I have a winXP machine which should connect to a linux samba.
Everything installed following
http://wiki.netbsd.se/index.php/How_to_secure_samba_with_stunnel
but it don't connect. I have both loglevels set to 7, and as serverlog
don't change I thing the error is at clientside.
stunnel.conf is:
client=yes
debug = 7
[smb]
accept=222.222.222.222:139
connect=85.48.253.144:8888
And the client log is:
2007.11.27 12:46:58 LOG7[3716:720]: RAND_status claims sufficient
entropy for the PRNG
2007.11.27 12:46:58 LOG7[3716:720]: PRNG seeded successfully
2007.11.27 12:46:58 LOG7[3716:720]: Certificate: stunnel.pem
2007.11.27 12:46:58 LOG7[3716:720]: Certificate loaded
2007.11.27 12:46:58 LOG7[3716:720]: Key file: stunnel.pem
2007.11.27 12:46:58 LOG7[3716:720]: Private key loaded
2007.11.27 12:46:58 LOG7[3716:720]: SSL context initialized for service smb
2007.11.27 12:46:58 LOG5[3716:720]: stunnel 4.21 on x86-pc-mingw32-gnu
with OpenSSL 0.9.8g 19 Oct 2007
2007.11.27 12:46:58 LOG5[3716:720]: Threading:WIN32 SSL:ENGINE
Sockets:SELECT,IPv6
2007.11.27 12:46:58 LOG5[3716:3292]: No limit detected for the number
of clients
2007.11.27 12:46:59 LOG7[3716:3292]: FD 216 in non-blocking mode
2007.11.27 12:46:59 LOG7[3716:3292]: SO_REUSEADDR option set on accept socket
2007.11.27 12:46:59 LOG7[3716:3292]: smb bound to 222.222.222.222:139
2007.11.27 12:47:15 LOG7[3716:3292]: smb accepted FD=248 from
88.31.107.217:1625
2007.11.27 12:47:15 LOG7[3716:3292]: Creating a new thread
2007.11.27 12:47:15 LOG7[3716:3292]: New thread created
2007.11.27 12:47:15 LOG7[3716:4028]: smb started
2007.11.27 12:47:15 LOG7[3716:4028]: FD 248 in non-blocking mode
2007.11.27 12:47:15 LOG7[3716:4028]: TCP_NODELAY option set on local socket
2007.11.27 12:47:15 LOG5[3716:4028]: smb accepted connection from
88.31.107.217:1625
2007.11.27 12:47:15 LOG7[3716:4028]: FD 272 in non-blocking mode
2007.11.27 12:47:15 LOG7[3716:4028]: smb connecting 85.48.253.144:8888
2007.11.27 12:47:15 LOG7[3716:4028]: connect_wait: waiting 10 seconds
2007.11.27 12:47:25 LOG7[3716:3292]: smb accepted FD=308 from
88.31.107.217:1628
2007.11.27 12:47:25 LOG7[3716:3292]: Creating a new thread
2007.11.27 12:47:25 LOG7[3716:3292]: New thread created
2007.11.27 12:47:25 LOG7[3716:3012]: smb started
2007.11.27 12:47:25 LOG7[3716:3012]: FD 308 in non-blocking mode
2007.11.27 12:47:25 LOG7[3716:3012]: TCP_NODELAY option set on local socket
2007.11.27 12:47:25 LOG5[3716:3012]: smb accepted connection from
88.31.107.217:1628
2007.11.27 12:47:25 LOG7[3716:3012]: FD 340 in non-blocking mode
2007.11.27 12:47:25 LOG7[3716:3012]: smb connecting 85.48.253.144:8888
2007.11.27 12:47:25 LOG7[3716:3012]: connect_wait: waiting 10 seconds
2007.11.27 12:47:25 LOG6[3716:4028]: connect_wait: s_poll_wait timeout
2007.11.27 12:47:25 LOG5[3716:4028]: Connection reset: 0 bytes sent to
SSL, 0 bytes sent to socket
2007.11.27 12:47:25 LOG7[3716:4028]: smb finished (1 left)
2007.11.27 12:47:35 LOG6[3716:3012]: connect_wait: s_poll_wait timeout
2007.11.27 12:47:35 LOG5[3716:3012]: Connection reset: 0 bytes sent to
SSL, 0 bytes sent to socket
2007.11.27 12:47:35 LOG7[3716:3012]: smb finished (0 left)
Where is the problem?
Thanks
1
1
Dear All,
I am trying to set an https layer using stunnel. I am having problems
with the intermediary certificate since it appears broken to the user.
You may find a screenshot here:
http://u-journal.org/stunnel/Root_Cert_Err.jpg
My stunnel version is: 3.26 running on Debian 3.1
I run stunnel as standalone with this parameters:
stunnel -d 10.123.16.103:443 -D 7 -R /etc/ssl/certs/stunnel.rnd \
-p /etc/ssl/certs/stunnel.pem -o /var/log/stunnel/stunnel.log \
-r 10.123.16.103:80 -N https
You may find the output of my stunnel -V here:
http://pastebin.ca/793495
uname -a: Linux lb2-dp-vm 2.6.8-3-686 #1 Tue Dec 5 21:26:38 UTC 2006
i686 GNU/Linux
openssl version: OpenSSL 0.9.7e 25 Oct 2004
So, if I create my /etc/ssl/certs/stunnel.pem file like this:
-----BEGIN RSA PRIVATE KEY-----
rsa_priv_key
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
secured.behringer.com_certificate
-----END CERTIFICATE-----
-- OR --
-----BEGIN RSA PRIVATE KEY-----
rsa_priv_key
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
secured.behringer.com_certificate
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
VeriSign Intermediate CA Certificate
(https://www.verisign.com.sg/support/ssl/install/intermediate/secure.shtml)
-----END CERTIFICATE-----
I get the mentioned error. If I create the /etc/ssl/certs/stunnel.pem
like this:
-----BEGIN RSA PRIVATE KEY-----
rsa_priv_key
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
VeriSign Intermediate CA Certificate
(https://www.verisign.com.sg/support/ssl/install/intermediate/secure.shtml)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
secured.behringer.com_certificate
-----END CERTIFICATE-----
I get the error:
"[...] X509_check_private_key:key values mismatch"
You may see the log here:
http://pastebin.ca/793500
Any clues on what am I doing wrong?
Thank you so much!
unai
1
1
26 Nov '07
OK,
I took my configs, my certs, etc. and put them on two boxes in the lab - then I ensured I could use stunnel to connect using VNC. I then put a NAT box (Linksys BEFSR81) between the two and configured the Linksys to provide port forwarding. I then reconnected and everything worked first time. Therefore, I can only assume that either port-forwarding is misconfigured on my Watchguard SOHO 6tc -or- that the Windows firewall is causing problems (neither lab box has a firewall running). I'll keep you posted on what I find. Thanks.
Richard
My original post:
I did read through the archives but I cannot determine how to get Stunnel
working through the firewall. Here is what I wish to do:
1. Tunnel Windows Remote Desktop through stunnel.
2. I wish to connect from home to work; I have access to the firewall at
work.
Here's what I've done:
1. Installed stunnel on Windows XP at home and at work. I have self-signed
certificates and am using verify = 3 (on both computers). Cacert.pem has
the CA cert, the work cert, and the home cert in a single file. The
server-cert.pem has the work computer's key and cert while the
client-1-cert.pem (home computer) has it's own key and cert.
2. Stunnel at home has client = yes, stunnel at work has this commented
out. Stunnel at work will become a "server" where multiple clients connect
via stunnel and that single computer makes multiple RDP connections.
Client (home) computer has
[rdp1]
accept = 4391
connect = <work outside interface IP>:44391
Server (work) computer has
[rdp2]
accept = 44391
connect = <work computer name>:3392
If I try this at work from within the corporate network (change the client
connect string to the stunnel server's IP or hostname), then everything
works fine. However, once I try from outside the work network, nothing
works. Firewall is a Watchguard SOHO 6tc and I have a inbound rule
permitting 44391 and directing it to X.X.X.52 (the stunnel server). I also
have other rules allowing RDP (on port 3392 for instance) directly to the
computer I wish to control and those rules work. Essentially, RDP directly
through the firewall works but stunnel through the firewall does not. I
assume there is no traffic destined for .52 on 44391 because the log file on
the server (with debug = 7) only shows the startup sequence and port binding
(netstat -a shows I am listening on 44391). I also tried this at home on my
Juniper 5XT and was unsuccessful. Please help.
Richard
1
0
26 Nov '07
Craig,
Thanks. Are you advising that I put "client = yes" in the service declaration rather than the main configuration? I already have "client = yes" on the client side (in the main configuration) and that line commented out of the server's configuration (I assume the default is client = no).
When I review the log on the client computer, I can see where it times out waiting on a response from the work firewall's outside IP address. I do not see any connection attempts on the server side and both stunnel instances (client and server) have debug = 7 and logging to stunnel.log.
Richard
> -----Original Message-----
> From: stunnel-users-bounces(a)mirt.net [mailto:stunnel-users-
> bounces(a)mirt.net] On Behalf Of Richard Woodman
> Sent: 26 November 2007 07:44 AM
> To: stunnel-users(a)mirt.net
> Subject: [stunnel-users] More questions on RDP and port forwarding
>
> I did read through the archives but I cannot determine how to get
> Stunnel
> working through the firewall. Here is what I wish to do:
>
> 1. Tunnel Windows Remote Desktop through stunnel.
> 2. I wish to connect from home to work; I have access to the firewall
> at
> work.
>
> Here's what I've done:
>
> 1. Installed stunnel on Windows XP at home and at work. I have self-
> signed
> certificates and am using verify = 3 (on both computers). Cacert.pem
> has
> the CA cert, the work cert, and the home cert in a single file. The
> server-cert.pem has the work computer's key and cert while the
> client-1-cert.pem (home computer) has it's own key and cert.
> 2. Stunnel at home has client = yes, stunnel at work has this
> commented
> out. Stunnel at work will become a "server" where multiple clients
> connect
> via stunnel and that single computer makes multiple RDP connections.
>
> Client (home) computer has
>
Try changing the client config to the following:
[rdp1]
client = yes
accept = 4391
connect = <work outside interface IP>:44391
>
> Server (work) computer has
>
> [rdp2]
> accept = 44391
> connect = <work computer name>:3392
>
> If I try this at work from within the corporate network (change the
> client
> connect string to the stunnel server's IP or hostname), then everything
> works fine. However, once I try from outside the work network, nothing
> works. Firewall is a Watchguard SOHO 6tc and I have a inbound rule
> permitting 44391 and directing it to X.X.X.52 (the stunnel server). I
> also
> have other rules allowing RDP (on port 3392 for instance) directly to
> the
> computer I wish to control and those rules work. Essentially, RDP
> directly
> through the firewall works but stunnel through the firewall does not.
> I
> assume there is no traffic destined for .52 on 44391 because the log
> file on
> the server (with debug = 7) only shows the startup sequence and port
> binding
> (netstat -a shows I am listening on 44391). I also tried this at home
> on my
> Juniper 5XT and was unsuccessful. Please help.
>
> Richard
>
>
> _______________________________________________
> stunnel-users mailing list
> stunnel-users(a)mirt.net
> http://stunnel.mirt.net/mailman/listinfo/stunnel-users
Cheers,
Craig
1
0
I did read through the archives but I cannot determine how to get Stunnel
working through the firewall. Here is what I wish to do:
1. Tunnel Windows Remote Desktop through stunnel.
2. I wish to connect from home to work; I have access to the firewall at
work.
Here's what I've done:
1. Installed stunnel on Windows XP at home and at work. I have self-signed
certificates and am using verify = 3 (on both computers). Cacert.pem has
the CA cert, the work cert, and the home cert in a single file. The
server-cert.pem has the work computer's key and cert while the
client-1-cert.pem (home computer) has it's own key and cert.
2. Stunnel at home has client = yes, stunnel at work has this commented
out. Stunnel at work will become a "server" where multiple clients connect
via stunnel and that single computer makes multiple RDP connections.
Client (home) computer has
[rdp1]
accept = 4391
connect = <work outside interface IP>:44391
Server (work) computer has
[rdp2]
accept = 44391
connect = <work computer name>:3392
If I try this at work from within the corporate network (change the client
connect string to the stunnel server's IP or hostname), then everything
works fine. However, once I try from outside the work network, nothing
works. Firewall is a Watchguard SOHO 6tc and I have a inbound rule
permitting 44391 and directing it to X.X.X.52 (the stunnel server). I also
have other rules allowing RDP (on port 3392 for instance) directly to the
computer I wish to control and those rules work. Essentially, RDP directly
through the firewall works but stunnel through the firewall does not. I
assume there is no traffic destined for .52 on 44391 because the log file on
the server (with debug = 7) only shows the startup sequence and port binding
(netstat -a shows I am listening on 44391). I also tried this at home on my
Juniper 5XT and was unsuccessful. Please help.
Richard
3
2
Hi Guys,
I'm very new to Stunnel. In fact I have no
experience with it what so ever. My situation is this: I have server
program and a client at the moment which know nothing about SSL. Yet the
powers that be insist that my two machines, if they must use sockets, do
so using SSL. After reading through the distribution, I found this very
interesting program called Stunnel which sounds like it might solve my
problem quite well. From what I've read so far, I gather this program
can be used as an SSL wrapper for my server and my client. Would some
kind soul please help me with the configuration process (the
configuration file) so that my client and server can be safe and secure?
My server uses a port which I have chosen (really quite arbitrarily).
Basically I need the server to listen on that port and wait for incoming
data which it will processs and in most cases not even reply. With
normal sockets this is a no-brainer since Steven's book outlines it very
well. If I understand the documentation I've read so far, Stunnel adds
the encryption layer on top of that which I need. So how do I configure
and invokestunnel in this environment? Sorry for stupid questions at the
moment I just lack examples like this and confidence in using the
program.
Thanks,
Paul
2
1
Hi,
Since a few months I'm playing with stunnel.
Last month I installed a stunnel at a customer. This week he reported he
could not connect any more. After testing here I discovered the CA cert
had expired. I made this myself and I didn't see that it's only valid
for one month. I made new certificates making sure they are valid for
longer than one month, so this is solved for now.
My question : are there good documents about management of certificates
? I'm specially interested in renewing the certificates.
Regards,
Koenraad Lelong.
2
1
Let me first explain what I want to do in order to see if stunnel is
what I need:
I have some laptops around the world and I want to let them login in my
intranet. The login is versus a Samba server. So more or less the
connection would be:
Laptop (running winXP) --- router --- internet --- router --- linux
ssh server(port 22 open) --- linux samba server
Could stunnel help me achivieng this? any hint of how? I have read the
documentation, but I am a little lost.
thanks
--
<http://www.escoltesiguies.cat>*Lluís Forns - Tècnic Informàtic *
*Servei d'Informàtica*
*Minyons Escoltes i Guies de Catalunya (MEG)*
*Telèfon:* 93 590 27 00
*Fax:* 93 590 04 92
*www.escoltesiguies.cat*
No m'imprimeixis si no és necessari. Protegim el medi ambient.
2
1
I see that you have client = yes in the config file.
When client = yes is set outside the service block, it becomes a global
setting that tells all the services that it should tunnel that they are
clients and not servers.
If you specify the client = yes within a service eg.
[pop3s]
client = yes
accept = 995
connect = 110
then stunnel knows that the specified service alone is a client.
What I recommend is that you disable the client = yes in the global area and
change you config file to something like this:
I have removed the comments to shorten the config for explanation:
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
CRLpath = crls
CRLfile = certnew.pem
debug = 7
output = stunnel.log
;client = yes
[https]
accept = 443
connect = 192.168.0.5:443
TIMEOUTclose = 0
Try using this as your config and see if it works or not.
Cheers
Craig
From: Dan Vespa [mailto:[email protected]]
Sent: 19 November 2007 05:07 PM
To: Craig Retief
Subject: RE: [stunnel-users] Stunnel and Outlook Web Access Problems
Craig,
Here it is....
; Sample stunnel configuration file by Michal Trojnara 2002-2006
; Some options used here may not be adequate for your particular
configuration
; Certificate/key is needed in server mode and optional in client mode
; The default certificate is provided only for testing and should not
; be used in a production environment
;cert = stunnel.pem
;key = stunnel.pem
; Some performance tunings
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
; Workaround for Eudora bug
;options = DONT_INSERT_EMPTY_FRAGMENTS
; Authentication stuff
;verify = 2
; Don't forget to c_rehash CApath
;CApath = crls
; It's often easier to use CAfile
;CAfile = certnew.pem
; Don't forget to c_rehash CRLpath
CRLpath = crls
; Alternatively you can use CRLfile
CRLfile = certnew.pem
; Some debugging stuff useful for troubleshooting
debug = 7
output = stunnel.log
; Use it for client mode
client = yes
; Service-level configuration
;[pop3s]
;accept = 995
;connect = 110
;[imaps]
;accept = 993
;connect = 143
;[ssmtp]
;accept = 465
;connect = 25
[https]
accept = 443
connect = 192.168.0.5:443
TIMEOUTclose = 0
; vim:ft=dosini
_____
From: Craig Retief
Sent: Mon 19/11/2007 9:54 AM
To: 'Dan Vespa'
Cc: stunnel-users(a)mirt.net
Subject: RE: [stunnel-users] Stunnel and Outlook Web Access Problems
Please Post your stunnel configs.
Makes life easier.
Cheers
Craig
From: Dan Vespa [mailto:[email protected]]
Sent: 19 November 2007 03:35 PM
To: Craig
Subject: RE: [stunnel-users] Stunnel and Outlook Web Access Problems
Craig,
I set the debug level higher and this is what my log outputs....
2007.11.19 08:25:54 LOG7[1596:2656]: RAND_status claims sufficient entropy
for the PRNG
2007.11.19 08:25:54 LOG7[1596:2656]: PRNG seeded successfully
2007.11.19 08:25:54 LOG7[1596:2656]: SSL context initialized for service
https
2007.11.19 08:25:54 LOG5[1596:2656]: stunnel 4.21 on x86-pc-mingw32-gnu with
OpenSSL 0.9.8g 19 Oct 2007
2007.11.19 08:25:54 LOG5[1596:2656]: Threading:WIN32 SSL:ENGINE
Sockets:SELECT,IPv6
2007.11.19 08:25:54 LOG5[1596:3012]: No limit detected for the number of
clients
2007.11.19 08:25:54 LOG7[1596:3012]: FD 188 in non-blocking mode
2007.11.19 08:25:54 LOG7[1596:3012]: SO_REUSEADDR option set on accept
socket
2007.11.19 08:25:54 LOG7[1596:3012]: https bound to 0.0.0.0:443
2007.11.19 08:26:32 LOG7[1596:3012]: https accepted FD=236 from
127.0.0.1:1409
2007.11.19 08:26:32 LOG7[1596:3012]: Creating a new thread
2007.11.19 08:26:32 LOG7[1596:3012]: New thread created
2007.11.19 08:26:32 LOG7[1596:2576]: https started
2007.11.19 08:26:32 LOG7[1596:2576]: FD 236 in non-blocking mode
2007.11.19 08:26:32 LOG7[1596:2576]: TCP_NODELAY option set on local socket
2007.11.19 08:26:32 LOG5[1596:2576]: https accepted connection from
127.0.0.1:1409
2007.11.19 08:26:32 LOG7[1596:2576]: FD 260 in non-blocking mode
2007.11.19 08:26:32 LOG7[1596:2576]: https connecting 192.168.0.5:443
2007.11.19 08:26:32 LOG7[1596:2576]: connect_wait: waiting 10 seconds
2007.11.19 08:26:32 LOG7[1596:2576]: connect_wait: connected
2007.11.19 08:26:32 LOG5[1596:2576]: https connected remote server from
192.168.0.24:1410
2007.11.19 08:26:32 LOG7[1596:2576]: Remote FD=260 initialized
2007.11.19 08:26:32 LOG7[1596:2576]: TCP_NODELAY option set on remote socket
2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): before/connect
initialization
2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 write client
hello A
2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 read server
hello A
2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 read server
certificate A
2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 read server
done A
2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 write client
key exchange A
2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 write change
cipher spec A
2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 write
finished A
2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 flush data
2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 read
finished A
2007.11.19 08:26:32 LOG7[1596:2576]: 1 items in the session cache
2007.11.19 08:26:32 LOG7[1596:2576]: 1 client connects (SSL_connect())
2007.11.19 08:26:32 LOG7[1596:2576]: 1 client connects that finished
2007.11.19 08:26:32 LOG7[1596:2576]: 0 client renegotiations requested
2007.11.19 08:26:32 LOG7[1596:2576]: 0 server connects (SSL_accept())
2007.11.19 08:26:32 LOG7[1596:2576]: 0 server connects that finished
2007.11.19 08:26:32 LOG7[1596:2576]: 0 server renegotiations requested
2007.11.19 08:26:32 LOG7[1596:2576]: 0 session cache hits
2007.11.19 08:26:32 LOG7[1596:2576]: 0 session cache misses
2007.11.19 08:26:32 LOG7[1596:2576]: 0 session cache timeouts
2007.11.19 08:26:32 LOG6[1596:2576]: SSL connected: new session negotiated
2007.11.19 08:26:32 LOG6[1596:2576]: Negotiated ciphers: RC4-MD5 SSLv3
Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
2007.11.19 08:26:53 LOG7[1596:3012]: https accepted FD=288 from
127.0.0.1:1411
2007.11.19 08:26:53 LOG7[1596:3012]: Creating a new thread
2007.11.19 08:26:53 LOG7[1596:3012]: New thread created
2007.11.19 08:26:53 LOG7[1596:1060]: https started
2007.11.19 08:26:53 LOG7[1596:1060]: FD 288 in non-blocking mode
2007.11.19 08:26:53 LOG7[1596:1060]: TCP_NODELAY option set on local socket
2007.11.19 08:26:53 LOG5[1596:1060]: https accepted connection from
127.0.0.1:1411
2007.11.19 08:26:53 LOG7[1596:1060]: FD 312 in non-blocking mode
2007.11.19 08:26:53 LOG7[1596:1060]: https connecting 192.168.0.5:443
2007.11.19 08:26:53 LOG7[1596:1060]: connect_wait: waiting 10 seconds
2007.11.19 08:26:53 LOG7[1596:1060]: connect_wait: connected
2007.11.19 08:26:53 LOG5[1596:1060]: https connected remote server from
192.168.0.24:1412
2007.11.19 08:26:53 LOG7[1596:1060]: Remote FD=312 initialized
2007.11.19 08:26:53 LOG7[1596:1060]: TCP_NODELAY option set on remote socket
2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): before/connect
initialization
2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 write client
hello A
2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 read server
hello A
2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 read
finished A
2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 write change
cipher spec A
2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 write
finished A
2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 flush data
2007.11.19 08:26:53 LOG7[1596:1060]: 1 items in the session cache
2007.11.19 08:26:53 LOG7[1596:1060]: 2 client connects (SSL_connect())
2007.11.19 08:26:53 LOG7[1596:1060]: 2 client connects that finished
2007.11.19 08:26:53 LOG7[1596:1060]: 0 client renegotiations requested
2007.11.19 08:26:53 LOG7[1596:1060]: 0 server connects (SSL_accept())
2007.11.19 08:26:53 LOG7[1596:1060]: 0 server connects that finished
2007.11.19 08:26:53 LOG7[1596:1060]: 0 server renegotiations requested
2007.11.19 08:26:53 LOG7[1596:1060]: 1 session cache hits
2007.11.19 08:26:53 LOG7[1596:1060]: 0 session cache misses
2007.11.19 08:26:53 LOG7[1596:1060]: 0 session cache timeouts
2007.11.19 08:26:53 LOG6[1596:1060]: SSL connected: previous session reused
2007.11.19 08:26:53 LOG7[1596:1060]: SSL socket closed on SSL_read
2007.11.19 08:26:53 LOG7[1596:1060]: Socket write shutdown
2007.11.19 08:26:53 LOG5[1596:1060]: Connection closed: 70 bytes sent to
SSL, 164 bytes sent to socket
2007.11.19 08:26:53 LOG7[1596:1060]: https finished (1 left)
2007.11.19 08:27:53 LOG3[1596:2576]: readsocket: Connection reset by peer
(WSAECONNRESET) (10054)
2007.11.19 08:27:53 LOG5[1596:2576]: Connection reset: 1102 bytes sent to
SSL, 1241 bytes sent to socket
2007.11.19 08:27:53 LOG7[1596:2576]: https finished (0 left)
Does this make any sense to you????
Dan
_____
From: Craig
Sent: Mon 19/11/2007 1:34 AM
To: stunnel-users(a)mirt.net
Subject: Re: [stunnel-users] Stunnel and Outlook Web Access Problems
OWA rewrites the URL when you log in and I have found that it causes
problems when doing that with a Stunnel connection.
What I think might be happening is that your initial connection says
http://server.tld/ then when you log in OWA rewrites the URL to
https://server.tld/
What I think is happening is that your stunnel is listening on port 80 and
when you log in, OWA changes the listening port in the browser to port 443.
Try running the listening server (stunnel server) to listen on port 443
instead of port 80 and see if that fixes the problem.
Cheers
Craig
From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]]
On Behalf Of Dan Vespa
Sent: 17 November 2007 07:21 PM
To: stunnel-users(a)mirt.net
Subject: [stunnel-users] Stunnel and Outlook Web Access Problems
I am trying to use the latest version of stunnel to connect to OWA. I set
stunnel to listen on port 80 (localhost) and then connect to myserverip on
port 443. I get the login screen but can go no further after I Enter my
credentials and Click OK. Checking the stunnel log screen it shows that a
connect has been made? I don't understand why It won't connect any further??
OWA is on Exchange Server 2003 and I am using Windows XP SP2. I have also
updated to Open SSL latest version.
Thanks in Advance.
Dan
1
0
Please Post your stunnel configs.
Makes life easier.
Cheers
Craig
From: Dan Vespa [mailto:[email protected]]
Sent: 19 November 2007 03:35 PM
To: Craig
Subject: RE: [stunnel-users] Stunnel and Outlook Web Access Problems
Craig,
I set the debug level higher and this is what my log outputs....
2007.11.19 08:25:54 LOG7[1596:2656]: RAND_status claims sufficient entropy
for the PRNG
2007.11.19 08:25:54 LOG7[1596:2656]: PRNG seeded successfully
2007.11.19 08:25:54 LOG7[1596:2656]: SSL context initialized for service
https
2007.11.19 08:25:54 LOG5[1596:2656]: stunnel 4.21 on x86-pc-mingw32-gnu with
OpenSSL 0.9.8g 19 Oct 2007
2007.11.19 08:25:54 LOG5[1596:2656]: Threading:WIN32 SSL:ENGINE
Sockets:SELECT,IPv6
2007.11.19 08:25:54 LOG5[1596:3012]: No limit detected for the number of
clients
2007.11.19 08:25:54 LOG7[1596:3012]: FD 188 in non-blocking mode
2007.11.19 08:25:54 LOG7[1596:3012]: SO_REUSEADDR option set on accept
socket
2007.11.19 08:25:54 LOG7[1596:3012]: https bound to 0.0.0.0:443
2007.11.19 08:26:32 LOG7[1596:3012]: https accepted FD=236 from
127.0.0.1:1409
2007.11.19 08:26:32 LOG7[1596:3012]: Creating a new thread
2007.11.19 08:26:32 LOG7[1596:3012]: New thread created
2007.11.19 08:26:32 LOG7[1596:2576]: https started
2007.11.19 08:26:32 LOG7[1596:2576]: FD 236 in non-blocking mode
2007.11.19 08:26:32 LOG7[1596:2576]: TCP_NODELAY option set on local socket
2007.11.19 08:26:32 LOG5[1596:2576]: https accepted connection from
127.0.0.1:1409
2007.11.19 08:26:32 LOG7[1596:2576]: FD 260 in non-blocking mode
2007.11.19 08:26:32 LOG7[1596:2576]: https connecting 192.168.0.5:443
2007.11.19 08:26:32 LOG7[1596:2576]: connect_wait: waiting 10 seconds
2007.11.19 08:26:32 LOG7[1596:2576]: connect_wait: connected
2007.11.19 08:26:32 LOG5[1596:2576]: https connected remote server from
192.168.0.24:1410
2007.11.19 08:26:32 LOG7[1596:2576]: Remote FD=260 initialized
2007.11.19 08:26:32 LOG7[1596:2576]: TCP_NODELAY option set on remote socket
2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): before/connect
initialization
2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 write client
hello A
2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 read server
hello A
2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 read server
certificate A
2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 read server
done A
2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 write client
key exchange A
2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 write change
cipher spec A
2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 write
finished A
2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 flush data
2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 read
finished A
2007.11.19 08:26:32 LOG7[1596:2576]: 1 items in the session cache
2007.11.19 08:26:32 LOG7[1596:2576]: 1 client connects (SSL_connect())
2007.11.19 08:26:32 LOG7[1596:2576]: 1 client connects that finished
2007.11.19 08:26:32 LOG7[1596:2576]: 0 client renegotiations requested
2007.11.19 08:26:32 LOG7[1596:2576]: 0 server connects (SSL_accept())
2007.11.19 08:26:32 LOG7[1596:2576]: 0 server connects that finished
2007.11.19 08:26:32 LOG7[1596:2576]: 0 server renegotiations requested
2007.11.19 08:26:32 LOG7[1596:2576]: 0 session cache hits
2007.11.19 08:26:32 LOG7[1596:2576]: 0 session cache misses
2007.11.19 08:26:32 LOG7[1596:2576]: 0 session cache timeouts
2007.11.19 08:26:32 LOG6[1596:2576]: SSL connected: new session negotiated
2007.11.19 08:26:32 LOG6[1596:2576]: Negotiated ciphers: RC4-MD5 SSLv3
Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
2007.11.19 08:26:53 LOG7[1596:3012]: https accepted FD=288 from
127.0.0.1:1411
2007.11.19 08:26:53 LOG7[1596:3012]: Creating a new thread
2007.11.19 08:26:53 LOG7[1596:3012]: New thread created
2007.11.19 08:26:53 LOG7[1596:1060]: https started
2007.11.19 08:26:53 LOG7[1596:1060]: FD 288 in non-blocking mode
2007.11.19 08:26:53 LOG7[1596:1060]: TCP_NODELAY option set on local socket
2007.11.19 08:26:53 LOG5[1596:1060]: https accepted connection from
127.0.0.1:1411
2007.11.19 08:26:53 LOG7[1596:1060]: FD 312 in non-blocking mode
2007.11.19 08:26:53 LOG7[1596:1060]: https connecting 192.168.0.5:443
2007.11.19 08:26:53 LOG7[1596:1060]: connect_wait: waiting 10 seconds
2007.11.19 08:26:53 LOG7[1596:1060]: connect_wait: connected
2007.11.19 08:26:53 LOG5[1596:1060]: https connected remote server from
192.168.0.24:1412
2007.11.19 08:26:53 LOG7[1596:1060]: Remote FD=312 initialized
2007.11.19 08:26:53 LOG7[1596:1060]: TCP_NODELAY option set on remote socket
2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): before/connect
initialization
2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 write client
hello A
2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 read server
hello A
2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 read
finished A
2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 write change
cipher spec A
2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 write
finished A
2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 flush data
2007.11.19 08:26:53 LOG7[1596:1060]: 1 items in the session cache
2007.11.19 08:26:53 LOG7[1596:1060]: 2 client connects (SSL_connect())
2007.11.19 08:26:53 LOG7[1596:1060]: 2 client connects that finished
2007.11.19 08:26:53 LOG7[1596:1060]: 0 client renegotiations requested
2007.11.19 08:26:53 LOG7[1596:1060]: 0 server connects (SSL_accept())
2007.11.19 08:26:53 LOG7[1596:1060]: 0 server connects that finished
2007.11.19 08:26:53 LOG7[1596:1060]: 0 server renegotiations requested
2007.11.19 08:26:53 LOG7[1596:1060]: 1 session cache hits
2007.11.19 08:26:53 LOG7[1596:1060]: 0 session cache misses
2007.11.19 08:26:53 LOG7[1596:1060]: 0 session cache timeouts
2007.11.19 08:26:53 LOG6[1596:1060]: SSL connected: previous session reused
2007.11.19 08:26:53 LOG7[1596:1060]: SSL socket closed on SSL_read
2007.11.19 08:26:53 LOG7[1596:1060]: Socket write shutdown
2007.11.19 08:26:53 LOG5[1596:1060]: Connection closed: 70 bytes sent to
SSL, 164 bytes sent to socket
2007.11.19 08:26:53 LOG7[1596:1060]: https finished (1 left)
2007.11.19 08:27:53 LOG3[1596:2576]: readsocket: Connection reset by peer
(WSAECONNRESET) (10054)
2007.11.19 08:27:53 LOG5[1596:2576]: Connection reset: 1102 bytes sent to
SSL, 1241 bytes sent to socket
2007.11.19 08:27:53 LOG7[1596:2576]: https finished (0 left)
Does this make any sense to you????
Dan
_____
From: Craig
Sent: Mon 19/11/2007 1:34 AM
To: stunnel-users(a)mirt.net
Subject: Re: [stunnel-users] Stunnel and Outlook Web Access Problems
OWA rewrites the URL when you log in and I have found that it causes
problems when doing that with a Stunnel connection.
What I think might be happening is that your initial connection says
http://server.tld/ then when you log in OWA rewrites the URL to
https://server.tld/
What I think is happening is that your stunnel is listening on port 80 and
when you log in, OWA changes the listening port in the browser to port 443.
Try running the listening server (stunnel server) to listen on port 443
instead of port 80 and see if that fixes the problem.
Cheers
Craig
From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]]
On Behalf Of Dan Vespa
Sent: 17 November 2007 07:21 PM
To: stunnel-users(a)mirt.net
Subject: [stunnel-users] Stunnel and Outlook Web Access Problems
I am trying to use the latest version of stunnel to connect to OWA. I set
stunnel to listen on port 80 (localhost) and then connect to myserverip on
port 443. I get the login screen but can go no further after I Enter my
credentials and Click OK. Checking the stunnel log screen it shows that a
connect has been made? I don't understand why It won't connect any further??
OWA is on Exchange Server 2003 and I am using Windows XP SP2. I have also
updated to Open SSL latest version.
Thanks in Advance.
Dan
1
0