Guy, Your suggestion fixed the problem. Thank you!
Regards, Jeff
Guy wrote:
> Jeff Salisbury wrote:
>
>
>> Greetings, We have been using Stunnel 4.26 to facilitate the
>> sending and receiving of email with an email client that is not
>> SSL enabled. Version 4.26 has been working great. However, when
>> we upgrade to 4.27, we are unable to POP email (we can send
>> email). We did not change our Stunnel.conf file.
>>
>> Can anyone advise us what we need to do to get 4.27 working?
>> I've included our Stunnel.conf file contents, and the Stunnel log
>> output below.
>>
>>
>
>
>
> Try: sslVersion = TLSv1
>
>
> See below.
>
>
>
> Your Modified Configuration File:
>
> #####
> # GLOBAL OPTIONS
>
> client = yes
> #output = C:\Documents and Settings\All Users\Application Data\stunnel-log.txt
> debug = 7
> taskbar = yes
>
> sslVersion = TLSv1
>
> # SERVICE-LEVEL OPTIONS
>
> [pop3]
> accept=995
> connect=mail.OurPOP.com:995
>
> [smtp]
> accept=465
> connect=mail.OurSMTP.com:465
> #
> #####
>
>
>
> Configuration File Used:
>
> #####
> #
> client = yes
> debug = debug
> output = _test.log
> rndbytes = 256
> rndfile = t:\tmp\randseed.bin
> socket = l:TCP_NODELAY=1
> socket = r:TCP_NODELAY=1
>
> sslVersion = TLSv1
>
> [YOUR-POP3S]
> accept=TUNNEL-01:110
> connect=216.97.239.60:995
>
> [YOUR-SMTPS]
> accept=TUNNEL-01:25
> connect=216.97.239.60:465
> #
> #####
>
>
>
> Stunnel Debug Output Log:
>
> Snagged 256 random bytes from t:\tmp\randseed.bin
> Wrote 1024 new random bytes to t:\tmp\randseed.bin
> RAND_status claims sufficient entropy for the PRNG
> PRNG seeded successfully
> SSL context initialized for service YOUR-POP3S
> SSL context initialized for service YOUR-SMTPS
> stunnel 4.27 on x86-pc-mingw32-gnu with OpenSSL 0.9.8k 25 Mar 2009
> Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6
> No limit detected for the number of clients
> FD 1884 in non-blocking mode
> SO_REUSEADDR option set on accept socket
> YOUR-POP3S bound to 127.0.10.1:110
> FD 1876 in non-blocking mode
> SO_REUSEADDR option set on accept socket
> YOUR-SMTPS bound to 127.0.10.1:25
> YOUR-POP3S accepted FD=1860 from 127.0.10.1:1599
> Creating a new thread
> New thread created
> YOUR-POP3S started
> FD 1860 in non-blocking mode
> TCP_NODELAY option set on local socket
> YOUR-POP3S accepted connection from 127.0.10.1:1599
> FD 1836 in non-blocking mode
> connect_blocking: connecting 216.97.239.60:995
> connect_blocking: s_poll_wait 216.97.239.60:995: waiting 10 seconds
> connect_blocking: connected 216.97.239.60:995
> YOUR-POP3S connected remote server from 10.10.10.10:1600
> Remote FD=1836 initialized
> TCP_NODELAY option set on remote socket
> SSL state (connect): before/connect initialization
> SSL state (connect): SSLv3 write client hello A
> SSL state (connect): SSLv3 read server hello A
> SSL state (connect): SSLv3 read server certificate A
> SSL state (connect): SSLv3 read server done A
> SSL state (connect): SSLv3 write client key exchange A
> SSL state (connect): SSLv3 write change cipher spec A
> SSL state (connect): SSLv3 write finished A
> SSL state (connect): SSLv3 flush data
> SSL state (connect): SSLv3 read finished A
> 1 items in the session cache
> 1 client connects (SSL_connect())
> 1 client connects that finished
> 0 client renegotiations requested
> 0 server connects (SSL_accept())
> 0 server connects that finished
> 0 server renegotiations requested
> 0 session cache hits
> 0 session cache misses
> 0 session cache timeouts
> SSL connected: new session negotiated
> Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1
> Socket closed on read
> SSL write shutdown
> SSL alert (write): warning: close notify
> SSL socket closed on SSL_shutdown
> Socket write shutdown
> Connection closed: 49 bytes sent to SSL, 90 bytes sent to socket
> YOUR-POP3S finished (0 left)
> YOUR-SMTPS accepted FD=1844 from 127.0.10.1:1601
> Creating a new thread
> New thread created
> YOUR-SMTPS started
> FD 1844 in non-blocking mode
> TCP_NODELAY option set on local socket
> YOUR-SMTPS accepted connection from 127.0.10.1:1601
> FD 1836 in non-blocking mode
> connect_blocking: connecting 216.97.239.60:465
> connect_blocking: s_poll_wait 216.97.239.60:465: waiting 10 seconds
> connect_blocking: connected 216.97.239.60:465
> YOUR-SMTPS connected remote server from 10.10.10.10:1602
> Remote FD=1836 initialized
> TCP_NODELAY option set on remote socket
> SSL state (connect): before/connect initialization
> SSL state (connect): SSLv3 write client hello A
> SSL state (connect): SSLv3 read server hello A
> SSL state (connect): SSLv3 read server certificate A
> SSL state (connect): SSLv3 read server done A
> SSL state (connect): SSLv3 write client key exchange A
> SSL state (connect): SSLv3 write change cipher spec A
> SSL state (connect): SSLv3 write finished A
> SSL state (connect): SSLv3 flush data
> SSL state (connect): SSLv3 read finished A
> 1 items in the session cache
> 1 client connects (SSL_connect())
> 1 client connects that finished
> 0 client renegotiations requested
> 0 server connects (SSL_accept())
> 0 server connects that finished
> 0 server renegotiations requested
> 0 session cache hits
> 0 session cache misses
> 0 session cache timeouts
> SSL connected: new session negotiated
> Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1
> Socket closed on read
> SSL write shutdown
> SSL alert (write): warning: close notify
> SSL socket closed on SSL_shutdown
> Socket write shutdown
> Connection closed: 78 bytes sent to SSL, 423 bytes sent to socket
> YOUR-SMTPS finished (0 left)
>
>
>
> POP3 Transaction Log:
>
> CONNECT : Looking up host name TUNNEL-01...
> CONNECT : Host name TUNNEL-01 found
> CONNECT : Connecting to host TUNNEL-01 [127.0.10.1:110]...
> CONNECT : Connected to host TUNNEL-01 [127.0.10.1:110]
> POP REPLY : +OK Hello there.
> POP SEND : USER username
> POP REPLY : +OK Password required.
> POP SEND : PASS **********
> POP REPLY : -ERR Login failed.
> POP SEND : QUIT
> POP REPLY : +OK Better luck next time.
> DISCONNECT: Disconnected from server
>
>
>
> SMTP Transaction Log:
>
> CONNECT : Looking up host name TUNNEL-01...
> CONNECT : Host name TUNNEL-01 found
> CONNECT : Connecting to host TUNNEL-01 [127.0.10.1:25]...
> CONNECT : Connected to host TUNNEL-01 [127.0.10.1:25]
> SMTP REPLY: 220-crimson.lunarbreeze.com ESMTP Exim 4.69 #1 Tue, 16 Jun 2009 14:45:25 -0700
> SMTP SEND : EHLO computername
> SMTP REPLY: 250-crimson.lunarbreeze.com Hello 123,123.123.123 [123,123.123.123]
> SMTP REPLY: 250-SIZE 52428800
> SMTP REPLY: 250-PIPELINING
> SMTP REPLY: 250-AUTH PLAIN LOGIN
> SMTP REPLY: 250 HELP
> SMTP SEND : AUTH PLAIN xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx==
> SMTP REPLY: 535 Incorrect authentication data
> SMTP SEND : QUIT
> SMTP REPLY: 221 crimson.lunarbreeze.com closing connection
> DISCONNECT: Disconnected from server
>
>
1
0
Greetings, We have been using Stunnel 4.26 to facilitate the sending
and receiving of email with an email client that is not SSL enabled.
Version 4.26 has been working great. However, when we upgrade to 4.27,
we are unable to POP email (we can send email). We did not change our
Stunnel.conf file.
Can anyone advise us what we need to do to get 4.27 working? I've
included our Stunnel.conf file contents, and the Stunnel log output below.
Regards,
Jeff
=====================================================
# GLOBAL OPTIONS
client = yes
#output = C:\Documents and Settings\All Users\Application
Data\stunnel-log.txt
debug = 7
taskbar = yes
# SERVICE-LEVEL OPTIONS
[pop3]
accept=995
connect=mail.OurPOP.com:995
[smtp]
accept=465
connect=mail.OurSMTP.com:465
=====================================================
2009.06.14 14:03:03 LOG7[3348:540]: RAND_status claims sufficient
entropy for the PRNG
2009.06.14 14:03:03 LOG7[3348:540]: PRNG seeded successfully
2009.06.14 14:03:03 LOG7[3348:540]: SSL context initialized for service pop3
2009.06.14 14:03:03 LOG7[3348:540]: SSL context initialized for service smtp
2009.06.14 14:03:03 LOG5[3348:540]: stunnel 4.27 on x86-pc-mingw32-gnu
with OpenSSL 0.9.8k 25 Mar 2009
2009.06.14 14:03:03 LOG5[3348:540]: Threading:WIN32 SSL:ENGINE
Sockets:SELECT,IPv6
2009.06.14 14:03:03 LOG5[3348:3668]: No limit detected for the number of
clients
2009.06.14 14:03:03 LOG7[3348:3668]: FD 204 in non-blocking mode
2009.06.14 14:03:03 LOG7[3348:3668]: SO_REUSEADDR option set on accept
socket
2009.06.14 14:03:03 LOG7[3348:3668]: pop3 bound to 0.0.0.0:995
2009.06.14 14:03:03 LOG7[3348:3668]: FD 212 in non-blocking mode
2009.06.14 14:03:03 LOG7[3348:3668]: SO_REUSEADDR option set on accept
socket
2009.06.14 14:03:03 LOG7[3348:3668]: smtp bound to 0.0.0.0:465
2009.06.14 14:03:11 LOG7[3348:3668]: pop3 accepted FD=228 from
127.0.0.1:2027
2009.06.14 14:03:11 LOG7[3348:3668]: Creating a new thread
2009.06.14 14:03:11 LOG7[3348:3668]: New thread created
2009.06.14 14:03:11 LOG7[3348:3668]: pop3 accepted FD=244 from
127.0.0.1:2026
2009.06.14 14:03:11 LOG7[3348:3668]: Creating a new thread
2009.06.14 14:03:11 LOG7[3348:3668]: New thread created
2009.06.14 14:03:11 LOG7[3348:1144]: pop3 started
2009.06.14 14:03:11 LOG7[3348:1144]: FD 228 in non-blocking mode
2009.06.14 14:03:11 LOG5[3348:1144]: pop3 accepted connection from
127.0.0.1:2027
2009.06.14 14:03:11 LOG7[3348:1144]: FD 268 in non-blocking mode
2009.06.14 14:03:11 LOG6[3348:1144]: connect_blocking: connecting
216.97.239.60:995
2009.06.14 14:03:11 LOG7[3348:4060]: pop3 started
2009.06.14 14:03:11 LOG7[3348:4060]: FD 244 in non-blocking mode
2009.06.14 14:03:11 LOG5[3348:4060]: pop3 accepted connection from
127.0.0.1:2026
2009.06.14 14:03:11 LOG7[3348:4060]: FD 280 in non-blocking mode
2009.06.14 14:03:11 LOG6[3348:4060]: connect_blocking: connecting
216.97.239.60:995
2009.06.14 14:03:11 LOG7[3348:1144]: connect_blocking: s_poll_wait
216.97.239.60:995: waiting 10 seconds
2009.06.14 14:03:11 LOG7[3348:4060]: connect_blocking: s_poll_wait
216.97.239.60:995: waiting 10 seconds
2009.06.14 14:03:11 LOG5[3348:1144]: connect_blocking: connected
216.97.239.60:995
2009.06.14 14:03:11 LOG5[3348:1144]: pop3 connected remote server from
192.168.0.55:2028
2009.06.14 14:03:11 LOG7[3348:1144]: Remote FD=268 initialized
2009.06.14 14:03:11 LOG7[3348:1144]: SSL state (connect): before/connect
initialization
2009.06.14 14:03:11 LOG7[3348:1144]: SSL state (connect): SSLv3 write
client hello A
2009.06.14 14:03:11 LOG5[3348:4060]: connect_blocking: connected
216.97.239.60:995
2009.06.14 14:03:11 LOG5[3348:4060]: pop3 connected remote server from
192.168.0.55:2029
2009.06.14 14:03:11 LOG7[3348:4060]: Remote FD=280 initialized
2009.06.14 14:03:11 LOG7[3348:4060]: SSL state (connect): before/connect
initialization
2009.06.14 14:03:11 LOG7[3348:4060]: SSL state (connect): SSLv3 write
client hello A
2009.06.14 14:03:11 LOG7[3348:1144]: SSL alert (read): fatal: handshake
failure
2009.06.14 14:03:11 LOG3[3348:1144]: SSL_connect: 14094410:
error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure
2009.06.14 14:03:11 LOG5[3348:1144]: Connection reset: 0 bytes sent to
SSL, 0 bytes sent to socket
2009.06.14 14:03:11 LOG7[3348:1144]: pop3 finished (1 left)
2009.06.14 14:03:11 LOG7[3348:4060]: SSL alert (read): fatal: handshake
failure
2009.06.14 14:03:11 LOG3[3348:4060]: SSL_connect: 14094410:
error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure
2009.06.14 14:03:11 LOG5[3348:4060]: Connection reset: 0 bytes sent to
SSL, 0 bytes sent to socket
2009.06.14 14:03:11 LOG7[3348:4060]: pop3 finished (0 left)
1
0
I'm trying to use stunnel to send email with SSL authentication.
Sending the email with Apple's Mail.app with 'use default ports'
selected.
stunnel.log output:
2009.06.12 09:58:17 LOG7[41897:140735078037248]: Snagged 64 random
bytes from /Users/jlbrown/.rnd
2009.06.12 09:58:17 LOG7[41897:140735078037248]: Wrote 1024 new random
bytes to /Users/jlbrown/.rnd
2009.06.12 09:58:17 LOG7[41897:140735078037248]: RAND_status claims
sufficient entropy for the PRNG
2009.06.12 09:58:17 LOG7[41897:140735078037248]: PRNG seeded
successfully
2009.06.12 09:58:17 LOG7[41897:140735078037248]: Certificate: /etc/
postfix/smtpd.cert
2009.06.12 09:58:17 LOG7[41897:140735078037248]: Certificate loaded
2009.06.12 09:58:17 LOG7[41897:140735078037248]: Key file: /etc/
postfix/smtpd.key
2009.06.12 09:58:17 LOG7[41897:140735078037248]: Private key loaded
2009.06.12 09:58:17 LOG7[41897:140735078037248]: SSL context
initialized for service ssmtp
2009.06.12 09:58:17 LOG7[41897:140735078037248]: Certificate: /etc/
postfix/smtpd.cert
2009.06.12 09:58:17 LOG7[41897:140735078037248]: Certificate loaded
2009.06.12 09:58:17 LOG7[41897:140735078037248]: Key file: /etc/
postfix/smtpd.key
2009.06.12 09:58:17 LOG7[41897:140735078037248]: Private key loaded
2009.06.12 09:58:17 LOG7[41897:140735078037248]: SSL context
initialized for service ssmtp2
2009.06.12 09:58:17 LOG5[41897:140735078037248]: stunnel 4.27 on i686-
apple-darwin9.7.0 with OpenSSL 0.9.7l 28 Sep 2006
2009.06.12 09:58:17 LOG5[41897:140735078037248]: Threading:PTHREAD
SSL:ENGINE Sockets:SELECT,IPv6 Auth:LIBWRAP
2009.06.12 09:58:17 LOG6[41897:140735078037248]: file ulimit = 256
(can be changed with 'ulimit -n')
2009.06.12 09:58:17 LOG6[41897:140735078037248]: FD_SETSIZE = 1024
(some systems allow to increase this value)
2009.06.12 09:58:17 LOG5[41897:140735078037248]: 125 clients allowed
2009.06.12 09:58:17 LOG7[41897:140735078037248]: FD 10 in non-blocking
mode
2009.06.12 09:58:17 LOG7[41897:140735078037248]: FD 11 in non-blocking
mode
2009.06.12 09:58:17 LOG7[41897:140735078037248]: FD 12 in non-blocking
mode
2009.06.12 09:58:17 LOG7[41897:140735078037248]: SO_REUSEADDR option
set on accept socket
2009.06.12 09:58:17 LOG7[41897:140735078037248]: ssmtp bound to
0.0.0.0:465
2009.06.12 09:58:17 LOG7[41897:140735078037248]: FD 13 in non-blocking
mode
2009.06.12 09:58:17 LOG7[41897:140735078037248]: SO_REUSEADDR option
set on accept socket
2009.06.12 09:58:17 LOG7[41897:140735078037248]: ssmtp2 bound to
0.0.0.0:587
2009.06.12 09:58:17 LOG7[41903:140735078037248]: Created pid file /usr/
local/var/run/stunnel/stunnel.pid
2009.06.12 09:58:56 LOG7[41903:140735078037248]: ssmtp2 accepted FD=14
from 192.168.1.10:64996
2009.06.12 09:58:56 LOG7[41903:4295561216]: ssmtp2 started
2009.06.12 09:58:56 LOG7[41903:4295561216]: FD 14 in non-blocking mode
2009.06.12 09:58:56 LOG7[41903:4295561216]: TCP_NODELAY option set on
local socket
2009.06.12 09:58:56 LOG7[41903:4295561216]: Waiting for a libwrap
process
2009.06.12 09:58:56 LOG7[41903:4295561216]: Acquired libwrap process #0
2009.06.12 10:00:04 LOG7[41903:140735078037248]: ssmtp2 accepted FD=15
from 192.168.1.10:65006
2009.06.12 10:00:04 LOG7[41903:4295675904]: ssmtp2 started
2009.06.12 10:00:04 LOG7[41903:4295675904]: FD 15 in non-blocking mode
2009.06.12 10:00:04 LOG7[41903:4295675904]: TCP_NODELAY option set on
local socket
2009.06.12 10:00:04 LOG7[41903:4295675904]: Waiting for a libwrap
process
2009.06.12 10:00:04 LOG7[41903:4295675904]: Acquired libwrap process #1
2009.06.12 10:01:04 LOG7[41903:140735078037248]: ssmtp accepted FD=16
from 192.168.1.10:65013
2009.06.12 10:01:04 LOG7[41903:4295790592]: ssmtp started
2009.06.12 10:01:04 LOG7[41903:4295790592]: FD 16 in non-blocking mode
2009.06.12 10:01:04 LOG7[41903:4295790592]: TCP_NODELAY option set on
local socket
2009.06.12 10:01:04 LOG7[41903:4295790592]: Waiting for a libwrap
process
2009.06.12 10:01:04 LOG7[41903:4295790592]: Acquired libwrap process #2
2009.06.12 10:03:56 LOG6[41903:4295561216]: read_blocking: s_poll_wait
timeout
2009.06.12 10:03:56 LOG5[41903:4295561216]: Connection reset: 0 bytes
sent to SSL, 0 bytes sent to socket
2009.06.12 10:03:56 LOG7[41903:4295561216]: ssmtp2 finished (2 left)
2009.06.12 10:03:56 LOG7[41903:140735078037248]: ssmtp accepted FD=14
from 192.168.1.10:65022
2009.06.12 10:03:56 LOG7[41903:4295561216]: ssmtp started
2009.06.12 10:03:56 LOG7[41903:4295561216]: FD 14 in non-blocking mode
2009.06.12 10:03:56 LOG7[41903:4295561216]: TCP_NODELAY option set on
local socket
2009.06.12 10:03:56 LOG7[41903:4295561216]: Waiting for a libwrap
process
2009.06.12 10:03:56 LOG7[41903:4295561216]: Acquired libwrap process #3
2009.06.12 10:05:04 LOG6[41903:4295675904]: read_blocking: s_poll_wait
timeout
2009.06.12 10:05:04 LOG5[41903:4295675904]: Connection reset: 0 bytes
sent to SSL, 0 bytes sent to socket
2009.06.12 10:05:04 LOG7[41903:4295675904]: ssmtp2 finished (2 left)
2009.06.12 10:05:04 LOG7[41903:140735078037248]: ssmtp accepted FD=15
from 192.168.1.10:65028
2009.06.12 10:05:04 LOG7[41903:4295675904]: ssmtp started
2009.06.12 10:05:04 LOG7[41903:4295675904]: FD 15 in non-blocking mode
2009.06.12 10:05:04 LOG7[41903:4295675904]: TCP_NODELAY option set on
local socket
2009.06.12 10:05:04 LOG7[41903:4295675904]: Waiting for a libwrap
process
2009.06.12 10:05:04 LOG7[41903:4295675904]: Acquired libwrap process #4
2009.06.12 10:06:04 LOG6[41903:4295790592]: read_blocking: s_poll_wait
timeout
2009.06.12 10:06:04 LOG5[41903:4295790592]: Connection reset: 0 bytes
sent to SSL, 0 bytes sent to socket
2009.06.12 10:06:04 LOG7[41903:4295790592]: ssmtp finished (2 left)
2009.06.12 10:06:04 LOG7[41903:140735078037248]: ssmtp accepted FD=16
from 192.168.1.10:65032
2009.06.12 10:06:04 LOG7[41903:4295790592]: ssmtp started
2009.06.12 10:06:04 LOG7[41903:4295790592]: FD 16 in non-blocking mode
2009.06.12 10:06:04 LOG7[41903:4295790592]: TCP_NODELAY option set on
local socket
2009.06.12 10:06:04 LOG7[41903:4295790592]: Waiting for a libwrap
process
2009.06.12 10:08:56 LOG6[41903:4295561216]: read_blocking: s_poll_wait
timeout
2009.06.12 10:08:56 LOG5[41903:4295561216]: Connection reset: 0 bytes
sent to SSL, 0 bytes sent to socket
2009.06.12 10:08:56 LOG7[41903:4295561216]: ssmtp finished (2 left)
2009.06.12 10:08:56 LOG7[41903:140735078037248]: ssmtp2 accepted FD=14
from 192.168.1.10:65040
2009.06.12 10:08:56 LOG7[41903:4295561216]: ssmtp2 started
2009.06.12 10:08:56 LOG7[41903:4295561216]: FD 14 in non-blocking mode
2009.06.12 10:08:56 LOG7[41903:4295561216]: TCP_NODELAY option set on
local socket
2009.06.12 10:08:56 LOG7[41903:4295561216]: Waiting for a libwrap
process
2009.06.12 10:10:04 LOG6[41903:4295675904]: read_blocking: s_poll_wait
timeout
2009.06.12 10:10:04 LOG5[41903:4295675904]: Connection reset: 0 bytes
sent to SSL, 0 bytes sent to socket
2009.06.12 10:10:04 LOG7[41903:4295675904]: ssmtp finished (2 left)
2009.06.12 10:10:04 LOG7[41903:140735078037248]: ssmtp accepted FD=15
from 192.168.1.10:65044
2009.06.12 10:10:04 LOG7[41903:4295675904]: ssmtp started
2009.06.12 10:10:04 LOG7[41903:4295675904]: FD 15 in non-blocking mode
2009.06.12 10:10:04 LOG7[41903:4295675904]: TCP_NODELAY option set on
local socket
2009.06.12 10:10:04 LOG7[41903:4295675904]: Waiting for a libwrap
process
2009.06.12 10:11:04 LOG7[41903:140735078037248]: ssmtp accepted FD=17
from 192.168.1.10:65048
2009.06.12 10:11:04 LOG7[41903:4295905280]: ssmtp started
2009.06.12 10:11:04 LOG7[41903:4295905280]: FD 17 in non-blocking mode
2009.06.12 10:11:04 LOG7[41903:4295905280]: TCP_NODELAY option set on
local socket
2009.06.12 10:11:04 LOG7[41903:4295905280]: Waiting for a libwrap
process
2009.06.12 10:13:56 LOG7[41903:140735078037248]: ssmtp accepted FD=18
from 192.168.1.10:65060
2009.06.12 10:13:56 LOG7[41903:4297134080]: ssmtp started
2009.06.12 10:13:56 LOG7[41903:4297134080]: FD 18 in non-blocking mode
2009.06.12 10:13:56 LOG7[41903:4297134080]: TCP_NODELAY option set on
local socket
2009.06.12 10:13:56 LOG7[41903:4297134080]: Waiting for a libwrap
process
2009.06.12 10:15:04 LOG7[41903:140735078037248]: ssmtp accepted FD=19
from 192.168.1.10:65063
2009.06.12 10:15:04 LOG7[41903:4297211904]: ssmtp started
2009.06.12 10:15:04 LOG7[41903:4297211904]: FD 19 in non-blocking mode
2009.06.12 10:15:04 LOG7[41903:4297211904]: TCP_NODELAY option set on
local socket
2009.06.12 10:15:04 LOG7[41903:4297211904]: Waiting for a libwrap
process
2009.06.12 10:18:56 LOG7[41903:140735078037248]: ssmtp2 accepted FD=20
from 192.168.1.10:65090
2009.06.12 10:18:56 LOG7[41903:4297326592]: ssmtp2 started
2009.06.12 10:18:56 LOG7[41903:4297326592]: FD 20 in non-blocking mode
2009.06.12 10:18:56 LOG7[41903:4297326592]: TCP_NODELAY option set on
local socket
2009.06.12 10:18:56 LOG7[41903:4297326592]: Waiting for a libwrap
process
2009.06.12 10:20:04 LOG7[41903:140735078037248]: ssmtp2 accepted FD=21
from 192.168.1.10:65093
2009.06.12 10:20:04 LOG7[41903:4297441280]: ssmtp2 started
2009.06.12 10:20:04 LOG7[41903:4297441280]: FD 21 in non-blocking mode
2009.06.12 10:20:04 LOG7[41903:4297441280]: TCP_NODELAY option set on
local socket
2009.06.12 10:20:04 LOG7[41903:4297441280]: Waiting for a libwrap
process
2009.06.12 10:23:56 LOG7[41903:140735078037248]: ssmtp2 accepted FD=22
from 192.168.1.10:65111
2009.06.12 10:23:56 LOG7[41903:4297555968]: ssmtp2 started
2009.06.12 10:23:56 LOG7[41903:4297555968]: FD 22 in non-blocking mode
2009.06.12 10:23:56 LOG7[41903:4297555968]: TCP_NODELAY option set on
local socket
2009.06.12 10:23:56 LOG7[41903:4297555968]: Waiting for a libwrap
process
2009.06.12 10:25:04 LOG7[41903:140735078037248]: ssmtp accepted FD=23
from 192.168.1.10:65113
2009.06.12 10:25:04 LOG7[41903:4297670656]: ssmtp started
2009.06.12 10:25:04 LOG7[41903:4297670656]: FD 23 in non-blocking mode
2009.06.12 10:25:04 LOG7[41903:4297670656]: TCP_NODELAY option set on
local socket
2009.06.12 10:25:04 LOG7[41903:4297670656]: Waiting for a libwrap
process
2009.06.12 10:28:56 LOG7[41903:140735078037248]: ssmtp2 accepted FD=24
from 192.168.1.10:65125
2009.06.12 10:28:56 LOG7[41903:4297785344]: ssmtp2 started
2009.06.12 10:28:56 LOG7[41903:4297785344]: FD 24 in non-blocking mode
2009.06.12 10:28:56 LOG7[41903:4297785344]: TCP_NODELAY option set on
local socket
2009.06.12 10:28:56 LOG7[41903:4297785344]: Waiting for a libwrap
process
2009.06.12 10:30:04 LOG7[41903:140735078037248]: ssmtp2 accepted FD=25
from 192.168.1.10:65128
2009.06.12 10:30:04 LOG7[41903:4297900032]: ssmtp2 started
2009.06.12 10:30:04 LOG7[41903:4297900032]: FD 25 in non-blocking mode
2009.06.12 10:30:04 LOG7[41903:4297900032]: TCP_NODELAY option set on
local socket
2009.06.12 10:30:04 LOG7[41903:4297900032]: Waiting for a libwrap
process
2009.06.12 10:33:56 LOG7[41903:140735078037248]: ssmtp2 accepted FD=26
from 192.168.1.10:65299
2009.06.12 10:33:56 LOG7[41903:4298014720]: ssmtp2 started
2009.06.12 10:33:56 LOG7[41903:4298014720]: FD 26 in non-blocking mode
2009.06.12 10:33:56 LOG7[41903:4298014720]: TCP_NODELAY option set on
local socket
2009.06.12 10:33:56 LOG7[41903:4298014720]: Waiting for a libwrap
process
2009.06.12 10:35:04 LOG7[41903:140735078037248]: ssmtp2 accepted FD=27
from 192.168.1.10:65326
2009.06.12 10:35:04 LOG7[41903:4298129408]: ssmtp2 started
2009.06.12 10:35:04 LOG7[41903:4298129408]: FD 27 in non-blocking mode
2009.06.12 10:35:04 LOG7[41903:4298129408]: TCP_NODELAY option set on
local socket
2009.06.12 10:35:04 LOG7[41903:4298129408]: Waiting for a libwrap
process
2009.06.12 10:40:04 LOG7[41903:140735078037248]: ssmtp accepted FD=28
from 192.168.1.10:65365
2009.06.12 10:40:04 LOG7[41903:4298244096]: ssmtp started
2009.06.12 10:40:04 LOG7[41903:4298244096]: FD 28 in non-blocking mode
2009.06.12 10:40:04 LOG7[41903:4298244096]: TCP_NODELAY option set on
local socket
2009.06.12 10:40:04 LOG7[41903:4298244096]: Waiting for a libwrap
process
2009.06.12 10:45:04 LOG7[41903:140735078037248]: ssmtp accepted FD=29
from 192.168.1.10:65377
2009.06.12 10:45:04 LOG7[41903:4298358784]: ssmtp started
2009.06.12 10:45:04 LOG7[41903:4298358784]: FD 29 in non-blocking mode
2009.06.12 10:45:04 LOG7[41903:4298358784]: TCP_NODELAY option set on
local socket
2009.06.12 10:45:04 LOG7[41903:4298358784]: Waiting for a libwrap
process
2009.06.12 10:50:04 LOG7[41903:140735078037248]: ssmtp accepted FD=30
from 192.168.1.10:65406
2009.06.12 10:50:04 LOG7[41903:4298473472]: ssmtp started
2009.06.12 10:50:04 LOG7[41903:4298473472]: FD 30 in non-blocking mode
2009.06.12 10:50:04 LOG7[41903:4298473472]: TCP_NODELAY option set on
local socket
2009.06.12 10:50:04 LOG7[41903:4298473472]: Waiting for a libwrap
process
Stunnel is running on Mac OS X 10.5.7.
Any help would be much appreciated.
James.
1
0
Hello Carter,
thank you very much for your help and nice examples. I will try it in my local network.
Have a good day.
Mia
---- Pôvodná správa ----
Od koho: Carter Browne <cbrowne(a)cbcs-usa.com>
Komu: aaa aaa <miamia(a)inMail.sk>
Dátum: 8. 6. 2009 17:52:00
Predmet: Re: [stunnel-users] 1 server and more desktops
Mia,
I work in both Windows and Linux, so I use a Windows approach - copying
files where in Linux a link would be more appropriate.
Assume server.pem is the server full server certificate including the
private key and client1.pem is a full client certificate including the key.
The first step is to make a copy of the server certificate and delete
the lines starting with -----BEGIN RSA PRIVATE KEY------ down through
the blank line
after -----END RSA PRIVATE KEY-----
Initial I call this server-pub.pem
The command:
openssl x509 -in server-pub.pem -subject_hash -noout
will print out the hash for the server key (as 8 hexadecimal digits),
for example abcef012
Then I rename server-pub.pem to abcdef012.0
I repeat the same process for each client key, so that client1.pem in
this example would have a public key named 987654fe.0 (assuming that the
hash of 987654fe).
In the client1 configuration:
cert = client1.pem
key = client1.pem
verify = 3
cafile = abcdef012.0
In the server configuration
cert = server1.pem
key = server1.pem
verify = 3
capath = capath
In the capath directory is
987654fe.0
... Plus the hashes of the other clients.
In Windows, the capath is under the stunnel directory.
The client certificates can also be concatenated in a single file. If
you use a directory, it is not necessary to restart stunnel if you add a
new client. If you use a concatenated file, you do have to restart
stunnel if you add a client. There are some notes in the documentation
about the structure of a concatenated file.
I hope this helps.
Carter
Carter Browne
CBCS
cbrowne(a)cbcs-usa.com
781-721-2890
aaa aaa wrote:
> Hi Carter,
>
> thank you. I am trying to use scenario with self-signed certificates
> exactly like you are using it. Could you please write me some examples
> of config for server and clients? I don't know where to put private
> keys and how to set up server for acceptation of certificates from
> clients only - server must reject all communication without/or with
> other certificates as are stored in his folder.
>
> thank you in advance
>
> regards,
> mia
>
> ---- Pôvodná správa ----
> Od koho: Carter Browne <cbrowne(a)cbcs-usa.com>
> Komu: aaa aaa <miamia(a)inMail.sk>
> Dátum: 8. 6. 2009 15:00:00
> Predmet: Re: [stunnel-users] 1 server and more desktops
>
> I do this using self-signed certificates and verify=2 or verify=3. The
> remote computers would only have the servers public certificate their
> CAfile (or CApath). The server must have all the remote computers
> public certificates in its CAfile or CApath. See the rules about how to
> build those. If you are only using self-signed certificates, you can
> use verify=3, otherwise you will have to use verify=2. Each port that
> you want to forward must be in you stunnel.conf file - without knowing
> what you are trying to do, it is hard to be more specific.
>
> Carter
>
> Carter Browne
> CBCS
> cbrowne(a)cbcs-usa.com
> 781-721-2890
>
>
>
> aaa aaa wrote:
> > hello Christophe,
> >
> > thanks for your answer. Sorry for any misunderstanding. Well, I just
> > wanted to ask if it is able to set stunnel for working with more
> > certificates? So it means that I don't want to have secured tunnel
> > between remote and local computer only but also between one remote and
> > many local computers with more certificates? Every local computer
> > should have own certificate.
> >
> > Is this possible?
> >
> > thank you.
> >
> > ---- Pôvodná správa ----
> > Od koho: Christophe Nanteuil <christophe.nanteuil(a)gmail.com>
> > Komu: aaa aaa <miamia(a)inmail.sk>
> > Dátum: 7. 6. 2009 16:27:00
> > Predmet: Re: [stunnel-users] 1 server and more desktops
> >
> > Hello,
> >
> > Stunnel is an application oriented tunnel, not a machine oriented
> > tunnel. Please, be more precise in your requests if you want someone
> > to be able to help you. It seems also that the stunnel documentation
> > pages are worh reading in your case.
> >
> > Regards,
> >
> > --
> > Christophe
> >
> >
> > 2009/6/7 aaa aaa <miamia(a)inmail.sk>:
> > > Hello,
> > >
> > > I have one server and 3 desktops (PC1,PC2,PC3). I need to do this:
> > every pc
> > > should communicate with server with his own certificate and server
> > should
> > > sends anwser back to the computer encrypted for this one pc only.
> > >
> > > Example: PC3 {with server's public key} sends data to server and
> server
> > > sends answer to PC3 (encrypted wiht unique PC3's public key).
> > > then PC2 {with server's public key} sends data to server and server
> > sends
> > > answer to PC2 (encrypted wiht unique PC2's public key). and so
> on... how
> > > should I configure stunnel for this?
> > >
> > > And another question > how should I configure all computers (server,
> > > pc1,pc2,pc3) to accept communication over secured stunnel only and
> > drop all
> > > other unsecured communication?
> > >
> > >
> > > thank you in advance.
> > > regards, Mia
> > > ----------
> > > Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk.
> > Domena,
> > > webhosting, e-mail a seo od 10 centov/denne.
> > >
> > > _______________________________________________
> > > stunnel-users mailing list
> > > stunnel-users(a)mirt.net
> > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users
> > >
> > >
> > ----------
> > Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk
> > <http://www.inpage.sk/>. Domena, webhosting, e-mail a seo od 10
> > centov/denne.
> > ------------------------------------------------------------------------
> >
> > _______________________________________________
> > stunnel-users mailing list
> > stunnel-users(a)mirt.net
> > http://stunnel.mirt.net/mailman/listinfo/stunnel-users
> >
> ----------
> Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk
> <http://www.inpage.sk/>. Domena, webhosting, e-mail a seo od 10
> centov/denne.
----------
Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. Domena, webhosting, e-mail a seo od 10 centov/denne.
1
0
Hi Carter,
thank you. I am trying to use scenario with self-signed certificates
exactly like you are using it. Could you please write me some examples
of config for server and clients? I don't know where to put private
keys and how to set up server for acceptation of certificates from
clients only - server must reject all communication without/or with
other certificates as are stored in his folder.
thank you in advance
regards,
mia
> ---- Pôvodná správa ----
> Od koho: Carter Browne <cbrowne(a)cbcs-usa.com>
> Komu: aaa aaa <miamia(a)inMail.sk>
> Dátum: 8. 6. 2009 15:00:00
> Predmet: Re: [stunnel-users] 1 server and more desktops
>
> I do this using self-signed certificates and verify=2 or verify=3. The
> remote computers would only have the servers public certificate their
> CAfile (or CApath). The server must have all the remote computers
> public certificates in its CAfile or CApath. See the rules about how to
> build those. If you are only using self-signed certificates, you can
> use verify=3, otherwise you will have to use verify=2. Each port that
> you want to forward must be in you stunnel.conf file - without knowing
> what you are trying to do, it is hard to be more specific.
>
> Carter
>
> Carter Browne
> CBCS
> cbrowne(a)cbcs-usa.com
> 781-721-2890
>
>
>
> aaa aaa wrote:
> > hello Christophe,
> >
> > thanks for your answer. Sorry for any misunderstanding. Well, I just
> > wanted to ask if it is able to set stunnel for working with more
> > certificates? So it means that I don't want to have secured tunnel
> > between remote and local computer only but also between one remote and
> > many local computers with more certificates? Every local computer
> > should have own certificate.
> >
> > Is this possible?
> >
> > thank you.
> >
> > ---- Pôvodná správa ----
> > Od koho: Christophe Nanteuil <christophe.nanteuil(a)gmail.com>
> > Komu: aaa aaa <miamia(a)inmail.sk>
> > Dátum: 7. 6. 2009 16:27:00
> > Predmet: Re: [stunnel-users] 1 server and more desktops
> >
> > Hello,
> >
> > Stunnel is an application oriented tunnel, not a machine oriented
> > tunnel. Please, be more precise in your requests if you want someone
> > to be able to help you. It seems also that the stunnel documentation
> > pages are worh reading in your case.
> >
> > Regards,
> >
> > --
> > Christophe
> >
> >
> > 2009/6/7 aaa aaa <miamia(a)inmail.sk>:
> > > Hello,
> > >
> > > I have one server and 3 desktops (PC1,PC2,PC3). I need to do this:
> > every pc
> > > should communicate with server with his own certificate and server
> > should
> > > sends anwser back to the computer encrypted for this one pc only.
> > >
> > > Example: PC3 {with server's public key} sends data to server and
> server
> > > sends answer to PC3 (encrypted wiht unique PC3's public key).
> > > then PC2 {with server's public key} sends data to server and server
> > sends
> > > answer to PC2 (encrypted wiht unique PC2's public key). and so
> on... how
> > > should I configure stunnel for this?
> > >
> > > And another question > how should I configure all computers (server,
> > > pc1,pc2,pc3) to accept communication over secured stunnel only and
> > drop all
> > > other unsecured communication?
> > >
> > >
> > > thank you in advance.
> > > regards, Mia
> > > ----------
> > > Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk.
> > Domena,
> > > webhosting, e-mail a seo od 10 centov/denne.
> > >
> > > _______________________________________________
> > > stunnel-users mailing list
> > > stunnel-users(a)mirt.net
> > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users
> > >
> > >
> > ----------
> > Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk
> > <http://www.inpage.sk/>. Domena, webhosting, e-mail a seo od 10
> > centov/denne.
> > ------------------------------------------------------------------------
> >
> > _______________________________________________
> > stunnel-users mailing list
> > stunnel-users(a)mirt.net
> > http://stunnel.mirt.net/mailman/listinfo/stunnel-users
> >
> ----------
> Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk
> <http://www.inpage.sk/>. Domena, webhosting, e-mail a seo od 10
> centov/denne.
----------
Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. Domena, webhosting, e-mail a seo od 10 centov/denne.
1
0
08 Jun '09
Hi!
I have a problem when running ssh over stunnel in background mode
('foreground' out-commented in config file). In foreground mode, everything
works fine. I'm using a modified OpenSSL, adding an engine that is dedicated
to communicate with a smartcard reader.
The scenario is:
- Starting stunnel on server, extract from config file:
[ssh]
accept = myserver:122
connect = 22
- Starting stunnel on client, extract from config file:
engine = myengine
engineNum = 1
client = yes
[ssh]
accept = 22
connect = myserver:122
I come to here, than it hangs:
...
2009.06.08 15:08:22 LOG7[472:3054680976]: SSL state (connect): SSLv3 read
server certificate A
2009.06.08 15:08:22 LOG7[472:3054680976]: SSL state (connect): SSLv3 read
server certificate request A
2009.06.08 15:08:22 LOG7[472:3054680976]: SSL state (connect): SSLv3 read
server done A
2009.06.08 15:08:22 LOG7[472:3054680976]: SSL state (connect): SSLv3 write
client certificate A
2009.06.08 15:08:22 LOG7[472:3054680976]: SSL state (connect): SSLv3 write
client key exchange A
- - - - - - -
But when I run in foreground mode, it all works fine and stunnel continues
and I get the ssh login prompt.
I'm running RHEL 5.2, OpenSSL 0.9.8*, stunnel 4.27
Any help would be appreciated
Rgds
JA
1
0
Hello,
a short question: Which start parameters are there for Stunnel v4.xx?
Thanks,
Seb.
_
ASCII ribbon campaign against HTML e-mail ( )
& proprietary e-mail formats X
/ \
www.asciiribbon.org
1
0
hello Christophe,
thanks for your answer. Sorry for any misunderstanding. Well, I just wanted to ask if it is able to set stunnel for working with more certificates? So it means that I don't want to have secured tunnel between remote and local computer only but also between one remote and many local computers with more certificates? Every local computer should have own certificate.
Is this possible?
thank you.
---- Pôvodná správa ----
Od koho: Christophe Nanteuil <christophe.nanteuil(a)gmail.com>
Komu: aaa aaa <miamia(a)inmail.sk>
Dátum: 7. 6. 2009 16:27:00
Predmet: Re: [stunnel-users] 1 server and more desktops
Hello,
Stunnel is an application oriented tunnel, not a machine oriented
tunnel. Please, be more precise in your requests if you want someone
to be able to help you. It seems also that the stunnel documentation
pages are worh reading in your case.
Regards,
--
Christophe
2009/6/7 aaa aaa <miamia(a)inmail.sk>:
> Hello,
>
> I have one server and 3 desktops (PC1,PC2,PC3). I need to do this: every pc
> should communicate with server with his own certificate and server should
> sends anwser back to the computer encrypted for this one pc only.
>
> Example: PC3 {with server's public key} sends data to server and server
> sends answer to PC3 (encrypted wiht unique PC3's public key).
> then PC2 {with server's public key} sends data to server and server sends
> answer to PC2 (encrypted wiht unique PC2's public key). and so on... how
> should I configure stunnel for this?
>
> And another question > how should I configure all computers (server,
> pc1,pc2,pc3) to accept communication over secured stunnel only and drop all
> other unsecured communication?
>
>
> thank you in advance.
> regards, Mia
> ----------
> Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. Domena,
> webhosting, e-mail a seo od 10 centov/denne.
>
> _______________________________________________
> stunnel-users mailing list
> stunnel-users(a)mirt.net
> http://stunnel.mirt.net/mailman/listinfo/stunnel-users
>
>
----------
Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. Domena, webhosting, e-mail a seo od 10 centov/denne.
1
0
Hello,
I've got the crazy idea to run stunnel behind an existing, SSL-enabled,
basic-auth-using httpd. Configuration would be as follows:
1. put some stunnel.cgi into /usr/www/cgi-bin which would call stunnel
binary
2. start stunnel client with -r
https://login:[email protected]/cgi-bin/stunnel.cgi
Advantages (assumed you're behind a proxy which allows only 443 as outgoing
port):
a. You can still access other WebIFs on that server.
b. You don't have to administer another web server including authentication,
certificates and so on.
May be stunnel is not the best tool for the above scenario (I reckon stunnel
is currently unable to fulfill this)... I hope someone can shed some light
on this.
Cheers, Chatty.
1
0
Hello,
I have one server and 3 desktops (PC1,PC2,PC3). I need to do this: every pc should communicate with server with his own certificate and server should sends anwser back to the computer encrypted for this one pc only.
Example: PC3 {with server's public key} sends data to server and server sends answer to PC3 (encrypted wiht unique PC3's public key).
then PC2 {with server's public key} sends data to server and server sends answer to PC2 (encrypted wiht unique PC2's public key). and so on... how should I configure stunnel for this?
And another question > how should I configure all computers (server, pc1,pc2,pc3) to accept communication over secured stunnel only and drop all other unsecured communication?
thank you in advance.
regards, Mia
----------
Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. Domena, webhosting, e-mail a seo od 10 centov/denne.
2
1