Hello:
I have two windows machines. I am trying to connect to a shared drive on
the server over an
stunnel connection following the instructions on this page:
http://research.lumeta.com/ches/cheap/stunnelsolution.html
The connection from the client seems to connect to the server, but the
server-side stunnel
seems to be getting a timeout when it attempts to connect to port 139. I am
able to map
the network drive locally, so I am surprised it is not able to connect.
Here is the log from stunnel on the server:
2006.02.04 18:22:17 LOG5[2116:3068]: stunnel 4.14 on x86-pc-mingw32-gnu
WIN32+SELECT+IPv6 with OpenSSL 0.9.7i 14 Oct 2005
2006.02.04 18:22:17 LOG7[2116:3968]: RAND_status claims sufficient entropy
for the PRNG
2006.02.04 18:22:17 LOG6[2116:3968]: PRNG seeded successfully
2006.02.04 18:22:17 LOG7[2116:3968]: Certificate: stunnel.pem
2006.02.04 18:22:17 LOG7[2116:3968]: Key file: stunnel.pem
2006.02.04 18:22:17 LOG5[2116:3968]: No limit detected for the number of
clients
2006.02.04 18:22:17 LOG7[2116:3968]: FD 168 in non-blocking mode
2006.02.04 18:22:17 LOG7[2116:3968]: SO_REUSEADDR option set on accept
socket
2006.02.04 18:22:17 LOG7[2116:3968]: netDrives bound to 0.0.0.0:2139
2006.02.04 18:24:49 LOG7[2116:3968]: netDrives accepted FD=188 from
192.168.1.247:1334
2006.02.04 18:24:49 LOG7[2116:3968]: Creating a new thread
2006.02.04 18:24:49 LOG7[2116:3968]: New thread created
2006.02.04 18:24:49 LOG7[2116:2224]: netDrives started
2006.02.04 18:24:49 LOG7[2116:2224]: FD 188 in non-blocking mode
2006.02.04 18:24:49 LOG7[2116:2224]: TCP_NODELAY option set on local socket
2006.02.04 18:24:49 LOG5[2116:2224]: netDrives connected from
192.168.1.247:1334
2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): before/accept
initialization
2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 read client
hello A
2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 write server
hello A
2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 write
certificate A
2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 write server
done A
2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 flush data
2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 read client
key exchange A
2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 read finished
A
2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 write change
cipher spec A
2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 write
finished A
2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 flush data
2006.02.04 18:24:49 LOG7[2116:2224]: 1 items in the session cache
2006.02.04 18:24:49 LOG7[2116:2224]: 0 client connects (SSL_connect())
2006.02.04 18:24:49 LOG7[2116:2224]: 0 client connects that finished
2006.02.04 18:24:49 LOG7[2116:2224]: 0 client renegotiatations requested
2006.02.04 18:24:49 LOG7[2116:2224]: 1 server connects (SSL_accept())
2006.02.04 18:24:49 LOG7[2116:2224]: 1 server connects that finished
2006.02.04 18:24:49 LOG7[2116:2224]: 0 server renegotiatiations requested
2006.02.04 18:24:49 LOG7[2116:2224]: 0 session cache hits
2006.02.04 18:24:49 LOG7[2116:2224]: 0 session cache misses
2006.02.04 18:24:49 LOG7[2116:2224]: 0 session cache timeouts
2006.02.04 18:24:49 LOG6[2116:2224]: SSL accepted: new session negotiated
2006.02.04 18:24:49 LOG6[2116:2224]: Negotiated ciphers: AES256-SHA
SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1
2006.02.04 18:24:49 LOG7[2116:2224]: FD 216 in non-blocking mode
2006.02.04 18:24:49 LOG7[2116:2224]: netDrives connecting 127.0.0.1:139
2006.02.04 18:24:49 LOG7[2116:2224]: connect_wait: waiting 10 seconds
2006.02.04 18:24:59 LOG7[2116:3968]: netDrives accepted FD=236 from
192.168.1.247:1336
2006.02.04 18:24:59 LOG7[2116:3968]: Creating a new thread
2006.02.04 18:24:59 LOG7[2116:3968]: New thread created
2006.02.04 18:24:59 LOG7[2116:3544]: netDrives started
2006.02.04 18:24:59 LOG7[2116:3544]: FD 236 in non-blocking mode
2006.02.04 18:24:59 LOG7[2116:3544]: TCP_NODELAY option set on local socket
2006.02.04 18:24:59 LOG5[2116:3544]: netDrives connected from
192.168.1.247:1336
2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): before/accept
initialization
2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): SSLv3 read client
hello A
2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): SSLv3 write server
hello A
2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): SSLv3 write change
cipher spec A
2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): SSLv3 write
finished A
2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): SSLv3 flush data
2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): SSLv3 read finished
A
2006.02.04 18:24:59 LOG7[2116:3544]: 1 items in the session cache
2006.02.04 18:24:59 LOG7[2116:3544]: 0 client connects (SSL_connect())
2006.02.04 18:24:59 LOG7[2116:3544]: 0 client connects that finished
2006.02.04 18:24:59 LOG7[2116:3544]: 0 client renegotiatations requested
2006.02.04 18:24:59 LOG7[2116:3544]: 2 server connects (SSL_accept())
2006.02.04 18:24:59 LOG7[2116:3544]: 2 server connects that finished
2006.02.04 18:24:59 LOG7[2116:3544]: 0 server renegotiatiations requested
2006.02.04 18:24:59 LOG7[2116:3544]: 1 session cache hits
2006.02.04 18:24:59 LOG7[2116:3544]: 0 session cache misses
2006.02.04 18:24:59 LOG7[2116:3544]: 0 session cache timeouts
2006.02.04 18:24:59 LOG6[2116:2224]: connect_wait: s_poll_wait timeout
2006.02.04 18:24:59 LOG6[2116:3544]: SSL accepted: previous session reused
2006.02.04 18:24:59 LOG3[2116:2224]: Failed to initialize remote connection
2006.02.04 18:24:59 LOG7[2116:3544]: FD 216 in non-blocking mode
2006.02.04 18:24:59 LOG7[2116:2224]: netDrives finished (1 left)
2006.02.04 18:24:59 LOG7[2116:3544]: netDrives connecting 127.0.0.1:139
2006.02.04 18:24:59 LOG7[2116:3544]: connect_wait: waiting 10 seconds
2006.02.04 18:25:09 LOG6[2116:3544]: connect_wait: s_poll_wait timeout
2006.02.04 18:25:09 LOG3[2116:3544]: Failed to initialize remote connection
2006.02.04 18:25:09 LOG7[2116:3544]: netDrives finished (0 left)
Here is the stunnel.conf file from the server:
; Sample stunnel configuration file by Michal Trojnara 2002-2005
; Some options used here may not be adequate for your particular
configuration
; Certificate/key is needed in server mode and optional in client mode
; The default certificate is provided only for testing and should not
; be used in a production environment
cert = stunnel.pem
;key = stunnel.pem
; Some performance tunings
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
; Workaround for Eudora bug
;options = DONT_INSERT_EMPTY_FRAGMENTS
; Authentication stuff
;verify = 2
; Don't forget to c_rehash CApath
;CApath = certs
; It's often easier to use CAfile
;CAfile = certs.pem
; Don't forget to c_rehash CRLpath
;CRLpath = crls
; Alternatively you can use CRLfile
;CRLfile = crls.pem
; Some debugging stuff useful for troubleshooting
debug = 7
output = stunnel.log
; Use it for client mode
;client = yes
; Service-level configuration
[netDrives]
accept = 2139
connect = 139
In case you need it, here is the stunnel log from the client:
2006.02.04 18:23:43 LOG5[3236:2376]: stunnel 4.14 on x86-pc-mingw32-gnu
WIN32+SELECT+IPv6 with OpenSSL 0.9.7i 14 Oct 2005
2006.02.04 18:23:43 LOG7[3236:324]: RAND_status claims sufficient entropy
for the PRNG
2006.02.04 18:23:43 LOG6[3236:324]: PRNG seeded successfully
2006.02.04 18:23:43 LOG7[3236:324]: Certificate: stunnel.pem
2006.02.04 18:23:43 LOG7[3236:324]: Key file: stunnel.pem
2006.02.04 18:23:43 LOG5[3236:324]: No limit detected for the number of
clients
2006.02.04 18:23:43 LOG7[3236:324]: FD 200 in non-blocking mode
2006.02.04 18:23:43 LOG7[3236:324]: SO_REUSEADDR option set on accept socket
2006.02.04 18:23:43 LOG7[3236:324]: netDrives bound to 222.222.222.222:139
2006.02.04 18:24:42 LOG7[3236:324]: netDrives accepted FD=220 from
192.168.1.247:1333
2006.02.04 18:24:42 LOG7[3236:324]: Creating a new thread
2006.02.04 18:24:42 LOG7[3236:324]: New thread created
2006.02.04 18:24:42 LOG7[3236:572]: netDrives started
2006.02.04 18:24:42 LOG7[3236:572]: FD 220 in non-blocking mode
2006.02.04 18:24:42 LOG7[3236:572]: TCP_NODELAY option set on local socket
2006.02.04 18:24:42 LOG5[3236:572]: netDrives connected from
192.168.1.247:1333
2006.02.04 18:24:42 LOG7[3236:572]: FD 252 in non-blocking mode
2006.02.04 18:24:42 LOG7[3236:572]: netDrives connecting 192.168.1.10:2139
2006.02.04 18:24:42 LOG7[3236:572]: connect_wait: waiting 10 seconds
2006.02.04 18:24:42 LOG7[3236:572]: connect_wait: connected
2006.02.04 18:24:42 LOG7[3236:572]: Remote FD=252 initialized
2006.02.04 18:24:42 LOG7[3236:572]: TCP_NODELAY option set on remote socket
2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): before/connect
initialization
2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 write client
hello A
2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 read server
hello A
2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 read server
certificate A
2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 read server
done A
2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 write client
key exchange A
2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 write change
cipher spec A
2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 write
finished A
2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 flush data
2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 read finished
A
2006.02.04 18:24:42 LOG7[3236:572]: 1 items in the session cache
2006.02.04 18:24:42 LOG7[3236:572]: 1 client connects (SSL_connect())
2006.02.04 18:24:42 LOG7[3236:572]: 1 client connects that finished
2006.02.04 18:24:42 LOG7[3236:572]: 0 client renegotiatations requested
2006.02.04 18:24:42 LOG7[3236:572]: 0 server connects (SSL_accept())
2006.02.04 18:24:42 LOG7[3236:572]: 0 server connects that finished
2006.02.04 18:24:42 LOG7[3236:572]: 0 server renegotiatiations requested
2006.02.04 18:24:42 LOG7[3236:572]: 0 session cache hits
2006.02.04 18:24:42 LOG7[3236:572]: 0 session cache misses
2006.02.04 18:24:42 LOG7[3236:572]: 0 session cache timeouts
2006.02.04 18:24:42 LOG6[3236:572]: SSL connected: new session negotiated
2006.02.04 18:24:42 LOG6[3236:572]: Negotiated ciphers: AES256-SHA
SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1
2006.02.04 18:24:52 LOG3[3236:572]: readsocket: Connection reset by peer
(WSAECONNRESET) (10054)
2006.02.04 18:24:52 LOG7[3236:324]: netDrives accepted FD=276 from
192.168.1.247:1335
2006.02.04 18:24:52 LOG5[3236:572]: Connection reset: 72 bytes sent to SSL,
0 bytes sent to socket
2006.02.04 18:24:52 LOG7[3236:324]: Creating a new thread
2006.02.04 18:24:52 LOG7[3236:572]: netDrives finished (0 left)
2006.02.04 18:24:52 LOG7[3236:324]: New thread created
2006.02.04 18:24:52 LOG7[3236:1336]: netDrives started
2006.02.04 18:24:52 LOG7[3236:1336]: FD 276 in non-blocking mode
2006.02.04 18:24:52 LOG7[3236:1336]: TCP_NODELAY option set on local socket
2006.02.04 18:24:52 LOG5[3236:1336]: netDrives connected from
192.168.1.247:1335
2006.02.04 18:24:52 LOG7[3236:1336]: FD 248 in non-blocking mode
2006.02.04 18:24:52 LOG7[3236:1336]: netDrives connecting 192.168.1.10:2139
2006.02.04 18:24:52 LOG7[3236:1336]: connect_wait: waiting 10 seconds
2006.02.04 18:24:52 LOG7[3236:1336]: connect_wait: connected
2006.02.04 18:24:52 LOG7[3236:1336]: Remote FD=248 initialized
2006.02.04 18:24:52 LOG7[3236:1336]: TCP_NODELAY option set on remote socket
2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): before/connect
initialization
2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): SSLv3 write client
hello A
2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): SSLv3 read server
hello A
2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): SSLv3 read
finished A
2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): SSLv3 write change
cipher spec A
2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): SSLv3 write
finished A
2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): SSLv3 flush data
2006.02.04 18:24:52 LOG7[3236:1336]: 1 items in the session cache
2006.02.04 18:24:52 LOG7[3236:1336]: 2 client connects (SSL_connect())
2006.02.04 18:24:52 LOG7[3236:1336]: 2 client connects that finished
2006.02.04 18:24:52 LOG7[3236:1336]: 0 client renegotiatations requested
2006.02.04 18:24:52 LOG7[3236:1336]: 0 server connects (SSL_accept())
2006.02.04 18:24:52 LOG7[3236:1336]: 0 server connects that finished
2006.02.04 18:24:52 LOG7[3236:1336]: 0 server renegotiatiations requested
2006.02.04 18:24:52 LOG7[3236:1336]: 1 session cache hits
2006.02.04 18:24:52 LOG7[3236:1336]: 0 session cache misses
2006.02.04 18:24:52 LOG7[3236:1336]: 0 session cache timeouts
2006.02.04 18:24:52 LOG6[3236:1336]: SSL connected: previous session reused
2006.02.04 18:25:02 LOG3[3236:1336]: readsocket: Connection reset by peer
(WSAECONNRESET) (10054)
2006.02.04 18:25:02 LOG5[3236:1336]: Connection reset: 72 bytes sent to SSL,
0 bytes sent to socket
2006.02.04 18:25:02 LOG7[3236:1336]: netDrives finished (0 left)
Here is the stunnel.conf file from the client:
; Sample stunnel configuration file by Michal Trojnara 2002-2005
; Some options used here may not be adequate for your particular
configuration
; Certificate/key is needed in server mode and optional in client mode
; The default certificate is provided only for testing and should not
; be used in a production environment
cert = stunnel.pem
;key = stunnel.pem
; Some performance tunings
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
; Workaround for Eudora bug
;options = DONT_INSERT_EMPTY_FRAGMENTS
; Authentication stuff
;verify = 2
; Don't forget to c_rehash CApath
;CApath = certs
; It's often easier to use CAfile
;CAfile = certs.pem
; Don't forget to c_rehash CRLpath
;CRLpath = crls
; Alternatively you can use CRLfile
;CRLfile = crls.pem
; Some debugging stuff useful for troubleshooting
debug = 7
output = stunnel.log
; Use it for client mode
client = yes
; Service-level configuration
[netDrives]
accept = 222.222.222.222:139
connect = tcServer.crcBusinessServices.com:2139
Any ideas what could be wrong?
Thanks,
Neil
--
Neil Aggarwal, JAMM Consulting, (214) 986-3533, www.JAMMConsulting.com
FREE! Valuable info on how your business can reduce operating costs by
17% or more in 6 months or less! http://newsletter.JAMMConsulting.com
1
0
Here is the ChangeLog entry:
* version 1.01 2006.02.04, status: functional, not proven to be stable
- TUN changed to TAP (project renamed from tunpipe to tappipe)
- TCP-over-TCP meltdown problem fixed
http://sites.inka.de/sites/bigred/devel/tcp-tcp.html
- important bugfixes
Download site:
ftp://stunnel.mirt.net/tappipe/
Best regards,
Mike
1
0
Stunnel with ntsyslog on windows 2000 forwarding to syslog-ng on fedora core 4 with stunnel in the middle.
by Anthony Cicalla 03 Feb '06
by Anthony Cicalla 03 Feb '06
03 Feb '06
Website questions answered first
1) ntsyslog(on windows 2000 pro) is not connecting through stunnel to
(fedora core 4) syslog-ng daemon.
2) latest version of stunnel just downloaded it.
3)stunnel
syslog-ng -f /etc/syslog-ng.conf
4)ran the command but got no output. (stunnel /etc/stunnel/stunnel.conf -f
-D -7)
5)ran the command and it exectuted as above but still got no optput ran
(stunnel /etc/stunnel/stunnel.conf -V)
6)Linux echelon.bankserv.com 2.6.11-1.1369_FC4 #1 Thu Jun 2 22:55:56 EDT
2005 i686 i686 i386 GNU/Linux
7)sry I'm a noob and don't know how to get this. I am from the windows side
of the house. If you need it send me the command and I will get you the
output.
8)Using built-in specs.
Target: i386-redhat-linux
Configured with: ../configure --prefix=/usr --mandir=/usr/share/man
--infodir=/usr/share/info --enable-shared --enable-threads=posix
--enable-checking=release --with-system-zlib --enable-__cxa_atexit
--disable-libunwind-exceptions --enable-libgcj-multifile
--enable-languages=c,c++,objc,java,f95,ada --enable-java-awt=gtk
--with-java-home=/usr/lib/jvm/java-1.4.2-gcj-1.4.2.0/jre
--host=i386-redhat-linux
Thread model: posix
gcc version 4.0.0 20050519 (Red Hat 4.0.0-8)
9)This is the latest version for fedora core 4. I downloaded the packages
for openssl and ran the updater.
I am setting up centralized logging with stunnel, syslog-ng, ntsyslog.
Following the directions from these two links.
<http://www.stunnel.org/examples/syslog-ng.html>
<http://www.monitorware.com/Common/en/Articles/eventlog-stunnel-syslog.php>
Encrypting traffic to a remote syslog-ng server including SSL peer
authentication
1. Install stunnel and syslog-ng on all machines.
2. Create certificates for all machines. On RedHat 9 and similar machines,
you can do the following as root:
# cd /etc/pki/tls/certs
# make syslog-ng-server.pem
# make syslog-ng-client.pem
3. Place copies of syslog-ng-server.pem on all machines in /etc/stunnel with
one important alteration. The clients only need the certificate section of
syslog-ng-server.pem. In other words, remove the private key section from
syslog-ng-server.pem on all clients. Place every client's
syslog-ng-client.pem in /etc/stunnel. For server, create a special
syslog-ng-client.pem containing the certificate sections for all clients and
place in /etc/stunnel. In other words, remove the private key sections from
all syslog-ng-client.pem files and concatenate what is left to create
server's special syslog-ng-client.pem.
4. Give only root ownership, read and write permissions for certificates.
5. On server, create /etc/stunnel/stunnel.conf containing the following
replacing server IP address accordingly:
cert = /etc/stunnel/syslog-ng-server.pem
CAfile = /etc/stunnel/syslog-ng-client.pem
verify = 3
[5140]
accept = 192.x.x.x:5140
connect = 127.0.0.1:514
On clients, create /etc/stunnel/stunnel.conf containing the following
replacing server IP address accordingly:
client = yes
cert = /etc/stunnel/syslog-ng-client.pem
CAfile = /etc/stunnel/syslog-ng-server.pem
verify = 3
[5140]
accept = 127.0.0.1:514
connect = 192.x.x.x:5140
6. On server, create the following in /etc/syslog-ng.conf:
options { long_hostnames(off);
sync(0);
keep_hostname(yes);
chain_hostnames(no); };
source src {unix-stream("/dev/log");
pipe("/proc/kmsg");
internal();};
source stunnel {tcp(ip("127.0.0.1")
port(514)
max-connections(1));};
destination remoteclient {file("/var/log/remoteclient");};
destination dest {file("/var/log/messages");};
log {source(src); destination(dest);};
log {source(stunnel); destination(remoteclient);};
On clients, create the following in /etc/syslog-ng.conf:
options {long_hostnames(off);
sync(0);};
source src {unix-stream("/dev/log"); pipe("/proc/kmsg");
internal();};
destination dest {file("/var/log/messages");};
destination stunnel {tcp("127.0.0.1" port(514));};
log {source(src);destination(dest);};
log {source(src);destination(stunnel);};
(See syslog-ng documentation for more sophisticated syslog-ng.conf
alternatives.)
7. Open necessary ports with regards to packet filtering and TCP wrappers.
8. On all machines, add the following lines to boot procedure and execute
them now:
# stunnel
# syslog-ng -f /etc/syslog-ng.conf
That was the unix side stunnel config.
Copy the files to a location of your choice. If in doubt what you need,
download the latest stunnel binary as well as the ZIP file with the openssl
libararies. Place everything in the same directory, e.g. c:\bin\stunnel.
Please note that the stunnel binary (eg. stunnel-4.04.exe) is the actual
stunnel program and NOT a self-extracting exe program.
Once you have done this, you only need to supply stunnel with a correct
configuration file. You can use the one from the stunnel UNIX/Linux
tutorial, step 5. Make sure that you not only copy over the config file but
also the needed .PEM files. You probably need to change the pathes in the
stunnel.conf file to reflect your local Windows directory structure.
Once you have the config file ready, you can start the Windows stunnel.
Please note that it by default starts interactively. If all goes well, there
is a small icon in the icon tray. Double-Click it to get a status window. If
something goes wrong, the status window automatically appears with a nice
error message.
AT THIS POINT I AM ABLE TO START STUNNEL WITH NO ERRORS SHOW UP BUT 0 ACTIVE
TUNNELS.
Let's assume all went well. What is left is that we must tell the event log
monitor where to forward events to.
Installation:
Install the service by executing the following command:
NTsyslog -install
The service will be started automatically by the service control manager
during system startup. You can start and stop the service manually from the
Services Control Panel.
By default the service runs under the LocalSystem account. The service
can be configured to run as a local user with the following rights:
* Log on as a service
* Manage auditing and security log
The user the service runs as can be configured in the NTsyslog
Properties page which can be accessed through the Services Control Panel.
A GUI tool, NTSyslogCtrl is provided to configure what types of messages
are monitored and what priority to use for each type.
The priority for each event log type controls the service and facility
that the syslog message is sent to. Each log type has a seperate priority.
If the priority for a particular key does not exist, as if you were
upgrading, or using an old NTSyslogCtrl app, the default is 9, user.alert.
Usually, syslog refers to a "facility" and "severity". These are
combined in to a single value called "priority".
To calculate the priorities from normal facility and severity codes:
Take the numeric value for the facility, multiply by 8, and add the
numeric value for the severity.
Standard facility and severity values are:
Facility:
(0) kernel (12) ntp
(1) user (13) log audit
(2) mail (14) log alert
(3) system (15) clock 2
(4) security/auth 1 (16) local 0
(5) syslog (17) local 1
(6) line printer (18) local 2
(7) news (19) local 3
(8) uucp (20) local 4
(9) clock 1 (21) local 5
(10) security/auth 2 (22) local 6
(11) ftp (23) local 7
Severity:
(0) emergency (4) warning
(1) alert (5) notice
(2) critical (6) information
(3) error (7) debug
Note that facility 4, 9, 10, and 15 have different meaning on
various systems. Please consult your system manual pages or syslogd
documentation.
Complete details are available in RFC 3164. See:
<http://www.ietf.org/rfc/rfc3164.txt>
The NTSyslog service must be stopped and restarted for the Registry
settings to take effect. By default all messages are sent using the
user.alert priority.
Registry Settings:
The NTSyslogCtrl program is the preferred method of configuring the
registry. Editing the registry manually is not required when using the
configuration tool.
The syslog host is configured by creating the following Registry entry:
[HKEY_LOCAL_MACHINE\SOFTWARE\SaberNet]
"Syslog"="192.X.X.X"
An additional syslog host may be configured for redundancy:
[HKEY_LOCAL_MACHINE\SOFTWARE\SaberNet]
"Syslog1"=""
The syslog host can be specified by domain name (loghost.example.com) or
by IP address (10.123.112.1).
The types of event log messages sent to the syslog host can be
configured by setting the dword value for each of the types of messages. All
types with a non-zero value will be processed. The included registry file
enables all event types for each event log:
[HKEY_LOCAL_MACHINE\SOFTWARE\SaberNet\Syslog\System]
"Information"=dword:00000001
"Information Priority"=dword:00000009
"Warning"=dword:00000001
"Warning Priority"=dword:00000009
"Error"=dword:00000001
"Error Priority"=dword:00000009
"Audit Success"=dword:00000001
"Audit Success Priority"=dword:00000009
"Audit Failure"=dword:00000001
"Audit Failure Priority"=dword:00000009
[HKEY_LOCAL_MACHINE\SOFTWARE\SaberNet\Syslog\Security]
"Information"=dword:00000001
"Information Priority"=dword:00000009
"Warning"=dword:00000001
"Warning Priority"=dword:00000009
"Error"=dword:00000001
"Error Priority"=dword:00000009
"Audit Success"=dword:00000001
"Audit Success Priority"=dword:00000009
"Audit Failure"=dword:00000001
"Audit Failure Priority"=dword:00000009
[HKEY_LOCAL_MACHINE\SOFTWARE\SaberNet\Syslog\Application]
"Information"=dword:00000001
"Information Priority"=dword:00000009
"Warning"=dword:00000001
"Warning Priority"=dword:00000009
"Error"=dword:00000001
"Error Priority"=dword:00000009
"Audit Success"=dword:00000001
"Audit Success Priority"=dword:00000009
"Audit Failure"=dword:00000001
"Audit Failure Priority"=dword:00000009
Version 1.11 and later supports user defined event logs. Simply add the
appropriate sub-key and settings to the registry in the same format as the
three standard event logs:
[HKEY_LOCAL_MACHINE\SOFTWARE\SaberNet\Syslog\Directory Service]
"Information"=dword:00000001
"Information Priority"=dword:00000009
"Warning"=dword:00000001
"Warning Priority"=dword:00000009
"Error"=dword:00000001
"Error Priority"=dword:00000009
"Audit Success"=dword:00000001
"Audit Success Priority"=dword:00000009
"Audit Failure"=dword:00000001
"Audit Failure Priority"=dword:00000009
ok after all of this configuration and setup I get no syslogs in on the
logging server. I did and ethereal capture and tested a few settings. If I
point it directly to the syslog ip address it's still not connecting becuase
it's trying to connect on port 514. The syslog server is running on port
5140 from the config. I can telnet to port 5140 with no problems. I can
start the nt syslog service with the server's ip and see packets attempting
to be sent this tells me that ntsyslog is working. When I go to examine
stunnel I get
2006.02.02 10:18:06 LOG5[484:108]: stunnel 4.14 on x86-pc-mingw32-gnu
WIN32+SELECT+IPv4 with OpenSSL 0.9.7i 14 Oct 2005
2006.02.02 10:18:07 LOG5[484:652]: No limit detected for the number of
clients
2006.02.02 11:38:18 LOG5[484:640]: 5140 connected from 127.0.0.1:1386
2006.02.02 11:38:27 LOG3[484:640]: SSL_accept: 140760FC: error:140760FC:SSL
routines:SSL23_GET_CLIENT_HELLO:unknown protocol
And that is where I am stuck... any help would be greatly appreciated. I
check this regularly so I will reply or attempt suggestions pretty quickly
and reply the results. I am still pretty new with linux so if you want me to
do something or to get you some information put the commands or step of how
to do it in the post. It will not only help me but it will help others
behind me that might not know as much as well.
I followed the instructions above which has the commands. I created the
pem files and the conf files just as above althought there is not
/etc/syslog-ng.conf on the windows machine. I still made the files but they
are put in c:\bin\stunnel becuase syslog-ng doesn't run on windows. they
reccommended snare of something of the like to forward the logs so I chose
ntsyslog. Ntsyslog is setup exactly like the instructions say. like I said
above stunnel starts without an error when I start the ntsyslog the error
appears in the stunnel log.
Client
Stunnel.conf
cert = C:\bin\stunnel\syslog-ng-server.pem
CAfile = c:\bin\stunnel\syslog-ng-client.pem
verify = 3
[5140]
accept = 127.0.0.1:514
connect = 192.168.x.x:5140
Client
Server
stunnel.conf
cert = /etc/stunnel/syslog-ng-server.pem
CAfile = /etc/stunnel/syslog-ng-client.pem
verify = 3
[5140]
accept = 192.168.x.x:5140
connect = 127.0.0.1:514
syslog-ng.conf
options { long_hostnames(off);
sync(0);
keep_hostname(yes);
chain_hostnames(no); };
source src {unix-stream("/dev/log");
pipe("/proc/kmsg");
internal();};
source stunnel {tcp(ip("127.0.0.1")
port(514)
max-connections(1));};
destination remoteclient {file("/var/log/remoteclient");};
destination dest {file("/var/log/messages");};
log {source(src); destination(dest);};
log {source(stunnel); destination(remoteclient);};
When you run the gui for ntsyslog it creates the registry entries so i did
no have to create them.
Client is on windows the server is the fedora core 4 box
1
0
Dear Users,
For the last two days I was working on a VPN solution for stunnel.
The early alpha version is ready for download here:
ftp://stunnel.mirt.net/tunpipe/
Advantages:
- based on proven strength of SSL encryption (much better than IPSec or any proprietary encryption protocol),
- very clean and lightweight design,
- very easy to configure.
Disadvantages:
- only works on GNU/Linux (can be ported to some other Unixes),
- use of TCP is the main performance limitation.
Aternative solutions:
http://www.math.ucla.edu/~jimc/documents/vpn.html
Suggestions and comments are welcome.
Best regards,
Mike
2
3
Can anybody tell me if it's possible for stunnel to act as a local
web proxy that simply encrypts my outgoing HTTP traffic and decrypts
it on the way back in? Specifically is it still possible to block
urls at the hosting provider with this approach and is all my
browsing then safe from prying eyes? What I want is along the lines
of a VPN solution but it sounds like stunnel can at least take care
of my HTTP needs.
2
1
Mike:
Given this: what is the best way for Stunnel to make authentication
And authorization decisions based on information presented in the
Certificate from the peer. My question comes from: how do I do level 3
Checking in a scalable manner when my order of magnitude is in the
Thousands...
Much thanks
Sekhar
-------------------------------
Message: 3
Date: Tue, 31 Jan 2006 09:51:06 +0100
From: "Michal Trojnara" <Michal.Trojnara(a)mobi-com.net>
Subject: RE: [stunnel-users] FQDN validation and checking within
STunnel
To: <stunnel-users(a)mirt.net>
Message-ID: <20060131085108.B053F1C130(a)linode.mirt.net>
Content-Type: text/plain; charset="us-ascii"
Nagasundaram, Sekhar wrote:
> Is there a setting in Stunnel to do FQDN checking?
DNS is not a secure protocol
(http://www.securesphere.net/download/papers/dnsspoof.htm). Security
should not be based on DNS checks. I'm not going to implement this
feature.
Best regards,
Mike
------------------------------
Message: 4
Date: Tue, 31 Jan 2006 10:41:37 +0100
From: "Michal Trojnara" <Michal.Trojnara(a)mobi-com.net>
Subject: RE: --with-threads=ucontext portability (was Re:
[stunnel-users] stunnel4.x.x and IRIX)
To: <stunnel-users(a)mirt.net>
Message-ID: <20060131094139.33A011C17C(a)linode.mirt.net>
Content-Type: text/plain; charset="iso-8859-1"
Miloslav Trmac wrote:
> I have just seen a crash at a similar place on x86_64. The apparent
> cause is sthreads.c:116:
> makecontext(&ctx->ctx, (void(*)(void))cli, 1, arg); arg is a void
> *, but:
> - the size is given as 1; it should be
> (sizeof (arg) + sizeof (int) - 1) / sizeof (int)
> because the "size" is defined as a number of int arguments
> - it won't work anyway; makecontext () is defined to work only for
> integer parameters. It is not possible to pass a pointer as
> integers on x86_64, which uses registers to pass the first 6
> integer or pointer parameters.
Are we still talking about IRIX?
http://nixdoc.net/man-pages/IRIX/man3c/makecontext.3c.html
I can't find any of mentioned limitations in the manual.
Just the opposite: "the arguments that follow the argc parameter for
makecontext are restricted to longs and pointers only".
Best regards,
Mike
------------------------------
_______________________________________________
stunnel-users mailing list
stunnel-users(a)mirt.net
http://stunnel.mirt.net/mailman/listinfo/stunnel-users
End of stunnel-users Digest, Vol 18, Issue 19
*********************************************
2
1
Can anybody tell me if it's possible for stunnel to act as a local
web proxy that simply encrypts my outgoing HTTP traffic and decrypts
it on the way back in? Specifically is it still possible to block
urls at the hosting provider with this approach and is all my
browsing then safe from prying eyes? What I want is along the lines
of a VPN solution but it sounds like stunnel can at least take care
of my HTTP needs.
1
0