I am faling to connect to gmail. Not sure what that bind error means.
iqbala@ghar:~$ sudo stunnel4
2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes
from /home/iqbala/.rnd
2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes
to /home/iqbala/.rnd
2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims
sufficient entropy for the PRNG
2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully
2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem
2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded
2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem
2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded
2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for
service ssmtp
2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on
i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007
2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD
SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP
2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be
changed with 'ulimit -n')
2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE
limit for file descriptors
2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed
2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode
2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode
2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode
2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on
accept socket
2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to
74.125.93.111:587
2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign
requested address (99)
Here is how my conf file looks like
iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$"
cert = /etc/stunnel/stunnel.pem
foreground = yes
sslVersion = SSLv3
chroot = /var/lib/stunnel4/
setuid = stunnel4
setgid = stunnel4
pid = /stunnel4.pid
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
debug = 7
output = /var/log/stunnel4/stunnel.log
client = yes
[ssmtp]
accept = smtp.gmail.com:587
connect = 25
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
5
9
The configuration files are :
pid = /var/stunnel.pid
;chroot = /var/lib/stunnel
setuid = nobody
setgid = nobody
foreground =yes
; Use it for client mode
client = yes
; Service-level configuration
[pop3s]
accept = 995
connect = 110
[imaps]
accept = 993
connect = 143
[ssmtp]
accept = 465
connect = 25
[mysqls]
accept = 3307
connect = 192.168.1.6:3307
On 192.168.1.6
----------------------
pid = /var/stunnel.pid
setuid =nobody
setgid = nobody
foreground = yes
client = no
; Service-level configuration
[pop3s]
accept = 995
connect = 110
[imaps]
accept = 993
connect = 143
[ssmtp]
accept = 465
connect = 25
[mysqls]
accept =3307
connect =3306
connecting like
/usr/local/mysql/bin/mysql -h 127.0.0.1 -u root -p -P 3307
Enter password:
On entring password the following lines appear :
ERROR 2013 (HY000): Lost connection to MySQL server at 'reading initial communication packet', system error: 104
Subrata
----- Original Message -----
From: Brian Hatch <bri(a)stunnel.org>
To: subrata(a)indiatimes.com
Sent: Sun, 7 Oct 2007 10:02:17 +0530 (IST)
Subject: Re: [stunnel-users] Stunnel on the same machine
Near 2007-10-05 22:17 +0530, subrata(a)indiatimes.com insisted:
> After starting stunnel and connecting the mysql client/usr/local/mysql/bin/mysql -h 127.0.0.1 -u root -p the flow gets stuck at the Enter password prompt any suggestions how to proceed from there.
What do your stunnel configuration files look like?
Other problem: mysql client may decide to use a local domain socket when
connecting to localhost, thwarting your attempts to go via Stunnel.
You might want to 'strace mysql ...' and look for the connect() lines.
--
Brian Hatch Time flies like an
Systems and arrow. Fruit flies
Security Engineer like a banana.
http://www.ifokr.org/bri/
Every message PGP signed
--
My life has changed. What about yours?
Log on to the new Indiatimes Mail and Live out of the Inbox!
3
3
Hello,
I have been trying to enable stunnel on a HPUX server, and whilst I thought it was going to be simple, I have not been able to make it work so far. We have a webserver and due to some pages being hardcoded to port 8080 it can't support SSL without a lot of code changes. As a short term workaround I am trying to use stunnel in server mode to provide a HTTPS interface. I expected this to be a very simple matter of accepting connections on port 443 and connecting to port 8080, but it's not working.
We're using an old version of stunnel (4.04) however this is the version bundled with the HPUX OS we have.
When stunnel is started there are no errors (log file output below) and netstat shows that a process is listening on port 443, however a browser (tried IE6 and Firefox) doesn't display anything. Connecting to port 8080 shows the application as expected.
I have run a wireshark trace at the client end, and it seems that the stunnel server is not responding to the initial "Client Hello" message. Only 3 packets are seen:
C->S SYN
S->C SYN,ACK
C->S SSL Client Hello
My guess is that the ssl server is not starting up correctly, however everything looks ok in the logfile, although it might not be completing. Nothing is displayed in the log when I try to connect to port 443.
Any help would be much appreciated as I am stuck!
Thanks Craig
Server
eSM_CoE# uname -a
HP-UX eSM_CoE B.11.23 U ia64 1107767544 unlimited-user license
Stunnel Version
eSM_CoE# ./sbin/stunnel -version
stunnel 4.04 on ia64-hp-hpux11.23 PTHREAD with OpenSSL 0.9.8d 28 Sep 2006
Global options
cert = /opt/hpws/apache32/stunnel/etc/stunnel/stunnel.pem
ciphers = ALL:!ADH:+RC4:@STRENGTH
debug = 5
key = /opt/hpws/apache32/stunnel/etc/stunnel/stunnel.pem
pid = /opt/hpws/apache32/stunnel/var/run/stunnel.pid
RNDbytes = 64
RNDfile = /dev/urandom
RNDoverwrite = yes
session = 300 seconds
verify = none
Service-level options
TIMEOUTbusy = 300 seconds
TIMEOUTclose = 60 seconds
TIMEOUTidle = 43200 seconds
Conf file
eSM_CoE# cat stunnel.conf
# Sample stunnel configuration file
RNDfile=/opt/hpws/apache32/stunnel/.stunnel.rnd
# Chroot
#chroot = /var/chroot/stunnel/
# PID is created inside chroot jail
pid = /opt/hpws/apache32/logs/stunnel.pid
# Workaround for Eudora bug
#options = DONT_INSERT_EMPTY_FRAGMENTS
# Client Authentication
#verify = 2
# don't forget about c_rehash CApath
# it is located inside chroot jail:
#CApath = /certs
# or simply use CAfile instead:
#CAfile = /opt/hpws/apache32/conf/certs.pem
# Some debugging stuff
debug = 7
output = /opt/hpws/apache32/logs/stunnel.log
# Use in client mode
client = no
# Run in the background
foreground = no
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
delay=yes
# Service-level configuration
[https]
accept = 172.20.167.74:443
connect = localhost:8080
TIMEOUTclose = 10
Log file output
2009.10.30 14:32:41 LOG5[4172:1]: stunnel 4.04 on ia64-hp-hpux11.23 PTHREAD with OpenSSL 0.9.8d 28 Sep 2006
2009.10.30 14:32:41 LOG7[4172:1]: Snagged 64 random bytes from /opt/hpws/apache32/stunnel/.stunnel.rnd
2009.10.30 14:32:41 LOG7[4172:1]: Wrote 1024 new random bytes to /opt/hpws/apache32/stunnel/.stunnel.rnd
2009.10.30 14:32:41 LOG7[4172:1]: RAND_status claims sufficient entropy for the PRNG
2009.10.30 14:32:41 LOG6[4172:1]: PRNG seeded successfully
2009.10.30 14:32:41 LOG7[4172:1]: Certificate: /opt/hpws/apache32/stunnel/etc/stunnel/stunnel.pem
2009.10.30 14:32:41 LOG7[4172:1]: Key file: /opt/hpws/apache32/stunnel/etc/stunnel/stunnel.pem
2009.10.30 14:32:41 LOG5[4172:1]: FD_SETSIZE=60000, file ulimit=4096 -> 2000 clients allowed
2009.10.30 14:32:41 LOG7[4172:1]: FD 5 in non-blocking mode
2009.10.30 14:32:41 LOG7[4172:1]: SO_REUSEADDR option set on accept socket
2009.10.30 14:32:41 LOG7[4172:1]: https bound to 172.20.167.74:443
_________________________________________________________________
New Windows 7: Find the right PC for you. Learn more.
http://www.microsoft.com/uk/windows/buy/
1
0
I am running an stunnel in chroot setup on a Red Hat Enterprise Linux Server
(v3) :
stunnel 4.27 on x86_64-unknown-linux-gnu with OpenSSL 0.9.7a Feb 19 2003
Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6
And i want to connect from a Windows 2003 system (als version 4.27)
When i try to do a basic connect from the Windows stunnel to the Linux
stunnel, the connection gets reset each time, ssldump shows:
New TCP connection #1: hans13(1363) <-> nada(25000)
1 1 0.0000 (0.0000) C>S Handshake
ClientHello
Version 3.0
cipher suites
Unknown value 0x39
Unknown value 0x38
Unknown value 0x35
SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
SSL_RSA_WITH_3DES_EDE_CBC_SHA
Unknown value 0x33
Unknown value 0x32
Unknown value 0x2f
SSL_RSA_WITH_RC4_128_SHA
SSL_RSA_WITH_RC4_128_MD5
SSL_DHE_RSA_WITH_DES_CBC_SHA
SSL_DHE_DSS_WITH_DES_CBC_SHA
SSL_RSA_WITH_DES_CBC_SHA
SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA
SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA
SSL_RSA_EXPORT_WITH_DES40_CBC_SHA
SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
SSL_RSA_EXPORT_WITH_RC4_40_MD5
compression methods
unknown value
NULL
1 2 0.0000 (0.0000) S>C Alert
level fatal
value handshake_failure
1 0.0000 (0.0000) S>C TCP RST
Stunnel logging shows:
2009.10.26 10:37:25 LOG7[29959:1073879408]: xxx started
2009.10.26 10:37:25 LOG7[29959:1073879408]: FD 7 in non-blocking mode
2009.10.26 10:37:25 LOG5[29959:1073879408]: tfe accepted connection from 10.10.10.10:1250
2009.10.26 10:37:25 LOG7[29959:1073879408]: SSL state (accept): before/accept initialization
2009.10.26 10:37:25 LOG7[29959:1073879408]: SSL alert (write): fatal: handshake failure
2009.10.26 10:37:25 LOG3[29959:1073879408]: SSL_accept: 1408A09F: error:1408A09F:SSL routines:SSL3_GET_CLIENT_HELLO:length mismatch
2009.10.26 10:37:25 LOG5[29959:1073879408]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket
2009.10.26 10:37:25 LOG7[29959:1073879408]: xxx finished (-1 left)
When i explicitly configure the Windows stunnel to use:
sslVersion = SSLv2
or
sslVersion = TLSv1 (see ssldump logging below)
everything works fine.
Is this a known bug or an undocumented feature?
Ewald...
New TCP connection #3: hans13.amc.nl(1367) <-> nada.amc.nl(25000)
3 1 0.0000 (0.0000) C>S Handshake
ClientHello
Version 3.1
resume [32]=
b8 a1 d2 93 6a ae 4a 0d 49 04 cd 88 92 75 f1 6d
d7 65 88 c3 01 51 bf eb d4 44 ce b7 fd 75 32 64
cipher suites
Unknown value 0x39
Unknown value 0x38
Unknown value 0x35
TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
Unknown value 0x33
Unknown value 0x32
Unknown value 0x2f
TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_RC4_128_MD5
TLS_DHE_RSA_WITH_DES_CBC_SHA
TLS_DHE_DSS_WITH_DES_CBC_SHA
TLS_RSA_WITH_DES_CBC_SHA
TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA
TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA
TLS_RSA_EXPORT_WITH_DES40_CBC_SHA
TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5
TLS_RSA_EXPORT_WITH_RC4_40_MD5
compression methods
unknown value
NULL
3 2 0.0000 (0.0000) S>C Handshake
ServerHello
Version 3.1
session_id[32]=
b8 a1 d2 93 6a ae 4a 0d 49 04 cd 88 92 75 f1 6d
d7 65 88 c3 01 51 bf eb d4 44 ce b7 fd 75 32 64
cipherSuite Unknown value 0x35
compressionMethod NULL
etc...
2
1
Hello,
Till some recent time, I was using "socat"
(http://www.dest-unreach.org/socat/) to create a SSL-wrapper (in a way
similar to what "stunnel" does). I was using:
===
socat -ly -d -d
openssl-listen:443,bind=X.X.X.X,fork,reuseaddr,cipher=HIGH:3DES:MD5,cert=server-cert.pem,key=server-key.pem,verify=0
tcp4:Y.Y.Y.Y:P
===
It was working pretty well, without interruptions, although it got some
estability problems when passing 1-2 months (server apparently get stuck).
So I decided to give a try to "stunnel".
I switched to "stunnel" and problems arise... I'm experimenting *very*
frequent connection cuts. If I examine daemon.log (I'm using Debian 5), I have:
Oct 20 12:06:36 hetzner stunnel: LOG3[3677:3083029392]: SSL_read: 140EC071:
error:140EC071:SSL routines:SSL2_READ_INTERNAL:bad mac decode
Oct 20 12:06:36 hetzner stunnel: LOG5[3677:3083029392]: Connection reset:
315484 bytes sent to SSL, 50471 bytes sent to socket
So it seems stunnel is closing the connection due to a "bad mac decode"
error. My environment (client and server) have not changed, I only switched
"the transport" (socat -> stunnel). Any idea why is it failing now?
Moreover, if I switch back to socat, cuts disappear. Is stunnel buggy? Am I
missing some config/tunning at the SSL/socket level?
My current config is:
roman@hetzner:~$ stunnel4 -sockets
Socket option defaults:
Option Accept Local Remote OS default
SO_DEBUG -- -- -- 0
SO_DONTROUTE -- -- -- 0
SO_KEEPALIVE -- -- -- 0
SO_LINGER -- -- -- 0:0
SO_OOBINLINE -- -- -- 0
SO_RCVBUF -- -- -- 87380
SO_SNDBUF -- -- -- 16384
SO_RCVLOWAT -- -- -- 1
SO_SNDLOWAT -- -- -- 1
SO_RCVTIMEO -- -- -- 0:0
SO_SNDTIMEO -- -- -- 0:0
SO_REUSEADDR 1 -- -- 0
SO_BINDTODEVICE -- -- -- --
IP_TOS -- -- -- 0
IP_TTL -- -- -- 64
TCP_NODELAY -- -- -- 0
root@hetzner:~# stunnel4 -version
stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007
Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP
Global options
debug = 5
pid = /var/run/stunnel4.pid
RNDbytes = 64
RNDfile = /dev/urandom
RNDoverwrite = yes
Service-level options
cert = /etc/stunnel/stunnel.pem
ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH
key = /etc/stunnel/stunnel.pem
session = 300 seconds
stack = 65536 bytes
sslVersion = SSLv3 for client, all for server
TIMEOUTbusy = 300 seconds
TIMEOUTclose = 60 seconds
TIMEOUTconnect = 10 seconds
TIMEOUTidle = 43200 seconds
verify = none
My stunnel.conf is very simple. Apart from cert setup, the tunnel is
something like:
===
[tunelserv]
accept = X.X.X:X:443
connect = X.X.X.X:P
===
Any idea? Thank you in advance.
Cheers,
-Roman
2
2
On Fri, 2009-10-23 15:04:14 -0400, Al Gonzalez wrote:
> I apologize for a potentially silly question, but is there any way to
> determine if my question made it to the user's group. I sent in a
> question (I think last Friday), and other than a auto-reply to myself, I
> don't know if anyone really received it. I'm in a bit of a pickle, and
> could sure use some help. Thanks.
If you are worried about your message may not make it to a mailing
list, check the list archive at the URL given in the "List-Archive:"
header included in the mails sent from the list server. In case of
stunnel-users this is http://stunnel.mirt.net/pipermail/stunnel-users.
And yes, your mail from October 20th can be found there.
Regarding your problem, I'm afraid I can't help as I use stunnel for
'secure tunnels' only, i.e. I have stunnel on both ends of the
connection and I don't have to care about the protocols tunneled
through.
Sorry,
Ludolf.
--
---------------------------------------------------------------
Ludolf Holzheid Tel: +49 621 339960
Bihl+Wiedemann GmbH Fax: +49 621 3392239
Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de
D-68199 Mannheim, Germany
---------------------------------------------------------------
1
0
Does stunnel support multiple domain certificates?
I am trying to get stunnel to work with multiple domains on a machine that
can have only one IP address. (It is an amazon EC2 instance - they do not
support multiple IPs per instance)
It seems to me that the only way to get this to work is with a multiple
domain certificate, which I believe is called a "Unified Communications
Certificate". Does stunnel support these?
Thank you so much,
Andrew
--
View this message in context: http://www.nabble.com/multiple-domain-certificates-tp25897355p25897355.html
Sent from the Stunnel - Users mailing list archive at Nabble.com.
2
2
Thank you in advance for any assistance you can provide...
I am trying to talk to a UHF radio (from a PC) over a secure channel, but
having some difficulties. Please let me provide just a little background
so you know why I’m doing what I’m doing. In the existing system,
Internet Explorer (IE) is the client that talks to this radio. When the
radio boots up, it sends a webpage over Ethernet to IE and (after the user
login), a secure link is established, and the radio can be controlled from
IE – the various webpages change as the user maneuvers through the various
dropdowns, etc. We’ve been asked to automate this interface now for a
production environment. The client is going to be replaced with a PC
connected to a great deal of test equipment, and the server will now send
XML instead of html to the client. The client is being developed in
LabVIEW (from National Instruments) – this has made this task even more
challenging.
As all of this secure stuff is new to me, I spent many hours just trying
to understand the problem(s) and the lingo. As LabVIEW has some
limitations in this area, I found that Stunnel was my best option. Using
TCP/IP and sending http to the radio (shown below), I’ve been able (in a
non-secure mode, without Stunnel) to communicate and get the opening
screen (html) to be returned to me (the XML server output is currently
being developed) and displayed in a LabVIEW window.
GET / HTTP/1.1
Host: 10.4.32.1
Connection: Keep-Alive
Authorization: Basic YWRtaW46UgEkJHdvtmQx
Credentials: admin:Password
I downloaded the binary version of Stunnel.exe (version 4.27 with OpenSSL
0.9.8k dated Mar 2009), then modified the LabVIEW code to call (using a
command line approach) Stunnel. In this way, I can’t provide any (dash)
options, so it’s completely dependent on the stunnel.conf file. After a
number of attempts, I was able to get the client to bind to the server (I
think), but I see nothing being returned to me (no html). I must use
TLSv1, and ciphers = DES-CBC3-SHA.
I’ve seen examples on stunnel.org that show a great deal more handshaking
information than I’m seeing, so I’m wondering if I’m missing some detail
in my conf file. For example, my log file ends like this
2009.10.16 13:18:49 LOG7[4812:4776]: FD 208 in non-blocking mode
2009.10.16 13:18:49 LOG7[4812:4776]: SO_REUSEADDR option set on accept
socket
2009.10.16 13:18:49 LOG7[4812:4776]: https bound to 10.4.1.8:443
But the example I mentioned goes on after the “https bound” and adds
things like …
2009.08.04 12:15:55 LOG7[16648:22996]: proxy accepted FD=320 from
127.0.0.1:48086
2009.08.04 12:15:55 LOG7[16648:22996]: Creating a new thread
2009.08.04 12:15:55 LOG7[16648:22996]: New thread created
2009.08.04 12:15:55 LOG7[16648:8540]: proxy started
2009.08.04 12:15:55 LOG7[16648:8540]: FD 320 in non-blocking mode
2009.08.04 12:15:55 LOG7[16648:8540]: TCP_NODELAY option set on local
socket
2009.08.04 12:15:55 LOG5[16648:8540]: proxy accepted connection from
127.0.0.1:48086
2009.08.04 12:15:55 LOG7[16648:8540]: FD 340 in non-blocking mode
2009.08.04 12:15:55 LOG7[16648:8540]: proxy connecting 89.149.253.125:8080
2009.08.04 12:15:55 LOG7[16648:8540]: connect_wait: waiting 10 seconds
2009.08.04 12:15:56 LOG7[16648:8540]: connect_wait: connected
2009.08.04 12:15:56 LOG5[16648:8540]: proxy connected remote server from
192.168.2.3:48088
2009.08.04 12:15:56 LOG7[16648:8540]: Remote FD=340 initialized
2009.08.04 12:15:56 LOG7[16648:8540]: TCP_NODELAY option set on remote
socket
2009.08.04 12:15:56 LOG7[16648:8540]: SSL state (connect): before/connect
initialization
2009.08.04 12:15:56 LOG7[16648:8540]: SSL state (connect): SSLv3 write
client hello A
2009.08.04 12:15:56 LOG7[16648:8540]: SSL state (connect): SSLv3 read
server hello A
.
.
.
2009.08.04 12:15:57 LOG6[16648:8540]: SSL connected: new session
negotiated
2009.08.04 12:15:57 LOG6[16648:8540]: Negotiated ciphers: AES256-SHA SSLv3
Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1
That make’s me think that I’m not quite there yet. I’ve attached my
stunnel.conf, my log file, and the http request I’m making (above). I’m
hoping you can find some flaws in my conf file that will get me closer.
Other than receiving html, I’m not sure how to know that I truly have a
secure connection. I’m thinking I should see a little more in my log
file, but I’m not sure.
The other thing I’m not sure about (as I’ve heard differing thoughts) is
whether I have to Encrypt my http commands, or does stunnel take care of
that somehow? If I have to encypt, how would I go about doing this? Also,
(and I’m getting ahead of myself) do I have to open and close a session
every time I want to talk, or do I somehow leave the channel open? I’ve
read about Session Resumption, but I’m not sure if that is something I
need to setup in the conf file, or if that can even be controlled by
Stunnel.
Al Gonzalez
Principal Software Engineer
Compass Call Programs
Offensive Information Warfare
Raytheon Company
260.429.4354
260.429.5829 fax
Al_Gonzalez(a)raytheon.com
1
0
16 Oct '09
Hello,
I have a problem regarding stunnel and MySQL replication.
I use replication to keep our database synchronous with a second
database, which stands in our building. The secure connection via
stunnel works and "SHOW SLAVE STATUS;" shows, that the replication is
working. Because the master database is rarely used at the moment,
sometimes there are no changes (insert, update or delete) made for an
hour. Unfortunately it seems that stunnel disconnects the connection
between the databases after some time. The client database still thinks
that it is connected to the master server, because it still is connected
to port 3307 (which is stunnel of course). So now the changes made in
the master database are no longer replicated. Is there any way to
configure stunnel to keep the connection between the to servers alive
even after an hour of zero traffic? I thought that TIMEOUTidle would be
the answer to my problem, but it had no effect.
I really hope you can help me and thanks for your suggestions in advance.
Greetings,
Marcel Kirsch
This is my current configuration:
Client:
; Certificate/key is needed in server mode and optional in client mode
cert = /etc/stunnel/stunnel.pem
key = /etc/stunnel/stunnel.pem
; Protocol version (all, SSLv2, SSLv3, TLSv1)
sslVersion = SSLv3
; Some security enhancements for UNIX systems - comment them out on Win32
chroot = /var/lib/stunnel4/
setuid = stunnel4
setgid = stunnel4
; PID is created inside chroot jail
pid = /stunnel4.pid
; Some performance tunings
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
;compression = rle
retry = yes
TIMEOUTidle = 86400
; Some debugging stuff useful for troubleshooting
debug = 3
output = /var/log/stunnel4/stunnel.log
; Use it for client mode
client = yes
[mysqls]
accept = 3307
connect = 78.46.106.68:3307
Server:
client = no
pid = /var/run/stunnel.pid
#
# debugging
#
debug = 7
output = /etc/stunnel/stunnel.log
#
# Some performance tunings
#
# disable Nagle algorithm (a.k.a. tinygram prevention, see man 7 tcp)
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
cert = /etc/stunnel/stunnel.pem
retry = yes
TIMEOUTidle = 86400
[mysqls]
accept = 3307
connect = 127.0.0.1:mysql
Log of client while connecting:
2009.10.09 09:28:58 LOG7[3729:3082963856]: connect_wait: connected
2009.10.09 09:28:58 LOG5[3729:3082963856]: mysqls connected remote
server from 192.168.1.87:33206
2009.10.09 09:28:58 LOG7[3729:3082963856]: Remote FD=17 initialized
2009.10.09 09:28:58 LOG7[3729:3082963856]: TCP_NODELAY option set on
remote socket
2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect):
before/connect initialization
2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3
write client hello A
2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3
read server hello A
2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3
read server certificate A
2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3
read server done A
2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3
write client key exchange A
2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3
write change cipher spec A
2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3
write finished A
2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3
flush data
2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3
read finished A
2009.10.09 09:28:58 LOG7[3729:3082963856]: 3 items in the session cache
2009.10.09 09:28:58 LOG7[3729:3082963856]: 3 client connects
(SSL_connect())
2009.10.09 09:28:58 LOG7[3729:3082963856]: 3 client connects that
finished
2009.10.09 09:28:58 LOG7[3729:3082963856]: 0 client renegotiations
requested
2009.10.09 09:28:58 LOG7[3729:3082963856]: 0 server connects
(SSL_accept())
2009.10.09 09:28:58 LOG7[3729:3082963856]: 0 server connects that
finished
2009.10.09 09:28:58 LOG7[3729:3082963856]: 0 server renegotiations
requested
2009.10.09 09:28:58 LOG7[3729:3082963856]: 0 session cache hits
2009.10.09 09:28:58 LOG7[3729:3082963856]: 0 session cache misses
2009.10.09 09:28:58 LOG7[3729:3082963856]: 0 session cache timeouts
2009.10.09 09:28:58 LOG6[3729:3082963856]: SSL connected: new session
negotiated
2009.10.09 09:28:58 LOG6[3729:3082963856]: Negotiated ciphers:
AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1
Log of server while connecting:
2009.10.09 09:28:52 LOG7[31073:139652979042032]: mysqls accepted FD=14
from 212.95.118.250:60651
2009.10.09 09:28:52 LOG7[31073:1091389776]: mysqls started
2009.10.09 09:28:52 LOG7[31073:1091389776]: FD 14 in non-blocking mode
2009.10.09 09:28:52 LOG7[31073:1091389776]: TCP_NODELAY option set on
local socket
2009.10.09 09:28:52 LOG7[31073:1091389776]: Waiting for a libwrap process
2009.10.09 09:28:52 LOG7[31073:1091389776]: Acquired libwrap process #0
2009.10.09 09:28:52 LOG7[31073:1091389776]: Releasing libwrap process #0
2009.10.09 09:28:52 LOG7[31073:1091389776]: Released libwrap process #0
2009.10.09 09:28:52 LOG7[31073:1091389776]: mysqls permitted by libwrap
from 212.95.118.250:60651
2009.10.09 09:28:52 LOG5[31073:1091389776]: mysqls accepted connection
from 212.95.118.250:60651
2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept):
before/accept initialization
2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3
read client hello A
2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3
write server hello A
2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3
write certificate A
2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3
write server done A
2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3
flush data
2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3
read client key exchange A
2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3
read finished A
2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3
write change cipher spec A
2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3
write finished A
2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3
flush data
2009.10.09 09:28:52 LOG7[31073:1091389776]: 3 items in the session cache
2009.10.09 09:28:52 LOG7[31073:1091389776]: 0 client connects
(SSL_connect())
2009.10.09 09:28:52 LOG7[31073:1091389776]: 0 client connects that
finished
2009.10.09 09:28:52 LOG7[31073:1091389776]: 0 client renegotiations
requested
2009.10.09 09:28:52 LOG7[31073:1091389776]: 17 server connects
(SSL_accept())
2009.10.09 09:28:52 LOG7[31073:1091389776]: 17 server connects that
finished
2009.10.09 09:28:52 LOG7[31073:1091389776]: 0 server renegotiations
requested
2009.10.09 09:28:52 LOG7[31073:1091389776]: 0 session cache hits
2009.10.09 09:28:52 LOG7[31073:1091389776]: 1 session cache misses
2009.10.09 09:28:52 LOG7[31073:1091389776]: 14 session cache timeouts
2009.10.09 09:28:52 LOG6[31073:1091389776]: SSL accepted: new session
negotiated
2009.10.09 09:28:52 LOG6[31073:1091389776]: Negotiated ciphers:
AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1
2009.10.09 09:28:52 LOG7[31073:1091389776]: FD 15 in non-blocking mode
2009.10.09 09:28:52 LOG7[31073:1091389776]: mysqls connecting 127.0.0.1:3306
2009.10.09 09:28:52 LOG7[31073:1091389776]: connect_wait: waiting 10 seconds
2009.10.09 09:28:52 LOG7[31073:1091389776]: connect_wait: connected
2009.10.09 09:28:52 LOG5[31073:1091389776]: mysqls connected remote
server from 127.0.0.1:59705
2009.10.09 09:28:52 LOG7[31073:1091389776]: Remote FD=15 initialized
2009.10.09 09:28:52 LOG7[31073:1091389776]: TCP_NODELAY option set on
remote socket
2009.10.09 09:28:52 LOG7[31073:1098307920]: Socket closed on read
2009.10.09 09:28:52 LOG7[31073:1098307920]: SSL write shutdown
2009.10.09 09:28:52 LOG7[31073:1098307920]: SSL alert (write): warning:
close notify
2009.10.09 09:28:52 LOG6[31073:1098307920]: SSL socket closed on
SSL_shutdown
2009.10.09 09:28:52 LOG7[31073:1098307920]: Socket write shutdown
2009.10.09 09:28:52 LOG5[31073:1098307920]: Connection closed: 9600
bytes sent to SSL, 185 bytes sent to socket
2009.10.09 09:28:52 LOG7[31073:1098307920]: mysqls finished (1 left)
Log of server while disconnecting:
2009.10.09 09:53:48 LOG3[31073:1091389776]: SSL_read: Connection reset
by peer (104)
2009.10.09 09:53:48 LOG5[31073:1091389776]: Connection reset: 1047 bytes
sent to SSL, 185 bytes sent to socket
2009.10.09 09:53:48 LOG7[31073:1091389776]: mysqls finished (0 left)
(There is no log of client while disconnecting)
3
3
Re: [stunnel-users] MySQL replication with stunnel, connection closed after some time
by Michal Trojnara 16 Oct '09
by Michal Trojnara 16 Oct '09
16 Oct '09
Marcel Kirsch wrote:
> it is correct that there is a router (with NAT) between the slave server
> and the internet. I tried the solution of Mike (socket =
> l:SO_KEEPALIVE=1...), but it didn't work.
> I googled SO_KEEPALIVE and discovered that it only sends a keep alive
> packet every 2 hours by default. Unfortunately the connection is closed
> after a shorter time (about 30 minutes). Do you know how it is possible
> to set the keep alive time to a shorter value?
On Linux you can use:
echo 300 > /proc/sys/net/ipv4/tcp_keepalive_time
Best regards,
Mike
1
0