Hi,
I am using stunnel 4.15 on Windows XP SP1 with Mozilla Thunderbird as
the e-mail client. I do not have openSSL installed locally. I do have
the libssl32.dll and libeay32.dll in the same directory as stunnel.exe
(C:\Program Files\stunnel). I am running stunnel as a service.
Stunnel crashes when I use it to send e-mail (SMTP via TLS) via gmail.
According to the e-mail client configuration page on the gmail website
http://mail.google.com/support/bin/answer.py?answer=13287&topic=1555
I tried to use SMTP over TLS to connect to smtp.gmail.com:587
My gmail-smtps block in stunnel.conf was
; SMTP service, listens on localhost:250
[gmail-smtps]
protocol=smtp
accept=localhost:250
connect=smtp.gmail.com:587
On trying to send an e-mail message via the above configuration stunnel
crashed. The log file is as follows
2006.06.14 03:17:15 LOG5[3956:3512]: stunnel 4.15 on x86-pc-mingw32-gnu
with OpenSSL 0.9.7i 14 Oct 2005
2006.06.14 03:17:15 LOG5[3956:3512]: Threading:WIN32 SSL:ENGINE
Sockets:SELECT,IPv6
2006.06.14 03:17:15 LOG5[3956:3600]: No limit detected for the number of
clients
2006.06.14 03:17:15 LOG7[3956:3600]: FD 172 in non-blocking mode
2006.06.14 03:17:15 LOG7[3956:3600]: SO_REUSEADDR option set on accept
socket
2006.06.14 03:17:15 LOG7[3956:3600]: gmail-pop3s bound to 127.0.0.1:1100
2006.06.14 03:17:15 LOG7[3956:3600]: FD 180 in non-blocking mode
2006.06.14 03:17:15 LOG7[3956:3600]: SO_REUSEADDR option set on accept
socket
2006.06.14 03:17:15 LOG7[3956:3600]: gmail-smtps bound to 127.0.0.1:250
....# info about other mail connections
2006.06.14 03:17:26 LOG7[3956:3600]: gmail-smtps accepted FD=236 from
127.0.0.1:3665
2006.06.14 03:17:26 LOG7[3956:3600]: Creating a new thread
2006.06.14 03:17:26 LOG7[3956:3600]: New thread created
2006.06.14 03:17:26 LOG7[3956:2812]: gmail-smtps started
2006.06.14 03:17:26 LOG7[3956:2812]: FD 236 in non-blocking mode
2006.06.14 03:17:26 LOG7[3956:2812]: TCP_NODELAY option set on local socket
2006.06.14 03:17:26 LOG5[3956:2812]: gmail-smtps connected from
127.0.0.1:3665
2006.06.14 03:17:26 LOG7[3956:2812]: FD 268 in non-blocking mode
2006.06.14 03:17:26 LOG7[3956:2812]: gmail-smtps connecting
64.233.167.111:587
2006.06.14 03:17:26 LOG7[3956:2812]: connect_wait: waiting 10 seconds
2006.06.14 03:17:26 LOG7[3956:2812]: connect_wait: connected
2006.06.14 03:17:26 LOG7[3956:2812]: Remote FD=268 initialized
2006.06.14 03:17:26 LOG7[3956:2812]: TCP_NODELAY option set on remote socket
2006.06.14 03:17:26 LOG5[3956:2812]: Negotiations for smtp (client side)
started
2006.06.14 03:17:26 LOG7[3956:2812]: <- 220 mx.gmail.com ESMTP
w66sm450524pyw
2006.06.14 03:17:26 LOG7[3956:2812]: -> 220 mx.gmail.com ESMTP
w66sm450524pyw
<logfile ends>
What mistake am I making?
Fortunately it seems that gmail supports SMTP over SSL too
(smtp.gmail.com:465) and I am using that. However I am also facing this
problem with another account which unfortunately allows SMTP only over TLS.
Thanks,
Shatadal.
---
avast! Antivirus: Outbound message clean.
Virus Database (VPS): 0624-1, 06/13/2006
Tested on: 6/14/2006 6:22:04 AM
avast! - copyright (c) 2000-2006 ALWIL Software.
http://www.avast.com
_________________________________________________________________
Is your PC infected? Get a FREE online computer virus scan from McAfee®
Security. http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963
2
1
Mike,
I've created a self-signed certificate on my Windows test box using
OpenSSL 0.9.7j (the version from Shining Light).
I created the key file with the following command:
"openssl genrsa 1024 > \host.key
Here is the command I used to create the self-signed cert:
"openssl req -new -x509 -nodes -sha1 -days 9999 -key \host.key >
\host.cert"
I then copied the key/cert to the appropriate file in the stunnel
directory.
I then copied the cert to the Solaris server and included it with all
other client certs.
Here is the Windows configuration file:
;
;CLIENT-ONLY stunnel configuration file
;
client = yes
cert = C:\Program Files\stunnel\stunnel.pem-client-certificate
CAfile = C:\Program Files\stunnel\stunnel.pem-server-certificate
;chroot = /var/run/stunnel
;pid = /usr/local/var/run/stunnel/stunnel.pid
;setuid = stunnel
;setgid = stunnel
verify = 3
;foreground = yes
debug = 7
output = C:\Program Files\stunnel\stunnel.log
[5140]
accept = 127.0.0.1:514
connect = 172.17.99.143:5140
Here is the Solaris configuration file:
;
;SERVER-ONLY stunnel configuration file
;
cert = /usr/local/etc/stunnel/stunnel.pem-server-certificate
CAfile = /usr/local/etc/stunnel/stunnel.pem-all-client-certificates
;chroot = /var/run/stunnel
;pid = /var/run/stunnel/run/stunnel.pid
;setuid = stunnel
;setgid = stunnel
verify = 3
;foreground = yes
debug = 7
output=/stunnel.log
[5140]
accept = 172.17.99.143:5140
connect = 127.0.0.1:514
The following happens on the Windows box when I first launch stunnel:
2006.06.30 09:51:31 LOG5[516:360]: stunnel 4.15 on x86-pc-mingw32-gnu
with OpenSSL 0.9.7i 14 Oct 2005
2006.06.30 09:51:31 LOG5[516:360]: Threading:WIN32 SSL:ENGINE
Sockets:SELECT,IPv6
2006.06.30 09:51:31 LOG5[516:392]: No limit detected for the number of
clients
2006.06.30 09:51:31 LOG7[516:392]: FD 1904 in non-blocking mode
2006.06.30 09:51:31 LOG7[516:392]: SO_REUSEADDR option set on accept
socket
2006.06.30 09:51:31 LOG7[516:392]: 5140 bound to 127.0.0.1:514
Nothing happens on the Solaris box.
When I start EventReporter, the following happens, in a continuous loop
(until I stop EventReporter):
2006.06.30 10:16:26 LOG7[296:700]: 5140 accepted FD=156 from
127.0.0.1:1154
2006.06.30 10:16:26 LOG7[296:700]: Creating a new thread
2006.06.30 10:16:26 LOG7[296:700]: New thread created
2006.06.30 10:16:27 LOG7[296:1204]: 5140 started
2006.06.30 10:16:27 LOG7[296:1204]: FD 156 in non-blocking mode
2006.06.30 10:16:27 LOG5[296:1204]: 5140 connected from 127.0.0.1:1154
2006.06.30 10:16:27 LOG7[296:1204]: FD 188 in non-blocking mode
2006.06.30 10:16:27 LOG7[296:1204]: 5140 connecting 172.17.99.143:5140
2006.06.30 10:16:27 LOG7[296:1204]: connect_wait: waiting 10 seconds
2006.06.30 10:16:27 LOG7[296:1204]: connect_wait: connected
2006.06.30 10:16:27 LOG7[296:1204]: Remote FD=188 initialized
2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): before/connect
initialization
2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 write
client hello A
2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 read
server hello A
2006.06.30 10:16:27 LOG5[296:1204]: VERIFY OK: depth=0,
/C=CA/ST=ONTARIO/L=TORONTO/O=BANK OF MONTREAL/OU=LMG-DTS/CN=jdb2u10
2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 read
server certificate A
2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 read
server certificate request A
2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 read
server done A
2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 write
client certificate A
2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 write
client key exchange A
2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 write
certificate verify A
2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 write
change cipher spec A
2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 write
finished A
2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 flush
data
2006.06.30 10:16:27 LOG3[296:1204]: SSL_connect: Peer suddenly
disconnected
2006.06.30 10:16:27 LOG5[296:1204]: Connection reset: 0 bytes sent to
SSL, 0 bytes sent to socket
2006.06.30 10:16:27 LOG7[296:1204]: 5140 finished (0 left)
On the Solaris box, here is the matching entry, also in a continuous
loop:
2006.06.30 10:16:47 LOG7[1214:1]: 5140 accepted FD=2 from
172.17.99.150:1155
2006.06.30 10:16:47 LOG7[1214:800]: 5140 started
2006.06.30 10:16:47 LOG7[1214:800]: FD 2 in non-blocking mode
2006.06.30 10:16:47 LOG5[1214:800]: 5140 connected from
172.17.99.150:1155
2006.06.30 10:16:47 LOG7[1214:800]: SSL state (accept): before/accept
initialization
2006.06.30 10:16:47 LOG7[1214:800]: SSL state (accept): SSLv3 read
client hello A
2006.06.30 10:16:47 LOG7[1214:800]: SSL state (accept): SSLv3 write
server hello A
2006.06.30 10:16:47 LOG7[1214:800]: SSL state (accept): SSLv3 write
certificate A
2006.06.30 10:16:47 LOG7[1214:800]: SSL state (accept): SSLv3 write
certificate request A
2006.06.30 10:16:47 LOG7[1214:800]: SSL state (accept): SSLv3 flush data
2006.06.30 10:16:48 LOG4[1214:800]: VERIFY ERROR: depth=0, error=self
signed certificate:
/C=CA/ST=ONTARIO/L=TORONTO/O=BMO/OU=LMG-DTS/CN=jdb1winxp
2006.06.30 10:16:48 LOG7[1214:800]: SSL alert (write): fatal: bad
certificate
2006.06.30 10:16:48 LOG3[1214:800]: SSL_accept: 140890B2:
error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate
returned
2006.06.30 10:16:48 LOG5[1214:800]: Connection reset: 0 bytes sent to
SSL, 0 bytes sent to socket
2006.06.30 10:16:48 LOG7[1214:800]: 5140 finished (1 left)
It appears the server cert is ok, but "something" is wrong with the
client (Windows box) cert.
Any chance you could post the command used in the "make install" to kick
off the creation of the self-signed cert on Unix? I grep'd for it, but
couldn't find it.
Regards,
John Boxall
1
0
In modifying stunnel to work with the OpenSSL FIPS-certified module, I
found out that private keys cannot be in the default OpenSSL format;
they must be in PKCS8 format (due to the MD5 algorithm being disabled
in FIPS mode).
Talking to Dr. Henson of the OpenSSL group I was able to convert my
private keys from the default format to PKCS8, but I found that
stunnel was not able to handle these keys. I got the following error
output (note that server.pem contains a PKCS8 private key and a PKCS7
public cert):
2006.06.08 17:49:38 LOG7[1120:616]: Certificate: server.pem
2006.06.08 17:49:38 LOG7[1120:616]: Key file: server.pem
2006.06.08 17:49:42 LOG3[1120:616]: error stack: 140B3009 :
error:140B3009:SSL routines:SSL_CTX_use_RSAPrivateKey_file:PEM lib
2006.06.08 17:49:42 LOG3[1120:616]: error stack: 906700D :
error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1 lib
2006.06.08 17:49:42 LOG3[1120:616]: error stack: 2306A075 :
error:2306A075:PKCS12 routines:PKCS12_DECRYPT_D2I:pkcs12 pbe crypt
error
2006.06.08 17:49:42 LOG3[1120:616]: error stack: 23077073 :
error:23077073:PKCS12 routines:PKCS12_pbe_crypt:pkcs12 algor
cipherinit error
2006.06.08 17:49:42 LOG3[1120:616]: SSL_CTX_use_RSAPrivateKey_file:
6074079: error:06074079:digital envelope
routines:EVP_PBE_CipherInit:unknown pbe algorithm
2006.06.08 17:49:42 LOG3[1120:616]: Server is down
Continuing with Dr. Henson, he informed me that this ssl error output
meant that "the PBE table has not been initialized in the
application". I corrected this by adding a call to
OpenSSL_add_all_algorithms() into ssl_init() in ssl.c. This fixed my
error with the PEM files.
I am posting this so that this bug may be fixed for the next stunnel
release. Additionally, I'd like verification that my fix makes sense
given the structure of the stunnel code. From doing some searches in
the stunnel source, I could not find any existing code that
initialized the PBE table so adding the call to ssl_init() made sense
_to me_. Michal: do you agree?
2
1
Michal, et al,
When attempting to connect from a Windows box to a Solaris box (as the
server), the Solaris stunnel log (debug = 7) shows that the certificate
on the Windows box (included with the download) has expired. I can
connect from a Solaris 9 client box with no problems.
The Solaris box is running as an NTP client to an internal NTP server.
The Windows box isn't logged into a domain, but the time is within 5
minutes of the Solaris box.
Solaris server:
Solaris 9 (2004/09, no patches)
OpenSSL 0.9.8a
Stunnel 4.15
Application:
Syslog-ng 1.6.11 (working fine on a client
Solaris 9 box)
Windows client:
Windows XP
Stunnel 4.15
Application:
EventReporter 8.0.268/8.0.219
stunnel.conf: (borrowed and modified from a Solaris client box)
;
;CLIENT-ONLY stunnel configuration file
;
client = yes
cert = C:\Program Files\stunnel\stunnel.pem-client-certificate
CAfile = C:\Program Files\stunnel\stunnel.pem-server-certificate
;chroot = /var/run/stunnel
;pid = /usr/local/var/run/stunnel/stunnel.pid
;setuid = stunnel
;setgid = stunnel
verify = 3
;foreground = yes
debug = 7
output = C:\Program Files\stunnel\stunnel.log
[5140]
accept = 127.0.0.1:514
connect = 192.168.0.143:5140
If the certificate has truly expired, could you post a new one? If not,
any suggestions?
Regards,
John Boxall
2
1
29 Jun '06
Surely. Here are the contents of the patch file for vs.mak.
>cat 4.15-MSVC2005.patch
diff -cr stunnel-4.15-orig/src/vc.mak stunnel-4.15/src/vc.mak
*** stunnel-4.15-orig/src/vc.mak Sat Jan 21 10:17:32 2006
--- stunnel-4.15/src/vc.mak Thu Jun 29 17:31:43 2006
***************
*** 1,2 ****
! # makefile for VC is not ready...
--- 1,42 ----
! # Simple Makefile.w32 for stunnel.exe by Michal Trojnara 1998-2006
! #
! # Modified by David Gillingham (dgillingham(a)gmail.com) for Visual
! # Studio
+ # Modify this to point to your actual openssl compile directory
+ # (You did already compile openssl, didn't you???)
+ SSLDIR=..\openssl-0.9.7j
+
+ OBJS=stunnel.obj ssl.obj ctx.obj file.obj client.obj protocol.obj \
+ sthreads.obj log.obj options.obj network.obj resolver.obj \
+ gui.obj
+
+ CC=cl
+ CFLAGS=-MD -W3 -Ox -O2 -Ob2 -Gs0 -GF -Gy -GL -nologo \
+ -I"$(SSLDIR)\inc32" $(DEFINES)
+ DEFINES=-DUSE_WIN32 -D_CRT_SECURE_NO_DEPRECATE \
+ -D_CRT_NONSTDC_NO_DEPRECATE -DHAVE_GETADDRINFO \
+ -DHAVE_GETNAMEINFO -D_MBCS
+
+ LINK=link
+ LDFLAGS=-INCREMENTAL:NO -NOLOGO -SUBSYSTEM:WINDOWS -OPT:REF \
+ -OPT:ICF -LTCG -MACHINE:X86 -ERRORREPORT:PROMPT
+ LIBS=-LIBPATH:"$(SSLDIR)\out32dll" wsock32.lib ssleay32.lib \
+ libeay32.lib user32.lib gdi32.lib shell32.lib comdlg32.lib \
+ advapi32.lib
+
+ all: stunnel.exe
+
+ clean:
+ del $(OBJS) resources.res
+ del *.manifest
+ del stunnel.exe
+
+ stunnel.exe: $(OBJS) resources.res
+ $(LINK) $(LDFLAGS) $(LIBS) -OUT:$@ $**
+ IF EXIST [email protected] mt -nologo -manifest [email protected] -outputresource:$@;1
+
+ resources.res: resources.rc resources.h stunnel.ico
+ rc -fo $@ resources.rc
+
+ $(OBJS): *.h vc.mak
On 6/29/06, Michal Trojnara <Michal.Trojnara(a)mobi-com.net> wrote:
>
> That's possible. Could you prepare a patch with a minimal set of
> changes (not including anything needed to build those Unix-specific files?).
1
0
All--
I have created a patch that will allow stunnel 4.15 to be built with
Visual Studio 2005's command line environment. I have only tested it
with VS2k5, but it should work for all Visual Studio .NET versions
(that is, VS 7.0 or later).
After you apply this patch to the source tree, you will need to run
the makefile from a Visual Studio Command prompt
(Start->Programs->Visual Studio->Visual Studio Tools->Visual Studio
Command Prompt). From there, change the working directory to the
stunnel\src folder and execute the command "nmake -f vs.mak all".
After the build process has completed, you will have a working
stunnel.exe.
This patch will modify vc.mak to a working makefile for nmake
(mimicing the basic structure of mingw.mak), common.h to include a
couple missing headers for the I/O functions in pty.c, and env.c to
include the winsock headers under the Win32 environment (replicating
how it was done in common.h).
This patch that is a result of internal testing/development I've done
here at work and am releasing it to this list (and the stunnel
developers) so that these changes could possibly be included in future
stunnel releases. To the stunnel devs: if there's any additional work
that can be done to get this integrated by the next release, just
mention it.
The other day, I tried sending the patch to the list as an attachment,
but my message never showed up on either the mirt.net or google groups
mirrors. I can only assume it was rejected because of the attachment.
What follows is the full text of my patch file.
> cat 4.15-MSVC2005.patch
diff -cr stunnel-4.15-orig/src/common.h stunnel-4.15/src/common.h
*** stunnel-4.15-orig/src/common.h Fri Mar 10 08:54:56 2006
--- stunnel-4.15/src/common.h Fri Jun 23 21:41:00 2006
***************
*** 153,158 ****
--- 153,164 ----
#endif
#include <windows.h>
+ /* include Visual Studio headers needed for I/O manipulation */
+ #ifdef _MSC_VER
+ #include <io.h>
+ #include <fcntl.h>
+ #endif
+
#define ECONNRESET WSAECONNRESET
#define ENOTSOCK WSAENOTSOCK
#define ENOPROTOOPT WSAENOPROTOOPT
diff -cr stunnel-4.15-orig/src/env.c stunnel-4.15/src/env.c
*** stunnel-4.15-orig/src/env.c Sat Jan 7 13:47:36 2006
--- stunnel-4.15/src/env.c Mon Jun 26 21:11:25 2006
***************
*** 31,45 ****
/* getpeername() can't be declared in the following includes */
#define getpeername no_getpeername
#include <sys/types.h>
#include <sys/socket.h> /* for AF_INET */
#include <netinet/in.h>
#include <arpa/inet.h> /* for inet_addr() */
#include <stdlib.h> /* for getenv() */
#ifdef __BEOS__
#include <be/bone/arpa/inet.h> /* for AF_INET */
#include <be/bone/sys/socket.h> /* for AF_INET */
- #else
- #include <sys/socket.h> /* for AF_INET */
#endif
#undef getpeername
--- 31,52 ----
/* getpeername() can't be declared in the following includes */
#define getpeername no_getpeername
#include <sys/types.h>
+ #ifdef USE_WIN32
+ #ifdef _WIN32_WCE
+ #include <winsock.h>
+ #else
+ #include <winsock2.h>
+ #include <ws2tcpip.h>
+ #endif /* _WIN32_WCE */
+ #else /* USE_WIN32 */
#include <sys/socket.h> /* for AF_INET */
#include <netinet/in.h>
#include <arpa/inet.h> /* for inet_addr() */
+ #endif /* USE_WIN32 */
#include <stdlib.h> /* for getenv() */
#ifdef __BEOS__
#include <be/bone/arpa/inet.h> /* for AF_INET */
#include <be/bone/sys/socket.h> /* for AF_INET */
#endif
#undef getpeername
diff -cr stunnel-4.15-orig/src/vc.mak stunnel-4.15/src/vc.mak
*** stunnel-4.15-orig/src/vc.mak Sat Jan 21 10:17:32 2006
--- stunnel-4.15/src/vc.mak Tue Jun 27 21:02:15 2006
***************
*** 1,2 ****
! # makefile for VC is not ready...
--- 1,45 ----
! # Simple Makefile.w32 for stunnel.exe by Michal Trojnara 1998-2006
! #
! # Modified by David Gillingham (dgillingham(a)gmail.com) for Visual
! # Studio
!
! # Modify this to point to your actual openssl compile directory
! # (You did already compile openssl, didn't you???)
! SSLDIR=..\..\openssl-0.9.7j
!
! DEFINES=-DUSE_WIN32 -D_CRT_SECURE_NO_DEPRECATE \
! -D_CRT_NONSTDC_NO_DEPRECATE -DHAVE_GETADDRINFO \
! -DHAVE_GETNAMEINFO -D_MBCS
! CC=cl
! CFLAGS=-MD -W3 -Ox -O2 -Ob2 -Gs0 -GF -Gy -GL -nologo \
! -I"$(SSLDIR)\inc32" $(DEFINES)
!
! LINK=link
! LDFLAGS=-INCREMENTAL:NO -NOLOGO -SUBSYSTEM:WINDOWS -OPT:REF \
! -OPT:ICF -LTCG -MACHINE:X86 -ERRORREPORT:PROMPT
! LIBS=-LIBPATH:"$(SSLDIR)\out32dll" wsock32.lib ssleay32.lib \
! libeay32.lib user32.lib gdi32.lib shell32.lib comdlg32.lib \
! advapi32.lib
!
! OBJS=stunnel.obj ssl.obj ctx.obj file.obj client.obj protocol.obj \
! sthreads.obj log.obj options.obj network.obj resolver.obj \
! gui.obj
!
!
! all: stunnel.exe
!
! clean:
! del $(OBJS) resources.res
! del *.manifest
! del stunnel.exe
!
! stunnel.exe: $(OBJS) resources.res
! $(LINK) $(LDFLAGS) $(LIBS) -OUT:$@ $**
! IF EXIST [email protected] mt -manifest [email protected] -outputresource:$@;1
!
! resources.res: resources.rc resources.h stunnel.ico
! rc /fo $@ resources.rc
!
! $(OBJS): $*.c *.h
! $(CC) $(CFLAGS) -c $*.c
2
1
I'm trying to run stunnel in proxy mode, to accept connections on port
443, and forward them to an application listening at port 9999 on the
same box. I believe I have the configuration correct, but I'm
obviously overlooking something.
Environment:
stunnel 4.15 on sparc-sun-solaris2.9 with OpenSSL 0.9.7g 11 Apr 2005
I have built an stunnel.conf file, and a stunnel.pem file which are
located in the correct place with the right permissions. I verified
that by moving or changing permissions and seeing that errors were
produced. I've changed the debug level to 7, and the following
information is displayed when I try to start stunnel:
cert# stunnel
2006.06.28 13:01:14 LOG7[9088:1]: Snagged 64 random bytes from /users/dave/.rnd
2006.06.28 13:01:14 LOG7[9088:1]: Wrote 1024 new random bytes to
/users/dave/.rnd
2006.06.28 13:01:14 LOG7[9088:1]: RAND_status claims sufficient
entropy for the PRNG
2006.06.28 13:01:14 LOG6[9088:1]: PRNG seeded successfully
2006.06.28 13:01:14 LOG7[9088:1]: Certificate:
/usr/local/etc/stunnel/stunnel.pem
2006.06.28 13:01:14 LOG7[9088:1]: Key file: /usr/local/etc/stunnel/stunnel.pem
2006.06.28 13:01:14 LOG7[9088:1]: Verify directory set to /
2006.06.28 13:01:14 LOG5[9088:1]: Peer certificate location /
2006.06.28 13:01:14 LOG7[9088:1]: SSL context initialized for service test
cert#
Same thing if I run it as stunnel stunnel.conf -fd
The prompt comes back immediately, ps -ef shows no stunnel running,
and nothing is answering on port 443 which is where I'm telling it to
listen:
stunnel.conf file:
cert = /usr/local/etc/stunnel/stunnel.pem
chroot = /usr/local/etc/stunnel
# PID is created inside chroot jail
pid = /pid/stunnel.pid
#setuid = nobody
#setgid = nogroup
# Authentication stuff
verify = 3
# don't forget about c_rehash CApath
# it is located inside chroot jail:
CApath = /
# Some debugging stuff
debug = 7
output = stunnel.log
# Use it for client mode
client = no
# Service-level configuration
[test]
accept = 127.0.0.1:443
connect = 127.0.0.1:9999
#TIMEOUTclose = 0
---end stunnel.conf file---
The pem files are located in the same directory as the stunnel.conf,
hence the "/" for the pathname above.
What am I overlooking please?
1
0
Hi All,
I am looking at a problem and found the system is
using stunnel with web server. From my google search I
have understood that stunnel is used to make the
application SSL enable. Please validate my
understanding.
I found following stunnel.cfg file in properties
directory
Port0
Enabled=0
ExternalPort=0
LocalPort=0
SSLEnabled=0
UDP=0
Port1
Enabled=1
ExternalPort=1500
LocalPort=10080
SSLEnabled=0
Port2
Enabled=0
ExternalPort=1600
LocalPort=10080
SSLEnabled=1
------------------------------------------------------
I have the following questions:
1] what is the meaning of ExternalPort and LocalPort ?
How does these ports relate with each other?
Please help me in understanding this configuration
file.
Thanks,
Dheeraj
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
1
0
I'd really like to get this working, but I'm not sure what other information you
require? All other posts on this subject refer to making sure zlib is included
when openssl is compiled. Well, I've confirmed that it is.
Would a strace of stunnel attempting to start up help?
FYI - The output of stunnel -version displays...
stunnel 4.15 on i686-pc-linux-gnu with OpenSSL 0.9.7a Feb 19 2003
Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Auth:LIBWRAP
Could someone please provide me with some suggestions.
Thanks very much.
On Mon, 26 Jun 2006 13:09:36 , <ahall(a)madasafish.com> sent:
>OK - after checking the OpenSSL src-rpm I can confirm that zlib is compiled...
>
>./Configure \
> --prefix=%{_prefix} --openssldir=%{_datadir}/ssl ${sslflags} \
> zlib no-idea no-mdc2 no-rc5 no-ec shared \
> --with-krb5-flavor=MIT \
> -I%{_prefix}/kerberos/include -L%{_prefix}/kerberos/%{_lib} \
> ${sslarch}
>
>Any ideas why the "compression=zlib" option still produces the "Failed to add
>zlib compression method" error?
>
>Thanks very much.
>
>
>>On Fri, 23 Jun 2006 17:01:24 , ahall(a)madasafish.com> sent:
>>
>>>Hi there,
>>>
>>>When I try to enable zlib compression at the server I get this error when
>>>starting it up...
>>>
>>>2006.06.23 15:44:39 LOG3[3426:3086293504]: Failed to add zlib compression method
>>>
>>>How do I get zlib to work? Do I need to compile OpenSSL with zlib?
>>>
>>>I'm using Fedora Core 3 with stunnel-4.15, and OpenSSL and zlib are from RPM's.
>>>
>>>Thanks very much.
>
>---- - Madasafish - Voted Best Heavy Consumer Broadband Provider in the 2006
Internet Industry Awards http://www.madasafish.com/
---- - Madasafish - Voted Best Heavy Consumer Broadband Provider in the 2006 Internet Industry Awards http://www.madasafish.com/
1
0
Attached is a patch for stunnel 4.15 that allows the source to be
built under Microsoft Visual Studio 2005. Here's a rundown of what's
been changed:
In common.h, I included io.h and fcntl.h so that pty.c would build
without error. In env.c, I included the winsock headers (replicating
how it was done for common.h), and removed a duplicate include of
sys/socket.h. The latter change wasn't necessary for compiliation
with MSVC, but I thought I'd remove what looked like an unncessary
line.
To get stunnel to build without warning, I defined the following
preprocessor definitions:
USE_WIN32
_CRT_SECURE_NO_DEPRECATE
_CRT_NONSTDC_NO_DEPRECATE
HAVE_GETADDRINFO
HAVE_GETNAMEINFO
_MBCS
Later in the week, I'll post a patch to vs.mak to automate the build
process (I'm still building with a solution file at the moment).
To the stunnel developers: If there's anything extra I can do to
ensure these changes are incorporated into the next release, please
let me know.
1
0