April 2007 - stunnel-users

firewall very restricted!!
by Pitoniso Rikito Rikin 16 Apr '07

16 Apr '07

Ok guys look this... my only contact with the world is trought the WEB port 80 how i can establish a ssh connection trought this port, the only method avaible is the GET or POST.... well how i do this... help --------------------------------- LLama Gratis a cualquier PC del Mundo. Llamadas a fijos y móviles desde 1 céntimo por minuto. http://es.voice.yahoo.com

2 1

Using Client Authentication
by Ravi Gowda 16 Apr '07

16 Apr '07

Hi All, I am trying to have a setup where stunnel acts as a client to a server which requires client-Authentication. This is the snapshot of my stunnel.conf # Sample stunnel configuration file # Copyright by Michal Trojnara 2002 setuid = nobody setgid = nobody output = /etc/stunnel/out cert = /etc/stunnel/rtca-client.pem key = /etc/stunnel/rtca-client.ky # Authentication stuff verify = 2 # don't forget about c_rehash CApath # it is located inside chroot jail: #CApath = /certs # or simply use CAfile instead: CAfile = /etc/stunnel/rtca.pem ciphers = DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:DES-CBC3-MD5:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-SHA:IDEA-CBC-SHA:IDEA-CBC-MD5:RC2-CBC-MD5:DHE-DSS-RC4-SHA:RC4-SHA:RC4-MD5:RC4-MD5:RC4-64-MD5:EXP1024-DHE-DSS-DES-CBC-SHA:EXP1024-DES-CBC-SHA:EXP1024-RC2-CBC-MD5:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:DES-CBC-MD5:EXP1024-DHE-DSS-RC4-SHA:EXP1024-RC4-SHA:EXP1024-RC4-MD5:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-RC2-CBC-MD5:EXP-RC4-MD5:EXP-RC4-MD5 # Some debugging stuff debug = 7 output = /etc/stunnel/stunnel.log # Use it for client mode client = yes when I try to connect to the server, I am seeing that Stunnel is sending an empty certificate..which is making my server to reject connections. Can someone please help me out?? Thanks in Advance Ravi Gowda

1 0

Re: [stunnel-users] Setting up chain certificates on Stunnel.
by Hans Werner Strube 12 Apr '07

12 Apr '07

Satyajit Das wrote: > My server certificate > signed by intermediate CA > signed by Verisign CA > > I have the Verisign certificate on my clients trusted root CAs, however I am > > not able to get the SSL communication through. I believe this is because > stunnel should send all the three certificates for authentication and I > couldnt > configure stunnel to send across all the three certificates. > > Can anybody please help install all these certificates on stunnel. Simply concatenate the certificates (in PEM format) in the file specified by "cert = ..." and supply the key of your server certificate either in the same file or in the file specified by "key = ...".

1 0

stunnel-4.20 crash on AIX
by Peter O'Gorman 12 Apr '07

12 Apr '07

Hi, We built stunnel-4.20 on solaris, hpux, aix, tru64. irix and various linux hosts, and it works fine everywhere except hpux10.20 and aix. stunnel crashes with similar backtraces on AIX-4.3,5.1,5.2 and 5.3, not on the first client connect (using stunnel client=yes, connecting to s secure daytime server on another host, because everyone needs a secure daytime server :-p) but on the second connection. We have not tried server side yet, I assume results are similar. The backtrace looks like this: GDB: Program terminated with signal 11, Segmentation fault. #0 0xd0126b1c in _sigsetmask () from /usr/lib/libpthreads.a(shr_xpg5.o) (gdb) bt #0 0xd0126b1c in _sigsetmask () from /usr/lib/libpthreads.a(shr_xpg5.o) #1 0xd0127e5c in _p_sigaction () from /usr/lib/libpthreads.a(shr_xpg5.o) #2 0xd0315544 in sigaction () from /usr/lib/libc.a(shr.o) #3 0xd038beac in signal () from /usr/lib/libc.a(shr.o) #4 0x10006200 in sigchld_handler (sig=0) at network.c:350 #5 0x00004378 in ?? () Previous frame inner to this frame (corrupt stack?) dbx: sigchld_handler(sig = 0), line 350 in "network.c" _sigsetmask(??, ??, ??) at 0xd0126b1c _p_sigaction(??, ??, ??) at 0xd0127e58 raise.sigaction(??, ??, ??) at 0xd0315540 signal(??, ??) at 0xd038bea8 sigchld_handler(sig = 0), line 350 in "network.c" _sigsetmask(??, ??, ??) at 0xd0126b1c _p_sigaction(??, ??, ??) at 0xd0127e58 raise.sigaction(??, ??, ??) at 0xd0315540 signal(??, ??) at 0xd038bea8 sigchld_handler(sig = 0), line 350 in "network.c" _sigsetmask(??, ??, ??) at 0xd0126b1c _p_sigaction(??, ??, ??) at 0xd0127e58 raise.sigaction(??, ??, ??) at 0xd0315540 signal(??, ??) at 0xd038bea8 repeated forever. Line 350 of network.c says: signal(SIGCHLD, sigchld_handler); And that is in the signal handler, it seems like a normal thing to do, and I have no idea why, on AIX, it crashes. putting an #ifndef _AIX #endif around the signal() call "fixes" the crash, alternatively setting SIGCHLD to SIG_IGN on AIX "fixes" it, but I don't think that either solution is correct. I don't believe the signal handler will get called again as we do not reset the signal. (tests that assumtion and finds answer to riddle) Okay, problem identified. The signal_handler is being called repeatedly, causing an infinite loop that can only end in a crash. According to the AIX signal man page: The signal in libc.a does not set the SA_RESTART flag. It sets the signal mask to the signal whose action is being specified, and sets flags to SA_OLDSTYLE. The Berkeley Software Distribution (BSD) version of signal sets the SA_RESTART flag and preserves the current settings of the signal mask and flags. The BSD version can be used by compiling with the Berkeley Compatibility Library (libbsd.a). And indeed, no patches are required if I add -lbsd. Another solution would probably be to use sigaction if it is available. Meanwhile, please find attached a patch to add -lbsd on aix. Thanks for bearing with me while I figured this out :-) Peter

1 0

Setting up chain certificates on Stunnel.
by Satyajit Das 12 Apr '07

12 Apr '07

Hi , I am using stunnel as a wrapper to provide SSL functionalities for my server. Right now I am having problems setting up chained certificates on stunnel. My Problem -> My server certificate > signed by intermediate CA > signed by Verisign CA I have the Verisign certificate on my clients trusted root CAs, however I am not able to get the SSL communication through. I believe this is because stunnel should send all the three certificates for authentication and I couldnt configure stunnel to send across all the three certificates. Can anybody please help install all these certificates on stunnel. Thanks in advance, Satyajit

1 0

Cannot install stunnel as a service on Vista
by Neil Aggarwal 12 Apr '07

12 Apr '07

Hello: I cannot install stunnel as a service on Vista. I get a permission denied error. Is there a way to work around it? Thanks, Neil -- Neil Aggarwal, (214)986-3533, www.JAMMConsulting.com FREE! Eliminate junk email and reclaim your inbox. Visit http://www.spammilter.com for details.

2 1

forcing checking of local certificates every time
by san san 11 Apr '07

11 Apr '07

Hi, I am using stunnel with verify option with value 3. In value 3 the authentication is carried out using the local trusted certificates. I think stunnel does not check the local trusted certificates directory each and every time. If the connection has already been established then it does not check local trusted certificates , connection can be established using the certificates in cache. Is it possible to force to check the local trusted certificates every time. Regards

2 1

stunnel work with NAT
by atsushi kataoka 11 Apr '07

11 Apr '07

I have one question , does stunnel work with NAT ? I will explain the architecture There are some 10.0.0.XXXX machines and some are 192.0.0.XXXX machines. They are connected to each other via Router which does NAT. My VNC servers are installed on 10.0.0.XXXX and vnc clients on 192.0.0.XXXX I am not able to do the vnc from client to server. Now I want to encrypt the VNC traffic , can stunnel work with NAT? A Kataoka

1 0

running concurrent stunnel instances
by John Taylor 10 Apr '07

10 Apr '07

Greetings, I am running rsync through stunnel 4.20. Each end is a Dell dual cpu, dual core Xeon (each core with hyper-threading) 8 gigs of memory, running Win 2003 Server. The disks are 10K RPM Ultra-320 drives that use hardware raid-5. Right now, I have anywhere between 5 and 8 Scheduled Tasks running at the same time. The reason for this is that the backups need to run in parallel in order to finish within the 15 hour time window. Although I am not certain about an exact number, I believe I would be transferring about 300-400 gig of data each time. Even though I have a gigabit connection between the two servers, I am only seeing 5-6% network utilization. When running the same rsync batch file without stunnel encryption, the throughput was much higher. I would like to see about increasing my throughput with stunnel encryption running. I don't expect it to be as fast as running without stunnel, but I still think I should be able to do better than 5-6% throughput. I am also running a enhanced version of rsync that does not have any issues with NTFS disk fragmentation, since it preallocates the files to the final size before writing. I think the bottleneck is the CPU. To test out this theory, I would like to have multiple copies of the stunnel.exe running, each using their own config file and own port numbers. I don't think the problem is with rsync because it spawns a new process for each connection. Thus, the multiple rsync.exe processes get the advantage of running on top of multiple cores. This is not the case with stunnel.exe. It only uses 1 process, but 8 threads. I am hoping that multiple stunnel.exe instances will fix the bottleneck because each stunnel.exe process could then be running on it's own core. How can I accomplish this? Also, what is the fastest encryption cipher that stills has good security, over 64 bit, preferably at least 128 bit. Any help would be greatly appreciated. Thanks, -John Stunnel.conf on server: cert = my.pem verify = 3 CAfile = my.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 taskbar=no debug = 5 output = stunnel.log [rsynctnl] accept=12345 connect=873 ciphers = AES128-SHA Stunnel.conf on client: cert = my.pem taskbar = no socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 5 output = stunnel.log client = yes [rsynctnl] accept=12345 connect=10.9.8.7:12345 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

3 2

stunnel as ssh client and self signed certificates
by san san 07 Apr '07

07 Apr '07

Hi, I was planning to use stunnel for my rdp based product. I have several trivial doubts,but since i would be using the same in my product. I would like to know following 1.Actually i want to use stunnel in the same way as ssh i.e Client authentication only , i don't want server authentication at all in my client. So it is possible to not check any server certificate from client side. If i will be using client certificate 2.Is it possible to use self-signed certificate ? I am aware of the drawbacks of using self-signed certificates but because of some inevitable reason i have to use self-signed certificates. I am sorry for my poor knowledge. Regards

1 0