example on the website talks about doing this, sort of,
>but I don't see any options to specify on a service configuration level
>whether the listen port is in SSL or non-SSL mode. The use of a service name
>like [pop3] vs [pop3s] seems to imply a difference, but I've got a custom
>application I'm trying to tunnel two way, not a standard IETF service.
>
>A perusal of the last year's mailing list archives didn't yield anything. I
>guess the next step is to look at the source and see if it's supported
>unless someone here can tell me one way or the other. If it's not supported,
>I guess I'll add it in.
>
>thanks,
>
>Paul
>
>
>Paul Hethmon
>Senior Engineer
>ClareityT Security
>SAFEMLST Security Education, Consulting and Solutions
>http://www.SAFEMLS.com <http://www.safemls.com/>
>paul.hethmon(a)callclareity.com
>work: 865.671.6630
>cell: 865.250.3517
>
>
1
0
07 Dec '05
Michal,
Ok, the next obvious questions then:
1. When is 4.15 expected?
2. If not in the next 7 days, what can I do to help?
I've done C/C++ and sockets for the last 10 years. I've looked at the
code briefly so far, but have not set up a build environment yet. I need
it in the next week so if there is any coding I can do which would help
you, let me know your thoughts and where to put stuff.
Also, just a public thanks for putting the package together. I started
coding my own a couple of days ago and then thought there must have been
someone else who just needed an SSL tunnel (and not a full blown SSH
setup).
Thanks,
Paul
-----Original Message-----
From: stunnel-users-bounces(a)mirt.net
[mailto:[email protected]] On Behalf Of Michal Trojnara
Sent: Wednesday, December 07, 2005 9:03 AM
To: stunnel-users(a)mirt.net
Subject: RE: [stunnel-users] Windows config with both SSL listen
andnon-SSLlisten
Paul,
This feature is going to be supported in the next release (4.15).
Your config will look like this:
[inbound]
client = no
accept = 5102
connect = 5010
[outbound]
client = yes
accept = 5101
connect = x.x.x.x:5102
Best regards,
Mike
________________________________
From: stunnel-users-bounces(a)mirt.net
[mailto:[email protected]]
On Behalf Of Paul Hethmon
Sent: Wednesday, December 07, 2005 2:50 PM
To: stunnel-users(a)mirt.net
Subject: [stunnel-users] Windows config with both SSL listen and
non-SSLlisten
I'm trying to set up using the Windows service the ability to listen in
SSL mode on one port (5102) and forward to non-SSL port (5010) and then
also listen on one port (5101) in non-SSL mode and forward to a remote
port
(5102) in SSL mode. What I have currently in the config is:
[inbound]
accept = 5102
connect = 5010
[outbound]
accept = 5101
connect = x.x.x.x:5102
The first STunnel example on the website talks about doing this, sort
of, but I don't see any options to specify on a service configuration
level whether the listen port is in SSL or non-SSL mode. The use of a
service name like [pop3] vs [pop3s] seems to imply a difference, but
I've got a custom application I'm trying to tunnel two way, not a
standard IETF service.
A perusal of the last year's mailing list archives didn't yield
anything. I guess the next step is to look at the source and see if it's
supported unless someone here can tell me one way or the other. If it's
not supported, I guess I'll add it in.
thanks,
Paul
Paul Hethmon
Senior Engineer
ClareityT Security
SAFEMLST Security Education, Consulting and Solutions
http://www.SAFEMLS.com <http://www.safemls.com/>
paul.hethmon(a)callclareity.com
work: 865.671.6630
cell: 865.250.3517
_______________________________________________
stunnel-users mailing list
stunnel-users(a)mirt.net
http://stunnel.mirt.net/mailman/listinfo/stunnel-users
2
1
I'm trying to set up using the Windows service the ability to listen in
SSL mode on one port (5102) and forward to non-SSL port (5010) and then
also listen on one port (5101) in non-SSL mode and forward to a remote
port (5102) in SSL mode. What I have currently in the config is:
[inbound]
accept = 5102
connect = 5010
[outbound]
accept = 5101
connect = x.x.x.x:5102
The first STunnel example on the website talks about doing this, sort
of, but I don't see any options to specify on a service configuration
level whether the listen port is in SSL or non-SSL mode. The use of a
service name like [pop3] vs [pop3s] seems to imply a difference, but
I've got a custom application I'm trying to tunnel two way, not a
standard IETF service.
A perusal of the last year's mailing list archives didn't yield
anything. I guess the next step is to look at the source and see if it's
supported unless someone here can tell me one way or the other. If it's
not supported, I guess I'll add it in.
thanks,
Paul
Paul Hethmon
Senior Engineer
Clareity(tm) Security
SAFEMLS(tm) Security Education, Consulting and Solutions
http://www.SAFEMLS.com <http://www.safemls.com/>
paul.hethmon(a)callclareity.com
work: 865.671.6630
cell: 865.250.3517
2
1
Pretty new to stunnel and not very familiar with compiling programs at all:
1. Description:
Installation of stunnel 4.14 failing on a Solaris 9 box.
#>make
Making all in src
/bin/bash ../libtool --tag=CC --mode=link gcc -g -O2 -Wall -Wshadow
-Wcast-align -Wpointer-arith -I/usr/local/ssl/include -o libstunnel.la
-rpath /usr/local/lib -avoid-version env.lo -lz -ldl -lsocket -lnsl
-L/usr/local/ssl/lib -lssl -lcrypto -lwrap
gcc -shared -Wl,-h -Wl,libstunnel.so -o .libs/libstunnel.so .libs/env.o
-lz -ldl -lsocket -lnsl -L/usr/local/ssl/lib -lssl -lcrypto -lwrap -lc
ld: fatal: library -lwrap: not found
ld: fatal: File processing errors. No output written to .libs/libstunnel.so
collect2: ld returned 1 exit status
*** Error code 1
make: Fatal error: Command failed for target `libstunnel.la'
Current working directory /local1/home/stunnel/stunnel-4.14/src
*** Error code 1
make: Fatal error: Command failed for target `all-recursive'
*******************************************
James Bartkowicz
Bed Bath & Beyond
Server Administration Team - UNIX
908-688-0888 ext.4441
*******************************************
------------------------------------------------------
CONFIDENTIALITY NOTICE: This e-mail, and any attachments thereto, is
intended only for use by the addressee(s) named herein and may contain
confidential information. If you are not the intended recipient of this
e-mail, you are hereby notified that any dissemination, distribution or
copying of this e-mail, and any attachments thereto, is strictly
prohibited. If you have received this e-mail in error, please permanently
delete the original and any copy of any e-mail and any printout thereof.
Thank you for your compliance.
2
1
I've looked through the man pages, FAQ's, examples, and found one post
(without a reply:
http://stunnel.mirt.net/pipermail/stunnel-users/2005-May/000487.html) about
this, but still don't have my question answered.
I have a machine outside the firewall (let's call it outThere) that needs to
connect back to a machine inside the firewall (let's call in inHere) for
backup procedures. Now, because of the firewall, outThere cannot connect to
inHere, but inHere can connect to anything on outThere that it wants.
Can I initiate an stunnel connection from inHere to outThere, and then have
stunnel on outThere listen on a localhost port, which, when connected to,
would actually forward the connection (over SSL) back to a configured port on
inHere? Is this at all doable?
j----- k-----
--
Joshua Kugler
CDE System Administrator
http://distance.uaf.edu/
2
1