I am faling to connect to gmail. Not sure what that bind error means.
iqbala@ghar:~$ sudo stunnel4
2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes
from /home/iqbala/.rnd
2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes
to /home/iqbala/.rnd
2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims
sufficient entropy for the PRNG
2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully
2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem
2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded
2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem
2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded
2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for
service ssmtp
2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on
i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007
2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD
SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP
2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be
changed with 'ulimit -n')
2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE
limit for file descriptors
2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed
2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode
2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode
2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode
2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on
accept socket
2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to
74.125.93.111:587
2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign
requested address (99)
Here is how my conf file looks like
iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$"
cert = /etc/stunnel/stunnel.pem
foreground = yes
sslVersion = SSLv3
chroot = /var/lib/stunnel4/
setuid = stunnel4
setgid = stunnel4
pid = /stunnel4.pid
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
debug = 7
output = /var/log/stunnel4/stunnel.log
client = yes
[ssmtp]
accept = smtp.gmail.com:587
connect = 25
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
5
9
The configuration files are :
pid = /var/stunnel.pid
;chroot = /var/lib/stunnel
setuid = nobody
setgid = nobody
foreground =yes
; Use it for client mode
client = yes
; Service-level configuration
[pop3s]
accept = 995
connect = 110
[imaps]
accept = 993
connect = 143
[ssmtp]
accept = 465
connect = 25
[mysqls]
accept = 3307
connect = 192.168.1.6:3307
On 192.168.1.6
----------------------
pid = /var/stunnel.pid
setuid =nobody
setgid = nobody
foreground = yes
client = no
; Service-level configuration
[pop3s]
accept = 995
connect = 110
[imaps]
accept = 993
connect = 143
[ssmtp]
accept = 465
connect = 25
[mysqls]
accept =3307
connect =3306
connecting like
/usr/local/mysql/bin/mysql -h 127.0.0.1 -u root -p -P 3307
Enter password:
On entring password the following lines appear :
ERROR 2013 (HY000): Lost connection to MySQL server at 'reading initial communication packet', system error: 104
Subrata
----- Original Message -----
From: Brian Hatch <bri(a)stunnel.org>
To: subrata(a)indiatimes.com
Sent: Sun, 7 Oct 2007 10:02:17 +0530 (IST)
Subject: Re: [stunnel-users] Stunnel on the same machine
Near 2007-10-05 22:17 +0530, subrata(a)indiatimes.com insisted:
> After starting stunnel and connecting the mysql client/usr/local/mysql/bin/mysql -h 127.0.0.1 -u root -p the flow gets stuck at the Enter password prompt any suggestions how to proceed from there.
What do your stunnel configuration files look like?
Other problem: mysql client may decide to use a local domain socket when
connecting to localhost, thwarting your attempts to go via Stunnel.
You might want to 'strace mysql ...' and look for the connect() lines.
--
Brian Hatch Time flies like an
Systems and arrow. Fruit flies
Security Engineer like a banana.
http://www.ifokr.org/bri/
Every message PGP signed
--
My life has changed. What about yours?
Log on to the new Indiatimes Mail and Live out of the Inbox!
3
3
Sometime near 2007-11-11 00:15 -0500, Marcio Marchini shouted:
> Researching online one can see that WebDAV's spec requires that they
> check both src and dest URLs for protocol & port. But with some proxies or
> SSL fronts like stunnel, only one of the URLs is rewritten, so one goes as
> http and the other as https. Here's one person explaining it, much better
> than me: http://svn.haxx.se/users/archive-2006-03/0549.shtml
Stunnel doesn't currently have the ability to scan and re-write the
plaintext. For HTTP redirects it could possibly be implemented
(re-write only the response before ^$, and redirects aren't chunked
and don't have content lengths to work with, etc) but you'd still
need enough HTTP logic to handle keepalives and such. It's not
trivial and not likely.
Another option would be to have something already HTTP aware doing
the rewriting in between stunnel and subversion. A re-writing
proxy.
Another option would be to use mod_rewrite in apache to rewrite
the urls.
But the best way would be to just use SSL inside apache and drop
stunnel entirely.
--
Brian Hatch The best way to accelerate
Systems and a Windows machine is at
Security Engineer 9.8 meters per second
http://www.ifokr.org/bri/ squared.
Every message PGP signed
3
2
Hi,
starting with v4.21, stunnel does not disconnect from the terminal anymore. This
can cause problems, if the caller does not redirect stdout/stderr to /dev/null.
This did not happen with v4.20.
The problem disappears, when I use he "--disable-libwrap" configure switch when
compiling stunnel.
I am running debian testing on i386 with the stunnel4 package 4.22-2.
How to reproduce:
1) stunnel config file:
setuid = lars
pid = /tmp/stunnel.pid
[server]
connect = 8080
accept = 443
cert = /some/file
2) command line:
cat stunnel.conf | stunnel4 -fd 0
3) process list:
erker:~/ttt/stunnel/testing/stunnel-4.26# ps -ef| grep stun
lars 29599 1 0 13:47 pts/1 00:00:00 src/stunnel -fd 0
lars 29600 1 0 13:47 pts/1 00:00:00 src/stunnel -fd 0
lars 29601 1 0 13:47 pts/1 00:00:00 src/stunnel -fd 0
lars 29602 1 0 13:47 pts/1 00:00:00 src/stunnel -fd 0
lars 29603 1 0 13:47 pts/1 00:00:00 src/stunnel -fd 0
lars 29604 1 0 13:47 ? 00:00:00 src/stunnel -fd 0
4) FDs of spawned processes:
erker:~/ttt/stunnel/testing/stunnel-4.26# ls -l /proc/29599/fd
lrwx------ 1 root root 64 Jan 10 13:50 1 -> /dev/pts/1
lrwx------ 1 root root 64 Jan 10 13:47 2 -> /dev/pts/1
lrwx------ 1 root root 64 Jan 10 13:50 3 -> socket:[903037]
Is this the expected behaviour?
I use stunnel in one of my projects (http://cryptonas.org) and it started to
hang with v4.22. After redirecting stdout/stderr to /dev/null, the program
works again.
I assume, that stunnel should take care for stdout/stderr on its own, when
started in daemon mode, right?
thanks for your great work!
Lars
4
6
I am attempting to send/receive to GMail through a CRM program (contains
email client) called ACT! (http://www.act.com) ACT! only allows server
addresses in the program configuration, NOT port numbers. (e.g.
smtp.gmail.com or 127.0.0.1 - nothing else)
I have configured *stunnel 4.26* as such:
; Some performance tunings
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
; Some debugging stuff useful for troubleshooting
debug = 7
output = stunnel.log
; Use it for client mode
client = yes
; Service-level configuration
[pop]
accept = localhost:110
connect = pop.gmail.com:995
[smtp]
accept = localhost:25
connect = smtp.gmail.com:465
and in ACT as such:
SMTP as localhost
POP as localhost
(also have tried 127.0.0.1, but with no difference).
The log is below, but the short of it is that I still cannot get through to
the GMail servers. I do not see any glaring errors below, but I'm sure
there is something useful. Thank you for any help...
2009.02.24 13:34:35 LOG7[3752:2216]: RAND_status claims sufficient entropy
for the PRNG
2009.02.24 13:34:35 LOG7[3752:2216]: PRNG seeded successfully
2009.02.24 13:34:35 LOG7[3752:2216]: SSL context initialized for service pop
2009.02.24 13:34:35 LOG7[3752:2216]: SSL context initialized for service
smtp
2009.02.24 13:34:35 LOG5[3752:2216]: stunnel 4.26 on x86-pc-mingw32-gnu with
OpenSSL 0.9.8i 15 Sep 2008
2009.02.24 13:34:35 LOG5[3752:2216]: Threading:WIN32 SSL:ENGINE
Sockets:SELECT,IPv6
2009.02.24 13:34:35 LOG5[3752:1576]: No limit detected for the number of
clients
2009.02.24 13:34:35 LOG7[3752:1576]: FD 200 in non-blocking mode
2009.02.24 13:34:35 LOG7[3752:1576]: SO_REUSEADDR option set on accept
socket
2009.02.24 13:34:35 LOG7[3752:1576]: pop bound to 127.0.0.1:110
2009.02.24 13:34:35 LOG7[3752:1576]: FD 208 in non-blocking mode
2009.02.24 13:34:35 LOG7[3752:1576]: SO_REUSEADDR option set on accept
socket
2009.02.24 13:34:35 LOG7[3752:1576]: smtp bound to 127.0.0.1:25
2009.02.24 13:34:39 LOG7[3752:1576]: smtp accepted FD=216 from
127.0.0.1:3063
2009.02.24 13:34:39 LOG7[3752:1576]: Creating a new thread
2009.02.24 13:34:39 LOG7[3752:1576]: New thread created
2009.02.24 13:34:39 LOG7[3752:760]: smtp started
2009.02.24 13:34:39 LOG7[3752:760]: FD 216 in non-blocking mode
2009.02.24 13:34:39 LOG7[3752:760]: TCP_NODELAY option set on local socket
2009.02.24 13:34:39 LOG5[3752:760]: smtp accepted connection from
127.0.0.1:3063
2009.02.24 13:34:39 LOG7[3752:760]: FD 240 in non-blocking mode
2009.02.24 13:34:39 LOG7[3752:760]: smtp connecting 209.85.201.111:465
2009.02.24 13:34:39 LOG7[3752:760]: connect_wait: waiting 10 seconds
2009.02.24 13:34:39 LOG7[3752:760]: connect_wait: connected
2009.02.24 13:34:39 LOG5[3752:760]: smtp connected remote server from
192.168.1.100:3064
2009.02.24 13:34:39 LOG7[3752:760]: Remote FD=240 initialized
2009.02.24 13:34:39 LOG7[3752:760]: TCP_NODELAY option set on remote socket
2009.02.24 13:34:39 LOG7[3752:760]: SSL state (connect): before/connect
initialization
2009.02.24 13:34:39 LOG7[3752:760]: SSL state (connect): SSLv3 write client
hello A
2009.02.24 13:34:39 LOG7[3752:760]: SSL state (connect): SSLv3 read server
hello A
2009.02.24 13:34:39 LOG7[3752:760]: SSL state (connect): SSLv3 read server
certificate A
2009.02.24 13:34:39 LOG7[3752:760]: SSL state (connect): SSLv3 read server
done A
2009.02.24 13:34:39 LOG7[3752:760]: SSL state (connect): SSLv3 write client
key exchange A
2009.02.24 13:34:39 LOG7[3752:760]: SSL state (connect): SSLv3 write change
cipher spec A
2009.02.24 13:34:39 LOG7[3752:760]: SSL state (connect): SSLv3 write
finished A
2009.02.24 13:34:39 LOG7[3752:760]: SSL state (connect): SSLv3 flush data
2009.02.24 13:34:39 LOG7[3752:760]: SSL state (connect): SSLv3 read finished
A
2009.02.24 13:34:39 LOG7[3752:760]: 1 items in the session cache
2009.02.24 13:34:39 LOG7[3752:760]: 1 client connects (SSL_connect())
2009.02.24 13:34:39 LOG7[3752:760]: 1 client connects that finished
2009.02.24 13:34:39 LOG7[3752:760]: 0 client renegotiations requested
2009.02.24 13:34:39 LOG7[3752:760]: 0 server connects (SSL_accept())
2009.02.24 13:34:39 LOG7[3752:760]: 0 server connects that finished
2009.02.24 13:34:39 LOG7[3752:760]: 0 server renegotiations requested
2009.02.24 13:34:39 LOG7[3752:760]: 0 session cache hits
2009.02.24 13:34:39 LOG7[3752:760]: 0 session cache misses
2009.02.24 13:34:39 LOG7[3752:760]: 0 session cache timeouts
2009.02.24 13:34:39 LOG6[3752:760]: SSL connected: new session negotiated
2009.02.24 13:34:39 LOG6[3752:760]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA
Au=RSA Enc=RC4(128) Mac=MD5
2009.02.24 13:34:39 LOG7[3752:760]: SSL socket closed on SSL_read
2009.02.24 13:34:39 LOG7[3752:760]: Socket write shutdown
2009.02.24 13:34:39 LOG5[3752:760]: Connection closed: 20 bytes sent to SSL,
226 bytes sent to socket
2009.02.24 13:34:39 LOG7[3752:760]: smtp finished (0 left)
2009.02.24 13:34:39 LOG7[3752:1576]: pop accepted FD=232 from 127.0.0.1:3065
2009.02.24 13:34:39 LOG7[3752:1576]: Creating a new thread
2009.02.24 13:34:39 LOG7[3752:1576]: New thread created
2009.02.24 13:34:39 LOG7[3752:376]: pop started
2009.02.24 13:34:39 LOG7[3752:376]: FD 232 in non-blocking mode
2009.02.24 13:34:39 LOG7[3752:376]: TCP_NODELAY option set on local socket
2009.02.24 13:34:39 LOG5[3752:376]: pop accepted connection from
127.0.0.1:3065
2009.02.24 13:34:39 LOG7[3752:376]: FD 240 in non-blocking mode
2009.02.24 13:34:39 LOG7[3752:376]: pop connecting 209.85.147.109:995
2009.02.24 13:34:39 LOG7[3752:376]: connect_wait: waiting 10 seconds
2009.02.24 13:34:42 LOG7[3752:376]: connect_wait: connected
2009.02.24 13:34:42 LOG5[3752:376]: pop connected remote server from
192.168.1.100:3066
2009.02.24 13:34:42 LOG7[3752:376]: Remote FD=240 initialized
2009.02.24 13:34:42 LOG7[3752:376]: TCP_NODELAY option set on remote socket
2009.02.24 13:34:42 LOG7[3752:376]: SSL state (connect): before/connect
initialization
2009.02.24 13:34:42 LOG7[3752:376]: SSL state (connect): SSLv3 write client
hello A
2009.02.24 13:34:42 LOG7[3752:376]: SSL state (connect): SSLv3 read server
hello A
2009.02.24 13:34:42 LOG7[3752:376]: SSL state (connect): SSLv3 read server
certificate A
2009.02.24 13:34:42 LOG7[3752:376]: SSL state (connect): SSLv3 read server
done A
2009.02.24 13:34:42 LOG7[3752:376]: SSL state (connect): SSLv3 write client
key exchange A
2009.02.24 13:34:42 LOG7[3752:376]: SSL state (connect): SSLv3 write change
cipher spec A
2009.02.24 13:34:42 LOG7[3752:376]: SSL state (connect): SSLv3 write
finished A
2009.02.24 13:34:42 LOG7[3752:376]: SSL state (connect): SSLv3 flush data
2009.02.24 13:34:42 LOG7[3752:376]: SSL state (connect): SSLv3 read finished
A
2009.02.24 13:34:42 LOG7[3752:376]: 1 items in the session cache
2009.02.24 13:34:42 LOG7[3752:376]: 1 client connects (SSL_connect())
2009.02.24 13:34:42 LOG7[3752:376]: 1 client connects that finished
2009.02.24 13:34:42 LOG7[3752:376]: 0 client renegotiations requested
2009.02.24 13:34:42 LOG7[3752:376]: 0 server connects (SSL_accept())
2009.02.24 13:34:42 LOG7[3752:376]: 0 server connects that finished
2009.02.24 13:34:42 LOG7[3752:376]: 0 server renegotiations requested
2009.02.24 13:34:42 LOG7[3752:376]: 0 session cache hits
2009.02.24 13:34:42 LOG7[3752:376]: 0 session cache misses
2009.02.24 13:34:42 LOG7[3752:376]: 0 session cache timeouts
2009.02.24 13:34:42 LOG6[3752:376]: SSL connected: new session negotiated
2009.02.24 13:34:42 LOG6[3752:376]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA
Au=RSA Enc=RC4(128) Mac=MD5
2009.02.24 13:34:42 LOG7[3752:1576]: smtp accepted FD=264 from
127.0.0.1:3067
2009.02.24 13:34:42 LOG7[3752:1576]: Creating a new thread
2009.02.24 13:34:42 LOG7[3752:1576]: New thread created
2009.02.24 13:34:42 LOG7[3752:216]: smtp started
2009.02.24 13:34:42 LOG7[3752:216]: FD 264 in non-blocking mode
2009.02.24 13:34:42 LOG7[3752:216]: TCP_NODELAY option set on local socket
2009.02.24 13:34:42 LOG5[3752:216]: smtp accepted connection from
127.0.0.1:3067
2009.02.24 13:34:42 LOG7[3752:216]: FD 288 in non-blocking mode
2009.02.24 13:34:42 LOG7[3752:216]: smtp connecting 209.85.201.109:465
2009.02.24 13:34:42 LOG7[3752:216]: connect_wait: waiting 10 seconds
2009.02.24 13:34:42 LOG7[3752:216]: connect_wait: connected
2009.02.24 13:34:42 LOG5[3752:216]: smtp connected remote server from
192.168.1.100:3068
2009.02.24 13:34:42 LOG7[3752:216]: Remote FD=288 initialized
2009.02.24 13:34:42 LOG7[3752:216]: TCP_NODELAY option set on remote socket
2009.02.24 13:34:42 LOG7[3752:216]: SSL state (connect): before/connect
initialization
2009.02.24 13:34:42 LOG7[3752:216]: SSL state (connect): SSLv3 write client
hello A
2009.02.24 13:34:42 LOG7[3752:216]: SSL state (connect): SSLv3 read server
hello A
2009.02.24 13:34:42 LOG7[3752:216]: SSL state (connect): SSLv3 read server
certificate A
2009.02.24 13:34:42 LOG7[3752:216]: SSL state (connect): SSLv3 read server
done A
2009.02.24 13:34:42 LOG7[3752:216]: SSL state (connect): SSLv3 write client
key exchange A
2009.02.24 13:34:42 LOG7[3752:216]: SSL state (connect): SSLv3 write change
cipher spec A
2009.02.24 13:34:42 LOG7[3752:216]: SSL state (connect): SSLv3 write
finished A
2009.02.24 13:34:42 LOG7[3752:216]: SSL state (connect): SSLv3 flush data
2009.02.24 13:34:42 LOG7[3752:216]: SSL state (connect): SSLv3 read finished
A
2009.02.24 13:34:42 LOG7[3752:216]: 2 items in the session cache
2009.02.24 13:34:42 LOG7[3752:216]: 2 client connects (SSL_connect())
2009.02.24 13:34:42 LOG7[3752:216]: 2 client connects that finished
2009.02.24 13:34:42 LOG7[3752:216]: 0 client renegotiations requested
2009.02.24 13:34:42 LOG7[3752:216]: 0 server connects (SSL_accept())
2009.02.24 13:34:42 LOG7[3752:216]: 0 server connects that finished
2009.02.24 13:34:42 LOG7[3752:216]: 0 server renegotiations requested
2009.02.24 13:34:42 LOG7[3752:216]: 0 session cache hits
2009.02.24 13:34:42 LOG7[3752:216]: 0 session cache misses
2009.02.24 13:34:42 LOG7[3752:216]: 0 session cache timeouts
2009.02.24 13:34:42 LOG6[3752:216]: SSL connected: new session negotiated
2009.02.24 13:34:42 LOG6[3752:216]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA
Au=RSA Enc=RC4(128) Mac=MD5
2009.02.24 13:34:43 LOG3[3752:216]: readsocket: Connection reset by peer
(WSAECONNRESET) (10054)
2009.02.24 13:34:43 LOG5[3752:216]: Connection reset: 63 bytes sent to SSL,
335 bytes sent to socket
2009.02.24 13:34:43 LOG7[3752:216]: smtp finished (1 left)
2009.02.24 13:35:43 LOG7[3752:376]: SSL socket closed on SSL_read
2009.02.24 13:35:43 LOG7[3752:376]: Socket write shutdown
2009.02.24 13:35:43 LOG5[3752:376]: Connection closed: 48 bytes sent to SSL,
131 bytes sent to socket
2009.02.24 13:35:43 LOG7[3752:376]: pop finished (0 left)
Richard Brust
rbrDataSolutions/ACT! Certified Consulting
http://www.rbrDataSolutions.com
916/769-9411
1
0
Hi, I use the STunnel tool to connect to my Ms-SQL database. And so far
this works nice. However at one organization I have the following
problem:
<< connect_wait: s_poll_wait timeout>> And the connection fails.
Here is the log file and config file. Can you give me any hints how to
check where it goes wrong?
Thanks.
Reinier.
2009.02.23 14:45:12 LOG7[2156:3096]: RAND_status claims sufficient
entropy for the PRNG
2009.02.23 14:45:12 LOG7[2156:3096]: PRNG seeded successfully
2009.02.23 14:45:12 LOG7[2156:3096]: Certificate: stunnel.pem
2009.02.23 14:45:12 LOG7[2156:3096]: Certificate loaded
2009.02.23 14:45:12 LOG7[2156:3096]: Key file: stunnel.pem
2009.02.23 14:45:12 LOG7[2156:3096]: Private key loaded
2009.02.23 14:45:12 LOG7[2156:3096]: SSL context initialized for service
SQLServer
2009.02.23 14:45:12 LOG5[2156:3096]: stunnel 4.26 on x86-pc-mingw32-gnu
with OpenSSL 0.9.8i 15 Sep 2008
2009.02.23 14:45:12 LOG5[2156:3096]: Threading:WIN32 SSL:ENGINE
Sockets:SELECT,IPv6
2009.02.23 14:45:12 LOG5[2156:3852]: No limit detected for the number of
clients
2009.02.23 14:45:12 LOG7[2156:3852]: FD 184 in non-blocking mode
2009.02.23 14:45:12 LOG7[2156:3852]: SO_REUSEADDR option set on accept
socket
2009.02.23 14:45:12 LOG7[2156:3852]: SQLServer bound to 127.0.0.1:31433
2009.02.23 14:49:25 LOG7[2156:3852]: SQLServer accepted FD=208 from
127.0.0.1:2912
2009.02.23 14:49:25 LOG7[2156:3852]: Creating a new thread
2009.02.23 14:49:25 LOG7[2156:3852]: New thread created
2009.02.23 14:49:25 LOG7[2156:996]: SQLServer started
2009.02.23 14:49:25 LOG7[2156:996]: FD 208 in non-blocking mode
2009.02.23 14:49:25 LOG7[2156:996]: TCP_NODELAY option set on local
socket
2009.02.23 14:49:25 LOG5[2156:996]: SQLServer accepted connection from
127.0.0.1:2912
2009.02.23 14:49:25 LOG7[2156:996]: FD 232 in non-blocking mode
2009.02.23 14:49:25 LOG7[2156:996]: SQLServer connecting
10.17.98.33:8080
2009.02.23 14:49:25 LOG7[2156:996]: connect_wait: waiting 60 seconds
2009.02.23 14:50:25 LOG6[2156:996]: connect_wait: s_poll_wait timeout
2009.02.23 14:50:25 LOG5[2156:996]: Connection reset: 0 bytes sent to
SSL, 0 bytes sent to socket
2009.02.23 14:50:25 LOG7[2156:996]: SQLServer finished (0 left)
; Sample stunnel configuration file by Michal Trojnara 2002-2006
; Some options used here may not be adequate for your particular
configuration
; Certificate/key is needed in server mode and optional in client mode
; The default certificate is provided only for testing and should not
; be used in a production environment
cert = stunnel.pem
;key = stunnel.pem
; Some performance tunings
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
; Authentication stuff
;verify = 2
; Don't forget to c_rehash CApath
;CApath = certs
; It's often easier to use CAfile
;CAfile = certs.pem
; Don't forget to c_rehash CRLpath
;CRLpath = crls
; Alternatively you can use CRLfile
;CRLfile = crls.pem
; Some debugging stuff useful for troubleshooting
debug = 7
;output = stunnel.log
; Use it for client mode
client = yes
; Service-level configuration
[SQLServer]
accept = 127.0.0.1:31433
;connect = xx.xx.xxx.xxx:443
connect = 10.17.98.33:8080
protocol = connect
protocolHost = xx.xx.xxx.xxx:443
;session cache timeout
session = 60
;time to wait for expected data
TIMEOUTbusy = 60
;time to wait for close_notify (set to 0 for buggy MSIE)
;TIMEOUTclose = 30
;time to wait to connect a remote host
TIMEOUTconnect = 60
;time to keep an idle connection
;TIMEOUTidle = 60
1
0
13 Feb '09
>Adamson H wrote:
>> Hi, stunnel 4.26 solves a number of issues running on FreeBSD. However,
>> a stunnel client still has a problem reconnecting to a host with dynamic
>> DNS service after the host IP has changed. Stunnel client seems unaware
>> of the host update, pointing the dynamic DNS name to the old outdated
>> IP. In order to get reconnected to the host, I have to create a cron
>> script to detect the IP change and restart stunnel on the stunnel
>> client. My client conf file has the following:
>>
>> [1873]
>> accept = 1873
>> connect = hostname.dynaip.org:1873
>>
>> The ip of hostname.dynaip.org changes at a random interval.
>
>The solution is:
>delay = yes
>
>Best regards,
>Mike
>_______________________________________________
>stunnel-users mailing list
>stunnel-users(a)mirt.net <mailto:[email protected]>
>http://stunnel.mirt.net/mailman/listinfo/stunnel-users
I added delay = yes to my stunnel client conf file and removed the cron
script. The rsync job (873) failed after the IP of the stunnel host had
changed. I had to manually restart stunnel to get the job done and put
the cron script back again.
delay = yes does not with work with ddns.
Regards,
Adamson H
3
4
Hi,
on my current project I have a strange error. Stunnel will work for
months and suddenly stop accepting connections. At other times it will
fail after a couple of hours. It doesn't crash. Connections are still
accepted, but no SSL negotiation does take place. Please find a log below.
It seems to be some problem with libwrap. As you can see in the logs the
last usage of libwrap doesn't release libwrap properly. "Released
libwrap process" log statement is missing. And after that just
everything hangs waiting for libwrap. But why is this happening?
Our host.allow and host.deny files are empty. libwrap is supposed to
allow everything.
Any suggestions are welcome!
Thanks in advance
Ulrich
2009.02.10 09:23:16 LOG7[24594:3083130544]: epp accepted FD=22 from
212.227.111.32:59551
2009.02.10 09:23:16 LOG7[24594:3082640272]: epp started
2009.02.10 09:23:16 LOG7[24594:3082640272]: FD 22 in non-blocking mode
2009.02.10 09:23:16 LOG7[24594:3082640272]: TCP_NODELAY option set on
local socket
2009.02.10 09:23:16 LOG7[24594:3082640272]: Waiting for a libwrap process
2009.02.10 09:23:16 LOG7[24594:3082640272]: Acquired libwrap process #4
2009.02.10 09:23:16 LOG7[24594:3082640272]: Releasing libwrap process #4
2009.02.10 09:23:16 LOG7[24594:3082640272]: Released libwrap process #4
2009.02.10 09:23:16 LOG7[24594:3082640272]: epp permitted by libwrap
from 212.227.111.32:59551
2009.02.10 09:23:16 LOG5[24594:3082640272]: epp accepted connection from
212.227.111.32:59551
2009.02.10 09:23:16 LOG7[24594:3082640272]: SSL state (accept):
before/accept initialization
2009.02.10 09:23:16 LOG7[24594:3082640272]: SSL state (accept): SSLv3
read client hello A
2009.02.10 09:23:16 LOG7[24594:3082640272]: SSL state (accept): SSLv3
write server hello A
2009.02.10 09:23:16 LOG7[24594:3082640272]: SSL state (accept): SSLv3
write certificate A
2009.02.10 09:23:16 LOG7[24594:3082640272]: SSL state (accept): SSLv3
write server done A
2009.02.10 09:23:16 LOG7[24594:3082640272]: SSL state (accept): SSLv3
flush data
2009.02.10 09:23:16 LOG7[24594:3082918800]: Socket closed on read
2009.02.10 09:23:16 LOG7[24594:3082918800]: SSL write shutdown
2009.02.10 09:23:16 LOG7[24594:3082918800]: SSL alert (write): warning:
close notify
2009.02.10 09:23:16 LOG6[24594:3082918800]: SSL socket closed on
SSL_shutdown
2009.02.10 09:23:16 LOG7[24594:3082918800]: Socket write shutdown
2009.02.10 09:23:16 LOG5[24594:3082918800]: Connection closed: 2249
bytes sent to SSL, 1169 bytes sent to socket
2009.02.10 09:23:16 LOG7[24594:3082918800]: epp finished (5 left)
2009.02.10 09:23:16 LOG7[24594:3082709904]: SSL state (accept): SSLv3
read client key exchange A
2009.02.10 09:23:16 LOG7[24594:3082709904]: SSL state (accept): SSLv3
read finished A
2009.02.10 09:23:16 LOG7[24594:3082709904]: SSL state (accept): SSLv3
write change cipher spec A
2009.02.10 09:23:16 LOG7[24594:3082709904]: SSL state (accept): SSLv3
write finished A
2009.02.10 09:23:16 LOG7[24594:3082709904]: SSL state (accept): SSLv3
flush data
2009.02.10 09:23:16 LOG7[24594:3082709904]: 36 items in the session cache
2009.02.10 09:23:16 LOG7[24594:3082709904]: 0 client connects
(SSL_connect())
2009.02.10 09:23:16 LOG7[24594:3082709904]: 0 client connects that
finished
2009.02.10 09:23:16 LOG7[24594:3082709904]: 0 client renegotiations
requested
2009.02.10 09:23:16 LOG7[24594:3082709904]: 292 server connects
(SSL_accept())
2009.02.10 09:23:16 LOG7[24594:3082709904]: 290 server connects that
finished
2009.02.10 09:23:16 LOG7[24594:3082709904]: 0 server renegotiations
requested
2009.02.10 09:23:16 LOG7[24594:3082709904]: 41 session cache hits
2009.02.10 09:23:16 LOG7[24594:3082709904]: 1 session cache misses
2009.02.10 09:23:16 LOG7[24594:3082709904]: 6 session cache timeouts
2009.02.10 09:23:16 LOG6[24594:3082709904]: SSL accepted: new session
negotiated
2009.02.10 09:23:16 LOG6[24594:3082709904]: Negotiated ciphers:
AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1
2009.02.10 09:23:16 LOG7[24594:3082709904]: FD 16 in non-blocking mode
2009.02.10 09:23:16 LOG7[24594:3082709904]: epp connecting 127.0.0.1:9777
2009.02.10 09:23:16 LOG7[24594:3082709904]: connect_wait: waiting 10 seconds
2009.02.10 09:23:16 LOG7[24594:3082709904]: connect_wait: connected
2009.02.10 09:23:16 LOG5[24594:3082709904]: epp connected remote server
from 127.0.0.1:40831
2009.02.10 09:23:16 LOG7[24594:3082709904]: Remote FD=16 initialized
2009.02.10 09:23:16 LOG7[24594:3082709904]: TCP_NODELAY option set on
remote socket
2009.02.10 09:23:16 LOG7[24594:3082640272]: SSL state (accept): SSLv3
read client key exchange A
2009.02.10 09:23:16 LOG7[24594:3082640272]: SSL state (accept): SSLv3
read finished A
2009.02.10 09:23:16 LOG7[24594:3082640272]: SSL state (accept): SSLv3
write change cipher spec A
2009.02.10 09:23:16 LOG7[24594:3082640272]: SSL state (accept): SSLv3
write finished A
2009.02.10 09:23:16 LOG7[24594:3082640272]: SSL state (accept): SSLv3
flush data
2009.02.10 09:23:16 LOG7[24594:3082640272]: 37 items in the session cache
2009.02.10 09:23:16 LOG7[24594:3082640272]: 0 client connects
(SSL_connect())
2009.02.10 09:23:16 LOG7[24594:3082640272]: 0 client connects that
finished
2009.02.10 09:23:16 LOG7[24594:3082640272]: 0 client renegotiations
requested
2009.02.10 09:23:16 LOG7[24594:3082640272]: 292 server connects
(SSL_accept())
2009.02.10 09:23:16 LOG7[24594:3082640272]: 291 server connects that
finished
2009.02.10 09:23:16 LOG7[24594:3082640272]: 0 server renegotiations
requested
2009.02.10 09:23:16 LOG7[24594:3082640272]: 41 session cache hits
2009.02.10 09:23:16 LOG7[24594:3082640272]: 1 session cache misses
2009.02.10 09:23:16 LOG7[24594:3082640272]: 6 session cache timeouts
2009.02.10 09:23:16 LOG6[24594:3082640272]: SSL accepted: new session
negotiated
2009.02.10 09:23:16 LOG6[24594:3082640272]: Negotiated ciphers:
AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1
2009.02.10 09:23:16 LOG7[24594:3082640272]: FD 18 in non-blocking mode
2009.02.10 09:23:16 LOG7[24594:3082640272]: epp connecting 127.0.0.1:9777
2009.02.10 09:23:16 LOG7[24594:3082640272]: connect_wait: waiting 10 seconds
2009.02.10 09:23:16 LOG7[24594:3082640272]: connect_wait: connected
2009.02.10 09:23:16 LOG5[24594:3082640272]: epp connected remote server
from 127.0.0.1:40832
2009.02.10 09:23:16 LOG7[24594:3082640272]: Remote FD=18 initialized
2009.02.10 09:23:16 LOG7[24594:3082640272]: TCP_NODELAY option set on
remote socket
2009.02.10 09:23:16 LOG7[24594:3083127696]: Socket closed on read
2009.02.10 09:23:16 LOG7[24594:3083127696]: SSL write shutdown
2009.02.10 09:23:16 LOG7[24594:3083127696]: SSL alert (write): warning:
close notify
2009.02.10 09:23:16 LOG6[24594:3083127696]: SSL socket closed on
SSL_shutdown
2009.02.10 09:23:16 LOG7[24594:3083127696]: Socket write shutdown
2009.02.10 09:23:16 LOG5[24594:3083127696]: Connection closed: 2249
bytes sent to SSL, 1169 bytes sent to socket
2009.02.10 09:23:16 LOG7[24594:3083127696]: epp finished (4 left)
2009.02.10 09:23:30 LOG7[24594:3083130544]: epp accepted FD=15 from
62.116.129.3:3503
2009.02.10 09:23:30 LOG7[24594:3083127696]: epp started
2009.02.10 09:23:30 LOG7[24594:3083127696]: FD 15 in non-blocking mode
2009.02.10 09:23:30 LOG7[24594:3083127696]: TCP_NODELAY option set on
local socket
2009.02.10 09:23:30 LOG7[24594:3083127696]: Waiting for a libwrap process
2009.02.10 09:23:30 LOG7[24594:3083127696]: Acquired libwrap process #4
2009.02.10 09:23:30 LOG7[24594:3083130544]: epp accepted FD=17 from
62.116.129.3:3504
2009.02.10 09:23:30 LOG7[24594:3082918800]: epp started
2009.02.10 09:23:30 LOG7[24594:3082918800]: FD 17 in non-blocking mode
2009.02.10 09:23:30 LOG7[24594:3082918800]: TCP_NODELAY option set on
local socket
2009.02.10 09:23:30 LOG7[24594:3082918800]: Waiting for a libwrap process
2009.02.10 09:23:30 LOG7[24594:3083127696]: Releasing libwrap process #4
2009.02.10 09:23:45 LOG7[24594:3083130544]: epp accepted FD=23 from
62.116.129.3:35076
2009.02.10 09:23:45 LOG7[24594:3082779536]: epp started
2009.02.10 09:23:45 LOG7[24594:3082779536]: FD 23 in non-blocking mode
2009.02.10 09:23:45 LOG7[24594:3082779536]: TCP_NODELAY option set on
local socket
2009.02.10 09:23:45 LOG7[24594:3082779536]: Waiting for a libwrap process
2009.02.10 09:23:48 LOG7[24594:3083130544]: epp accepted FD=24 from
212.209.10.53:4853
2009.02.10 09:23:48 LOG7[24594:3083058064]: epp started
2009.02.10 09:23:48 LOG7[24594:3083058064]: FD 24 in non-blocking mode
2009.02.10 09:23:48 LOG7[24594:3083058064]: TCP_NODELAY option set on
local socket
2009.02.10 09:23:48 LOG7[24594:3083058064]: Waiting for a libwrap process
2009.02.10 09:24:01 LOG7[24594:3083130544]: epp accepted FD=25 from
62.116.129.3:35084
2009.02.10 09:24:01 LOG7[24594:3082570640]: epp started
2009.02.10 09:24:01 LOG7[24594:3082570640]: FD 25 in non-blocking mode
2009.02.10 09:24:01 LOG7[24594:3082570640]: TCP_NODELAY option set on
local socket
2009.02.10 09:24:01 LOG7[24594:3082570640]: Waiting for a libwrap process
2009.02.10 09:24:50 LOG7[24594:3083130544]: epp accepted FD=26 from
91.203.4.58:3814
2009.02.10 09:24:50 LOG7[24594:3082501008]: epp started
2009.02.10 09:24:50 LOG7[24594:3082501008]: FD 26 in non-blocking mode
2009.02.10 09:24:50 LOG7[24594:3082501008]: TCP_NODELAY option set on
local socket
2009.02.10 09:24:50 LOG7[24594:3082501008]: Waiting for a libwrap process
2009.02.10 09:25:29 LOG7[24594:3083130544]: epp accepted FD=27 from
87.96.215.128:34595
2009.02.10 09:25:29 LOG7[24594:3082431376]: epp started
2009.02.10 09:25:29 LOG7[24594:3082431376]: FD 27 in non-blocking mode
2009.02.10 09:25:29 LOG7[24594:3082431376]: TCP_NODELAY option set on
local socket
2009.02.10 09:25:29 LOG7[24594:3082431376]: Waiting for a libwrap process
2009.02.10 09:25:40 LOG7[24594:3083130544]: epp accepted FD=28 from
195.249.40.26:36799
2009.02.10 09:25:40 LOG7[24594:3082361744]: epp started
2009.02.10 09:25:40 LOG7[24594:3082361744]: FD 28 in non-blocking mode
2
1
Hi, stunnel 4.26 solves a number of issues running on FreeBSD. However,
a stunnel client still has a problem reconnecting to a host with dynamic
DNS service after the host IP has changed. Stunnel client seems unaware
of the host update, pointing the dynamic DNS name to the old outdated
IP. In order to get reconnected to the host, I have to create a cron
script to detect the IP change and restart stunnel on the stunnel
client. My client conf file has the following:
[1873]
accept = 1873
connect = hostname.dynaip.org:1873
The ip of hostname.dynaip.org changes at a random interval.
Please help.
Adamosn H
2
1
kommersz wrote:
> My understanding was that there was a patch merged into Stunnel codeline
> with version 4.05 a long time ago which allows the parameters
> "httpsproxy_dest" and some others to be used when specifying a [https]
> connection in stunnel.conf.
Your understanding is not correct, but similar functionality was
re-implemented from scratch.
You may consider Reading The Fine Manual at:
http://stunnel.mirt.net/static/stunnel.html
The relevant part is:
protocol = proto
application protocol to negotiate SSL
currently supported: cifs, connect, imap, nntp, pop3, smtp
protocolAuthentication = auth_type
authentication type for protocol negotiations
currently supported: basic, NTLM
Currently authentication type only applies to 'connect' protocol.
default: basic
protocolHost = host:port
destination address for protocol negotiations
protocolPassword = password
password for protocol negotiations
protocolUsername = username
username for protocol negotiations
Best regards,
Mike
1
0