stunnel-users February 2012

19 participants
21 discussions

Stunnel 4 failing to connect to gmail
by Asif Iqbal 11 Dec '20

11 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

stunnel and hosts.allow
by Yousef Alhashemi 06 Jul '16

06 Jul '16

Hi, This may be a little bit off-topic, but does anyone here use stunnel with pan? My connections to stunnel (in pan) are always refused by libwrap. I was looking for the right rule to add to /etc/hosts.allow but nothing seems to work aside from "ALL : ALL" (which is obviously not good) and "nntps: KNOWN". Is the latter reasonable? The hosts_access(5) manpage is confusing to say the least. It mentions that daemon (the first token on any line) is the name of the daemon running the process, which would be "stunnel" in my case, but using "stunnel : LOCAL" or even "stunnel : ALL" doesn't work. The rule that seems to work, as mentioned, is "nntps : KNOWN" ("nntps" being the group name in stunnel.conf). What's even more confusing to me is that "nntps : LOCAL" does not work either. Nor does "nntps : localhost 127.0.0.1", "nntps : localhost", "nntps : 127.0.0.1", or "nntps : 192.168.1.". Pan is running on the same machine as stunnel so all connections must be coming from localhost. Why do these rules not trigger? Either way, I'd like to know the "least permissive" hosts.allow rule that would allow me to connect to my news provider from pan, and/or whether "nntps : KNOWN" is a safe option. Thanks, Yousef

3 6

stunnel.conf in %USERAPPDATA%
by Sebastian Rose-Indorf 20 Mar '12

20 Mar '12

Hello, I use Stunnel with Windows. The configuration file "stunnel.conf" and the log file "stunnel.log" are in the %USERAPPDATA%\Stunnel folder. Stunnel starts and works without problems. But the GUI options "Edit stunnel.conf" and "Reload stunnel.conf" do not work. Is remedy possible? Sebastian

2 3

Stunnel->Stunnel Failure Behavior...
by Matt Wise 13 Mar '12

13 Mar '12

I'm using Stunnel in our environment to tunnel our ZooKeeper connections... it works reasonably well as long as ZooKeeper is running on our ZooKeeper servers properly. Here's an example of our server and client configs: Server: > cert = /etc/stunnel/zookeeper.pem > key = /etc/stunnel/zookeeper.key > CAfile = /etc/stunnel/zookeeper_ca.pem > verify = 2 > sslVersion = TLSv1 > setuid = stunnel4 > setgid = stunnel4 > pid = /var/lib/stunnel4/zookeeper.stunnel4.pid > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > TIMEOUTconnect = 2 > debug = 4 > [zookeeper] > accept = 0.0.0.0:2182 > failover = rr > connect = 127.0.0.1:2181 Client: > cert = /etc/stunnel/zookeeper.pem > key = /etc/stunnel/zookeeper.key > CAfile = /etc/stunnel/zookeeper_ca.pem > verify = 2 > sslVersion = TLSv1 > client = yes > setuid = stunnel4 > setgid = stunnel4 > pid = /var/lib/stunnel4/zookeeper.stunnel4.pid > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > TIMEOUTconnect = 2 > debug = 4 > [zookeeper] > accept = 127.0.0.1:2182 > failover = rr > connect = zookeeper1:2182 > connect = zookeeper2:2182 > connect = zookeeper3:2182 Now the intended behavior is that if 'zookeeper1', 'zookeeper'2, or 'zookeeper3' go down that the client will re-establish a connection with one of the other servers. However, that doesnt seem to be happening. Instead, when the connection dies, Stunnel seems to go into a massive loop trying to re-connect to the original server. > Feb 22 21:41:24 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) Whats missing in my config to make the failover work properly? —Matt

2 2

linux default installation
by John A. Wallace 29 Feb '12

29 Feb '12

Hello. I am comparing a default installation of "stunnel.conf" in Linux with that in Windows, and I found some differences that I have a couple questions about. The Windows installation installed in client mode by default, but the one for Linux in server mode. I made a backup copy of the default files for both. For now I want to run stunnel in Linux in client mode, so I am making some changes to it. The installed default for these six parameters are as follows: Client=no Chroot=/var/lib/stunnel/ Setuid=stunnel Setgid=nogroup Pid=/var/run/stunnel.pid Cert=/etc/stunnel/stunnel.pem Is it correct to change these settings for testing in client mode so that they match the current Windows' client mode configuration, like so: Client=yes #Chroot=/var/lib/stunnel/ #Setuid=stunnel #Setgid=nogroup #Pid=/var/run/stunnel.pid #Cert=/etc/stunnel/stunnel.pem

1 1

stunnel log delayed
by John A. Wallace 29 Feb '12

29 Feb '12

Hello, I am running stunnel on Linux in client mode, and I have the following setting in "stunnel.conf": output=stunnel.log The log does not get written to periodically while the program is running but is delayed until after I have closed the program. It would be helpful to be able to look at it from time to time, especially while troubleshooting. Any way "to push" the data down into the file sooner? Thanks. John

2 1

Memory allocated in a different thread at network.c, line 63
by Philippe A. 28 Feb '12

28 Feb '12

Hello, I find the following error my syslog when stopping stunnel 4.52. The program seems to be unable to shutdown cleanly (ex: pid file doesn`t get removed). stunnel: INTERNAL ERROR: Memory allocated in a different thread at network.c, line 63 This is how I configured: LDFLAGS=-Wl,-rpath,/usr/local/app/openssl/lib64 \ ./configure --prefix=/usr/local/app/stunnel \ --includedir=$PKG_HOME/openssl/include/ \ --with-ssl=$PKG_HOME/openssl/ \ --with-threads=fork \ --disable-libwrap Where PKG_HOME is a variable of my own. I had the same error with version 4.51. I do not see the error when running in foreground. I do not see the error either if I compile with threads instead of fork. In case this information is needed, this is how I configured openssl. ./config --prefix=/usr/local/app/openssl --libdir=lib64 shared zlib-dynamic no-ssl2 This is on RHEL 5.5 Regards.

2 2

stunnel for WCF services configured for.NETTCP binding
by larisa_y 24 Feb '12

24 Feb '12

Will Stunnel work for WCF services configured for.NETTCP binding? Thank you. -- View this message in context: http://old.nabble.com/stunnel-for-WCF-services-configured-for.NETTCP-bindin… Sent from the Stunnel - Users mailing list archive at Nabble.com.

1 0

SSLv3 on Win32 does not work
by Zdenek Valach (INBOX) 24 Feb '12

24 Feb '12

Hi I am using the latest version of stunnel in server mode (converting POP3S to POP3) I need to make service work in SSLv3 mode. In TLSv1 it works fine, when I add to stunnel.conf tag sslVersion = all, it still works fine, but when I use sslVersion = SSLv3 although config file is loaded properly, process EXE crashed during establishing the connection. It looks like some bug in actual version of stunnel. Does somebody experience same problem? Thank you very much in advance for any advice Thanks Zdenek ____________________________________________________________ Send any screenshot to your friends in seconds... Works in all emails, instant messengers, blogs, forums and social networks. TRY IM TOOLPACK at http://www.imtoolpack.com/default.aspx?rc=if2 for FREE

2 1

Stunnel for Android
by Huzella Balázs 23 Feb '12

23 Feb '12

Hi! I have downloaded the Android port of stunnel: http://mirrors.zerg.biz/stunnel/stunnel-4.52-android.zip I would like to use it on my Android tablet but I don't know how to start or use it. I have root access on the device. I placed the stunnel and openssl files into /data/stunnel/ directory. Both files have execute permission. Can anybody please provide some information on how to use this application? I haven't found any info on stunnel.org. Best Regards, Balázs Huzella

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users February 2012