- stunnel-users - stunnel.org

aNULL ciphers
by Brian P Hinz 20 Apr '09

20 Apr '09

Hi, Does stunnel support the use of the aNULL cipher suites? I can't seem to make it work, stunnel just fails with a "no shared ciphers" message. I don't think that the problem is with openssl or the client, since when I test it with s_server the handshake completes. Thanks, -brian

1 0

Issue resolving path to .conf using DFS and changing from "by name" to "by IP address"
by Peterson, Stephen 17 Apr '09

17 Apr '09

We use stunnel 4.20 and encountered a problem today and hope someone may be able to provide some insight to a solution. Our client machines are all Windows XP machines with stunnel started as a service. Those installs of stunnel have the path to the .conf as part of the path to the executable. The path to the .conf uses a DFS share. Our network administrator changed our DFS share from "by name" to "by IP address" and then the client services could not resolve the location of the .conf file when the services started on the next start up of client machines. Has anyone encountered this before and what did you do to fix it? Thanks for any assistance. Stephen

1 0

error during multithreaded operation
by Dale Kingsbury 13 Apr '09

13 Apr '09

OS: Windows 2003 SP2 SDK: 2003 R2 SDK We have a multithreaded application that uses a REST-style interface to an SSL-enabled UNIX box that only uses AES. I tried using WinHTTP, but unfortunately, AES is broken in the 2003 version of WinHTTP (confirmed by M$). SO, I hook up stunnel, which works fine when I only start one thread, but if I use more than 1 thread, I get the following error in the stunnel.log. Note that the error is on thread 7140, and the connection is immediately closed. I have retry logic that re-starts failed threads, and the restarted thread works the second time. (of course, the first has finished, so it is essentially running by itself.) The other item of interest is that each thread is sending about 500,000 bytes of data in chunks of 16,000 bytes, and my trace shows that it usually fails after having written more than 100,000 bytes successfully. Any suggestions or help would be greatly appreciated... 2009.04.10 13:17:01 LOG7[3016:7040]: SSL state (connect): SSLv3 flush data 2009.04.10 13:17:01 LOG7[3016:7140]: SSL alert (write): fatal: decrypt error <<<<< ----- NOTE FAILS HERE ON thread 7140 2009.04.10 13:17:01 LOG7[3016:7040]: SSL state (connect): SSLv3 read finished A 2009.04.10 13:17:01 LOG7[3016:7040]: 0 items in the session cache 2009.04.10 13:17:01 LOG7[3016:7040]: 20 client connects (SSL_connect()) 2009.04.10 13:17:01 LOG7[3016:7040]: 19 client connects that finished 2009.04.10 13:17:01 LOG7[3016:7040]: 0 client renegotiations requested 2009.04.10 13:17:01 LOG7[3016:7040]: 0 server connects (SSL_accept()) 2009.04.10 13:17:01 LOG7[3016:7040]: 0 server connects that finished 2009.04.10 13:17:01 LOG7[3016:7040]: 0 server renegotiations requested 2009.04.10 13:17:01 LOG7[3016:7040]: 0 session cache hits 2009.04.10 13:17:01 LOG7[3016:7040]: 0 session cache misses 2009.04.10 13:17:01 LOG7[3016:7040]: 0 session cache timeouts 2009.04.10 13:17:01 LOG6[3016:7040]: SSL connected: new session negotiated 2009.04.10 13:17:01 LOG6[3016:7040]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2009.04.10 13:17:01 LOG3[3016:7140]: SSL_connect: 1408C095: error:1408C095:SSL routines:SSL3_GET_FINISHED:digest check failed 2009.04.10 13:17:01 LOG5[3016:7140]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.04.10 13:17:01 LOG7[3016:7140]: bycast-write-1 finished (1 left) Configuratation file: ;Stunnel configuration for Acuo. ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client=yes verify=0 ; Service-level configuration [bycast-read-1] accept = 18080 connect = 10.220.8.100:8080 ;ciphers=AES128-SHA:AES256-SHA TIMEOUTclose = 0 sslVersion = TLSv1 Dale Kingsbury Founder - Lead Software Engineer Phone: 651-744-9225 << NOTE new number Fax: 651-730-4231 Cel: 651-592-5204 email: dale(a)acuotech.com <mailto:[email protected]> RSNA Booth #4980

2 1

Re: [stunnel-users] OpenSSL Vulnerabilities
by Cal Webster 09 Apr '09

09 Apr '09

On Thu, 2009-04-09 at 12:08 -0500, Guy wrote: > Cal Webster wrote: > > > > Do these SSL libraries still require "MSVCR90.dll" from the > > "Visual C++ Redistributables"? > > > > I appreciate the swift response. :-) > > > > > No, the only Microsoft C Runtime Library dependency is MSVCRT.DLL > (see below output) Thank you. I see that. I've also confirmed by uninstalling "Visual C++ Redistributables" and the OpenSSL package from "slproweb.com". The stunnel service starts up and runs fine with the latest stunnel version 4.27b2. -----------[From stunnel.log]----------- 2009.04.09 14:56:11 LOG7[1240:1236]: RAND_status claims sufficient entropy for the PRNG 2009.04.09 14:56:11 LOG7[1240:1236]: PRNG seeded successfully 2009.04.09 14:56:11 LOG7[1240:1236]: SSL context initialized for service vnc1 2009.04.09 14:56:11 LOG7[1240:1236]: SSL context initialized for service vnc2 2009.04.09 14:56:11 LOG7[1240:1236]: SSL context initialized for service vnc3 2009.04.09 14:56:11 LOG5[1240:1236]: stunnel 4.27 on x86-pc-mingw32-gnu with OpenSSL 0.9.8k 25 Mar 2009 2009.04.09 14:56:11 LOG5[1240:1236]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv4 2009.04.09 14:56:11 LOG5[1240:1260]: No limit detected for the number of clients 2009.04.09 14:56:11 LOG7[1240:1260]: FD 312 in non-blocking mode 2009.04.09 14:56:11 LOG7[1240:1260]: SO_REUSEADDR option set on accept socket 2009.04.09 14:56:11 LOG7[1240:1260]: vnc1 bound to 127.0.0.1:5973 2009.04.09 14:56:11 LOG7[1240:1260]: FD 320 in non-blocking mode 2009.04.09 14:56:11 LOG7[1240:1260]: SO_REUSEADDR option set on accept socket 2009.04.09 14:56:11 LOG7[1240:1260]: vnc2 bound to 127.0.0.1:5972 2009.04.09 14:56:11 LOG7[1240:1260]: FD 328 in non-blocking mode 2009.04.09 14:56:11 LOG7[1240:1260]: SO_REUSEADDR option set on accept socket 2009.04.09 14:56:11 LOG7[1240:1260]: vnc3 bound to 127.0.0.1:15900 -----------[/From stunnel.log]----------- > > On Tue, 2009-04-07 at 19:34 -0500, Guy wrote: ... > $ listdlls -r stunnel > > ListDLLs v2.25 - DLL lister for Win9x/NT > Copyright (C) 1997-2004 Mark Russinovich > Sysinternals - www.sysinternals.com Thank you for the link. I've downloaded and installed the GUI version, "Process Explorer", on a test machine. I'm pleasantly surprised at its utility and light impact on system resources. One more question please: Will the Win32 binaries at the link you provided <ftp://stunnel.mirt.net/stunnel> keep up fairly closely with the latest OpenSSL releases? With OpenSSL so widely used it is constantly being evaluated for vulnerabilities. When they're found, it is patched quickly but dependent applications are sometimes slow to incorporate patched versions. Thanks again for your excellent help. ./Cal

1 0

Re: [stunnel-users] OpenSSL Vulnerabilities
by Cal Webster 09 Apr '09

09 Apr '09

Thank you Guy! I'll try the Win32 binaries and SSL libraries on a test machine. Do these SSL libraries still require "MSVCR90.dll" from the "Visual C++ Redistributables"? I appreciate the swift response. :-) ./Cal On Tue, 2009-04-07 at 19:34 -0500, Guy wrote: > Cal Webster wrote: > > > To update the OpenSSL libraries you must download and... > > > > > Find OpenSSL v.0.9.8k bins and stunnel-4.27b2-installer > (which includes OpenSSL v.0.9.8k DLLs) at: > > <ftp://stunnel.mirt.net/stunnel> >

1 0

OpenSSL Vulnerabilities
by Cal Webster 07 Apr '09

07 Apr '09

Will there be a security update of stunnel to address vulnerabilities outlined in CVE-2009-0590, CVE-2009-0591, and CVE-2009-0789? Alternatively, will stunnel use updated OpenSSL libraries on the host? It appears that this is true on Fedora RPM packages. For Example: ldd stunnel: ------------ libssl.so.7 => /lib64/libssl.so.7 (0x0000000006a3c000) libcrypto.so.7 => /lib64/libcrypto.so.7 (0x0000000007954000) ------------ rpm -q --requires stunnel ----------------------------------------- ... libcrypto.so.7 ... libssl.so.7 ... ----------------------------------------- rpm -ql openssl | egrep 'libcrypto.so.7|libssl.so.7' ----------------------------------------- /lib/libcrypto.so.7 /lib/libssl.so.7 ----------------------------------------- However, I don't know how to determine whether the same dependency works with Win32 dll's. For example, could we install "Win32 OpenSSL v0.9.8k Light" from the below link to resolve the vulnerabilities? http://www.slproweb.com/download/Win32OpenSSL_Light-0_9_8k.exe The description says that it "Installs the most commonly used essentials of Win32 OpenSSL v0.9.8k" but it doesn't say exactly what. Thanks for any insights or suggestions. Cal Webster

2 2

Re: [stunnel-users] Problem with name resolving when using delay option
by Michal Trojnara 06 Apr '09

06 Apr '09

Maksymilian Kowalik wrote: > So the workaround was as simple as creating etc directory inside chroot > and putting resolv.conf there. But still don't know whose bug it is > glibc's or stunnel's? It's not really a bug. It's rather an inherent property of chrooted environments. They often require some files and/or devices to work properly. Pozdrowienia z Polski, Mike

1 0

Re: [stunnel-users] Problem with name resolving when using delay option
by Aron Griffis 06 Apr '09

06 Apr '09

Maksymilian Kowalik wrote: [Mon Apr 06 2009, 08:56:02AM EDT] > So the workaround was as simple as creating etc directory > inside chroot and putting resolv.conf there. But still don't > know whose bug it is glibc's or stunnel's? Neither, it's your bug. :-) As you discovered, you need resolv.conf in the chroot. Aron

1 0

Updating OpenSSL used by stunnel
by Peter Droop 06 Apr '09

06 Apr '09

Hi, I am running stunnel 4.25 with openssl 0.9.8h on Windows 2003 Server. There are some security updates out for openssl, that are not available on stunnel.org. Can I update openssl by just replacing libeay32.dll and libssl32.dll in the stunnel installation directory? I downloaded the dlls from http://www.slproweb.com/products/Win32OpenSSL.html. Thanks, Peter

1 0

GPL patches
by Michal Trojnara 01 Apr '09

01 Apr '09

Dear Users, I've just uploaded some patches sent to stunnel-users list over the years to ftp://stunnel.mirt.net/stunnel/contrib/. Please remember my policy is *not* to include any GPL code into the official stunnel distribution. If you're brave you're free to apply the patches yourself, or even create a fork of stunnel with some additional functionality. Just be aware there were already some security vulnerabilities (including remote code execution) discovered in the 3rd party stunnel patches. For this reason I also don't recommend stunnel package/port maintainers to include any 3rd party code with stunnel. Best regards, Mike

1 0

Can't get NTLM authentication to work with proxy connect.
by Rudy Ghani 01 Apr '09

01 Apr '09

Hi there, My stunnel client is on an Active Directory-authenticated XP workstation, which needs to connect via a web proxy that authenticates using NTLM. I populated my login details in protocolUsername and protocolPassword, but the connection just dies when it reaches the proxy server. Looking at the log, I get the following:- 2009.04.01 08:20:39 LOG6[2140:2892]: SSL connected: new session negotiated 2009.04.01 08:20:39 LOG6[2140:2892]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2009.04.01 15:34:09 LOG7[2140:2708]: ssh3 accepted FD=356 from 127.0.0.1:1026 2009.04.01 15:34:09 LOG7[2140:2708]: Creating a new thread 2009.04.01 15:34:09 LOG7[2140:2708]: New thread created 2009.04.01 15:34:09 LOG7[2140:3896]: ssh3 started 2009.04.01 15:34:09 LOG7[2140:3896]: FD 356 in non-blocking mode 2009.04.01 15:34:09 LOG7[2140:3896]: TCP_NODELAY option set on local socket 2009.04.01 15:34:09 LOG5[2140:3896]: ssh3 accepted connection from 127.0.0.1:1026 2009.04.01 15:34:09 LOG7[2140:3896]: FD 472 in non-blocking mode 2009.04.01 15:34:09 LOG7[2140:3896]: ssh3 connecting 129.32.20.14:8080 2009.04.01 15:34:09 LOG7[2140:3896]: connect_wait: waiting 10 seconds 2009.04.01 15:34:09 LOG7[2140:3896]: connect_wait: connected 2009.04.01 15:34:09 LOG5[2140:3896]: ssh3 connected remote server from 130.32.82.203:1027 2009.04.01 15:34:09 LOG7[2140:3896]: Remote FD=472 initialized 2009.04.01 15:34:09 LOG7[2140:3896]: TCP_NODELAY option set on remote socket 2009.04.01 15:34:09 LOG5[2140:3896]: Negotiations for connect (client side) started 2009.04.01 15:34:09 LOG7[2140:3896]: -> CONNECT xxxx.ath.cx:443 HTTP/1.1 2009.04.01 15:34:09 LOG7[2140:3896]: -> Host: xxxx.ath.cx:443 2009.04.01 15:34:09 LOG7[2140:3896]: -> Proxy-Connection: keep-alive 2009.04.01 15:34:09 LOG7[2140:3896]: -> Proxy-Authorization: NTLM TlRMTVNTUAABAAAAAgIAAA== 2009.04.01 15:34:09 LOG7[2140:3896]: -> 2009.04.01 15:34:09 LOG3[2140:3896]: Unexpected socket close (fdgetline) 2009.04.01 15:34:09 LOG5[2140:3896]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.04.01 15:34:09 LOG7[2140:3896]: ssh3 finished (1 left) If I decode the NTLM auth string, I only get the NTLMSSP header, which seems to be incomplete. If I recall correctly the domain and workstation info should be passed on as well. So question is, how do I get this to work? Is there any specific format that I need to use when using the protocol* settings for NTLM? Thanks and regards.

1 0

SSL CTX use RSA Private Key error
by G K 27 Mar '09

27 Mar '09

Hello all. I am trying to set up stunnel for use on my machine. I shouldn't have a problem with iptables. But I do run tor/privoxy on a regular basis if that matters. I also have set up my gpg keys too. The following is the error I get. I did do some Googling but I'm not quite understanding what I'm looking for to change or modify. I know the error is the SSL CTX RSA private key. Wed Mar 25, 19:39 # /etc/rc.d/stunnel start :: Starting stunnel [BUSY] 2009.03.25 19:39:21 LOG7[7490:3082353408]: Snagged 64 random bytes from /root/.rnd 2009.03.25 19:39:21 LOG7[7490:3082353408]: Wrote 1024 new random bytes to /root/.rnd 2009.03.25 19:39:21 LOG7[7490:3082353408]: RAND_status claims sufficient entropy for the PRNG 2009.03.25 19:39:21 LOG7[7490:3082353408]: PRNG seeded successfully 2009.03.25 19:39:21 LOG7[7490:3082353408]: Certificate: /etc/stunnel/mail.pem 2009.03.25 19:39:21 LOG7[7490:3082353408]: Certificate loaded 2009.03.25 19:39:21 LOG7[7490:3082353408]: Key file: /etc/stunnel/mail.pem 2009.03.25 19:39:21 LOG3[7490:3082353408]: error stack: 140B3009 : error:140B3009:SSL routines:SSL_CTX_use_RSAPrivateKey_file:PEM lib 2009.03.25 19:39:21 LOG3[7490:3082353408]: SSL_CTX_use_RSAPrivateKey_file: 906D06C: error:0906D06C:PEM routines:PEM_read_bio:no start line stunnel 4.25-1 Linux vampypengy 2.6.28-ARCH #1 SMP PREEMPT Tue Mar 17 06:42:43 UTC 2009 i686 Genuine Intel(R) CPU T2060 @ 1.60GHz GenuineIntel GNU/Linux glibc 2.9-4 Using built-in specs. Target: i686-pc-linux-gnu Configured with: ../configure --prefix=/usr --enable-shared --enable-languages=c,c++,fortran,objc,obj-c++,treelang --enable-threads=posix --mandir=/usr/share/man --infodir=/usr/share/info --enable-__cxa_atexit --disable-multilib --libdir=/usr/lib --libexecdir=/usr/lib --enable-clocale=gnu --disable-libstdcxx-pch --with-tune=generic Thread model: posix gcc version 4.3.3 (GCC) OpenSSL 0.9.8j 07 Jan 2009 perl-net-ssleay 1.30-2

3 4

stunnel 4.26 MS SQL connetion - works on Vista, not on XP
by zervakos 25 Mar '09

25 Mar '09

Greetings, I was wondering if anyone's come across anything like this. I want to encrypt connections for MS SQL Server 2008 Express from a Windows XP client to a Windows 2003 Server. Following these instructions: http://www.securityfocus.com/infocus/1677 I was able to configure encrypted connections by pointing SQL Server Management Studio to 127.0.0.1 on _either_ XP or Vista and then that gets tunneled over to the Windows 2003 Server running SQL Server 2008 Express. I can browse the database tables, etc. Now the problem. I have users that make use of a thin client that connects directly to the SQL Server. It has one config file that I've pointed to 127.0.0.1. When I run this thin client on Vista, it works great, however, when running it on XP, stunnel tries to connect, but then gives up after several attempts. Here's what I see in the server log before connecting: 2009.03.23 12:26:59 LOG7[284564:274684]: RAND_status claims sufficient entropy for the PRNG 2009.03.23 12:26:59 LOG7[284564:274684]: PRNG seeded successfully 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Key file: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Private key loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded verify certificates from CAcert.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded CAcert.pem revocation lookup file 2009.03.23 12:26:59 LOG7[284564:274684]: Verify directory set to certificates 2009.03.23 12:26:59 LOG7[284564:274684]: Added certificates revocation lookup directory 2009.03.23 12:26:59 LOG5[284564:274684]: Peer certificate location certificates 2009.03.23 12:26:59 LOG7[284564:274684]: SSL context initialized for service vnc 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Key file: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Private key loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded verify certificates from CAcert.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded CAcert.pem revocation lookup file 2009.03.23 12:26:59 LOG7[284564:274684]: Verify directory set to certificates 2009.03.23 12:26:59 LOG7[284564:274684]: Added certificates revocation lookup directory 2009.03.23 12:26:59 LOG5[284564:274684]: Peer certificate location certificates 2009.03.23 12:26:59 LOG7[284564:274684]: SSL context initialized for service mssql 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Key file: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Private key loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded verify certificates from CAcert.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded CAcert.pem revocation lookup file 2009.03.23 12:26:59 LOG7[284564:274684]: Verify directory set to certificates 2009.03.23 12:26:59 LOG7[284564:274684]: Added certificates revocation lookup directory 2009.03.23 12:26:59 LOG5[284564:274684]: Peer certificate location certificates 2009.03.23 12:26:59 LOG7[284564:274684]: SSL context initialized for service rdp 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Key file: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Private key loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded verify certificates from CAcert.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded CAcert.pem revocation lookup file 2009.03.23 12:26:59 LOG7[284564:274684]: Verify directory set to certificates 2009.03.23 12:26:59 LOG7[284564:274684]: Added certificates revocation lookup directory 2009.03.23 12:26:59 LOG5[284564:274684]: Peer certificate location certificates 2009.03.23 12:26:59 LOG7[284564:274684]: SSL context initialized for service http 2009.03.23 12:26:59 LOG5[284564:274684]: stunnel 4.26 on x86-pc-mingw32-gnu with OpenSSL 0.9.8i 15 Sep 2008 2009.03.23 12:26:59 LOG5[284564:274684]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2009.03.23 12:26:59 LOG5[284564:289192]: No limit detected for the number of clients 2009.03.23 12:27:00 LOG7[284564:289192]: FD 268 in non-blocking mode 2009.03.23 12:27:00 LOG7[284564:289192]: SO_REUSEADDR option set on accept socket 2009.03.23 12:27:00 LOG7[284564:289192]: mssql bound to WINDOWS_SQL_SERVER:14333 2009.03.23 12:27:00 LOG7[284564:289192]: FD 292 in non-blocking mode 2009.03.23 12:27:00 LOG7[284564:289192]: SO_REUSEADDR option set on accept socket And here's what I see after trying to connect from XP (this appears 16 more times in stunnel.log until stunnel gives up): 2009.03.23 12:29:48 LOG7[284564:289192]: mssql accepted FD=308 from Windows_XP_Client:1252 2009.03.23 12:29:48 LOG7[284564:289192]: Creating a new thread 2009.03.23 12:29:48 LOG7[284564:289192]: New thread created 2009.03.23 12:29:48 LOG7[284564:348604]: mssql started 2009.03.23 12:29:48 LOG7[284564:348604]: FD 308 in non-blocking mode 2009.03.23 12:29:48 LOG5[284564:348604]: mssql accepted connection from Windows_XP_Client:1252 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): before/accept initialization 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 read client hello A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 write server hello A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 write certificate A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 write certificate request A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 flush data 2009.03.23 12:29:48 LOG5[284564:348604]: CRL: verification passed 2009.03.23 12:29:48 LOG5[284564:348604]: VERIFY OK: depth=1, /C=PL/ST=Warsaw/L=Warsaw/O=Secure/OU=Secure Labs/CN=CA/emailAddress=user(a)abc.com 2009.03.23 12:29:48 LOG5[284564:348604]: CRL: verification passed 2009.03.23 12:29:48 LOG5[284564:348604]: VERIFY OK: depth=0, /C=PL/ST=Warsaw/L=Warsaw/O=Secure/OU=Secure Labs/CN=VNC Client/emailAddress=user(a)abc.com 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 read client certificate A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 read client key exchange A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 read certificate verify A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 read finished A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 write change cipher spec A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 write finished A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 flush data 2009.03.23 12:29:48 LOG7[284564:348604]: 1 items in the session cache 2009.03.23 12:29:48 LOG7[284564:348604]: 0 client connects (SSL_connect()) 2009.03.23 12:29:48 LOG7[284564:348604]: 0 client connects that finished 2009.03.23 12:29:48 LOG7[284564:348604]: 0 client renegotiations requested 2009.03.23 12:29:48 LOG7[284564:348604]: 1 server connects (SSL_accept()) 2009.03.23 12:29:48 LOG7[284564:348604]: 1 server connects that finished 2009.03.23 12:29:48 LOG7[284564:348604]: 0 server renegotiations requested 2009.03.23 12:29:48 LOG7[284564:348604]: 0 session cache hits 2009.03.23 12:29:48 LOG7[284564:348604]: 0 session cache misses 2009.03.23 12:29:48 LOG7[284564:348604]: 0 session cache timeouts 2009.03.23 12:29:48 LOG6[284564:348604]: SSL accepted: new session negotiated 2009.03.23 12:29:48 LOG6[284564:348604]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2009.03.23 12:29:48 LOG7[284564:348604]: FD 332 in non-blocking mode 2009.03.23 12:29:48 LOG7[284564:348604]: mssql connecting 127.0.0.1:1433 2009.03.23 12:29:48 LOG7[284564:348604]: connect_wait: waiting 10 seconds 2009.03.23 12:29:48 LOG7[284564:348604]: connect_wait: connected 2009.03.23 12:29:48 LOG5[284564:348604]: mssql connected remote server from 127.0.0.1:2001 2009.03.23 12:29:48 LOG7[284564:348604]: Remote FD=332 initialized 2009.03.23 12:29:48 LOG7[284564:348604]: SSL alert (read): warning: close notify 2009.03.23 12:29:48 LOG7[284564:348604]: SSL closed on SSL_read 2009.03.23 12:29:48 LOG7[284564:348604]: Socket write shutdown 2009.03.23 12:29:48 LOG7[284564:348604]: SSL write shutdown 2009.03.23 12:29:48 LOG7[284564:348604]: SSL alert (write): warning: close notify 2009.03.23 12:29:48 LOG6[284564:348604]: SSL_shutdown successfully sent close_notify 2009.03.23 12:29:48 LOG5[284564:348604]: Connection closed: 37 bytes sent to SSL, 52 bytes sent to socket 2009.03.23 12:29:48 LOG7[284564:348604]: mssql finished (0 left) The server's stunnel.conf: CAfile = CAcert.pem CApath = certificates cert = server.pem client = no verify = 3 debug = 7 output = stunnel.log [mssql] accept = WINDOWS_SQL_SERVER:14333 connect = 127.0.0.1:1433 The client's stunnel.conf: CAfile = CAcert.pem CApath = certificates cert = client.pem client = yes verify = 3 debug = 7 output = stunnel.log [mssql] accept = 127.0.0.1:1433 connect = WINDOWS_SQL_SERVER:14333 Things I've tried: - changed the compatibility settings of the thin client to work under ealier versions of Windows, this didn't help - regenerated certificates, no good - tried connecting without certificates, still no good I still haven't tried earlier versions of stunnel, but I figured I'd just check and see if may anyone's run across something like this before. From what I can tell, the combination of XP, the thin client and stunnel does not work. The thin client does work on XP when I do not use stunnel, but I need to have the connection encrypted. Any help greatly appreciated, thanks -- View this message in context: http://www.nabble.com/stunnel-4.26-MS-SQL-connetion---works-on-Vista%2C-not… Sent from the Stunnel - Users mailing list archive at Nabble.com.

3 2

Re: [stunnel-users] Using stunnel in a box having http client and http server.
by Joe Lau 23 Mar '09

23 Mar '09

So, my understanding is that I will need one stunnel for each remote web server that my http client is going to connnect to. For example if my http client want to connect to 3 remote web servers. I will need to setup the folllowing stunnels: Remote https Web Server #1 <------------- Stunnel #1 <---------- http client (http://localhost:81) (port 81) Remote https Web Server #1 <------------- Stunnel #2 <---------- http client (http://localhost:82) (port 82) Remote https Web Server #1 <------------- Stunnel #3 <---------- http client (http://localhost:83) (port 83) But I will need only one stunnel for my http server as follow: Remote https client #1 ------------+-----> Stunnel --------------- http server | (port 443) (port 80) Remote https client #2 ------------+ | ..... | | Remote https client #N-------------+ Is the following config file correct for my http server stunnel? client=no accept=443 connect=localhost:80 Thank you! -Joe -----Original Message----- From: Christophe Nanteuil [mailto:[email protected]] Sent: Monday, March 23, 2009 3:19 AM To: Joe Lau Cc: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Using stunnel in a box having http client and http server. 2009/3/20 Joe Lau <Jlau(a)extremenetworks.com>: > > Hello, Hello, > I am new to this list. > > I am planning to use stunnel on my box which has a http client and http server running on it. > I will need two stunnel instances, one for the http client and one for the http server respectively. It seems good. > > For my http client, my stunnel config file looks like this: > > client=yes > accept=80 > connect=remote_web_server:443 > > For my http server, my stunnel config file looks like this: > > client=no > accept=443 > > The problem I am facing is now I have two programs (i.e. 1) stunnel for http client and 2) http server) listening to the same port 80. > How do I resolve this conflict? Who is going to connect to your http "client" ? if it is your local browser (which seems the goal of the configuration), then you can configure the client with "accept=81" and then type in your browser's address bar "https://localhost:/81" -- Christophe Nanteuil DISCLAIMER: This e-mail and any attachments to it may contain confidential and proprietary material and is solely for the use of the intended recipient. Any review, use, disclosure, distribution or copying of this transmittal is prohibited except by or on behalf of the intended recipient. If you have received this transmittal in error, please notify the sender and destroy this e-mail and any attachments and all copies, whether electronic or printed.

2 1

Re: [stunnel-users] Using stunnel in a box having http client and http server.
by Joe Lau 20 Mar '09

20 Mar '09

Hello, I am new to this list. I am planning to use stunnel on my box which has a http client and http server running on it. I will need two stunnel instances, one for the http client and one for the http server respectively. For my http client, my stunnel config file looks like this: client=yes accept=80 connect=remote_web_server:443 For my http server, my stunnel config file looks like this: client=no accept=443 The problem I am facing is now I have two programs (i.e. 1) stunnel for http client and 2) http server) listening to the same port 80. How do I resolve this conflict? Thank you very much for the help. Regards, -Joe DISCLAIMER: This e-mail and any attachments to it may contain confidential and proprietary material and is solely for the use of the intended recipient. Any review, use, disclosure, distribution or copying of this transmittal is prohibited except by or on behalf of the intended recipient. If you have received this transmittal in error, please notify the sender and destroy this e-mail and any attachments and all copies, whether electronic or printed.

1 0

Is this possible? Stunnel FIPS mode with rdesktop to secured Microsoft terminal server
by David W Blaine 16 Mar '09

16 Mar '09

Hi list, I was wondering if this solution is possible? Linux Linux Windows Server 2003 rdesktop ----> Stunnel client ------> Terminal Server no enc FIPS mode FIPS mode I know there is doco's about how to setup a Stunnel using client and server setups on either side but Windows admins here are unlikely to install Stunnel on their side. They have enabled FIPS mode on their Windows servers and disconnected all the Linux/UNIX admins from their Terminal Server. So I was wondering if I could get away with a client only solution? Dave

1 1

persistent SSL connection
by Dorai Ashok 16 Mar '09

16 Mar '09

Hi all, I was able to setup stunnel between two hosts successfully but the only problem I am facing is that, the SSL connection between the two hosts is not persistent. For every connection I make to the stunnel client, a new SSL connection is established by the stunnel client to the stunnel server. Is there a configuration variable in stunnel which can make the SSL connection between stunnel client and server persistent ? Thanks, -Dorai.

3 3

Re: [stunnel-users] persistent SSL connection
by Peter Pentchev 16 Mar '09

16 Mar '09

On Mon, Mar 16, 2009 at 12:59:16PM +0100, delaage.pierre(a)free.fr wrote: > Quoting Peter Pentchev <roam(a)ringlet.net>: You might want to fix your mailer's idea of quoting, since I did not write what you yourself wrote :) You wrote: > For persistent connexion, use ssh tunneling instead of stunnel. Unless, of course, you are trying to communicate with a third-party product that speaks SSL - if either the client or the server is not under your control, there's no way to make them use multiplexed SSH connections instead of SSL :) But if it's just stunnel on both sides, then yes, SSH tunneling may be a better choice for multiplexing, although it has its own problems - most often related to connection keepalive, especially if there is some kind of firewalling gateway on the path. G'luck, Peter -- Peter Pentchev roam(a)ringlet.net roam(a)space.bg roam(a)FreeBSD.org PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint FDBA FD79 C26F 3C51 C95E DF9E ED18 B68D 1619 4553 Hey, out there - is it *you* reading me, or is it someone else?

1 0

Re: [stunnel-users] Configuring stunnel to use p12 and p7b in client mode
by Eduard Witteveen 14 Mar '09

14 Mar '09

Pierre and List, Thanks for the answer. Maybe i wasn't clear enough in my question: 1 - I have a p12 and p7b file, which work in firefox and iexplore. 2 - I want to setup a tunnel, so the encryption is done by stunnel and not by the browser(so i can 'talk' normal http for soap) Removing the password sounds like a good idea, so i started with this. However, somehow my openssl doesnt know the command pkey. (as mentioned: http://www.openssl.org/docs/apps/pkey.html) > $ openssl pkey > openssl:Error: 'pkey' is an invalid command. > openssl version > OpenSSL 0.9.8g 19 Oct 2007 And > openssl.exe pkey > openssl:Error: 'pkey' is an invalid command. > openssl version > OpenSSL 0.9.8i 15 Sept 2008 I searched the net for the error message, but i couldnt find a solution (i did find more questions regarding this on mailinglists) On Thu, 2009-03-12 at 08:21 +0100, delaage.pierre(a)free.fr wrote: > Selon Eduard Witteveen <eduard(a)nergens.org>: > Hello, > In such case a definitive solution is to remove password protection of the > private key, although it is not good for your security, so be careful. > See info at openssl.org : > http://www.openssl.org/docs/apps/pkey.html#EXAMPLES > > "... > To remove the pass phrase on an RSA private key: > > openssl pkey -in key.pem -out keyout.pem > ..." > > and then regenerate a p12 file for your browsers. > > I do not know ways to specify the password in stunnel, but I think this should > not be a good idea. > Anyway ie and firefox should be able to cache your password at least for a > session, so... > > Yours sincerely, > Pierre Delaage > > > Hello, > > > > I'm trying to get stunnel running on my local system, so it will connect > > to the remote a host, which requires authentication with this p12 > > file(with password). I also have the chain of trust which is in the p7b > > file. > > > > The reason why i want to do this, is that the remote host exposes a soap > > interface by https, and i think it would be a good idea to tunnel the > > communications with stunnel, so a transparant configuration can be used. > > Also, this would mean there is no configuration needed for the browser > > anymore, since it can connect to the localhost instead of to the > > remoteserver. > > > > I've tested the p12(certificate PKCS12?) and (trust chain PKCS7?) files > > with internet explorer and firefox. They work(i can browse the > > remotehost), but i still have to enter the password. > > > > I've converted the p12 and p7b files into dem files with the following > > commands: > > > > > openssl pkcs12 -in certificate.p12 -out certificate.pem > > > Enter Import Password: > > > MAC verified OKK > > > Enter PEM pass phrase: > > > Verifying - Enter PEM pass phrase > > > > firefox: store as PEM with chain > > chain.p7b --> chain.pem > > > > Config: > > > key=certificate.pem > > > CAfile=chain.pem > > > client=yes > > > debug=7 > > > output=stunnel.log > > > verify=1 > > > [http] > > > accept=80 > > > connect=www.remoteserver.com:443 > > > TIMEOUTclose=0 > > > > Command: > > > sudo /usr/bin/stunnel4 stunnel.conf > > > > Error: > > > 009.03.11 00:58:10 LOG5[30424:3082909360]: Threading:PTHREAD > > > SSL:ENGINE > > > Sockets:POLL,IPv6 Auth:LIBWRAP > > > 2009.03.11 00:58:10 LOG6[30424:3082909360]: file ulimit = 1024 (can be > > > changed with 'ulimit -n') > > > 2009.03.11 00:58:10 LOG6[30424:3082909360]: poll() used - no > > > FD_SETSIZE > > > limit for file descriptors > > > 2009.03.11 00:58:10 LOG5[30424:3082909360]: 500 clients allowed > > > 2009.03.11 00:58:10 LOG7[30424:3082909360]: FD 10 in non-blocking mode > > > 2009.03.11 00:58:10 LOG7[30424:3082909360]: FD 11 in non-blocking mode > > > 2009.03.11 00:58:10 LOG7[30424:3082909360]: FD 12 in non-blocking mode > > > 2009.03.11 00:58:10 LOG7[30424:3082909360]: SO_REUSEADDR option set on > > > accept socket > > > 2009.03.11 00:58:10 LOG7[30424:3082909360]: http bound to 0.0.0.0:80 > > > 2009.03.11 00:58:10 LOG7[30430:3082909360]: Created pid file > > > /var/run/stunnel4.pid > > > > > > 2009.03.11 00:58:20 LOG7[30430:3082909360]: http accepted FD=13 from > > > 127.0.0.1:59793 > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: http started > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: FD 13 in non-blocking mode > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Waiting for a libwrap > > > process > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Acquired libwrap process > > > #0 > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Releasing libwrap process > > > #0 > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Released libwrap process > > > #0 > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: http permitted by libwrap > > > from > > > 127.0.0.1:59793 > > > 2009.03.11 00:58:20 LOG5[30430:3082738576]: http accepted connection > > > from > > > 127.0.0.1:59793 > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: FD 14 in non-blocking mode > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: http connecting > > > ${REMOTESERVER_IP}:443 > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: connect_wait: waiting 10 > > > seconds > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: connect_wait: connected > > > 2009.03.11 00:58:20 LOG5[30430:3082738576]: http connected remote > > > server > > > from 10.0.2.15:38710 > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Remote FD=14 initialized > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: SSL state (connect): > > > before/connect initialization > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: SSL state (connect): SSLv3 > > > write > > > client hello A > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: SSL state (connect): SSLv3 > > > read > > > server hello A > > > 2009.03.11 00:58:20 LOG4[30430:3082738576]: VERIFY ERROR: depth=0, > > > error=unable to get local issuer certificate: ${UNIQUE NAME} > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: SSL alert (write): fatal: > > > bad > > > certificate > > > 2009.03.11 00:58:20 LOG3[30430:3082738576]: SSL_connect: 14090086: > > > error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate > > > verify > > > failed > > > 2009.03.11 00:58:20 LOG5[30430:3082738576]: Connection reset: 0 bytes > > > sent > > > to SSL, 0 bytes sent to socket > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: http finished (0 left) > > (${UNIQUE NAME} / ${REMOTESERVER_IP} were replaced) > > > > Tested by connecting the browser to http://127.0.0.1:80/ > > > > How can i get stunnel to redirect http://127.0.0.1:80/ to > > http://remoteserver:443/ and use the certificate and chain to validate > > the connection? Any pointers would also be welcome, since i searched in > > google but i cannot find the correct information, while one would expect > > that this is not the first time that this is being tried. > > > > Thanks, > > > > Eduard Witteveen > > > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)mirt.net > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > >

1 0

Can stunnel do this?
by Miguel Beccari 13 Mar '09

13 Mar '09

I tried this configuration: client = yes debug = debug cert =/Users/etc/stunnel/stunnel.pem [imaps] accept = localhost:143 delay = yes connect = remote:993 and it worked! But if I change "accept = localhost:143" to "accept = localhost:993" it does not work. I need a imaps proxy. Logs does not say anything interesting (SSL accepted: new session negotiated) Thank you all, Miguel

1 0

Newbie Question - Moving stunnel to another machine
by Dave Nasralla 13 Mar '09

13 Mar '09

Hi, I'm pretty new to the unix command line and stunnel. I am running Mac OS 10.5 with the latest version of stunnel. I was able to get stunnel up and running on my computer and it is working fine ( - I installed X-Cold, used Darwinports, got it compiled and configured, and launching at bootup). My question is: If I have an identical Machine (same hardware and OS), is there an easy way to move stunnel over to it? I copied the stunnel executable and the configuration file over to the new machine. I ran it from the terminal command line. % /Applications/stunnel /Applications/stunnel.conf The original location on my machine was (/opt/local/bin/stunnel /opt/ local/etc/stunnel/stunnel.conf) No errors (got the prompt back). But no services start on the configured ports. Am I missing support files? Or am I being dumb to think you can simply copy the program over. I was hoping to not have to jump through the same hoops to get it up and running. Any direction would be appreciated. Thanks, dave naz PS It is a simple configuration to help non SSL Mail clients connect to GMail - no certs involved.

1 0

Configuring stunnel to use p12 and p7b in client mode
by Eduard Witteveen 11 Mar '09

11 Mar '09

Hello, I'm trying to get stunnel running on my local system, so it will connect to the remote a host, which requires authentication with this p12 file(with password). I also have the chain of trust which is in the p7b file. The reason why i want to do this, is that the remote host exposes a soap interface by https, and i think it would be a good idea to tunnel the communications with stunnel, so a transparant configuration can be used. Also, this would mean there is no configuration needed for the browser anymore, since it can connect to the localhost instead of to the remoteserver. I've tested the p12(certificate PKCS12?) and (trust chain PKCS7?) files with internet explorer and firefox. They work(i can browse the remotehost), but i still have to enter the password. I've converted the p12 and p7b files into dem files with the following commands: > openssl pkcs12 -in certificate.p12 -out certificate.pem > Enter Import Password: > MAC verified OKK > Enter PEM pass phrase: > Verifying - Enter PEM pass phrase firefox: store as PEM with chain chain.p7b --> chain.pem Config: > key=certificate.pem > CAfile=chain.pem > client=yes > debug=7 > output=stunnel.log > verify=1 > [http] > accept=80 > connect=www.remoteserver.com:443 > TIMEOUTclose=0 Command: > sudo /usr/bin/stunnel4 stunnel.conf Error: > 009.03.11 00:58:10 LOG5[30424:3082909360]: Threading:PTHREAD > SSL:ENGINE > Sockets:POLL,IPv6 Auth:LIBWRAP > 2009.03.11 00:58:10 LOG6[30424:3082909360]: file ulimit = 1024 (can be > changed with 'ulimit -n') > 2009.03.11 00:58:10 LOG6[30424:3082909360]: poll() used - no > FD_SETSIZE > limit for file descriptors > 2009.03.11 00:58:10 LOG5[30424:3082909360]: 500 clients allowed > 2009.03.11 00:58:10 LOG7[30424:3082909360]: FD 10 in non-blocking mode > 2009.03.11 00:58:10 LOG7[30424:3082909360]: FD 11 in non-blocking mode > 2009.03.11 00:58:10 LOG7[30424:3082909360]: FD 12 in non-blocking mode > 2009.03.11 00:58:10 LOG7[30424:3082909360]: SO_REUSEADDR option set on > accept socket > 2009.03.11 00:58:10 LOG7[30424:3082909360]: http bound to 0.0.0.0:80 > 2009.03.11 00:58:10 LOG7[30430:3082909360]: Created pid file > /var/run/stunnel4.pid > > 2009.03.11 00:58:20 LOG7[30430:3082909360]: http accepted FD=13 from > 127.0.0.1:59793 > 2009.03.11 00:58:20 LOG7[30430:3082738576]: http started > 2009.03.11 00:58:20 LOG7[30430:3082738576]: FD 13 in non-blocking mode > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Waiting for a libwrap > process > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Acquired libwrap process > #0 > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Releasing libwrap process > #0 > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Released libwrap process > #0 > 2009.03.11 00:58:20 LOG7[30430:3082738576]: http permitted by libwrap > from > 127.0.0.1:59793 > 2009.03.11 00:58:20 LOG5[30430:3082738576]: http accepted connection > from > 127.0.0.1:59793 > 2009.03.11 00:58:20 LOG7[30430:3082738576]: FD 14 in non-blocking mode > 2009.03.11 00:58:20 LOG7[30430:3082738576]: http connecting > ${REMOTESERVER_IP}:443 > 2009.03.11 00:58:20 LOG7[30430:3082738576]: connect_wait: waiting 10 > seconds > 2009.03.11 00:58:20 LOG7[30430:3082738576]: connect_wait: connected > 2009.03.11 00:58:20 LOG5[30430:3082738576]: http connected remote > server > from 10.0.2.15:38710 > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Remote FD=14 initialized > 2009.03.11 00:58:20 LOG7[30430:3082738576]: SSL state (connect): > before/connect initialization > 2009.03.11 00:58:20 LOG7[30430:3082738576]: SSL state (connect): SSLv3 > write > client hello A > 2009.03.11 00:58:20 LOG7[30430:3082738576]: SSL state (connect): SSLv3 > read > server hello A > 2009.03.11 00:58:20 LOG4[30430:3082738576]: VERIFY ERROR: depth=0, > error=unable to get local issuer certificate: ${UNIQUE NAME} > 2009.03.11 00:58:20 LOG7[30430:3082738576]: SSL alert (write): fatal: > bad > certificate > 2009.03.11 00:58:20 LOG3[30430:3082738576]: SSL_connect: 14090086: > error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate > verify > failed > 2009.03.11 00:58:20 LOG5[30430:3082738576]: Connection reset: 0 bytes > sent > to SSL, 0 bytes sent to socket > 2009.03.11 00:58:20 LOG7[30430:3082738576]: http finished (0 left) (${UNIQUE NAME} / ${REMOTESERVER_IP} were replaced) Tested by connecting the browser to http://127.0.0.1:80/ How can i get stunnel to redirect http://127.0.0.1:80/ to http://remoteserver:443/ and use the certificate and chain to validate the connection? Any pointers would also be welcome, since i searched in google but i cannot find the correct information, while one would expect that this is not the first time that this is being tried. Thanks, Eduard Witteveen

1 0

Stunnel 4.26 compile issue against openssl 0.9.8j + openssl-fips-1.2
by David W Blaine 10 Mar '09

10 Mar '09

Hi all, When I compile against OpenSSL 0.9.8j + OpenSSL-FIPS-1.2 module on Centos 4.7, I get an error in client.c: client.o(.text+0x1dd): In function `init_ssl': /tmp/stunnel-4.27/src/client.c:333: undefined reference to `FIPS_set_prng_key' collect2: ld returned 1 exit status make[1]: *** [stunnel] Error 1 make[1]: Leaving directory `/tmp/stunnel-4.27/src' make: *** [all-recursive] Error 1 It seems this call is related to a bug in OpenSSL-FIPS-1.1.1 module according to the comments. Checking the references in the includes for both OpenSSL 0.9.8j and OpenSSL-FIPS-1.2, I found that the call should be "fips_set_prng_key" with 3 arguments (the above requires only 2). So based on the comments, I removed it and I was able to successfully compile and install. Not sure if that is the right thing to do??? Dave

2 3

email through clients where no port number defined - like Outlook Express
by Richard Brust 06 Mar '09

06 Mar '09

A few days ago, sent an email in regards to a CRM program attempting to access GMail where no port number definitions are possible. That email (or part of it) is below, but after a bit more diag, I found that the email client was communicating with stunnel, but was not getting past that to GMail (or stunnel was not getting to GMail, not sure how to tell). I also realized that the settings of this application are similar to Outlook Express - email server defined, but no ability to specify port number. Does anyone have stunnel working with Outlook Express? I have a feeling the stunnel settings for that would be similar to what I need. Thanks, and the original email is below I am attempting to send/receive to GMail through a CRM program (contains email client) called ACT! (http://www.act.com) ACT! only allows server addresses in the program configuration, NOT port numbers. (e.g. smtp.gmail.com or 127.0.0.1 - nothing else) I have configured stunnel 4.26 as such: ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [pop] accept = localhost:110 connect = pop.gmail.com:995 [smtp] accept = localhost:25 connect = smtp.gmail.com:465 and in ACT as such: SMTP as localhost POP as localhost (also have tried 127.0.0.1, but with no difference). Richard Brust richard_brust(a)yahoo.com

1 0

Stunnel for tunneling all traffic (vpn)
by BS TLC 06 Mar '09

06 Mar '09

Is it possible to create 2 virtual interfaces, for tunnelling all traffic (vpn)? With ssh program it's quite simple: with the -w option 2 new (tunnel) interfaces are created (for example tun0 and tun1), and it's possible to create a vpn for all type of traffic. Best regards __________________________________________________ Do You Yahoo!? Poco spazio e tanto spam? Yahoo! Mail ti protegge dallo spam e ti da tanto spazio gratuito per i tuoi file e i messaggi http://mail.yahoo.it

2 1

stunnel with libwrap does not disconnect from terminal
by Lars Kruse 02 Mar '09

02 Mar '09

Hi, starting with v4.21, stunnel does not disconnect from the terminal anymore. This can cause problems, if the caller does not redirect stdout/stderr to /dev/null. This did not happen with v4.20. The problem disappears, when I use he "--disable-libwrap" configure switch when compiling stunnel. I am running debian testing on i386 with the stunnel4 package 4.22-2. How to reproduce: 1) stunnel config file: setuid = lars pid = /tmp/stunnel.pid [server] connect = 8080 accept = 443 cert = /some/file 2) command line: cat stunnel.conf | stunnel4 -fd 0 3) process list: erker:~/ttt/stunnel/testing/stunnel-4.26# ps -ef| grep stun lars 29599 1 0 13:47 pts/1 00:00:00 src/stunnel -fd 0 lars 29600 1 0 13:47 pts/1 00:00:00 src/stunnel -fd 0 lars 29601 1 0 13:47 pts/1 00:00:00 src/stunnel -fd 0 lars 29602 1 0 13:47 pts/1 00:00:00 src/stunnel -fd 0 lars 29603 1 0 13:47 pts/1 00:00:00 src/stunnel -fd 0 lars 29604 1 0 13:47 ? 00:00:00 src/stunnel -fd 0 4) FDs of spawned processes: erker:~/ttt/stunnel/testing/stunnel-4.26# ls -l /proc/29599/fd lrwx------ 1 root root 64 Jan 10 13:50 1 -> /dev/pts/1 lrwx------ 1 root root 64 Jan 10 13:47 2 -> /dev/pts/1 lrwx------ 1 root root 64 Jan 10 13:50 3 -> socket:[903037] Is this the expected behaviour? I use stunnel in one of my projects (http://cryptonas.org) and it started to hang with v4.22. After redirecting stdout/stderr to /dev/null, the program works again. I assume, that stunnel should take care for stdout/stderr on its own, when started in daemon mode, right? thanks for your great work! Lars

4 6

No Tray Icon in XP SP3
by Zepp 02 Mar '09

02 Mar '09

Hi all: I am running Stunnel 4.26 in Windows XP SP3. The issue I'm having is that the tray icon is missing when I install and run Stunnel as a service. the program works fine, and it shows up on the process list okay, but no tray icon appears at all. I scanned the help file and saw an option called taskbar which is supposed to be toggled on by default. I added it to the conf file anyway, and it didn't make any difference. The only way I've been able to get the icon to show is to start Stunnel by adding a shortcut to the Startup folder. Is there an option I'm missing? Thanks much! Zepp

1 0

Simple audit of configuration?
by conover＠rahul.net 01 Mar '09

01 Mar '09

Is there a simple way to verify that an stunnel configuration is secure as expected, with no configuration errors? Thanks, John -- John Conover, conover(a)rahul.net, http://www.johncon.com/

1 0

GMail on Windows using ACT
by Richard Brust 24 Feb '09

24 Feb '09

I am attempting to send/receive to GMail through a CRM program (contains email client) called ACT! (http://www.act.com) ACT! only allows server addresses in the program configuration, NOT port numbers. (e.g. smtp.gmail.com or 127.0.0.1 - nothing else) I have configured *stunnel 4.26* as such: ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [pop] accept = localhost:110 connect = pop.gmail.com:995 [smtp] accept = localhost:25 connect = smtp.gmail.com:465 and in ACT as such: SMTP as localhost POP as localhost (also have tried 127.0.0.1, but with no difference). The log is below, but the short of it is that I still cannot get through to the GMail servers. I do not see any glaring errors below, but I'm sure there is something useful. Thank you for any help... 2009.02.24 13:34:35 LOG7[3752:2216]: RAND_status claims sufficient entropy for the PRNG 2009.02.24 13:34:35 LOG7[3752:2216]: PRNG seeded successfully 2009.02.24 13:34:35 LOG7[3752:2216]: SSL context initialized for service pop 2009.02.24 13:34:35 LOG7[3752:2216]: SSL context initialized for service smtp 2009.02.24 13:34:35 LOG5[3752:2216]: stunnel 4.26 on x86-pc-mingw32-gnu with OpenSSL 0.9.8i 15 Sep 2008 2009.02.24 13:34:35 LOG5[3752:2216]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2009.02.24 13:34:35 LOG5[3752:1576]: No limit detected for the number of clients 2009.02.24 13:34:35 LOG7[3752:1576]: FD 200 in non-blocking mode 2009.02.24 13:34:35 LOG7[3752:1576]: SO_REUSEADDR option set on accept socket 2009.02.24 13:34:35 LOG7[3752:1576]: pop bound to 127.0.0.1:110 2009.02.24 13:34:35 LOG7[3752:1576]: FD 208 in non-blocking mode 2009.02.24 13:34:35 LOG7[3752:1576]: SO_REUSEADDR option set on accept socket 2009.02.24 13:34:35 LOG7[3752:1576]: smtp bound to 127.0.0.1:25 2009.02.24 13:34:39 LOG7[3752:1576]: smtp accepted FD=216 from 127.0.0.1:3063 2009.02.24 13:34:39 LOG7[3752:1576]: Creating a new thread 2009.02.24 13:34:39 LOG7[3752:1576]: New thread created 2009.02.24 13:34:39 LOG7[3752:760]: smtp started 2009.02.24 13:34:39 LOG7[3752:760]: FD 216 in non-blocking mode 2009.02.24 13:34:39 LOG7[3752:760]: TCP_NODELAY option set on local socket 2009.02.24 13:34:39 LOG5[3752:760]: smtp accepted connection from 127.0.0.1:3063 2009.02.24 13:34:39 LOG7[3752:760]: FD 240 in non-blocking mode 2009.02.24 13:34:39 LOG7[3752:760]: smtp connecting 209.85.201.111:465 2009.02.24 13:34:39 LOG7[3752:760]: connect_wait: waiting 10 seconds 2009.02.24 13:34:39 LOG7[3752:760]: connect_wait: connected 2009.02.24 13:34:39 LOG5[3752:760]: smtp connected remote server from 192.168.1.100:3064 2009.02.24 13:34:39 LOG7[3752:760]: Remote FD=240 initialized 2009.02.24 13:34:39 LOG7[3752:760]: TCP_NODELAY option set on remote socket 2009.02.24 13:34:39 LOG7[3752:760]: SSL state (connect): before/connect initialization 2009.02.24 13:34:39 LOG7[3752:760]: SSL state (connect): SSLv3 write client hello A 2009.02.24 13:34:39 LOG7[3752:760]: SSL state (connect): SSLv3 read server hello A 2009.02.24 13:34:39 LOG7[3752:760]: SSL state (connect): SSLv3 read server certificate A 2009.02.24 13:34:39 LOG7[3752:760]: SSL state (connect): SSLv3 read server done A 2009.02.24 13:34:39 LOG7[3752:760]: SSL state (connect): SSLv3 write client key exchange A 2009.02.24 13:34:39 LOG7[3752:760]: SSL state (connect): SSLv3 write change cipher spec A 2009.02.24 13:34:39 LOG7[3752:760]: SSL state (connect): SSLv3 write finished A 2009.02.24 13:34:39 LOG7[3752:760]: SSL state (connect): SSLv3 flush data 2009.02.24 13:34:39 LOG7[3752:760]: SSL state (connect): SSLv3 read finished A 2009.02.24 13:34:39 LOG7[3752:760]: 1 items in the session cache 2009.02.24 13:34:39 LOG7[3752:760]: 1 client connects (SSL_connect()) 2009.02.24 13:34:39 LOG7[3752:760]: 1 client connects that finished 2009.02.24 13:34:39 LOG7[3752:760]: 0 client renegotiations requested 2009.02.24 13:34:39 LOG7[3752:760]: 0 server connects (SSL_accept()) 2009.02.24 13:34:39 LOG7[3752:760]: 0 server connects that finished 2009.02.24 13:34:39 LOG7[3752:760]: 0 server renegotiations requested 2009.02.24 13:34:39 LOG7[3752:760]: 0 session cache hits 2009.02.24 13:34:39 LOG7[3752:760]: 0 session cache misses 2009.02.24 13:34:39 LOG7[3752:760]: 0 session cache timeouts 2009.02.24 13:34:39 LOG6[3752:760]: SSL connected: new session negotiated 2009.02.24 13:34:39 LOG6[3752:760]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2009.02.24 13:34:39 LOG7[3752:760]: SSL socket closed on SSL_read 2009.02.24 13:34:39 LOG7[3752:760]: Socket write shutdown 2009.02.24 13:34:39 LOG5[3752:760]: Connection closed: 20 bytes sent to SSL, 226 bytes sent to socket 2009.02.24 13:34:39 LOG7[3752:760]: smtp finished (0 left) 2009.02.24 13:34:39 LOG7[3752:1576]: pop accepted FD=232 from 127.0.0.1:3065 2009.02.24 13:34:39 LOG7[3752:1576]: Creating a new thread 2009.02.24 13:34:39 LOG7[3752:1576]: New thread created 2009.02.24 13:34:39 LOG7[3752:376]: pop started 2009.02.24 13:34:39 LOG7[3752:376]: FD 232 in non-blocking mode 2009.02.24 13:34:39 LOG7[3752:376]: TCP_NODELAY option set on local socket 2009.02.24 13:34:39 LOG5[3752:376]: pop accepted connection from 127.0.0.1:3065 2009.02.24 13:34:39 LOG7[3752:376]: FD 240 in non-blocking mode 2009.02.24 13:34:39 LOG7[3752:376]: pop connecting 209.85.147.109:995 2009.02.24 13:34:39 LOG7[3752:376]: connect_wait: waiting 10 seconds 2009.02.24 13:34:42 LOG7[3752:376]: connect_wait: connected 2009.02.24 13:34:42 LOG5[3752:376]: pop connected remote server from 192.168.1.100:3066 2009.02.24 13:34:42 LOG7[3752:376]: Remote FD=240 initialized 2009.02.24 13:34:42 LOG7[3752:376]: TCP_NODELAY option set on remote socket 2009.02.24 13:34:42 LOG7[3752:376]: SSL state (connect): before/connect initialization 2009.02.24 13:34:42 LOG7[3752:376]: SSL state (connect): SSLv3 write client hello A 2009.02.24 13:34:42 LOG7[3752:376]: SSL state (connect): SSLv3 read server hello A 2009.02.24 13:34:42 LOG7[3752:376]: SSL state (connect): SSLv3 read server certificate A 2009.02.24 13:34:42 LOG7[3752:376]: SSL state (connect): SSLv3 read server done A 2009.02.24 13:34:42 LOG7[3752:376]: SSL state (connect): SSLv3 write client key exchange A 2009.02.24 13:34:42 LOG7[3752:376]: SSL state (connect): SSLv3 write change cipher spec A 2009.02.24 13:34:42 LOG7[3752:376]: SSL state (connect): SSLv3 write finished A 2009.02.24 13:34:42 LOG7[3752:376]: SSL state (connect): SSLv3 flush data 2009.02.24 13:34:42 LOG7[3752:376]: SSL state (connect): SSLv3 read finished A 2009.02.24 13:34:42 LOG7[3752:376]: 1 items in the session cache 2009.02.24 13:34:42 LOG7[3752:376]: 1 client connects (SSL_connect()) 2009.02.24 13:34:42 LOG7[3752:376]: 1 client connects that finished 2009.02.24 13:34:42 LOG7[3752:376]: 0 client renegotiations requested 2009.02.24 13:34:42 LOG7[3752:376]: 0 server connects (SSL_accept()) 2009.02.24 13:34:42 LOG7[3752:376]: 0 server connects that finished 2009.02.24 13:34:42 LOG7[3752:376]: 0 server renegotiations requested 2009.02.24 13:34:42 LOG7[3752:376]: 0 session cache hits 2009.02.24 13:34:42 LOG7[3752:376]: 0 session cache misses 2009.02.24 13:34:42 LOG7[3752:376]: 0 session cache timeouts 2009.02.24 13:34:42 LOG6[3752:376]: SSL connected: new session negotiated 2009.02.24 13:34:42 LOG6[3752:376]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2009.02.24 13:34:42 LOG7[3752:1576]: smtp accepted FD=264 from 127.0.0.1:3067 2009.02.24 13:34:42 LOG7[3752:1576]: Creating a new thread 2009.02.24 13:34:42 LOG7[3752:1576]: New thread created 2009.02.24 13:34:42 LOG7[3752:216]: smtp started 2009.02.24 13:34:42 LOG7[3752:216]: FD 264 in non-blocking mode 2009.02.24 13:34:42 LOG7[3752:216]: TCP_NODELAY option set on local socket 2009.02.24 13:34:42 LOG5[3752:216]: smtp accepted connection from 127.0.0.1:3067 2009.02.24 13:34:42 LOG7[3752:216]: FD 288 in non-blocking mode 2009.02.24 13:34:42 LOG7[3752:216]: smtp connecting 209.85.201.109:465 2009.02.24 13:34:42 LOG7[3752:216]: connect_wait: waiting 10 seconds 2009.02.24 13:34:42 LOG7[3752:216]: connect_wait: connected 2009.02.24 13:34:42 LOG5[3752:216]: smtp connected remote server from 192.168.1.100:3068 2009.02.24 13:34:42 LOG7[3752:216]: Remote FD=288 initialized 2009.02.24 13:34:42 LOG7[3752:216]: TCP_NODELAY option set on remote socket 2009.02.24 13:34:42 LOG7[3752:216]: SSL state (connect): before/connect initialization 2009.02.24 13:34:42 LOG7[3752:216]: SSL state (connect): SSLv3 write client hello A 2009.02.24 13:34:42 LOG7[3752:216]: SSL state (connect): SSLv3 read server hello A 2009.02.24 13:34:42 LOG7[3752:216]: SSL state (connect): SSLv3 read server certificate A 2009.02.24 13:34:42 LOG7[3752:216]: SSL state (connect): SSLv3 read server done A 2009.02.24 13:34:42 LOG7[3752:216]: SSL state (connect): SSLv3 write client key exchange A 2009.02.24 13:34:42 LOG7[3752:216]: SSL state (connect): SSLv3 write change cipher spec A 2009.02.24 13:34:42 LOG7[3752:216]: SSL state (connect): SSLv3 write finished A 2009.02.24 13:34:42 LOG7[3752:216]: SSL state (connect): SSLv3 flush data 2009.02.24 13:34:42 LOG7[3752:216]: SSL state (connect): SSLv3 read finished A 2009.02.24 13:34:42 LOG7[3752:216]: 2 items in the session cache 2009.02.24 13:34:42 LOG7[3752:216]: 2 client connects (SSL_connect()) 2009.02.24 13:34:42 LOG7[3752:216]: 2 client connects that finished 2009.02.24 13:34:42 LOG7[3752:216]: 0 client renegotiations requested 2009.02.24 13:34:42 LOG7[3752:216]: 0 server connects (SSL_accept()) 2009.02.24 13:34:42 LOG7[3752:216]: 0 server connects that finished 2009.02.24 13:34:42 LOG7[3752:216]: 0 server renegotiations requested 2009.02.24 13:34:42 LOG7[3752:216]: 0 session cache hits 2009.02.24 13:34:42 LOG7[3752:216]: 0 session cache misses 2009.02.24 13:34:42 LOG7[3752:216]: 0 session cache timeouts 2009.02.24 13:34:42 LOG6[3752:216]: SSL connected: new session negotiated 2009.02.24 13:34:42 LOG6[3752:216]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2009.02.24 13:34:43 LOG3[3752:216]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2009.02.24 13:34:43 LOG5[3752:216]: Connection reset: 63 bytes sent to SSL, 335 bytes sent to socket 2009.02.24 13:34:43 LOG7[3752:216]: smtp finished (1 left) 2009.02.24 13:35:43 LOG7[3752:376]: SSL socket closed on SSL_read 2009.02.24 13:35:43 LOG7[3752:376]: Socket write shutdown 2009.02.24 13:35:43 LOG5[3752:376]: Connection closed: 48 bytes sent to SSL, 131 bytes sent to socket 2009.02.24 13:35:43 LOG7[3752:376]: pop finished (0 left) Richard Brust rbrDataSolutions/ACT! Certified Consulting http://www.rbrDataSolutions.com 916/769-9411

1 0

Stunnel error
by Reinier van der Gugten 23 Feb '09

23 Feb '09

Hi, I use the STunnel tool to connect to my Ms-SQL database. And so far this works nice. However at one organization I have the following problem: << connect_wait: s_poll_wait timeout>> And the connection fails. Here is the log file and config file. Can you give me any hints how to check where it goes wrong? Thanks. Reinier. 2009.02.23 14:45:12 LOG7[2156:3096]: RAND_status claims sufficient entropy for the PRNG 2009.02.23 14:45:12 LOG7[2156:3096]: PRNG seeded successfully 2009.02.23 14:45:12 LOG7[2156:3096]: Certificate: stunnel.pem 2009.02.23 14:45:12 LOG7[2156:3096]: Certificate loaded 2009.02.23 14:45:12 LOG7[2156:3096]: Key file: stunnel.pem 2009.02.23 14:45:12 LOG7[2156:3096]: Private key loaded 2009.02.23 14:45:12 LOG7[2156:3096]: SSL context initialized for service SQLServer 2009.02.23 14:45:12 LOG5[2156:3096]: stunnel 4.26 on x86-pc-mingw32-gnu with OpenSSL 0.9.8i 15 Sep 2008 2009.02.23 14:45:12 LOG5[2156:3096]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2009.02.23 14:45:12 LOG5[2156:3852]: No limit detected for the number of clients 2009.02.23 14:45:12 LOG7[2156:3852]: FD 184 in non-blocking mode 2009.02.23 14:45:12 LOG7[2156:3852]: SO_REUSEADDR option set on accept socket 2009.02.23 14:45:12 LOG7[2156:3852]: SQLServer bound to 127.0.0.1:31433 2009.02.23 14:49:25 LOG7[2156:3852]: SQLServer accepted FD=208 from 127.0.0.1:2912 2009.02.23 14:49:25 LOG7[2156:3852]: Creating a new thread 2009.02.23 14:49:25 LOG7[2156:3852]: New thread created 2009.02.23 14:49:25 LOG7[2156:996]: SQLServer started 2009.02.23 14:49:25 LOG7[2156:996]: FD 208 in non-blocking mode 2009.02.23 14:49:25 LOG7[2156:996]: TCP_NODELAY option set on local socket 2009.02.23 14:49:25 LOG5[2156:996]: SQLServer accepted connection from 127.0.0.1:2912 2009.02.23 14:49:25 LOG7[2156:996]: FD 232 in non-blocking mode 2009.02.23 14:49:25 LOG7[2156:996]: SQLServer connecting 10.17.98.33:8080 2009.02.23 14:49:25 LOG7[2156:996]: connect_wait: waiting 60 seconds 2009.02.23 14:50:25 LOG6[2156:996]: connect_wait: s_poll_wait timeout 2009.02.23 14:50:25 LOG5[2156:996]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.02.23 14:50:25 LOG7[2156:996]: SQLServer finished (0 left) ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ;output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [SQLServer] accept = 127.0.0.1:31433 ;connect = xx.xx.xxx.xxx:443 connect = 10.17.98.33:8080 protocol = connect protocolHost = xx.xx.xxx.xxx:443 ;session cache timeout session = 60 ;time to wait for expected data TIMEOUTbusy = 60 ;time to wait for close_notify (set to 0 for buggy MSIE) ;TIMEOUTclose = 30 ;time to wait to connect a remote host TIMEOUTconnect = 60 ;time to keep an idle connection ;TIMEOUTidle = 60

1 0

Re: [stunnel-users] stunnel client connecting to host with dynamic
by Adamson H 13 Feb '09

13 Feb '09

>Adamson H wrote: >> Hi, stunnel 4.26 solves a number of issues running on FreeBSD. However, >> a stunnel client still has a problem reconnecting to a host with dynamic >> DNS service after the host IP has changed. Stunnel client seems unaware >> of the host update, pointing the dynamic DNS name to the old outdated >> IP. In order to get reconnected to the host, I have to create a cron >> script to detect the IP change and restart stunnel on the stunnel >> client. My client conf file has the following: >> >> [1873] >> accept = 1873 >> connect = hostname.dynaip.org:1873 >> >> The ip of hostname.dynaip.org changes at a random interval. > >The solution is: >delay = yes > >Best regards, >Mike >_______________________________________________ >stunnel-users mailing list >stunnel-users(a)mirt.net <mailto:[email protected]> >http://stunnel.mirt.net/mailman/listinfo/stunnel-users I added delay = yes to my stunnel client conf file and removed the cron script. The rsync job (873) failed after the IP of the stunnel host had changed. I had to manually restart stunnel to get the job done and put the cron script back again. delay = yes does not with work with ddns. Regards, Adamson H

3 4

stunnel hanging (libwrap)
by Ulrich Wisser 11 Feb '09

11 Feb '09

Hi, on my current project I have a strange error. Stunnel will work for months and suddenly stop accepting connections. At other times it will fail after a couple of hours. It doesn't crash. Connections are still accepted, but no SSL negotiation does take place. Please find a log below. It seems to be some problem with libwrap. As you can see in the logs the last usage of libwrap doesn't release libwrap properly. "Released libwrap process" log statement is missing. And after that just everything hangs waiting for libwrap. But why is this happening? Our host.allow and host.deny files are empty. libwrap is supposed to allow everything. Any suggestions are welcome! Thanks in advance Ulrich 2009.02.10 09:23:16 LOG7[24594:3083130544]: epp accepted FD=22 from 212.227.111.32:59551 2009.02.10 09:23:16 LOG7[24594:3082640272]: epp started 2009.02.10 09:23:16 LOG7[24594:3082640272]: FD 22 in non-blocking mode 2009.02.10 09:23:16 LOG7[24594:3082640272]: TCP_NODELAY option set on local socket 2009.02.10 09:23:16 LOG7[24594:3082640272]: Waiting for a libwrap process 2009.02.10 09:23:16 LOG7[24594:3082640272]: Acquired libwrap process #4 2009.02.10 09:23:16 LOG7[24594:3082640272]: Releasing libwrap process #4 2009.02.10 09:23:16 LOG7[24594:3082640272]: Released libwrap process #4 2009.02.10 09:23:16 LOG7[24594:3082640272]: epp permitted by libwrap from 212.227.111.32:59551 2009.02.10 09:23:16 LOG5[24594:3082640272]: epp accepted connection from 212.227.111.32:59551 2009.02.10 09:23:16 LOG7[24594:3082640272]: SSL state (accept): before/accept initialization 2009.02.10 09:23:16 LOG7[24594:3082640272]: SSL state (accept): SSLv3 read client hello A 2009.02.10 09:23:16 LOG7[24594:3082640272]: SSL state (accept): SSLv3 write server hello A 2009.02.10 09:23:16 LOG7[24594:3082640272]: SSL state (accept): SSLv3 write certificate A 2009.02.10 09:23:16 LOG7[24594:3082640272]: SSL state (accept): SSLv3 write server done A 2009.02.10 09:23:16 LOG7[24594:3082640272]: SSL state (accept): SSLv3 flush data 2009.02.10 09:23:16 LOG7[24594:3082918800]: Socket closed on read 2009.02.10 09:23:16 LOG7[24594:3082918800]: SSL write shutdown 2009.02.10 09:23:16 LOG7[24594:3082918800]: SSL alert (write): warning: close notify 2009.02.10 09:23:16 LOG6[24594:3082918800]: SSL socket closed on SSL_shutdown 2009.02.10 09:23:16 LOG7[24594:3082918800]: Socket write shutdown 2009.02.10 09:23:16 LOG5[24594:3082918800]: Connection closed: 2249 bytes sent to SSL, 1169 bytes sent to socket 2009.02.10 09:23:16 LOG7[24594:3082918800]: epp finished (5 left) 2009.02.10 09:23:16 LOG7[24594:3082709904]: SSL state (accept): SSLv3 read client key exchange A 2009.02.10 09:23:16 LOG7[24594:3082709904]: SSL state (accept): SSLv3 read finished A 2009.02.10 09:23:16 LOG7[24594:3082709904]: SSL state (accept): SSLv3 write change cipher spec A 2009.02.10 09:23:16 LOG7[24594:3082709904]: SSL state (accept): SSLv3 write finished A 2009.02.10 09:23:16 LOG7[24594:3082709904]: SSL state (accept): SSLv3 flush data 2009.02.10 09:23:16 LOG7[24594:3082709904]: 36 items in the session cache 2009.02.10 09:23:16 LOG7[24594:3082709904]: 0 client connects (SSL_connect()) 2009.02.10 09:23:16 LOG7[24594:3082709904]: 0 client connects that finished 2009.02.10 09:23:16 LOG7[24594:3082709904]: 0 client renegotiations requested 2009.02.10 09:23:16 LOG7[24594:3082709904]: 292 server connects (SSL_accept()) 2009.02.10 09:23:16 LOG7[24594:3082709904]: 290 server connects that finished 2009.02.10 09:23:16 LOG7[24594:3082709904]: 0 server renegotiations requested 2009.02.10 09:23:16 LOG7[24594:3082709904]: 41 session cache hits 2009.02.10 09:23:16 LOG7[24594:3082709904]: 1 session cache misses 2009.02.10 09:23:16 LOG7[24594:3082709904]: 6 session cache timeouts 2009.02.10 09:23:16 LOG6[24594:3082709904]: SSL accepted: new session negotiated 2009.02.10 09:23:16 LOG6[24594:3082709904]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2009.02.10 09:23:16 LOG7[24594:3082709904]: FD 16 in non-blocking mode 2009.02.10 09:23:16 LOG7[24594:3082709904]: epp connecting 127.0.0.1:9777 2009.02.10 09:23:16 LOG7[24594:3082709904]: connect_wait: waiting 10 seconds 2009.02.10 09:23:16 LOG7[24594:3082709904]: connect_wait: connected 2009.02.10 09:23:16 LOG5[24594:3082709904]: epp connected remote server from 127.0.0.1:40831 2009.02.10 09:23:16 LOG7[24594:3082709904]: Remote FD=16 initialized 2009.02.10 09:23:16 LOG7[24594:3082709904]: TCP_NODELAY option set on remote socket 2009.02.10 09:23:16 LOG7[24594:3082640272]: SSL state (accept): SSLv3 read client key exchange A 2009.02.10 09:23:16 LOG7[24594:3082640272]: SSL state (accept): SSLv3 read finished A 2009.02.10 09:23:16 LOG7[24594:3082640272]: SSL state (accept): SSLv3 write change cipher spec A 2009.02.10 09:23:16 LOG7[24594:3082640272]: SSL state (accept): SSLv3 write finished A 2009.02.10 09:23:16 LOG7[24594:3082640272]: SSL state (accept): SSLv3 flush data 2009.02.10 09:23:16 LOG7[24594:3082640272]: 37 items in the session cache 2009.02.10 09:23:16 LOG7[24594:3082640272]: 0 client connects (SSL_connect()) 2009.02.10 09:23:16 LOG7[24594:3082640272]: 0 client connects that finished 2009.02.10 09:23:16 LOG7[24594:3082640272]: 0 client renegotiations requested 2009.02.10 09:23:16 LOG7[24594:3082640272]: 292 server connects (SSL_accept()) 2009.02.10 09:23:16 LOG7[24594:3082640272]: 291 server connects that finished 2009.02.10 09:23:16 LOG7[24594:3082640272]: 0 server renegotiations requested 2009.02.10 09:23:16 LOG7[24594:3082640272]: 41 session cache hits 2009.02.10 09:23:16 LOG7[24594:3082640272]: 1 session cache misses 2009.02.10 09:23:16 LOG7[24594:3082640272]: 6 session cache timeouts 2009.02.10 09:23:16 LOG6[24594:3082640272]: SSL accepted: new session negotiated 2009.02.10 09:23:16 LOG6[24594:3082640272]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2009.02.10 09:23:16 LOG7[24594:3082640272]: FD 18 in non-blocking mode 2009.02.10 09:23:16 LOG7[24594:3082640272]: epp connecting 127.0.0.1:9777 2009.02.10 09:23:16 LOG7[24594:3082640272]: connect_wait: waiting 10 seconds 2009.02.10 09:23:16 LOG7[24594:3082640272]: connect_wait: connected 2009.02.10 09:23:16 LOG5[24594:3082640272]: epp connected remote server from 127.0.0.1:40832 2009.02.10 09:23:16 LOG7[24594:3082640272]: Remote FD=18 initialized 2009.02.10 09:23:16 LOG7[24594:3082640272]: TCP_NODELAY option set on remote socket 2009.02.10 09:23:16 LOG7[24594:3083127696]: Socket closed on read 2009.02.10 09:23:16 LOG7[24594:3083127696]: SSL write shutdown 2009.02.10 09:23:16 LOG7[24594:3083127696]: SSL alert (write): warning: close notify 2009.02.10 09:23:16 LOG6[24594:3083127696]: SSL socket closed on SSL_shutdown 2009.02.10 09:23:16 LOG7[24594:3083127696]: Socket write shutdown 2009.02.10 09:23:16 LOG5[24594:3083127696]: Connection closed: 2249 bytes sent to SSL, 1169 bytes sent to socket 2009.02.10 09:23:16 LOG7[24594:3083127696]: epp finished (4 left) 2009.02.10 09:23:30 LOG7[24594:3083130544]: epp accepted FD=15 from 62.116.129.3:3503 2009.02.10 09:23:30 LOG7[24594:3083127696]: epp started 2009.02.10 09:23:30 LOG7[24594:3083127696]: FD 15 in non-blocking mode 2009.02.10 09:23:30 LOG7[24594:3083127696]: TCP_NODELAY option set on local socket 2009.02.10 09:23:30 LOG7[24594:3083127696]: Waiting for a libwrap process 2009.02.10 09:23:30 LOG7[24594:3083127696]: Acquired libwrap process #4 2009.02.10 09:23:30 LOG7[24594:3083130544]: epp accepted FD=17 from 62.116.129.3:3504 2009.02.10 09:23:30 LOG7[24594:3082918800]: epp started 2009.02.10 09:23:30 LOG7[24594:3082918800]: FD 17 in non-blocking mode 2009.02.10 09:23:30 LOG7[24594:3082918800]: TCP_NODELAY option set on local socket 2009.02.10 09:23:30 LOG7[24594:3082918800]: Waiting for a libwrap process 2009.02.10 09:23:30 LOG7[24594:3083127696]: Releasing libwrap process #4 2009.02.10 09:23:45 LOG7[24594:3083130544]: epp accepted FD=23 from 62.116.129.3:35076 2009.02.10 09:23:45 LOG7[24594:3082779536]: epp started 2009.02.10 09:23:45 LOG7[24594:3082779536]: FD 23 in non-blocking mode 2009.02.10 09:23:45 LOG7[24594:3082779536]: TCP_NODELAY option set on local socket 2009.02.10 09:23:45 LOG7[24594:3082779536]: Waiting for a libwrap process 2009.02.10 09:23:48 LOG7[24594:3083130544]: epp accepted FD=24 from 212.209.10.53:4853 2009.02.10 09:23:48 LOG7[24594:3083058064]: epp started 2009.02.10 09:23:48 LOG7[24594:3083058064]: FD 24 in non-blocking mode 2009.02.10 09:23:48 LOG7[24594:3083058064]: TCP_NODELAY option set on local socket 2009.02.10 09:23:48 LOG7[24594:3083058064]: Waiting for a libwrap process 2009.02.10 09:24:01 LOG7[24594:3083130544]: epp accepted FD=25 from 62.116.129.3:35084 2009.02.10 09:24:01 LOG7[24594:3082570640]: epp started 2009.02.10 09:24:01 LOG7[24594:3082570640]: FD 25 in non-blocking mode 2009.02.10 09:24:01 LOG7[24594:3082570640]: TCP_NODELAY option set on local socket 2009.02.10 09:24:01 LOG7[24594:3082570640]: Waiting for a libwrap process 2009.02.10 09:24:50 LOG7[24594:3083130544]: epp accepted FD=26 from 91.203.4.58:3814 2009.02.10 09:24:50 LOG7[24594:3082501008]: epp started 2009.02.10 09:24:50 LOG7[24594:3082501008]: FD 26 in non-blocking mode 2009.02.10 09:24:50 LOG7[24594:3082501008]: TCP_NODELAY option set on local socket 2009.02.10 09:24:50 LOG7[24594:3082501008]: Waiting for a libwrap process 2009.02.10 09:25:29 LOG7[24594:3083130544]: epp accepted FD=27 from 87.96.215.128:34595 2009.02.10 09:25:29 LOG7[24594:3082431376]: epp started 2009.02.10 09:25:29 LOG7[24594:3082431376]: FD 27 in non-blocking mode 2009.02.10 09:25:29 LOG7[24594:3082431376]: TCP_NODELAY option set on local socket 2009.02.10 09:25:29 LOG7[24594:3082431376]: Waiting for a libwrap process 2009.02.10 09:25:40 LOG7[24594:3083130544]: epp accepted FD=28 from 195.249.40.26:36799 2009.02.10 09:25:40 LOG7[24594:3082361744]: epp started 2009.02.10 09:25:40 LOG7[24594:3082361744]: FD 28 in non-blocking mode

2 1

stunnel client connecting to host with dynamic dns service
by Adamson H 09 Feb '09

09 Feb '09

Hi, stunnel 4.26 solves a number of issues running on FreeBSD. However, a stunnel client still has a problem reconnecting to a host with dynamic DNS service after the host IP has changed. Stunnel client seems unaware of the host update, pointing the dynamic DNS name to the old outdated IP. In order to get reconnected to the host, I have to create a cron script to detect the IP change and restart stunnel on the stunnel client. My client conf file has the following: [1873] accept = 1873 connect = hostname.dynaip.org:1873 The ip of hostname.dynaip.org changes at a random interval. Please help. Adamosn H

2 1

Re: [stunnel-users] Stunnel via proxy CONNECT
by Michal Trojnara 09 Feb '09

09 Feb '09

kommersz wrote: > My understanding was that there was a patch merged into Stunnel codeline > with version 4.05 a long time ago which allows the parameters > "httpsproxy_dest" and some others to be used when specifying a [https] > connection in stunnel.conf. Your understanding is not correct, but similar functionality was re-implemented from scratch. You may consider Reading The Fine Manual at: http://stunnel.mirt.net/static/stunnel.html The relevant part is: protocol = proto application protocol to negotiate SSL currently supported: cifs, connect, imap, nntp, pop3, smtp protocolAuthentication = auth_type authentication type for protocol negotiations currently supported: basic, NTLM Currently authentication type only applies to 'connect' protocol. default: basic protocolHost = host:port destination address for protocol negotiations protocolPassword = password password for protocol negotiations protocolUsername = username username for protocol negotiations Best regards, Mike

1 0

Re: [stunnel-users] stunnel tls wrapper/proxy for xmpp
by C.J. Adams-Collier 04 Feb '09

04 Feb '09

On Mon, Feb 02, 2009 at 02:20:18PM -0800, Brian Hatch wrote: > Roughly around 2009-02-02 13:31 -0800, C.J. Adams-Collier broached: > > > I'm new here, and I didn't see anything relating to this after a quick > > glance at the archives. I'd like to start a stunnel connection > > connected to the google talk server and then connect finch up to that > > so that I can tap the clear xmpp session using tcpdump. Can one of > > you help me? > > 5222 requires starttls for xmpp, which stunnel doesn't support. > > 5223 is wrapped ssl and would work for you. Thanks Brian, That almost works, too! I think google only does TLS (5222) though. 23:01:03.594856 IP colliertech.org.35052 > od-in-f83.google.com.5223: S 2704797155:2704797155(0) win 5840 <mss 1460,sackOK,timestamp 133784958 0,nop,wscale 1> 23:01:06.591987 IP colliertech.org.35052 > od-in-f83.google.com.5223: S 2704797155:2704797155(0) win 5840 <mss 1460,sackOK,timestamp 133785708 0,nop,wscale 1> Was there a silent "yet" at the end of your "doesn't support" comment above? :) Do you need beta testers for this new feature? Cheers, C.J. > > -- > Brian Hatch Error 23 occurred when > Systems and attempting to report > Security Engineer error 23. > http://www.ifokr.org/bri/ > > Every message PGP signed

4 7

Error message vista
by Reinier van der Gugten 04 Feb '09

04 Feb '09

Hi, I use Stunnel for some of my customers. However I tried it myself (after a while, and after a reinstall of windows) and I get this error. Can anyone tell me how to get it to work again? I get the same error when I run it as administrator, or when I change the port from 443 to 4430. 2009.02.04 13:54:04 LOG7[2828:5668]: Snagged 64 random bytes from C:/.rnd 2009.02.04 13:54:04 LOG7[2828:5668]: Wrote 1024 new random bytes to C:/.rnd 2009.02.04 13:54:04 LOG7[2828:5668]: RAND_status claims sufficient entropy for the PRNG 2009.02.04 13:54:04 LOG7[2828:5668]: PRNG seeded successfully 2009.02.04 13:54:04 LOG7[2828:5668]: Certificate: stunnel.pem 2009.02.04 13:54:04 LOG7[2828:5668]: Certificate loaded 2009.02.04 13:54:04 LOG7[2828:5668]: Key file: stunnel.pem 2009.02.04 13:54:04 LOG7[2828:5668]: Private key loaded 2009.02.04 13:54:04 LOG7[2828:5668]: SSL context initialized for service SQLServer 2009.02.04 13:54:04 LOG5[2828:5668]: stunnel 4.26 on x86-pc-mingw32-gnu with OpenSSL 0.9.8i 15 Sep 2008 2009.02.04 13:54:04 LOG5[2828:5668]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2009.02.04 13:54:04 LOG5[2828:5672]: No limit detected for the number of clients 2009.02.04 13:54:04 LOG7[2828:5672]: FD 224 in non-blocking mode 2009.02.04 13:54:04 LOG7[2828:5672]: SO_REUSEADDR option set on accept socket 2009.02.04 13:54:04 LOG3[2828:5672]: Error binding SQLServer to 127.0.0.1:31433 2009.02.04 13:54:04 LOG3[2828:5672]: bind: Permission denied (WSAEACCES) (10013) 2009.02.04 13:54:04 LOG3[2828:5672]: Server is down My stunnel.conf looks like this (actual IP address has been modified): ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ;output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [SQLServer] accept = 127.0.0.1:31433 connect = 85.15.135.121:443 ; In case of a proxy server, use: ;connect = 10.3.2.50:8080 ;protocol = connect ;protocolHost = 85.15.135.121:443

2 1

crl next update field functionality seems incorrect
by Steve Hoffman 04 Feb '09

04 Feb '09

Regarding this piece of code in verify.c: if(X509_cmp_current_time(next_update)<0) { s_log(LOG_WARNING, "Found CRL is expired - " "revoking all certificates until you get updated CRL"); X509_STORE_CTX_set_error(callback_ctx, X509_V_ERR_CRL_HAS_EXPIRED); X509_OBJECT_free_contents(&obj); return 0; /* reject connection */ } I don't believe this is correct functionality. The "next update" field is not an expiration of the CRL, but more of an indicator that you, as the holder of the CRL, should obtain a new one. Snippet from this link: http://www.netscape.ca/browser/netscape8/help/en/ssl_help.html#next_update About the "Next Update" Date The browser uses the CRLs it has available to check the validity of certificates issued by the corresponding CAs. If a certificate is listed as revoked, the browser won't accept it as evidence of identity. A CA typically publishes an updated CRL at regular intervals. Every CRL includes a date, specified in the Next Update field, by which the CA will publish the next update of that CRL. In general, if the date in the Next Update field is earlier than the current date, you should obtain the most recent version of the CRL. To view CRL information and set up automatic CRL updating, see Viewing and Managing CRLs. CAs are required to produce a new CRL by the Next Update date. However, the absence of the most recent CRL does not by itself invalidate a certificate. For this reason, if the most recent CRL is not available, a certificate may be validated even though the most recent CRL shows it as expired. Automatic CRL updating can help to avoid this situation. I'd like to suggest removing this check. Thanks, Steve

3 2

error compilation stunnel-4.11 for ARM9
by mailinglist 03 Feb '09

03 Feb '09

Did you ever receive a answer for your problem. Ic have the same problem now. checking for socklen_t... yes configure: **************************************** PTY device files checking for "/dev/ptmx"... configure: error: cannot check for file existence when cross compiling Thanks in advance for you help Ebse

1 0

stunnel tls wrapper/proxy for xmpp
by C.J. Adams-Collier 02 Feb '09

02 Feb '09

Hey all, I'm new here, and I didn't see anything relating to this after a quick glance at the archives. I'd like to start a stunnel connection connected to the google talk server and then connect finch up to that so that I can tap the clear xmpp session using tcpdump. Can one of you help me? Thanks in advance, C.J. cjac@sh0:~/stunnel$ cat stunnel.conf client = yes connect = el-in-f125.google.com:5222 foreground = yes pid = /tmp/stunnel4.pid debug = 7 cjac@sh0:~/stunnel$ stunnel-4.26/src/stunnel stunnel.conf 2009.02.02 21:31:13 LOG6[24798:140190659815120]: Unable to retrieve any random data from /home/cjac/.rnd 2009.02.02 21:31:13 LOG7[24798:140190659815120]: Wrote 0 new random bytes to /home/cjac/.rnd 2009.02.02 21:31:13 LOG7[24798:140190659815120]: RAND_status claims sufficient entropy for the PRNG 2009.02.02 21:31:13 LOG7[24798:140190659815120]: PRNG seeded successfully 2009.02.02 21:31:13 LOG7[24798:140190659815120]: SSL context initialized for service stunnel 2009.02.02 21:31:13 LOG5[24798:140190659815120]: stunnel 4.26 on x86_64-unknown-linux-gnu with OpenSSL 0.9.8c 05 Sep 2006 2009.02.02 21:31:13 LOG5[24798:140190659815120]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 2009.02.02 21:31:13 LOG7[24798:140190659815120]: stunnel started 2009.02.02 21:31:13 LOG7[24798:140190659815120]: FD 0 in non-blocking mode 2009.02.02 21:31:13 LOG7[24798:140190659815120]: FD 1 in non-blocking mode 2009.02.02 21:31:13 LOG7[24798:140190659815120]: FD 4 in non-blocking mode 2009.02.02 21:31:13 LOG7[24798:140190659815120]: stunnel connecting 209.85.163.125:5222 2009.02.02 21:31:13 LOG7[24798:140190659815120]: connect_wait: waiting 10 seconds 2009.02.02 21:31:14 LOG7[24798:140190659815120]: connect_wait: connected 2009.02.02 21:31:14 LOG5[24798:140190659815120]: stunnel connected remote server from 172.16.9.3:55967 2009.02.02 21:31:14 LOG7[24798:140190659815120]: Remote FD=4 initialized 2009.02.02 21:31:14 LOG7[24798:140190659815120]: SSL state (connect): before/connect initialization 2009.02.02 21:31:14 LOG7[24798:140190659815120]: SSL state (connect): SSLv3 write client hello A 2009.02.02 21:31:14 LOG7[24798:140190659815120]: SSL alert (write): fatal: handshake failure 2009.02.02 21:31:14 LOG3[24798:140190659815120]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2009.02.02 21:31:14 LOG5[24798:140190659815120]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.02.02 21:31:14 LOG7[24798:140190659815120]: stunnel finished (0 left)

2 1

Fwd: Stunnel & Zimbra
by Allen 02 Feb '09

02 Feb '09

Hi folks, I'm reposting this from my email address on file, because it was initially rejected (I think because I sent it from my main business address, which is not the address I have listed with this group. My apologies. ------------ I've been using stunnel with Zimbra, on OS X Sever since last year and it's been working well (SSL tunnels should be seen and not heard ;-). I upgraded Zimbra yesterday to a new version, that apparently was supposed to fix its instability running on the OS X platform. However, the upgrade wound up breaking the mail server's ability to send email. From Zimbra's web client, it appears like mail is getting sent (there's a little green sent mail box that pops up right after you click on the send button). Mail never arrives at the client end. I can still receive mail into the Zimbra account when I send to it from my business or personal email account. I provisoned and reloaded posffix, etc., and still can't receive mail on the other end. No stunnel settings have changed since before the upgrade. Here are the stunnel-related file outputs: ----------------------------------------------------------------- root# cat /opt/local/etc/stunnel/stunnel.conf client = yes foreground = no [smtps] accept = 5000 connect = server_name.x.y.com:465 (server name changed to protect the innocent ;-) ----------------------------------------------------------------- cat /opt/zimbra/conf/relay_password server_name.domain.com [email protected]:fakepassword --------------------------------------------- With the real usernames, password, domains, etc., those two (above) stunnel files worked perfectly well with stunnel, and sending mail was not a problem. That was --until I upgraded Zimbra. I realize that this is a stunnel forum and the Zimbra-related forum deals with all their issues. However, I'm wondering if somebody out there in stunnel land might have a light bulb going off regarding this issue. Perhaps there's something that I'm overlooking? Thanks! Allen

1 0

Identification Propagation patch using stunnel client certificates
by Christophe Nanteuil 02 Feb '09

02 Feb '09

Hello, NB : this patch is provided as alpha version : it handles only 1 request at a time for each administrative and ident servers. Why to use this patch ? This patch can be useful when : - you provide access to Internet via your stunnel server and when your legislation enforces you to keep logs of who connected where and when. In this case, you will have Squid logs filled with identification of stunnel clients in a very simple way : nothing to ask to the client as it uses automatically its certificate to fill in the identity fields. - you want to implement several profile access for your clients accessing your web proxy/server : as the proxy will ask ident request to stunnel, you can create filter groups to allow / denied access (with redirection to a page that you can customize) depending on stunnel answer : see filtergroups option of DansGuardian or acl options in squid. Patch to version : 4.26 Type : new feature Description : Identification Propagation using stunnel client certificates The patch proposes to extend the identification propagation provided by the directive 'EXEC=' to directive 'CONNECT=' when using client certificates. With EXEC directive, Subject name and Issuer Name of clients are put in environment variables, which allows the program to determine identity of the stunnel client. This patch adds an ident server functionality to stunnel, compliant with RFC 1413, to allow propagation of identification to remote hosts specified by the service directive 'CONNECT='. Additionnaly, this patch provides an admnistrative server "bound" to the Ident server : on the administrative socket (default port 127.0.0.1:790), you can request number of users currently connected and list them. How to use this patch ? You just have to add a 'identServer=yes' directive to services that you want to propagate identification. For example, you can use this patch when connecting to a DansGuardian web proxy (installed on proxy.example.com) with the option authplugin = '/etc/dansguardian/ authplugins/ident.conf' enabled in the configuration file (or when connecting to a Squid web proxy compiled with --enable-ident-lookups option), and the following stunnel configuration file (located in /etc/ssl/stunnel/stunnel-ident.conf) : ... [WEB] accept=8080 connect=proxy.example.com:8080 identServer=yes ... Stunnel will create a listening socket on 0.0.0.0:113 and answer requests initiated by DansGuardian. -- Christophe Nanteuil

2 4

Stunnel seems broken with oracle http server
by Mailing List SVR 01 Feb '09

01 Feb '09

Hi all, stunnel seems broken with https served by oracle http server, look at the following one for example: https://www.orange.sk/ I'm not able to have http->to https working with that web site, it is a stunnel specific problem or an oracle one? thanks Nicola

2 2

stunnel question when using two BCM5820 SSL accelerator card
by q p 30 Jan '09

30 Jan '09

Hello,stunnel-users I have two BCM5820 SSL accelerator card in one Freebsd 7.1 host. But when I plug in two ssl accel card and make stress test by Web Application Stress Tool , I get same banchmark ,about 70reqs/s , 50% cpu usage, as one ssl accel card in box. On another word, it seems only one accle card is working another one is idle. Is there someone has simialer problem as me? How to make the another card work? #pciconf -lv ubsec0@pci0:2:3:0: class=0x0b4000 card=0x001014e4 chip=0x582014e4 rev=0x10 hdr=0x00 vendor = 'Broadcom Corporation' device = 'BCM 5820 Crypto Accelerator' class = processor ubsec1@pci0:2:4:0: class=0x0b4000 card=0x001014e4 chip=0x582014e4 rev=0x10 hdr=0x00 vendor = 'Broadcom Corporation' device = 'BCM 5820 Crypto Accelerator' class = processor Stunnel Version 4.26 # make -D WITH_STUNNEL_SSL_ENGINE install clean Openssl Version 0.9.8e CPU P4 1.6A MEM 512M [root@proxy /usr/ports/security/stunnel]# stunnel -version stunnel 4.26 on i386-portbld-freebsd7.1 with OpenSSL 0.9.8e 23 Feb 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/tmp/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = AES:CAMELLIA:ALL:!ADH:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none [root@proxy /usr/ports/security/]# openssl version OpenSSL 0.9.8e 23 Feb 2007 BTW:MY SITE IS ALSO BOMBED BY MANY SPAM MAIL EVERYDAY, BUT NOT ALL MAILS FROM CHINESE IS SPAM, ACTUALLY USA IS THE SECOND SPAM SOURCE COUNTURY. ALL OF US HATE SPAM.

1 0

Feature request: set environment variable for inetd-type program
by Michael Renner 27 Jan '09

27 Jan '09

Moin, I am not a programmer, I am a writer and user, so I have to ask kindly for a additional stunnel feature I need the ability to push some information from the stunnel client side to the server side. To be more concrete: a self written script that is called by stunnels 'exec' statement need some settings, e.g. username and password. My idea is to configure this in the client side stunnel.conf and pass this as a environment variable to this script. There is no chance to pack these stings in a client certificate, because everybody who is able to handle snoop/tcpdump will be able to read this. I imagine a configuration like this: client stunnel.conf [foo] accept = 127.0.0.1:1234 connect = 192.0.20.0:443 env = "SUSER=renner" env = "SPASS=geheim" server stunnel.conf [foo] accept = 192.0.20.0:443 exec = /opt/foo/script.sh env = yes My question to the developers: do you think this is a helpful feature, also for others? Greetings -- |Michael Renner E-mail: michael.renner(a)gmx.de | |D-81541 Munich Germany ICQ: #112280325 | |Germany Don't drink as root! ESC:wq

4 4

Stunnel 4.26 - AIX 5.3
by Spence, Thomas Civ 844 CS/SCBX 26 Jan '09

26 Jan '09

Dear Users, * I'm running Stunnel 4.26 as a service, but it dies on logoff... * Could you tell me which one should I put comment "/* ... */" at stunnel.c or protocol.c so I want stunnel's daemon won't stop running. * I am using stunnel.conf, like this: ------- pid = cert = /usr/local/ssl/private/stunnel.pem output = stunnel.log [tssl] accept = 992 exec = /usr/sbin/telnetd ------- *stunnel.log ------- [/usr/local/etc/stunnel]# cat *.log 2009.01.21 16:42:54 LOG7[462906:1]: Snagged 64 random bytes from //.rnd 2009.01.21 16:42:54 LOG7[462906:1]: Wrote 1024 new random bytes to //.rnd 2009.01.21 16:42:54 LOG7[462906:1]: RAND_status claims sufficient entropy for the PRNG 2009.01.21 16:42:54 LOG7[462906:1]: PRNG seeded successfully 2009.01.21 16:42:55 LOG7[462906:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2009.01.21 16:42:55 LOG7[462906:1]: Certificate loaded 2009.01.21 16:42:55 LOG7[462906:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2009.01.21 16:42:55 LOG7[462906:1]: Private key loaded 2009.01.21 16:42:55 LOG7[462906:1]: SSL context initialized for service tssl 2009.01.21 16:42:55 LOG5[462906:1]: stunnel 4.26 on powerpc-ibm-aix5.3.0.0 with OpenSSL 0.9.8j 07 Jan 2009 2009.01.21 16:42:55 LOG5[462906:1]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2009.01.21 16:42:55 LOG6[462906:1]: file ulimit = 65534 (can be changed with 'ulimit -n') 2009.01.21 16:42:55 LOG6[462906:1]: poll() used - no FD_SETSIZE limit for file descriptors 2009.01.21 16:42:55 LOG5[462906:1]: 31999 clients allowed 2009.01.21 16:42:55 LOG7[462906:1]: FD 10 in non-blocking mode 2009.01.21 16:42:55 LOG7[462906:1]: FD 11 in non-blocking mode 2009.01.21 16:42:55 LOG7[462906:1]: FD 12 in non-blocking mode 2009.01.21 16:42:55 LOG7[462906:1]: SO_REUSEADDR option set on accept socket 2009.01.21 16:42:55 LOG7[462906:1]: tssl bound to 0.0.0.0:992 2009.01.21 16:42:55 LOG7[540758:1]: No pid file being created 2009.01.21 16:43:17 LOG7[540758:1]: tssl accepted FD=0 from x.x.x.x:3532 2009.01.21 16:43:17 LOG7[540758:258]: tssl started 2009.01.21 16:43:17 LOG7[540758:258]: FD 0 in non-blocking mode 2009.01.21 16:43:17 LOG7[540758:258]: Waiting for a libwrap process 2009.01.21 16:43:17 LOG7[540758:258]: Acquired libwrap process #0 2009.01.21 16:43:17 LOG7[540758:258]: Releasing libwrap process #0 2009.01.21 16:43:17 LOG7[540758:258]: Released libwrap process #0 2009.01.21 16:43:17 LOG7[540758:258]: tssl permitted by libwrap from x.x.x.x:3532 2009.01.21 16:43:17 LOG5[540758:258]: tssl accepted connection from x.x.x.x:3532 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): before/accept initialization 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 read client hello A 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 write server hello A 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 write certificate A 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 write server done A 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 flush data 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 read client key exchange A 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 read finished A 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 write change cipher spec A 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 write finished A 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 flush data 2009.01.21 16:43:17 LOG7[540758:258]: 1 items in the session cache 2009.01.21 16:43:17 LOG7[540758:258]: 0 client connects (SSL_connect()) 2009.01.21 16:43:17 LOG7[540758:258]: 0 client connects that finished 2009.01.21 16:43:17 LOG7[540758:258]: 0 client renegotiations requested 2009.01.21 16:43:17 LOG7[540758:258]: 1 server connects (SSL_accept()) 2009.01.21 16:43:17 LOG7[540758:258]: 1 server connects that finished 2009.01.21 16:43:17 LOG7[540758:258]: 0 server renegotiations requested 2009.01.21 16:43:17 LOG7[540758:258]: 0 session cache hits 2009.01.21 16:43:17 LOG7[540758:258]: 0 session cache misses 2009.01.21 16:43:17 LOG7[540758:258]: 0 session cache timeouts 2009.01.21 16:43:17 LOG6[540758:258]: SSL accepted: new session negotiated 2009.01.21 16:43:17 LOG6[540758:258]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2009.01.21 16:43:17 LOG7[540758:258]: bind#1: Invalid argument (22) 2009.01.21 16:43:17 LOG7[540758:258]: bind#2: Invalid argument (22) 2009.01.21 16:43:17 LOG6[540758:258]: Local mode child started (PID=639170) 2009.01.21 16:43:17 LOG7[540758:258]: Remote FD=13 initialized 2009.01.21 16:43:34 LOG7[540758:258]: Socket closed on read 2009.01.21 16:43:34 LOG7[540758:258]: SSL write shutdown 2009.01.21 16:43:34 LOG7[540758:258]: SSL alert (write): warning: close notify 2009.01.21 16:43:34 LOG6[540758:258]: SSL socket closed on SSL_shutdown 2009.01.21 16:43:34 LOG7[540758:258]: Socket write shutdown 2009.01.21 16:43:34 LOG5[540758:258]: Connection closed: 8360 bytes sent to SSL, 101 bytes sent to socket 2009.01.21 16:43:34 LOG7[540758:258]: tssl finished (0 left) ------- Your help will be appreciate... Thank you. ________________________________ Tom Spence AIX Sys Adm ABIDES System Support 844th CS/SCBX Pentagon - MD822

3 10

Use stunnel through firewall for home Web server?
by Bill Eldridge 25 Jan '09

25 Jan '09

I was interested in whether there's a simple way to have stunnel redirect traffic from a public Web browser/port to my home Web browser behind my DSL firewall (no ports opened/forwarded for incoming connections on the router, only outgoing-initiated) I scanned old posts but didn't find anything that quite fit - references are usually for people who want to get out from behind a firewall, not publish sites publicly from behind (i.e. externally initiated clicks)

4 12

Compilation problem
by fredzy padzy 21 Jan '09

21 Jan '09

Hi everyone I try to compile stunnel, but it fails. Actually, it tells me about a parse error inside signal.h, and i think it's a falsePositive. The configure works great and nothing look strange inside the configure.log. I also tried to googled those errors, but didn't find any clues. My server is a sunOS 10 and the src were taken from http://www.stunnel.org/download/stunnel/src/stunnel-4.26.tar.gz My version of openssl : OpenSSL 0.9.7.d Here are the errors, after the make command : /stunnel-4.26 root# make Making all in src make[1]: Entering directory `/root/syslogNG/stunnel-4.26/src' if gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.26\" -DPACKAGE_STRING=\"stunnel\ 4.26\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.26\" -DHOST=\"i386-pc-solaris2.10\" -DCPU_I386=1 -DVENDOR_PC=1 -DOS_SOLARIS2_10=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_SYS_FILIO_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_LIBSOCKET=1 -DHAVE_LIBDL=1 -DHAVE_LIBZ=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_GETCONTEXT=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/usr/local/ssl\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/var/run/stunnel/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/local/ssl/include -MT file.o -MD -MP -MF ".deps/file.Tpo" -c -o file.o file.c; \ then mv -f ".deps/file.Tpo" ".deps/file.Po"; else rm -f ".deps/file.Tpo"; exit 1; fi *In file included from /usr/include/sys/signal.h:34,* from /usr/include/signal.h:26, from common.h:250, from file.c:38: /usr/include/sys/siginfo.h:259: error: parse error before "ctid_t" /usr/include/sys/siginfo.h:292: error: parse error before '}' token /usr/include/sys/siginfo.h:294: error: parse error before '}' token /usr/include/sys/siginfo.h:390: error: parse error before "ctid_t" /usr/include/sys/siginfo.h:392: error: conflicting types for `__proc' /usr/include/sys/siginfo.h:261: error: previous declaration of `__proc' /usr/include/sys/siginfo.h:398: error: conflicting types for `__fault' /usr/include/sys/siginfo.h:267: error: previous declaration of `__fault' /usr/include/sys/siginfo.h:404: error: conflicting types for `__file' /usr/include/sys/siginfo.h:273: error: previous declaration of `__file' /usr/include/sys/siginfo.h:420: error: conflicting types for `__prof' /usr/include/sys/siginfo.h:287: error: previous declaration of `__prof' /usr/include/sys/siginfo.h:424: error: conflicting types for `__rctl' /usr/include/sys/siginfo.h:291: error: previous declaration of `__rctl' /usr/include/sys/siginfo.h:426: error: parse error before '}' token /usr/include/sys/siginfo.h:428: error: parse error before '}' token /usr/include/sys/siginfo.h:432: error: parse error before "k_siginfo_t" /usr/include/sys/siginfo.h:437: error: parse error before '}' token In file included from /usr/include/signal.h:26, from common.h:250, from file.c:38: /usr/include/sys/signal.h:85: error: parse error before "siginfo_t" In file included from common.h:250, from file.c:38: /usr/include/signal.h:111: error: parse error before "siginfo_t" /usr/include/signal.h:113: error: parse error before "siginfo_t" In file included from common.h:251, from file.c:38: /usr/include/sys/wait.h:86: error: parse error before "siginfo_t" make[1]: *** [file.o] Error 1 make[1]: Leaving directory `/root/syslogNG/stunnel-4.26/src' make: *** [all-recursive] Error 1 Is that normal that i've 2 signal.h files ?

1 0

Re: [stunnel-users] ftp to sftp
by Michael Renner 18 Jan '09

18 Jan '09

On Friday 16 January 2009, aaa aaa wrote: > Hello, Moin, > I am using last edition of stunnel. I would like to use my favourite ftp > client and connect to sftp. But my ftp clinet don't allow this so I would > like to use stunnel if possible. How should I configure stunnel to do this > (ports etc.)? I am a newbie with stunnel but I am using it for sending > email for several weeks and everything works well. So I hope it is possible > to use it for sftp too. there are 2 'save' ftp enhancement: sftp and ftps. While 'sftp' means 'ftp over ssh' stand 'ftps' for 'ftp over ssl'. So stunnel is the wrong tool if you have to use ftps. Please check http://www.stunnel.org/examples/ftp.html for more information about stunnel and ftp. CU -- |Michael Renner E-mail: michael.renner(a)gmx.de | |D-81541 Munich Germany ICQ: #112280325 | |Germany Don't drink as root! ESC:wq

2 2

Re: [stunnel-users] ftp to sftp
by Justin Greene 16 Jan '09

16 Jan '09

I do not think that this can work. SFTP is not just encrypted FTP traffic, but an entirely different protocol. Justin ________________________________ From: aaa aaa [mailto:[email protected]] Sent: Friday, January 16, 2009 7:58 AM To: stunnel-users(a)mirt.net Subject: ftp to sftp Hello, I am using last edition of stunnel. I would like to use my favourite ftp client and connect to sftp. But my ftp clinet don't allow this so I would like to use stunnel if possible. How should I configure stunnel to do this (ports etc.)? I am a newbie with stunnel but I am using it for sending email for several weeks and everything works well. So I hope it is possible to use it for sftp too. Any help much appreciated. thanks in advance. ----------

1 0

0x09 bytes in stunnel-4.26/src/Makefile.am
by Andrew Schulman 14 Jan '09

14 Jan '09

For some strange reason, there are five hex 09 bytes in stunnel-4.26/src/Makefile.am. This broke my Cygwin build: I remove the Windows-only stuff from this file for Cygwin, and diff captured the 0x09 characters that got removed, but then when I later tried to apply the patch, patch choked on them. It seems that each of these bytes should really be 0x0A. Strange. Andrew.

2 2

Re: [stunnel-users] How do I do a one-time client connection?
by D. Richard Hipp 13 Jan '09

13 Jan '09

On Jan 13, 2009, at 11:07 AM, Karl J. Runge wrote: > On Tue, 13 Jan 2009, "D. Richard Hipp" <drh(a)hwaci.com> wrote: >> >> I'm sure I could get something like that to work on Unix. >> Unfortunately, I need a cross-platform solution:; unix & windows. >> And >> (as usual) the windows side is harder to work around. >> >> What I really need to do is send a known amount of binary data in a >> file over an SSL connection to a remote machine, then get back the >> reply of unknown length into a separate file: >> >> stunnel test.conf <test.in >test.out >> >> I'm open to any suggestions on how to do this, (such that it will >> work >> on unix and windows). > > So it is not an https URL like in your example? If it were, perhaps > wget or curl for windows would be a better path than stunnel. I'm using a simple web-page fetch for debugging. In actual use, the situation is more complicated and wget and curl won't work. Thx for the suggestion, though. > > > socat might be ported to windows, I'm not sure. If writing a small C > wrapper program for Windows is not acceptable, I'm not sure what you > can do. socat appears to be linux-mostly. (They have a MacOS-X port, which suggests that it is not even "unix" neutral.) So I'm guessing that windows is out of the question there. Looks like I'm just going to have to bite the bullet and link against OpenSSL directly..... > > > > BTW, I have made a one-time connection patch to stunnel that I use > with > my VNC tool SSVNC: > > http://libvncserver.cvs.sourceforge.net/viewvc/libvncserver/libvncserver/x1… > > It is a hack, but useful. My VNC tool works OK with stock stunnel > (everything else equal I prefer using), but I also distribute a > patched > stunnel for more reliable behavior in this one-time client connect > mode. > > Karl > D. Richard Hipp drh(a)hwaci.com

2 1

Re: [stunnel-users] How do I do a one-time client connection?
by stunnel-hm＠karlrunge.com 13 Jan '09

13 Jan '09

On Tue, 13 Jan 2009, "D. Richard Hipp" <drh(a)hwaci.com> wrote: > > Apparently stunnel will work as a pipe if I create a config file like > this: > > client=yes > connect=remosthost:port > > Then run stunnel and talk over standard input and standard output. One problem I have found in doing this is that if socketpair(2) is used to create the file descriptor that will be connected to stunnel's stdio, then stunnel's libwrap checking is activated because it detects it to be a socket. Using socketpair is a nice way to turn a TCP client into one that connects via a two-way pipe with stunnel (because the client app doesn't have to special case the two file descriptors for stunnel's stdin and stdout when reading and writing.) Since a user (i.e. not a sysadmin) has no control over the libwrap settings in /etc, stunnel's libwrap check will always fail when used this way. In my opinion, stunnel should allow disabling of libwrap (and syslog too) via the config file (i.e. not just compile time options). This makes the "one connection" client usage you describe work better. Karl

1 0

Re: [stunnel-users] How do I do a one-time client connection?
by D. Richard Hipp 13 Jan '09

13 Jan '09

Perhaps I spoke too soon about having solved my own problem. Suppose I have a configuration file (test.conf) like this: client=yes connect=www.fossil-scm.org:443 Then if I run: stunnel test.conf And I type "GET / HTTP/1.0" on standard input, the webpage comes back on standard output. So far so good. But if I do: stunnel test.conf <test.in >test.out Where file test.in contains the "GET / HTTP/1.0" test, I get nothing back! I also tried this: cat test.in | stunnel test.conf And various combinations of this: openssl s_client -connect www.fossil-scm.org:443 <test.in In every case, when I type the GET line on standard input it works. When I redirect from a file it does not. Any hints on the cause of the very unexpected and very mysterious behavior? D. Richard Hipp drh(a)hwaci.com

1 0

How do I do a one-time client connection?
by D. Richard Hipp 13 Jan '09

13 Jan '09

I'd like to invoke stunnel to handle a single SSL client-side connection (talking to an SSL server) with the assurance that the stunnel quit will automatically quit after that one connection closes. I did not see any options to support this. Did I overlook something, or is stunnel just not able to do this? D. Richard Hipp drh(a)hwaci.com

1 1

public domain [PATCH] to stunnel 4.27b1 for Windows CE / Windows Mobile compilation and unicode bug fixes
by Pierre DELAAGE 10 Jan '09

10 Jan '09

Dear Sir, Please find enclosed a patch in "diff -cr orig work" format, applying to stunnel4.27b1 as found here ftp://stunnel.mirt.net/stunnel/. This patch maily addresses compilation and unicode issues for Windows CE targets. I use MS EVC 4sp2 compiler with WCE 420 SDK, on a vista host platform. Once debugged the code works fine on WM5 and WM6 HTC smartphones. It needs a windows CE openssl lib (I logged a patch to openssl snap 20090102 because it has some compilation issues on windows CE platform). * For the sake of completeness openssl 098i and 098j (latest) must be ALSO patched to compile for wince, with this patch I submitted to openssl team : http://marc.info/?l=openssl-dev&m=123099015013538&w=2 The present stunnel patch addresses the following issues : 1/ COMPILATION FAILURE : on common.h "EINVAL redefinition" : in fact the compile options WX (see evc.mak) does not tolerate any warning : to avoid a warning on EINVAL redef, we must protect this undef by ifdef. Note that there is still a problem : if the symbol is NOT defined at all, it will NEVER be defined by that revised code : this is because the compiler always generate an error if it sees something like : #ifdef EINVAL #undef EINVAL #define EINVAL WSAEINVAL #else #define EINVAL WSAEINVAL #endif because it seems to not like two defines even separated by a else. Just putting the #define outside of a block dealing with undef, does not solve the compilation issue. 2/ COMPILATION FAILURE : related to wcecompat/setjmp.h SOLUTION : in evc.mak, needed /D ARM to compile with wcecompat/setjmp.h. This symbol is not documented in MSDN but clearly present is header files. Moreover It is consistent with other processor symbols described in the sdk. 3/ COMPILATION FAILURE : related to gui.c pb with undeclared hmainmenu identifier, because "endif use_win32" misplaced. 3/ RC COMPILATION FAILURE : related to resources.rc CAUSE : "VERSION" unknown SOLUTION : /dversion in rflags in evc.mak 4/ LINK ERROR : fatal error LNK1181: cannot open input file 'libeay32.lib' cause : bad path name in evc.mak for openssl lib. since openssl >> 098a (eg 098h) "out32dll" folder is named "out32dll_targetCPU". 5/ LINK ERROR on gui.obj : error LNK2001: unresolved external symbol _beginthread _$(TARGETCPU) Cause : in sthreads.c, misplaced "#endif os2" Note : corrected various erroneous comments on #if endif in sthreads.c ************* OPERATIONAL ERRORS (at run-time) using stunnel to enable certificate based authentication for POPS/SMPTPS between a smartphone and a linux server, I faced this problems : When first trying to authenticate a dlgbox is displayed on the smartphone to input the password of the private key protecting the client certificate: 6/ RUN-TIME ERROR : "squares" displayed instead of chars in "password input dialog box" titlebar Well, this is only a cosmetic issue, but this is still an issue. Cause : this is a typical unicode issue in gui.c pass_proc/wm_initdialog : the sendmessage to display the title uses a concatenation of two strings : a constant extracted from the resource file, and converted to wchar by TEXT macro in unicode context, and a key file name given by ui_data->section->key. The problem is that the file name is always of type 8bit char, leading to concatenation "scrambling" when concatenated with a unicode string. SOLUTION : it seems not possible to change the type of ui_data->section->key to tchar/wchar because it is used in various ansi code. So the simplest way to correct this pb is just to make a local conversion from ansi to tchar in gui.c/pass_proc/initdialog 7/ RUN-TIME ERROR : It is impossible to validate a password on a private key protecting a certificate: The password is ALWAYS rejected (after many tests with 3 retries). Cause : the password is input as unicode (because the message EM_GETLINE on the control IDE_PASSEDIT is unicode ready) but stored and managed as an ansi string so the password can never be validated. NOTE : contrary to the documentation of windows CE sdk, the EM_GETLINE msg IS REALLY unicode ready. Indeed this is also the case in classic win32 sdk for PC platform (described in the msdn library). SOLUTION : the input password must be converted to ansi before being validated vs openssl 2009.01.05 13:00:01 LOG3[4849170:5712826]: Wrong pass phrase: retrying 2009.01.05 13:00:05 LOG3[4849170:5712826]: error stack: 140B3009 : error:140B3009:SSL routines:SSL_CTX_use_RSAPrivateKey_file:PEM lib 2009.01.05 13:00:05 LOG3[4849170:5712826]: error stack: 906A065 : error:0906A065:PEM routines:PEM_do_header:bad decrypt 2009.01.05 13:00:05 LOG3[4849170:5712826]: SSL_CTX_use_RSAPrivateKey_file: 6065064: error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt 2009.01.05 13:00:05 LOG3[4849170:5712826]: Server is down I hope you will find this patch useful. Thank you for your excellent work, Yours sincerely and happy new year, Pierre Delaage Note : I use stunnel to establish a simple "vpn" between smartphones and a corporate linux server mainly for HTTPS/POPS/SMTPS support. Stunnel is very relevant in that matter, over solutions based on SSH (although we use also ssh), from a communication cost point of view : ssh establishes permanent socket between client and server, so that the communication is charged by the mobile network provider : and these charges are very expensive. On the contrary stunnel only establishes ssl sockets on demand so that financial charges are limited to strict necessary. Please note that stunnel brings "client based certificate authentication" to POP/SMTP mobile mail user agents which only supports SSL with server authentication, but NO client authentication, such as mobile outlook.Here again stunnel is very relevant. Note 2 : the unicode bug fixes should benefit also to the win32 stunnel version for PC. Note 3 : this mail has also been sent to webmaster(a)stunnel.org, but with no response at all. Only in work/src: client.obj diff -cr orig/src/common.h work/src/common.h *** orig/src/common.h 2008-09-01 08:06:24.000000000 +0200 --- work/src/common.h 2009-01-05 23:16:03.052680000 +0100 *************** *** 187,198 **** #define EINPROGRESS WSAEINPROGRESS #define EWOULDBLOCK WSAEWOULDBLOCK #define EISCONN WSAEISCONN ! #undef EINVAL #define EINVAL WSAEINVAL #include <process.h> /* _beginthread */ #include <tchar.h> #define NO_IDEA #define OPENSSL_NO_IDEA --- 187,204 ---- #define EINPROGRESS WSAEINPROGRESS #define EWOULDBLOCK WSAEWOULDBLOCK #define EISCONN WSAEISCONN ! ! #ifdef EINVAL // pdelaage, required to avoid compilation "error", see WX option in evc.mak and ms-evc420 compiler ! #undef EINVAL // TODO : if einval is not defined, this code does not define it; but putting a #define in an #else leads again to compilation error! #define EINVAL WSAEINVAL + #endif + #include <process.h> /* _beginthread */ #include <tchar.h> + + #define NO_IDEA #define OPENSSL_NO_IDEA Only in work/src: ctx.obj diff -cr orig/src/evc.mak work/src/evc.mak *** orig/src/evc.mak 2008-09-20 22:23:21.000000000 +0200 --- work/src/evc.mak 2009-01-04 10:09:32.439894500 +0100 *************** *** 1,23 **** # wce.mak for stunnel.exe by Michal Trojnara 2006 # ! WCEVER=300 # Modify this to point to your actual openssl compile directory # (You did already compile openssl, didn't you???) ! SSLDIR=..\..\build\openssl-0.9.8i ! COMPATDIR=..\..\build\wcecompat CEUTILSDIR=..\..\ceutils DSTDIR=ce:\stunnel - SDKDIR=C:\Windows CE Tools\wce$(WCEVER)\Pocket PC 2002 ! INCLUDES=-I$(SSLDIR)/inc32 -I$(COMPATDIR)\include -I"$(SDKDIR)\include" LIBS=libeay32.lib ssleay32.lib wcecompatex.lib winsock.lib ! CC=CL$(TARGETCPU) ! CFLAGS=/nologo /MC /O1i /W3 /WX /GF /Gy /DHOST=\"$(TARGETCPU)-WCE-eVC-$(WCEVER)\" /D$(TARGETCPU) /DUNDER_CE=$(WCEVER) /D_WIN32_WCE=$(WCEVER) /DUNICODE -D_UNICODE $(INCLUDES) ! RFLAGS=$(INCLUDES) ! LDFLAGS=/nologo /subsystem:windowsce,3.00 /machine:ARM /libpath:"$(SDKDIR)\lib\$(TARGETCPU)" /libpath:"$(COMPATDIR)\lib" /libpath:"$(SSLDIR)\out32dll" OBJS=stunnel.obj ssl.obj ctx.obj verify.obj file.obj client.obj protocol.obj sthreads.obj log.obj options.obj network.obj resolver.obj GUIOBJS=gui.obj resources.res --- 1,35 ---- # wce.mak for stunnel.exe by Michal Trojnara 2006 # ! WCEVER=420 ! # pdelaage : following flag required by (eg) winnt.h, and is different from targetcpu (armV4) ! WCETARGETCPU=ARM # Modify this to point to your actual openssl compile directory # (You did already compile openssl, didn't you???) ! SSLDIR=C:\Users\standard\Documents\Dvts\Contrib\openssl\openssl-0.9.8-stable-SNAP-20090102\openssl-0.9.8-stable-SNAP-20090102 ! COMPATDIR=C:\Users\standard\Documents\Dvts\openssl\build\wcecompat ! # pdelaage : ceutilsdir probably useless CEUTILSDIR=..\..\ceutils + # pdelaage "ce:" is not a correct location , but we never "make install" DSTDIR=ce:\stunnel ! SDKDIR="C:\Progra~1\Micros~2\wce$(WCEVER)\standardsdk" ! ! # pdelaage eroneous path for sdkdir INCLUDES=-I$(SSLDIR)/inc32 -I$(COMPATDIR)\include -I"$(SDKDIR)\include" ! INCLUDES=-I$(SSLDIR)\inc32 -I$(COMPATDIR)\include -I"$(SDKDIR)\include\$(TARGETCPU)" LIBS=libeay32.lib ssleay32.lib wcecompatex.lib winsock.lib ! # not correct because for armv4 cc is just clarm.exe. Moreover cc is already set in the ms wce$TARGETCPU.bat script, so it is not necessary to set it up here ! # CC=CL$(TARGETCPU) ! ! VERSION=4.27 ! DEFINES=/DVERSION=\"$(VERSION)\" ! # pdelaage added wcetargetcpu to cflags ! CFLAGS=/nologo /MC /O1i /W3 /WX /GF /Gy $(DEFINES) /DHOST=\"$(TARGETCPU)-WCE-eVC-$(WCEVER)\" /D$(WCETARGETCPU) /D$(TARGETCPU) /DUNDER_CE=$(WCEVER) /D_WIN32_WCE=$(WCEVER) /DUNICODE -D_UNICODE $(INCLUDES) ! RFLAGS=/DVERSION=\"$(VERSION)\" $(INCLUDES) ! # pdelaage : LDFLAGS: since openssl >> 098a (eg 098h) out32dll is out32dll_targetCPU ! LDFLAGS=/nologo /subsystem:windowsce,3.00 /machine:ARM /libpath:"$(SDKDIR)\lib\$(TARGETCPU)" /libpath:"$(COMPATDIR)\lib" /libpath:"$(SSLDIR)\out32dll_$(TARGETCPU)" OBJS=stunnel.obj ssl.obj ctx.obj verify.obj file.obj client.obj protocol.obj sthreads.obj log.obj options.obj network.obj resolver.obj GUIOBJS=gui.obj resources.res Only in work/src: file.obj diff -cr orig/src/gui.c work/src/gui.c *** orig/src/gui.c 2008-05-02 08:23:03.000000000 +0200 --- work/src/gui.c 2009-01-04 23:45:07.451820500 +0100 *************** *** 320,329 **** hwnd=CreateWindow(classname, win32_name, WS_TILEDWINDOW, CW_USEDEFAULT, CW_USEDEFAULT, CW_USEDEFAULT, CW_USEDEFAULT, NULL, hmainmenu, hInstance, NULL); ! #endif if(cmdline.service) /* do not allow to save file in the service mode */ EnableMenuItem(hmainmenu, IDM_SAVEAS, MF_GRAYED); if(error_mode) /* log window is hidden by default */ set_visible(1); --- 320,330 ---- hwnd=CreateWindow(classname, win32_name, WS_TILEDWINDOW, CW_USEDEFAULT, CW_USEDEFAULT, CW_USEDEFAULT, CW_USEDEFAULT, NULL, hmainmenu, hInstance, NULL); ! // commented by pdelaage on 20090104 #endif if(cmdline.service) /* do not allow to save file in the service mode */ EnableMenuItem(hmainmenu, IDM_SAVEAS, MF_GRAYED); + #endif // added by pdelaage on 20090104 if(error_mode) /* log window is hidden by default */ set_visible(1); *************** *** 523,536 **** WPARAM wParam, LPARAM lParam) { TCHAR titlebar[STRLEN]; WORD cchPassword; switch (message) { case WM_INITDIALOG: /* Set the default push button to "Cancel." */ SendMessage(hDlg, DM_SETDEFID, (WPARAM) IDCANCEL, (LPARAM) 0); _sntprintf(titlebar, STRLEN, TEXT("Private key: %s"), ! ui_data->section->key); SetWindowText(hDlg, titlebar); return TRUE; --- 524,548 ---- WPARAM wParam, LPARAM lParam) { TCHAR titlebar[STRLEN]; WORD cchPassword; + LPTSTR keyFileName;// added by pdelaage on 20090104 + TCHAR sPassword[PEM_BUFSIZE];// added by pdelaage on 20090104 + char* cPassword;// added by pdelaage on 20090104 switch (message) { case WM_INITDIALOG: /* Set the default push button to "Cancel." */ SendMessage(hDlg, DM_SETDEFID, (WPARAM) IDCANCEL, (LPARAM) 0); + // pdelaage on 20090104: here was a bug : _sntprintf is unicode ready but ui_data->section->key is always char. + // commented by pdelaage on 20090104 _sntprintf(titlebar, STRLEN, TEXT("Private key: %s"), + // ui_data->section->key); + + keyFileName = str2tstr(ui_data->section->key); _sntprintf(titlebar, STRLEN, TEXT("Private key: %s"), ! keyFileName); ! free(keyFileName); ! ! SetWindowText(hDlg, titlebar); return TRUE; *************** *** 549,561 **** } /* Put the number of characters into first word of buffer. */ ! *((LPWORD)ui_data->pass) = cchPassword; /* Get the characters. */ SendDlgItemMessage(hDlg, IDE_PASSEDIT, EM_GETLINE, ! (WPARAM) 0, /* line 0 */ (LPARAM) ui_data->pass); ! ui_data->pass[cchPassword] = 0; /* Null-terminate the string. */ EndDialog(hDlg, TRUE); return TRUE; --- 561,580 ---- } /* Put the number of characters into first word of buffer. */ ! *((LPWORD) sPassword) = cchPassword; /* Get the characters. */ SendDlgItemMessage(hDlg, IDE_PASSEDIT, EM_GETLINE, ! (WPARAM) 0, /* line 0 */ (LPARAM) sPassword);// pdelaage ui_data->pass); ! ! sPassword[cchPassword] = 0; /* Null-terminate the string. */ ! ! // convert input password to ANSI string (as ui_data->pass) ! cPassword = tstr2str(sPassword); ! strcpy(ui_data->pass, cPassword); ! free(cPassword); ! EndDialog(hDlg, TRUE); return TRUE; Only in work/src: gui.obj Only in work/src: log.obj diff -cr orig/src/makece.bat work/src/makece.bat *** orig/src/makece.bat 2005-12-23 20:57:24.000000000 +0100 --- work/src/makece.bat 2009-01-03 19:31:34.507379500 +0100 *************** *** 1,3 **** @echo off ! call "C:\Program Files\Microsoft eMbedded Tools\EVC\WCE300\BIN\WCEARM.BAT" nmake /NOLOGO -f evc.mak %1 %2 %3 %4 %5 %6 %7 %8 %9 --- 1,4 ---- @echo off ! ::call "C:\Program Files\Microsoft eMbedded Tools\EVC\WCE300\BIN\WCEARM.BAT" ! call "C:\Progra~1\MSEVC4\EVC\WCE420\BIN\WCEARMV4.BAT" nmake /NOLOGO -f evc.mak %1 %2 %3 %4 %5 %6 %7 %8 %9 Only in work/src: network.obj Only in work/src: nogui.obj Only in work/src: options.obj Only in work/src: protocol.obj Only in work/src: resolver.obj Only in work/src: resources.RES Only in work/src: ssl.obj diff -cr orig/src/sthreads.c work/src/sthreads.c *** orig/src/sthreads.c 2008-09-21 21:44:06.000000000 +0200 --- work/src/sthreads.c 2009-01-04 10:46:46.285200500 +0100 *************** *** 400,406 **** return 0; } ! #endif #ifdef USE_OS2 --- 400,406 ---- return 0; } ! #endif /* cmt added by pdelaage on 20090104 : USE_WIN32 */ #ifdef USE_OS2 *************** *** 437,442 **** --- 437,444 ---- return 0; } + #endif /* USE_OS2 */ // added by pdelaage on 20090104 + #ifdef _WIN32_WCE int _beginthread(void (*start_address)(void *), *************** *** 456,464 **** ExitThread(0); } ! #endif /* !defined(_WIN32_WCE) */ ! #endif /* USE_WIN32 */ #ifdef DEBUG_STACK_SIZE --- 458,467 ---- ExitThread(0); } ! #endif /* _WIN32_WCE */ /* pdelaage 20090104, following cmt is improper: !defined(_WIN32_WCE) */ ! // pdelaage 20090104 : following endif is misplaced, the endif usewin32 is already placed upper, but this endif relates ! // to os2, and is misplaced because it "squeezes" winCE code #endif /* USE_WIN32 */ #ifdef DEBUG_STACK_SIZE Only in work/src: sthreads.obj Files orig/src/stunnel.exe and work/src/stunnel.exe differ Only in work/src: stunnel.obj Only in work/src: tstunnel.exe Only in work/src: verify.obj

1 0

Re: [stunnel-users] Distinguished Name (DN) is a cleartext network communication?
by Christophe Nanteuil 09 Jan '09

09 Jan '09

2009/1/8 Michael Renner <michael.renner(a)gmx.de>: > A server should appear like a a 'normal' https webserver to others. More or > less interesting, or just a 404 error message. However: it should appear > harmless to others, just like a webserver. > Behind this should work a proxy server (squid). Only authorized users should > be able to use it. > If I understand well what you want to do, I think my patch "Identification Propagation patch using stunnel client certificates" can be useful : - Use my stunnel patch Using squid as a proxy : - In stunnel config file : select pertinent fields of the certiificate : DN -> identFields=1023 - Get a squid version compiled with --enable-ident-lookups option - In squid : use a home-made external authentification program which returns ok if the DN provided is good. Squid documentation will tell you what is the need for the home-made authentification program. I think it's easier with DansGuardian proxy : - In stunnel config file : select pertinent fields of the certiificate : only Issuer_CN -> identFields=32 - in /etc/dansguardian/dansguardian.conf, create 2 groups : filtergroups = 2 filtergroupslist = '/etc/dansguardian/lists/filtergroupslist' - create filter groups in /etc/dansguardian/lists/filtergroupslist. (All not matching users will go in group 1) : put a line like "your issuer CN equals 2" - in /etc/dansguardian/dansguardianf1.conf, put "groupmode=0" , ie banned - in /etc/dansguardian/dansguardianf2.conf, put "groupmode=2" , ie non filtered Note that the authentification of the users is done by stunnel. Stunnel forwards the identification to the proxy which does not need to authenticate since it was done by stunnel. If the ident provided by my patch is not convenient, you can modify it to match your needs. Hope this helps -- Christophe Nanteuil

1 0

Re: [stunnel-users] Distinguished Name (DN) is a cleartext network communication?
by Tobias Dussa 09 Jan '09

09 Jan '09

Hi, [...] > But this setup is senseless, since the DN is readable with a network sniffer. > It does not appear harmless any longer after a closer look into the network > traffic. But it have to. > Now, I need an other idea to implement such s service. One easy solution that comes to mind is to deploy an outer SSL tunnel for privacy and then set up an inner SSL tunnel for traffic separation. However, I think this would require stunnel on the client side as well, at least for legitimate users. Cheers, Toby. -- begin LOVE-LETTER-FOR-YOU.txt.vbs I am a signature virus. Distribute me until the bitter end http://piology.org/ILOVEYOU-Signature-FAQ.html

1 0

Stunnel (v4.26) Running, Working, but Sometimes Aborting
by Jeff Salisbury 09 Jan '09

09 Jan '09

Greetings, We are new to stunnel. We've installed Stunnel v4.26 on a handful of Windows XP machines, and we can send and receive emails through the Stunnel configuration. These XP machines reboot automatically every night. Many mornings, when the user sits down and tries to initially send email, the email hangs and Stunnel aborts (or has already aborted). If the user runs stunnel again, our sending and receiving of email is restored and stunnel seems rock-solid for the rest of the day. Has anybody else had stability problems with Stunnel v4.26? Any suggestions? FYI, relevant configuration information is shown below: Best regards, Jeff ================================== 1) Instead of installing stunnel on each machine, we have copied the following files into a network folder available to everyone in our office: Q:\bin\stunnel\stunnel.exe Q:\bin\stunnel\Q:\ibeay32.dll Q:\bin\stunnel\libssl32.dll Q:\bin\stunnel\stunnel.conf 2) Everyone has a shortcut installed in their "Startup" folder to run Q:\bin\stunnel\stunnel.exe. 3) Here is our stunnel.conf file: # GLOBAL OPTIONS client = yes output = C:\Documents and Settings\All Users\Application Data\stunnel-log.txt debug = 0 taskbar = yes # SERVICE-LEVEL OPTIONS [pop3] accept=995 connect=mail.ourpop.com:995 [smtp] accept=465 connect=mail.oursmtp.com:465

1 0

Distinguished Name (DN) is a cleartext network communication?
by Michael Renner 07 Jan '09

07 Jan '09

Moin, I am confused. Trying to use the DN as a kind of password replacement I saw that the DN goes unencrypted through the network, while the traffic itself is encrypted of cause. Analysing the network packages with wireshark I get this: 100104083828Z0..1.0...U....DE1.0...U....Germany1.0 ..U....Munich1.0...U. ..vbox4php1.0...U....stunnel1.0...U....mars.mtr.mynet1$0"..*.H.. .....michael.renner(a)gmx.de0.."0 This is, more or less, the content of the DN. Is there a chance to encrypt this? My setup should work, no matter if a client certificate exists or not (also independent of the DN's content) . But the appliation behind stunnel (started by stunnel using the 'exec' statement) may behave dependent on the DN! Any chance? Thanks -- |Michael Renner E-mail: michael.renner(a)gmx.de | |D-81541 Munich Germany ICQ: #112280325 | |Germany Don't drink as root! ESC:wq

1 0

Stunnel New User
by David Aitchison 07 Jan '09

07 Jan '09

Hello, I have a potential use for Stunnel on a project I am working on. Excuse the perhaps very silly questions, this is all new to me. I have read through the manual, and understand that Stunnel can either be run from the command line ad-hoc or as an application using the stunnel.conf configuration file. If I have Stunnel running on the server, does this mean that all mails that leave that server will be SSL encrypted? I have a requirement to send mails out over SSL, but my application doesn't support that, it does support sending out over standard SMTP port 25, but I need it to use port 465? Thanks in advance, David Aitchison

3 2

Re: [stunnel-users] Problem with the client certificate
by Michael Renner 03 Jan '09

03 Jan '09

On Thursday 01 January 2009, Christophe Nanteuil wrote: > Well, > I think the problem comes from the CAfile, ie the cert used to verify the > other certs. This is right. I thought that the CA file is not essential with verify depths less than 2. It seems this was a mistake. This time (yes, I use tinyCA), I made and used client- and server certificates as well as the CA. Now it works. Thanks for your help! > To test, I think it is better to have only one section per file : > - your key (section ----BEGIN RSA PRIVATE KEY----- to ---END RSA...) in the > key file corresponding to key=file in config file. > - your certificate (section ----BEGIN CERTIFICATE ----- to ---END > CERTIFICATE...) in the cert file corresponding to cert=file in the config > file. > These files must exist for server and client since you want mutual > authentication. > For verifying the certificate, you need to put the client certificate > (autosigned) in the CAfile option of the server config file. > The same for the client : put the server certificate in the CAfile option > of the client config file. > > on the server, the command 'openssl verify -CAfile client_cert.pem > client_cert.pem' should return ok > on the client, the command 'openssl verify -CAfile server_cert.pem > server_cert.pem' should return ok. > It can seem stupid but, as you have self-signed certificate, the CAfile is > the cert file. > > If you use tinyCA, you can easily build your own CA with one CA cert and > several certs for clients or servers. Then, you would be able to have the > same CAfile on the client and on the server. > > I hope this is clear enough. If not, write me back. > > > > > 2008/12/31 Michael Renner <michael.renner(a)gmx.de> > > > On Tuesday 30 December 2008, you wrote: > > > Hello, > > > > Happy new year! > > > > > * are the permissions correct on your files : > > > - key must belong to the user and have 0600 status (read only by the > > > > user) > > > > > - cert must belong to the user. > > > > I think the permissions are OK. The file is owed by root and loaded at > > the start > > Wrote 1024 new random bytes to /root/.rnd > > RAND_status claims sufficient entropy for the PRNG > > PRNG seeded successfully > > Certificate: /etc/stunnel/stunnelclient.pem > > Certificate loaded > > Key file: /etc/stunnel/stunnelclient.pem > > Private key loaded > > SSL context initialized for service BreakOut > > > > > * Is the content of the cert file of this form > > > > > > -----BEGIN CERTIFICATE----- > > > certificate data here > > > -----END CERTIFICATE----- > > > ? > > > and the content of the key file this form > > > -----BEGIN RSA PRIVATE KEY----- > > > key datat here > > > -----END RSA PRIVATE KEY----- > > > > I made several files. According to > > http://www.stunnel.org/faq/certs.html#ToC5 > > I got a file with a certificate, a RSA Key and a DH section (I removed > > the password for the certificate). > > > > According to http://www.stunnel.org/examples/client_cert.html I got a > > different file: it has a certificate and a RSA section and between them > > an other section: > > > > rcnyy/AbS1YPkdggJSnw+fqzg/L/QvQB6GTT5KWJzd0= > > -----END RSA PRIVATE KEY----- > > Certificate: > > Data: > > Version: 3 (0x2) > > Serial Number: 5 (0x5) > > Signature Algorithm: sha1WithRSAEncryption > > Issuer: C=DE, ST=Germany, L=Munich, O=vbox4php, OU=Rektorat, > > CN=DE/emailAddress=michael.renner(a)gmx.de > > Validity > > Not Before: Dec 28 20:37:19 2008 GMT > > Not After : Dec 28 20:37:19 2009 GMT > > Subject: C=DE, ST=Germany, O=vbox4php, OU=stunnel, > > CN=boulder.vbox4php.org/[email protected] > > Subject Public Key Info: > > Public Key Algorithm: rsaEncryption > > RSA Public Key: (1024 bit) > > Modulus (1024 bit): > > 00:b1:05:47:7a:27:4f:19:2b:18:72:e3:3c:f6:a6: > > . > > . > > 2b:55:2d:c9:dc:96:55:14:bb > > Exponent: 65537 (0x10001) > > X509v3 extensions: > > X509v3 Basic Constraints: > > CA:FALSE > > Netscape Cert Type: > > SSL Server > > Netscape Comment: > > TinyCA Generated Certificate > > X509v3 Subject Key Identifier: > > > > 86:F6:1F:71:29:AA:A5:61:DF:B2:81:F2:34:3A:A6:9E:58:C8:6A:5E X509v3 > > Authority Key Identifier: > > > > keyid:72:68:1A:0C:9D:E9:93:81:07:E9:36:71:75:33:05:C6:70:35:01:BF > > > > > > DirName:/C=DE/ST=Germany/L=Munich/O=vbox4php/OU=Rektorat/CN=DE/emailAddre > >ss= michael.renner(a)gmx.de > > serial:BC:97:82:4E:E3:9F:FE:5A > > > > X509v3 Issuer Alternative Name: > > email:[email protected] > > <email%3Amichael.renner(a)gmx.de> X509v3 Subject Alternative Name: > > email:[email protected] > > <email%3Amichael.renner(a)gmx.de> Signature Algorithm: > > sha1WithRSAEncryption > > 49:ef:06:aa:e5:71:b1:6e:23:87:02:9d:ce:56:e1:3b:77:5a: > > . > > . > > 41:93:92:ee:57:23:95:f3:99:62:27:6a:a4:b7:85:b4:92:86: > > 22:50:79:a0 > > -----BEGIN CERTIFICATE----- > > > > Anyhow: it fails: > > 2008.12.31 17:51:07 LOG4[13056:1073809760]: VERIFY ERROR: depth=0, > > error=unable to get local issuer > > certificate: /C=DE/ST=Germany/O=vbox4php/OU=stunnel/CN= > > boulder.vbox4php.org/[email protected] > > 2008.12.31 17:51:07 LOG3[13056:1073809760]: SSL_accept: 140890B2: > > error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate > > returned > > > > With strace I can see the the key and the cert is OK on the client side: > > (I assume that it is only read once): > > > > [pid 11829] open("/etc/stunnel/stunnelserver.pem", O_RDONLY) = 4 > > [pid 11829] fstat(4, {st_mode=S_IFREG|0600, st_size=5521, ...}) = 0 > > [pid 11829] mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE| > > MAP_ANONYMOUS, -1, 0) = 0x7f8f5f13b000 > > [pid 11829] read(4, "-----BEGIN RSA PRIVATE KEY-----\n"..., 4096) = 4096 > > [pid 11829] read(4, "VQQDEwJERTEkMCIGCSqGSIb3\nDQEJARY"..., 4096) = 1425 > > [pid 11829] read(4, "", 4096) = 0 > > [pid 11829] close(4) = 0 > > [pid 11829] munmap(0x7f8f5f13b000, 4096) = 0 > > [pid 11829] write(2, "2008.12.31 17:52:56 LOG7[11829:1"..., 682008.12.31 > > 17:52:56 LOG7[11829:140253752059616]: Certificate loaded > > ) = 68 > > [pid 11829] write(2, "2008.12.31 17:52:56 LOG7[11829:1"..., 902008.12.31 > > 17:52:56 LOG7[11829:140253752059616]: Key > > file: /etc/stunnel/stunnelserver.pem > > ) = 90 > > [pid 11829] open("/etc/stunnel/stunnelserver.pem", O_RDONLY) = 4 > > [pid 11829] fstat(4, {st_mode=S_IFREG|0600, st_size=5521, ...}) = 0 > > [pid 11829] mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE| > > MAP_ANONYMOUS, -1, 0) = 0x7f8f5f13b000 > > [pid 11829] read(4, "-----BEGIN RSA PRIVATE KEY-----\n"..., 4096) = 4096 > > [pid 11829] close(4) = 0 > > [pid 11829] munmap(0x7f8f5f13b000, 4096) = 0 > > [pid 11829] write(2, "2008.12.31 17:52:56 LOG7[11829:1"..., 682008.12.31 > > 17:52:56 LOG7[11829:140253752059616]: Private key loaded > > > > > > While I see in the clients logfile: > > SSL state (connect): SSLv3 flush data > > SSL alert (read): fatal: bad certificate > > SSL_connect: 14094412: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 > > alert > > bad certificate > > Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket > > > > > > Strange! > > > > > > One more hint? > > -- > > > > |Michael Renner E-mail: michael.renner(a)gmx.de | > > |D-81541 Munich Germany ICQ: #112280325 | > > |Germany Don't drink as root! ESC:wq -- |Michael Renner E-mail: michael.renner(a)gmx.de | |D-81541 Munich Germany ICQ: #112280325 | |Germany Don't drink as root! ESC:wq

1 0

hiding a proxy that appear like a web server?
by Michael Renner 03 Jan '09

03 Jan '09

Moin, I want to use stunnel (in conjunction with prtunnel) to reach my own proxy server out of a restricted network. The normal stunnel connection works so far without a problem. But I am looking for a possibility that this connection (reaching the endpoint of stunnel with my proxy server behind) appears like a normal webserver (maybe with just one simple index.html) to others. Any ideas? Thanks -- |Michael Renner E-mail: michael.renner(a)gmx.de | |D-81541 Munich Germany ICQ: #112280325 | |Germany Don't drink as root! ESC:wq

1 1

Re: [stunnel-users] Problem with the client certificate
by Michael Renner 31 Dec '08

31 Dec '08

On Tuesday 30 December 2008, you wrote: > Hello, Happy new year! > * are the permissions correct on your files : > - key must belong to the user and have 0600 status (read only by the user) > - cert must belong to the user. I think the permissions are OK. The file is owed by root and loaded at the start Wrote 1024 new random bytes to /root/.rnd RAND_status claims sufficient entropy for the PRNG PRNG seeded successfully Certificate: /etc/stunnel/stunnelclient.pem Certificate loaded Key file: /etc/stunnel/stunnelclient.pem Private key loaded SSL context initialized for service BreakOut > * Is the content of the cert file of this form > > -----BEGIN CERTIFICATE----- > certificate data here > -----END CERTIFICATE----- > ? > and the content of the key file this form > -----BEGIN RSA PRIVATE KEY----- > key datat here > -----END RSA PRIVATE KEY----- I made several files. According to http://www.stunnel.org/faq/certs.html#ToC5 I got a file with a certificate, a RSA Key and a DH section (I removed the password for the certificate). According to http://www.stunnel.org/examples/client_cert.html I got a different file: it has a certificate and a RSA section and between them an other section: rcnyy/AbS1YPkdggJSnw+fqzg/L/QvQB6GTT5KWJzd0= -----END RSA PRIVATE KEY----- Certificate: Data: Version: 3 (0x2) Serial Number: 5 (0x5) Signature Algorithm: sha1WithRSAEncryption Issuer: C=DE, ST=Germany, L=Munich, O=vbox4php, OU=Rektorat, CN=DE/emailAddress=michael.renner(a)gmx.de Validity Not Before: Dec 28 20:37:19 2008 GMT Not After : Dec 28 20:37:19 2009 GMT Subject: C=DE, ST=Germany, O=vbox4php, OU=stunnel, CN=boulder.vbox4php.org/[email protected] Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): 00:b1:05:47:7a:27:4f:19:2b:18:72:e3:3c:f6:a6: . . 2b:55:2d:c9:dc:96:55:14:bb Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Cert Type: SSL Server Netscape Comment: TinyCA Generated Certificate X509v3 Subject Key Identifier: 86:F6:1F:71:29:AA:A5:61:DF:B2:81:F2:34:3A:A6:9E:58:C8:6A:5E X509v3 Authority Key Identifier: keyid:72:68:1A:0C:9D:E9:93:81:07:E9:36:71:75:33:05:C6:70:35:01:BF DirName:/C=DE/ST=Germany/L=Munich/O=vbox4php/OU=Rektorat/CN=DE/[email protected] serial:BC:97:82:4E:E3:9F:FE:5A X509v3 Issuer Alternative Name: email:[email protected] X509v3 Subject Alternative Name: email:[email protected] Signature Algorithm: sha1WithRSAEncryption 49:ef:06:aa:e5:71:b1:6e:23:87:02:9d:ce:56:e1:3b:77:5a: . . 41:93:92:ee:57:23:95:f3:99:62:27:6a:a4:b7:85:b4:92:86: 22:50:79:a0 -----BEGIN CERTIFICATE----- Anyhow: it fails: 2008.12.31 17:51:07 LOG4[13056:1073809760]: VERIFY ERROR: depth=0, error=unable to get local issuer certificate: /C=DE/ST=Germany/O=vbox4php/OU=stunnel/CN=boulder.vbox4php.org/emailAddress=michael.renner(a)gmx.de 2008.12.31 17:51:07 LOG3[13056:1073809760]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned With strace I can see the the key and the cert is OK on the client side: (I assume that it is only read once): [pid 11829] open("/etc/stunnel/stunnelserver.pem", O_RDONLY) = 4 [pid 11829] fstat(4, {st_mode=S_IFREG|0600, st_size=5521, ...}) = 0 [pid 11829] mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE| MAP_ANONYMOUS, -1, 0) = 0x7f8f5f13b000 [pid 11829] read(4, "-----BEGIN RSA PRIVATE KEY-----\n"..., 4096) = 4096 [pid 11829] read(4, "VQQDEwJERTEkMCIGCSqGSIb3\nDQEJARY"..., 4096) = 1425 [pid 11829] read(4, "", 4096) = 0 [pid 11829] close(4) = 0 [pid 11829] munmap(0x7f8f5f13b000, 4096) = 0 [pid 11829] write(2, "2008.12.31 17:52:56 LOG7[11829:1"..., 682008.12.31 17:52:56 LOG7[11829:140253752059616]: Certificate loaded ) = 68 [pid 11829] write(2, "2008.12.31 17:52:56 LOG7[11829:1"..., 902008.12.31 17:52:56 LOG7[11829:140253752059616]: Key file: /etc/stunnel/stunnelserver.pem ) = 90 [pid 11829] open("/etc/stunnel/stunnelserver.pem", O_RDONLY) = 4 [pid 11829] fstat(4, {st_mode=S_IFREG|0600, st_size=5521, ...}) = 0 [pid 11829] mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE| MAP_ANONYMOUS, -1, 0) = 0x7f8f5f13b000 [pid 11829] read(4, "-----BEGIN RSA PRIVATE KEY-----\n"..., 4096) = 4096 [pid 11829] close(4) = 0 [pid 11829] munmap(0x7f8f5f13b000, 4096) = 0 [pid 11829] write(2, "2008.12.31 17:52:56 LOG7[11829:1"..., 682008.12.31 17:52:56 LOG7[11829:140253752059616]: Private key loaded While I see in the clients logfile: SSL state (connect): SSLv3 flush data SSL alert (read): fatal: bad certificate SSL_connect: 14094412: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Strange! One more hint? -- |Michael Renner E-mail: michael.renner(a)gmx.de | |D-81541 Munich Germany ICQ: #112280325 | |Germany Don't drink as root! ESC:wq

1 1

Problem with the client certificate
by Michael Renner 27 Dec '08

27 Dec '08

Moin, it seems that I understood something wrong with stunnel client certificates. First of all: until now I run stunnel 4.18 and stunnel 4.21 with debian and kubuntu without client certificates (with success). I use it to reach a proprietary application through an untrusted network. Now, I want the clients to authenticate against the server. Therefor, as a quick and dirty test, I used the same stunnel.pem file at the server and at the client side. The configuration at the server side (where the application is waiting for connections, in this example it is just a script) looks like this: cert = /etc/stunnel/stunnel.pem #chroot = /var/run/stunnel/ pid = /tmp/stunnel.pid setuid = nobody setgid = nogroup output = /var/log/stunnel4.log exec = /root/stest.sh verify = 1 [BreakOut] accept = 192.168.0.1:443 Here is the configuration at the client side, where a browser establish a connection cert = /etc/stunnel/stunnel.pem key = /etc/stunnel/stunnel.pem sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 0 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [BreakOut] accept = 127.0.0.1:8080 connect = 192.168.0.1:443 First of all: is it right to set 'verify = 1' at the server side, and 'verify = 0' at the client side? It seems right to me, because the client should authenticate, but not the other way. Anyhow: As soon as a connection is opened using this configuration it will terminate at the same second. renner@mars:~$ telnet localhost 8080 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Connection closed by foreign host. In the clients logfile I see SSL state (connect): before/connect initialization SSL state (connect): SSLv3 write client hello A SSL state (connect): SSLv3 read server hello A VERIFY IGNORE: depth=0, /C=DE/ST=Germany/L=Munich/O=vbox4php/OU=stunnel/CN=boulder.vbox4php.org/emailAddress=michael.renner(a)gmx.de VERIFY OK: depth=0, /C=DE/ST=Germany/L=Munich/O=vbox4php/OU=stunnel/CN=boulder.vbox4php.org/emailAddress=michael.renner(a)gmx.de VERIFY IGNORE: depth=0, /C=DE/ST=Germany/L=Munich/O=vbox4php/OU=stunnel/CN=boulder.vbox4php.org/emailAddress=michael.renner(a)gmx.de VERIFY OK: depth=0, /C=DE/ST=Germany/L=Munich/O=vbox4php/OU=stunnel/CN=boulder.vbox4php.org/emailAddress=michael.renner(a)gmx.de SSL state (connect): SSLv3 read server certificate A SSL state (connect): SSLv3 read server certificate request A SSL state (connect): SSLv3 read server done A SSL state (connect): SSLv3 write client certificate A SSL state (connect): SSLv3 write client key exchange A SSL state (connect): SSLv3 write certificate verify A SSL state (connect): SSLv3 write change cipher spec A SSL state (connect): SSLv3 write finished A SSL state (connect): SSLv3 flush data SSL alert (read): fatal: bad certificate SSL_connect: 14094412: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket BreakOut finished (0 left) And, more interesting, at the server side: BreakOut connected from 84.57.55.105:57987 VERIFY ERROR: depth=0, error=self signed certificate: /C=DE/ST=Germany/L=Munich/O=vbox4php/OU=stunnel/CN=boulder.vbox4php.org/emailAddress=michael.renner(a)gmx.de SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Is something wrong with my self signed certificate? In my first tests I used one that I made with tinyCA, an other was made according http://www.stunnel.org/faq/certs.html: * openssl req -new -x509 -days 365 -nodes -out stunnel.pem -keyout stunnel.pem * openssl gendh 512 >> stunnel.pem * openssl rsa -in stunnel.pem -out new.pem * edit new.pem, merge some parts with stunnel.pem and rename it Any hint? Thanks -- |Michael Renner E-mail: michael.renner(a)gmx.de | |D-81541 Munich Germany ICQ: #112280325 | |Germany Don't drink as root! ESC:wq

1 0

Windows binary kits on 64 bit 2003 server or 2008 server
by Rich Jordan 24 Dec '08

24 Dec '08

Sorry to sully the list with wintel questions, but I haven't been able to locate an answer, and without systems available to test the obvious method of finding out is not available. We're running Stunnel V4.26 on a windows 2003 32-bit server, communicating with several better platforms running Stunnel V4.20 and newer, no issues. One interested customer is running windows 2003 server, 64-bit, and plans on moving to win2008 server 64 bit in the not too distant future. I do not have access to either OS/system and they're reluctant to install without knowing ahead of time what might happen. I'm hoping someone has tried the current STunnel binary kit on either or both of those systems. Will the kit run on 64-bit windows 2003, and is it usable on windows 2008? If not is this a situation where a build from source on either/both of those windows systems will produce working code? I've also found a number of hits for reputed OpenSSL ports for 64 bit windows. Any particular ones known to be good? Thanks for any info. Rich Illuc ivi, illud feci

1 0

Re: [stunnel-users] Wrapping a CherryPy server?
by Lucas Burdick 19 Dec '08

19 Dec '08

Hmm, I guess I didn't send my previous followup to the list. After setting the log to output properly, I was able to troubleshoot my problem. The chroot directory was non-existent and therefore didn't allow my .pid to be created. I have created the directory and everything now works as it should. Thanks for the help. Sorry for the trouble. Lucas -----Original Message----- From: Michael Renner [mailto:[email protected]] Sent: December-19-08 11:07 AM To: stunnel-users(a)mirt.net; Lucas Burdick Subject: Re: [stunnel-users] Wrapping a CherryPy server? On Friday 19 December 2008, Lucas Burdick wrote: > Hi There, Moin, > I?m trying to encrypt a cherrypy web page that I?m serving up. The page > itself works just fine on port 80, but I can?t seem to get stunnel to wrap > it. I?m using 4.26 on CentOS 5.2. I?ve put in my stunnel.conf: [...] > I?ve also tried commenting out the above mentioned .conf entry. I get the > error that inetd mode needs a remote host or executable. I?m trying to run > in daemon mode but I don?t think I?m doing it right. > > Please help, or ask me questions, or tell me to elaborate or something. can you call stunnel using the forground option and check the logfile? start stunnel like this ... $ stunnel -D debug -f -o /var/log/stunnel.log ........ CU -- |Michael Renner E-mail: michael.renner(a)gmx.de | |D-81541 Munich Germany ICQ: #112280325 | |Germany Don't drink as root! ESC:wq

1 0

Log rotation patch
by Christophe Nanteuil 17 Dec '08

17 Dec '08

Hello, NB : I propose this patch in alpha version. It has been tested only on a Linux Mandriva. (in the alpha version, it's recommended to use it on logs you might loose). Why to use this patch ? One reason I have to restart periodically stunnel is to do log rotation. This patch allows log rotation while running stunnel by implementing it directly inside. Therefore, the established connections are not closed by log rotation. Patch to version : 4.26 (should work on earlier versions). Type : new feature Description : Log rotation inside stunnel How to use this patch ? 3 new options are added in config file (see manual) maxLogSize : maximum size of log file (output option in config file). If logs have to be added, a log rotation is initiated. maxLogFiles : how many log files you want to keep. Default 7. useLogCompression : specify if rotated log files kept must be compressed or not. (requires zlib to be set). Just recompile stunnel after applying patch in stunnel directory: patch -p1 < /path/to/stunnel-logrot-0.10a.patch Test results are welcomed. Regards -- Christophe Nanteuil

1 0

Re: [stunnel-users] Stunnel 4 failing to connect to gmail
by Alex Limberis 15 Dec '08

15 Dec '08

HI Asif, Unfortunately that is the way gmail works. It changes the from to the gmail address rather than the computer domain. Unfortunately, this mostly makes it useless if you are trying to use it as a smarthost. -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Asif Iqbal Sent: Monday, December 15, 2008 2:06 PM To: Scott Gifford Cc: stunnel-users(a)mirt.net; nullmailer(a)lists.untroubled.org Subject: Re: [stunnel-users] Stunnel 4 failing to connect to gmail On Mon, Dec 15, 2008 at 4:49 PM, Scott Gifford <sgifford(a)suspectclass.com> wrote: > "Asif Iqbal" <vadud3(a)gmail.com> writes: > > [...] > >> I said it too soon. It passed that bind error but it still failing in ssl. >> I am seeing `SSL alert (write): fatal: handshake failure' > > Hello again Asif, glad you decided to try out stunnel! Yep, as you suggested :-) > > Try using port 465 instead of 587. That worked! I were able to send an email and I did receive it. It says the email came from `vadud3(a)gmail.com' instead of the sender, which is me(a)myhomecomputer.domain I am using this in /etc/nullmailer/remotes file localhost smtp --port=25 --user=vadud3 --pass=s3cr3t > > It looks like Google's STARTTLS command requires an EHLO to be sent > first, which is a someqhat unusual requirement. I don't think stunnel > does that. Port 465 will start talking SSL directly, without > requiring SMTP commands first. > > Good luck! > > ----Scott. > -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] Cannot connect to SBC/yahoo to send (or telnet)
by Leandro Avila 12 Dec '08

12 Dec '08

Not sure if ranting will get you the kind of answer that you look for but it was certainly entertaining for me. Anyway... I agree, some times things can be a little frustraiting but I guess that depends on how much time on how much work you want to put into it. Sorry to hear you feel stupid. Everyone has to start from 0 at shome point and it takes time to get a good handle to how things work. The question is... do you really want to know how things work or just want them to work without having to do much? A google search of "SSL Explained" http://wildbill.nulldevice.net/presentations/sslpreso/ I liked slide 11/35 nice little diagram of SSL handshake wich helps to visualize in very general terms how an SSL connection works. The rest of the slides are good too check them out! In your particular case that forced you to change from plain-text to SSL connections to your mail server. You had a couple of options. - First and most obvious is to use SSL support build into your mail client (Thunderbird, Outlook,etc) most if not all modern mail clients support SSL natively. No need for stunnel there. - If your mail client does not support SSL then stunnel is the way to go. But your issue is on how stunnel is being used. As client. When you are a client... you always want to verify your server. You want to make sure you are connected to the right server. You want to use verify=2 in stunnel.conf How do we verify that the server I just connected is in fact the right server? That is the Certificate Authority's job. We ultimately have to trust the CA they issued the certificate for the server owner. They signed the certificate with their key. and we use the CA's certificate to verify that signature. Here is the catch... operating systems, and some programs are shipped with a prebuild collection of CA certificates. Unfortunatelly stunnel does not. However, most CAs let you download their certificates for your own use. In your particular case, looks like the server you are connecting to uses a certificate issued by Equifax Secure Certificate Authority Here they have the download page for the CA Certificates. http://www.geotrust.com/resources/root-certificates/ You pointed out that they refuse connections if the client presents a certificate. Yes, that is somehow a common practice. Mutual authentication (both server and client send certificates to each other and verify them) is impractical in some cases. Thanks ----------------- Leandro Avila

1 0

Cannot connect to SBC/yahoo to send (or telnet)
by James Moe 05 Dec '08

05 Dec '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, (I sent this yesterday but that one seems to have gotten lost....) Stunnel v4.20. When connecting to SBC/Yahoo, the session is terminated with a "bad certificate" message. See the log below. The tech folks claim all is well at their end. Is there something I am missing here? Here is the conf file: ....[ conf ].... socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 client = yes output = G:/c/voice/pmmdev/testcase/bin/stunnel.log verify = 0 debug = 7 cert = g:/c/voice/pmmdev/testcase/bin/sma-test.pem [sbc] accept = localhost:6325 connect = smtp.att.yahoo.com:465 ....[ end conf ].... ....[ connection log ].... 2008.11.11 00:14:17 LOG7[223:1737]: sbc accepted FD=15 from 127.0.0.1:61053 2008.11.11 00:14:17 LOG7[223:1737]: Creating a new thread 2008.11.11 00:14:17 LOG7[223:1737]: New thread created 2008.11.11 00:14:17 LOG7[251:1737]: sbc started 2008.11.11 00:14:17 LOG7[251:1737]: FD 15 in non-blocking mode 2008.11.11 00:14:17 LOG7[251:1737]: TCP_NODELAY option set on local socket 2008.11.11 00:14:17 LOG5[251:1737]: sbc accepted connection from 127.0.0.1:61053 2008.11.11 00:14:17 LOG7[251:1737]: FD 16 in non-blocking mode 2008.11.11 00:14:17 LOG7[251:1737]: sbc connecting 69.147.64.31:465 2008.11.11 00:14:17 LOG7[251:1737]: connect_wait: waiting 10 seconds 2008.11.11 00:14:17 LOG7[251:1737]: connect_wait: connected 2008.11.11 00:14:17 LOG5[251:1737]: sbc connected remote server from 192.168.69.14:61054 2008.11.11 00:14:17 LOG7[251:1737]: Remote FD=16 initialized 2008.11.11 00:14:17 LOG7[251:1737]: TCP_NODELAY option set on remote socket 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): before/connect initialization 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 write client hello A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 read server hello A 2008.11.11 00:14:17 LOG5[251:1737]: VERIFY IGNORE: depth=0, /C=US/ST=California/L=Santa Clara/O=Yahoo! Inc./OU=Yahoo/CN=smtp.att.yahoo.com 2008.11.11 00:14:17 LOG5[251:1737]: VERIFY OK: depth=0, /C=US/ST=California/L=Santa Clara/O=Yahoo! Inc./OU=Yahoo/CN=smtp.att.yahoo.com 2008.11.11 00:14:17 LOG5[251:1737]: VERIFY IGNORE: depth=0, /C=US/ST=California/L=Santa Clara/O=Yahoo! Inc./OU=Yahoo/CN=smtp.att.yahoo.com 2008.11.11 00:14:17 LOG5[251:1737]: VERIFY OK: depth=0, /C=US/ST=California/L=Santa Clara/O=Yahoo! Inc./OU=Yahoo/CN=smtp.att.yahoo.com 2008.11.11 00:14:17 LOG5[251:1737]: VERIFY IGNORE: depth=0, /C=US/ST=California/L=Santa Clara/O=Yahoo! Inc./OU=Yahoo/CN=smtp.att.yahoo.com 2008.11.11 00:14:17 LOG5[251:1737]: VERIFY OK: depth=0, /C=US/ST=California/L=Santa Clara/O=Yahoo! Inc./OU=Yahoo/CN=smtp.att.yahoo.com 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 read server certificate A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 read server certificate request A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 read server done A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 write client certificate A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 write client key exchange A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 write certificate verify A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 write change cipher spec A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 write finished A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 flush data 2008.11.11 00:14:18 LOG7[251:1737]: SSL alert (read): fatal: bad certificate 2008.11.11 00:14:18 LOG3[251:1737]: SSL_connect: 14094412: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate 2008.11.11 00:14:18 LOG5[251:1737]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.11.11 00:14:18 LOG7[251:1737]: sbc finished (0 left) ....[ end log ].... - -- jimoe (at) sohnen-moe (dot) com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (OS/2) iD8DBQFJGe4zzTcr8Prq0ZMRAhSPAJ4h6YHyR+/W5brb7FK1tbbW1zYZ+wCglxpC 9k2qqpP2hN99BL0TnsNhlnw= =P74g -----END PGP SIGNATURE-----

6 7

Test, test. Hello?
by James Moe 05 Dec '08

05 Dec '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, I have not received a posting for several days. Has the list really gone that quiet? - -- jimoe (at) sohnen-moe (dot) com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (OS/2) iD4DBQFJOXHezTcr8Prq0ZMRAqqQAJ0aUC0ZyZC+85WF4WZN3nntQjfrxgCY/zjt 3Jlthcur9UTtXOnNkVcPFg== =scXZ -----END PGP SIGNATURE-----

1 0

Extending stunnels connect functionality
by bernhard.czech＠nobiscum.de 24 Nov '08

24 Nov '08

Hi all, we are looking for somebody to extend stunnel's multiple connect functionality a bit as of: - adding the ability to send a configurable string to each "connect" and compare the answer against an configured expectation string - the expectation should also be able to be interpreted as an regular expression. - the testing interval should be configurable - an alternative port should be configurable - it should be possible to call a script instead of doing a connection with the connect string provided as a parameter. - a way of monitoring might all paths might be good (i.e. writing a status file on regular basis) These things are pretty much the same things that LVS ( http://www.linuxvirtualserver.org/) provides. But we would like to reduce the complexity in our environment a bit. If somebody is interested to implement this feel free to contact me. If possible with an amount of expected reward. Kind regards, Bernhard Czech -- Bernhard Czech nobisCum Individual GmbH [T] +49 (0) 931 / 79 66 7-90 44 [F] +49 (0) 931 / 79 66 7-29 [M] +49 (0)175 / 90 51 45 8 [@] Bernhard.Czech(a)nobiscum.de [URL] www.nobiscum.de [Anschrift] Sedanstraße 23, 97082 Würzburg, Germany [Registergericht] Würzburg, HRB 5159 [Geschäftsführer] Markus Frisch, Hans-Peter Holl

1 0

Tunnel traffic from a network interface
by Kjetil Holien 23 Nov '08

23 Nov '08

Hi! Is it possible to capture traffic from one network interface on one computer, tunnel it to a second computer by stunnel and then send it through a network interface on that computer? This without changing any data on the network traffic (MAC adresses, IP etc). Thanks for any answers! greetings, Kjetil

1 0

Amount of FD's per connection
by Koornstra, Reinoud 21 Nov '08

21 Nov '08

Hi, I am using stunnel compiled to use threads. I read in the faq that a connection may use 1 to 4 fd's per connection. Normally this is only one, how can I influence this, I mean making sure there is one fd per connection? I also wish to limit the amount of max connections at the same time. Perhaps the most easy way is limit the amount of fd's per process with ulimit. However, depending on how many fd's are needed per connection it is difficult to set right now. Kind Regards, Reinoud.

2 2

xforwardedfor patch for 4.26?
by Chris Charman 19 Nov '08

19 Nov '08

Has anyone done such a thing? Alternately, are there good instructions someplace for setting up transparent proxy?

1 0

Re: [stunnel-users] Cannot connect to SBC/yahoo to send (or telnet)
by James Moe 19 Nov '08

19 Nov '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 11/19/08 03:20 am, kith walls wrote: > When connecting to SBC/Yahoo you need to front the session with HTTP. > I am not clear what you mean. Would you give an example? >> Hello, >> Stunnel v4.20. >> When connecting to SBC/Yahoo, the session is > terminated >> with a "bad certificate" message. See the > log below. The tech folks claim >> all is well at their end. >> Is there something I am missing here? >> Here is the conf file: > - -- jimoe (at) sohnen-moe (dot) com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (OS/2) iD8DBQFJJEsmzTcr8Prq0ZMRAjiTAJ9n/nZO2zaZemqvsU2Y1ge30OYdJQCeN3Oc Wj0dFPjjSH7qbV5d5L/F3ck= =ijQ0 -----END PGP SIGNATURE-----

1 0

Proxy support in configuration file?
by Reinier van der Gugten 19 Nov '08

19 Nov '08

Is there proxy support for Stunnel, and if so, how do I specify the proxy server in the configuration file? If it is not supported, can you give me a price estimate on what it would cost to add it? Greetings, Reinier. E.g. I want to connect to an external location at: Myserver.com:443 The proxy is at: CustomerProxy:8080 And my application runs at the customer talking to: localhost:1433 The proxy does not require authentication. Looking at the docuemtation you linked me I found this example: CONNECT server.example.com:80 HTTP/1.1 Host: server.example.com:80 Proxy-Authorization: basic aGVsbG86d29ybGQ= Using my addresses, where goes what? CONNECT CustomerProxy:8080 HTTP/1.1 Host: Myserver.com:443 // Proxy-Authorization: basic aGVsbG86d29ybGQ= Kind regards, Reinier -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Michal Trojnara Sent: vrijdag 14 november 2008 15:04 To: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Proxy support On Fri, 14 Nov 2008 14:53:20 +0100, "Reinier van der Gugten" <info(a)rgit.eu> wrote: > Has someone got a working version of STunnel that can handle a proxy? Do you mean client mode CONNECT protocol support (RFC 2817 section 5.2)? http://www.ietf.org/rfc/rfc2817.txt It's supported in stunnel since version 4.15 (released 2006.03.11). Best regards, Mike _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

stunnel and expiring CRLs
by Jason Haar 19 Nov '08

19 Nov '08

Hi there Is stunnel capable of re-reading updated CRLs on the fly? Without needing to be restarted? I have tried both CRLfile and CRLpath (with the hashes) with no luck. It appear stunnel only reads them on startup and never refers to them again? There also seems to be no option to send a HUP or the like to force a re-read - only a full restart will make stunnel re-read the CRLs. i.e. our system works after a fresh restart until the original CRL expires, and then stunnel starts rejecting new connections with "Found CRL is expired - revoking all certificates until you get updated CRL" - even though there have been several CRL file (and hash) updates in between. Restarting stunnel makes it start working again. I've googled around and see several other people have asked similar questions over the years, and there are references by Michal Trojnara that it should work? This is stunnel-4.14-2 under CentOS5 with openssl-0.9.8b-8.3.el5_0.2. No chroot jail Thanks! -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

4 5

Connection rejected: too many clients (>=500)?
by Chris Charman 18 Nov '08

18 Nov '08

Hey folks -- Can anyone tell me where the max number of clients is configured in 4.21? I'm running okay for a while, but then I end up with repeated messages as below in the logs: 2008.11.18 19:13:33 LOG7[26491:46912520933328]: https accepted FD=512 from xx.xx.xx.xx:xxxxx 2008.11.18 19:13:33 LOG4[26491:46912520933328]: Connection rejected: too many clients (>=500) 2008.11.18 19:13:33 LOG7[26491:46912520933328]: https accepted FD=512 from xx.xx.xx.xx:xxxxx 2008.11.18 19:13:33 LOG4[26491:46912520933328]: Connection rejected: too many clients (>=500) 2008.11.18 19:13:33 LOG7[26491:46912520933328]: https accepted FD=512 from xx.xx.xx.xx:xxxxx 2008.11.18 19:13:33 LOG4[26491:46912520933328]: Connection rejected: too many clients (>=500) [...] I've only seen reports of this problem, but no solution. Anyone out there who can help? Thanks in advance! -Chris ------------- Config below ----------------- ulimit unlimited stunnel -version stunnel 4.21 on x86_64-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none uname -a Linux domU-12-31-39-01-61-B2 2.6.21.7-2.fc8xen #1 SMP Fri Feb 15 12:34:28 EST 2008 x86_64 GNU/Linux stunnel -sockets Socket option defaults: Option Accept Local Remote OS default SO_DEBUG -- -- -- 0 SO_DONTROUTE -- -- -- 0 SO_KEEPALIVE -- -- -- 0 SO_LINGER -- -- -- 0:0 SO_OOBINLINE -- -- -- 0 SO_RCVBUF -- -- -- 87380 SO_SNDBUF -- -- -- 16384 SO_RCVLOWAT -- -- -- 1 SO_SNDLOWAT -- -- -- 1 SO_RCVTIMEO -- -- -- 0:0 SO_SNDTIMEO -- -- -- 0:0 SO_REUSEADDR 1 -- -- 0 SO_BINDTODEVICE -- -- -- -- IP_TOS -- -- -- 0 IP_TTL -- -- -- 64 TCP_NODELAY -- -- -- 0 gcc -v Using built-in specs. Target: x86_64-linux-gnu Configured with: ../src/configure -v --enable-languages=c,c++,fortran,objc,obj-c++,treelang --prefix=/usr --enable-shared --with-system-zlib --libexecdir=/usr/lib --without-included-gettext --enable-threads=posix --enable-nls --with-gxx-include-dir=/usr/include/c++/4.2 --program-suffix=-4.2 --enable-clocale=gnu --enable-libstdcxx-debug --enable-objc-gc --enable-mpfr --enable-checking=release --build=x86_64-linux-gnu --host=x86_64-linux-gnu --target=x86_64-linux-gnu Thread model: posix gcc version 4.2.3 (Ubuntu 4.2.3-2ubuntu7) openssl version OpenSSL 0.9.8g 19 Oct 2007

2 2

Re: [stunnel-users] Cannot connect to SBC/yahoo to send (or telnet)
by James Moe 18 Nov '08

18 Nov '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 11/18/08 10:17 am, James Moe wrote: > Hello, > Stunnel v4.20. > When connecting to SBC/Yahoo, the session is terminated > with a "bad certificate" message. See the log below. The tech folks claim > all is well at their end. > Is there something I am missing here? > Here is the conf file: > My apologies. I lost control of the email program and it sent this message here instead of to a local host. - -- jimoe (at) sohnen-moe (dot) com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (OS/2) iD8DBQFJIvmqzTcr8Prq0ZMRAsb2AJ9ROwt9FH4GpfyNWQ020rpGmC7K/wCdGhdW Bs96qyJjjXSA9d+AwVktAac= =+UNT -----END PGP SIGNATURE-----

1 0

Proxy support
by Reinier van der Gugten 18 Nov '08

18 Nov '08

Oops.. That's exactly what I meant... However What is the correct configuration in that case? E.g. I want to connect to an external location at: Myserver.com:443 The proxy is at: CustomerProxy:8080 And my application runs at the customer talking to: localhost:1433 The proxy does not require authentication. Looking at the docuemtation you linked me I found this example: CONNECT server.example.com:80 HTTP/1.1 Host: server.example.com:80 Proxy-Authorization: basic aGVsbG86d29ybGQ= Using my addresses, where goes what? CONNECT CustomerProxy:8080 HTTP/1.1 Host: Myserver.com:443 // Proxy-Authorization: basic aGVsbG86d29ybGQ= Kind regards, Reinier -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Michal Trojnara Sent: vrijdag 14 november 2008 15:04 To: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Proxy support On Fri, 14 Nov 2008 14:53:20 +0100, "Reinier van der Gugten" <info(a)rgit.eu> wrote: > Has someone got a working version of STunnel that can handle a proxy? Do you mean client mode CONNECT protocol support (RFC 2817 section 5.2)? http://www.ietf.org/rfc/rfc2817.txt It's supported in stunnel since version 4.15 (released 2006.03.11). Best regards, Mike _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 1

Re: [stunnel-users] Help - Getting stunnel compiled on windows and using a patch
by Reinier van der Gugten 14 Nov '08

14 Nov '08

Thanks so mucht for this information! I had to make the folowing changes as well: Set the Compile with common language runtime to: No common language runtime support for each .h file If I do that, the error: Command line error D8045: cannot compile C file 'src\client.c' with the /clr option disappears (Next I got an error in the resouce.rc file with the LTEXT VERSION... So I // that out) Next I get about 121 errors, like: Error LNK2001: unresolved external symbol _main ... symbol _num_clients etc. Any ideas? Kind regards, Reinier ________________________________ From: DMILE525 [mailto:[email protected]] Sent: donderdag 13 november 2008 23:23 To: Reinier van der Gugten Subject: Re: [stunnel-users] Help - Getting stunnel compiled on windows and using a patch on Windows: install Win32 OpenSSL http://www.slproweb.com/products/Win32OpenSSL.html <wlmailhtml:{86BCE398-B6B8-40AD-8A3D-BE759753A203}mid://00000009/!x-usc: http://www.slproweb.com/products/Win32OpenSSL.html> install VS2008 (I'm using free VS2008 C++ Express Edition http://www.microsoft.com/express/download/ <wlmailhtml:{86BCE398-B6B8-40AD-8A3D-BE759753A203}mid://00000009/!x-usc: http://www.microsoft.com/express/download/> ) The first thing to do (assuming a default installation of 'C:\OpenSSL') is to go to 'C:\OpenSSL\lib\VC' and copy all of the files to your Visual C++ 'lib' directory. This directory is sometimes located in a somewhat cryptic location such as 'C:\Program Files (x86)\Microsoft Visual Studio 9.0\VC\lib' or 'C:\Program Files\Microsoft Visual Studio 9.0\VC\lib'. Next, copy everything in the 'C:\OpenSSL\include' directory to your Visual C++ 'include' directory. create new empty project add to project: stunnel.c ssl.c ctx.c verify.c file.c client.c protocol.c sthreads.c log.c options.c network.c resolver.c gui.c common.h prototypes.h resources.h stunnel.ico resources.rc "Configuration properties -> Linker -> input -> additional properties" add wsock32.lib ssleay32.lib libeay32.lib "Configuration properties -> General -> character set" set "Use Multi-Byte Character Set" in common.h after #ifndef COMMON_H #define COMMON_H add #define USE_WIN32 #define _CRT_SECURE_NO_DEPRECATE #define _CRT_NONSTDC_NO_DEPRECATE //#define HAVE_GETADDRINFO //#define HAVE_GETNAMEINFO #ifndef _MBCS #define _MBCS #endif #define VERSION "4.26" #if defined _M_IX86 #pragma comment(linker, "/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*'\"") #elif defined _M_IA64 #pragma comment(linker, "/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='ia64' publicKeyToken='6595b64144ccf1df' language='*'\"") #elif defined _M_X64 #pragma comment(linker, "/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='amd64' publicKeyToken='6595b64144ccf1df' language='*'\"") #else #pragma comment(linker, "/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='*' publicKeyToken='6595b64144ccf1df' language='*'\"") #endif On Wed, Nov 12, 2008 at 6:50 PM, Reinier van der Gugten <info(a)rgit.eu> wrote: Hello, I am trying to compile STunnel. I'd rather not, but the pre-compiled version does not support a proxy server. So I hop you will be able to help me, or point me to a good howto on how to compile stunnel using windows and a patch from the patch-list. Or does someone have a compiled (windows) version with proxy support? If so, please mail it to me. Or tell me where to find more detailed information pls. - Next thing I will try is to install linux on a computer in order to try it that way... Greetings, Reinier. _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 2

Strange CRL verification behaviour
by Christophe Nanteuil 03 Nov '08

03 Nov '08

With stunnel 4.26 (or ealier), in order to verify revocation of clients' certificates, I use this configuration file : -------------------8<------------------ CAfile=/etc/ssl/stunnel/ca_certs.pem CRLfile=/etc/ssl/stunnel/crl.pem cert=/etc/ssl/stunnel/server.pem key=/etc/ssl/stunnel/server.key sslVersion=TLSv1 verify=2 [WEB] accept=8080 connect=127.0.0.1:3128 ------------------->8------------------ 1/ If there is no CRLfile when stunnel starts, stunnel dies and logs show "Failed to load /etc/ssl/stunnel/crl.pem revocation lookup file" -> ok. 2/ If the CRLfile is correct, stunnel starts. When the CRL expires, stunnel rejects any new connection. Logs then show : " Found CRL is expired - revoking all certificates until you get updated CRL" -> ok 3/ If the CRLfile is not a valid CRL, stunnel starts and ignores the CRLfile. Then, for any new connection, logs show "CRL: verification passed". -> NOT ok, IMO. examples of wrong CRLs : a CRL issued by an unknown CA or a certificate in the PEM format. This can happen when the CRL expires (soon) and the administrator puts a "new one" but misfits files. He then restarts stunnel, which works. This behaviour can be annoying because the logs of CRL are now in level 6 (INFO) and not any more in level 5 (NOTICE). My configuration was in debug=5 and logs showed only "CRL: verification passed", I could not determine what CRL was really used. I propose the attached patch to modify behaviour in case 3/, ie if no CRL corresponding to the issuer of each certificate of the chain is found : - reject connection if CRLdir or CRLfile was specified in the config file - accept connection but warn in logs if the use of CRL was not explicitly set in the config file. NB : the source code of function "crl_check" shows "/* based on BSD-style licensed code of mod_ssl */". I looked into the code of "mod_ssl-2.8.31-1.3.41" (file pkg.sslmod/ssl_engine_kernel.c, line 1601-1769) and there is actually the same behaviour. -- Christophe Nanteuil

1 0

Spawning a shell
by Tobias Dussa 29 Oct '08

29 Oct '08

Hi everybody, maybe I'm missing something real obvious here, but I can't figure out what's going wrong. I'm trying to make stunnel spawn a regular shell when it gets a connect. As far as I understand, the pty option should allocate a virtual tty, so I ought to be able to just exec() a shell. However, this won't work; apparently some more magic is required. I do get the basic interactive functionality to work (i. e., I can enter, say, ls and get back a directory listing), but the terminal won't work properly: Unwanted echoes (stty -echo doesn't help). Furthermore, for some reason stderr is not connected to the new pty but sticks to stunnel's original pty. I have tried spawning a shell directly from stunnel (with exec), spawning a script which redirects stdin/-out/-err to the proper pty, then execs a shell, spawning a script which execs login, spawning a script which execs getty. (The latter being closest to what I want, but not good enough.) I'm running out of ideas. Anyone ever did this? Any comments? (Incidentally, if anyone has a better idea how to create the possibility to log in with an X.509 certificate without using stunnel, I'm all ears.) I'm running stunnel4 on Debian etch: --- stunnel 4.18 on i486-pc-linux-gnu with OpenSSL 0.9.8c 05 Sep 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none --- Cheers, Toby. -- The nine most terrifying words in the English language are: I'm from the government and I'm here to help. ---Ronald Reagan

3 2

Thanks for solving my problem!
by editor 20 Oct '08

20 Oct '08

Hi: Thanks! I commented out the "Verify" option within the configuration file and restarted the application. I can use it POP3S & HTTPS with the Nokia & Sony-Ericsson mobiles fine now as well as Thunderbird. I will check with Outlook next. Window's mobile is complaining it can not create a SSL session however. I think it has to do with the public certificate I use in the mail host. Godaddy uses this two part public certificate and the Network Solutions is a single file. I am hoping in a new release of Stunnel, it can support a two part public certificate. Thanks again!!! Kevin > > > > > > ------------------------------ > > > > Message: 2 > > Date: Sun, 19 Oct 2008 21:17:29 -0700 (PDT) > > From: Algol Tradent <tradent(a)yahoo.com> > > Subject: Re: [stunnel-users] Version 4.26 and using to secure IMAPS & > > POP3 > > To: stunnel-users(a)mirt.net > > Message-ID: <710279.38955.qm(a)web62003.mail.re1.yahoo.com> > > Content-Type: text/plain; charset=us-ascii > > > > Hello, > > > > I think your problem is on your config file for the server. On your config file you have the following option > > > > # Authentication stuff > > verify = 3 > > > > You probably don't want this option set. Because you are asking the client and the server to authenticate each other based on certificates... which I don;t think is the case here. > > > > On your log file there is this line which is a good indicator of your problem. > > > > routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate > > > > I hope this helps > >

1 0

Version 4.26 and using to secure IMAPS & POP3
by Editor (Kevin) 20 Oct '08

20 Oct '08

Hi: I upgraded to the current 4.26 as I was having an issue with 4.15. The idea is to secure IMAP traffic as well as inbound SMTP. The email client is the latest Thunderbird and seems to be very stable. The mail Host is a Sun E-250 with current patches for Solaris 9. Note: I am using a public certificate and as it from "godaddy.com", it is this unusual two part certificate. This may be where the problem is as I had to combine the two public certificate files together (maybe the next version of STUNNEL could do this automatically so the risk of errors is reduced!). However, using STUNNEL, I am having an issue connecting as I get a strange error message and the connection dies. Error Log: 2008.10.19 13:10:41 LOG7[2104:1]: imaps accepted FD=0 from 80.38.96.194:4129 2008.10.19 13:10:41 LOG7[2104:3]: imaps started 2008.10.19 13:10:41 LOG7[2104:3]: FD 0 in non-blocking mode 2008.10.19 13:10:41 LOG7[2104:1]: Cleaning up the signal pipe 2008.10.19 13:10:41 LOG7[2104:3]: TCP_NODELAY option set on local socket 2008.10.19 13:10:41 LOG7[2104:3]: Waiting for a libwrap process 2008.10.19 13:10:41 LOG7[2104:3]: Acquired libwrap process #0 2008.10.19 13:10:41 LOG7[2104:1]: Cleaning up the signal pipe 2008.10.19 13:10:41 LOG7[2104:3]: Releasing libwrap process #0 2008.10.19 13:10:41 LOG7[2104:3]: Released libwrap process #0 2008.10.19 13:10:41 LOG7[2104:1]: Cleaning up the signal pipe 2008.10.19 13:10:41 LOG7[2104:3]: imaps permitted by libwrap from 80.38.96.194:4129 2008.10.19 13:10:41 LOG5[2104:3]: imaps accepted connection from 80.38.96.194:4129 2008.10.19 13:10:41 LOG7[2104:3]: SSL state (accept): before/accept initialization 2008.10.19 13:10:41 LOG7[2104:3]: SSL state (accept): SSLv3 read client hello A 2008.10.19 13:10:41 LOG7[2104:3]: SSL state (accept): SSLv3 write server hello A 2008.10.19 13:10:41 LOG7[2104:1]: Cleaning up the signal pipe 2008.10.19 13:10:41 LOG7[2104:3]: SSL state (accept): SSLv3 write certificate A 2008.10.19 13:10:41 LOG7[2104:3]: SSL state (accept): SSLv3 write certificate request A 2008.10.19 13:10:41 LOG7[2104:3]: SSL state (accept): SSLv3 flush data 2008.10.19 13:10:42 LOG7[2104:3]: SSL alert (read): warning: no certificate 2008.10.19 13:10:42 LOG7[2104:1]: Cleaning up the signal pipe 2008.10.19 13:10:42 LOG7[2104:3]: SSL alert (write): fatal: handshake failure 2008.10.19 13:10:42 LOG3[2104:3]: SSL_accept: 140890C7: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate 2008.10.19 13:10:42 LOG7[2104:1]: Cleaning up the signal pipe 2008.10.19 13:10:42 LOG5[2104:3]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.10.19 13:10:42 LOG7[2104:1]: Cleaning up the signal pipe 2008.10.19 13:10:42 LOG7[2104:3]: imaps finished (0 left) See the weird no client peer handshake???? The configuration file: # more /usr/local/etc/stunnel/stunnel.conf # stunnel configuration file # Use to provide ssl protection for https, pop3 and imap # # Setting up the root jail chroot = /usr/local/var/stunnel # # The PID is created inside chroot jail pid = /stunnel.pid setuid = nobody setgid = nogroup ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /usr/local/var/lib/stunnel/ setuid = nobody setgid = nogroup ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 # Authentication stuff verify = 3 # Certicates to use # cert = /usr/local/etc/stunnel/stunnel.pem CAfile = /usr/local/etc/stunnel/_.cellmail.com.crt # SSLCertificateChainFile = /usr/local/etc/stunnel/gd_intermediate_bundle.crt # Some debugging stuff debug = 7 output = /var/log/stunnel.log # Use it for client mode #client = yes # Service-level configuration [pop3s] accept = 199.4.110.39:995 connect = 110 [imaps] accept = 199.4.110.39:993 connect = 143 [ssmtp] accept = 199.4.110.39:465 connect = frog.cellmail.com:25 # TIMEOUTclose = 0 The startup log: 2008.10.19 13:02:50 LOG7[2077:1]: Snagged 64 random bytes from /export/home/kgreene/.rnd 2008.10.19 13:02:50 LOG7[2077:1]: Wrote 1024 new random bytes to /export/home/kgreene/.rnd 2008.10.19 13:02:50 LOG7[2077:1]: RAND_status claims sufficient entropy for the PRNG 2008.10.19 13:02:50 LOG7[2077:1]: PRNG seeded successfully 2008.10.19 13:02:50 LOG7[2077:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2008.10.19 13:02:50 LOG7[2077:1]: Certificate loaded 2008.10.19 13:02:50 LOG7[2077:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2008.10.19 13:02:50 LOG7[2077:1]: Private key loaded 2008.10.19 13:02:50 LOG7[2077:1]: Loaded verify certificates from /usr/local/etc/stunnel/_.cellmail.com.crt 2008.10.19 13:02:50 LOG7[2077:1]: Loaded /usr/local/etc/stunnel/_.cellmail.com.crt revocation lookup file 2008.10.19 13:02:50 LOG7[2077:1]: SSL context initialized for service pop3s 2008.10.19 13:02:50 LOG7[2077:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2008.10.19 13:02:50 LOG7[2077:1]: Certificate loaded 2008.10.19 13:02:50 LOG7[2077:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2008.10.19 13:02:50 LOG7[2077:1]: Private key loaded 2008.10.19 13:02:50 LOG7[2077:1]: Loaded verify certificates from /usr/local/etc/stunnel/_.cellmail.com.crt 2008.10.19 13:02:50 LOG7[2077:1]: Loaded /usr/local/etc/stunnel/_.cellmail.com.crt revocation lookup file 2008.10.19 13:02:50 LOG7[2077:1]: SSL context initialized for service imaps 2008.10.19 13:02:50 LOG7[2077:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2008.10.19 13:02:50 LOG7[2077:1]: Certificate loaded 2008.10.19 13:02:50 LOG7[2077:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2008.10.19 13:02:50 LOG7[2077:1]: Private key loaded 2008.10.19 13:02:50 LOG7[2077:1]: Loaded verify certificates from /usr/local/etc/stunnel/_.cellmail.com.crt 2008.10.19 13:02:50 LOG7[2077:1]: Loaded /usr/local/etc/stunnel/_.cellmail.com.crt revocation lookup file 2008.10.19 13:02:50 LOG7[2077:1]: SSL context initialized for service ssmtp 2008.10.19 13:02:50 LOG5[2077:1]: stunnel 4.26 on sparc-sun-solaris2.9 with OpenSSL 0.9.8h 28 May 2008 2008.10.19 13:02:50 LOG5[2077:1]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.10.19 13:02:50 LOG6[2077:1]: file ulimit = 256 (can be changed with 'ulimit -n') 2008.10.19 13:02:50 LOG6[2077:1]: poll() used - no FD_SETSIZE limit for file descriptors 2008.10.19 13:02:50 LOG5[2077:1]: 125 clients allowed 2008.10.19 13:02:50 LOG7[2077:1]: FD 11 in non-blocking mode 2008.10.19 13:02:50 LOG7[2077:1]: FD 12 in non-blocking mode 2008.10.19 13:02:50 LOG7[2077:1]: FD 13 in non-blocking mode 2008.10.19 13:02:50 LOG7[2077:1]: SO_REUSEADDR option set on accept socket 2008.10.19 13:02:50 LOG7[2077:1]: pop3s bound to 199.4.110.39:995 2008.10.19 13:02:50 LOG7[2077:1]: FD 14 in non-blocking mode 2008.10.19 13:02:50 LOG7[2077:1]: SO_REUSEADDR option set on accept socket 2008.10.19 13:02:50 LOG7[2077:1]: imaps bound to 199.4.110.39:993 2008.10.19 13:02:50 LOG7[2077:1]: FD 15 in non-blocking mode 2008.10.19 13:02:50 LOG7[2077:1]: SO_REUSEADDR option set on accept socket 2008.10.19 13:02:50 LOG7[2077:1]: ssmtp bound to 199.4.110.39:465 2008.10.19 13:02:50 LOG7[2083:1]: Created pid file /stunnel.pid 2008.10.19 13:02:50 LOG7[2083:1]: Cleaning up the signal pipe

2 1

forgeground=no with pppd and pty=yes?
by Sandeep Kumar 15 Oct '08

15 Oct '08

Hi, I want to encrypt pppd, but stunnel should start in background mode. But as soon as I set foreground=no, ppp is unable to connect. Is this not possible ? -- Sandeep Kumar http://students.iiit.ac.in/~sandeep_kr

1 0

Setting up a POP3 connection through stunnel?
by Ben Stover 13 Oct '08

13 Oct '08

Assume currently I retrieve my emails from my mailbox unencrypted with the following info: pop3.mydomain.com port=110 Now I want to switch to an encrypted POP3 mail connection. with the following information pop3.mydomain.com port=777 Can I simply write now in the conf file: [myownsetup] accept = 127.0.0.1:110 connect = pop3.mydomain.com:777 Is this sufficient? Ben

2 1

Question (new user!) how to get it to work? - SQL
by Reinier van der Gugten 10 Oct '08

10 Oct '08

Hi, I read most of the messages and tutorials, but still I do not seem to get it to work. I want to achieve the following: Client side: VB application communicating to a SQL server over port 1433. Server side: Lisning on port 1433 that is lisned to by SQL 2005. However this is not allowed evrywhere, so stunnel comes into play. Client side: VB application communicating to localhost on port 1433 Stunnel installed lisning on port 1433 and passing it on to port 80 (Note for later: I would like to use SSL, so it will pass through routers, But for the test it will suffice to keep it unencrypted. Also the server is still local and could be reached directly. But it should work fine for testing.) Server: Stunnel installed as service lisning on port 80 and transmitting it to port 1433 (later to be moved to 443, as I also run a HTTP server) The config file looks like this: ------------------------------------------------- Client: ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 ;output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [SQLServer] accept = 127.0.0.1:1433 connect = 10.12.18.10:80 ------------------------------------------------- Server: ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 ;output = stunnel.log ; Use it for client mode ;client = yes ; Service-level configuration [SQL] accept = 80 connect = localhost:1433 ------------------------------------------------- As you can see, I tried to keep as close to the example file as I could. Looking forward to getting this to work and then to including ssl... Kind regards, Reinier.

1 0

Stunnel 4.26 Not working
by natalie burdick 30 Sep '08

30 Sep '08

I just upgraded from Sony to IBM laptop, in doing so, I installed latest version of Stunnel for use with my pop email client. I am running Stunnel 4.26 on Windows XP Here is my stunnel log: 2008.09.29 20:48:44 LOG5[2568:4088]: stunnel 4.26 on x86-pc-mingw32-gnu with OpenSSL 0.9.8i 15 Sep 2008 2008.09.29 20:48:44 LOG5[2568:4088]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2008.09.29 20:48:44 LOG5[2568:1628]: No limit detected for the number of clients It was working until I upgraded to this version, now when I use my client to check or send email, it just says that it's connecting to the server but never actually does. I can provide my conf

2 2

set process name support in stunnel?
by Hank Leininger 28 Sep '08

28 Sep '08

Has anybody patched stunnel to modify its name in ps output, setproctitle-style, to tell more about itself? I'm thinking a config parameter "processname" which the user can specify in the service_name stanza (or just tack the service_name onto the end of the process title). I use stunnel mostly for ad-hoc client connections, or in a script to plug a perl script that knows how to fuzz IMAP, SMTP, etc into an SSL listener. For me the stunnel 3 command-line flag usage was ideal. But, I finally gave up and switched to using stunnel v4, usually piping a dynamically-generated config in on an fd. The downside with that is now instead of 'ps' showing useful, differentiating commandline flags for each stunnel process, I just have dozens of 'stunnel -fd 0's. It's possible to track down who's going where (netstat -antp, etc) but that's painful. Being able to set an arbitrary, meaningful-to-humans process name (or extra tag, etc) from config entries would resolve this, and might be useful for people with more conventional uses for stunnel. Thanks, -- Hank Leininger <hlein(a)korelogic.com> BE5D FCCA 673B D18B 98A9 3175 896E 3D4A 1B4D C5AC

1 0

Re: [stunnel-users] Stunnel License
by Bansal, Gaurav (Gaurav) 24 Sep '08

24 Sep '08

We are compiling stunnel source without any modification for different platform supported of our product. Then we are running stunnel as a standalone process after making changes to stunnel.conf file. In stunnel.conf file we are providing location of certificates and ports to be used We would distribute stunnel binary along with our product. Given the scenario I have mentioned do you foresee legal problems in usage of stunnel. I understand that OpenSSL uses OpenSSL license but I got this for openssl website. ==================================================== On many systems including the major Linux and BSD distributions, yes (the GPL does not place restrictions on using libraries that are part of the normal operating system distribution). On other systems, the situation is less clear. Some GPL software copyright holders claim that you infringe on their rights if you use OpenSSL with their software on operating systems that don't normally include OpenSSL. If you develop open source software that uses OpenSSL, you may find it useful to choose another license than the GPL, or state explicitly that "This program is released under the GPL with the additional exemption that compiling, linking, and/or using OpenSSL is allowed." If you are using GPL software developed by others, you may want to ask the copyright holder for permission to use their software with OpenSSL. ===================================================== Specifically I am concerned if Stunnel states that compiling, linking, and/or using OpenSSL is allowed Thanks Gaurav ________________________________ From: Bansal, Gaurav (Gaurav) Sent: Wednesday, September 24, 2008 5:27 PM To: 'webmaster(a)stunnel.org'; 'stunnel-users(a)mirt.net'; 'stunnel-users-owner(a)mirt.net'; 'Michal.Trojnara(a)mirt.net' Subject: Stunnel License Hi, We are planning to use Stunnel to encrypt traffic between Apache mod_jk and AJP connector of JBoss Tomcat. It seems that Stunnel uses OpenSSL APIs. Since Stunnel is available under GPL license, the license terms prevents us from using Stunnel in our product since it exposes OpenSSL which is also available under GPL license. I would like to know if there is also a commercial license available for stunnel? I would appreciate if you can throw pointers on how to package Stunnel with a commercial product. Thank Gaurav

2 1

Stunnel License
by Bansal, Gaurav (Gaurav) 24 Sep '08

24 Sep '08

Hi, We are planning to use Stunnel to encrypt traffic between Apache mod_jk and AJP connector of JBoss Tomcat. It seems that Stunnel uses OpenSSL APIs. Since Stunnel is available under GPL license, the license terms prevents us from using Stunnel in our product since it exposes OpenSSL which is also available under GPL license. I would like to know if there is also a commercial license available for stunnel? I would appreciate if you can throw pointers on how to package Stunnel with a commercial product. Thank Gaurav

1 0

Re: [stunnel-users] Compiled Stunnel 4.25 with OpenSSL 0.9.8h
by Nelgraine 22 Sep '08

22 Sep '08

Thanks for your reply. I’ve found out that Solaris 10 machine has default OpenSSL 0.9.7d located in /usr/local/ssl/bin. Update OpenSSL 0.9.8h using this command: ../config -fPIC shared no-idea threads make depend make make test make install But unfortunately the gcc link to old openssl 0.9.7d. How to update the link in gcc? Any help would be greatly appreciated. Thanks! Regards, Nelgraine --- On Sun, 9/21/08, stunnel-users-request(a)mirt.net <stunnel-users-request(a)mirt.net> wrote: > From: stunnel-users-request(a)mirt.net <stunnel-users-request(a)mirt.net> > Subject: stunnel-users Digest, Vol 50, Issue 15 > To: stunnel-users(a)mirt.net > Date: Sunday, September 21, 2008, 6:00 PM > Send stunnel-users mailing list submissions to > stunnel-users(a)mirt.net > > To subscribe or unsubscribe via the World Wide Web, visit > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body > 'help' to > stunnel-users-request(a)mirt.net > > You can reach the person managing the list at > stunnel-users-owner(a)mirt.net > > When replying, please edit your Subject line so it is more > specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. stunnel 4.26 released (Michal Trojnara) > 2. Re: Compiled Stunnel 4.25 with OpenSSL 0.9.8h > on Solaris 10 > (Michal Trojnara) > 3. stunnel 4.26 released (Michal Trojnara) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 20 Sep 2008 23:13:50 +0200 > From: Michal Trojnara <Michal.Trojnara(a)mobi-com.net> > Subject: [stunnel-users] stunnel 4.26 released > To: 'stunnel-users(a)mirt.net' > <stunnel-users(a)mirt.net>, > stunnel-announce(a)mirt.net, openssl-users(a)openssl.org > Message-ID: > <86cf5ffd468849a8dba392b1d3bc6bb3(a)mobi-com.net> > Content-Type: text/plain; charset=US-ASCII; format=flowed > > Dear Users, > > Version 4.26, 2008.09.20, urgency: MEDIUM: > * New features > - Win32 DLLs for OpenSSL 0.9.8i. > - /etc/hosts.allow and /etc/hosts.deny no longer need to > be copied to > the chrooted directory, as the libwrap processes are no > longer > chrooted. > - A more informative error messages for invalid port > number specified > in stunnel.conf file. > - Support for Microsoft Visual C++ 9.0 Express Edition. > * Bugfixes > - Killing all libwrap processes at stunnel shutdown > fixed. > - A minor bug in stunnel.init sample SysV startup file > fixed. > > Home page/download: http://stunnel.mirt.net/ > > sha1sum for stunnel-4.24.tar.gz file: > 1c9f5dd6b21f354c356cd9100899a90a83068c68 > > Best regards, > Mike > > > > ------------------------------ > > Message: 2 > Date: Sun, 21 Sep 2008 00:13:07 +0200 > From: Michal Trojnara <Michal.Trojnara(a)mobi-com.net> > Subject: Re: [stunnel-users] Compiled Stunnel 4.25 with > OpenSSL 0.9.8h > on Solaris 10 > To: 'stunnel-users(a)mirt.net' > <stunnel-users(a)mirt.net> > Message-ID: > <6cb62b05bc25b1da1f8992ceadb133d4(a)mobi-com.net> > Content-Type: text/plain; charset=US-ASCII; format=flowed > > On 2008-09-19, at 04:36, Nelgraine wrote: > > Undefined first referenced > > symbol in file > > BIO_set_flags protocol.o > > SSL_CTX_set_info_callback ctx.o > > ld: fatal: Symbol referencing errors. No output > written to stunnel > > Is it possible that your system has more than one copy of > the OpenSSL > libraries? > Maybe gcc tries to link against the old ones instead of the > new ones? > > > 1. Should I need to upgrade OpenSSL 0.9.8h into > OpenSSL 0.9.8i? > > I don't think this could cause your problem. > > > 2. I have installed openssl 0.9.8h on Solaris 10 and > created several > > ca certificates. > > - If I will upgrade OpenSSL 0.9.8h into OpenSSL > 0.9.8i, should I > > also recreate ca certificates? > > No, you don't have to recreate your certificates. > > Best regards, > Mike > > > > ------------------------------ > > Message: 3 > Date: Sat, 20 Sep 2008 23:13:50 +0200 > From: Michal Trojnara <Michal.Trojnara(a)mobi-com.net> > Subject: [stunnel-users] stunnel 4.26 released > To: 'stunnel-users(a)mirt.net' > <stunnel-users(a)mirt.net>, > stunnel-announce(a)mirt.net, openssl-users(a)openssl.org > Message-ID: > <86cf5ffd468849a8dba392b1d3bc6bb3(a)mobi-com.net> > Content-Type: text/plain; charset=US-ASCII; format=flowed > > Dear Users, > > Version 4.26, 2008.09.20, urgency: MEDIUM: > * New features > - Win32 DLLs for OpenSSL 0.9.8i. > - /etc/hosts.allow and /etc/hosts.deny no longer need to > be copied to > the chrooted directory, as the libwrap processes are no > longer > chrooted. > - A more informative error messages for invalid port > number specified > in stunnel.conf file. > - Support for Microsoft Visual C++ 9.0 Express Edition. > * Bugfixes > - Killing all libwrap processes at stunnel shutdown > fixed. > - A minor bug in stunnel.init sample SysV startup file > fixed. > > Home page/download: http://stunnel.mirt.net/ > > sha1sum for stunnel-4.24.tar.gz file: > 1c9f5dd6b21f354c356cd9100899a90a83068c68 > > Best regards, > Mike > > ______________________________________________________________________ > OpenSSL Project > http://www.openssl.org > User Support Mailing List > openssl-users(a)openssl.org > Automated List Manager > majordomo(a)openssl.org > > > ------------------------------ > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > End of stunnel-users Digest, Vol 50, Issue 15 > *********************************************

1 0

Compiled Stunnel 4.25 with OpenSSL 0.9.8h on Solaris 10
by Nelgraine 20 Sep '08

20 Sep '08

Ive read this article Compiling Stunnel 4.21 on Solaris 10 http://stunnel.mirt.net/pipermail/stunnel-users/2008-March/001895.html I've been also experiencing this kind of problem but I've Compiled Stunnel 4.25 with OpenSSL 0.9.8h on Solaris 10. Configure: # ./configure --prefix=/usr/local/stunnel-4.25 --with-ssl=/usr/local/openssl-0.9.8h configure: **************************************** success Make Error: gcc -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/local/openssl-0.9.8h/include -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o pty.o libwrap.o -lz -ldl -lsocket -lnsl -lpthread -L/usr/local/openssl-0.9.8h/lib -lssl -lcrypto -lwrap Undefined first referenced symbol in file BIO_set_flags protocol.o SSL_CTX_set_info_callback ctx.o ld: fatal: Symbol referencing errors. No output written to stunnel My Question is: 1. Should I need to upgrade OpenSSL 0.9.8h into OpenSSL 0.9.8i? 2. I have installed openssl 0.9.8h on Solaris 10 and created several ca certificates. - If I will upgrade OpenSSL 0.9.8h into OpenSSL 0.9.8i, should I also recreate ca certificates? Any help would be greatly appreciated.

2 1

stunnel 4.26 released
by Michal Trojnara 20 Sep '08

20 Sep '08

Dear Users, Version 4.26, 2008.09.20, urgency: MEDIUM: * New features - Win32 DLLs for OpenSSL 0.9.8i. - /etc/hosts.allow and /etc/hosts.deny no longer need to be copied to the chrooted directory, as the libwrap processes are no longer chrooted. - A more informative error messages for invalid port number specified in stunnel.conf file. - Support for Microsoft Visual C++ 9.0 Express Edition. * Bugfixes - Killing all libwrap processes at stunnel shutdown fixed. - A minor bug in stunnel.init sample SysV startup file fixed. Home page/download: http://stunnel.mirt.net/ sha1sum for stunnel-4.24.tar.gz file: 1c9f5dd6b21f354c356cd9100899a90a83068c68 Best regards, Mike

1 0

Re: [stunnel-users] STunnel as a Relay server
by Ludolf Holzheid 19 Sep '08

19 Sep '08

On Thu, 2008-09-18 15:02:56 -0400, Thomas O'Hare wrote: > Ludolf > > Just got this as the main mail server was down for several days. > > The Win EXE that installs the STunnel service is what I meant. Is there > a way to edit the configuration text file to skip tunneling. There is > an ancient app on some PCs that can use only port 25 and we want to use > STunnel to do both SSL & non-SSL relays so we do not have to install & > maintain 2 different packages to basically do the same thing. Thomas, Of course, you get a clear-text port redirector if you connect two instances of stunnel running on the same machine, one acting as client, the other one as server. But again, I think this is oversized and not easier to set up than a simple TCP port redirector. Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Bug in tools stunnel.init
by Kevin A. McGrail 17 Sep '08

17 Sep '08

Hi Michael, I've upgraded to stunnel 4.25 and found a few small bugs in the init script. In stunnel.init.in, I'm pretty sure the DAEMON line should be DAEMON=@prefix@/bin/stunnel and not DAEMON=@prefix@/etc/stunnel Also, when the parent process is killed with stop, I see Sep 17 14:34:16 server stunnel: warning: can't get client address: Bad file descriptor because the child processes seem to stick around. I've modified the init script to kill the main process using the pid file and then using pidof to identify and kill the remaining child processes. Is this expected behavior? regards, KAM

2 2

Non-SSL Relay
by Thomas O'Hare 17 Sep '08

17 Sep '08

Hello I know the obvious and goes against what it was made for, but... Is there a way to use STunnel as a relay server w/o SSL? IOW, if you put STunnel in a number of installations but one or more PCs need a non-SSL server, can they use it? It would beat having to install "2" relay servers on each PC. -- Thanks, ~ Thomas O'Hare ~ Web, Wireless, Network, Database & Systems Software/Hardware Operations Manager | Virtual FoxPro User Group Tom(a)VFUG.Org | http://www.VFUG.Org/

1 0

STunnel as a Relay server
by Thomas O'Hare 16 Sep '08

16 Sep '08

I know this is against what STunnel was made for but... There are Stunnel installations on client PCs but they also need to use STunnel to also send to non-SSL entities -- since it is easier then installing 2 relay/proxy servers. Is there a way to make STunnel into a non-SSL relay server? -- Thanks, ~ Thomas O'Hare ~ Web, Wireless, Network, Database & Systems Software/Hardware Operations Manager | Virtual FoxPro User Group Tom(a)VFUG.Org | http://www.VFUG.Org/

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users