I am faling to connect to gmail. Not sure what that bind error means.
iqbala@ghar:~$ sudo stunnel4
2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes
from /home/iqbala/.rnd
2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes
to /home/iqbala/.rnd
2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims
sufficient entropy for the PRNG
2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully
2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem
2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded
2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem
2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded
2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for
service ssmtp
2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on
i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007
2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD
SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP
2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be
changed with 'ulimit -n')
2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE
limit for file descriptors
2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed
2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode
2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode
2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode
2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on
accept socket
2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to
74.125.93.111:587
2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign
requested address (99)
Here is how my conf file looks like
iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$"
cert = /etc/stunnel/stunnel.pem
foreground = yes
sslVersion = SSLv3
chroot = /var/lib/stunnel4/
setuid = stunnel4
setgid = stunnel4
pid = /stunnel4.pid
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
debug = 7
output = /var/log/stunnel4/stunnel.log
client = yes
[ssmtp]
accept = smtp.gmail.com:587
connect = 25
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
5
9
29 Jan '12
Dear stunnel managers,
I would like to inform you that there exist some incompatibility with
stunnel and openssl pkcs11-engine with external PIN entry device (like
RSA smartcard using opensc) in Linux.
We use this config to load openssl engine stunnel.conf:
---
engine=dynamic
engineCtrl=SO_PATH:/usr/lib/engines/engine_pkcs11.so
engineCtrl=ID:pkcs11
engineCtrl=LIST_ADD:1
engineCtrl=LOAD
engineCtrl=MODULE_PATH:/usr/lib/opensc-pkcs11.so
engineCtrl=INIT
---
Problem is, with this setup stunnel does not allow user to enter PIN for
the secret key.
Instead it tries to get secret key without PIN, 3 times (and then
therefore usually blocks card PIN) and retires:
----
Initializing engine 1
Engine 1 initialized
PRNG seeded successfully
Certificate: mart.pem
Certificate loaded
Key file: id_01
error queue: 26096080 : error:26096080:engine
routines:ENGINE_load_private_key:failed loading private key
error queue: 800050A0 : error:800050A0:PKCS11 library:PKCS11_login:PIN
incorrect
Wrong PIN: retrying
error queue: 26096080 : error:26096080:engine
routines:ENGINE_load_private_key:failed loading private key
error queue: 800050A0 : error:800050A0:PKCS11 library:PKCS11_login:PIN
incorrect
Wrong PIN: retrying
error queue: 26096080 : error:26096080:engine
routines:ENGINE_load_private_key:failed loading private key
ENGINE_load_private_key: 800050A0: error:800050A0:PKCS11
library:PKCS11_login:PIN incorrect
----
I discovered workaround that is valid form version 4.26 till current
4.34, as follows, NULL-ing the ui_data.method property in ctx.c:
---
diff -cr stunnel-4.34/src/ctx.c stunnel-4.34-patched/src/ctx.c
*** stunnel-4.34/src/ctx.c 2010-09-14 18:08:43.000000000 +0300
--- stunnel-4.34-patched/src/ctx.c 2010-09-28 21:56:36.219081931 +0300
***************
*** 304,309 ****
--- 304,310 ----
UI_method_set_reader(ui_method, pin_cb);
#else /* USE_WIN32 */
ui_method=UI_OpenSSL();
+ ui_data.section = NULL;
#endif /* USE_WIN32 */
if(section->engine)
for(i=1; i<=3; i++) {
---
After that patch private key loads correctly:
---
Initializing engine 1
Engine 1 initialized
PRNG seeded successfully
Certificate: mart.pem
Certificate loaded
Key file: id_01
private key loaded
---
It would be nice if:
* somebody investigates more precisely why the OpenSSL PIN entry is not
showing with unpached stunnel
* include my or better patch for this situation
Thank you very much for excellent piece of software!
With best regards,
Märt Laak
2
2
The configuration files are :
pid = /var/stunnel.pid
;chroot = /var/lib/stunnel
setuid = nobody
setgid = nobody
foreground =yes
; Use it for client mode
client = yes
; Service-level configuration
[pop3s]
accept = 995
connect = 110
[imaps]
accept = 993
connect = 143
[ssmtp]
accept = 465
connect = 25
[mysqls]
accept = 3307
connect = 192.168.1.6:3307
On 192.168.1.6
----------------------
pid = /var/stunnel.pid
setuid =nobody
setgid = nobody
foreground = yes
client = no
; Service-level configuration
[pop3s]
accept = 995
connect = 110
[imaps]
accept = 993
connect = 143
[ssmtp]
accept = 465
connect = 25
[mysqls]
accept =3307
connect =3306
connecting like
/usr/local/mysql/bin/mysql -h 127.0.0.1 -u root -p -P 3307
Enter password:
On entring password the following lines appear :
ERROR 2013 (HY000): Lost connection to MySQL server at 'reading initial communication packet', system error: 104
Subrata
----- Original Message -----
From: Brian Hatch <bri(a)stunnel.org>
To: subrata(a)indiatimes.com
Sent: Sun, 7 Oct 2007 10:02:17 +0530 (IST)
Subject: Re: [stunnel-users] Stunnel on the same machine
Near 2007-10-05 22:17 +0530, subrata(a)indiatimes.com insisted:
> After starting stunnel and connecting the mysql client/usr/local/mysql/bin/mysql -h 127.0.0.1 -u root -p the flow gets stuck at the Enter password prompt any suggestions how to proceed from there.
What do your stunnel configuration files look like?
Other problem: mysql client may decide to use a local domain socket when
connecting to localhost, thwarting your attempts to go via Stunnel.
You might want to 'strace mysql ...' and look for the connect() lines.
--
Brian Hatch Time flies like an
Systems and arrow. Fruit flies
Security Engineer like a banana.
http://www.ifokr.org/bri/
Every message PGP signed
--
My life has changed. What about yours?
Log on to the new Indiatimes Mail and Live out of the Inbox!
3
3
I've been fighting with stunnel, trying to get its transparent proxy support
to work. No matter what I do, as soon as transparent = source support is
turned on, tests with my mail client just time out.
If I turn transparent proxy support off it works but appears as if
connections are from localhost, which is undesirable.
My goal is to have stunnel listen on *:465 and provide SSL protected
connectivity, which appear to arrive from the remote client IP, on my mail server's
external IP address on port 25. My mail server and the firewall with the
rules on it are the same physical machine.
Can someone please make some suggestions as to what else I can try to get
this working?
I'm running Linux 2.6.38 on a current CentOS/rhel5 box and I've got modules
built for most netfilter options, including:
NF_CONNTRACK=m
NETFILTER_TPROXY=m
NETFILTER_XT_MATCH_SOCKET=m
NETFILTER_XT_TARGET_TPROXY=m
/proc/sys/net/ipv4/conf/all/rp_filter = 0
/proc/sys/net/ipv4/ip_forward = 1
This is my stunnel config:
cert = /etc/stunnel/assps.crt
key = /etc/stunnel/assps.key
pid = /var/run/stunnel/stunnel_smtps.pid
verify = 0
debug = 7
output = /var/log/stunnel_smtps.log
TIMEOUTconnect = 60
[smtps]
accept = 465
connect = MY_EXTERNAL_IP:25
transparent = source
My stunnel seems happy with the DH Parameters in my cert file.
My firewall relevant rules:
iptables -t mangle -N DIVERT
iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
iptables -t mangle -A DIVERT -j MARK --set-mark 1
iptables -t mangle -A DIVERT -j ACCEPT
ip rule add fwmark 1 lookup 100
ip route add local 0.0.0.0/0 dev lo table 100
# stunnel -version
stunnel 4.35 on i686-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 July 2008
Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP
Global options
debug = daemon.notice
pid = /var/run/stunnel.pid
RNDbytes = 64
RNDfile = /dev/urandom
RNDoverwrite = yes
Service-level options
cert = /etc/stunnel/stunnel.pem
ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH
curve = sect163r2
session = 300 seconds
stack = 65536 bytes
sslVersion = SSLv3 for client, all for server
TIMEOUTbusy = 300 seconds
TIMEOUTclose = 60 seconds
TIMEOUTconnect = 10 seconds
TIMEOUTidle = 43200 seconds
verify = none
# stunnel -sockets
Socket option defaults:
Option Accept Local Remote OS default
SO_DEBUG -- -- -- 0
SO_DONTROUTE -- -- -- 0
SO_KEEPALIVE -- -- -- 0
SO_LINGER -- -- -- 0:0
SO_OOBINLINE -- -- -- 0
SO_RCVBUF -- -- -- 87380
SO_SNDBUF -- -- -- 16384
SO_RCVLOWAT -- -- -- 1
SO_SNDLOWAT -- -- -- 1
SO_RCVTIMEO -- -- -- 0:0
SO_SNDTIMEO -- -- -- 0:0
SO_REUSEADDR 1 -- -- 0
SO_BINDTODEVICE -- -- -- --
TCP_KEEPCNT -- -- -- 9
TCP_KEEPIDLE -- -- -- 7200
TCP_KEEPINTVL -- -- -- 75
IP_TOS -- -- -- 0
IP_TTL -- -- -- 64
TCP_NODELAY -- -- -- 0
Here is the log file with the connection timeout:
2011.03.20 15:26:43 LOG5[23214:3073877712]: Reading configuration from file /etc/stunnel/stunnel-assp_smtps.conf
2011.03.20 15:26:43 LOG7[23214:3073877712]: Snagged 64 random bytes from /root/.rnd
2011.03.20 15:26:43 LOG7[23214:3073877712]: Wrote 1024 new random bytes to /root/.rnd
2011.03.20 15:26:43 LOG7[23214:3073877712]: PRNG seeded successfully
2011.03.20 15:26:43 LOG7[23214:3073877712]: Using DH parameters from /etc/stunnel/assps.crt
2011.03.20 15:26:43 LOG6[23214:3073877712]: DH initialized with 512 bit key
2011.03.20 15:26:43 LOG7[23214:3073877712]: Certificate: /etc/stunnel/assps.crt
2011.03.20 15:26:43 LOG7[23214:3073877712]: Certificate loaded
2011.03.20 15:26:43 LOG7[23214:3073877712]: Key file: /etc/stunnel/assps.key
2011.03.20 15:26:43 LOG7[23214:3073877712]: Private key loaded
2011.03.20 15:26:43 LOG7[23214:3073877712]: SSL context initialized for service smtps
2011.03.20 15:26:43 LOG5[23214:3073877712]: Configuration successful
2011.03.20 15:26:43 LOG5[23214:3073877712]: No limit detected for the number of clients
2011.03.20 15:26:43 LOG7[23214:3073877712]: libwrap_init: FD=3 allocated (blocking mode)
2011.03.20 15:26:43 LOG7[23214:3073877712]: libwrap_init: FD=4 allocated (blocking mode)
2011.03.20 15:26:43 LOG7[23214:3073877712]: libwrap_init: FD=4 allocated (blocking mode)
2011.03.20 15:26:43 LOG7[23214:3073877712]: libwrap_init: FD=5 allocated (blocking mode)
2011.03.20 15:26:43 LOG7[23214:3073877712]: libwrap_init: FD=5 allocated (blocking mode)
2011.03.20 15:26:43 LOG7[23214:3073877712]: libwrap_init: FD=6 allocated (blocking mode)
2011.03.20 15:26:43 LOG7[23214:3073877712]: libwrap_init: FD=6 allocated (blocking mode)
2011.03.20 15:26:43 LOG7[23214:3073877712]: libwrap_init: FD=7 allocated (blocking mode)
2011.03.20 15:26:43 LOG7[23214:3073877712]: libwrap_init: FD=7 allocated (blocking mode)
2011.03.20 15:26:43 LOG7[23214:3073877712]: libwrap_init: FD=8 allocated (blocking mode)
2011.03.20 15:26:43 LOG7[23214:3073877712]: signal_pipe: FD=9 allocated (blocking mode)
2011.03.20 15:26:43 LOG7[23214:3073877712]: signal_pipe: FD=10 allocated (blocking mode)
2011.03.20 15:26:43 LOG7[23214:3073877712]: accept socket: FD=11 allocated (non-blocking mode)
2011.03.20 15:26:43 LOG7[23214:3073877712]: Option SO_REUSEADDR set on accept socket
2011.03.20 15:26:43 LOG7[23214:3073877712]: Service smtps bound to 0.0.0.0:465
2011.03.20 15:26:43 LOG7[23214:3073877712]: Service smtps opened FD=11
2011.03.20 15:26:44 LOG7[23220:3073877712]: Created pid file /var/run/stunnel/stunnel_smtps.pid
2011.03.20 15:26:44 LOG5[23220:3073877712]: stunnel 4.35 on i686-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008
2011.03.20 15:26:44 LOG5[23220:3073877712]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP
2011.03.20 15:26:56 LOG7[23220:3073877712]: local socket: FD=0 allocated (non-blocking mode)
2011.03.20 15:26:56 LOG7[23220:3073877712]: Service smtps accepted FD=0 from MY_TESTING_CLIENT_IP:56765
2011.03.20 15:26:56 LOG7[23220:3073874832]: Service smtps started
2011.03.20 15:26:56 LOG7[23220:3073874832]: Option TCP_NODELAY set on local socket
2011.03.20 15:26:56 LOG7[23220:3073874832]: Waiting for a libwrap process
2011.03.20 15:26:56 LOG7[23220:3073874832]: Acquired libwrap process #0
2011.03.20 15:26:56 LOG7[23220:3073874832]: Releasing libwrap process #0
2011.03.20 15:26:56 LOG7[23220:3073874832]: Released libwrap process #0
2011.03.20 15:26:56 LOG7[23220:3073874832]: Service smtps permitted by libwrap from MY_TESTING_CLIENT_IP:56765
2011.03.20 15:26:56 LOG5[23220:3073874832]: Service smtps accepted connection from MY_TESTING_CLIENT_IP:56765
2011.03.20 15:26:56 LOG7[23220:3073874832]: SSL state (accept): before/accept initialization
2011.03.20 15:26:56 LOG7[23220:3073874832]: SSL state (accept): SSLv3 read client hello A
2011.03.20 15:26:56 LOG7[23220:3073874832]: SSL state (accept): SSLv3 write server hello A
2011.03.20 15:26:56 LOG7[23220:3073874832]: SSL state (accept): SSLv3 write certificate A
2011.03.20 15:26:56 LOG7[23220:3073874832]: SSL state (accept): SSLv3 write certificate request A
2011.03.20 15:26:56 LOG7[23220:3073874832]: SSL state (accept): SSLv3 flush data
2011.03.20 15:26:56 LOG7[23220:3073874832]: SSL alert (read): warning: no certificate
2011.03.20 15:26:56 LOG7[23220:3073874832]: SSL state (accept): SSLv3 read client key exchange A
2011.03.20 15:26:56 LOG7[23220:3073874832]: SSL state (accept): SSLv3 read finished A
2011.03.20 15:26:56 LOG7[23220:3073874832]: SSL state (accept): SSLv3 write change cipher spec A
2011.03.20 15:26:56 LOG7[23220:3073874832]: SSL state (accept): SSLv3 write finished A
2011.03.20 15:26:56 LOG7[23220:3073874832]: SSL state (accept): SSLv3 flush data
2011.03.20 15:26:56 LOG7[23220:3073874832]: 1 items in the session cache
2011.03.20 15:26:56 LOG7[23220:3073874832]: 0 client connects (SSL_connect())
2011.03.20 15:26:56 LOG7[23220:3073874832]: 0 client connects that finished
2011.03.20 15:26:56 LOG7[23220:3073874832]: 0 client renegotiations requested
2011.03.20 15:26:56 LOG7[23220:3073874832]: 1 server connects (SSL_accept())
2011.03.20 15:26:56 LOG7[23220:3073874832]: 1 server connects that finished
2011.03.20 15:26:56 LOG7[23220:3073874832]: 0 server renegotiations requested
2011.03.20 15:26:56 LOG7[23220:3073874832]: 0 session cache hits
2011.03.20 15:26:56 LOG7[23220:3073874832]: 0 external session cache hits
2011.03.20 15:26:56 LOG7[23220:3073874832]: 0 session cache misses
2011.03.20 15:26:57 LOG7[23220:3073874832]: 0 session cache timeouts
2011.03.20 15:26:57 LOG6[23220:3073874832]: SSL accepted: new session negotiated
2011.03.20 15:26:57 LOG6[23220:3073874832]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1
2011.03.20 15:26:57 LOG7[23220:3073874832]: remote socket: FD=1 allocated (non-blocking mode)
2011.03.20 15:26:57 LOG6[23220:3073874832]: local_bind succeeded on the original port
2011.03.20 15:26:57 LOG6[23220:3073874832]: connect_blocking: connecting MY_EXTERNAL_IP:25
2011.03.20 15:26:57 LOG7[23220:3073874832]: connect_blocking: s_poll_wait MY_EXTERNAL_IP:25: waiting 60 seconds
2011.03.20 15:27:57 LOG3[23220:3073874832]: connect_blocking: s_poll_wait MY_EXTERNAL_IP:25: TIMEOUTconnect exceeded
2011.03.20 15:27:57 LOG5[23220:3073874832]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket
2011.03.20 15:27:57 LOG7[23220:3073874832]: Service smtps finished (0 left)
2011.03.20 15:29:21 LOG7[23220:3073877712]: Dispatching signals from the signal pipe
2011.03.20 15:29:21 LOG5[23220:3073877712]: Received signal 15; terminating
2011.03.20 15:29:21 LOG7[23220:3073877712]: removing pid file /var/run/stunnel/stunnel_smtps.pid
The only even slightly odd thing I see other than the timeouts is the
" 2011.03.20 15:26:56 LOG7[23220:3073874832]: SSL alert (read): warning: no certificate"
I'm not sure what that is about, but it doesn't seem critical...
2
3
The ChangeLog entry:
Version 4.33, 2010.04.05, urgency: MEDIUM:
* New features
- Win32 DLLs for OpenSSL 1.0.0.
This library requires to c_rehash CApath/CRLpath directories on upgrade.
- Win32 DLLs for zlib 1.2.4.
- Experimental support for local mode on WIN32 platform.
Try "exec = c:\windows\system32\cmd.exe".
* Bugfixes
- Inetd mode fixed
SHA-1 value for stunnel-4.33.tar.gz:
695c7ef834952cb8ddbc790e10b6e32798fc2767
Home page: http://stunnel.mirt.net/
Download: ftp://stunnel.mirt.net/stunnel/
Best regards,
Michal Trojnara
4
6
Hello,
I'm using stunnel in client mode to provide an SSL connection for
offlineimap[1] which does not support verification of SSL certificates.
As I've read stunnel does not compare the name of the server offering
the certificate to the server name mentioned in the certificate (in the
CN field for example). So if I used the following section in my
stunnel.conf
client=yes
[imaps]
accept = 127.0.0.1:4322
connect = imap.gmail.com:993
CAfile = /usr/share/ca-certificates/mozilla/Equifax_Secure_CA.crt
verify = 2
stunnel would happily accept any certificate signed by Equifax for an
arbitrary website. Is this correct?
So I've switched to using the verify=3 option and I just want to make
sure I configured it correctly.
I'm now using the following section
client=yes
[imaps]
accept = 127.0.0.1:4322
connect = imap.gmail.com:993
CAfile= /home/ph/.certs/imaps.pem
verify = 3
imaps.pem is a file containing two certificates, namely the first
and the last certificate in the certificate chain of imap.gmail.com,
that is the Equifax CA certificate and the server certificate itself.
I then use offlineimap to establish an unencrypted connection to
127.0.0.1:4322.
My understanding is that stunnel will now exclusively accept the server
certificate stored in the imaps.pem file rendering all MITM attacks
impossible.
I'd be grateful if someone could confirm that this setup makes sense. Is
this the way the verify=3 option is supposed to use? First I thought
that it should be enough to just provide the server certificate in the
imaps.pem file, but then openssl would complain about a self-signed
certificate, so I included the CA certificate as well.
Regards,
Philipp
[1] https://github.com/jgoerzen/offlineimap/wiki/
2
3
Hi
I'm about to add stunnel to my buildroot embedded project (ARM926EJ-S) and I
was hoping the list could answer a few performance questions?
I've been looking for a way to encrypt the connections between my embedded
units and my server. From what I understood about openvpn, the server
starts to give problems beyond 1024 "concurrent sessions" .... I'm looking
at a design that can handle 4K concurrent sessions....although it'll take a
few
years to get that big.
My embedded devices have a GSM modem and setup a ppp0 interface over gprs.
I'm considering stunnel in the hope that I could have up to 3000 stunnel
connections
coming into my servers. I say 3K because by the tike I reach this figure I
hope to have implemented better switches and off load the overhead of the
encrypted connection to
the switch.
The requirement is that the embedded "non-ssl aware client" will be able to
communicate with the server over a secure tunnel.
Am I completely on the wrong road? .... could stunnel cater for something
like this?
Thanks in advance!
3
2
Certificate request popup when clicking on MS Office links in a stunnel HTTPS redirect to Domino HTTP server?
by Josiah Fizer 25 Mar '11
by Josiah Fizer 25 Mar '11
25 Mar '11
We have a Lotus Domino server hosting some Microsoft Office documents. For
improved security, I started using stunnel to redirect pacts from the HTTP
servers via HTTPS. Everything works perfectly, however when a user clicks a
document link they are prompted for login credentials or a certificate. This
would seem to be because MS Office is trying to open the remote document in
edit mode rather then downloading it locally or opening it in read mode.
I've tried a number of stunnel configuration options but nothing seems to
work. At current I am using the following simple configuration. Any insight
into the issue would be appreciated.
cert = stunnel.pem
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
verify=0
[https]
accept = 443
connect = localhost:80
TIMEOUTclose = 0
1
0
Re: [stunnel-users] Windows Firewall has blocked some features of thisprogram
by jay＠experts-exchange.com 22 Mar '11
by jay＠experts-exchange.com 22 Mar '11
22 Mar '11
Hi Josealf,
Thank you for your response and for this information. Is there a VB script
or other method I can use for this purpose? I use a signed Java applet to
download, install, and execute stunnel, but can insert a step to run a VB
or other script on the host prior. I suspect the stunnel installer may do
this already, but after looking, did not see anything.
Thank you
> You can add the required firewall exceptions as part of your installation
> tasks. You just need to allow connections to the incoming port(s) your
> stunnel config use.
>
> -----Original Message-----
> From: jay(a)experts-exchange.com
> Sender: stunnel-users-bounces(a)stunnel.org
> Date: Mon, 21 Mar 2011 17:39:11
> To: <stunnel-users(a)stunnel.org>
> Subject: [stunnel-users] Windows Firewall has blocked some features of
> this
> program
>
> Folks,
>
> While bundling stunnel with my user application, upon kick off I see this
> error message.*1 Is there a way to avoid this security warning? I am
> trying to figure out if signing the binaries will escape this situation,
> or if it is related to the binary not containing a string table. I
> investigated linking the win32 binary with MS Visual Studio 2005 to see
> if
> the presence of the version string info in the binary would help*2, but
> so
> far I have been unable to directly link. I originally built stunnel using
> cygwin's mingw32-gcc*3, so linking using MSDEV is not too easy.*4
>
> Thanks
>
>
> Refs:
> *1 "Windows Security Alert. To help protect your computer, Windows
> Firewall has blocked some features of this program. Do you want to keep
> blocking this program? Name: stunnel Publisher: Unknown"
>
> *2 stunnel/src/version.rc,
>
> // pdelaage TODO 20101111: this file works with MS VC / EVC
> // But with MINGW, properties are NOT displayed in Windows Explorer
> // although they are embedded in the final exe program.
> // anyway, using a .o coming from MS VC does not change anything,
> // and linking the gcc version.o with ms tools works!
> // so the problem is in fact in gcc-linking, not in version.o.
>
>
> *2 mingw64-i686-gcc-core 4.5.1-2
>
> Administrator@MSDN-2005-DEV /cygdrive/c/dl/stunnel/stunnel-4.35/src
> $ i686-w64-mingw32-gcc-4.5.1 -s -o stunnel.exe file.obj client.obj
> log.obj
> options.obj protocol.obj network.obj resolver.obj ssl.obj ctx.obj
> verify.obj sthreads.obj stunnel.obj gui.obj resources.obj
> -L/cygdrive/c/openssl/lib -L/cygdrive/c/dl/stunnel/zlib-1.2.5
> -lcrypto.dll
> -lssl.dll -lz -lws2_32 -lgdi32 -mwindows -v
> Using built-in specs.
> COLLECT_GCC=i686-w64-mingw32-gcc-4.5.1
> COLLECT_LTO_WRAPPER=/usr/lib/gcc/i686-w64-mingw32/4.5.1/lto-wrapper.exe
> Target: i686-w64-mingw32
> Configured with:
> /cygdrive/c/nnnew/gcc32/mingw64-i686-gcc-4.5.1-2/src/gcc-4.5.1/configure
> --srcdir=/cygdrive/c/nnnew/gcc32/mingw64-i686-gcc-4.5.1-2/src/gcc-4.5.1
> --prefix=/usr --exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin
> --libexecdir=/usr/lib --datadir=/usr/share --localstatedir=/var
> --sysconfdir=/etc --datarootdir=/usr/share
> --docdir=/usr/share/doc/mingw64-i686-gcc -C --build=i686-pc-cygwin
> --host=i686-pc-cygwin --target=i686-w64-mingw32
> --with-sysroot=/usr/i686-w64-mingw32/sys-root
> --with-build-sysroot=/usr/i686-w64-mingw32/sys-root --disable-multilib
> --disable-win32-registry
> --enable-languages=c,ada,c++,fortran,objc,obj-c++
> --enable-fully-dynamic-strings --enable-libgomp --enable-sjlj-exceptions
> --enable-version-specific-runtime-libs --with-dwarf2
> --enable-decimal-float=bid --enable-lto
> Thread model: win32
> gcc version 4.5.1 (GCC)
> COMPILER_PATH=/usr/lib/gcc/i686-w64-mingw32/4.5.1/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/:/usr/lib/gcc/i686-w64-mingw32/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/:/usr/lib/gcc/i686-w64-mingw32/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/bin/
> LIBRARY_PATH=/usr/lib/gcc/i686-w64-mingw32/4.5.1/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/lib/../lib32/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/lib/:/usr/i686-w64-mingw32/sys-root/mingw/lib/
> COLLECT_GCC_OPTIONS='-s' '-o' 'stunnel.exe' '-L/cygdrive/c/openssl/lib'
> '-L/cygdrive/c/dl/stunnel/zlib-1.2.5' '-mwindows' '-v' '-mtune=generic'
> '-march=pentiumpro'
> /usr/lib/gcc/i686-w64-mingw32/4.5.1/collect2.exe
> --sysroot=/usr/i686-w64-mingw32/sys-root -m i386pe --subsystem windows
> -Bdynamic -o stunnel.exe -s
> /usr/i686-w64-mingw32/sys-root/mingw/lib/crt2.o
> /usr/lib/gcc/i686-w64-mingw32/4.5.1/crtbegin.o -L/cygdrive/c/openssl/lib
> -L/cygdrive/c/dl/stunnel/zlib-1.2.5 -L/usr/lib/gcc/i686-w64-mingw32/4.5.1
> -L/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/lib/../lib32
> -L/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/lib
> -L/usr/i686-w64-mingw32/sys-root/mingw/lib file.obj client.obj log.obj
> options.obj protocol.obj network.obj resolver.obj ssl.obj ctx.obj
> verify.obj sthreads.obj stunnel.obj gui.obj resources.obj -lcrypto.dll
> -lssl.dll -lz -lws2_32 -lgdi32 -lmingw32 -lgcc_eh -lgcc -lmoldname
> -lmingwex -lmsvcrt -lgdi32 -lcomdlg32 -luser32 -lkernel32 -ladvapi32
> -lshell32 -lmingw32 -lgcc_eh -lgcc -lmoldname -lmingwex -lmsvcrt
> /usr/lib/gcc/i686-w64-mingw32/4.5.1/crtend.o
>
> Administrator@MSDN-2005-DEV /cygdrive/c/dl/stunnel/stunnel-4.35/src
> $
>
> *4 Link attempt under windows:
>
> C:\dl\stunnel\stunnel-4.35\src>link /libpath:"C:\openssl\lib"
> /libpath:"c:\dl\stunnel\zlib-1.2.5" /machine:I386 /nologo
> /out:"stunnel.exe" /incremental:no /release /mapinfo:exports
> /subsystem:windows /opt:ref /opt:icf wsock32.lib kernel32.lib user32.lib
> gdi32.lib comdlg32.lib advapi32.lib shell32.lib msvcrt.lib libcmt.lib
> libcrypto.a libssl.a libz.a file.obj client.obj log.obj options.obj
> protocol.obj network.obj resolver.obj ssl.obj ctx.obj verify.obj
> sthreads.obj stunnel.obj gui.obj resources.obj
> msvcrt.lib(_stat.obj) : warning LNK4078: multiple '.drectve' sections
> found with different attributes (00000A00)
> options.obj : error LNK2019: unresolved external symbol ___chkstk
> referenced in function _parse_conf
> gui.obj : error LNK2019: unresolved external symbol _strdup referenced in
> function _WinMain@16
> libcrypto.a(asn_mime.o) : error LNK2001: unresolved external symbol
> __alloca
> libcrypto.a(bss_file.o) : error LNK2019: unresolved external symbol
> __alloca referenced in function _BIO_new_file
> libcrypto.a(cryptlib.o) : error LNK2001: unresolved external symbol
> __alloca
> libcrypto.a(err_prn.o) : error LNK2001: unresolved external symbol
> __alloca
> libcrypto.a(bn_prime.o) : error LNK2001: unresolved external symbol
> __alloca
> libcrypto.a(b_print.o) : error LNK2019: unresolved external symbol
> ___umoddi3 referenced in function _fmtint
> libcrypto.a(bn_word.o) : error LNK2001: unresolved external symbol
> ___umoddi3
> libcrypto.a(b_print.o) : error LNK2019: unresolved external symbol
> ___udivdi3 referenced in function _fmtint
> stunnel.exe : fatal error LNK1120: 5 unresolved externals
>
> C:\dl\stunnel\stunnel-4.35\src>
>
> _______________________________________________
> stunnel-users mailing list
> stunnel-users(a)stunnel.org
> http://stunnel.mirt.net/mailman/listinfo/stunnel-users
>
2
1
22 Mar '11
Folks,
While bundling stunnel with my user application, upon kick off I see this
error message.*1 Is there a way to avoid this security warning? I am
trying to figure out if signing the binaries will escape this situation,
or if it is related to the binary not containing a string table. I
investigated linking the win32 binary with MS Visual Studio 2005 to see if
the presence of the version string info in the binary would help*2, but so
far I have been unable to directly link. I originally built stunnel using
cygwin's mingw32-gcc*3, so linking using MSDEV is not too easy.*4
Thanks
Refs:
*1 "Windows Security Alert. To help protect your computer, Windows
Firewall has blocked some features of this program. Do you want to keep
blocking this program? Name: stunnel Publisher: Unknown"
*2 stunnel/src/version.rc,
// pdelaage TODO 20101111: this file works with MS VC / EVC
// But with MINGW, properties are NOT displayed in Windows Explorer
// although they are embedded in the final exe program.
// anyway, using a .o coming from MS VC does not change anything,
// and linking the gcc version.o with ms tools works!
// so the problem is in fact in gcc-linking, not in version.o.
*2 mingw64-i686-gcc-core 4.5.1-2
Administrator@MSDN-2005-DEV /cygdrive/c/dl/stunnel/stunnel-4.35/src
$ i686-w64-mingw32-gcc-4.5.1 -s -o stunnel.exe file.obj client.obj log.obj
options.obj protocol.obj network.obj resolver.obj ssl.obj ctx.obj
verify.obj sthreads.obj stunnel.obj gui.obj resources.obj
-L/cygdrive/c/openssl/lib -L/cygdrive/c/dl/stunnel/zlib-1.2.5 -lcrypto.dll
-lssl.dll -lz -lws2_32 -lgdi32 -mwindows -v
Using built-in specs.
COLLECT_GCC=i686-w64-mingw32-gcc-4.5.1
COLLECT_LTO_WRAPPER=/usr/lib/gcc/i686-w64-mingw32/4.5.1/lto-wrapper.exe
Target: i686-w64-mingw32
Configured with:
/cygdrive/c/nnnew/gcc32/mingw64-i686-gcc-4.5.1-2/src/gcc-4.5.1/configure
--srcdir=/cygdrive/c/nnnew/gcc32/mingw64-i686-gcc-4.5.1-2/src/gcc-4.5.1
--prefix=/usr --exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin
--libexecdir=/usr/lib --datadir=/usr/share --localstatedir=/var
--sysconfdir=/etc --datarootdir=/usr/share
--docdir=/usr/share/doc/mingw64-i686-gcc -C --build=i686-pc-cygwin
--host=i686-pc-cygwin --target=i686-w64-mingw32
--with-sysroot=/usr/i686-w64-mingw32/sys-root
--with-build-sysroot=/usr/i686-w64-mingw32/sys-root --disable-multilib
--disable-win32-registry --enable-languages=c,ada,c++,fortran,objc,obj-c++
--enable-fully-dynamic-strings --enable-libgomp --enable-sjlj-exceptions
--enable-version-specific-runtime-libs --with-dwarf2
--enable-decimal-float=bid --enable-lto
Thread model: win32
gcc version 4.5.1 (GCC)
COMPILER_PATH=/usr/lib/gcc/i686-w64-mingw32/4.5.1/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/:/usr/lib/gcc/i686-w64-mingw32/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/:/usr/lib/gcc/i686-w64-mingw32/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/bin/
LIBRARY_PATH=/usr/lib/gcc/i686-w64-mingw32/4.5.1/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/lib/../lib32/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/lib/:/usr/i686-w64-mingw32/sys-root/mingw/lib/
COLLECT_GCC_OPTIONS='-s' '-o' 'stunnel.exe' '-L/cygdrive/c/openssl/lib'
'-L/cygdrive/c/dl/stunnel/zlib-1.2.5' '-mwindows' '-v' '-mtune=generic'
'-march=pentiumpro'
/usr/lib/gcc/i686-w64-mingw32/4.5.1/collect2.exe
--sysroot=/usr/i686-w64-mingw32/sys-root -m i386pe --subsystem windows
-Bdynamic -o stunnel.exe -s
/usr/i686-w64-mingw32/sys-root/mingw/lib/crt2.o
/usr/lib/gcc/i686-w64-mingw32/4.5.1/crtbegin.o -L/cygdrive/c/openssl/lib
-L/cygdrive/c/dl/stunnel/zlib-1.2.5 -L/usr/lib/gcc/i686-w64-mingw32/4.5.1
-L/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/lib/../lib32
-L/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/lib
-L/usr/i686-w64-mingw32/sys-root/mingw/lib file.obj client.obj log.obj
options.obj protocol.obj network.obj resolver.obj ssl.obj ctx.obj
verify.obj sthreads.obj stunnel.obj gui.obj resources.obj -lcrypto.dll
-lssl.dll -lz -lws2_32 -lgdi32 -lmingw32 -lgcc_eh -lgcc -lmoldname
-lmingwex -lmsvcrt -lgdi32 -lcomdlg32 -luser32 -lkernel32 -ladvapi32
-lshell32 -lmingw32 -lgcc_eh -lgcc -lmoldname -lmingwex -lmsvcrt
/usr/lib/gcc/i686-w64-mingw32/4.5.1/crtend.o
Administrator@MSDN-2005-DEV /cygdrive/c/dl/stunnel/stunnel-4.35/src
$
*4 Link attempt under windows:
C:\dl\stunnel\stunnel-4.35\src>link /libpath:"C:\openssl\lib"
/libpath:"c:\dl\stunnel\zlib-1.2.5" /machine:I386 /nologo
/out:"stunnel.exe" /incremental:no /release /mapinfo:exports
/subsystem:windows /opt:ref /opt:icf wsock32.lib kernel32.lib user32.lib
gdi32.lib comdlg32.lib advapi32.lib shell32.lib msvcrt.lib libcmt.lib
libcrypto.a libssl.a libz.a file.obj client.obj log.obj options.obj
protocol.obj network.obj resolver.obj ssl.obj ctx.obj verify.obj
sthreads.obj stunnel.obj gui.obj resources.obj
msvcrt.lib(_stat.obj) : warning LNK4078: multiple '.drectve' sections
found with different attributes (00000A00)
options.obj : error LNK2019: unresolved external symbol ___chkstk
referenced in function _parse_conf
gui.obj : error LNK2019: unresolved external symbol _strdup referenced in
function _WinMain@16
libcrypto.a(asn_mime.o) : error LNK2001: unresolved external symbol __alloca
libcrypto.a(bss_file.o) : error LNK2019: unresolved external symbol
__alloca referenced in function _BIO_new_file
libcrypto.a(cryptlib.o) : error LNK2001: unresolved external symbol __alloca
libcrypto.a(err_prn.o) : error LNK2001: unresolved external symbol __alloca
libcrypto.a(bn_prime.o) : error LNK2001: unresolved external symbol __alloca
libcrypto.a(b_print.o) : error LNK2019: unresolved external symbol
___umoddi3 referenced in function _fmtint
libcrypto.a(bn_word.o) : error LNK2001: unresolved external symbol ___umoddi3
libcrypto.a(b_print.o) : error LNK2019: unresolved external symbol
___udivdi3 referenced in function _fmtint
stunnel.exe : fatal error LNK1120: 5 unresolved externals
C:\dl\stunnel\stunnel-4.35\src>
2
1