- stunnel-users - stunnel.org

Connection rejected: too many clients (>=500)?
by Chris Charman 18 Nov '08

18 Nov '08

Hey folks -- Can anyone tell me where the max number of clients is configured in 4.21? I'm running okay for a while, but then I end up with repeated messages as below in the logs: 2008.11.18 19:13:33 LOG7[26491:46912520933328]: https accepted FD=512 from xx.xx.xx.xx:xxxxx 2008.11.18 19:13:33 LOG4[26491:46912520933328]: Connection rejected: too many clients (>=500) 2008.11.18 19:13:33 LOG7[26491:46912520933328]: https accepted FD=512 from xx.xx.xx.xx:xxxxx 2008.11.18 19:13:33 LOG4[26491:46912520933328]: Connection rejected: too many clients (>=500) 2008.11.18 19:13:33 LOG7[26491:46912520933328]: https accepted FD=512 from xx.xx.xx.xx:xxxxx 2008.11.18 19:13:33 LOG4[26491:46912520933328]: Connection rejected: too many clients (>=500) [...] I've only seen reports of this problem, but no solution. Anyone out there who can help? Thanks in advance! -Chris ------------- Config below ----------------- ulimit unlimited stunnel -version stunnel 4.21 on x86_64-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none uname -a Linux domU-12-31-39-01-61-B2 2.6.21.7-2.fc8xen #1 SMP Fri Feb 15 12:34:28 EST 2008 x86_64 GNU/Linux stunnel -sockets Socket option defaults: Option Accept Local Remote OS default SO_DEBUG -- -- -- 0 SO_DONTROUTE -- -- -- 0 SO_KEEPALIVE -- -- -- 0 SO_LINGER -- -- -- 0:0 SO_OOBINLINE -- -- -- 0 SO_RCVBUF -- -- -- 87380 SO_SNDBUF -- -- -- 16384 SO_RCVLOWAT -- -- -- 1 SO_SNDLOWAT -- -- -- 1 SO_RCVTIMEO -- -- -- 0:0 SO_SNDTIMEO -- -- -- 0:0 SO_REUSEADDR 1 -- -- 0 SO_BINDTODEVICE -- -- -- -- IP_TOS -- -- -- 0 IP_TTL -- -- -- 64 TCP_NODELAY -- -- -- 0 gcc -v Using built-in specs. Target: x86_64-linux-gnu Configured with: ../src/configure -v --enable-languages=c,c++,fortran,objc,obj-c++,treelang --prefix=/usr --enable-shared --with-system-zlib --libexecdir=/usr/lib --without-included-gettext --enable-threads=posix --enable-nls --with-gxx-include-dir=/usr/include/c++/4.2 --program-suffix=-4.2 --enable-clocale=gnu --enable-libstdcxx-debug --enable-objc-gc --enable-mpfr --enable-checking=release --build=x86_64-linux-gnu --host=x86_64-linux-gnu --target=x86_64-linux-gnu Thread model: posix gcc version 4.2.3 (Ubuntu 4.2.3-2ubuntu7) openssl version OpenSSL 0.9.8g 19 Oct 2007

2 2

Re: [stunnel-users] Cannot connect to SBC/yahoo to send (or telnet)
by James Moe 18 Nov '08

18 Nov '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 11/18/08 10:17 am, James Moe wrote: > Hello, > Stunnel v4.20. > When connecting to SBC/Yahoo, the session is terminated > with a "bad certificate" message. See the log below. The tech folks claim > all is well at their end. > Is there something I am missing here? > Here is the conf file: > My apologies. I lost control of the email program and it sent this message here instead of to a local host. - -- jimoe (at) sohnen-moe (dot) com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (OS/2) iD8DBQFJIvmqzTcr8Prq0ZMRAsb2AJ9ROwt9FH4GpfyNWQ020rpGmC7K/wCdGhdW Bs96qyJjjXSA9d+AwVktAac= =+UNT -----END PGP SIGNATURE-----

1 0

Proxy support
by Reinier van der Gugten 18 Nov '08

18 Nov '08

Oops.. That's exactly what I meant... However What is the correct configuration in that case? E.g. I want to connect to an external location at: Myserver.com:443 The proxy is at: CustomerProxy:8080 And my application runs at the customer talking to: localhost:1433 The proxy does not require authentication. Looking at the docuemtation you linked me I found this example: CONNECT server.example.com:80 HTTP/1.1 Host: server.example.com:80 Proxy-Authorization: basic aGVsbG86d29ybGQ= Using my addresses, where goes what? CONNECT CustomerProxy:8080 HTTP/1.1 Host: Myserver.com:443 // Proxy-Authorization: basic aGVsbG86d29ybGQ= Kind regards, Reinier -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Michal Trojnara Sent: vrijdag 14 november 2008 15:04 To: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Proxy support On Fri, 14 Nov 2008 14:53:20 +0100, "Reinier van der Gugten" <info(a)rgit.eu> wrote: > Has someone got a working version of STunnel that can handle a proxy? Do you mean client mode CONNECT protocol support (RFC 2817 section 5.2)? http://www.ietf.org/rfc/rfc2817.txt It's supported in stunnel since version 4.15 (released 2006.03.11). Best regards, Mike _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 1

Re: [stunnel-users] Help - Getting stunnel compiled on windows and using a patch
by Reinier van der Gugten 14 Nov '08

14 Nov '08

Thanks so mucht for this information! I had to make the folowing changes as well: Set the Compile with common language runtime to: No common language runtime support for each .h file If I do that, the error: Command line error D8045: cannot compile C file 'src\client.c' with the /clr option disappears (Next I got an error in the resouce.rc file with the LTEXT VERSION... So I // that out) Next I get about 121 errors, like: Error LNK2001: unresolved external symbol _main ... symbol _num_clients etc. Any ideas? Kind regards, Reinier ________________________________ From: DMILE525 [mailto:[email protected]] Sent: donderdag 13 november 2008 23:23 To: Reinier van der Gugten Subject: Re: [stunnel-users] Help - Getting stunnel compiled on windows and using a patch on Windows: install Win32 OpenSSL http://www.slproweb.com/products/Win32OpenSSL.html <wlmailhtml:{86BCE398-B6B8-40AD-8A3D-BE759753A203}mid://00000009/!x-usc: http://www.slproweb.com/products/Win32OpenSSL.html> install VS2008 (I'm using free VS2008 C++ Express Edition http://www.microsoft.com/express/download/ <wlmailhtml:{86BCE398-B6B8-40AD-8A3D-BE759753A203}mid://00000009/!x-usc: http://www.microsoft.com/express/download/> ) The first thing to do (assuming a default installation of 'C:\OpenSSL') is to go to 'C:\OpenSSL\lib\VC' and copy all of the files to your Visual C++ 'lib' directory. This directory is sometimes located in a somewhat cryptic location such as 'C:\Program Files (x86)\Microsoft Visual Studio 9.0\VC\lib' or 'C:\Program Files\Microsoft Visual Studio 9.0\VC\lib'. Next, copy everything in the 'C:\OpenSSL\include' directory to your Visual C++ 'include' directory. create new empty project add to project: stunnel.c ssl.c ctx.c verify.c file.c client.c protocol.c sthreads.c log.c options.c network.c resolver.c gui.c common.h prototypes.h resources.h stunnel.ico resources.rc "Configuration properties -> Linker -> input -> additional properties" add wsock32.lib ssleay32.lib libeay32.lib "Configuration properties -> General -> character set" set "Use Multi-Byte Character Set" in common.h after #ifndef COMMON_H #define COMMON_H add #define USE_WIN32 #define _CRT_SECURE_NO_DEPRECATE #define _CRT_NONSTDC_NO_DEPRECATE //#define HAVE_GETADDRINFO //#define HAVE_GETNAMEINFO #ifndef _MBCS #define _MBCS #endif #define VERSION "4.26" #if defined _M_IX86 #pragma comment(linker, "/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*'\"") #elif defined _M_IA64 #pragma comment(linker, "/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='ia64' publicKeyToken='6595b64144ccf1df' language='*'\"") #elif defined _M_X64 #pragma comment(linker, "/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='amd64' publicKeyToken='6595b64144ccf1df' language='*'\"") #else #pragma comment(linker, "/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='*' publicKeyToken='6595b64144ccf1df' language='*'\"") #endif On Wed, Nov 12, 2008 at 6:50 PM, Reinier van der Gugten <info(a)rgit.eu> wrote: Hello, I am trying to compile STunnel. I'd rather not, but the pre-compiled version does not support a proxy server. So I hop you will be able to help me, or point me to a good howto on how to compile stunnel using windows and a patch from the patch-list. Or does someone have a compiled (windows) version with proxy support? If so, please mail it to me. Or tell me where to find more detailed information pls. - Next thing I will try is to install linux on a computer in order to try it that way... Greetings, Reinier. _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 2

Strange CRL verification behaviour
by Christophe Nanteuil 03 Nov '08

03 Nov '08

With stunnel 4.26 (or ealier), in order to verify revocation of clients' certificates, I use this configuration file : -------------------8<------------------ CAfile=/etc/ssl/stunnel/ca_certs.pem CRLfile=/etc/ssl/stunnel/crl.pem cert=/etc/ssl/stunnel/server.pem key=/etc/ssl/stunnel/server.key sslVersion=TLSv1 verify=2 [WEB] accept=8080 connect=127.0.0.1:3128 ------------------->8------------------ 1/ If there is no CRLfile when stunnel starts, stunnel dies and logs show "Failed to load /etc/ssl/stunnel/crl.pem revocation lookup file" -> ok. 2/ If the CRLfile is correct, stunnel starts. When the CRL expires, stunnel rejects any new connection. Logs then show : " Found CRL is expired - revoking all certificates until you get updated CRL" -> ok 3/ If the CRLfile is not a valid CRL, stunnel starts and ignores the CRLfile. Then, for any new connection, logs show "CRL: verification passed". -> NOT ok, IMO. examples of wrong CRLs : a CRL issued by an unknown CA or a certificate in the PEM format. This can happen when the CRL expires (soon) and the administrator puts a "new one" but misfits files. He then restarts stunnel, which works. This behaviour can be annoying because the logs of CRL are now in level 6 (INFO) and not any more in level 5 (NOTICE). My configuration was in debug=5 and logs showed only "CRL: verification passed", I could not determine what CRL was really used. I propose the attached patch to modify behaviour in case 3/, ie if no CRL corresponding to the issuer of each certificate of the chain is found : - reject connection if CRLdir or CRLfile was specified in the config file - accept connection but warn in logs if the use of CRL was not explicitly set in the config file. NB : the source code of function "crl_check" shows "/* based on BSD-style licensed code of mod_ssl */". I looked into the code of "mod_ssl-2.8.31-1.3.41" (file pkg.sslmod/ssl_engine_kernel.c, line 1601-1769) and there is actually the same behaviour. -- Christophe Nanteuil

1 0

Spawning a shell
by Tobias Dussa 29 Oct '08

29 Oct '08

Hi everybody, maybe I'm missing something real obvious here, but I can't figure out what's going wrong. I'm trying to make stunnel spawn a regular shell when it gets a connect. As far as I understand, the pty option should allocate a virtual tty, so I ought to be able to just exec() a shell. However, this won't work; apparently some more magic is required. I do get the basic interactive functionality to work (i. e., I can enter, say, ls and get back a directory listing), but the terminal won't work properly: Unwanted echoes (stty -echo doesn't help). Furthermore, for some reason stderr is not connected to the new pty but sticks to stunnel's original pty. I have tried spawning a shell directly from stunnel (with exec), spawning a script which redirects stdin/-out/-err to the proper pty, then execs a shell, spawning a script which execs login, spawning a script which execs getty. (The latter being closest to what I want, but not good enough.) I'm running out of ideas. Anyone ever did this? Any comments? (Incidentally, if anyone has a better idea how to create the possibility to log in with an X.509 certificate without using stunnel, I'm all ears.) I'm running stunnel4 on Debian etch: --- stunnel 4.18 on i486-pc-linux-gnu with OpenSSL 0.9.8c 05 Sep 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none --- Cheers, Toby. -- The nine most terrifying words in the English language are: I'm from the government and I'm here to help. ---Ronald Reagan

3 2

Thanks for solving my problem!
by editor 20 Oct '08

20 Oct '08

Hi: Thanks! I commented out the "Verify" option within the configuration file and restarted the application. I can use it POP3S & HTTPS with the Nokia & Sony-Ericsson mobiles fine now as well as Thunderbird. I will check with Outlook next. Window's mobile is complaining it can not create a SSL session however. I think it has to do with the public certificate I use in the mail host. Godaddy uses this two part public certificate and the Network Solutions is a single file. I am hoping in a new release of Stunnel, it can support a two part public certificate. Thanks again!!! Kevin > > > > > > ------------------------------ > > > > Message: 2 > > Date: Sun, 19 Oct 2008 21:17:29 -0700 (PDT) > > From: Algol Tradent <tradent(a)yahoo.com> > > Subject: Re: [stunnel-users] Version 4.26 and using to secure IMAPS & > > POP3 > > To: stunnel-users(a)mirt.net > > Message-ID: <710279.38955.qm(a)web62003.mail.re1.yahoo.com> > > Content-Type: text/plain; charset=us-ascii > > > > Hello, > > > > I think your problem is on your config file for the server. On your config file you have the following option > > > > # Authentication stuff > > verify = 3 > > > > You probably don't want this option set. Because you are asking the client and the server to authenticate each other based on certificates... which I don;t think is the case here. > > > > On your log file there is this line which is a good indicator of your problem. > > > > routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate > > > > I hope this helps > >

1 0

Version 4.26 and using to secure IMAPS & POP3
by Editor (Kevin) 20 Oct '08

20 Oct '08

Hi: I upgraded to the current 4.26 as I was having an issue with 4.15. The idea is to secure IMAP traffic as well as inbound SMTP. The email client is the latest Thunderbird and seems to be very stable. The mail Host is a Sun E-250 with current patches for Solaris 9. Note: I am using a public certificate and as it from "godaddy.com", it is this unusual two part certificate. This may be where the problem is as I had to combine the two public certificate files together (maybe the next version of STUNNEL could do this automatically so the risk of errors is reduced!). However, using STUNNEL, I am having an issue connecting as I get a strange error message and the connection dies. Error Log: 2008.10.19 13:10:41 LOG7[2104:1]: imaps accepted FD=0 from 80.38.96.194:4129 2008.10.19 13:10:41 LOG7[2104:3]: imaps started 2008.10.19 13:10:41 LOG7[2104:3]: FD 0 in non-blocking mode 2008.10.19 13:10:41 LOG7[2104:1]: Cleaning up the signal pipe 2008.10.19 13:10:41 LOG7[2104:3]: TCP_NODELAY option set on local socket 2008.10.19 13:10:41 LOG7[2104:3]: Waiting for a libwrap process 2008.10.19 13:10:41 LOG7[2104:3]: Acquired libwrap process #0 2008.10.19 13:10:41 LOG7[2104:1]: Cleaning up the signal pipe 2008.10.19 13:10:41 LOG7[2104:3]: Releasing libwrap process #0 2008.10.19 13:10:41 LOG7[2104:3]: Released libwrap process #0 2008.10.19 13:10:41 LOG7[2104:1]: Cleaning up the signal pipe 2008.10.19 13:10:41 LOG7[2104:3]: imaps permitted by libwrap from 80.38.96.194:4129 2008.10.19 13:10:41 LOG5[2104:3]: imaps accepted connection from 80.38.96.194:4129 2008.10.19 13:10:41 LOG7[2104:3]: SSL state (accept): before/accept initialization 2008.10.19 13:10:41 LOG7[2104:3]: SSL state (accept): SSLv3 read client hello A 2008.10.19 13:10:41 LOG7[2104:3]: SSL state (accept): SSLv3 write server hello A 2008.10.19 13:10:41 LOG7[2104:1]: Cleaning up the signal pipe 2008.10.19 13:10:41 LOG7[2104:3]: SSL state (accept): SSLv3 write certificate A 2008.10.19 13:10:41 LOG7[2104:3]: SSL state (accept): SSLv3 write certificate request A 2008.10.19 13:10:41 LOG7[2104:3]: SSL state (accept): SSLv3 flush data 2008.10.19 13:10:42 LOG7[2104:3]: SSL alert (read): warning: no certificate 2008.10.19 13:10:42 LOG7[2104:1]: Cleaning up the signal pipe 2008.10.19 13:10:42 LOG7[2104:3]: SSL alert (write): fatal: handshake failure 2008.10.19 13:10:42 LOG3[2104:3]: SSL_accept: 140890C7: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate 2008.10.19 13:10:42 LOG7[2104:1]: Cleaning up the signal pipe 2008.10.19 13:10:42 LOG5[2104:3]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.10.19 13:10:42 LOG7[2104:1]: Cleaning up the signal pipe 2008.10.19 13:10:42 LOG7[2104:3]: imaps finished (0 left) See the weird no client peer handshake???? The configuration file: # more /usr/local/etc/stunnel/stunnel.conf # stunnel configuration file # Use to provide ssl protection for https, pop3 and imap # # Setting up the root jail chroot = /usr/local/var/stunnel # # The PID is created inside chroot jail pid = /stunnel.pid setuid = nobody setgid = nogroup ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /usr/local/var/lib/stunnel/ setuid = nobody setgid = nogroup ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 # Authentication stuff verify = 3 # Certicates to use # cert = /usr/local/etc/stunnel/stunnel.pem CAfile = /usr/local/etc/stunnel/_.cellmail.com.crt # SSLCertificateChainFile = /usr/local/etc/stunnel/gd_intermediate_bundle.crt # Some debugging stuff debug = 7 output = /var/log/stunnel.log # Use it for client mode #client = yes # Service-level configuration [pop3s] accept = 199.4.110.39:995 connect = 110 [imaps] accept = 199.4.110.39:993 connect = 143 [ssmtp] accept = 199.4.110.39:465 connect = frog.cellmail.com:25 # TIMEOUTclose = 0 The startup log: 2008.10.19 13:02:50 LOG7[2077:1]: Snagged 64 random bytes from /export/home/kgreene/.rnd 2008.10.19 13:02:50 LOG7[2077:1]: Wrote 1024 new random bytes to /export/home/kgreene/.rnd 2008.10.19 13:02:50 LOG7[2077:1]: RAND_status claims sufficient entropy for the PRNG 2008.10.19 13:02:50 LOG7[2077:1]: PRNG seeded successfully 2008.10.19 13:02:50 LOG7[2077:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2008.10.19 13:02:50 LOG7[2077:1]: Certificate loaded 2008.10.19 13:02:50 LOG7[2077:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2008.10.19 13:02:50 LOG7[2077:1]: Private key loaded 2008.10.19 13:02:50 LOG7[2077:1]: Loaded verify certificates from /usr/local/etc/stunnel/_.cellmail.com.crt 2008.10.19 13:02:50 LOG7[2077:1]: Loaded /usr/local/etc/stunnel/_.cellmail.com.crt revocation lookup file 2008.10.19 13:02:50 LOG7[2077:1]: SSL context initialized for service pop3s 2008.10.19 13:02:50 LOG7[2077:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2008.10.19 13:02:50 LOG7[2077:1]: Certificate loaded 2008.10.19 13:02:50 LOG7[2077:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2008.10.19 13:02:50 LOG7[2077:1]: Private key loaded 2008.10.19 13:02:50 LOG7[2077:1]: Loaded verify certificates from /usr/local/etc/stunnel/_.cellmail.com.crt 2008.10.19 13:02:50 LOG7[2077:1]: Loaded /usr/local/etc/stunnel/_.cellmail.com.crt revocation lookup file 2008.10.19 13:02:50 LOG7[2077:1]: SSL context initialized for service imaps 2008.10.19 13:02:50 LOG7[2077:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2008.10.19 13:02:50 LOG7[2077:1]: Certificate loaded 2008.10.19 13:02:50 LOG7[2077:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2008.10.19 13:02:50 LOG7[2077:1]: Private key loaded 2008.10.19 13:02:50 LOG7[2077:1]: Loaded verify certificates from /usr/local/etc/stunnel/_.cellmail.com.crt 2008.10.19 13:02:50 LOG7[2077:1]: Loaded /usr/local/etc/stunnel/_.cellmail.com.crt revocation lookup file 2008.10.19 13:02:50 LOG7[2077:1]: SSL context initialized for service ssmtp 2008.10.19 13:02:50 LOG5[2077:1]: stunnel 4.26 on sparc-sun-solaris2.9 with OpenSSL 0.9.8h 28 May 2008 2008.10.19 13:02:50 LOG5[2077:1]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.10.19 13:02:50 LOG6[2077:1]: file ulimit = 256 (can be changed with 'ulimit -n') 2008.10.19 13:02:50 LOG6[2077:1]: poll() used - no FD_SETSIZE limit for file descriptors 2008.10.19 13:02:50 LOG5[2077:1]: 125 clients allowed 2008.10.19 13:02:50 LOG7[2077:1]: FD 11 in non-blocking mode 2008.10.19 13:02:50 LOG7[2077:1]: FD 12 in non-blocking mode 2008.10.19 13:02:50 LOG7[2077:1]: FD 13 in non-blocking mode 2008.10.19 13:02:50 LOG7[2077:1]: SO_REUSEADDR option set on accept socket 2008.10.19 13:02:50 LOG7[2077:1]: pop3s bound to 199.4.110.39:995 2008.10.19 13:02:50 LOG7[2077:1]: FD 14 in non-blocking mode 2008.10.19 13:02:50 LOG7[2077:1]: SO_REUSEADDR option set on accept socket 2008.10.19 13:02:50 LOG7[2077:1]: imaps bound to 199.4.110.39:993 2008.10.19 13:02:50 LOG7[2077:1]: FD 15 in non-blocking mode 2008.10.19 13:02:50 LOG7[2077:1]: SO_REUSEADDR option set on accept socket 2008.10.19 13:02:50 LOG7[2077:1]: ssmtp bound to 199.4.110.39:465 2008.10.19 13:02:50 LOG7[2083:1]: Created pid file /stunnel.pid 2008.10.19 13:02:50 LOG7[2083:1]: Cleaning up the signal pipe

2 1

forgeground=no with pppd and pty=yes?
by Sandeep Kumar 15 Oct '08

15 Oct '08

Hi, I want to encrypt pppd, but stunnel should start in background mode. But as soon as I set foreground=no, ppp is unable to connect. Is this not possible ? -- Sandeep Kumar http://students.iiit.ac.in/~sandeep_kr

1 0

Setting up a POP3 connection through stunnel?
by Ben Stover 13 Oct '08

13 Oct '08

Assume currently I retrieve my emails from my mailbox unencrypted with the following info: pop3.mydomain.com port=110 Now I want to switch to an encrypted POP3 mail connection. with the following information pop3.mydomain.com port=777 Can I simply write now in the conf file: [myownsetup] accept = 127.0.0.1:110 connect = pop3.mydomain.com:777 Is this sufficient? Ben

2 1

Question (new user!) how to get it to work? - SQL
by Reinier van der Gugten 10 Oct '08

10 Oct '08

Hi, I read most of the messages and tutorials, but still I do not seem to get it to work. I want to achieve the following: Client side: VB application communicating to a SQL server over port 1433. Server side: Lisning on port 1433 that is lisned to by SQL 2005. However this is not allowed evrywhere, so stunnel comes into play. Client side: VB application communicating to localhost on port 1433 Stunnel installed lisning on port 1433 and passing it on to port 80 (Note for later: I would like to use SSL, so it will pass through routers, But for the test it will suffice to keep it unencrypted. Also the server is still local and could be reached directly. But it should work fine for testing.) Server: Stunnel installed as service lisning on port 80 and transmitting it to port 1433 (later to be moved to 443, as I also run a HTTP server) The config file looks like this: ------------------------------------------------- Client: ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 ;output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [SQLServer] accept = 127.0.0.1:1433 connect = 10.12.18.10:80 ------------------------------------------------- Server: ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 ;output = stunnel.log ; Use it for client mode ;client = yes ; Service-level configuration [SQL] accept = 80 connect = localhost:1433 ------------------------------------------------- As you can see, I tried to keep as close to the example file as I could. Looking forward to getting this to work and then to including ssl... Kind regards, Reinier.

1 0

Stunnel 4.26 Not working
by natalie burdick 30 Sep '08

30 Sep '08

I just upgraded from Sony to IBM laptop, in doing so, I installed latest version of Stunnel for use with my pop email client. I am running Stunnel 4.26 on Windows XP Here is my stunnel log: 2008.09.29 20:48:44 LOG5[2568:4088]: stunnel 4.26 on x86-pc-mingw32-gnu with OpenSSL 0.9.8i 15 Sep 2008 2008.09.29 20:48:44 LOG5[2568:4088]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2008.09.29 20:48:44 LOG5[2568:1628]: No limit detected for the number of clients It was working until I upgraded to this version, now when I use my client to check or send email, it just says that it's connecting to the server but never actually does. I can provide my conf

2 2

set process name support in stunnel?
by Hank Leininger 28 Sep '08

28 Sep '08

Has anybody patched stunnel to modify its name in ps output, setproctitle-style, to tell more about itself? I'm thinking a config parameter "processname" which the user can specify in the service_name stanza (or just tack the service_name onto the end of the process title). I use stunnel mostly for ad-hoc client connections, or in a script to plug a perl script that knows how to fuzz IMAP, SMTP, etc into an SSL listener. For me the stunnel 3 command-line flag usage was ideal. But, I finally gave up and switched to using stunnel v4, usually piping a dynamically-generated config in on an fd. The downside with that is now instead of 'ps' showing useful, differentiating commandline flags for each stunnel process, I just have dozens of 'stunnel -fd 0's. It's possible to track down who's going where (netstat -antp, etc) but that's painful. Being able to set an arbitrary, meaningful-to-humans process name (or extra tag, etc) from config entries would resolve this, and might be useful for people with more conventional uses for stunnel. Thanks, -- Hank Leininger <hlein(a)korelogic.com> BE5D FCCA 673B D18B 98A9 3175 896E 3D4A 1B4D C5AC

1 0

Re: [stunnel-users] Stunnel License
by Bansal, Gaurav (Gaurav) 24 Sep '08

24 Sep '08

We are compiling stunnel source without any modification for different platform supported of our product. Then we are running stunnel as a standalone process after making changes to stunnel.conf file. In stunnel.conf file we are providing location of certificates and ports to be used We would distribute stunnel binary along with our product. Given the scenario I have mentioned do you foresee legal problems in usage of stunnel. I understand that OpenSSL uses OpenSSL license but I got this for openssl website. ==================================================== On many systems including the major Linux and BSD distributions, yes (the GPL does not place restrictions on using libraries that are part of the normal operating system distribution). On other systems, the situation is less clear. Some GPL software copyright holders claim that you infringe on their rights if you use OpenSSL with their software on operating systems that don't normally include OpenSSL. If you develop open source software that uses OpenSSL, you may find it useful to choose another license than the GPL, or state explicitly that "This program is released under the GPL with the additional exemption that compiling, linking, and/or using OpenSSL is allowed." If you are using GPL software developed by others, you may want to ask the copyright holder for permission to use their software with OpenSSL. ===================================================== Specifically I am concerned if Stunnel states that compiling, linking, and/or using OpenSSL is allowed Thanks Gaurav ________________________________ From: Bansal, Gaurav (Gaurav) Sent: Wednesday, September 24, 2008 5:27 PM To: 'webmaster(a)stunnel.org'; 'stunnel-users(a)mirt.net'; 'stunnel-users-owner(a)mirt.net'; 'Michal.Trojnara(a)mirt.net' Subject: Stunnel License Hi, We are planning to use Stunnel to encrypt traffic between Apache mod_jk and AJP connector of JBoss Tomcat. It seems that Stunnel uses OpenSSL APIs. Since Stunnel is available under GPL license, the license terms prevents us from using Stunnel in our product since it exposes OpenSSL which is also available under GPL license. I would like to know if there is also a commercial license available for stunnel? I would appreciate if you can throw pointers on how to package Stunnel with a commercial product. Thank Gaurav

2 1

Stunnel License
by Bansal, Gaurav (Gaurav) 24 Sep '08

24 Sep '08

Hi, We are planning to use Stunnel to encrypt traffic between Apache mod_jk and AJP connector of JBoss Tomcat. It seems that Stunnel uses OpenSSL APIs. Since Stunnel is available under GPL license, the license terms prevents us from using Stunnel in our product since it exposes OpenSSL which is also available under GPL license. I would like to know if there is also a commercial license available for stunnel? I would appreciate if you can throw pointers on how to package Stunnel with a commercial product. Thank Gaurav

1 0

Re: [stunnel-users] Compiled Stunnel 4.25 with OpenSSL 0.9.8h
by Nelgraine 22 Sep '08

22 Sep '08

Thanks for your reply. I’ve found out that Solaris 10 machine has default OpenSSL 0.9.7d located in /usr/local/ssl/bin. Update OpenSSL 0.9.8h using this command: ../config -fPIC shared no-idea threads make depend make make test make install But unfortunately the gcc link to old openssl 0.9.7d. How to update the link in gcc? Any help would be greatly appreciated. Thanks! Regards, Nelgraine --- On Sun, 9/21/08, stunnel-users-request(a)mirt.net <stunnel-users-request(a)mirt.net> wrote: > From: stunnel-users-request(a)mirt.net <stunnel-users-request(a)mirt.net> > Subject: stunnel-users Digest, Vol 50, Issue 15 > To: stunnel-users(a)mirt.net > Date: Sunday, September 21, 2008, 6:00 PM > Send stunnel-users mailing list submissions to > stunnel-users(a)mirt.net > > To subscribe or unsubscribe via the World Wide Web, visit > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body > 'help' to > stunnel-users-request(a)mirt.net > > You can reach the person managing the list at > stunnel-users-owner(a)mirt.net > > When replying, please edit your Subject line so it is more > specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. stunnel 4.26 released (Michal Trojnara) > 2. Re: Compiled Stunnel 4.25 with OpenSSL 0.9.8h > on Solaris 10 > (Michal Trojnara) > 3. stunnel 4.26 released (Michal Trojnara) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 20 Sep 2008 23:13:50 +0200 > From: Michal Trojnara <Michal.Trojnara(a)mobi-com.net> > Subject: [stunnel-users] stunnel 4.26 released > To: 'stunnel-users(a)mirt.net' > <stunnel-users(a)mirt.net>, > stunnel-announce(a)mirt.net, openssl-users(a)openssl.org > Message-ID: > <86cf5ffd468849a8dba392b1d3bc6bb3(a)mobi-com.net> > Content-Type: text/plain; charset=US-ASCII; format=flowed > > Dear Users, > > Version 4.26, 2008.09.20, urgency: MEDIUM: > * New features > - Win32 DLLs for OpenSSL 0.9.8i. > - /etc/hosts.allow and /etc/hosts.deny no longer need to > be copied to > the chrooted directory, as the libwrap processes are no > longer > chrooted. > - A more informative error messages for invalid port > number specified > in stunnel.conf file. > - Support for Microsoft Visual C++ 9.0 Express Edition. > * Bugfixes > - Killing all libwrap processes at stunnel shutdown > fixed. > - A minor bug in stunnel.init sample SysV startup file > fixed. > > Home page/download: http://stunnel.mirt.net/ > > sha1sum for stunnel-4.24.tar.gz file: > 1c9f5dd6b21f354c356cd9100899a90a83068c68 > > Best regards, > Mike > > > > ------------------------------ > > Message: 2 > Date: Sun, 21 Sep 2008 00:13:07 +0200 > From: Michal Trojnara <Michal.Trojnara(a)mobi-com.net> > Subject: Re: [stunnel-users] Compiled Stunnel 4.25 with > OpenSSL 0.9.8h > on Solaris 10 > To: 'stunnel-users(a)mirt.net' > <stunnel-users(a)mirt.net> > Message-ID: > <6cb62b05bc25b1da1f8992ceadb133d4(a)mobi-com.net> > Content-Type: text/plain; charset=US-ASCII; format=flowed > > On 2008-09-19, at 04:36, Nelgraine wrote: > > Undefined first referenced > > symbol in file > > BIO_set_flags protocol.o > > SSL_CTX_set_info_callback ctx.o > > ld: fatal: Symbol referencing errors. No output > written to stunnel > > Is it possible that your system has more than one copy of > the OpenSSL > libraries? > Maybe gcc tries to link against the old ones instead of the > new ones? > > > 1. Should I need to upgrade OpenSSL 0.9.8h into > OpenSSL 0.9.8i? > > I don't think this could cause your problem. > > > 2. I have installed openssl 0.9.8h on Solaris 10 and > created several > > ca certificates. > > - If I will upgrade OpenSSL 0.9.8h into OpenSSL > 0.9.8i, should I > > also recreate ca certificates? > > No, you don't have to recreate your certificates. > > Best regards, > Mike > > > > ------------------------------ > > Message: 3 > Date: Sat, 20 Sep 2008 23:13:50 +0200 > From: Michal Trojnara <Michal.Trojnara(a)mobi-com.net> > Subject: [stunnel-users] stunnel 4.26 released > To: 'stunnel-users(a)mirt.net' > <stunnel-users(a)mirt.net>, > stunnel-announce(a)mirt.net, openssl-users(a)openssl.org > Message-ID: > <86cf5ffd468849a8dba392b1d3bc6bb3(a)mobi-com.net> > Content-Type: text/plain; charset=US-ASCII; format=flowed > > Dear Users, > > Version 4.26, 2008.09.20, urgency: MEDIUM: > * New features > - Win32 DLLs for OpenSSL 0.9.8i. > - /etc/hosts.allow and /etc/hosts.deny no longer need to > be copied to > the chrooted directory, as the libwrap processes are no > longer > chrooted. > - A more informative error messages for invalid port > number specified > in stunnel.conf file. > - Support for Microsoft Visual C++ 9.0 Express Edition. > * Bugfixes > - Killing all libwrap processes at stunnel shutdown > fixed. > - A minor bug in stunnel.init sample SysV startup file > fixed. > > Home page/download: http://stunnel.mirt.net/ > > sha1sum for stunnel-4.24.tar.gz file: > 1c9f5dd6b21f354c356cd9100899a90a83068c68 > > Best regards, > Mike > > ______________________________________________________________________ > OpenSSL Project > http://www.openssl.org > User Support Mailing List > openssl-users(a)openssl.org > Automated List Manager > majordomo(a)openssl.org > > > ------------------------------ > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > End of stunnel-users Digest, Vol 50, Issue 15 > *********************************************

1 0

Compiled Stunnel 4.25 with OpenSSL 0.9.8h on Solaris 10
by Nelgraine 20 Sep '08

20 Sep '08

Ive read this article Compiling Stunnel 4.21 on Solaris 10 http://stunnel.mirt.net/pipermail/stunnel-users/2008-March/001895.html I've been also experiencing this kind of problem but I've Compiled Stunnel 4.25 with OpenSSL 0.9.8h on Solaris 10. Configure: # ./configure --prefix=/usr/local/stunnel-4.25 --with-ssl=/usr/local/openssl-0.9.8h configure: **************************************** success Make Error: gcc -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/local/openssl-0.9.8h/include -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o pty.o libwrap.o -lz -ldl -lsocket -lnsl -lpthread -L/usr/local/openssl-0.9.8h/lib -lssl -lcrypto -lwrap Undefined first referenced symbol in file BIO_set_flags protocol.o SSL_CTX_set_info_callback ctx.o ld: fatal: Symbol referencing errors. No output written to stunnel My Question is: 1. Should I need to upgrade OpenSSL 0.9.8h into OpenSSL 0.9.8i? 2. I have installed openssl 0.9.8h on Solaris 10 and created several ca certificates. - If I will upgrade OpenSSL 0.9.8h into OpenSSL 0.9.8i, should I also recreate ca certificates? Any help would be greatly appreciated.

2 1

stunnel 4.26 released
by Michal Trojnara 20 Sep '08

20 Sep '08

Dear Users, Version 4.26, 2008.09.20, urgency: MEDIUM: * New features - Win32 DLLs for OpenSSL 0.9.8i. - /etc/hosts.allow and /etc/hosts.deny no longer need to be copied to the chrooted directory, as the libwrap processes are no longer chrooted. - A more informative error messages for invalid port number specified in stunnel.conf file. - Support for Microsoft Visual C++ 9.0 Express Edition. * Bugfixes - Killing all libwrap processes at stunnel shutdown fixed. - A minor bug in stunnel.init sample SysV startup file fixed. Home page/download: http://stunnel.mirt.net/ sha1sum for stunnel-4.24.tar.gz file: 1c9f5dd6b21f354c356cd9100899a90a83068c68 Best regards, Mike

1 0

Re: [stunnel-users] STunnel as a Relay server
by Ludolf Holzheid 19 Sep '08

19 Sep '08

On Thu, 2008-09-18 15:02:56 -0400, Thomas O'Hare wrote: > Ludolf > > Just got this as the main mail server was down for several days. > > The Win EXE that installs the STunnel service is what I meant. Is there > a way to edit the configuration text file to skip tunneling. There is > an ancient app on some PCs that can use only port 25 and we want to use > STunnel to do both SSL & non-SSL relays so we do not have to install & > maintain 2 different packages to basically do the same thing. Thomas, Of course, you get a clear-text port redirector if you connect two instances of stunnel running on the same machine, one acting as client, the other one as server. But again, I think this is oversized and not easier to set up than a simple TCP port redirector. Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Bug in tools stunnel.init
by Kevin A. McGrail 17 Sep '08

17 Sep '08

Hi Michael, I've upgraded to stunnel 4.25 and found a few small bugs in the init script. In stunnel.init.in, I'm pretty sure the DAEMON line should be DAEMON=@prefix@/bin/stunnel and not DAEMON=@prefix@/etc/stunnel Also, when the parent process is killed with stop, I see Sep 17 14:34:16 server stunnel: warning: can't get client address: Bad file descriptor because the child processes seem to stick around. I've modified the init script to kill the main process using the pid file and then using pidof to identify and kill the remaining child processes. Is this expected behavior? regards, KAM

2 2

Non-SSL Relay
by Thomas O'Hare 17 Sep '08

17 Sep '08

Hello I know the obvious and goes against what it was made for, but... Is there a way to use STunnel as a relay server w/o SSL? IOW, if you put STunnel in a number of installations but one or more PCs need a non-SSL server, can they use it? It would beat having to install "2" relay servers on each PC. -- Thanks, ~ Thomas O'Hare ~ Web, Wireless, Network, Database & Systems Software/Hardware Operations Manager | Virtual FoxPro User Group Tom(a)VFUG.Org | http://www.VFUG.Org/

1 0

STunnel as a Relay server
by Thomas O'Hare 16 Sep '08

16 Sep '08

I know this is against what STunnel was made for but... There are Stunnel installations on client PCs but they also need to use STunnel to also send to non-SSL entities -- since it is easier then installing 2 relay/proxy servers. Is there a way to make STunnel into a non-SSL relay server? -- Thanks, ~ Thomas O'Hare ~ Web, Wireless, Network, Database & Systems Software/Hardware Operations Manager | Virtual FoxPro User Group Tom(a)VFUG.Org | http://www.VFUG.Org/

2 1

What is the difference between "all" and "SSLv3" for sslVersion?
by Christopher Hunt 14 Sep '08

14 Sep '08

Hi there, I would like to understand the difference between specifying an sslVersion of "all" vs "SSLv3" when I see that the client is attempting SSLv3. I have a Java 1.5 ssl client connecting to an stunnel endpoint. If I specify an sslVersion of "all" in my stunnel configuration then the client is able to connect. When I see it connect, it appears to have connected as SSLv3 i.e.: 2008.09.14 15:59:20 LOG7[98326:2690846624]: https accepted FD=12 from 127.0.0.1:59812 2008.09.14 15:59:20 LOG7[98326:2952859648]: https started 2008.09.14 15:59:20 LOG7[98326:2952859648]: FD 12 in non-blocking mode 2008.09.14 15:59:20 LOG7[98326:2952859648]: TCP_NODELAY option set on local socket 2008.09.14 15:59:20 LOG7[98326:2952859648]: Waiting for a libwrap process 2008.09.14 15:59:20 LOG7[98326:2952859648]: Acquired libwrap process #0 2008.09.14 15:59:20 LOG7[98326:2952859648]: Releasing libwrap process #0 2008.09.14 15:59:20 LOG7[98326:2952859648]: Released libwrap process #0 2008.09.14 15:59:20 LOG7[98326:2952859648]: https permitted by libwrap from 127.0.0.1:59812 2008.09.14 15:59:20 LOG5[98326:2952859648]: https accepted connection from 127.0.0.1:59812 2008.09.14 15:59:20 LOG7[98326:2952859648]: SSL state (accept): before/ accept initialization 2008.09.14 15:59:21 LOG7[98326:2952859648]: SSL state (accept): SSLv3 read client hello A etc. If I substitute "SSLv3" for the value of sslVersion then I get: 2008.09.14 15:56:26 LOG7[98297:2690846624]: https accepted FD=12 from 127.0.0.1:59795 2008.09.14 15:56:26 LOG7[98297:2952859648]: https started 2008.09.14 15:56:26 LOG7[98297:2952859648]: FD 12 in non-blocking mode 2008.09.14 15:56:26 LOG7[98297:2952859648]: TCP_NODELAY option set on local socket 2008.09.14 15:56:26 LOG7[98297:2952859648]: Waiting for a libwrap process 2008.09.14 15:56:26 LOG7[98297:2952859648]: Acquired libwrap process #0 2008.09.14 15:56:26 LOG7[98297:2952859648]: Releasing libwrap process #0 2008.09.14 15:56:26 LOG7[98297:2952859648]: Released libwrap process #0 2008.09.14 15:56:26 LOG7[98297:2952859648]: https permitted by libwrap from 127.0.0.1:59795 2008.09.14 15:56:26 LOG5[98297:2952859648]: https accepted connection from 127.0.0.1:59795 2008.09.14 15:56:26 LOG7[98297:2952859648]: SSL state (accept): before/ accept initialization 2008.09.14 15:56:27 LOG3[98297:2952859648]: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number I have also tried specifying "SSLv2" (client disconnected complaining that v2 was not supported) and "TLSv1" (yields the same error as "SSLv3". My version of stunnel is: stunnel 4.25 on i686-apple-darwin9.4.0 with OpenSSL 0.9.7l 28 Sep 2006 Thank you in advance for any explanation on the difference between "all" and "SSLv3". Kind regards, Christopher

1 0

Stunnel on Vista gets "readsocket: Connection reset by peer"
by Scarsdale_James＠emc.com 10 Sep '08

10 Sep '08

Hi, I'm trying to use stunnel 4.25 on Vista over the Microsoft Loopback Adapter, but I always get the following error shown next to ">>>" below. Note that the session seems to have been negotiated okay. I found some notes about using "Run as administrator", but I still get the same behavior with this. The same setup works fine on XP. Any ideas before I start looking at code? Thanks, Jim 2008.09.10 15:27:42 LOG7[2844:692]: RAND_status claims sufficient entropy for the PRNG 2008.09.10 15:27:42 LOG7[2844:692]: PRNG seeded successfully 2008.09.10 15:27:42 LOG7[2844:692]: Certificate: stunnel.pem 2008.09.10 15:27:42 LOG7[2844:692]: Certificate loaded 2008.09.10 15:27:42 LOG7[2844:692]: Key file: stunnel.pem 2008.09.10 15:27:42 LOG7[2844:692]: Private key loaded 2008.09.10 15:27:42 LOG7[2844:692]: SSL context initialized for service smb 2008.09.10 15:27:42 LOG5[2844:692]: stunnel 4.25 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2008.09.10 15:27:42 LOG5[2844:692]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2008.09.10 15:27:42 LOG5[2844:2656]: No limit detected for the number of clients 2008.09.10 15:27:42 LOG7[2844:2656]: FD 248 in non-blocking mode 2008.09.10 15:27:42 LOG7[2844:2656]: SO_REUSEADDR option set on accept socket 2008.09.10 15:27:42 LOG7[2844:2656]: smb bound to 192.168.0.253:139 2008.09.10 15:28:13 LOG7[2844:2656]: smb accepted FD=240 from 192.168.0.253:49238 2008.09.10 15:28:13 LOG7[2844:2656]: Creating a new thread 2008.09.10 15:28:13 LOG7[2844:2656]: New thread created 2008.09.10 15:28:13 LOG7[2844:2856]: smb started 2008.09.10 15:28:13 LOG7[2844:2856]: FD 240 in non-blocking mode 2008.09.10 15:28:13 LOG7[2844:2856]: TCP_NODELAY option set on local socket 2008.09.10 15:28:13 LOG5[2844:2856]: smb accepted connection from 192.168.0.253:49238 2008.09.10 15:28:13 LOG7[2844:2856]: FD 264 in non-blocking mode 2008.09.10 15:28:13 LOG7[2844:2856]: smb connecting 128.221.79.49:10005 2008.09.10 15:28:13 LOG7[2844:2856]: connect_wait: waiting 10 seconds 2008.09.10 15:28:13 LOG7[2844:2856]: connect_wait: connected 2008.09.10 15:28:13 LOG5[2844:2856]: smb connected remote server from 128.221.79.44:49239 2008.09.10 15:28:13 LOG7[2844:2856]: Remote FD=264 initialized 2008.09.10 15:28:13 LOG7[2844:2856]: TCP_NODELAY option set on remote socket 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): before/connect initialization 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 write client hello A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 read server hello A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 read server certificate A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 read server done A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 write client key exchange A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 write change cipher spec A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 write finished A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 flush data 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 read finished A 2008.09.10 15:28:13 LOG7[2844:2856]: 1 items in the session cache 2008.09.10 15:28:13 LOG7[2844:2856]: 1 client connects (SSL_connect()) 2008.09.10 15:28:13 LOG7[2844:2856]: 1 client connects that finished 2008.09.10 15:28:13 LOG7[2844:2856]: 0 client renegotiations requested 2008.09.10 15:28:13 LOG7[2844:2856]: 0 server connects (SSL_accept()) 2008.09.10 15:28:13 LOG7[2844:2856]: 0 server connects that finished 2008.09.10 15:28:13 LOG7[2844:2856]: 0 server renegotiations requested 2008.09.10 15:28:13 LOG7[2844:2856]: 0 session cache hits 2008.09.10 15:28:13 LOG7[2844:2856]: 0 session cache misses 2008.09.10 15:28:13 LOG7[2844:2856]: 0 session cache timeouts 2008.09.10 15:28:13 LOG6[2844:2856]: SSL connected: new session negotiated 2008.09.10 15:28:13 LOG6[2844:2856]: SSL connected: new session negotiated 2008.09.10 15:28:13 LOG6[2844:2856]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 >>> 2008.09.10 15:28:44 LOG3[2844:2856]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2008.09.10 15:28:44 LOG5[2844:2856]: Connection reset: 153 bytes sent to SSL, 0 bytes sent to socket 2008.09.10 15:28:44 LOG7[2844:2856]: smb finished (0 left) Relevant info stunnel.conf on client: [smb] accept = 192.168.0.253:139 connect = [server ipaddress]:10005 Relevant info stunnel.conf on server: [smb] accept = 10005 connect = 139 ;connect = 445

1 0

Stunnel on Vista gets "readsocket: Connection reset by peer"
by Scarsdale_James＠emc.com 10 Sep '08

10 Sep '08

Hi, I'm trying to use stunnel 4.25 on Vista over the Microsoft Loopback Adapter, but I always get the following error shown next to ">>>" below. Note that the SSL session appears to have been negotiated okay. I found some notes about using "Run as adminstrator" on Vista, but I still get the same behavior with this. The same setup works fine on XP. Any ideas before I start looking at code? Thanks, Jim 2008.09.10 15:27:42 LOG7[2844:692]: RAND_status claims sufficient entropy for the PRNG 2008.09.10 15:27:42 LOG7[2844:692]: PRNG seeded successfully 2008.09.10 15:27:42 LOG7[2844:692]: Certificate: stunnel.pem 2008.09.10 15:27:42 LOG7[2844:692]: Certificate loaded 2008.09.10 15:27:42 LOG7[2844:692]: Key file: stunnel.pem 2008.09.10 15:27:42 LOG7[2844:692]: Private key loaded 2008.09.10 15:27:42 LOG7[2844:692]: SSL context initialized for service smb 2008.09.10 15:27:42 LOG5[2844:692]: stunnel 4.25 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2008.09.10 15:27:42 LOG5[2844:692]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2008.09.10 15:27:42 LOG5[2844:2656]: No limit detected for the number of clients 2008.09.10 15:27:42 LOG7[2844:2656]: FD 248 in non-blocking mode 2008.09.10 15:27:42 LOG7[2844:2656]: SO_REUSEADDR option set on accept socket 2008.09.10 15:27:42 LOG7[2844:2656]: smb bound to 192.168.0.253:139 2008.09.10 15:28:13 LOG7[2844:2656]: smb accepted FD=240 from 192.168.0.253:49238 2008.09.10 15:28:13 LOG7[2844:2656]: Creating a new thread 2008.09.10 15:28:13 LOG7[2844:2656]: New thread created 2008.09.10 15:28:13 LOG7[2844:2856]: smb started 2008.09.10 15:28:13 LOG7[2844:2856]: FD 240 in non-blocking mode 2008.09.10 15:28:13 LOG7[2844:2856]: TCP_NODELAY option set on local socket 2008.09.10 15:28:13 LOG5[2844:2856]: smb accepted connection from 192.168.0.253:49238 2008.09.10 15:28:13 LOG7[2844:2856]: FD 264 in non-blocking mode 2008.09.10 15:28:13 LOG7[2844:2856]: smb connecting [server ip]:10005 2008.09.10 15:28:13 LOG7[2844:2856]: connect_wait: waiting 10 seconds 2008.09.10 15:28:13 LOG7[2844:2856]: connect_wait: connected 2008.09.10 15:28:13 LOG5[2844:2856]: smb connected remote server from 128.221.79.44:49239 2008.09.10 15:28:13 LOG7[2844:2856]: Remote FD=264 initialized 2008.09.10 15:28:13 LOG7[2844:2856]: TCP_NODELAY option set on remote socket 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): before/connect initialization 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 write client hello A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 read server hello A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 read server certificate A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 read server done A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 write client key exchange A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 write change cipher spec A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 write finished A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 flush data 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 read finished A 2008.09.10 15:28:13 LOG7[2844:2856]: 1 items in the session cache 2008.09.10 15:28:13 LOG7[2844:2856]: 1 client connects (SSL_connect()) 2008.09.10 15:28:13 LOG7[2844:2856]: 1 client connects that finished 2008.09.10 15:28:13 LOG7[2844:2856]: 0 client renegotiations requested 2008.09.10 15:28:13 LOG7[2844:2856]: 0 server connects (SSL_accept()) 2008.09.10 15:28:13 LOG7[2844:2856]: 0 server connects that finished 2008.09.10 15:28:13 LOG7[2844:2856]: 0 server renegotiations requested 2008.09.10 15:28:13 LOG7[2844:2856]: 0 session cache hits 2008.09.10 15:28:13 LOG7[2844:2856]: 0 session cache misses 2008.09.10 15:28:13 LOG7[2844:2856]: 0 session cache timeouts 2008.09.10 15:28:13 LOG6[2844:2856]: SSL connected: new session negotiated 2008.09.10 15:28:13 LOG6[2844:2856]: SSL connected: new session negotiated 2008.09.10 15:28:13 LOG6[2844:2856]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 >>> 2008.09.10 15:28:44 LOG3[2844:2856]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2008.09.10 15:28:44 LOG5[2844:2856]: Connection reset: 153 bytes sent to SSL, 0 bytes sent to socket 2008.09.10 15:28:44 LOG7[2844:2856]: smb finished (0 left) Relevant info stunnel.conf on client: [smb] accept = 192.168.0.253:139 connect = [server ip]:10005 Relevant info stunnel.conf on server: [smb] accept = 10005 connect = 139 ;connect = 445

1 0

Building STunnel 4.25 with OpenSSL 0.9.8h on Windows
by Paul Coleman 10 Sep '08

10 Sep '08

Hi everyone, I've recently been trying to compile STunnel for Windows, but have found so many conflicting reports of the best way to do it on the website / other sites, that I'm now well and truly confused! I've got MSVS 2005, but have also tried with mingw, and cygwin - and also on Linux using mingw32. I'm unsure as to whether I need some Makefile.w32, whether I need to compile OpenSSL from source, where I need to put OpenSSL libraries when they're done, if I need to run Configure, etc etc. I'm not looking for a complete step by step guide including 'cd to x, type this' (although I wouldn't complain! :P), but a general poke in the right direction would be great. Thanks for your help, --Paul

1 0

Re: [stunnel-users] Help using stunnel for the first time
by Jilin Zhang 09 Sep '08

09 Sep '08

try: http://localhost:1515 > Hi, > > I'm trying to use stunnel for the first time (on Mac OS X 10.5), and > I'm not having much luck. > > First of all, I downloaded the source and installed stunnel > successfully. I then setup a config file as follows (where myhost is > the host i am connecting to): > > client=yes > verify=0 > [psuedo-https] > accept=1515 > connect=myhost:443 > TIMEOUTclose = 0 > > Then, I run the following on the command line: > /usr/local/bin/stunnel ./stunnel.config > > It appears that stunnel runs without error, and if I do 'ps aux | grep > stunnel' there are 4 stunnel processes running. > > Then, as a test, I try to connect to port 1515 from my web browser by > visiting https://localhost:1515, but it just hangs there... nothing. > > Any suggestions? > > Thanks! > > Ian > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > >

2 1

Help using stunnel for the first time
by Ian Baxter 09 Sep '08

09 Sep '08

Hi, I'm trying to use stunnel for the first time (on Mac OS X 10.5), and I'm not having much luck. First of all, I downloaded the source and installed stunnel successfully. I then setup a config file as follows (where myhost is the host i am connecting to): client=yes verify=0 [psuedo-https] accept=1515 connect=myhost:443 TIMEOUTclose = 0 Then, I run the following on the command line: /usr/local/bin/stunnel ./stunnel.config It appears that stunnel runs without error, and if I do 'ps aux | grep stunnel' there are 4 stunnel processes running. Then, as a test, I try to connect to port 1515 from my web browser by visiting https://localhost:1515, but it just hangs there... nothing. Any suggestions? Thanks! Ian

1 0

Re: [stunnel-users] A Calypso user needs your help with stunnel
by John Bryant 09 Sep '08

09 Sep '08

Dear Ludolf et al: Thank you very much for your recent communication. I drew up what I thought I needed, based on your answer, in the configuration file. As might be expected in that I'm a novice at this, I still have a few more questions: 1. I tried it with and without the "Authentification stuff". Either way, after modifying stunnel.conf, and running stunnel.exe, stunnel.exe bombed with the following error: "Stunnel server down" (log said: ************** 2008.09.02 14:20:17 LOG7[16442455:16274811]: RAND_status claims sufficient entropy for the PRNG 2008.09.02 14:20:17 LOG7[16442455:16274811]: PRNG seeded successfully 2008.09.02 14:20:17 LOG3[16442455:16274811]: Error loading verify certificates from certs.pem 2008.09.02 14:20:17 LOG3[16442455:16274811]: error stack: B084002 : error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib 2008.09.02 14:20:17 LOG3[16442455:16274811]: error stack: 2006D080 : error:2006D080:BIO routines:BIO_new_file:no such file 2008.09.02 14:20:17 LOG3[16442455:16274811]: SSL_CTX_load_verify_locations: 2001002: error:02001002:system library:fopen:No such file or directory 2008.09.02 14:20:17 LOG3[16442455:16274811]: Server is down What caused this? ************** 2. My other question is: Do I need to put stunnel.exe in the startup folder? Does it automatically reference stunnel.conf (that is what I was assuming)? When I get it to run correctly, automatically referencing stunnel, conf, then can I run Calypso with the settings changed to tie in with the stunnel conf file? All of the above I was assuming was true, but I'm just asking to make sure. Thanks! Lenny

3 6

Respawn stunnel
by Joe Kemp 08 Sep '08

08 Sep '08

What is the best way to setup stunnel to respawn if it crashes? I have looked at inittab (probably would have to have stunnel run in foreground?) or the procautostart.cpp utility. Any other ideas? Is there an easier way. Joe A. Kemp CapWIN Senior Systems Architect (O) 301-614-3727 (C) 301-502-1281

2 1

Re: [stunnel-users] Scripting stunnel to load automatically when OS X 10.5 server starts up -plist
by Christopher Hunt 04 Sep '08

04 Sep '08

On 04/09/2008, at 8:00 PM, stunnel-users-request(a)mirt.net wrote: > Here is my plist. I put this in /Library/LaunchDaemons. What do you > think? --Thanks, Allen Firstly have you considered using Lingon to maintain your plist? That could help you. > <?xml version="1.0" encoding="UTF-8"?> > <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd > "> > <plist version="1.0"> > <dict> > <key>KeepAlive</key> > <true/> > <key>Label</key> > <string>stunnel_startup</string> > <key>ProgramArguments</key> > <array> > <string>/opt/local/bin/stunnel</string> > </array> > <key>RunAtLoad</key> > <true/> > </dict> > </plist> The most obvious thing that stands out is that you aren't supplying a config file argument to stunnel. How's it going to locate your config file? You might want to check your system.log file using the Console application and watch for messages. You also need to use launchctl to load your plist - Lingon makes this pretty straightforward. Cheers, -C

1 0

Scripting stunnel to load automatically when OS X 10.5 server starts up -plist
by Allen 03 Sep '08

03 Sep '08

Thank you Chris and Tom, for your responses, Here is my plist. I put this in /Library/LaunchDaemons. What do you think? --Thanks, Allen <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd "> <plist version="1.0"> <dict> <key>KeepAlive</key> <true/> <key>Label</key> <string>stunnel_startup</string> <key>ProgramArguments</key> <array> <string>/opt/local/bin/stunnel</string> </array> <key>RunAtLoad</key> <true/> </dict> </plist>

1 1

Re: [stunnel-users] Scripting stunnel to load automatically when OS X 10.5 server starts up -any solution?
by Christopher Hunt 03 Sep '08

03 Sep '08

On 03/09/2008, at 8:00 PM, stunnel-users-request(a)mirt.net wrote: > Does anybody have a solution that will start up stunnel on OS X > bootup? ... Sounds to me like a launchd config error. How about sending through the plist? Cheers, -C

2 1

Starting stunnel automatically on OS X system startup
by Allen 02 Sep '08

02 Sep '08

Does anybody have a solution that will start up stunnel on OS X bootup? I've installed stunnel on a Leopard server (OS 10.4.5.4) to make a smtp SSL relay work (and it works fine). The problem is, we'd have to type in /opt/local/bin/stunnel on the command line every time the server is rebooted. Rather than having to create a /Library/ SystemStartup/diretory_structure_with_plist_etc., has somebody done this, and can lead me in the right direction, in the interest of time? I've just run out of time, and I kinda think that somebody must have done this already. Thanks! Allen

1 1

A Calypso user needs your help with stunnel
by John Bryant 02 Sep '08

02 Sep '08

Dear folks: I am trying to install stunnel so that I can have an SSL capability with Calypso. I was guided to the stunnel.org site by instructions at: http://www.windowsbbs.com/courier-email-client/35188-ssl-connection-really-…. (the instructions that I am referring to are duplicated below, under the first line of asterisks - they mention later versions of stunnel, but do not update their instructions for them adequately) I could not understand the instructions at your site that told about modifying the conf file with the LATEST version of stunnel.exe, which I did download and install and that's as far as I got - couldn't understand the options as clearly as I had the others, so uninstalled it.) (Tried downloading the OLD version, 4.05 exe, mentioned in the instructions and the two dll files,and making all the changes to THAT conf.txt file, etc, but THAT did not work because when I ran the shortcut to the conf.txt file that I had put in the Start folder, the computer gave me, when connected, a "cannot find 1 1/4 dll" message, and then an "illegal op" and a "cannot run due to restrictions on your computer" message (when not connected, just the latter two). I know you don't want to hear about old versions but it was logical for me to try since I could not figure out how to use the latest version.) So what do I do now? Thanks! Lenora (do not give up on me, I have computers in my background, etc. etc) ************** (Excerpts from the thread at the url listed above) http://www.windowsbbs.com/courier-email-client/35188-ssl-connection-really-… A week ago I provided instructions for using stunnel to provide SSL functionality for Calypso/Courier - in case your email provider requires SSL, which Calypso and Courier do not yet support. Those instructions were correct if your email provider uses the dedicated SSL ports - 465 for smtps, 995 for pop3s, 993 for imap4s. They were incomplete if your email provider uses the standard ports - 25 for smtp, 110 for pop3, [N/A - 143 for imap4]. Normally when the SSL ports are being used the entire conversation is encrypted with SSL. stunnel will initiate the session with the standard SSL protocol. However, if the standard ports are being used the session is initiated without SSL and then switches to SSL using an smtp or pop3 specific protocol (STARTTLS or STLS). stunnel needs to be told this, or it wont work on the standard ports. For the standard ports an extra line is required in the configuration file. To use stunnel do the following: 1) download the following files from http://www.stunnel.org/download/binaries.html stunnel-4.05.exe (version may be higher when you go there) libssl32.dll libeay32.dll and put them into a directory such as C:\Program Files\Stunnel\ 2) create a shortcut to stunnel-4.05.exe in the same directory [in WinXP do this by right clicking on it and selecting Create Shortcut] 3) edit the shortcut by right clicking on it and selecting Properties Modify the Target to look like this "C:\Program Files\Stunnel\stunnel-4.05.exe" stunnel-conf.txt (Optional) Rename the shortcut to remove the "Shortcut to ". 4) create the file stunnel-conf.txt in the same directory, and put the following lines in it: ----starting with next line---- # GLOBAL OPTIONS client = yes output = stunnel-log.txt debug=4 taskbar = yes # SERVICE-LEVEL OPTIONS [POP3 (ISP name)] accept = 127.0.0.1:108 connect = myISPs.POP3server.net:995 [SMTP (ISP name)] accept = 127.0.0.1:107 connect = myISPs.SMTPserver.net:465 ----ending with previous line---- Change the server names (before colons), and perhaps ports (after colons), to be correct for your ISP. Change ISP name too. Save and exit. 4b) if your email provider uses standard ports for either smtp or pop3, make either or both of the following changes to your stunnel-conf.txt file: [POP3 (ISP name)] accept = 127.0.0.1:108 connect = myISPs.POP3server.net:110 protocol = pop3 [SMTP (ISP name)] accept = 127.0.0.1:107 connect = myISPs.SMTPserver.net:25 protocol = smtp Once again, change the server names (before colons) to be correct for your ISP. Change ISP name too. Save and exit. 4c) if you have two email providers requiring SSL you can add a second set of services like so: [POP3 (2nd ISP name)] accept = 127.0.0.1:106 connect = my2ndISPs.POP3server.net:995 [SMTP (2nd ISP name)] accept = 127.0.0.1:105 connect = my2ndISPs.SMTPserver.net:465 Each email provider requires its own two ports (e.g. 108+107, 106+105), but 2 email accounts at a single provider can share the same pair of ports. However, if an email provider only uses SSL for one of smtp or pop3, you only need one of the two service sections. Once again, change the server names (before colons) to be correct for your ISP. Change ISP name too. Save and exit. 5) put a copy of that shortcut into your Start Menu's Programs/Startup folder [normally, by dragging shortcut over Start button, over Programs, over Startup, then drop it in Startup list.] 6) edit your Calypso/Courier Account Properties to change your mail servers. Incoming: Port 108 Server 127.0.0.1 Outgoing: Port 107 Server 127.0.0.1 [this is done differently for Calypso and Courier, due to Courier's new approach to SMTP servers] If an email provider only uses SSL for one of smtp or pop3, you only need to change one of the two mail servers. If you set up more than one email provider for SSL, change each account's properties to the corresponding ports. Now when you check or send email Calypso/Courier will communicate with stunnel, which will connect to your ISP's mail servers via SSL. The shortcut in Startup will rerun stunnel each time you reboot. You should just double-click on the shortcut in the program folder to run stunnel the first time. Hope this helps. Greg ************* Later addition (later on same thread): I just reinstalled all of my computer and I forgot to backup my sTunnel config! Anyway, the instructions have changed a bit as of sTunnel version 4.12... sTunnel is now distributed as an installer EXE, and the auxiliary DLLs are installed by default. The only step that really changes is step 1. All you have to do is to download the sTunnel installer and run it. There is no need to download the other files. The rest stays pretty much the same. ********** Question from somebody: First of all, I want to thank you for posting this very useful 'how to' -- this is what foruming is all about I have two questions (for anyone): 1. When using Stunnel, does it completely encrypt the user name, password, and the contents of the email, or just the contents? 2. The Stunnel website (www.stunnel.org) mentions that you'd also need the OpenSSL Libraries to make it work. But I did not download them, and still managed to make the Stunnel work with Courier. Am I (still) missing something? ************ Answer: 1. stunnel establishes an ssl tunnel (hence the name) between your computer and the email server. So every byte travelling between the two is encrypted. It's like establishing a VPN between your computer and the server. 2. As gmagana posted at the start of the month, they seem to have enhanced the installation process - such that you don't need to worry about the extra files. Isn't open source great! ********* Final comment: Looks like I can finally use Courier with Google's Gmail (http://gmail.google.com) to send/receive encrypted email. (End of excerpts)

2 1

Re: [stunnel-users] failed to build stunnel 4.25 under VS 2005
by Michal Trojnara 29 Aug '08

29 Aug '08

On Fri, 29 Aug 2008 00:00:56 +0800, "Ericdai" <pcix133(a)hotmail.com> wrote: > I try to build Stunnel 4.25 under VS2005 ,but failed Today I updated stunnel, so it can be built with Visual C++ 2008 (known also as Visual C++ 9.0). My plan is to release stunnel 4.26 next week. > prototypes.h(428) : error C2081: 'socklen_t' : name in formal > parameter list illegal I had no problem with socklen_t. Maybe it's specific to the old version of Visual C++. > I also suggest build a windows client only version > n It only can be running on windows > n It only can act as a client > n I think it can reduce the code size and runtime footprice smaller Not really. The difference would be negligible. Best regards, Mike

1 0

failed to build stunnel 4.25 under VS 2005
by Ericdai 28 Aug '08

28 Aug '08

I try to build Stunnel 4.25 under VS2005 ,but failed cl -MD -W3 -Ox -O2 -Ob2 -Gs0 -GF -Gy -GL -nologo -I"..\..\ssl\inc32" -DUSE_WIN32 -D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE -DHAVE_GETADDRINFO -DHAVE_GETNAMEINFO -D_MBCS /c stunnel.c stunnel.c prototypes.h(428) : error C2081: 'socklen_t' : name in formal parameter list illegal stunnel.c(206) : error C2065: 'socklen_t' : undeclared identifier stunnel.c(206) : error C2146: syntax error : missing ';' before identifier 'addrlen' stunnel.c(206) : error C2065: 'addrlen' : undeclared identifier I use nmake -f vc.mak to do it Anyone has build it successfully ,pls help me ! Another way ,is there a stunnel solution or project file ? I also suggest build a windows client only version n It only can be running on windows n It only can act as a client n I think it can reduce the code size and runtime footprice smaller Thanks and best regards Eric dai

1 0

Re: [stunnel-users] In chrooted environment system times defaults to UTC
by Ivan Lezhnjov Jr. 22 Aug '08

22 Aug '08

Friday 22 August 2008 you wrote: > I noticed that when running stunnel from within the jail it logs its > messages with syslong using UTC. > > My question is how would one reconcile timezone of chrooted stunnel with a > system one? > > The issue illustrated: > > Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: stunnel 4.17 on > i686-pc-linux-gnu with OpenSSL 0.9.8h 28 May 2008 > Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: Threading:PTHREAD > SSL:ENGINE Sockets:POLL,IPv4 > Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: 500 clients > allowed Aug 22 12:29:40 xerxes stunnel: LOG5[26570:3086773168]: 5101 > connected from 127.0.0.1:1469 > Aug 22 09:29:40 xerxes stunnel: LOG5[26570:3086773168]: VERIFY OK: > depth=0, /C=UA/ST=ARC/L=Simferopol/O=HOMELAB/CN=sega.localnet > > xerxes' localtime is GMT+3 and sega's too, but stunnel runs on sega in > chrooted environment and thus uses UTC (if it's not chrooted it reports > localtime to syslog facility). > > Any ideas? Jee that was simple! cp /etc/localtime /var/lib/stunnel/etc/ (on each machine where stunnel runs) and you're done :^) -- Ivan Lezhnjov Jr. Europe, Ukraine, Simferopol Running Source Mage GNU/Linux, kernel version 2.6.24 build #5 +----------------------------------------------------------------------+ Key ID 0x5811D90C Key Fingerprint 2A52 5C8C 38BE C04F D8DE A169 19E2 E49A 5811 D90C Use GPG Exercise Your Right To Privacy

1 0

In chrooted environment system times defaults to UTC
by Ivan Lezhnjov Jr. 22 Aug '08

22 Aug '08

I noticed that when running stunnel from within the jail it logs its messages with syslong using UTC. My question is how would one reconcile timezone of chrooted stunnel with a system one? The issue illustrated: Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: stunnel 4.17 on i686-pc-linux-gnu with OpenSSL 0.9.8h 28 May 2008 Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: 500 clients allowed Aug 22 12:29:40 xerxes stunnel: LOG5[26570:3086773168]: 5101 connected from 127.0.0.1:1469 Aug 22 09:29:40 xerxes stunnel: LOG5[26570:3086773168]: VERIFY OK: depth=0, /C=UA/ST=ARC/L=Simferopol/O=HOMELAB/CN=sega.localnet xerxes' localtime is GMT+3 and sega's too, but stunnel runs on sega in chrooted environment and thus uses UTC (if it's not chrooted it reports localtime to syslog facility). Any ideas? -- Ivan Lezhnjov Jr. Europe, Ukraine, Simferopol Running Source Mage GNU/Linux, kernel version 2.6.24 build #5 +----------------------------------------------------------------------+ Key ID 0x5811D90C Key Fingerprint 2A52 5C8C 38BE C04F D8DE A169 19E2 E49A 5811 D90C Use GPG Exercise Your Right To Privacy

1 0

Certificates, Servers & Clients. Clarify this please.
by Ivan Lezhnjov Jr. 22 Aug '08

22 Aug '08

Now that I've read a bunch of articles and have seen a pile of examples of how pairs of a certificate and a private key can be created I must say they all suggest different approaches and techniques to creating certificates and ultimately bewildered me. Could anyone please explain as simply as possible, in layman's terms what exactly must be done? Let's talk about simple scenario with two hosts (A & B) involved, both running stunnel. Let us assume host A is the server and host B is the client. cert = CAfile = must be created. And we use verify level 3 (verify = 3) So, what exactly do we do now? And what happens in the dialog between these two machines? -- Ivan Lezhnjov Jr. Europe, Ukraine, Simferopol Running Source Mage GNU/Linux, kernel version 2.6.24 build #5 +----------------------------------------------------------------------+ Key ID 0x5811D90C Key Fingerprint 2A52 5C8C 38BE C04F D8DE A169 19E2 E49A 5811 D90C Use GPG Exercise Your Right To Privacy

1 0

Can't start stunnel (dies mysteriously)
by Ivan Lezhnjov Jr. 19 Aug '08

19 Aug '08

Hello there I run stunnel version 4.21 and openssl version 0.9.8h. In my setup I aim to create a tunnel to send log files through to a centralized loghost. Host A (loghost) runs Source Mage GNU/Linux (with stunnel 4.21, openssl 0.9.8h) and host B runs Slackware 11 system (with stunnel 4.17, openssl 0.9.8h). The problem is that stunnel starts on host B but won't start on host A. Here's the snippet of /var/log/messages that records stunnel start-up event: root@sega:/home/users/ilj % stunnel && tail /var/log/messages -n 3 Aug 19 16:17:37 sega stunnel: LOG5[29146:3082634944]: stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.8h 28 May 2008 Aug 19 16:17:37 sega stunnel: LOG5[29146:3082634944]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Aug 19 16:17:37 sega stunnel: LOG5[29146:3082634944]: 500 clients allowed I've actually been trying to run stunnel for the first time ever so I don't really know if this output confirms that everything is alright but judging solely from what is put in log file it seems stunnel has started successfully. Unfortunately, this isn't quite true root@sega:/home/users/ilj % ps ax | grep stun 29618 pts/4 R+ 0:00 grep stun So, this is the problem I have. It doesn't start on host A. Host A has the following stunnel configuration: root@sega:/home/users/ilj % cat /etc/stunnel/stunnel.conf cert = /etc/stunnel/syslog-ng-server.pem CAfile = /etc/stunnel/syslog-ng-client.pem verify = 3 [5101] accept = 217.117.75.2:5101 connect = 127.0.0.1:1999 Host B sports a little bit different configuration file: root@xerxes:~ % cat /etc/stunnel/stunnel.conf client = yes cert = /etc/stunnel/syslog-ng-client.pem CAfile = /etc/stunnel/syslog-ng-server.pem verify = 3 [5101] accept = 127.0.0.1:1999 connect = 217.117.75.2:5101 On both hosts (A & B) I run stunnel standalone as root. > 4. Output of "stunnel -f -D 7 <your-parameters>". Erm.. it doesn't seem to work for me. There's no -D parameter according to man stunnel. The following information below is about host A only: root@sega:/home/users/ilj % stunnel -version stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.8h 28 May 2008 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /usr/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none root@sega:/home/users/ilj % uname -a Linux sega 2.6.24 #5 SMP PREEMPT Wed May 7 18:22:29 EEST 2008 i686 GNU/Linux root@sega:/home/users/ilj % gaze from /usr/lib/libc.a glibc-2.7:/usr/lib/libc.a root@sega:/home/users/ilj % gcc -v Reading specs from /usr/lib/gcc/i686-pc-linux-gnu/4.2.3/specs Target: i686-pc-linux-gnu Configured with: /usr/src/gcc-4.2.3/configure --host=i686-pc-linux-gnu --prefix=/usr --infodir=/usr/share/info --mandir=/usr/share/man --enable-threads=posix --with-system-zlib Thread model: posix gcc version 4.2.3 root@sega:/home/users/ilj % gaze installed | grep openssl openssl:20080615:installed:0.9.8h -- Ivan Lezhnjov Jr. Europe, Ukraine, Simferopol Running Source Mage GNU/Linux, kernel version 2.6.24 build #5 +----------------------------------------------------------------------+ Key ID 0x5811D90C Key Fingerprint 2A52 5C8C 38BE C04F D8DE A169 19E2 E49A 5811 D90C Use GPG Exercise Your Right To Privacy

1 0

Disable libwrap at runtime?
by Jans, Kert 16 Aug '08

16 Aug '08

Hi, Is it possible to disable libwrap support at runtime? I've reviewed the archives and documentation and cannot determine if this is possible. I know it is possible to compile-out support for libwrap by using: configure --disable-libwrap Is compiling-out support the only way? I'd like to disable support in a pre-build version of stunnel. Regards, Kert

2 1

Re: [stunnel-users] Mutual SSL Authentication
by Christopher Hunt 15 Aug '08

15 Aug '08

Ah ha - "verify = 3" - thanks! On 15/08/2008, at 9:12 AM, Brian Hatch wrote: >> > Mutual authentication uses the verify option on both > ends, rather than just on one end. Both sides verify, > and both sides present a certificate.

2 1

Re: [stunnel-users] Mutual SSL Authentication
by Christopher Hunt 14 Aug '08

14 Aug '08

On 14/08/2008, at 8:00 PM, Michal.Trojnara(a)mobi-com.net wrote: > Sure. Stunnel supports mutual SSL authentication. > Please read the fine manual for details. Hi Mike, Thanks for the reply. I did quite a lot of trawling on the web, your website and the stunnel man pages and couldn't find any guidance on mutual ssl authentication configuration. Are you able to give me a pointer, perhaps a URL to something that contains an example? Thanks again. Cheers, -C

1 0

Stunnel connection drops after four http requests
by Renner, Christopher R 13 Aug '08

13 Aug '08

With quite a bit of help from a list member here, I have stunnel 4.25 running on OSX 1.5.4 (PHP development environment). Problem is I can only get four http requests to the server before the connection is dropped. Stunnel is still running in the background.

1 0

Mutual SSL Authentication
by Christopher Hunt 13 Aug '08

13 Aug '08

Hi there, Does stunnel have any in-built support for mutual SSL authentication? If not are there plans to incorporate support? Cheers, -C

2 1

question
by Ted Ehrlich 12 Aug '08

12 Aug '08

1 0

OSX 10.5 install?
by Renner, Christopher R 11 Aug '08

11 Aug '08

> >> Hi, >> >> New list member here. I¹m going through the archives now, and have Googled >> my way to exhaustion, looking for up-to-date instructions to install stunnel >> on a Mac desktop. >> >> I do PHP web application development and need to be able to connect to a NAS >> space via stunnel on my desktop dev environment in order to simulate the live >> environment. >> >> Does anyone 1) have a link to current OSX install instructions, or 2) care to >> share such instructions with me off the top of your head? >> >> I tried working through this darwinports page ( >> http://stunnel.darwinports.com/) but 1) it sends me to Macports.org for the >> .dmg file thereby installing macports and not darwinports....and after that >> the ³port² command is unrecognized in terminal when trying to install >> stunnel. >> >> >> Thanks. >>

2 1

Socket connection status
by Jeffrey Buck 08 Aug '08

08 Aug '08

Hi, I'm running stunnel 4.04 on ia64-redhat-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003. I have basically taken a generic TCP interface and implemented a STUNNEL client/server setup to allow the connection to transfer data using SSL. I have an issue with checking the status of the connection when a connection attempt is made. We are using ObjectSpace libraries for all of our tcp related connections so I don't have the low level calls that are actually being made, but here is a brief description of what is happenning.... We create an os_tcp_socket object and call the connect_to() method. This establishes a connection to the stunnel client on my local machine....which in turn makes the connection the the stunnel server on the remote machine. The problem I'm am having is when I can't get to the remote machine. After the connect_to() call, we check the status of the socket and unless I sleep for 5-10 seconds, it always seems to think that the connection is ok...which kind-of makes sense because it is able to connect to the stunnel client port since it is local...but in fact, if there isn't access to the remote machine, eventually stunnel will close that initial connection to that socket (that where the 5-10 second delay seems to help). The status I really want is weather or not the entire connection was successful through stunnel to the remote machine. Is there a better way to do this other than putting a sleep() in. Right now I have a 10 second sleep in between the connect_to() call and the status check on the local/client stunnel TCP port. That seems to be enough time for stunnel to attept to complete the connection and kill the connection to it's local/client port so that when I check the status of it, it comes back bad. If this is the best way to do it...what is the amount of time needed for stunnel to attempt to complete it's connection to the remote machine? Thanks! Jeff

2 3

Yahoo SSL
by Bernie Murciano 29 Jul '08

29 Jul '08

1 0

Re: [stunnel-users] help with stunnell
by Ludolf Holzheid 28 Jul '08

28 Jul '08

On Thu, 2008-07-24 23:37:22 -0700, vinodsreehari(a)yahoo.com wrote: > [..] > > I configured stnnel in one server as server mode ,for accepting > connection on 8070 ,and connect to 80 . It works only if i specify > https://ipaddress:8070 This is because the default port for https is 443. If you'd configure stunnel to accept on port 443, `https://ipaddress' would work. > I have configured one client server also to accept connection on 80 > and redirect to teh 8070 of server. I want to know that is that teh > way its working . If there is a stunnel instance on the client machine accepting connections on port 80 and connecting to the web server at the https port (default or not), a user could specify `http://localhost' to connect to the web server (and the traffic between the client machine and the server would be secured). > And is it possible to implement the same in a live enviroment ,in > which teh webserver will run on different port ,but users dont need > to specify the port number . Yes. As soon as the destination port for the 'first hop' of a redirected/tunneled connection is the default port for the protocol in question, there is no need to specify the port number. The port numbers of 'intermediate hops' are configuration options for the two stunnel instances (in this case), so the user dosn't have to care about them. HTH, Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Re: [stunnel-users] Wrong documentation
by Sandeep Kumar 25 Jul '08

25 Jul '08

On Thu, Jul 24, 2008 at 9:39 PM, Brian Hatch <bri(a)stunnel.org> wrote: > In the neigborhood of 2008-07-24 09:40 +0530, Sandeep Kumar mentioned: > > > Look at this page > http://www.stunnel.org/faq/stunnel.html#configuration_file > > In service level options section, under the explanation of "CRLpath" it > is > > said that all files in it should be of the form XXXXXXXX.0. But my > stunnnel > > setup worked only when i names as XXXXXXXX.r0 instead of XXXXXXXX.0. > > What version of openssl are you running? stunnel 4.15 with OpenSSL 0.9.8b > > > > -- > Brian Hatch "Have you asked Kirk if > Systems and he'd like the job?" > Security Engineer "You can't hide from me! > http://www.ifokr.org/bri/ I will find you. > > Every message PGP signed > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.2.1 (GNU/Linux) > > iD8DBQFIiKlFVkMj8/ymYEsRAmKxAJ9CTLp0Xi8n1VxdFup/kBUuZe6scwCfcvyu > WQG8BlfrUV8RcP31/ZUEbJk= > =EBgc > -----END PGP SIGNATURE----- > > -- Sandeep Kumar http://students.iiit.ac.in/~sandeep_kr

1 0

Help on configuring Stunnel
by Patel Dippen-CDP054 24 Jul '08

24 Jul '08

I downloaded the pre-compiled Windows version of Stunnel (stunnel-4.25-installer.exe). We need to deploy this on 2 machines A and B. The way it works is: - B connects to A - then A connects to B How should I configure Stunnel on machine A, since, in the first case A is the Server and in the 2nd scenario A becomes the Client. Questions on deploying Stunnel on machine A: - Can I run just 1 instance of Stunnel on machine A? It seems I cannot since I have to set the "client = yes" in the 2nd scenario - Do I need to run multiple instances, 1 running as the Server and the 2nd as the Client? Here is the config file I used on the machine A: **************************** cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [iPerfS] accept = 5010 connect = 127.0.0.1:5001 [iPerfS] accept = 5002 connect = 12.50.0.25:5020 **************************** Here is the config file I used on the machine B: **************************** cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [iPerfC] accept = 5001 connect = 12.50.0.26:5010 [iPerfS] accept = 5020 connect = 127.0.0.1:5002 **************************** Regards, Dippen

1 0

Stunnel 4.24 patch to allow stunnel to search for the OCSP responder within an X.509 certificate's AIA extension.
by Bruce Keats 24 Jul '08

24 Jul '08

Hi all, This patch also fixes a problem with stunnel accepting an "unknown" response as "good" and allows the connection to be setup. An OCSP responder can return one of three responses (good, revoked, unknown), however the code would accept "unknown" as good. This patch fixes that problem and treats an "unknown" response as a failure. Stunnel can query an OCSP responder to determine the revocation status of a certificate when stunnel is verifying the certificate. The code works great, however it is uses a preconfigured OCSP responder. The OCSP responder's IP/hostname is specified in the stunnel configuration file as a URI. I found this rather restrictive, so I added code to extract the OCSP responder's URI from the certificate. As per RFC 3280, one of the valid extensions for X.509 certificate is the Authority Information Access (AIA) where the "accessMethod" can be "is-ad-ocsp" to identify the OCSP responders location as per RFC2560. There can be more than one OCSP responder listed in the AIA because it is a sequence. Each location is queried in the order they appear within the certificate until either a "good" or "revoked" response is received. If an "known" response or a failure then the next OCSP responder is checked. If all OCSP responder queries result in failure then the validation also fails.. A new configuration option "OCSPaia" was added. If the "OCSPaia=yes" then the stunnel will look for the OCSP responder(s) within the certificate's AIA. The locally configured "OCSP=<url>" overrides the OCSPaia option. Bruce

1 0

Wrong documentation
by Sandeep Kumar 24 Jul '08

24 Jul '08

Look at this page http://www.stunnel.org/faq/stunnel.html#configuration_file In service level options section, under the explanation of "CRLpath" it is said that all files in it should be of the form XXXXXXXX.0. But my stunnnel setup worked only when i names as XXXXXXXX.r0 instead of XXXXXXXX.0. -- Sandeep Kumar http://students.iiit.ac.in/~sandeep_kr

1 0

help with stunnel port forwarding
by vinod bhasi 23 Jul '08

23 Jul '08

Hi, Please help me with stunnel port forwarding . My apache is running at port 8000 .I want this to be forwarded to 80 so that normal users dont need to specify the port number . Can anyone help me with the configuration in both client and server side .Im confused as stunnel wont run with same port used by apache. Any help will be appreciated Thanks in advancve Vinod Bhasi Did you know? You can CHAT without downloading messenger. Go to http://in.webmessenger.yahoo.com/

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 48, Issue 13
by Patrick Dung 21 Jul '08

21 Jul '08

Message: 3 Date: Mon, 21 Jul 2008 11:34:22 +0200 From: Micha? Trojnara <Michal.Trojnara(a)mobi-com.net> Subject: Re: [stunnel-users] Problem with Solaris 10u5 x86 and Stunnel 4.25 To: stunnel-users(a)mirt.net Message-ID: <2a3f79f5f6dd65f2ced02b2e9929368b(a)mirt.net> Content-Type: text/plain; charset="UTF-8" http://stunnel.mirt.net/pipermail/stunnel-users/2008-June/002021.html Mike On Sat, 19 Jul 2008 01:53:17 -0700 (PDT), Patrick Dung <patrick_dkt(a)yahoo.com.hk> wrote: > Hi > > I use this to compile stunnel: > The gcc and openssl is from Solaris SFW. > > # export CC=/usr/sfw/bin/gcc > # ./configure --with-threads=pthread --with-ssl=/usr/sfw > --localstatedir=/var > > After installing and starting stunnel, I found there are mutiple stunnel > processes. > There is a PID file which store one of the stunnel process. > I have tried to kill that PID, stunnel is bring down. > But there other stunnel processes running. > > Any ideas? > > Regards > Patrick > > > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users I see. Thanks for reply. Yesterday, I have tried to compile stunnel with Sun Studio. It got problem linking with libwrap, so I turned off libwrap support. And it compile (without knowing there is a libwrap patch) and there is only one single running stunnel process. Regards Patrick

1 0

stunnel exits silently on startup
by Luis López de Quintana 21 Jul '08

21 Jul '08

Problem: stunnel doesn't run: ldq@ldq:~$ stunnel4 /etc/stunnel.cnf ldq@ldq:~$ ps aux | grep stunnel ldq 15683 0.0 0.0 2332 1392 pts/0 S+ 11:08 0:00 man stunnel ldq 25289 0.0 0.0 1776 608 pts/1 S+ 11:59 0:00 grep stunnel stunnel.cnf: ldq@ldq:~$ cat /etc/stunnel.cnf client = yes debug = debug [nntps] accept = 127.0.0.1:1109 connect = news.giganews.com:443 Version: stunnel 4.140-5ubuntu1 libc6 ldq@ldq:~$ uname -a Linux ldq 2.6.18.5 SMP Thu May 8 01:31:23 UTC 2008 x86_64 GNU/Linux -- LdQ

2 2

Problem with Solaris 10u5 x86 and Stunnel 4.25
by Patrick Dung 19 Jul '08

19 Jul '08

Hi I use this to compile stunnel: The gcc and openssl is from Solaris SFW. # export CC=/usr/sfw/bin/gcc # ./configure --with-threads=pthread --with-ssl=/usr/sfw --localstatedir=/var After installing and starting stunnel, I found there are mutiple stunnel processes. There is a PID file which store one of the stunnel process. I have tried to kill that PID, stunnel is bring down. But there other stunnel processes running. Any ideas? Regards Patrick

1 0

Config Sanity Check
by Caplan, Michael 19 Jul '08

19 Jul '08

Hi There, I am working through an issue with a script that builds a socket connection to stunnel. Stunnel is being used to relay to an Apache web server. I'm building a localhost TCP connection on port 54322, and writing my HTTP data. When reading data back from the socket connection in my script I'm sometimes getting nothing, and other times getting the proper result. I can confirm that the web server is always receiving the request and returning a proper response. Wireshark shows SSL data being transmitted and received, so stunnel is doing its thing. However, the response does not seem to be relayed to my script on the other side of stunnel *sometimes*. My hunch is that I am doing something wrong with my script, but I am hoping that an stunnel guru can rule out any oddities with my stunnel setup. My config is below as well as the output of my log file. Any thoughts? Thanks! Mike cert = connector.pem debug = 7 output = c:\ssl.log ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [registerserver] client = yes accept =54321 connect =www.int.ddx.com:443 [connector2server] client = yes accept =54322 connect =asd.int.ddx.com:443 [server2connector] accept = 54323 connect = 9000 2008.07.18 21:41:41 LOG7[13648:13748]: Snagged 64 random bytes from C:/.rnd 2008.07.18 21:41:41 LOG7[13648:13748]: Wrote 1024 new random bytes to C:/.rnd 2008.07.18 21:41:41 LOG7[13648:13748]: RAND_status claims sufficient entropy for the PRNG 2008.07.18 21:41:41 LOG7[13648:13748]: PRNG seeded successfully 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate loaded 2008.07.18 21:41:41 LOG7[13648:13748]: Key file: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Private key loaded 2008.07.18 21:41:41 LOG7[13648:13748]: SSL context initialized for service registerserver 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate loaded 2008.07.18 21:41:41 LOG7[13648:13748]: Key file: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Private key loaded 2008.07.18 21:41:41 LOG7[13648:13748]: SSL context initialized for service connector2server 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate loaded 2008.07.18 21:41:41 LOG7[13648:13748]: Key file: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Private key loaded 2008.07.18 21:41:41 LOG7[13648:13748]: SSL context initialized for service server2connector 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate loaded 2008.07.18 21:41:41 LOG7[13648:13748]: Key file: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Private key loaded 2008.07.18 21:41:41 LOG7[13648:13748]: SSL context initialized for service test 2008.07.18 21:41:41 LOG5[13648:13748]: stunnel 4.25 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2008.07.18 21:41:41 LOG5[13648:13748]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2008.07.18 21:41:46 LOG7[13476:13096]: Snagged 64 random bytes from C:/.rnd 2008.07.18 21:41:47 LOG7[13476:13096]: Wrote 1024 new random bytes to C:/.rnd 2008.07.18 21:41:47 LOG7[13476:13096]: RAND_status claims sufficient entropy for the PRNG 2008.07.18 21:41:47 LOG7[13476:13096]: PRNG seeded successfully 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate loaded 2008.07.18 21:41:47 LOG7[13476:13096]: Key file: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Private key loaded 2008.07.18 21:41:47 LOG7[13476:13096]: SSL context initialized for service registerserver 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate loaded 2008.07.18 21:41:47 LOG7[13476:13096]: Key file: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Private key loaded 2008.07.18 21:41:47 LOG7[13476:13096]: SSL context initialized for service connector2server 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate loaded 2008.07.18 21:41:47 LOG7[13476:13096]: Key file: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Private key loaded 2008.07.18 21:41:47 LOG7[13476:13096]: SSL context initialized for service server2connector 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate loaded 2008.07.18 21:41:47 LOG7[13476:13096]: Key file: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Private key loaded 2008.07.18 21:41:47 LOG7[13476:13096]: SSL context initialized for service test 2008.07.18 21:41:47 LOG5[13476:13096]: stunnel 4.25 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2008.07.18 21:41:47 LOG5[13476:13096]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 Please consider the environment before printing this email. E-mail messages may contain viruses, worms, or other malicious code. By reading the message and opening any attachments, the recipient accepts full responsibility for taking protective action against such code. Henry Schein is not liable for any loss or damage arising from this message. The information in this email is confidential and may be legally privileged. It is intended solely for the addressee(s). Access to this e-mail by anyone else is unauthorized.

1 0

Difference between verify level 2 and 3
by Sandeep Kumar 16 Jul '08

16 Jul '08

Hi, I searched a lot on google, in the archives, and in the FAQ page, but could not find the differences between verify levels 2 and 3, other than the one line explanation given on the FAQ/man page. Specifically, I want to ask: 1. Is verify level 3 same as 2, but asks for client certificates as well? (Seems unlikely but still..) 2. Since verify level 2 also demands CApath/CAfile to be present, then it also is ultimately verifying against locally installed certs, which is supposed to be level 3's behaviour? Thanks & regards, Sandeep Kumar http://web.iiit.ac.in/~sandeep_kr

2 2

stunnel-portforwarding
by vinod bhasi 16 Jul '08

16 Jul '08

Hi All, I am a newbie as far as stunnel is concerned. I need help urgently on how to do port forwarding with Stunnel. Any help is appreciated. Thanks and Regards, Vinod Bhasi Save all your chat conversations. Find them online at http://in.messenger.yahoo.com/webmessengerpromo.php

1 0

SSL with SMTP problem - sTunnel 4.25 Windows
by dscycler 14 Jul '08

14 Jul '08

I am using sTunnel 4.25 for Windows to send and receive e-mail from a GoldMine client. sTunnel has worked well over the years but am having an issue with a particular mail host, Live Office. They have implemented SMTP SSL on port 25. The debug log is as follows: 2008.07.14 13:45:11 LOG7[2136:5356]: smtp accepted FD=224 from 127.0.0.1:1907 2008.07.14 13:45:11 LOG7[2136:5356]: Creating a new thread 2008.07.14 13:45:11 LOG7[2136:5356]: New thread created 2008.07.14 13:45:11 LOG7[2136:4944]: smtp started 2008.07.14 13:45:11 LOG7[2136:4944]: FD 224 in non-blocking mode 2008.07.14 13:45:11 LOG5[2136:4944]: smtp accepted connection from 127.0.0.1:1907 2008.07.14 13:45:11 LOG7[2136:4944]: FD 232 in non-blocking mode 2008.07.14 13:45:11 LOG7[2136:4944]: smtp connecting 64.70.94.196:25 2008.07.14 13:45:11 LOG7[2136:4944]: connect_wait: waiting 10 seconds 2008.07.14 13:45:11 LOG7[2136:4944]: connect_wait: connected 2008.07.14 13:45:11 LOG5[2136:4944]: smtp connected remote server from 127.0.0.1:1908 2008.07.14 13:45:11 LOG7[2136:4944]: Remote FD=232 initialized 2008.07.14 13:45:11 LOG7[2136:4944]: SSL state (connect): before/connect initialization 2008.07.14 13:45:11 LOG7[2136:4944]: SSL state (connect): SSLv3 write client hello A 2008.07.14 13:45:11 LOG7[2136:4944]: SSL alert (write): fatal: handshake failure 2008.07.14 13:45:11 LOG3[2136:4944]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2008.07.14 13:45:11 LOG5[2136:4944]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.07.14 13:45:11 LOG7[2136:4944]: smtp finished (0 left) I am looking for help to troubleshoot the connection problem. Is this an sTunnel issue or a mail server issue? Are there conf file settings to address the issue? Thanks, DavidS

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 48, Issue 8
by Pietro Di Primo 10 Jul '08

10 Jul '08

Thank you for reply. I tryied it but it doesn't work because my client run some separated subprocesses and are them that contact the server so, if an extern process try to connect to 127.0.0.1:<the_found_port> while one of that subprocess has finished and the next is not yet started, it will be able to do it and also my subprocess will be pending (i tryed it). Hope i was able to explain the situation. Any suggestion? Thanks in advace > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 9 Jul 2008 13:26:03 +0200 (CEST) > From: "Pietro Di Primo" <pietro.diprimo(a)ct.infn.it> > Subject: [stunnel-users] client-server tunnelling > To: stunnel-users(a)mirt.net > Message-ID: > <2553.193.206.208.201.1215602763.squirrel(a)imapfis.ct.infn.it> > Content-Type: text/plain;charset=utf-8 > > Hi, I have a client server application, and want to tunnel it in this way: > a script select a free port in a random way, write the stunnel.conf file. > with "accept=<the_found_port>" and "connect=<my_server>" and run my client > application passing to 127.0.0.1:<the_found_port> as server address. > The problem is that i need to be sure that no other client or user can > access <the_found_port> while the application is running. > I guess that it should be possible to do it, but i wasn't able to. > > Can anybody help me? > > Thanks > > > -- > --- > > Ing. Pietro Di Primo > INFN - Istituto Nazionale di Fisica Nucleare > Grid Computing Research Area > Via S. Sofia 78 95123 CATANIA (Italy) > Voice : +39 095 378-5446/5517 > Fax. : +39 095 378 5518 > Mobile : +39 320 8591527 > E-mail : pietro.diprimo(a)ct.infn.it > Skype : pietrodiprimo > > > > ------------------------------ > > Message: 2 > Date: Wed, 9 Jul 2008 14:08:23 +0200 > From: Micha? Trojnara <Michal.Trojnara(a)mobi-com.net> > Subject: Re: [stunnel-users] client-server tunnelling > To: stunnel-users(a)mirt.net > Message-ID: <6ba9f1b703149916bb1a61fb68a1e377(a)mirt.net> > Content-Type: text/plain; charset="UTF-8" > > > Pietro Di Primo wrote: >> Hi, I have a client server application, and want to tunnel it in this > way: >> a script select a free port in a random way, write the stunnel.conf >> file. >> with "accept=<the_found_port>" and "connect=<my_server>" and run my > client >> application passing to 127.0.0.1:<the_found_port> as server address. >> The problem is that i need to be sure that no other client or user can >> access <the_found_port> while the application is running. >> I guess that it should be possible to do it, but i wasn't able to. > > Simply bind the specific network interface with: > accept=127.0.0.1:<the_found_port> > > Best regards, > Mike > > > > ------------------------------ > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > End of stunnel-users Digest, Vol 48, Issue 8 > ******************************************** > -- --- Ing. Pietro Di Primo INFN - Istituto Nazionale di Fisica Nucleare Grid Computing Research Area Via S. Sofia 78 95123 CATANIA (Italy) Voice : +39 095 378-5446/5517 Fax. : +39 095 378 5518 Mobile : +39 320 8591527 E-mail : pietro.diprimo(a)ct.infn.it Skype : pietrodiprimo

1 0

client-server tunnelling
by Pietro Di Primo 09 Jul '08

09 Jul '08

Hi, I have a client server application, and want to tunnel it in this way: a script select a free port in a random way, write the stunnel.conf file. with "accept=<the_found_port>" and "connect=<my_server>" and run my client application passing to 127.0.0.1:<the_found_port> as server address. The problem is that i need to be sure that no other client or user can access <the_found_port> while the application is running. I guess that it should be possible to do it, but i wasn't able to. Can anybody help me? Thanks -- --- Ing. Pietro Di Primo INFN - Istituto Nazionale di Fisica Nucleare Grid Computing Research Area Via S. Sofia 78 95123 CATANIA (Italy) Voice : +39 095 378-5446/5517 Fax. : +39 095 378 5518 Mobile : +39 320 8591527 E-mail : pietro.diprimo(a)ct.infn.it Skype : pietrodiprimo

1 0

FW: how to start ??
by dominique 07 Jul '08

07 Jul '08

Hello, First time I am using stunnel. 1. The issue I had is with Altiris and Exchange. All our Exchange Servers are SSL now and Altiris is not-SSL. Altiris is reading an exchange mailbox and gives back an error : "Error receiving data from socket". So the infrastructure is composed of two servers one Altiris Server not-SSL which is attempting to communicate to an Exchange Server with SSL. The Altiris Server is trying to read the email in one mailbox hosted by an Exchange SSL Server 2. Stunnel 4.25 x86-pc-mingw32-gnu with openssl 0.9.8h 28 May 2008 3. Windows 2003 Server environment 4. stunnel -d -r 5. 2008.07.07 13:34:41 LOG7[4748:1676]: RAND_status claims sufficient entropy for the PRNG 2008.07.07 13:34:41 LOG7[4748:1676]: PRNG seeded successfully 2008.07.07 13:34:41 LOG7[4748:1676]: Certificate: stunnel.pem 2008.07.07 13:34:41 LOG7[4748:1676]: Certificate loaded 2008.07.07 13:34:41 LOG7[4748:1676]: Key file: stunnel.pem 2008.07.07 13:34:41 LOG7[4748:1676]: Private key loaded 2008.07.07 13:34:41 LOG7[4748:1676]: SSL context initialized for service pop3 2008.07.07 13:34:41 LOG5[4748:1676]: stunnel 4.25 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2008.07.07 13:34:41 LOG5[4748:1676]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2008.07.07 13:34:41 LOG5[4748:3596]: No limit detected for the number of clients 2008.07.07 13:34:41 LOG7[4748:3596]: FD 284 in non-blocking mode 2008.07.07 13:34:41 LOG7[4748:3596]: SO_REUSEADDR option set on accept socket 2008.07.07 13:34:41 LOG3[4748:3596]: Error binding pop3 to 149.142.194.230:995 2008.07.07 13:34:41 LOG3[4748:3596]: bind: Can't assign requested address (WSAEADDRNOTAVAIL) (10049) 2008.07.07 13:34:41 LOG3[4748:3596]: Server is down 6. no file gcc. Thanks, Dominique Dominique_duchemin(a)hotmail.com

1 0

Using externally signed certificate with stunnel 4
by Tim Skirvin 07 Jul '08

07 Jul '08

I've got a comodo signed SSL certificate that I'm trying to use with stunnel4 to allow secure NNTP connections from a wide variety of clients. The certificate at least partially works; if I leave 'verify' off in the stunnel.conf file, then the service runs and users can connect, albeit while still having to verify the cert. But if I turn 'verify' on, then it doesn't work on *either* side. I've tried playing with CAfile and CApath without much luck. I'll attach my configuration files, the relevant pems, and some debugging information; is there something else I'm missing? I've already contacted comodo, and after several rounds of conversation they suggest I contact the list. Errors from the client side (note that I'm using a debug port here): + openssl s_client -connect news:565 -verify -debug verify depth is 0 CONNECTED(00000003) depth=2 /C=US/O=Entrust.net/OU=www.entrust.net/CPS incorp. by ref. (limits liab.)/OU=(c) 1999 Entrust.net Limited/CN=Entrust.net Secure Server Certification Authority verify error:num=19:self signed certificate in certificate chain verify return:0 6976:error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed:s3_clnt.c:951: ...and on the server, I get this: 2008.06.30 14:08:38 LOG7[10039:47679267941088]: nntps accepted FD=7 from 171.64.19.111:56122 2008.06.30 14:08:38 LOG7[10039:1073809760]: nntps started 2008.06.30 14:08:38 LOG7[10039:1073809760]: FD 7 in non-blocking mode 2008.06.30 14:08:38 LOG7[10039:1073809760]: FD 8 in non-blocking mode 2008.06.30 14:08:38 LOG7[10039:1073809760]: FD 9 in non-blocking mode 2008.06.30 14:08:38 LOG7[10039:47679267941088]: Cleaning up the signal pipe 2008.06.30 14:08:38 LOG6[10039:47679267941088]: Child process 10247 finished with code 0 2008.06.30 14:08:38 LOG7[10039:1073809760]: Connection from 171.64.19.111:56122 permitted by libwrap 2008.06.30 14:08:38 LOG5[10039:1073809760]: nntps connected from 171.64.19.111:56122 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): before/accept initialization 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): SSLv3 read client hello A 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): SSLv3 write server hello A 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): SSLv3 write certificate A 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): SSLv3 write certificate request A 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): SSLv3 flush data 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL alert (read): fatal: unknown CA 2008.06.30 14:08:38 LOG3[10039:1073809760]: SSL_accept: 14094418: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca 2008.06.30 14:08:38 LOG5[10039:1073809760]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.06.30 14:08:38 LOG7[10039:1073809760]: nntps finished (0 left) Basic Requested Information that wasn't supplied above: * stunnel 4.18-2 on Debian etch (2.6.18-6-686 #1 SMP) * Running standalone with '/usr/bin/stunnel4 /etc/news/stunnel.conf' * libc6, no gcc, OpenSSL 0.9.8c-4etch3 * The log on startup: 2008.06.30 14:00:15 LOG7[26276:3083523776]: Snagged 64 random bytes from /root/.rnd 2008.06.30 14:00:15 LOG7[26276:3083523776]: Wrote 1024 new random bytes to /root/.rnd 2008.06.30 14:00:15 LOG7[26276:3083523776]: RAND_status claims sufficient entropy for the PRNG 2008.06.30 14:00:15 LOG7[26276:3083523776]: PRNG seeded successfully 2008.06.30 14:00:15 LOG7[26276:3083523776]: Configuration SSL options: 0x01000000 2008.06.30 14:00:15 LOG7[26276:3083523776]: SSL options set: 0x01000000 2008.06.30 14:00:15 LOG7[26276:3083523776]: Certificate: /etc/ssl/certs/news-stunnel.pem 2008.06.30 14:00:15 LOG7[26276:3083523776]: Certificate loaded 2008.06.30 14:00:15 LOG7[26276:3083523776]: Key file: /etc/ssl/private/news-stunnel.key 2008.06.30 14:00:15 LOG7[26276:3083523776]: Private key loaded 2008.06.30 14:00:15 LOG7[26276:3083523776]: Loaded verify certificates from /etc/ssl/certs/comodo.cert 2008.06.30 14:00:15 LOG7[26276:3083523776]: SSL context initialized for service nntps - Tim Skirvin (tskirvin(a)stanford.edu) -- Information Technology Services http://www.stanford.edu/~tskirvin/ System Software Developer, Unix Team Stanford University

1 1

Windows setup
by Koenraad Lelong 04 Jul '08

04 Jul '08

Hello, I would like to know if it is possible to run a silent setup of the Windows-setup of stunnel. I'm including it in my own setup of my own application so I would like to avoid the interaction of the stunnel-setup. Second question is if it is bad to "install" stunnel more than once on a computer. Until now I had a setup for new installations and an update for updates of my application. This seems not to work because some users use the setup to update an existing installation and with this they run the install of stunnel for the second time. If it is bad, how do I detect the existance of stunnel, and what version it is, so I could update stunnel if it's outdated. Regards, Koenraad Lelong. P.S. If this is the wrong list for such questions I apologize. I would like to know the right list.

1 0

Re: [stunnel-users] Stunnel 4.21 99% cpu ultilization
by Fat Wallet 03 Jul '08

03 Jul '08

Hi, If anyone have a clue on what I should do to fix this issue, I would really appreciated: One of the stunnel process is running at 99% and in R state and the time just keep incrementing. [root@root]# ps auxw|grep stunnel root 781 0.0 0.0 6520 2684 ? T 11:01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 2853 0.0 0.0 3940 604 ttyp2 S+ 11:37 0:00 grep stunnel root 16554 0.0 0.0 3992 788 ? S Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 16555 0.0 0.0 3992 788 ? S Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 16556 0.0 0.0 3992 788 ? S Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 16557 0.0 0.0 3992 788 ? S Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 16558 0.0 0.0 3992 788 ? S Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 16561 0.0 0.0 6520 2684 ? Ts Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 16656 0.0 0.0 6520 2684 ? S Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 23954 0.0 0.0 6520 2684 ? S 08:00 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 23955 99.0 0.0 6520 2684 ? R 08:00 189:52 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 31521 0.0 0.0 6520 2684 ? S 10:30 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf Thanks, Mike ----- Original Message ---- From: Aron Griffis <agriffis(a)n01se.net> To: Fat Wallet <fat8wallet(a)yahoo.com> Cc: stunnel-users(a)mirt.net Sent: Monday, June 30, 2008 11:04:44 AM Subject: Re: [stunnel-users] Stunnel 4.21 99% cpu ultilization Fat Wallet wrote: [Mon Jun 30 2008, 01:28:11PM EDT] > Can someone please help with this issue? This 100% cpu > utilization issue happens randomly on multiprocess cpu. strace, ltrace, build stunnel with debugging symbols and attach gdb to the spinning process, etc. Is your name really Fat Wallet?

2 1

protect the private key, while running stunnel in server mode as a windows service
by sandeep siroya 03 Jul '08

03 Jul '08

Hi, I have stunnel in server mode running as a windows service on a Win2003 Server system. I need to give this system to a different company for testing their client against our server. How do I protect my private key on stunnel, while letting the 3rd company being able to login as administrator on stunnel's win2003 system and start/stop stunnel service? I know one can protect the private key with a passphrase in stunnel, but that does not serve my purpose as stunnel in this case should be able to start/stop without any user-intervention and I cannot store the passphrase in cleartext. thanks , ss

1 0

Peer suddenly disconnected
by victor.harutyunyan＠arca.am 02 Jul '08

02 Jul '08

Hello there, I have installed stunnel server on FreeBSD. I configure it like this cert=server_cert.pem key=private\server_key.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 verify=2 CAfile=test_cert.pem [ssl_host_proxy] accept=172.24.150.15:1234 connect=192.168.1.1:10500 TIMEOUTidle=120 Client side is not a computer it's small device. I generate client certificates in this manor: echo off del test_ck.pem /q # delete previous test.ck.pem file echo Starting New test_ck file Generation C:\OpenSSL\bin\openssl.exe req -new -x509 -newkey rsa:2048 -sha1 -out test_cert.pem -keyout test_key.pem -nodes -config sample_ck.cnf -days 1825 -batch C:\OpenSSL\bin\openssl.exe pkcs8 -in test_key.pem -topk8 -out test_pk8.pem -passout pass:"TestPassword0001" -noiter -v1 PBE-SHA1-3DES del test_key.pem /q copy test_cert.pem+test_pk8.pem test_ck.pem /y del test_pk8.pem /q Echo New test_ck.pem file has the following sections: findstr "BEGIN END" test_ck.pem pause test_cert.pem is on a stunnel server as CAfile and test_ck.pem is on my small device which is capable to connect via stunnel. And I generate other self-signed CA, and generate one certificate request and sign it via this CA, and install that key and certificate on server. cert=server_cert.pem key=private\server_key.pem All is working fine, but after one year my server certificate has expired, when I regenerate new server certificate and try to connect, I see in server log this: Child process 6094 finished with code 0 SSL state (accept): before accept initialization SSL state (accept): SSLv3 read client hello A SSL state (accept): SSLv3 write server hello A SSL state (accept): SSLv3 write certificate A SSL state (accept): SSLv3 write server done A SSL state (accept): SSLv3 flush data SSL_accept: Peer suddenly disconnected And my device can't connect to the server, I haven't any client side logs and error messages, only NOT DELIVERED in my device. :( Can you please help me to solve this problem, I am trying many many times, I was very angry.. Thank you very much. Victor Harutyunyan. P.S. Sorry for my bad english.

1 0

Peer suddenly disconnected
by victor.harutyunyan＠arca.am 02 Jul '08

02 Jul '08

Hello there, I have installed stunnel server on FreeBSD. I configure it like this cert=server_cert.pem key=private\server_key.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 verify=2 CAfile=test_cert.pem [ssl_host_proxy] accept=172.24.150.15:1234 connect=192.168.1.1:10500 TIMEOUTidle=120 Client side is not a computer it's small device. I generate client certificates in this manor: echo off del test_ck.pem /q # delete previous test.ck.pem file echo Starting New test_ck file Generation C:\OpenSSL\bin\openssl.exe req -new -x509 -newkey rsa:2048 -sha1 -out test_cert.pem -keyout test_key.pem -nodes -config sample_ck.cnf -days 1825 -batch C:\OpenSSL\bin\openssl.exe pkcs8 -in test_key.pem -topk8 -out test_pk8.pem -passout pass:"TestPassword0001" -noiter -v1 PBE-SHA1-3DES del test_key.pem /q copy test_cert.pem+test_pk8.pem test_ck.pem /y del test_pk8.pem /q Echo New test_ck.pem file has the following sections: findstr "BEGIN END" test_ck.pem pause test_cert.pem is on a stunnel server as CAfile and test_ck.pem is on my small device which is capable to connect via stunnel. And I generate other self-signed CA, and generate one certificate request and sign it via this CA, and install that key and certificate on server. cert=server_cert.pem key=private\server_key.pem All is working fine, but after one year my server certificate has expired, when I regenerate new server certificate and try to connect, I see in server log this: Child process 6094 finished with code 0 SSL state (accept): before accept initialization SSL state (accept): SSLv3 read client hello A SSL state (accept): SSLv3 write server hello A SSL state (accept): SSLv3 write certificate A SSL state (accept): SSLv3 write server done A SSL state (accept): SSLv3 flush data SSL_accept: Peer suddenly disconnected And my device can't connect to the server, I haven't any client side logs and error messages, only NOT DELIVERED in my device. :( Can you please help me to solve this problem, I am trying many many times, I was very angry.. Thank you very much. Victor Harutyunyan. P.S. Sorry for my bad english.

1 0

socket not getting closed
by Manjunath S Karikatti 02 Jul '08

02 Jul '08

Hello, We are using stunnel to wrap the tcp connetion between the our client session used by users and the server process. Due to some reason when client session terminates abruptly (either due to user's PC crash or network outage) the stunnel process does not terminate. We see that the socket on client PC is closed but stunnel process is still alive with socket for that PC in established state. This is on AIX platform. Do not know this is issue with stunnel process or something on AIX needs to be tuned (like the tcp_keepidle value). Thanks for any info and help. Thanks and Regards, Manjunath

1 0

Re: [stunnel-users] Stunnel 4.21 99% cpu ultilization
by Fat Wallet 01 Jul '08

01 Jul '08

Thanks for your reply. I was hoping to see if someone have a similar issue since there was an issue with stunnel 4.20 version. Thanks, Mike ----- Original Message ---- From: Aron Griffis <agriffis(a)n01se.net> To: Fat Wallet <fat8wallet(a)yahoo.com> Cc: stunnel-users(a)mirt.net Sent: Monday, June 30, 2008 11:04:44 AM Subject: Re: [stunnel-users] Stunnel 4.21 99% cpu ultilization Fat Wallet wrote: [Mon Jun 30 2008, 01:28:11PM EDT] > Can someone please help with this issue? This 100% cpu > utilization issue happens randomly on multiprocess cpu. strace, ltrace, build stunnel with debugging symbols and attach gdb to the spinning process, etc. Is your name really Fat Wallet?

1 0

Stunnel v4.25 vs v4.20
by James Moe 30 Jun '08

30 Jun '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, I upgraded to v4.25 and stunnel aborts right away. v4.20 works just fine. What is protocol family 47? ====[ log file ]==== 2008.06.26 11:31:01 LOG5[282:8553]: stunnel 4.25 on i386-pc-os2-emx with OpenSSL 0.9.8h 28 May 2008 2008.06.26 11:31:01 LOG5[282:8553]: Threading: SSL:ENGINE Sockets:SELECT,IPv4 2008.06.26 11:31:01 LOG3[282:8553]: Error binding pop3.sma.com_L110-R995 to 127.0.0.1:110 2008.06.26 11:31:01 LOG3[282:8553]: bind: Address family not supported by protocol family (47) ====[ conf file ]==== socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 client = yes output = G:/c/voice/pmmdev/testcase/bin/stunnel.log verify = 0 debug = 5 cert = g:/c/voice/pmmdev/testcase/bin/sma-test.pem [pop3.sma.com_L110-R995] accept = localhost:110 connect = pop3.sma.com:995 ;# protocol = pop3 [smtpauth.earthlink.net_L6025-R587] accept = localhost:6025 connect = smtpauth.earthlink.net:587 protocol = smtp [sohnen-moe.com:L6125:R587] accept = localhost:6125 connect = sohnen-moe.com:587 protocol = smtp [smtp.sma.com_L25-R587] accept = localhost:25 connect = smtp.sma.com:587 protocol = smtp - -- jimoe (at) sohnen-moe (dot) com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (OS/2) iD8DBQFIY+DkzTcr8Prq0ZMRArW+AJ4uOJFOGyluIj52DG4cM62jMPs8NACfbug2 oVsLAXJ+fH1Raj568dGn2mM= =JSCM -----END PGP SIGNATURE-----

1 1

Re: [stunnel-users] Stunnel 4.21 99% cpu ultilization
by Fat Wallet 30 Jun '08

30 Jun '08

Hi, Can someone please help with this issue? This 100% cpu utilization issue happens randomly on multiprocess cpu. Thanks! ----- Original Message ---- From: Fat Wallet <fat8wallet(a)yahoo.com> To: stunnel-users(a)mirt.net Sent: Monday, June 23, 2008 10:39:16 AM Subject: Stunnel 4.21 99% cpu ultilization Hi All, I've been googling for this issue but it seems like google is not my friend at the moment. I am running Linux with 4 cpus and top command shows stunnel at 99-100% cpu. Please help. //stunnel configuration file # PID is created inside chroot jail pid = /var/run/stunnel.pid # debug debug = 7 output = /var/log/stunnel.log # Authentication stuff verify = 2 cert = /etc/stunnel/cert.pem CAfile = /etc/stunnel/ca.pem #Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 # Use it for client mode client = yes /////////// stunnel version stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.7a Feb 19 2003 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none //openssl version OpenSSL 0.9.7a Feb 19 2003 //Redhat version Red Hat Linux release 9 (Shrike) root]#cat /proc/cpuinfo | grep processor | wc -l 4 http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

UPNP & Nat-PMP with Stunnel
by Dean Shavit 26 Jun '08

26 Jun '08

Stunnel works great for me, but with dynamic port forwarding, I've not been able to get it working. I suspect it's because stunnel is a bit confusing about which port to reply to... Anyone else found a way to crack this nut?

1 0

How do I kill stunnel?
by Grant Edwards 25 Jun '08

25 Jun '08

I've got an application that starts stunnel using equivalent of a fork/exec. The stunnel process then appears to fork off multiple copies of itself. Before the application exits, it needs to stop stunnel. I send a SIGINT to the PID that was created using the fork, but only the first "master" copy terminates -- the master stunnel process doesn't terminate its children when it exits. So I end up with a bunch of "orphaned" stunnel processes. They're not zombies, they're process that are either in state R or S (runnable or sleeping). How do I tell stunnel to not only terminate, but to terminate whatever child processes it has created? -- Grant Edwards grante Yow! Zippy's brain cells at are straining to bridge visi.com synapses ...

2 4

Stunnel config files incompatible between 4.05 and 4.21 ?
by Brian McKee 25 Jun '08

25 Jun '08

Hi All, I have a stunnel config file that works fine on an older Mandrake machine running stunnel 4.05. If I use that same config file on a new Ubuntu machine running 4.21 it just dies with "/etc/stunnel/stunnel.pem: No such file or directory" IIUC, running in client mode it doesn't need a .pem file, and I didn't create any certifcates on the Mandrake machines. Do I need to generate a cert for some reason? I've attached the config below. Brian =============================== client = yes [telnet] accept = 23 connect = some.ip.number.removed:992 [as-central] accept = 8470 connect = some.ip.number.removed:9470 [as-database] accept = 8471 connect = some.ip.number.removed:9471 [as-rmtcmd] accept = 8475 connect = some.ip.number.removed:9475

1 0

Is the "HTTP Proxy connect" feature implemented?
by alex Wright 24 Jun '08

24 Jun '08

Hey, I'm trying to use stunnel in the following scenerio: ssh-client -> stunnel (to ssl) -> Proxy -> server(ssl to ssh). I downloaded stunnel 4.25, but I hadn't noiticed any support for this. However, in the "patches" page (http://www.stunnel.org/patches/) - three patches seem to be suitable: (connect-proxy_dunbar.patch<http://www.stunnel.org/patches/patches/connect-proxy_dunbar.patch>, connect-proxy.mwald.patch<http://www.stunnel.org/patches/patches/connect-proxy.mwald.patch>) but are for version 4.05 (whichwill probably be a pain to merge with current version). When I stumbled upon the Changelog ( http://www.stunnel.org/download/ChangeLog.txt) I noticed that version 4.15, has support for "Client mode CONNECT protocol" - which is what I need - and altough i had looked hard, I haven't found any documentation to it. So, is the above feature what I want (and if so - how do I use it?) or do I need to update the patches to the current version? Thanks in advance, Alex.

1 0

Stunnel 4.21 99% cpu ultilization
by Fat Wallet 23 Jun '08

23 Jun '08

Hi All, I've been googling for this issue but it seems like google is not my friend at the moment. I am running Linux with 4 cpus and top command shows stunnel at 99-100% cpu. Please help. //stunnel configuration file # PID is created inside chroot jail pid = /var/run/stunnel.pid # debug debug = 7 output = /var/log/stunnel.log # Authentication stuff verify = 2 cert = /etc/stunnel/cert.pem CAfile = /etc/stunnel/ca.pem #Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 # Use it for client mode client = yes /////////// stunnel version stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.7a Feb 19 2003 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none //openssl version OpenSSL 0.9.7a Feb 19 2003 //Redhat version Red Hat Linux release 9 (Shrike) root]#cat /proc/cpuinfo | grep processor | wc -l 4 http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

Using Stunnel on Vista
by John Lallemand 18 Jun '08

18 Jun '08

We have a system that needs a TN3270 client and Stunnel to connect on XP. Currently, OnNet Host/Rumba is the most popular TN3270 client in use. But when we try these programs on Vista, the connection times out. 1) Is Stunnel Vista compatible? 2) If it is, does Stunnel need specific settings to work on Vista? Thank you! ------------------------------ John Lallemand Software Release Manager University of California, Santa Cruz

2 1

Problem with multiple stunnel jobs
by Carter Browne 17 Jun '08

17 Jun '08

A couple of days ago, I upgrade from 4.15 to 4.23 on a Linux system running Redhat 8. At the same time I went from openssl 0.9.8g to 0.9.8h. No changes were made to the configuration file. After the change, rather than starting a single process, it starts 6 processes. The process number of the lowest number process is the one that is put into the /var/run/stunnel.pid file. When I try to stop stunnel, using /etc/init.d/stunnel stop, the lowest number process is kill, and the highest number process seems to be running continuously - although it is not a hard cpu loop, but it keeps on accumulating run time. The number of processes may not be a new phenomenon, but the inability to kill itself is. I normally restart the stunnel on a daily basis to keep the log files manageable, but with this new behavior, the /etc/init.d/strunnel restart command fails because the ports are still in use. Any ideas on how to fix this problem. Thanks, Carter -- Carter Browne CBCS cbrowne(a)cbcs-usa.com 781-721-2890

2 1

Goldmine 8 & Advisormail SSL problems
by Stephen E. Rischall 17 Jun '08

17 Jun '08

1 0

stunnel service problems...
by Jeremy Paje 10 Jun '08

10 Jun '08

Has anyone had any problems with the windows stunnel service not starting automatically? We install stunnel as a service (stunnel.exe -install) We've had it previously installed on 600+ machines with no problems, but recently (noticed on slower machines running XP) the stunnel service does not start...but it happens randomly only on slower machines. The following errors are in the event log... Timeout (30000 milliseconds) waiting for the stunnel service to connect. (Event ID ID 7009) AND The stunnel service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. (Event ID 7000) I've tried setting the service to restart if failed, and to delay 2 minutes before restart, etc with no luck. If you start the stunnel manually all is well, it just doesn't start on bootup. Any suggestions? Thanks JP

1 0

Re: [stunnel-users] stunnel compatibility question
by Brian Hatch 09 Jun '08

09 Jun '08

Roughly around 2008-06-09 11:34 -0400, Patel Dippen-CDP054 kibitzed: > In this scenario, can Stunnel listen on the UDP port on the local No. Stunnel will not listen on UDP ports. Stunnel will not send UDP packets. Stunnel doesn't support UDP. -- Brian Hatch The problem is that you'd Systems and probably make something Security Engineer useful of my life that http://www.ifokr.org/bri/ I would never do. Every message PGP signed

2 1

Fw: Re: stunnel compatibility question
by Jeffrey Buck 06 Jun '08

06 Jun '08

1 0

Re: [stunnel-users] stunnel compatibility question
by Brian Hatch 05 Jun '08

05 Jun '08

At almost 2008-06-05 09:37 -0400, Patel Dippen-CDP054 cajoled: > I guess what I am stating is can Stunnel listen on a UDP port The answer to that question is 'no, it cannot.' -- Brian Hatch "I was looking at bringing Systems and up some new servers on Security Engineer imaginary hardware." http://www.ifokr.org/bri/ --Jason Every message PGP signed

1 0

stunnel compatibility question
by Jeffrey Buck 04 Jun '08

04 Jun '08

2 4

Re: [stunnel-users] stunnel compatibility question
by Brian Hatch 03 Jun '08

03 Jun '08

In the neigborhood of 2008-06-03 07:58 -0400, Patel Dippen-CDP054 argued: > Will Stunnel work for UDP data? Stunnel only accepts TCP connections. > We have traffic going into the Server on UDP and outbound from the Server on TCP. You'll want an actual VPN protocol to handle that then. Or consider using a better protocol - what you describe makes the firewalls cry. > My understanding is that OpenSSL implemented the DTLS protocol (TFC > 4347: to support UDP data) in version 0.9.8 (OpenSSL: a free and popular > implementation of TLS added support for DTLS with version 0.9.8.) Not supported in Stunnel currently. -- Brian Hatch Always yield to temptation, Systems and because it may not pass Security Engineer your way again. http://www.ifokr.org/bri/ Every message PGP signed

1 0

Is anyone using Stunnel for tunnelling Voip?
by Errol Samuels 03 Jun '08

03 Jun '08

Hello All, I am currently researching a solution for tunnelling VoIP traffic since VoIP is blocked in the country concerned. It appears that the ISP is targeting OpenVPN and OpenSwan and blocking them so I want to try something different. My solution based on OpenVPN worked great until it got blocked by the ISP about a week ago. It was using an OpenVPN server hosted in a US Datacenter and the VPN clients were simply routers with third party Linux firmware with the OpenVPN client embedded in the firmware. I am also investigating the possibility of tunnelling OpenVPN through SSH but I have to watch my IP overheads here because the ISP watches the upload bandwidth as well! Has anyone attempted or had any success using stunnel for a similar scenario as I have mentioned? Thanks in Advance Regards, Errol

3 9

Can I put an accept+connect pair anywhere in the conf file?
by Ben Stover 02 Jun '08

02 Jun '08

The *.conf file is divided into several sections: [imaps] .... [pop3s] .... [smtps] ..... Are these "section headers" just comments and can I put my accept+connect pair on an arbitrary place in the *.conf file (as long as they are preceeded by their own section header [foobar] ? Ben

2 1

Connecting to mySQL from Windows
by Alistair Scott 02 Jun '08

02 Jun '08

Hi everyone I have a mySQL database that I need to connect to through SSH. I have successfully setup a connection to it using Plink. However, I'm running this from a batch file and I'd like a more elegant solution - that's where stunnel comes in I think. Rather than running a batch file, I'd like to run the connection as a Windows service - which I think this is achievable with stunnel. Trouble is, I can't work out how to do it. This is what I'm trying to achieve... Windows computer connects to mySQL server through SSH. Forwards a port to the mySQL server port 3306. Application on Windows computer connects to local forwarded port & therefore connects to the mySQL db at the remote end. I was hoping that someone could give me a pointer as to how I can set this up. Thanks in advance. Al

1 0

stunnel 4.25 released
by Michal Trojnara 01 Jun '08

01 Jun '08

Dear Users, Version 4.25, 2008.06.01, urgency: MEDIUM: * New features - Win32 DLLs for OpenSSL 0.9.8h. * Bugfixes - Spawning libwrap processes delayed until privileges are dropped. - Compilation fix for systems without struct msghdr.msg_control. Home page/download: http://stunnel.mirt.net/ sha1sum for stunnel-4.24.tar.gz file: fc6d61fad996f750c76ea627c5dd9f789af0eaf6 Best regards, Mike

1 0

Re: [stunnel-users] stunnel compatibility question
by Brian Hatch 30 May '08

30 May '08

Right around 2008-05-30 13:51 -0400, Patel Dippen-CDP054 suggested: > Is the true? I have a similar issue. I have never implemented SSL or > Stunnel. But, on whatever readup I have done so far, it seems Stunnel is > a tunneling protocol (IPnIP). So, you do have to have Stunnel on the > other end to extract the IP packet. Stunnel puts data inside SSL, inside TCP. Just like HTTPS is HTTP (data) inside SSL, inside TCP. You can think of the cleartext data inside the SSL tunnel for both of those examples. Yes, the data needs to be extracted from the SSL stream in both cases, but the application that gets it doesn't need to know diddly about it. > I mean if you are saying it will work, that's great news for me. It works if Stunnel is on one side and an SSL client or server is on the other side. > Our Server will have OpenSSL implementation but we plan to deploy > Stunnel on the Client machine. That's what Stunnel is for. -- Brian Hatch "Sorry, sorry, Systems and sorry, much apologizings." Security Engineer http://www.ifokr.org/bri/ Every message PGP signed

1 0

Need class name for stunnel
by Bill Murphy 28 May '08

28 May '08

I'm using stunnel to send and receive emails in a Microsoft Access 2007 application. I would like to be able to programmatically close stunnel when the user exits a form in the application which is used for sending and receiving emails. I can close other programs running in Windows with the code in this api: http://www.mvps.org/access/api/api0025.htm This code requires the "class name" of the application while it is running in Windows in order to close it. Stunnel.exe does not appear to have a class name. I've used the following additional api to display the class names of all currently running apps: http://www.mvps.org/access/api/api0013.htm Stunnel.exe does not show up in the list of running apps produced by this code. Is there another way to determine the stunnel class name? Bill

1 0

Re: [stunnel-users] Problem with Stunnel and OpenBSD
by Juan J. Martínez 23 May '08

23 May '08

Hello, I'm debugging with openssl s_client... >From inside the box: $ openssl s_client -connect blackshell.usebox.net:995 CONNECTED(00000004) depth=0 /C=ES/ST=Valencia/L=Valencia/O=usebox.net/OU=blackshell/CN=blackshell.usebox.net verify error:num=18:self signed certificate verify return:1 depth=0 /C=ES/ST=Valencia/L=Valencia/O=usebox.net/OU=blackshell/CN=blackshell.usebox.net verify return:1 ... And works fine. >From outside: $ openssl s_client -connect blackshell.usebox.net:995 CONNECTED(00000003) (and halts for n minutes) I hope this helps, even I don't know the difference between "CONNECTED(00...4)" and "CONNECTED(00...3)". Regards, Juanjo -- desarrollo y sistemas: http://www.usebox.net/ página personal: http://www.usebox.net/jjm/

1 1

STUNNEL: Thunderbird with Exchange and only inbound port 443
by Fatma 23 May '08

23 May '08

Hello All, A quick question regarding the stunnel ability to work with the following scenario. Scenario is: I have an Exchange Server sitting on the external perimeter with Outlook Web Access (OWA) enabled and it is the frontend and backend mail server as well. And I have a remote client which has a Thunderbird Client (for example) that I need it to connect to the Exchange Server to retrieve emails. The only inbound port to the Exchange Server from a network perspective is HTTPS-443 and no other ports are open on the firewall. Now the question is how can a client thunderbird connect to the Exchange Server/OWA with only 443 port open. So what i was thinking is and tell me if this works? If i install two instances of STUNNEL one on the remote client and one on the exchange server and the following happens. on the client the stunnel listens on port 25 SMTP and encrypts and forwards to port 443 then the server recieves and listens on port 443 and decrypts and forwards to port 110 POP3 will that work actually? hmmm i wish i explained that pretty well. if not then how can it work with the given scenario. cheerz.

1 0

Re: [stunnel-users] Wrapping a mail client - multiple servers
by Ludolf Holzheid 21 May '08

21 May '08

On Wed, 2008-05-21 14:39:42 +0100, Daniel James wrote: > [..] > > Can I, for example, put multiple [SSMTP] sections and multiple [POP3S] > sections in one stunnel.conf? I don't know. But if you can, you don't want to. The section headers don't specify a protocol. They simply give the section a name (for log output, e.g.). There is no problem in naming sections [first-POP3S] and [second-POP3S]. HTH, Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Wrapping a mail client - multiple servers
by Daniel James 21 May '08

21 May '08

I use a mail client that does not directly support SSL. I can use stunnel to provide the security layer when I connect to a SSMTP and/or POP3S server (under windows). This works fine, whether I run stunnel as a background application or as a Windows service. I'd like, however, to be able to connect to multiple mail servers over SSL. I'm not sure how I might achieve this? What would be nice would be get stunnel to forward POP3/SMTP communication on different local ports to POP3S/SSMTP on different remote servers. Can I do this? It appears to be possible to run multiple copies of stunnel as applications, and to get each copy to take its configuration from a different stunnel.conf file, so that different copies of stunnel could listen on different local ports and each could proxy the traffic it receives to a different remote server (I haven't tried this -- and it's not an ideal solution -- but it looks as though it should work). It does not appear to be possible, however, to create two instances of the stunnel service running with different configuration files. Is it possible to set up multiple listening ports proxying to different remote servers in a single configuration file? If so, what's the syntax for that? Cheers, Daniel.

1 0