- stunnel-users - stunnel.org

stunnel wildcard question
by neve_capricorn＠gmx.de 17 Apr '08

17 Apr '08

hi, iam pulling my hair out with an wildcard ssl certificate / stunnel configuration. i use stunnel 4.2.2 and latest openSSL release. i have a signed wildcard certificate from comodo. when i add the .crt, .key and .ca-bundle file into an apache configuration, everything work fine in firefox and ie. when i try to use stunnel with the same certificates i got problems in firefox when i disable ; Authentication stuff ; verify =1 and when i set verify=1 i got problems in IE .7 (a dialog box pops and ask for identification the certificates). can someone maybe help me out,please? a demo is here: https://ssl1.medialib.de (works fine in firefox) https://ssl1.medialib.de (problem in IE7) thank you very much & best gary

1 0

Verify=3 cache expiration
by Edouard Dessioux 16 Apr '08

16 Apr '08

Hi everyone, I'm using stunnel v4.16 on a Windows 2003 Server, and I'm working with stunnel in verify=3 mode. I wanted to know if the stunnel needs to be restarted after a certificates has been removed ? If not, how long is the cache expiration delay before being taken into account ? Regards, Edouard DESSIOUX Directeur de Projets Tibco Mobile 3, rue Danton - 92240 Malakoff Tél : +33 (0)1 55 58 04 59 - Fax : +33 (0)1 55 58 03 89 - Mob. +33 (0)6 34 02 61 54 E-mail : edessioux(a)tibco.fr - www.tibcomobile.fr Faites un geste pour la planète, n'imprimez ce message que si nécessaire.

1 0

SCM repo?
by Alberto Giménez 12 Apr '08

12 Apr '08

Hello, Is there any public SCM (SVN, GIT, whatever) repository? I haven't seen anything on the website and I'd like to try to implement a new feature. Thanks in advance. -- Alberto Giménez

2 1

Stunnel 4.22 compiling issues on Solaris 10
by cod3fr3ak 09 Apr '08

09 Apr '08

I have sucessfully compiled Stunnel 4.22 on Solaris 10, but still recieve the sam errors during the configure. Initially I tried using Openssl-0.9.8f from Sun Freeware. Then I built and compiled Openssl-0.9.8g, but I still recieved the following errors on the build: configure: **************************************** SSL checking for SSL directory... /usr/local/ssl checking for obsolete RSAref library... no checking /usr/local/ssl/include/openssl/engine.h usability... yes checking /usr/local/ssl/include/openssl/engine.h presence... no configure: WARNING: /usr/local/ssl/include/openssl/engine.h: accepted by the compiler, rejected by the preprocessor! configure: WARNING: /usr/local/ssl/include/openssl/engine.h: proceeding with the compiler's result checking for /usr/local/ssl/include/openssl/engine.h... yes <ftp://ftp.sunfreeware.com/pub/freeware/sparc/10/openssl-0.9.8f-sol10-sparc-…>

1 0

Using stunnel + haproxy for SSL support
by Alberto Giménez 04 Apr '08

04 Apr '08

Hi, I'm having trouble using stunnel and haproxy to load balance https and http traffic. To be honest, I really don't know wether it is stunnel or haproxy related so I am going to contact both lists :) I have set up a haproxy load balancer as http proxy for two backend Apache2 webservers. It works fine. I also have stunnel on the same LB to add SSL suport (with xforwardedfor patch installed). It works fine (mostly). The issue is related to Apache trailing slash thingie. If I query https://haproxy.domain.loc/hatest/ it works perfectly, but if I omit the trailing slash: https://haproxy.domain.loc/hatest then following things happen: - Browser makes SSL connection with stunnel on port 443. - stunnel deciphers and forwards the request on the haproxy attached to LB's port 80. - haproxy (now using plain http) forwards to one of the backends. - Apache2 located on the backend replies with "301 moved permanently" to force the browser to add the trailing slash. As Apache was queried by *haproxy in plain http*, the 301 includes http:// on the Location header. HTTPS is over from now! - The client browser then rewrites the address to http://haproxy.domain.loc/hatest/ and SSL is lost forever. I've been googling and searching the lists but nothing found, just this old message: http://mirt.net/pipermail/stunnel-users/2007-January/001437.html Has anyone found a workaround for that issue? Thanks in advance. -- Alberto Giménez

2 1

Problems with Stunnel 4.22 build
by GGrant 04 Apr '08

04 Apr '08

There's a problem with the Stunnel 4.22 build as there's undefined IDs in the resources.rc file. To get around this get the resources.rc file from an earlier build (e.g. Stunnel 4.21) and replace it. It should compile happily -- View this message in context: http://www.nabble.com/Problems-with-Stunnel-4.22-build-tp16491431p16491431.… Sent from the Stunnel - Users mailing list archive at Nabble.com.

1 0

23 secs to list 5000 files using stunnel and samba on linux
by Paul Kerin 04 Apr '08

04 Apr '08

Hi I'm using the following s/w versions on RHEL3: Stunnel: 4.04 (also experimenting with 4.22, no difference so far) Samba: 3.0.9-1.3E.10 Kernel: 2.4.21-32.0.1.EL Stunnel is used to encrypt samba connections from linux clients because redhat 3 doesn't support NTLMv2 (cifs not standard and probably not an option). To list 5000 files (simply typing ls within a mounted directory on the client) it consistently takes around 20-23 seconds to return the data. Listing is almost instantaneous when using a windows client, or using a linux client without stunnel. As a side note, if I pipe the result to /dev/null it takes around 9 seconds (?). The network forwarding path from the samba client to samba server is: smbclient > localhost:924 > stunnel > remotehost:923 > stunnel > samba server (port 446) Tcpdump shows that when using stunnel about 10500 packets are generated, minus stunnel it's more like 500. I'd expect some overhead related to SSL, but 21 times the traffic seems a little excessive. I've experimented with socket options such as TCP_NODELAY, SO_LINGER, SO_RCVLOWAT, SO_OOBINLINE, etc with no improvement at all. However, my understanding of these is pretty superficial so I'm not confident I've exhausted all options here (ie perhaps combining multiple settings at once). I've got stunnel debug set to 7 on client and server. No errors and no logging at all except for the initial handshake when the mount is created. Including the tcpdump would probably be excessive at this stage. In summary, using stunnel the data gets transmitted in packets usually containing around 200 bytes, whereas without stunnel it's mostly 1408 byte packets. Any suggestions? Thanks Paul

4 4

Stunnel Newbie - Compiling Stunnel and adding patches for Windows
by GGrant 02 Apr '08

02 Apr '08

Hi, I've downloaded the Stunnel source code and I am trying to compile it with the Visual C++ compiler (cl.exe). I am not sure what to do as I cannot find the Makefile.w32. So how do I go about it? Also how do you apply a user patch to the source code/ Must I copy and paste the code to the required files? Cheers -- View this message in context: http://www.nabble.com/Stunnel-Newbie---Compiling-Stunnel-and-adding-patches… Sent from the Stunnel - Users mailing list archive at Nabble.com.

1 0

Stunnel-Openssl: Problems with certificate chain
by Pietro Di Primo 31 Mar '08

31 Mar '08

Hi, My name is Pietro Di Primo and I work on the INFN Grid project (http://grid.infn.it/). I'm trying to develop an application based on stunnel. Everything works well when I use user certificates (signed by our CA), but i need to use (on the client side) a particular proxy. This proxy contains a public and a private key, and the public key of the user that generated it (I atteched a file with a such proxy). On the server side I have the CA certificate but not the user's one, so I can't verify the client (unable to get local issuer certificate). I tried to get the user certificate using the SSL_get_peer_cert_chain function on the server, but it returns NULL. On the client side I tried SSL_CTX_use_certificate_chain_file, Also I tried to get a STACK_OF(X509) and use SSL_CTX_use_certificate (for proxy certificate), and SSL_CTX_add_extra_chain_cert (to include the user's certificate), but it still doesn't work. Can you help me please? Best Regards -- --- Ing. Pietro Di Primo INFN - Istituto Nazionale di Fisica Nucleare Grid Computing Research Area Via S. Sofia 78 95123 CATANIA (Italy) Voice : +39 095 378-5446/5517 Fax. : +39 095 378 5518 Mobile : +39 320 8591527 E-mail : pietro.diprimo(a)ct.infn.it Skype : pietrodiprimo

1 0

Re: [stunnel-users] Enhancement request - Increase thread stack size
by Mccue, Richard Alan 26 Mar '08

26 Mar '08

Michal Trojnara wrote: >> I load an engine into Stunnel to access the private key. The engine loads >> without incident, but Stunnel consistently aborts when creating a session >> with the first peer because the thread stack is too small. > > I'm not sure if it's a good idea to sacrifice stunnel scalability for > compatibility with this engine. Thread stack size is one of the main > limitations for the number of concurrent threads on 32-bit platforms. IMHO > it's better to fix the engine code to allocate its buffers on the heap.> > > What do you think? All things considered, I must agree that reducing the engine use of the stack would be the better solution. I'll look it over and see if I can find anything sizable on the stack to move. Thanks for the suggestion! - Rich

2 2

New libwrap code
by Randy McMurchy 26 Mar '08

26 Mar '08

Hi all, My apologies if this has been discussed (I've reviewed the archives since 4.21 was released), and if so please just point me in the right direction. I read in some of the messages there's been a revamp (overhaul, changes, whatever) of the libwrap code in Stunnel-4.21. I'm not having any issues using the new version, however, I'm seeing it spawn 5 processes where in every other version I've used in the past there has always only been one process spawned. Here's what I see: root 3408 1 0 17:50 pts/10 00:00:00 /usr/bin/stunnel root 3409 1 0 17:50 pts/10 00:00:00 /usr/bin/stunnel root 3410 1 0 17:50 pts/10 00:00:00 /usr/bin/stunnel root 3411 1 0 17:50 pts/10 00:00:00 /usr/bin/stunnel root 3412 1 0 17:50 pts/10 00:00:00 /usr/bin/stunnel stunnel 3413 1 0 17:50 ? 00:00:00 /usr/bin/stunnel Is this a product of the new libwrap code? I turned debug messages WAY up and I see over and over startup messages for all 5 processes. Example of one: 2008.03.25 17:50:24 LOG5[3407:3082803904]: stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.8e 23 Feb 2007 2008.03.25 17:50:24 LOG5[3407:3082803904]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Auth:LIBWRAP 2008.03.25 17:50:24 LOG6[3407:3082803904]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.03.25 17:50:24 LOG6[3407:3082803904]: poll() used - no FD_SETSIZE limit for file descriptors 2008.03.25 17:50:24 LOG5[3407:3082803904]: 500 clients allowed 2008.03.25 17:50:24 LOG7[3407:3082803904]: FD 9 in non-blocking mode 2008.03.25 17:50:24 LOG7[3407:3082803904]: FD 10 in non-blocking mode 2008.03.25 17:50:24 LOG7[3407:3082803904]: FD 11 in non-blocking mode 2008.03.25 17:50:24 LOG7[3407:3082803904]: SO_REUSEADDR option set on accept socket 2008.03.25 17:50:24 LOG7[3407:3082803904]: swat bound to 0.0.0.0:904 2008.03.25 17:50:24 LOG7[3413:3082803904]: Created pid file /run/stunnel.pid 2008.03.25 17:50:42 LOG7[3413:3082803904]: swat accepted FD=12 from 192.168.11.212:1535 2008.03.25 17:50:42 LOG7[3413:3086076816]: swat started 2008.03.25 17:50:42 LOG7[3413:3086076816]: FD 12 in non-blocking mode 2008.03.25 17:50:42 LOG7[3413:3086076816]: Waiting for a libwrap process 2008.03.25 17:50:42 LOG7[3413:3086076816]: Acquired libwrap process #0 2008.03.25 17:50:42 LOG7[3413:3086076816]: Releasing libwrap process #0 2008.03.25 17:50:42 LOG7[3413:3086076816]: Released libwrap process #0 2008.03.25 17:50:42 LOG7[3413:3086076816]: swat permitted by libwrap from 192.168.11.212:1535 2008.03.25 17:50:42 LOG5[3413:3086076816]: swat accepted connection from 192.168.11.212:1535 When I connect to swat (Samba config tool) it again goes through a process of using all 5 of the system processes. Sorry for being so verbose here. My question is: Has something changed so that there is more than one process spawned (and used) when Stunnel is started? Any help would be appreciated. -- Randy

1 0

Enhancement request - Increase thread stack size
by Mccue, Richard Alan 25 Mar '08

25 Mar '08

I load an engine into Stunnel to access the private key. The engine loads without incident, but Stunnel consistently aborts when creating a session with the first peer because the thread stack is too small. I rebuilt Stunnel 4.21 on my test machine after increasing the stack size parameter and it fixed the problem. Here is the diff: --------------------- # diff -b common.h common.h_orig 33c33 < #define STACK_SIZE 32768*4 --- > #define STACK_SIZE 32768 42c42 < #define STACK_SIZE 65536*4 --- > #define STACK_SIZE 65536 --------------------- Could this enhancement be included in the next Stunnel release? Regards, Rich

1 0

HTTPS being redirected back to HTTP
by Steven Buehler 25 Mar '08

25 Mar '08

I have tested several versions of stunnel up to version 4.21 on SLES 9 and 10. I am trying to use stunnel to implement TLS 1.0 for HTTPS on a Lotus Domino server. I am able to connect to the Domino server with a web browser with HTTPS successfully. However, once I log into the server it drops me back down to HTTP. I suspect the Domino server is sending a redirect back to HTTP during the login because if I change the URL back to HTTPS in the browser after the login, it re-establishes the HTTPS connection. I've checked with Lotus support and there is nothing that can be done on the Domino server to prevent this. Is there anyway to handle this in stunnel so that the requests remain as HTTPS requests to the browser? Here is the services section of my stunnel.conf [https] sslVersion = TLSv1 accept = gsvatestm02.er.usgs.gov:443 connect = gsvatestm02.er.usgs.gov:80 TIMEOUTclose = 0

2 1

possible stunnel memory leak
by Stefano Stabellini 25 Mar '08

25 Mar '08

Hi all, I may have found a possible memory leak in stunnel (version 4.15) when used with pthreads. What I am seeing is the memory usage going up when connections open and never going down, no matter if all the connections close. It is really easy to reproduce it: I have started two stunnel instances communicating with each other, the first one acting as a server (config file stunnel.1) and executing cat, the second one acting as a client (config file stunnel.2) and opening port 5556. Then I execute the script I have attached that simply opens 500 connections using netcat to port 5556. If you cat /proc/<stunnel pid>/status you can see that the memory usage is about 300MB. The problem is that even after all the connections are closed the memory usage stays (more or less) the same. I tried to find the bug myself using valgrind, but I couldn't get far, it seems that valgrind gets confused by openssl so doesn't print very useful informations. I really appreciate any help you can give me; just tell me if you need any other info. Best Regards, Stefano Stabellini #!/bin/bash i=1 while test $i -lt 520 do cat script | nc 127.0.0.1 5556 &>/dev/null & echo $i i=$(( $i + 1 )) done foreground = yes [test] accept = 5555 cert = /etc/ssl/certs/stunnel.pem exec = cat foreground = yes [test] accept = 5556 cert = /etc/ssl/certs/stunnel.pem client = yes connect = 5555

1 0

IMAPS stunnel on older OSX Mac: SSL3_GET_RECORD:wrong version number
by Tom Shaw 23 Mar '08

23 Mar '08

1. compiled and installed stunnel on older OSX Mac. Tried connectiong via IMAPS and POP3S using Apple OSX Mail and I get the errors shown in line 4. Process works when I change my .conf file to contain sslVersion = SSLv2. I'm a neophyte to ssl and I have no idea what is wrong or where to start or if this situation is OK. Any help is appreciated. Also this needs to be backward compatible to OSX 10.3.9 which is why the compiling on Panther. 2. stunnel version 4.20 3. standalone via sudo from command line 4. error message Mar 23 10:49:52 musky stunnel: LOG5[2941:25192960]: imaps accepted connection from 206.208.58.127:37295 Mar 23 10:49:52 musky stunnel: LOG3[2941:25192960]: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number Mar 23 10:49:52 musky stunnel: LOG5[2941:25192960]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 5. $ /usr/local/sbin/stunnel -version stunnel 4.20 on powerpc-apple-darwin7.9.0 with OpenSSL 0.9.7l 28 Sep 2006 Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv4 Auth:LIBWRAP Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none 6. $ uname -a Darwin musky.oitc.com 7.9.0 Darwin Kernel Version 7.9.0: Wed Mar 30 20:11:17 PST 2005; root:xnu/xnu-517.12.7.obj~1/RELEASE_PPC Power Macintosh powerpc 7. Your libc version if you use Linux. 8. $ gcc -v Reading specs from /usr/libexec/gcc/darwin/ppc/3.3/specs Thread model: posix gcc version 3.3 20030304 (Apple Computer, Inc. build 1666) 9. $ openssl version OpenSSL 0.9.7l 28 Sep 2006 10. My conf ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /usr/local/etc/stunnel/secure_mail.pem ;key = /usr/local/etc/stunnel/secure_mail.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv2 ; Some security enhancements for UNIX systems - comment them out on Win32 ;chroot = /usr/local/var/lib/stunnel/ ;setuid = nobody ;setgid = nobody ;setgid = nogroup ; PID is created inside chroot jail pid = /var/run/stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /usr/local/etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ;output = stunnel.log ; Use it for client mode ;client = yes ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 587 [sldap] accept = 636 connect = 389 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini

1 0

What is the stable version of Stunnel?
by Randy McMurchy 22 Mar '08

22 Mar '08

Hi all, Can anyone say for sure what is the stable version of Stunnel? On the main Stunnel web site page ( http://www.stunnel.org ) and in the announcement for the version it says the new 4.21 version is experimental. However, on the download page ( http://www.stunnel.org/download/source.html ) the 4.21 version is flagged as the stable version. Sort of confusing. -- Randy

2 1

compiling stunnel 4.21 on solaris 10
by cod3fr3ak 14 Mar '08

14 Mar '08

Is this not compatible with Openssl 0.9.8f? I think 0.9.8g only reacently came out. Is this the only thing wrong. All my other applications work with this version of openssl. BTW I am using the sunfreeware version, because I wanted to avoid having to compile a bunch of software. i was planning to only compile Stunnel, and maybe swatch. I'll compile Openssl if there is no other way but I'd rather not. Any ideas? R

1 0

bidirectional tunnel
by Leo Cherepanov 14 Mar '08

14 Mar '08

Hello. First of all - thanx a lot, I'm using stunnel every day and it helps me. It will help me even more :) if I can make bidirectional tunnel between external server S and computer C behind nat-proxy-firewall. Of course, C is initiator. I mean after tunnel is up, there is a port-forward C:port1->S:port2 (already works) _and_ S:port3->C:port4 Once again, S has an external ip, C has a private ip. Is this schema posible? Thanx en avance.

1 0

SSLV3 decompression failure???
by Earl Stenlund 13 Mar '08

13 Mar '08

I've been running into the error below: SSL_connect: 14094406: error:14094406:SSL routines:SSL3_READ_BYTES:sslv3 alert decompression failure Running Vista SP1 with stunnel 4.21 connecting to newshosting. It seems to come and go. Any ideas on what is causing this or how to fix it? Thanks, Earl

1 0

Re: [stunnel-users] Compiling Stunnel 4.21 on Solaris 10
by cod3fr3ak 13 Mar '08

13 Mar '08

Is this not compatible with Openssl 0.9.8f? I think 0.9.8g only reacently came out. Is this the only thing wrong. All my other applications work with this version of openssl. BTW I am using the sunfreeware version, because I wanted to avoid having to compile a bunch of software. i was planning to only compile Stunnel, and maybe swatch. I'll compile Openssl if there is no other way but I'd rather not. Any ideas? R

1 0

Compiling Stunnel 4.21 on Solaris 10
by cod3fr3ak 13 Mar '08

13 Mar '08

I am trying to compile Stunnel 4.21 on Solaris 10 with no luck. I am using Openssl 0.9.8f. After running configure, I run make and receive the following output: (truncated for size) ------------------------------------------------------- /bin/bash ../libtool --tag=CC --mode=link gcc -m64 -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/local/ssl/include -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o pty.o -lz -ldl -lsocket -lnsl -lpthread -L/usr/local/ssl/lib -lssl -lcrypto gcc -m64 -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/local/ssl/include -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o pty.o -lz -ldl -lsocket -lnsl -lpthread -L/usr/local/ssl/lib -lssl -lcrypto Undefined first referenced symbol in file BIO_set_flags protocol.o SSL_CTX_set_info_callback ctx.o ld: fatal: Symbol referencing errors. No output written to stunnel collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `stunnel' Current working directory /tmp/stunnel-4.20/src *** Error code 1 The following command caused the error: failcom='exit 1'; \ for f in x $MAKEFLAGS; do \ case $f in \ *=* | --[!k]*);; \ *k*) failcom='fail=yes';; \ esac; \ done; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='src doc tools'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || eval $failcom; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' I have tried Stunnel version 4.21, 4.20 with the same results. I have used Stunnel to help build several secure log servers in the past, and I've never had problems getting it compiled and installed. Any help would be greatly appreciated. cod3fr3ak

1 0

Re: [stunnel-users] stunnel not seeing ca bundle files
by Ludolf Holzheid 12 Mar '08

12 Mar '08

On Wed, 2008-03-12 09:05:17 -0700, sf.techguy(a)gmail.com wrote: > [..] > > Tried the command above on the 1st of 5 crt files (openssl pkcs12 -in > filename.crt -out filename.pem), and am getting this error: > > 19319:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong > tag:tasn_dec.c:1007: > 19319:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 > error:tasn_dec.c:305:Type=PKCS12 > > Any ideas why that might be happening? It seems your files do not contain a PKCS#12 structure (containing the key and the whole certificate chain). I should have recognize this by the fact you have one file for each certificate. Sorry. Maybe you should give the x509 openssl command a try: openssl x509 -in filename.crt -inform DES -out filename.pem HTH, Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

stunnel not seeing ca bundle files
by sf.techguy＠gmail.com 12 Mar '08

12 Mar '08

I'm running stunnel 4.14 on Darwin 7.0.0 (Mac OS X Server 10.4.11), with OpenSSL 0.9.71. I purchased a security certificate from comodo, and was able to get it installed and working (mostly) with stunnel, but when I browse to the website, I get an error that the the browser can't verify the identity of the site, due to a problem w/the security cert. I called comodo, and they the error is caused by stunnel not seeing the intermediate certificate files that they told me need to be installed in order for their certificate to work. These files were: ComodoUTNServerCA.crt UTNAddTrustServerCA.crt AddTrustExternalCARoot.crt EssentialSSLCA.crt my_server_net.crt I modified stunnel.conf, and included this line: CApath = ca-certs/ (<- dir path, relative to chroot, containing above files) But the error persists. Can anyone tell me if what comodo support is telling me is even correct? I've verified that my .key and .crt files match by running: $ openssl x509 -noout -modulus -in server.crt | openssl md5 $ openssl rsa -noout -modulus -in server.key | openssl md5 And the output of both matches. Not sure what to try next. Any help much appreciated! Thanks in advance...

3 2

(no subject)
by Eddie Castelli 11 Mar '08

11 Mar '08

Dear all, Some years ago I have installed Apache, PHP and mySQL. Now I need to update. Unfortunately I can't remember if I installed a package or individual program elements. Could please someone help me and guide me trough as I need urgently the update. Many thanks in advance. -- best regards Eddie

3 3

behaviour on remote disconnection
by Marek Jarycki 11 Mar '08

11 Mar '08

Hi. I'm using 3.26 version of stunnel. How to disallow creating local sockets (on client side) when remote (server) is not available? My application detects socket creation errors and it works without stunnel, but in stunnel the socket is always opening correctly so I have to wait for timeouts to discover network disconnection. Regards, deimoss

2 1

Re: [stunnel-users] unknown protocol error (140770FC) with xinetd
by Ian Pilcher 10 Mar '08

10 Mar '08

Ian Pilcher wrote: > ... and the (non-working) server-side stunnel configuration: > > cert = /etc/stunnel/rsyncs_cert.pem > key = /etc/stunnel/private/rsyncs_key.pem > client = no > pid = /var/run/stunnel.pid > RNDfile = /var/run/stunnel/random_seed > foreground = yes > debug = debug > output = /var/run/stunnel/stunnel.log > > exec = /usr/bin/rsync > execargs = rsync --daemon Amazing how sending off the question gets the old brain cells working (or maybe it was the second cup of coffee). The problem was "foreground = yes". Since xinet.d redirects stderr back over the network connection, the stunnel startup messages were going back to the client. For some reason, the client didn't think that was a proper SSL handshake. ;-) -- ======================================================================== Ian Pilcher arequipeno(a)gmail.com ========================================================================

1 0

unknown protocol error (140770FC) with xinetd
by Ian Pilcher 10 Mar '08

10 Mar '08

I am trying to set up rsync over SSL with stunnel. I've got things working when I run stunnel standalone on both systems, but I have been unable to get things working when I run stunnel via xinetd on the server (haven't tried using xinet on the client yet). Here is the (standalone) server configuration that works: cert = /etc/stunnel/rsyncs_cert.pem key = /etc/stunnel/private/rsyncs_key.pem client = no pid = /var/run/stunnel.pid RNDfile = /var/run/stunnel/random_seed foreground = yes debug = debug ;output = /var/run/stunnel/stunnel.log [rsyncs] accept = 2873 exec = /usr/bin/rsync execargs = rsync --daemon Here is the (non-working) server-side xinetd configuration: # default: off # description: rsync tunneled over SSL (stunnel) service rsyncs { disable = no flags = IPv4 socket_type = stream wait = no user = root server = /usr/sbin/stunnel } ... and the (non-working) server-side stunnel configuration: cert = /etc/stunnel/rsyncs_cert.pem key = /etc/stunnel/private/rsyncs_key.pem client = no pid = /var/run/stunnel.pid RNDfile = /var/run/stunnel/random_seed foreground = yes debug = debug output = /var/run/stunnel/stunnel.log exec = /usr/bin/rsync execargs = rsync --daemon Trying to connect to the non-working configuration with openssl s_client, I get: CONNECTED(00000003) write to 0x9b9e938 [0x9b9f068] (133 bytes => 133 (0x85)) 0000 - 80 83 01 03 01 00 5a 00-00 00 20 00 00 39 00 00 ......Z... ..9.. 0010 - 38 00 00 35 00 00 16 00-00 13 00 00 0a 07 00 c0 8..5............ 0020 - 00 00 33 00 00 32 00 00-2f 03 00 80 00 00 66 00 ..3..2../.....f. 0030 - 00 05 00 00 04 01 00 80-00 00 63 00 00 62 00 00 ..........c..b.. 0040 - 15 00 00 12 00 00 09 06-00 40 00 00 65 00 00 64 [email protected] 0050 - 00 00 14 00 00 11 00 00-08 00 00 06 04 00 80 00 ................ 0060 - 00 03 02 00 80 3e b4 89-34 c1 e6 93 97 2d 8d ca .....>..4....-.. 0070 - 90 e1 4c 51 e1 71 c7 54-ed 52 0c 6e 2e 47 90 9b ..LQ.q.T.R.n.G.. 0080 - 8e c6 73 3d d8 ..s=. read from 0x9b9e938 [0x9ba45c8] (7 bytes => 7 (0x7)) 0000 - 32 30 30 38 2e 30 33 2008.03 18523:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:567: The server log shows: 2008.03.10 11:32:23 LOG5[18563:3086215456]: stunnel 4.20 on i386-redhat-linux-gnu with OpenSSL 0.9.8b 04 May 2006 2008.03.10 11:32:23 LOG5[18563:3086215456]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.03.10 11:32:23 LOG7[18563:3086215456]: stunnel started 2008.03.10 11:32:23 LOG7[18563:3086215456]: FD 0 in non-blocking mode 2008.03.10 11:32:23 LOG7[18563:3086215456]: FD 1 in non-blocking mode 2008.03.10 11:32:23 LOG7[18563:3086215456]: FD 4 in non-blocking mode 2008.03.10 11:32:23 LOG7[18563:3086215456]: FD 5 in non-blocking mode 2008.03.10 11:32:23 LOG7[18563:3086215456]: Connection from 127.0.0.1:38481 permitted by libwrap 2008.03.10 11:32:23 LOG5[18563:3086215456]: stunnel accepted connection from 127.0.0.1:38481 2008.03.10 11:32:23 LOG7[18563:3086215456]: SSL state (accept): before/accept initialization 2008.03.10 11:32:23 LOG7[18563:3086215456]: SSL state (accept): SSLv3 read client hello A 2008.03.10 11:32:23 LOG7[18563:3086215456]: SSL state (accept): SSLv3 write server hello A 2008.03.10 11:32:23 LOG7[18563:3086215456]: SSL state (accept): SSLv3 write certificate A 2008.03.10 11:32:23 LOG7[18563:3086215456]: SSL state (accept): SSLv3 write server done A 2008.03.10 11:32:23 LOG3[18563:3086215456]: SSL_accept: Peer suddenly disconnected 2008.03.10 11:32:23 LOG5[18563:3086215456]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.03.10 11:32:23 LOG7[18563:3086215456]: stunnel finished (0 left) Anyone have any ideas? Thanks! -- ======================================================================== Ian Pilcher arequipeno(a)gmail.com ========================================================================

1 0

Windows FIPS compile
by Joe Kemp 10 Mar '08

10 Mar '08

I am trying to get stunnel to compile against a fips openssl. I read in install.fips that it is not yet supported. Is anyone currently working on this? If so I would love to join forces or any info on the specific issues would help get me started. Thanks. -Joe

2 2

help
by Paque Alexandre 10 Mar '08

10 Mar '08

Hi, I am writing you because I haven’t found solution on the web. In order to secure a connection between servers (1 client and 1 server stunnel), I chose the stunnel tool. However, I have an issue when I unplugged the network cable. If I unplug the network cable on the remote side, Stunnel will detect the cutting only on the local side. In fact, I would like to configure stunnel client in order to detect the unplugged network cable on server side. I tried many configurations but without success: socket = l:TCP_NODELAY=1 socket = l:SO_LINGER=1:1 socket = l:SO_KEEPALIVE=1 socket = l:SO_REUSEADDR=1 socket = r:TCP_NODELAY=1 socket = r:SO_LINGER=1:1 socket = r:SO_KEEPALIVE=1 socket = r:SO_REUSEADDR=1 Could you help me? Thanks you in advance, Alex _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

1 0

ssl mutual authentication
by Simon Santoro 09 Mar '08

09 Mar '08

Hello all. I am sure I am missing something really obvious here, but I can't get this to work. HTTP client (localhost) -> stunnel (localhost) -> HTTPS server (remote host) I'd like to user stunnel as proxy for my HTTP requests that go to a HTTPS server (apache if that makes any difference) on a remote host (fresh) that uses a cert to authenticate the request. I wrote this little ruby script[2] to test the request, and it works, so i am sure that on the server/client/cert end there is no problem. Now I'd like to use a simple wget or w3m to get the file from the remote server trough stunnel, but I keep getting SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed The only difference between the ruby script and the stunnel setup is that in the ruby script i have two different files for the crt and the key, and with stunnel I joined those files together with cat s2(a)magnesium.key s2(a)magnesium.crt >s2(a)magnesium.pam on localhost i run: $ stunnel -r fresh:443 -d localhost:11443 -c -f -D 7 -c -S 0 -p certs/s2(a)magnesium.pem -a certs/ -A certs/freshCA.crt -v 3 -P none 2008.03.09 21:21:38 LOG5[9026:3082811056]: Using 'fresh.443' as tcpwrapper service name 2008.03.09 21:21:38 LOG7[9026:3082811056]: RAND_status claims sufficient entropy for the PRNG 2008.03.09 21:21:38 LOG6[9026:3082811056]: PRNG seeded successfully 2008.03.09 21:21:38 LOG7[9026:3082811056]: Certificate: certs/s2(a)magnesium.pem Enter PEM pass phrase: 2008.03.09 21:21:40 LOG7[9026:3082811056]: cert_defaults is 0 2008.03.09 21:21:40 LOG7[9026:3082811056]: cert_dir is certs/ 2008.03.09 21:21:40 LOG7[9026:3082811056]: cert_file is certs/freshCA.crt 2008.03.09 21:21:40 LOG7[9026:3082811056]: Loaded verify certificates from certs/freshCA.crt 2008.03.09 21:21:40 LOG7[9026:3082811056]: Set verify directory to certs/ 2008.03.09 21:21:40 LOG5[9026:3082811056]: Peer certificate location certs/ 2008.03.09 21:21:40 LOG5[9026:3082811056]: stunnel 3.26 on i486-pc-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.8e 23 Feb 2007 2008.03.09 21:21:40 LOG7[9026:3082811056]: No pid file being created 2008.03.09 21:21:40 LOG5[9026:3082811056]: FD_SETSIZE=1024, file ulimit=1024 -> 500 clients allowed 2008.03.09 21:21:40 LOG7[9026:3082811056]: SO_REUSEADDR option set on accept socket 2008.03.09 21:21:40 LOG7[9026:3082811056]: fresh.443 bound to 127.0.0.1:11443 then, I try to connect to localhost:11443 with w3m, in the hope that my HTTP request is encrypted and send to fresh:443, and stunnel should check if the PEER certificate is correct, but all I get is: 2008.03.09 21:26:44 LOG7[9214:3082585776]: fresh.443 accepted FD=6 from 127.0.0.1:43888 2008.03.09 21:26:44 LOG7[9214:3082423184]: fresh.443 started 2008.03.09 21:26:44 LOG5[9214:3082423184]: fresh.443 connected from 127.0.0.1:43888 2008.03.09 21:26:44 LOG7[9214:3082423184]: fresh.443 connecting 192.168.0.2:443 2008.03.09 21:26:44 LOG7[9214:3082423184]: Remote FD=7 initialized 2008.03.09 21:26:44 LOG7[9214:3082423184]: Relying on OpenSSL RSA Blinding. 2008.03.09 21:26:44 LOG7[9214:3082423184]: SSL state (connect): before/connect initialization 2008.03.09 21:26:44 LOG7[9214:3082423184]: SSL state (connect): SSLv3 write client hello A 2008.03.09 21:26:45 LOG7[9214:3082423184]: SSL state (connect): SSLv3 read server hello A 2008.03.09 21:26:45 LOG5[9214:3082423184]: VERIFY OK: depth=1, /C=IT/O=S2 corp./CN=S2/emailAddress=s2@fresh 2008.03.09 21:26:45 LOG4[9214:3082423184]: VERIFY ERROR ONLY MY: no cert for /C=IT/O=S2 corp./CN=fresh 2008.03.09 21:26:45 LOG7[9214:3082423184]: SSL alert (write): fatal: certificate unknown 2008.03.09 21:26:45 LOG3[9214:3082423184]: SSL_connect: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed 2008.03.09 21:26:45 LOG7[9214:3082423184]: fresh.443 finished (0 left) Did I something wrong? What am I missing? Please help me, it would save me really a lot of work on the client side if I could get this going. Thanks! Simon [1] ---------------------------------------------------- #!/usr/bin/ruby SERVER_CERT_FILE = "certs/freshCA.crt" CERT_FILE = "certs/s2(a)magnesium.crt" CERT_FILE_KEY = "certs/s2(a)magnesium.key" require 'net/https' https = Net::HTTP.new('fresh', 443) https.use_ssl = true #client certificates https.cert = OpenSSL::X509::Certificate.new( File.read(CERT_FILE) ) https.key = OpenSSL::PKey::RSA.new( File.read(CERT_FILE_KEY), 'panza') #server certificate https.ca_file = SERVER_CERT_FILE https.verify_mode = OpenSSL::SSL::VERIFY_PEER #VERIFY_NONE https.read_timeout = 120 https.start do |https| request = Net::HTTP::Get.new('/notes/test_auth') # request.basic_auth 's', 'x' response = https.request(request) response.value puts response.body end ----------------------------------------------------

1 1

Connection Problem on Vista
by Earl Stenlund 08 Mar '08

08 Mar '08

I setup stunnel this afternoon to work with Newshosting. It was working fine but now I cannot connect using my desktop running Vista. I receive this message: SSL_connect: 14094406: error:14094406:SSL routines:SSL3_READ_BYTES:sslv3 alert decompression failure Stunnel connects fine on my laptop which is also running Vista. Help, Earl Stenlund

1 0

Username authentication
by Joe Kemp 07 Mar '08

07 Mar '08

I want to try to use stunnel as a "simple" client vpn. It solves all of my encryption issues but I would like to verify a username/password before it lets the traffic through. I didn't see any patches or hacks out there that did this. Has this been attempted before or am I on my own. I would also be interested in other solutions based on openssl that are not network device level VPNs clients. Already using client side certificates and I know that is the normal SSL authentication mechanism.... Thanks. -Joe

2 2

Send delay?
by Colin E 04 Mar '08

04 Mar '08

Please can you help a hardware engineer, who almost understands what he's doing. I'm using sTunnel 4.21 on a Windows 2000 machine, to provide a TCP program with SSL. This works very well. However the application is very time critical and must finish sending block of XML as quickly as possible. I suspect there is a delay in either sTunnel or openSSL, while it waits to see if there are any more characters before sending a packet. Is this correct? If it is, is there a work round. -- View this message in context: http://www.nabble.com/Send-delay--tp15826043p15826043.html Sent from the Stunnel - Users mailing list archive at Nabble.com.

2 4

Newbie
by Rod Bodden 03 Mar '08

03 Mar '08

Hello to all! I'm trying to set up Stunnel for the first time. I hope to use it with HFS. I followed directions found on HFS website and ran into a problem creating a pem file. Could someone direct me to information about installing Stunnel? Or help me directly by sharing with me how to install Stunnel? I sincerely appreciate your help!!! Rod

1 0

Bugs
by Jan.Haering＠rz-kiru.de 29 Feb '08

29 Feb '08

Hallo, I have found 2 Bugs. 1. In Version 4.21: No Taskbar Icon is displayed when the service starts. Although the taskbar ist set in config file (taskbar = yes). 2. In probably all Versions (I have testet 4.18, 4.20 and 4.21) If i started the service over Start -> Programm Files -> stunnel -> Service Start (stunnel -start) no log files are written. If i start the service over services.msc from Windows or "sc start stunnel" log files are written. The icon log displayed the following message in version 4.18 and 4.20 2007.11.09 09:41:03 LOG3[2396:2400]: stunnel.log: Broken pipe (32) 2007.11.09 09:41:03 LOG3[2396:2400]: Unable to open output file: stunnel.log Best Regards Jan

5 9

webdav with stunnel and 'net use'
by detlef oertel 26 Feb '08

26 Feb '08

Hello list, what we want to do, is mounting a webdav share via https on a windows xp box. Therefore we tried to tunnel localhost:80 to server:443 The name of the test server is here bonifax. What works is: mounting direct via http net use x: "http://bonfax/opsi-depot" mounting over stunnel with 'Add Network Place Wizard' or RunDLL32.EXE netplwiz.dll,AddNetPlaceRunDll using the address: http://localhost/opsi-depot What fails is: ---------------------------- C:\WINDOWS>net use y: "http://localhost/opsi-depot" Systemfehler 67 aufgetreten. Der Netzwerkname wurde nicht gefunden. -------- Error 67 'network name not found' ------------------------ part of stunnel.conf ------------------------ ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration verify=0 [psuedo-https] accept = 80 connect = bonifax:443 TIMEOUTclose = 0 ------------------------ This is the log: ----------------------------- 2008.02.26 20:04:11 LOG7[1560:1404]: psuedo-https accepted FD=176 from 127.0.0.1:1861 2008.02.26 20:04:11 LOG7[1560:1404]: Creating a new thread 2008.02.26 20:04:11 LOG7[1560:1404]: New thread created 2008.02.26 20:04:11 LOG7[1560:3308]: psuedo-https started 2008.02.26 20:04:11 LOG7[1560:3308]: FD 176 in non-blocking mode 2008.02.26 20:04:11 LOG7[1560:3308]: TCP_NODELAY option set on local socket 2008.02.26 20:04:11 LOG5[1560:3308]: psuedo-https accepted connection from 127.0.0.1:1861 2008.02.26 20:04:11 LOG7[1560:3308]: FD 208 in non-blocking mode 2008.02.26 20:04:11 LOG7[1560:3308]: psuedo-https connecting 192.168.1.14:443 2008.02.26 20:04:11 LOG7[1560:3308]: connect_wait: waiting 10 seconds 2008.02.26 20:04:11 LOG7[1560:3308]: connect_wait: connected 2008.02.26 20:04:11 LOG5[1560:3308]: psuedo-https connected remote server from 192.168.2.234:1862 2008.02.26 20:04:11 LOG7[1560:3308]: Remote FD=208 initialized 2008.02.26 20:04:11 LOG7[1560:3308]: TCP_NODELAY option set on remote socket 2008.02.26 20:04:11 LOG7[1560:3308]: SSL state (connect): before/connect initialization 2008.02.26 20:04:11 LOG7[1560:3308]: SSL state (connect): SSLv3 write client hello A 2008.02.26 20:04:11 LOG7[1560:3308]: SSL state (connect): SSLv3 read server hello A 2008.02.26 20:04:11 LOG5[1560:3308]: VERIFY IGNORE: depth=0, /C=DE/ST=Rheinland-Pfalz/O=uib/CN=bonifax.uib.local 2008.02.26 20:04:11 LOG5[1560:3308]: VERIFY OK: depth=0, /C=DE/ST=Rheinland-Pfalz/O=uib/CN=bonifax.uib.local 2008.02.26 20:04:11 LOG5[1560:3308]: VERIFY IGNORE: depth=0, /C=DE/ST=Rheinland-Pfalz/O=uib/CN=bonifax.uib.local 2008.02.26 20:04:11 LOG5[1560:3308]: VERIFY OK: depth=0, /C=DE/ST=Rheinland-Pfalz/O=uib/CN=bonifax.uib.local 2008.02.26 20:04:11 LOG5[1560:3308]: VERIFY IGNORE: depth=0, /C=DE/ST=Rheinland-Pfalz/O=uib/CN=bonifax.uib.local 2008.02.26 20:04:11 LOG5[1560:3308]: VERIFY OK: depth=0, /C=DE/ST=Rheinland-Pfalz/O=uib/CN=bonifax.uib.local 2008.02.26 20:04:11 LOG7[1560:3308]: SSL state (connect): SSLv3 read server certificate A 2008.02.26 20:04:11 LOG7[1560:3308]: SSL state (connect): SSLv3 read server key exchange A 2008.02.26 20:04:11 LOG7[1560:3308]: SSL state (connect): SSLv3 read server done A 2008.02.26 20:04:11 LOG7[1560:3308]: SSL state (connect): SSLv3 write client key exchange A 2008.02.26 20:04:11 LOG7[1560:3308]: SSL state (connect): SSLv3 write change cipher spec A 2008.02.26 20:04:11 LOG7[1560:3308]: SSL state (connect): SSLv3 write finished A 2008.02.26 20:04:11 LOG7[1560:3308]: SSL state (connect): SSLv3 flush data 2008.02.26 20:04:11 LOG7[1560:3308]: SSL state (connect): SSLv3 read finished A 2008.02.26 20:04:11 LOG7[1560:3308]: 1 items in the session cache 2008.02.26 20:04:11 LOG7[1560:3308]: 1 client connects (SSL_connect()) 2008.02.26 20:04:11 LOG7[1560:3308]: 1 client connects that finished 2008.02.26 20:04:11 LOG7[1560:3308]: 0 client renegotiations requested 2008.02.26 20:04:11 LOG7[1560:3308]: 0 server connects (SSL_accept()) 2008.02.26 20:04:11 LOG7[1560:3308]: 0 server connects that finished 2008.02.26 20:04:11 LOG7[1560:3308]: 0 server renegotiations requested 2008.02.26 20:04:11 LOG7[1560:3308]: 0 session cache hits 2008.02.26 20:04:11 LOG7[1560:3308]: 0 session cache misses 2008.02.26 20:04:11 LOG7[1560:3308]: 0 session cache timeouts 2008.02.26 20:04:11 LOG6[1560:3308]: SSL connected: new session negotiated 2008.02.26 20:04:11 LOG6[1560:3308]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2008.02.26 20:04:26 LOG7[1560:3308]: SSL alert (read): warning: close notify 2008.02.26 20:04:26 LOG7[1560:3308]: SSL closed on SSL_read 2008.02.26 20:04:26 LOG7[1560:3308]: Socket write shutdown 2008.02.26 20:04:26 LOG7[1560:3308]: SSL write shutdown 2008.02.26 20:04:26 LOG7[1560:3308]: SSL alert (write): warning: close notify 2008.02.26 20:04:26 LOG6[1560:3308]: SSL_shutdown successfully sent close_notify 2008.02.26 20:04:26 LOG5[1560:3308]: Connection closed: 311 bytes sent to SSL, 971 bytes sent to socket 2008.02.26 20:04:26 LOG7[1560:3308]: psuedo-https finished (0 left) ---------------------- stunnel version 4.21 Anyone any ideas what went wrong and how to go around ? regards detlef -- detlef oertel Tel. 06131 / 27561-10 Fax 06131 / 27561-22 eMail: d.oertel(a)uib.de uib umwelt informatik büro gmbh Firmensitz / Anschrift: Bonifaziusplatz 1B 55118 Mainz internet: www.uib.de Geschäftsführer: dr. detlef oertel Handelsregister: Amtsgericht Mainz HRB 6942

1 0

Sun Niagra2
by Steve Harris 25 Feb '08

25 Feb '08

Hi all, Has built stunnel on the Sun Niagra 2 platform to take advantage of the on-chip crypto? Cheers - Steve -- NOTE: This message is confidential and may not be disclosed to anyone without the express written consent of the sender. ********************************************************************* PH: 250-381-1335 xt125

1 0

Log & Timestamp question
by Edward Blake 25 Feb '08

25 Feb '08

Stunnel currently logs times in the format hh:mm:ss. Is there a way to get a more exact time, such as UTC or down to the millisecond? Edward Blake

1 0

VNC, STUNNEL & HTTPTUNNEL ----- (((VNC)SSL)HTTP)
by sean bhola 25 Feb '08

25 Feb '08

I need to connect to my PC at work from home. The firewall at work has only ports 80 (http) and 443 (https) open, I also think there is a proxy. I was wondering which scenario would work. 1: To encapsulate vnc traffic within ssl using stunnel and pass it though port 443, OR 2: To encapsulate vnc traffic within ssl using stunnel, then encapsulate that within http using httptunnel and pass through port 80 OR 3: To encapsulate vnc traffic within http, then encapsulate that within ssl using stunnel and pass through port 443 I read this article http://www.securityfocus.com/infocus/1677 but still had the concerns above. Help would be much appreciated. Thanks. Sean

2 1

running SWAT through stunnel and uid/gid question
by Wayne Sherman 24 Feb '08

24 Feb '08

(using STunnel 4.21 on gentoo) I can successfully run the samba SWAT tool through stunnel with these settings: [swat] exec = /usr/sbin/swat execargs = swat accept = 901 But, I have discovered that in order to successfully log-in to swat, I have to comment these lines in the global section of stunnel.conf: #setuid = stunnel #setgid = stunnel Is there a way to specify the UID/GID per service (like the xinetd service level option "user") instead of globally? Thanks, Wayne

1 0

Re: [stunnel-users] Stunnel Configuration
by paque_alexandre＠yahoo.fr 19 Feb '08

19 Feb '08

1 0

Web based CRL file
by Edouard Dessioux 18 Feb '08

18 Feb '08

Hi, I have several questions about the CRL file : - is the file reloaded before each connection or is it first loaded at the stunnel startup ? - do you have any idea of how to use a web-based CRL file ? Regards, Edouard DESSIOUX Directeur de Projets Tibco Mobile 3, rue Danton - 92240 Malakoff Tél : +33 (0)1 55 58 04 59 - Fax : +33 (0)1 55 58 03 89 - Mob. +33 (0)6 34 02 61 54 E-mail : edessioux(a)tibco.fr - www.tibcomobile.fr Faites un geste pour la planète, n'imprimez ce message que si nécessaire.

1 0

Installing Stunnel 4.21 on Shared Hosting Server with OpenSSL 0.9.6g
by Norbert Hoeller 17 Feb '08

17 Feb '08

I am trying to install Stunnel 4.21 on a 1&1 shared Linux server. PHP Settings claims that OpenSSL 0.9.6g is installed. I unpacked the tar file and ran "./configure" using --prefix to override the /usr/local/ install directory. I had one warning: "configure: WARNING: Openssl engine header not found". In terms of threading model, I got "configure: PTHREAD thread model detected". When I tried to run "make", I got "common.h:318: #error OpenSSL library compiled without thread support". Is there a way around this? I tried running "./configure" with --with-threads=ucontext/fork, but that gave a bunch of "OCSP_" undeclared variables and "Error 1". Thanks, Norbert

2 2

Validation of certificate
by Edouard Dessioux 12 Feb '08

12 Feb '08

Hi everyone, I'm new to this mailing list, but before my asking question, i checked the archive but did not find anything related, so, it may be out of topic. Well, for the moment, I can't provide all the informations asked like « output of ... command », but I'm not sure this is relevant for my question. The informations I can provide are : * I use stunnel to terminate a tls connection between a mobile phone and a web application server. * I use stunnel to validate my clients certificates. * The stunnel will be running on a windows 2003 server * I guess I would be using the last available version of stunnel * The certificates would be generated by a PKI different from openssl What I would like to do is : I have a PKI already deployed with many certificates, and I want only a small subset of them to be validated by the stunnel. I thought of using multiples OU fields to « tags » some users, but can this fields be checked by stunnel ? Do you guys have any feedback on this or any alternative way to do something equivalent ? Regards, Edouard DESSIOUX Directeur de Projets Tibco Mobile 3, rue Danton - 92240 Malakoff Tél : +33 (0)1 55 58 04 59 - Fax : +33 (0)1 55 58 03 89 - Mob. +33 (0)6 34 02 61 54 E-mail : edessioux(a)tibco.fr - www.tibcomobile.fr Faites un geste pour la planète, n'imprimez ce message que si nécessaire.

1 0

signal 15 terminating stunnel on start in Ubuntu
by Rick Barry 11 Feb '08

11 Feb '08

I am trying to use Stunnel 4.2 on Ubuntu 7.1. When I use this command to start Stunnel: /etc/init.d/stunnel4 start I get this output: Starting SSL tunnels: 2008.02.11 09:00:05 LOG7[6780:3082872496]: RAND_status claims sufficient entropy for the PRNG 2008.02.11 09:00:05 LOG7[6780:3082872496]: PRNG seeded successfully 2008.02.11 09:00:05 LOG7[6780:3082872496]: SSL context initialized for service nntp [Failed: /etc/stunnel/stunnel.conf] You should check that you have specified the pid= in you configuration file In the log entry @ /var/log/stunnel4/stunnel.log: 2008.02.11 08:33:54 LOG5[5468:3082974896]: stunnel 4.20 on i486-pc-linux- gnu with OpenSSL 0.9.8e 23 Feb 2007 2008.02.11 08:33:54 LOG5[5468:3082974896]: ThreadingTHREAD SSL:ENGINE SocketsOLL,IPv6 Auth:LIBWRAP 2008.02.11 08:33:54 LOG6[5468:3082974896]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.02.11 08:33:54 LOG6[5468:3082974896]: poll() used - no FD_SETSIZE limit for file descriptors 2008.02.11 08:33:54 LOG5[5468:3082974896]: 500 clients allowed 2008.02.11 08:33:54 LOG7[5468:3082974896]: FD 4 in non-blocking mode 2008.02.11 08:33:54 LOG7[5468:3082974896]: FD 5 in non-blocking mode 2008.02.11 08:33:54 LOG7[5468:3082974896]: FD 6 in non-blocking mode 2008.02.11 08:33:54 LOG7[5468:3082974896]: SO_REUSEADDR option set on accept socket 2008.02.11 08:33:54 LOG7[5468:3082974896]: nntp bound to 127.0.0.1:119 2008.02.11 08:33:54 LOG7[5517:3082974896]: Created pid file /stunnel4.pid 2008.02.11 08:39:10 LOG5[5517:3082974896]: Received signal 15; terminating 2008.02.11 08:39:10 LOG7[5517:3082974896]: removing pid file /stunnel4.pid Signal 15 seems to be the linchpin here, but my research hasn't brought up anything conclusive. Any pointers? Thank you. Rick Barry ____________________________________________________________________________________ Looking for last minute shopping deals? Find them fast with Yahoo! Search. http://tools.search.yahoo.com/newsearch/category.php?category=shopping

1 0

Stunnel Problem - 935 Maximum connections on Windows
by Iain ＠ Mobile777 11 Feb '08

11 Feb '08

We are having some difficulties when using Stunnel under load. The maximum sessions running on a Windows servers seems to be set at 935 concurrent connections. Our system uses Stunnel to route incoming SSL traffic on port 443 through Openssl to a Java application on port 26789. Both Stunnel and the Java server run on a Windows 2003 server, with between 4GB and 8GB of ram, both running Dual Intel Zeon 2Ghz processors. The problem is that when the Stunnel server is under load, the maximum connections that we can achieve is 935 concurrent connections (Windows threads between 936 and 938), before Stunnel throws errors and starts closing the connections. Here is some additional information about our system: Stunnel version 4.21 (latest Windows binaries) OpenSSL 0.9.8g Stunnel Config: ----------------------------------------------------------------------- debug = 7 output = stunnel.log # Use it for client mode #client = yes #TIMEOUTidle = 60 socket = a:TCP_NODELAY=1 socket = a:SO_LINGER=a:0 socket = r:TCP_NODELAY=1 socket = r:SO_LINGER=r:0 socket = l:TCP_NODELAY=1 socket = l:SO_LINGER=l:0 # Service-level configuration [JAVASERVER] #session = 5000 accept = 443 connect = localhost: 26789 # delay = yes #transparent = yes ----------------------------------------------------------------------- We have tried various options, such as the TIMEOUTidle and session parameters for Stunnel, but with no luck. We have even tried running Stunnel separately on a Linux distro (FC4), with even less positive results. The pertinent errors in the log files are as follows: Connection closed: 178664 bytes sent to SSL, 44646 bytes sent to socket SSL alert (write): warning: close notify _beginthread: Exec format error (8) Connection rejected: create_client failed I can mail full logs of our load tests as well. Our server will be expected to handle upwards of 10000 connections at a time, we've been researching for about a week now how to get the performance we need, but so far nothing. Iain

3 3

Stunnel + Hybrid-ircd issues
by Strykar 09 Feb '08

09 Feb '08

Hi, I'm running Hybrid-7.2 on two PCs, one of which has a dynamic IP, as Hybrid wants a static IP and not hostname in its connect section, we are trying to use stunnel to encrypt server<->server communication. Server 1 specs (To which I'm connecting) running FreeBSD 6.3: *********************************************** #stunnel -version stunnel 4.05 on amd64-unknown-freebsd5.3 PTHREAD+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 Global options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /usr/local/etc/stunnel/stunnel.pem pid = /var/tmp/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes #gcc -v Using built-in specs. Configured with: FreeBSD/amd64 system compiler Thread model: posix gcc version 3.4.6 [FreeBSD] 20060305 #uname FreeBSD 6.3-STABLE FreeBSD 6.3-STABLE #6: Tue Jan 22 13:23:51 GMT 2008 root@:/usr/obj/usr/src/sys/SVR1 amd64 Server 2 specs (From which I'm connecting via stunnel as a client) running OpenBSD 4.2: ****************************************************************** #stunnel -version stunnel 4.20 on i386-unknown-openbsd4.2 with OpenSSL 0.9.7j 04 May 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/arandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none # gcc -v Reading specs from /usr/lib/gcc-lib/i386-unknown-openbsd4.2/3.3.5/specs Configured with: Thread model: single gcc version 3.3.5 (propolice) # cat stunnel.conf: cert = /etc/ssl/private/stunnel.pem key = /etc/ssl/private/rsa.key setuid = _stunnel setgid = _stunnel pid = /var/run/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 foreground = yes [irc] client = yes accept = localhost:994 connect = xxx.xxx.xxx.xxx:994 Here's the debug logged to stderr: # stunnel 2008.02.08 19:34:54 LOG7[11904:2237644800]: Snagged 64 random bytes from /dev/arandom 2008.02.08 19:34:54 LOG7[11904:2237644800]: RAND_status claims sufficient entropy for the PRNG 2008.02.08 19:34:54 LOG7[11904:2237644800]: PRNG seeded successfully 2008.02.08 19:34:54 LOG7[11904:2237644800]: Certificate: /etc/ssl/private/stunnel.pem 2008.02.08 19:34:54 LOG7[11904:2237644800]: Certificate loaded 2008.02.08 19:34:54 LOG7[11904:2237644800]: Key file: /etc/ssl/private/rsa.key 2008.02.08 19:34:54 LOG7[11904:2237644800]: Private key loaded 2008.02.08 19:34:54 LOG7[11904:2237644800]: SSL context initialized for service irc 2008.02.08 19:34:54 LOG5[11904:2237644800]: stunnel 4.20 on i386-unknown-openbsd4.2 with OpenSSL 0.9.7j 04 May 2006 2008.02.08 19:34:54 LOG5[11904:2237644800]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.02.08 19:34:54 LOG6[11904:2237644800]: file ulimit = 128 (can be changed with 'ulimit -n') 2008.02.08 19:34:54 LOG6[11904:2237644800]: poll() used - no FD_SETSIZE limit for file descriptors 2008.02.08 19:34:54 LOG5[11904:2237644800]: 61 clients allowed 2008.02.08 19:34:54 LOG7[11904:2237644800]: FD 6 in non-blocking mode 2008.02.08 19:34:54 LOG7[11904:2237644800]: FD 7 in non-blocking mode 2008.02.08 19:34:54 LOG7[11904:2237644800]: FD 8 in non-blocking mode 2008.02.08 19:34:54 LOG7[11904:2237644800]: SO_REUSEADDR option set on accept socket 2008.02.08 19:34:54 LOG7[11904:2237644800]: irc bound to 127.0.0.1:994 2008.02.08 19:34:54 LOG7[11904:2237644800]: Created pid file /var/run/stunnel.pid 2008.02.08 19:35:15 LOG7[11904:2237644800]: irc accepted FD=9 from 127.0.0.1:8579 2008.02.08 19:35:15 LOG7[11904:2336256000]: irc started 2008.02.08 19:35:15 LOG7[11904:2336256000]: FD 9 in non-blocking mode 2008.02.08 19:35:15 LOG7[11904:2336256000]: TCP_NODELAY option set on local socket 2008.02.08 19:35:15 LOG7[11904:2336256000]: FD 10 in non-blocking mode 2008.02.08 19:35:15 LOG7[11904:2336256000]: FD 11 in non-blocking mode 2008.02.08 19:35:15 LOG7[11904:2336256000]: Connection from 127.0.0.1:8579 permitted by libwrap 2008.02.08 19:35:15 LOG5[11904:2336256000]: irc accepted connection from 127.0.0.1:8579 2008.02.08 19:35:15 LOG7[11904:2336256000]: FD 10 in non-blocking mode 2008.02.08 19:35:15 LOG7[11904:2336256000]: irc connecting 69.50.175.50:994 2008.02.08 19:35:15 LOG7[11904:2336256000]: connect_wait: waiting 10 seconds 2008.02.08 19:35:15 LOG7[11904:2237644800]: Cleaning up the signal pipe 2008.02.08 19:35:15 LOG6[11904:2237644800]: Child process 26562 finished with code 0 2008.02.08 19:35:15 LOG7[11904:2336256000]: connect_wait: connected 2008.02.08 19:35:15 LOG5[11904:2336256000]: irc connected remote server from 192.168.1.101:42954 2008.02.08 19:35:15 LOG7[11904:2336256000]: Remote FD=10 initialized 2008.02.08 19:35:15 LOG7[11904:2336256000]: TCP_NODELAY option set on remote socket 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): before/connect initialization 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 write client hello A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 read server hello A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 read server certificate A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 read server done A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 write client key exchange A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 write change cipher spec A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 write finished A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 flush data 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 read finished A 2008.02.08 19:35:15 LOG7[11904:2336256000]: 1 items in the session cache 2008.02.08 19:35:15 LOG7[11904:2336256000]: 1 client connects (SSL_connect()) 2008.02.08 19:35:15 LOG7[11904:2336256000]: 1 client connects that finished 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 client renegotiations requested 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 server connects (SSL_accept()) 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 server connects that finished 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 server renegotiations requested 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 session cache hits 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 session cache misses 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 session cache timeouts 2008.02.08 19:35:15 LOG6[11904:2336256000]: SSL connected: new session negotiated 2008.02.08 19:35:15 LOG6[11904:2336256000]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2008.02.08 19:35:15 LOG3[11904:2336256000]: SSL_read: Connection reset by peer (54) 2008.02.08 19:35:15 LOG5[11904:2336256000]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.02.08 19:35:15 LOG7[11904:2336256000]: irc finished (0 left) What is going on here with "SSL_read: Connection reset by peer (54)"? This process keeps repeating itself without the ircd's linking. - S

1 0

Verify Question
by Vlad 08 Feb '08

08 Feb '08

I'm sure that people have asked this question before, but i cannot find a way to search the archives. What is the difference between verify = 2 and verify = 3, The docs indicate that with verify = 3it will check against locally installed certs, but what does that mean, if I use =2 then what does it verify the cert against? Also a second question: I'm pretty sure that the answer is no but is it possible to do the following, have a cert A that is signed by CA cert B which itself is singed by a self-signed cert C. If the clients has C installed as a trusted cert, and it received A, is there anyway for it to validate A. I realize that these are probably pretty novice questions so I really appreciate your patience, thanks!

1 0

xforwardedfor in config
by Jill Rochelle 04 Feb '08

04 Feb '08

I am new to stunnel and the ssl world. I'm trying to get stunnel to work with haproxy for load balancing https requests. In the haproxy documentation it says that the stunnel.conf should look like this cert=/etc/stunnel/stunnel.pem setuid=stunnel setgid=proxy socket=l:TCP_NODELAY=1 socket=r:TCP_NODELAY=1 [https] accept=192.168.1.1:443 connect=192.168.1.1:80 xforwardedfor=yes However, when I try to start the stunnel service I get this Starting stunnel: file /etc/stunnel/stunnel.conf line 9: Specified option name is not valid here If I comment out the xforwardedfor parameter, it starts. Any help is greatly appreciated. Thank you, Jill Rochelle

2 2

2 secure sockets TCP (Server / Client) as posted earlier last month by khaled
by Dick van Fulpen 04 Feb '08

04 Feb '08

> Hi, > > I'm having the same question (and problem) as posted by khaled on Mon > Jan 7 19:31:03 CET 2008, subject [stunnel-users] 2 secure sockets TCP > (Server / Client). > > I think I have to send data to stunnel on the client side by a write > to localhost:1974 where stunnel is configured with this stunnel.conf: > ; Sample stunnel configuration file by Michal Trojnara 2002-2006 > ; Some options used here may not be adequate for your particular > configuration > ; Certificate/key is needed in server mode and optional in client mode > ; The default certificate is provided only for testing and should not > ; be used in a production environment > cert = stunnel.pem > ;key = stunnel.pem > > ; Some performance tunings > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > > ; Use it for client mode > ;client = yes > > ; Service-level configuration > [sip2s] > accept = 1975 > connect = 127.0.0.1:1974 > > To start stunnel only works with just stunnel. > Started from batch or in dos-box with the options -d -r etc. as > explained in the documentation does not work, error message: file not > found) > BTW: I'm using Windows XP Professional on both client and server. > Client IP = 10.4.208.159, server IP = 10.4.208.102 for a test set-up. > > On the server side it gives the same error when started with options. > stunnel.conf on the server is this: > ; Sample stunnel configuration file by Michal Trojnara 2002-2006 > ; Some options used here may not be adequate for your particular > configuration > ; Certificate/key is needed in server mode and optional in client mode > ; The default certificate is provided only for testing and should not > be used in a production environment > cert = stunnel.pem > ;key = stunnel.pem > > ; Some performance tunings > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > > ; Some debugging stuff useful for troubleshooting > debug = 7 > output = stunnel.log > > ; Use it for client mode > client = yes > > ; Service-level configuration > [sip2s] > accept = 1975 > connect = 127.0.0.1:1974 > > Reading data on TCP/IP 1974 does not display anything when the client > is sending data to localhost:1974 which is encrypted by stunnel an > forwarded on TCP/IP 1975. > At least that is my intention, but something I do is wrong. > Data sending unencrypted between client an server works fine, so > connection is possible. > > Any idea what I should do to let it work like this: > - a client sends data to a server and reads the response from this > server. > - all data on the network between client an server should be > encrypted. > As far as I could find in the stunnel manual it should be able to use > stunnel for this. > In the manual is an example using foo (client) and bar (server). > > Dick van Fulpen | Senior Software Engineer | Infor | Tel:+31 (0)73 > 6205 222 | Dick.vanFulpen(a)infor.com | Infor | Postbus 2067 | 5202 CB > 's-Hertogenbosch | Nederland | Bezoek onze website www.vubis-smart.com > | >

1 0

Connection Refused locally, SSL Proxy.
by Avner Peled 01 Feb '08

01 Feb '08

Hello! I have a game client connecting to a server using TCP over SSL. I'm trying to setup an SSL proxy using 2 stunnels on the same server like so: Client --> Stunnel-Server:20001 (decrypt)--> Stunnel-Client:901 (encrypt)---> Server:20001 Using latest stunnel-4.21-r1 on Gentoo kernel 2.6.22-gentoo-r9 I have a weird problem. The first connection after starting both stunnels works fine. Afterwards every time the client tries to connect, it gets refused once. Then it tries again and gets connected. Then the next time it will once again get refused once and then connect. I have looked at the logs and it seems the Stunnel server (the first) gets Connection Refused from localhost:901. Then it tries again and gets connected. The Stunnel client (the second) doesn't even mention the first failing local connection in the log. I have provided the config files of both stunnels and a log with debug = 7 (server ip's are censored) I have also tried the following config tweaks with no luck socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 TIMEOUTclose = 0 retry = yes Any help would be appreciated. Thanks!! -- Avner Peled. avnerus(a)gmail.com

1 1

debug level 7
by Damian Wiest 25 Jan '08

25 Jan '08

Hi, I'm new to stunnel and have run into some unexpected behavior. I'm inclined to think it's a bug, but perhaps I'm misunderstanding some things. I'm running FreeBSD 6.2 with stunnel 4.21 (installed via ports collection). I'm able to configure things properly when using stunnel in daemon mode, but am unable to run stunnel from inetd when I set the debug level to 7. Here's the config file I'm using, cert = /usr/local/CA/stunnel.pem key = /usr/local/CA/stunnel.pem sslVersion = all pid = /var/log/swat-stunnel.pid debug = 7 output = /tmp/stunnel.log exec = /usr/local/sbin/swat execargs = swat ...and the inetd.conf entry, swat stream tcp nowait.400 root /usr/local/sbin/stunnel stunnel /usr/local/etc/stunnel/swat.conf If I connect to port 901, some debug messages are written to the socket, dwiest(a)dfwdamian.vail: telnet localhost 901 Trying ::1... telnet: connect to address ::1: Connection refused Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. 2008.01.22 22:19:09 LOG7[81278:134651904]: Snagged 64 random bytes from /home/dwiest/.rnd 2008.01.22 22:19:09 LOG7[81278:134651904]: Wrote 1024 new random bytes to /home/dwiest/.rnd 2008.01.22 22:19:09 LOG7[81278:134651904]: RAND_status claims sufficient entropy for the PRNG 2008.01.22 22:19:09 LOG7[81278:134651904]: PRNG seeded successfully 2008.01.22 22:19:09 LOG7[81278:134651904]: Certificate: /usr/local/CA/stunnel.pem 2008.01.22 22:19:09 LOG7[81278:134651904]: Certificate loaded 2008.01.22 22:19:09 LOG7[81278:134651904]: Key file: /usr/local/CA/stunnel.pem 2008.01.22 22:19:09 LOG7[81278:134651904]: Private key loaded 2008.01.22 22:19:09 LOG7[81278:134651904]: SSL context initialized for service stunnel ^] telnet> q Connection closed. ...and some are written to the file I specified, dwiest(a)dfwdamian.vail: cat /tmp/stunnel.log 2008.01.22 22:19:09 LOG5[81278:134651904]: stunnel 4.21 on i386-unknown-freebsd6.2 with OpenSSL 0.9.7e-p1 25 Oct 2004 2008.01.22 22:19:09 LOG5[81278:134651904]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.01.22 22:19:09 LOG7[81278:134651904]: stunnel started 2008.01.22 22:19:09 LOG7[81278:134651904]: FD 0 in non-blocking mode 2008.01.22 22:19:09 LOG7[81278:134651904]: FD 1 in non-blocking mode 2008.01.22 22:19:09 LOG7[81278:134651904]: stunnel permitted by libwrap from 127.0.0.1:53961 2008.01.22 22:19:09 LOG5[81278:134651904]: stunnel accepted connection from 127.0.0.1:53961 2008.01.22 22:19:09 LOG7[81278:134651904]: SSL state (accept): before/accept initialization 2008.01.22 22:19:11 LOG3[81278:134651904]: SSL_accept: Peer suddenly disconnected 2008.01.22 22:19:11 LOG5[81278:134651904]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.01.22 22:19:11 LOG7[81278:134651904]: stunnel finished (0 left) If I run stunnel in daemon mode with the debug level set to 7, then the messages are printed to stderr. Shouldn't they go to either syslog, or to the file specified with the "output" option? I dug through the source code and discovered that file_putline() is being called from parse_config() before open_log() has been called. This results in file_putline() writing to stderr instead of the specified output file. If this is known behavior, then it would be nice if the man page mentioned something. -Damian

3 3

rtmps with stunnel
by David Schulberg 24 Jan '08

24 Jan '08

Hi, A while ago I reported an issue with using rtmps on linux to connect to a Red5 server through stunnel. I am having no issues on Windows. The rtmps connection is made from Flash code running in the browser. The error reported on Linux was 'SSL_accept: Peer suddenly disconnected' which occurs straight after 'SSL state (accept): before/accept initialization' . Now I am having a similar problem trying to connect from a MAC. In this case I also get 'SSL_accept: Peer suddenly disconnected' which occurs straight after 2008.01.24 16:39:31 LOG7[1608:2980]: SSL state (accept): before/accept initialization 2008.01.24 16:39:31 LOG7[1608:2980]: SSL state (accept): SSLv3 read client hello A 2008.01.24 16:39:31 LOG7[1608:2980]: SSL state (accept): SSLv3 write server hello A 2008.01.24 16:39:31 LOG7[1608:2980]: SSL state (accept): SSLv3 write certificate A 2008.01.24 16:39:31 LOG7[1608:2980]: SSL state (accept): SSLv3 write server done A 2008.01.24 16:39:31 LOG7[1608:2980]: SSL state (accept): SSLv3 flush data It seems to get further on the MAC but still fails. Regards, David

1 0

stunnel with Fedora core
by Andy 17 Jan '08

17 Jan '08

Hello everyone I am trying to configure stunnel on a Fedora Core machine, but have had little luck. The below configuration is in the /etc/stunne/stunnel.conf. I want this machine to send encrypted data to another machine via stunnel. My knowledge of stunnel is quite limited. chroot = /home/stunnel pid = /stunnel.pid setuid = stunnel setgid = stunne; debug = 7 output = /var/log/messages client = yes [ldap] accept = 389 connect = ldap.example.com:636 I have been told that this command will work. stunnel -c -d ldaps -r <LDAPSERVER>:ldaps This command does work under debian but does not work under fedora core. Can anyone help me with this? -- REGARDS, Andy

1 0

Debian Bug#460019: cert= produces output on stderr even with log= set
by Luis Rodrigo Gallardo Cruz 16 Jan '08

16 Jan '08

----- Forwarded message from Bryan Donlan <bd(a)fushizen.net> ----- Version: 3:4.21-1 With the following configuration: output = /srv/stun/log compression = zlib CApath = /srv/stun/keys cert = /srv/stun/server.pem connect = localhost:9999 verify = 3 The following is output on stderr: 2008.01.10 02:54:19 LOG5[11786:3083495088]: Peer certificate location /srv/stun/keys This confuses clients when stunnel is driven direcly from xinetd. This output, if it is produced at all, should be placed in the log file. ----- End forwarded message ----- The issue is that verify_init (verify.c:103) calls s_log(LOG_NOTICE, "Peer certificate location %s", section->ca_dir); apparently before the logfile is setup. Could the log file initialization be moved earlier in the starup sequence? Or maybe this log call's severity could be lowered.

2 6

Nessus crashes stunnel
by Joe Kemp 16 Jan '08

16 Jan '08

I am running some tests against my stunnel configuration with Nessus. I am able to get stunnel to exit silently when I run Nessus with the Nessus TCP Scan and Weak Supported SSL Cipher Suites test. I have played with a few different options but the process consistently ends when these tests are run together. Here is the config: Linux testssl.capwin.net 2.6.18-53.1.4.el5 #1 SMP Fri Nov 30 00:45:16 EST 2007 i686 i686 i386 GNU/Linux gcc version 4.1.2 20070626 (Red Hat 4.1.2-14) stunnel 4.20 on i686-pc-linux-gnu with OpenSSL 0.9.8b 04 May 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Auth:LIBWRAP OpenSSL 0.9.8b 04 May 2006 Tail of log file during nessus tests 2008.01.15 21:24:30 LOG5[10646:3086605200]: XMPP accepted connection from 10.102.11.250:41781 2008.01.15 21:24:30 LOG7[10646:3086605200]: SSL state (accept): before/accept initialization 2008.01.15 21:24:30 LOG7[10646:3086605200]: SSL alert (write): fatal: handshake failure 2008.01.15 21:24:30 LOG3[10646:3086605200]: SSL_accept: 1408A10B: error:1408A10B:SSL routines:SSL3_GET_CLIENT_HELLO:wrong version number 2008.01.15 21:24:30 LOG5[10646:3086605200]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.01.15 21:24:30 LOG7[10646:3086605200]: XMPP finished (0 left) 2008.01.15 21:24:30 LOG7[10646:3086608080]: XMPP accepted FD=7 from 10.102.11.250:41782 2008.01.15 21:24:30 LOG7[10646:3086605200]: XMPP started 2008.01.15 21:24:30 LOG7[10646:3086605200]: FD 7 in non-blocking mode 2008.01.15 21:24:30 LOG7[10646:3086605200]: TCP_NODELAY option set on local socket 2008.01.15 21:24:30 LOG7[10646:3086605200]: FD 8 in non-blocking mode 2008.01.15 21:24:30 LOG7[10646:3086605200]: FD 9 in non-blocking mode 2008.01.15 21:24:30 LOG7[10646:3086608080]: Cleaning up the signal pipe 2008.01.15 21:24:30 LOG6[10646:3086608080]: Child process 10676 finished with code 0 2008.01.15 21:24:30 LOG7[10646:3086605200]: Connection from 10.102.11.250:41782 permitted by libwrap 2008.01.15 21:24:30 LOG5[10646:3086605200]: XMPP accepted connection from 10.102.11.250:41782 2008.01.15 21:24:30 LOG7[10646:3086605200]: SSL state (accept): before/accept initialization Joe A. Kemp CapWIN Senior Systems Architect 6305 Ivy Lane Suite 300 Greenbelt, MD 20770 (P) 301-614-3727 (F) 301-614-0581

2 1

Re: [stunnel-users] stunnel automatically listening to extra ports: BAD
by Luis Rodrigo Gallardo Cruz 12 Jan '08

12 Jan '08

[You forgot to cc: the list] On Fri, Jan 11, 2008 at 03:24:32PM -0500, Alan Pinstein wrote: > On Jan 11, 2008, at 3:02 PM, Luis Rodrigo Gallardo Cruz wrote: >> On Fri, Jan 11, 2008 at 02:31:58PM -0500, Alan Pinstein wrote: >>> Hi All- >>> [ Stunnel listens on ports it shouldn't ] >>> >>> If I start up stunnel from the command line as "root" or another user >>> even, it only listens on the port listed in the conf file. >> >> Could you have some startup script that's automatically getting run >> with your logrotate scripts? >> > The problem happens the MOMENT stunnel starts. It has nothing to do with > the logrotate scripts. Oh, sorry, I got confused. (/me goes and re-reads the original mail ...) > I've done a bunch of debugging and can't figure out what's going on. > I have only one guess: stunnel automatically listens on any ports > that the process calling stunnel is listening on, in some sort of > attempt to seamlessly add SSL to existing daemons. I can't find any > docs or tell from the source code, but it's the only idea I can't > rule out... All this is in a *nix, right? The following is an educated guess: Open connections are open file descriptors, and fork()/exec() do not close open file descriptors. Thus, stunnel is inheriting the open connection. And, since it knows nothing about it, it does not close it or anything like that. So it's not that it activelly listens on it, but only that it does not bother to stop. You might check this theory by trying to connect to the port *after* apache is shut down. If I'm right you should get no answer at all. So, the solution is to have the file descriptors close when exec'ing stunnel. PHP or apache might have some option somewhere to do that (look for "close on exec" or something similarly named), but if not, you might have to write some sort of wrapper to do it. It's a messy thing, because AFAIK there's no clean way to do it short of for (i = 0; i < [some-hopefuly-large-enough-value]; i++) close(i); where the [large-enough-value] is determined by your system's file descriptor limit and your desire not to loop all the way to 2^32 or something. -- Rodrigo i-think-this-time-i-answered-the-question-asked Gallardo GPG-Fingerprint: 7C81 E60C 442E 8FBC D975 2F49 0199 8318 ADC9 BC28

5 4

Re: [stunnel-users] config socket SSL TCP
by khaled khaled 12 Jan '08

12 Jan '08

Hi,Can you send me please ( certificate+Key: Client & server) + CA.i want to try my server.The Client is a socket TCP developped on Openssl and C++.(I 'am sure that theclient work) but my config ???i want to generate a key for the client?the SSL client authenticate itself.Many thanks,FOR the server:-----BEGIN RSA PRIVATE KEY-----MIICXAIBAAKBgQDEIXwTWeacXiNOICmkgTgc+MD/i1w1sJ3LBR/lfnH+9pfs/6HBKY4SW+GHQtlSiHVx0WNQgoPQIU1J29PPWONYivIe2hdSvn1uSSmypa7gudWxUqBYuFKzzlmEMtFmUn8UG5KmV8SYQ/970C1bcEchWMyp40C+f9vkP3U/SmFBAwIDAQABAoGAQaWzkgaVWeFoj83UImveDFR2xRIwWwgyyLF+a6JXJbAESh+GVNFD7IE0i8GkXCuwo9giFeCZniCHbiFWVCC8d1/PZd/inQGfmtdTNbvr9xI7AVTTAH4D+mZTwduAuOAUdoI/r5+Ll/hyfZDdFMZuypbFHCUBspkNIfHymJ8qNwECQQD3Q16K1iuwRjZF7Pwl8YT3t8otnMawilFsV5f3RpGlxCT8yGH23liidPr9cwUCORRT4Lar98a9B77E7lTZEzQJAkEAyw+YW9pNqH13+nvcOkIVwefl1umNuU5ayye7gYi5xuccaoc2AnjtPPX8lSvM9ZNcT/0YQZSAsRfMm7YIq+dHqwJBAIZBDhRUNWSAuvc8tavkd04JfL1HYpp4f71T0i9xIaPf3DVkl8xy7a1H1v/Gc/HBDEh+urCk2EPK8Mn8nhU/WAECQAVikn3NGkYfnbDs2/hHjGAqEDRU2UdSxqGgmh5jS9n0gxJoJ4yFPHVjaKFkGflhQQ91/NCwaYFIykpO14gHiCUCQHkB8W/4zaB47skmB181p9WNiprWZRgqo4BINW6ecVQfc87s7+Jaz3GgRyCJ4QeUtbimOVd3wBO3FqzCyOnOLpY=-----END RSA PRIVATE KEY----------BEGIN CERTIFICATE-----MIICdzCCAeCgAwIBAgIBBzANBgkqhkiG9w0BAQQFADCBhDELMAkGA1UEBhMCRlIxDjAMBgNVBAgTBVBBUklTMQ4wDAYDVQQHEwVQQVJJUzEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMQ8wDQYDVQQDEwZraGFsZWQxITAfBgkqhkiG9w0BCQEWEmtraGFsZWRAaG90bWFpbC5mcjAeFw0wODAxMDgxOTQ5NDJaFw0xODAxMDUxOTQ5NDJaMDAxDzANBgNVBAMTBmNsaWVudDEdMBsGCSqGSIb3DQEJARYObmR0QHdhdmVjb20uZnIwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMQhfBNZ5pxeI04gKaSBOBz4wP+LXDWwncsFH+V+cf72l+z/ocEpjhJb4YdC2VKIdXHRY1CCg9AhTUnb089Y41iK8h7aF1K+fW5JKbKlruC51bFSoFi4UrPOWYQy0WZSfxQbkqZXxJhD/3vQLVtwRyFYzKnjQL5/2+Q/dT9KYUEDAgMBAAGjTDBKMBkGA1UdEQQSMBCBDm5kdEB3YXZlY29tLmZyMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAU2LdfcyCatRPpCalV3Qyq7RJwUjowDQYJKoZIhvcNAQEEBQADgYEAMcC80wuYfwycQF/6mbG2D4iQJkUJGXyWd2ColwPvxos5S07oUyPpy1ev+OVmHCSMZMuBpGsJ+0oNyqe39wWvvjB80pddXaKcRN4lNj7BSo2u/edy8WRoFjj75JV3Z35K5KmMAGs2MS7Np/sHa4CVlu5yd8gI0CIA5gxXwqPNJV8=-----END CERTIFICATE-----For CA ROOT:-----BEGIN RSA PRIVATE KEY-----MIICXwIBAAKBgQDCK1KTB2TkLVbNYnU9t29ZmlClEnszHa/xX8slB/VnFdazw/U2iSS01OtwXaUNTrA/hQJ50ykls14dRBguwJnNuGM8IH8zCCWNdesTMtYF0ZucCkrfSmir9210A2m6Wo1SEbKyUHErFMsW9UcxDPAGyfZQ0dIhjUDDkw9SL+fTPQIDAQABAoGBAJm3SGDjqqjFiAGC38QjM0DhXNTCA8ycxQw2xREk8s9QR6/7A2bQPcH3Cgjj6eXWFMvElggx9lJFZM2QegCRM3B7DlB4VYviCz+T5urezuRiHZkxfHp6m2T9fitcfB+FUCq3uGn3yeA+rLc/P5/dXV3JE1uNmH96p96e6kwRnorBAkEA6eDPz7dIh+2znbCcoyrX4G5tp7DqNooBH5p5gLp9an7DePgfHH15POZfCQ4oNv16VIfPhM8fF9u8tmbs5jjFsQJBANSI/OdNitlQYXCoUuDqgPbsxhnS6ajVUa7ZlMoGgkLCmuSj99gphD0q6tp/9niEhAdp36wSyerEZKvu5TEobU0CQQDZGEeOhpGbK3iJLcGYbFKLD7ZV7JDcI2o7jcavSWzVh+mmxpsKdSYu86DP5QZLVStSf+aPXzt7iAs6PXw1kAlhAkEAwywVSverdUraYFFC4qaWzaq7dMV5q4BRpYbLmwaFIneBNEva8teVR3Kc/xAZr6zJbeFs9KDAaeX2KOmV8SGV1QJBAKGPzYwD5XpW3v9NpmyNYzFf4HuzK6Gh90aZ5CLxSSdDHc9cmCZEgoXgepb6/48+qRpRELkSpeE2IWHBxmGMPa8=-----END RSA PRIVATE KEY----------BEGIN CERTIFICATE-----MIIDZTCCAs6gAwIBAgIBADANBgkqhkiG9w0BAQQFADCBhDELMAkGA1UEBhMCRlIxDjAMBgNVBAgTBVBBUklTMQ4wDAYDVQQHEwVQQVJJUzEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMQ8wDQYDVQQDEwZraGFsZWQxITAfBgkqhkiG9w0BCQEWEmtraGFsZWRAaG90bWFpbC5mcjAeFw0wODAxMDgxOTIyMTlaFw0xODAxMDUxOTIyMTlaMIGEMQswCQYDVQQGEwJGUjEOMAwGA1UECBMFUEFSSVMxDjAMBgNVBAcTBVBBUklTMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQxDzANBgNVBAMTBmtoYWxlZDEhMB8GCSqGSIb3DQEJARYSa2toYWxlZEBob3RtYWlsLmZyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCK1KTB2TkLVbNYnU9t29ZmlClEnszHa/xX8slB/VnFdazw/U2iSS01OtwXaUNTrA/hQJ50ykls14dRBguwJnNuGM8IH8zCCWNdesTMtYF0ZucCkrfSmir9210A2m6Wo1SEbKyUHErFMsW9UcxDPAGyfZQ0dIhjUDDkw9SL+fTPQIDAQABo4HkMIHhMB0GA1UdDgQWBBTYt19zIJq1E+kJqVXdDKrtEnBSOjCBsQYDVR0jBIGpMIGmgBTYt19zIJq1E+kJqVXdDKrtEnBSOqGBiqSBhzCBhDELMAkGA1UEBhMCRlIxDjAMBgNVBAgTBVBBUklTMQ4wDAYDVQQHEwVQQVJJUzEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMQ8wDQYDVQQDEwZraGFsZWQxITAfBgkqhkiG9w0BCQEWEmtraGFsZWRAaG90bWFpbC5mcoIBADAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBAUAA4GBAENN2yi1jGD87BjzQ7PfmmRiwP7psisy8GKv4ipRhho76Su353BOZJXNj1x+gyk1/gsDVeSRf0YDJTiH6bMLY2usC9UA3F7x6zvb36joVxbnKLNhxrXStYIaJgVYW+Pf8Wr3sXO/yAkiyDsCsDseofnSGrirPsMC0N9n5X5qf+ER-----END CERTIFICATE-----FOR the Client-----BEGIN CERTIFICATE-----MIICdzCCAeCgAwIBAgIBBjANBgkqhkiG9w0BAQQFADCBhDELMAkGA1UEBhMCRlIxDjAMBgNVBAgTBVBBUklTMQ4wDAYDVQQHEwVQQVJJUzEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMQ8wDQYDVQQDEwZraGFsZWQxITAfBgkqhkiG9w0BCQEWEmtraGFsZWRAaG90bWFpbC5mcjAeFw0wODAxMDgxOTQ2MzhaFw0xODAxMDUxOTQ2MzhaMDAxDzANBgNVBAMTBnNlcnZlcjEdMBsGCSqGSIb3DQEJARYOa2toQHdhdmVjb20uZnIwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAM9Sl2bn98NylY7KITLL//vJsr0OeuS79qTBdy2ticIWjz4k9/iVDQ7YmvxlxR5KtY1kSZYaSU44lXATH15ukczGWo2qy9uNfA5PhsEIUsE3SaQA+EptaicHQhsZ3QkLypz4gqNqK8Im/Nk4qvTR9Z7pturgROFOsckwOdSYbkC3AgMBAAGjTDBKMBkGA1UdEQQSMBCBDmtraEB3YXZlY29tLmZyMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAU2LdfcyCatRPpCalV3Qyq7RJwUjowDQYJKoZIhvcNAQEEBQADgYEAAfP0JXQlbi0GUIE04dYsCqug2D/l8+PtRuZ0iRUSznwhc5H7nkTeAV/i91BIBC3NtKdlhj6COcCApEVD9Jbax2dPJBm9ZCccVC41qKaD5Wi82y0aK7yIF+EvPGAieSWphhRbNH4ElF/rWADaIGMJz2PqtE0WgptDOfH5z/mn2MM=-----END CERTIFICATE----------BEGIN RSA PRIVATE KEY-----MIICXwIBAAKBgQDPUpdm5/fDcpWOyiEyy//7ybK9Dnrku/akwXctrYnCFo8+JPf4lQ0O2Jr8ZcUeSrWNZEmWGklOOJVwEx9ebpHMxlqNqsvbjXwOT4bBCFLBN0mkAPhKbWonB0IbGd0JC8qc+IKjaivCJvzZOKr00fWe6bbq4EThTrHJMDnUmG5AtwIDAQABAoGBAL00oNvXY3RJhFgV/ApBxtJhFvAW4O0S5Vsi/MMBFzG8KOoMDwob7RjZcUhbEHQ+tkXdepK0VqY+WZM4wG4L9p4IzpvU1CgLcPXf9zw7JLFZITMux1WhDCT/HEnr/sh138va7b7HXOl7TSgBrmo8xyPNktzqsye2TXiRU6rSHjjhAkEA7W+VnzA5V1T/H5N2p3V4Hy6P9Kv83nTqlq4JP9S939/1JYF2ZrdFPluNOO1Gn3PDFhuKZekFvvBdjXq8EH3H/wJBAN+IRdqFvah0smfASV3bEPbP1tl7JwsaOb8UqQciZHkwzQztHrZ7Gf3s+5HvMcQj4TMR9Dl4ad00kmB6pVnnx0kCQQCCBuOXY99jFicI8ca++jOoT+WCBlXatYhqsDBchnLdEVa9DWL76U3AUn7KOBa+57RkfPyTxsLgx91Tx20KUvedAkEAxd2+17xjMeZ6tdREHUx5K8C2kjStTuqcC0Siiqoq/gvwtmx/L1CwpVFNLtTo3JJWGfrekLDCJQkQOU7XZ0n/4QJBAOMpeKnf+ZXAuyhY9DVeCWK9G3MP/2VZuC7Z5N56P5VVk22mxe9LdyMdA2FG69fIuoaT9Uni/yD+tzRb6PJTDzM=-----END RSA PRIVATE KEY----- _________________________________________________________________ Comme 9 millions de français, créez un compte Hotmail ! http://www.windowslive.fr/hotmail/default.asp

1 0

stunnel automatically listening to extra ports: BAD
by Alan Pinstein 11 Jan '08

11 Jan '08

Hi All- I am using stunnel to secure a connection between a local python script using telnetlib and a custom sockets-based server requiring SSL, from local port 4449 to remote port 4449. This is done via: stunnel /opt/www/domains/admin.showcasere.com/showcase/classes/ opensrs-php/stunnel-app.conf where the conf file is: > client = yes > pid = /opt/www/domains/admin.showcasere.com/runtime/stunnel.pid > debug = 7 > [telnet] > accept = 4449 > connect = admin.hostedemail.com:4449 Functionally, everything works for my application, but I am experiencing a bad side-effect. stunnel is ALSO setting up listeners on HTTP and HTTPS ports, and when my daily logrotate scripts run and HUP apache, stunnel steals the web server's ports and the server won't come back up! I had 7 hours of downtime today because of this. I've done a bunch of debugging and can't figure out what's going on. I have only one guess: stunnel automatically listens on any ports that the process calling stunnel is listening on, in some sort of attempt to seamlessly add SSL to existing daemons. I can't find any docs or tell from the source code, but it's the only idea I can't rule out... Here is the debug log of the startup of stunnel (which is run from an apache/php script): Jan 11 13:10:13 bigwoody stunnel: LOG5[13964:3086333632]: stunnel 4.14 on i386-redhat-linux-gnu PTHREAD+POLL+IPv6+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 Jan 11 13:10:13 bigwoody stunnel: LOG7[13964:3086333632]: RAND_status claims sufficient entropy for the PRNG Jan 11 13:10:13 bigwoody stunnel: LOG6[13964:3086333632]: PRNG seeded successfully Jan 11 13:10:13 bigwoody stunnel: LOG6[13964:3086333632]: file ulimit = 1024 (can be changed with 'ulimit -n') Jan 11 13:10:13 bigwoody stunnel: LOG6[13964:3086333632]: poll() used - no FD_SETSIZE limit for file descriptors Jan 11 13:10:13 bigwoody stunnel: LOG5[13964:3086333632]: 500 clients allowed Jan 11 13:10:13 bigwoody stunnel: LOG7[13964:3086333632]: FD 31 in non-blocking mode Jan 11 13:10:13 bigwoody stunnel: LOG7[13964:3086333632]: FD 32 in non-blocking mode Jan 11 13:10:13 bigwoody stunnel: LOG7[13964:3086333632]: FD 33 in non-blocking mode Jan 11 13:10:13 bigwoody stunnel: LOG7[13964:3086333632]: SO_REUSEADDR option set on accept socket Jan 11 13:10:13 bigwoody stunnel: LOG7[13964:3086333632]: telnet bound to 0.0.0.0:4449 Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086333632]: Created pid file /opt/www/domains/admin.showcasere.com/runtime/stunnel.pid Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086333632]: telnet accepted FD=34 from 127.0.0.1:48335 Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: telnet started Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: FD 34 in non-blocking mode Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: FD 35 in non-blocking mode Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: FD 36 in non-blocking mode Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086333632]: Cleaning up the signal pipe Jan 11 13:10:13 bigwoody stunnel: LOG6[13965:3086333632]: Child process 13967 finished with code 0 Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: Connection from 127.0.0.1:48335 permitted by libwrap Jan 11 13:10:13 bigwoody stunnel: LOG5[13965:3086330784]: telnet connected from 127.0.0.1:48335 Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: FD 35 in non-blocking mode Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: telnet connecting 216.40.42.6:4449 Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: connect_wait: waiting 10 seconds Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: connect_wait: connected Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: Remote FD=35 initialized Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: SSL state (connect): before/connect initialization Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: SSL state (connect): SSLv3 write client hello A Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: SSL state (connect): SSLv3 read server hello A Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: SSL state (connect): SSLv3 read server certificate A Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: SSL state (connect): SSLv3 read server done A Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: SSL state (connect): SSLv3 write client key exchange A Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: SSL state (connect): SSLv3 write change cipher spec A Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: SSL state (connect): SSLv3 write finished A Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: SSL state (connect): SSLv3 flush data Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: SSL state (connect): SSLv3 read finished A Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: 1 items in the session cache Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: 1 client connects (SSL_connect()) Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: 1 client connects that finished Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: 0 client renegotiatations requested Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: 0 server connects (SSL_accept()) Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: 0 server connects that finished Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: 0 server renegotiatiations requested Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: 0 session cache hits Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: 0 session cache misses Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: 0 session cache timeouts Jan 11 13:10:13 bigwoody stunnel: LOG6[13965:3086330784]: SSL connected: new session negotiated Jan 11 13:10:13 bigwoody stunnel: LOG6[13965:3086330784]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4 (128) Mac=MD5 Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: SSL socket closed on SSL_read Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: Socket write shutdown Jan 11 13:10:13 bigwoody stunnel: LOG5[13965:3086330784]: Connection closed: 91 bytes sent to SSL, 73 bytes sent to socket Jan 11 13:10:13 bigwoody stunnel: LOG7[13965:3086330784]: telnet finished (0 left) And then, you can see what stunnel is listening on: [root@bigwoody custom_img]# lsof -i | grep stunnel stunnel 13965 apache 4u IPv4 156503478 TCP static-216.114.79.43.primarynetwork.com:http (LISTEN) stunnel 13965 apache 5u IPv4 156503480 TCP static-216.114.79.43.primarynetwork.com:https (LISTEN) stunnel 13965 apache 30u IPv4 156771437 TCP localhost.localdomain:51333->localhost.localdomain:9676 (ESTABLISHED) stunnel 13965 apache 33u IPv4 156846546 TCP *:privatewire (LISTEN) If I start up stunnel from the command line as "root" or another user even, it only listens on the port listed in the conf file. Does anyone have any idea what's going on here? How can I turn off this behavior? Thanks! Alan

2 1

Re: [stunnel-users] your mail
by Brian Hatch 10 Jan '08

10 Jan '08

On or about 2008-01-10 15:34 +0100, khaled45(a)free.fr directed: > Here attached files generated. > can you send me the configuration element of SSL and Stunnel or explain me how > to generate? You sent the private keys too - you shouldn't do this. You should create new keys when done debugging this problem. I saw only 2 keys - the CA and the stunnel.pem. Your configuration specifies 3 keys, the CA, stunnel.pem, and is attempting to verify the SSL client (browser? something else) against the CA via the 'verify=' line. What is the SSL client? Did you generate a key for it? Because your config is requiring the SSL client authenticate itself, and Stunnel is dropping the connection because that phase isn't working correctly. -- Brian Hatch "So, what's the problem?" Systems and "I don't know. Security Engineer *That's* the problem." http://www.ifokr.org/bri/ Every message PGP signed

1 0

Re: [stunnel-users] your mail
by Brian Hatch 09 Jan '08

09 Jan '08

At more or less 2008-01-09 18:09 +0100, khaled45(a)free.fr squalked: > ; It's often easier to use CAfile > CAfile = ca.pem > cert = userkey.pem > debug = 7 > client = no > [apache] > accept = 4433 > connect = 192.168.1.4:433 I'd suggest using the full path for your pem files above, just to be safe. Can you shoot the public keys of the client (which is not on this machine) and the ca.pem and the public key from userkey.pem (which is actually the server's key - you may wish to rename.) There are three pems involved: * the CA key (private) and cert (public) in ca.pem * the stunnel server's key (private) and cert (public) in userkey.pem. ('userkey' is a bad name here.) * the client's key (private) and cert (public) on 192.168.1.5. Can you send the public parts here so I can verify that they're signed by the appropritate folks? -- Brian Hatch "Everybody's cute! Systems and Everybody's cute! Security Engineer Even me. But in http://www.ifokr.org/bri/ purple I'm stunning!" Every message PGP signed

1 0

TCP (Server / Client)
by khaled khaled 09 Jan '08

09 Jan '08

Hi all, I am a new STUNNEL user,I will do 2 secure sockets TCP (Server / Client). I would like to know how to set 'stunnel.conf. I tried but it does not work. Description: ---------- I created a CA root and from this I have created 2 pairs (key and certificate) one for the server and one for the client. You can send me please a config file of the server. Many thanks, Stunnel.config (serveur) ----------------------- cert = server.crt key = serverkey.key CAfile = ca.crt ;[Server] accept = 192.168.1.4:4433 connect = 192.168.1.4:4433 _________________________________________________________________ Votre contact a choisi Hotmail, l'e-mail nouvelle génération. Créez un compte. http://www.windowslive.fr/hotmail/default.asp

3 6

2 secure sockets TCP (Server / Client).
by khaled khaled 07 Jan '08

07 Jan '08

Hi all,I am a new STUNNEL user,I will do 2 secure sockets TCP (Server / Client). I would like to know how to set 'stunnel.conf. I tried but it does not work. Description: ---------- I created a CA root and from this I have created 2 pairs (key and certificate) one for the server and one for the client. You can send me please a config file from a server? Many thanks, Stunnel.config (serveur) ----------------------- ; Sample stunnel configuration file by Michal Trojnara 2002-2006; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode; The default certificate is provided only for testing and should not; be used in a production environment;cert = stunnel.pem;key = stunnel.pemcert = server.crt key = serverkey.key ; Some performance tuningssocket = l:TCP_NODELAY=1socket = r:TCP_NODELAY=1 CAfile = ca.crt ;[Server]accept = 192.168.1.4:4433connect = 192.168.1.4:4433 KHALED Khaled Ingénieur de télécommunications et informatique _________________________________________________________________ Votre contact a choisi Hotmail, l'e-mail nouvelle génération. Créez un compte. http://www.windowslive.fr/hotmail/default.asp

1 0

Missing Something Basic on Config
by Steve 29 Dec '07

29 Dec '07

Using stunnel for NNTPS. Stunnel starts without any apparent problems (log looks normal), but simply doesn't intercept packets from my news reader. There is no activity in the log and sniffing the packets shows everything happening on 119. My understanding of the concept is that there are no configuration changes needed in the newsreader; IOW, I leave it pointing to the unsecured NNTP server with the port set to 119. I fear I'm missing something very obvious. BTW, I've confirmed the ability to use NNTPS with this particular server by using Outlook Express, which is compatible with NNTPS. Version: 4.20; I used the Windows binary. Running XP. Config: ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [nntps] accept = 192.168.1.101:119 connect = secure.news.easynews.com:563 Log: 2007.12.28 22:24:46 LOG5[6640:6644]: stunnel 4.20 on x86-pc-mingw32-gnu with OpenSSL 0.9.8d 28 Sep 2006 2007.12.28 22:24:46 LOG5[6640:6644]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2007.12.28 22:24:46 LOG5[6640:5936]: No limit detected for the number of clients 2007.12.28 22:24:46 LOG7[6640:5936]: FD 196 in non-blocking mode 2007.12.28 22:24:46 LOG7[6640:5936]: SO_REUSEADDR option set on accept socket 2007.12.28 22:24:46 LOG7[6640:5936]: nntps bound to 192.168.1.101:119

1 0

Avoiding outlook express warning...
by fg 28 Dec '07

28 Dec '07

Hello all I use stunnel on a server with a stunnel.pem file generated with openSSL,( this file is not certified with verisign or others...) Each time i launch outlook express on a client a have a warning saying that the server is using a certificate who can't be verified.... I have to close this warning and after all is ok... Question Is it possible to skip this warning? perhaps with a public key approuved in outlook express??? thanks for help --------------------------------- Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

3 2

stunnel
by peter griep 28 Dec '07

28 Dec '07

hello i'm using stunnel with download2day,but it's not working wih grabit can you tell what i must do to work stunnel with grabit. peter

3 2

1 tunnel client to few different servers
by Shalvi Ziv 26 Dec '07

26 Dec '07

All, As my PROXY server gets requests from end-users to be proxied to several different content providers (SMS servers), I was wondering how can encrypt the traffic between the PROXY to the SMS using stunnel, but still handle the differentiation to the various content providers. Meaning, my PROXY listens on port 9090 for all incoming SMS requests and each request should be addressed to different SMS server (i.e. different content provider) based on the number the message was sent to. See following example: Client = yes [SMPP] accept = 9090 (should always be this port) connect = <SMS IP>:442 Now, how can I do it with stunnel configuration (having the <SMS IP> flexibly assigned according to other parameters in the packet)? Thanks! zivs

2 1

Can stunnel be configured to listen for multiple IP addresses and access different email hosts?
by David Goldstein 21 Dec '07

21 Dec '07

2 1

Using stunnel as a non-root user
by T. S. Ferreira 20 Dec '07

20 Dec '07

I have a small web application running as a regular (non root) user on my port 6666. I would like to make it accessible through SSL on port 7777. In order to test it I used (as the same non root user) the following command: stunnel -D 7 -p mypemfile.pem -d 7777 -r localhost:6666 but it does not work. When I check with "ps aux | fgrep stunnel", no such program is running. However if I run it as root, it does work. I did not find in the documentation any restriction with this regard. Since my final application will run on a machine to whose root I do not have access, I would like to find a way to solve this problem. Any hint will be appreciated. -- tsf ----------------------------------------- My system data are: (1) Linux/Ubuntu 7.10, kernel 2.6.22-14-generic, (2) Output of "/usr/bin/stunnel4 -version": stunnel 4.20 on i486-pc-linux-gnu with OpenSSL 0.9.8e 23 Feb 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none (3) Output due to '-D 7' option: 2007.12.20 10:00:45 LOG7[14820:3082589872]: Snagged 64 random bytes from /home/tomasz/.rnd 2007.12.20 10:00:45 LOG7[14820:3082589872]: Wrote 1024 new random bytes to /home/tomasz/.rnd 2007.12.20 10:00:45 LOG7[14820:3082589872]: RAND_status claims sufficient entropy for the PRNG 2007.12.20 10:00:45 LOG7[14820:3082589872]: PRNG seeded successfully 2007.12.20 10:00:45 LOG7[14820:3082589872]: Certificate: jai_ssl.pem 2007.12.20 10:00:45 LOG7[14820:3082589872]: Certificate loaded 2007.12.20 10:00:45 LOG7[14820:3082589872]: Key file: jai_ssl.pem 2007.12.20 10:00:45 LOG7[14820:3082589872]: Private key loaded 2007.12.20 10:00:45 LOG7[14820:3082589872]: SSL context initialized for service stunnel3 (4)"/usr/bin/stunnel" is a Perl script whose comments say " ... wrapper to use stunnel 3.x syntax in stunnel >=4.05 ..."; it is version 2.00 (2005.04.2).

1 1

Stunnel never really connects
by Pat Riehecky 20 Dec '07

20 Dec '07

I am trying to send email over stunnel from a client that doesn't support encryption to a server that does. The local socket opens just fine, but it never really seems to connect to the remote server. A tcpdump shows only three packets exchanged between the two systems (Syn, Syn/Ack, Ack). The behavior is the same regardless of which tls enabled port I point stunnel at. I am able to connect to these ports via telnet and send email so I know the connection can be negotiated. I am using the 4.21 build for windows (XP SP2) found on the main webpage. Help! --- stunnel.conf --- ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ; my email client isn't eudora, but given how ; it doesn't support standards like encrypted ; transport..... options = DONT_INSERT_EMPTY_FRAGMENTS ; Some debugging stuff useful for troubleshooting debug = 7 ; Use it for client mode client = yes [smtp] accept = 127.0.0.1:25 connect = mailserver.mydomain.tld:587 ;connect = mailserver.mydomain.tld:465 ;connect = mailserver.mydomain.tld:25 protocol = smtp

2 1

'PIN' engine control command
by Ludolf Holzheid 14 Dec '07

14 Dec '07

Dear list, I'm trying to use stunnel on Windows with an USB token (`CryptoMate' from ACS). However, I can't manage to make stunnel ask for the token PIN: o Loading the private key works if I specify the PIN in the configuration file (`engineCtrl = PIN:...'). o If there is no `PIN' engine control option in the configuration file, loading the private key fails. The log message are: error stack: 26096080 : error:26096080:engine routines:ENGINE_load_private_key:failed loading private key error stack: 800050A0 : error:800050A0:Vendor defined:PKCS11_login:PIN incorrect Do I have to add a special engine control option to the configuration file in order to get asked for the PIN or is it intended to `just work'? Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

2 2

rtmps with stunnel on linux
by David Schulberg 14 Dec '07

14 Dec '07

Hi, Cannot get rtmps working with Firefox (IceWeasel) on Linux. I have rtmps working fine with Firefox and IE on Windows XP. The error I see in stunnel (see below) when I try rtmps through a Linux browser is "peer suddenly disconnected". Also curious that there are 2 attempts made. 2007.12.13 16:31:41 LOG7[2624:1192]: https accepted FD=212 from 124.190.241.7:59728 2007.12.13 16:31:41 LOG7[2624:1192]: Creating a new thread 2007.12.13 16:31:41 LOG7[2624:1192]: New thread created 2007.12.13 16:31:41 LOG7[2624:2576]: https started 2007.12.13 16:31:41 LOG7[2624:2576]: FD 212 in non-blocking mode 2007.12.13 16:31:41 LOG7[2624:2576]: TCP_NODELAY option set on local socket 2007.12.13 16:31:41 LOG5[2624:2576]: https accepted connection from 124.190.241.7:59728 2007.12.13 16:31:41 LOG7[2624:2576]: SSL state (accept): before/accept initialization 2007.12.13 16:31:41 LOG3[2624:2576]: SSL_accept: Peer suddenly disconnected 2007.12.13 16:31:41 LOG5[2624:2576]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.12.13 16:31:41 LOG7[2624:2576]: https finished (0 left) 2007.12.13 16:31:41 LOG7[2624:1192]: https accepted FD=236 from 124.190.241.7:59729 2007.12.13 16:31:41 LOG7[2624:1192]: Creating a new thread 2007.12.13 16:31:41 LOG7[2624:1192]: New thread created 2007.12.13 16:31:41 LOG7[2624:2572]: https started 2007.12.13 16:31:41 LOG7[2624:2572]: FD 236 in non-blocking mode 2007.12.13 16:31:41 LOG7[2624:2572]: TCP_NODELAY option set on local socket 2007.12.13 16:31:41 LOG5[2624:2572]: https accepted connection from 124.190.241.7:59729 2007.12.13 16:31:41 LOG7[2624:2572]: SSL state (accept): before/accept initialization 2007.12.13 16:31:41 LOG3[2624:2572]: SSL_accept: Peer suddenly disconnected 2007.12.13 16:31:41 LOG5[2624:2572]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.12.13 16:31:41 LOG7[2624:2572]: https finished (0 left) Regards, David Schulberg

1 0

Re: [stunnel-users] * lencoboy Stunnel client and Centos 5 Apache
by Luis Rodrigo Gallardo Cruz 12 Dec '07

12 Dec '07

[Again, please send your responses to the list.] On Wed, Dec 12, 2007 at 06:18:58PM +0000, Mario Neè wrote: > > On Wed, Dec 12, 2007 at 05:00:08PM +0000, Mario Neè wrote: > > > > From: rodrigo(a)nul-unu.com > > > > This takes what is sent to local port 1443, encrypts it, and sends it > > > > like that to the remote 192.168.x.x:443 This means that the remote > > > > Apache needs to be listening on port 443 with ssl enabled there. Is > > > > this what you wanted? > > > > > > yes it's what i want. > > > > > > > Ok. Then I'd guess the problem is that apache is not expecting SSL on > > port 443. Read up on how to enable it. I'd guess a good start is > > http://httpd.apache.org/docs/2.0/mod/mod_ssl.html > > > if i try to connect to 192.168.x.x:443 with firefox everything > works, only with stunnel i get that error Do you try to connect with http://192.168.x.x:443 or with https://192.168.x.x:443 (note the 's')? -- Rodrigo Gallardo GPG-Fingerprint: 7C81 E60C 442E 8FBC D975 2F49 0199 8318 ADC9 BC28

1 0

Re: [stunnel-users] * lencoboy Stunnel client and Centos 5 Apache
by Luis Rodrigo Gallardo Cruz 12 Dec '07

12 Dec '07

[Please, respond to the list, not to the private mail of whoever answers you.] On Wed, Dec 12, 2007 at 05:00:08PM +0000, Mario Neè wrote: > > From: rodrigo(a)nul-unu.com > > On Wed, Dec 12, 2007 at 09:36:35AM +0000, Mario Neè wrote: > > > i'm trying to connect a stunnel client to the welcome page of Apache > > > in Centos 5 (Fresh install with no changes to Apache conf). > > > > > > command to create a client (on Feisty Fawn Ubuntu): > > > sudo stunnel -c -d 1443 -r 192.168.x.x:443 > > > > This takes what is sent to local port 1443, encrypts it, and sends it > > like that to the remote 192.168.x.x:443 This means that the remote > > Apache needs to be listening on port 443 with ssl enabled there. Is > > this what you wanted? > > yes it's what i want. > Ok. Then I'd guess the problem is that apache is not expecting SSL on port 443. Read up on how to enable it. I'd guess a good start is http://httpd.apache.org/docs/2.0/mod/mod_ssl.html -- Rodrigo Gallardo GPG-Fingerprint: 7C81 E60C 442E 8FBC D975 2F49 0199 8318 ADC9 BC28

1 0

newbie config not running
by fuzzy_4711 12 Dec '07

12 Dec '07

Hello list. I am new to stunnel and do have some problems to get it running. The server is a WinXPSP2 behind a router. The router has port forwarding enabled for port 9999 to the stunnel server (4.21). On the same box a vnc server is running on port 5900 which I like to tunnel. Firewall is opened. The netstat -a -n shows the server listening on the desired port (9999). My server config looks like that: cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 ;output = stunnel.log ; Use it for client mode ;client = yes [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 25 [VNC Server] accept = 9999 connect = 5900 The client side is a linux box with config setting: client = yes [VNC Server] accept = 5900 connect = 9999 I turned on debugging and stunnel.log seems to be okay - no error messages. But I am not able to get an connection. What am I doing wrong? Stefan

5 8

* lencoboy Stunnel client and Centos 5 Apache
by Mario Neè 12 Dec '07

12 Dec '07

Hello, i'm trying to connect a stunnel client to the welcome page of Apache in Centos 5 (Fresh install with no changes to Apache conf). command to create a client (on Feisty Fawn Ubuntu): sudo stunnel -c -d 1443 -r 192.168.x.x:443 if i try to connect to http://localhost:1443 and a look in /var/log/syslog i see this error: SSL_connect: error:1408F06B:SSL routines:SSL3_GET_RECORD:bad decompression. _________________________________________________________________ Ti piace giocare con le lettere? Prova ABCLive! http://messengergiochi.it.msn.com/

2 1

server reads ecrypted data on connect ?
by Nikolaj G. 10 Dec '07

10 Dec '07

Hello stunnel'ers, First of all - im a newbie into openssl and stunnel. Im trying to stunnel between my own java socket server and client. The stunnel is established, but the server reads encrypted data on connect. Since I dont send anything, Im surprised to see encrypted data in the server log. Could someone please help. Ive managed to create a root certificate, a request and signing it, using: http://www.eclectica.ca/howto/ssl-cert-howto.php Thanks in advance. /nikolaj PS see configuration below: ----------------------------------------------- Packages (Fedora Core 6): openssl-devel-0.9.8b-15.fc6 openssl-0.9.8b-15.fc6 stunnel-4.15-2 ----------------------------------------------- The SERVER stunnel.conf: ; Certificate/key is needed in server mode CAfile = /root/ssl/cacert.pem cert = /root/ssl/key-cert.pem pid = /root/ssl/stunnel.pid ; Some debugging stuff useful for troubleshooting debug = 7 foreground=yes #setuid = stunnel #setgid = stunnel [mystunnel] accept = ratata.cirque.dk:998 connect = 127.0.0.1:8200 ----------------------------------------------- The CLIENT stunnel.conf: ; Certificate/key is needed in server mode CAfile = /root/ssl/eclectica/cacert.pem pid = /root/ssl/eclectica/stunnel.pid ; Some debugging stuff useful for troubleshooting debug = 7 foreground=yes ; enable client mode client = yes [mystunnel] accept = 127.0.0.1:998 connect = ratata.cirque.dk:8200 ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

1 0

HTTPS hardcoded redirects
by Ezio Ostorero 10 Dec '07

10 Dec '07

All, I have a problem similar to the one described in http://mirt.net/pipermail/stunnel-users/2006-October/001324.html i.e. I ***wish*** to use the recording functionalities of JMeter while accessing an apache-SSL-secured Tomcat web server. JMeter does not allow recording on SSL so I have to ... un-cipher my HTTPS sessions, stunnel looks like the right choice. Being an stunnel newbie, I started here: http://www.stunnel.org/examples/https_client.html , this HOWTO looks quite close to my configuration. We have a plain-vanilla tomcat server behind an apache/SSL, and I want to access this web application from an HTTP-only browser. So, I configure stunnel as a "client", I run it on my PC, with the following configuration: [psuedo-https] accept = 8080 connect = <server>:443 TIMEOUTclose = 0 I read it as follows: stunnel talk cleartext HTTP on the local 8080 port and forwards in crypted HTTPS on the <server> port 443 I set the URL in my browser to http://localhost:8080/oi/ and this happens: 1) Ethereal sez that my PC and <server> start an SSLv3 conversation, good, we're on track 2) I have an HTTP analyzer plugged in my browser that shows me the content of the first GET that is a redirect to an SSO server (on the same <server>:443 port) for user authentication https://<server>/ssoserver/login?service=...... 3) My browser then issue a GET to https://<server>/ssoserver/login?service=...... and is GAME OVER, my beloved stunnel is cleanly bypassed by the hardcoded https://<server>/ string Any suggestion? Is it a dead end? Any dirty trick I could play with? Such as running multiple stunnel instances, setting <server> = localhost in my hosts file etc.? Thanks, Ezio -- Ezio Ostorero, Catania Seltz e limone col sale. Arriminatu, non annacatu

1 0

Re: [stunnel-users] Problem compiling win32 stunnel.exe v 4.21
by butterspoon＠gmail.com 10 Dec '07

10 Dec '07

On 09/12/2007, Luis Rodrigo Gallardo Cruz <rodrigo(a)nul-unu.com> wrote: > On Sun, Dec 09, 2007 at 11:30:01PM +0000, Hidden wrote: > > Okay, so I'm trying to build stunnel.exe (ver 4.21) under Debian Linux > > 2.6.22.1 as a prelude to applying some patches and I'm getting > > stuck. > > Just to make sure I understand: You are trying to build *for* windows > *in* Debian. Yup, just like the documentation (INSTALL.W32) says: 1) install mingw32 cross-compiler o a Unix/Linux machine (native compilation on a Windows machine is possible, but not supported) [...] 5) type "make stunnel.exe" > You seem to be mixing up (the names of) unix libs with windows ones. Well, something is. I'm just doing it by the book! > Anyways, would it not be easier to compile in windows? Anyone else here build stunnel.exe? What did you use? T

1 0

Problem compiling win32 stunnel.exe v 4.21
by Hidden 09 Dec '07

09 Dec '07

Okay, so I'm trying to build stunnel.exe (ver 4.21) under Debian Linux 2.6.22.1 as a prelude to applying some patches and I'm getting stuck. I've followed the instructions in the makefile – Install mingw32; compile and install openssl; unpack and make stunnel.exe. mingw makes a bunch of object files for a while, but then at the link stage it bombs with i586-mingw32msvc/bin/ld: cannot find -lzdll make was when trying to execute the command: i586-mingw32msvc-gcc -s -o stunnel.exe file.obj client.obj log.obj options.obj protocol.obj network.obj resolver.obj ssl.obj ctx.obj verify.obj sthreads.obj stunnel.obj gui.obj resources.obj -L/usr/src/openssl-0.9.8g -lzdll -leay32 -lssl32 -lws2_32 -lgdi32 -mwindows eay32 is nowhere to be found either. It and ssl32 are clearly related to openssl, but I can't see any suitable files in either the openssl build directory (/usr/src/openssl-0.9.8g as advertised). zdll could be something to do with zlib (which I have, ver 1.2.3) and eay32 and ssl32 are obviously related to openssl, but the only libraries under openssl are libssl.a and libcrypto.a (although optimistically trying to bolt in libssl in place of ssl32 doesn't work). ws2_32 and gdi32 are windows sockets and GDI, for what it's worth. I can't find the required libs on the internet anywhere, and maybe it's all down to me being a novice with mingw. I do notice the tantalizingly named files zlib1.dll, libeay32.dll, and libssl32.dll in the precompiled Windows binary distribution of stunnel, but surely I can't use them in any way? I'd love some help from anyone who knows this system better! Thanks, Tony

2 1

SSL session caching with multiple clients through stunnel to an https server
by Paul McGarry 06 Dec '07

06 Dec '07

Hi there, I have an application where apache/php processes make SOAP requests over https to a single remote server (which is IIS I think). I am trying to cut down the time each request takes. In it's current configuration I think some time will be wasted as the php client and IIS server handshake to set up a new SSL connection for each request, thereby adding (at least) twice the network latency between the two servers to each request. (As far as I can tell there is no way to make php SOAP use some kind of persistant connection or SSL cache when talking to the server) I am wondering if I pushed the soap requests as http through stunnel whether stunnel would be more efficient with SSL connections or whether it will just create a new tunnel with a new ssl session for each request it receives? Does anyone have any advice? Paul

1 0

MS Outlook verify = 2 using problem
by FFT` 05 Dec '07

05 Dec '07

Good Day! I'm using Stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 with OpenSSL 0.9.8g 19 Oct 2007 on Fedora-like Linux server. stunnel.conf consists: _______________________________________________________________________________ cert = /usr/local/etc/stunnel/server.crt key = /usr/local/etc/stunnel/server.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) ;sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /usr/local/var/stunnel/ setuid = nobody setgid = nobody ; PID is created inside chroot jail pid = /stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath =/usr/local/etc/stunnel/certs ; It's often easier to use CAfile CAfile = /usr/local/etc/stunnel/ca.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/etc/stunnel/crl.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Service-level configuration [pop3s] accept = 995 connect = 110 ________________________________________________________________________ PKI consists: ROOT_CA CA MAIL_CON_CA SERVER CLIENT server.crt - Server certificate in PEM Format; server.pem - Server key in PEM Format with nopassword ca.pem - ROOT_CA, CA, MAIL_CON_CA certificates in PEM format. When I am using MS Outlook mail Client , there are some PROBLEM with connections to SERVER:995 stunnel.log consists: ______________________________________________ 2007.12.05 14:57:39 LOG5[16668:1074107776]: stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2007.12.05 14:57:39 LOG5[16668:1074107776]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 2007.12.05 14:57:39 LOG6[16668:1074107776]: file ulimit = 1024 (can be changed with 'ulimit -n') 2007.12.05 14:57:39 LOG6[16668:1074107776]: poll() used - no FD_SETSIZE limit for file descriptors 2007.12.05 14:57:39 LOG5[16668:1074107776]: 500 clients allowed 2007.12.05 14:57:39 LOG7[16668:1074107776]: FD 6 in non-blocking mode 2007.12.05 14:57:39 LOG7[16668:1074107776]: FD 8 in non-blocking mode 2007.12.05 14:57:39 LOG7[16668:1074107776]: FD 9 in non-blocking mode 2007.12.05 14:57:39 LOG7[16668:1074107776]: SO_REUSEADDR option set on accept socket 2007.12.05 14:57:39 LOG7[16668:1074107776]: pop3s bound to 0.0.0.0:995 2007.12.05 14:57:39 LOG7[16669:1074107776]: Created pid file /stunnel.pid 2007.12.05 14:57:48 LOG7[16669:1074107776]: pop3s accepted FD=10 from 192.168.1.205:2129 2007.12.05 14:57:48 LOG7[16669:1074228016]: pop3s started 2007.12.05 14:57:48 LOG7[16669:1074228016]: FD 10 in non-blocking mode 2007.12.05 14:57:48 LOG7[16669:1074228016]: TCP_NODELAY option set on local socket 2007.12.05 14:57:48 LOG5[16669:1074228016]: pop3s accepted connection from 192.168.1.205:2129 2007.12.05 14:57:48 LOG7[16669:1074228016]: SSL state (accept): before/accept initialization 2007.12.05 14:57:48 LOG7[16669:1074228016]: SSL state (accept): SSLv3 read client hello A 2007.12.05 14:57:48 LOG7[16669:1074228016]: SSL state (accept): SSLv3 write server hello A 2007.12.05 14:57:48 LOG7[16669:1074228016]: SSL state (accept): SSLv3 write certificate A 2007.12.05 14:57:48 LOG7[16669:1074228016]: SSL state (accept): SSLv3 write certificate request A 2007.12.05 14:57:48 LOG7[16669:1074228016]: SSL state (accept): SSLv3 flush data 2007.12.05 14:57:48 LOG7[16669:1074228016]: SSL alert (write): fatal: handshake failure 2007.12.05 14:57:48 LOG3[16669:1074228016]: SSL_accept: 140890C7: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate 2007.12.05 14:57:48 LOG5[16669:1074228016]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.12.05 14:57:48 LOG7[16669:1074228016]: pop3s finished (0 left) ______________________________________________ I load all Server, CA , and client certificate in SYSTEM, but there is NO Connection. Please help Me with Stunnel and Outlook using.

1 0

(no subject)
by Harmon, Paul 02 Dec '07

02 Dec '07

Ok Guys, I hate to be a nuisance. But I encountered an error coming out o the Stunnel configuration in LINUX. First what does it mean when Stunnel is in INETD mode? Does this imply certain configuration restrictions and why? Thanks, Paul Harmon

2 1

Help using Stunnel-4.XX
by Harmon, Paul 30 Nov '07

30 Nov '07

Hi Folks, Well I know a little more now than before. The version of Stunnel I'm using is Stunnel 4.05 running under Fedora 7.0. I am trying to setup a test scenario at the moment where I am running a stream socket between a client and a server, both mine since this is a test scenario. I need thisese programs to connect over a secure socket and the exchange of data is a custom application. I've read through Barry O'donovan's article and that seems to give me the information on how to configure and use Stunnel on the server side. It is not clear to me yet, what I need to do to the client side. Is there anyone out there who has done this type of thing and could give me some help? Thanks in advance, Paul Harmon

2 1

Problem with stunnel 4.20 on Fedora 7
by Andrew M Dunn 30 Nov '07

30 Nov '07

[Oh wise list folks... I haven't seen any responses to this. Does anybody have any experience either with using stunnel on Fedora 7, or with the particular error? I cannot find any other hints or reasons as to why the resolution is failing... Andy] ----original message------ I can't get stunnel to run on a freshly-installed Fedora 7 system. It fails with "Error resolving '0.0.0.0': servname is not supported for ai_socktype" but the usual other causes of that error (ie. ports not defined in /etc/services, bad settings in /etc/nsswitch.conf) are not the culprit this time. COMMAND LINE: /usr/sbin/stunnel /home/amdunn/security/stunnel.conf COMMAND OUTPUT: 2007.08.29 11:44:12 LOG3[13614:3086243520]: Error resolving '0.0.0.0': servname is not supported for ai_socktype (EAI_SERVICE) file /home/amdunn/security/stunnel.conf line 10: Failed to resolve accepting address STUNNEL.CONF FILE: ; ; stunnel file for testing 443 access to local http server ; cert=/home/amdunn/security/xxxxxxx key=/home/amdunn/security/yyyyyyy foreground=yes ; ; [sweb] accept=443 ; https port connect=80 ; standard httpd listening port TIMEOUTclose=0 ; must set this or IE waits 60sec on page end client=no STUNNEL -VERSION OUTPUT: stunnel 4.20 on i686-redhat-linux-gnu with OpenSSL 0.9.8b 04 May 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none

2 1

zlib compression not working
by webmaster＠escoltesiguies.cat 29 Nov '07

29 Nov '07

I have configured both windows client and linux server (samba) with zlib compression: compression = zlib But I have transferred a txt file of 100Mb in 40 minutes and the same file compressed with gzip (22Mb) in 14 minutes. So I thing compression is not working. Client log tells: Compression enabled using zlib method and server log: Compression enabled using zlib method How can I verify comression is working? maybe compression is working but it is poor?

1 0

About stunnel 4.21 daemon mode
by wei hu 28 Nov '07

28 Nov '07

Dear I had successfully installed stunnel 4.21 on my server, but after I edited the file stunnel.conf and startup the stunnel, I can't find the stunnel via the "ps -ef" command.Then I have found such error message in the log file: 2007.11.27 07:42:28 LOG5[28550:3085354688]: stunnel 4.21 on i686-pc-linux-gnu wi th OpenSSL 0.9.7f 22 Mar 2005 2007.11.27 07:42:28 LOG5[28550:3085354688]: Threading:PTHREAD SSL:ENGINE Sockets :POLL,IPv6 Auth:LIBWRAP 2007.11.27 07:42:28 LOG6[28550:3085354688]: file ulimit = 1024 (can be changed w ith 'ulimit -n') 2007.11.27 07:42:28 LOG6[28550:3085354688]: poll() used - no FD_SETSIZE limit fo r file descriptors 2007.11.27 07:42:28 LOG5[28550:3085354688]: 500 clients allowed 2007.11.27 07:42:28 LOG7[28550:3085354688]: FD 9 in non-blocking mode 2007.11.27 07:42:28 LOG7[28550:3085354688]: FD 10 in non-blocking mode 2007.11.27 07:42:28 LOG7[28550:3085354688]: FD 11 in non-blocking mode 2007.11.27 07:42:28 LOG7[28550:3085354688]: SO_REUSEADDR option set on accept so cket 2007.11.27 07:42:28 LOG7[28550:3085354688]: sproxy bound to 0.0.0.0:83 2007.11.27 07:42:28 LOG3[28556:3085354688]: Failed to get GID for group nobody Do somebody knows how to get GID for group nobody? My nobody group is sured to work correctly with Squid. The config file about group: ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /usr/local/var/lib/stunnel/ setuid = nobody setgid = nobody ; PID is created inside chroot jail pid = /stunnel.pid The command "stunnel -version" response: [root@vps stunnel]# /usr/local/bin/stunnel -version stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.7f 22 Mar 2005 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none The command "/usr/local/bin/stunnel" response: [root@vps stunnel]# /usr/local/bin/stunnel 2007.11.27 07:27:27 LOG7[13697:3085354688]: Snagged 64 random bytes from /root/.rnd 2007.11.27 07:27:27 LOG7[13697:3085354688]: Wrote 1024 new random bytes to /root/.rnd 2007.11.27 07:27:27 LOG7[13697:3085354688]: RAND_status claims sufficient entropy for the PRNG 2007.11.27 07:27:27 LOG7[13697:3085354688]: PRNG seeded successfully 2007.11.27 07:27:27 LOG7[13697:3085354688]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2007.11.27 07:27:27 LOG7[13697:3085354688]: Certificate loaded 2007.11.27 07:27:27 LOG7[13697:3085354688]: Key file: /usr/local/etc/stunnel/stunnel.pem 2007.11.27 07:27:27 LOG7[13697:3085354688]: Private key loaded 2007.11.27 07:27:27 LOG7[13697:3085354688]: SSL context initialized for service sproxy Best Regards, HuWei

2 2

Re: [stunnel-users] More questions on RDP and port forwarding
by richard.woodman＠cox.net 28 Nov '07

28 Nov '07

Carter, Thanks. With the exception of the client's loopback address in the hosts file, I have a very similar configuration. I have created an inbound rule (Custom service with an inbound rule declaration but no outbound rule) that looks just like my inbound RDP rules - I even reviewed the configuration file and the stunnel rule had the same commands as the RDP rule. However, RDP works through the firewall but stunnel does not. My Windows firewall has an exception for stunnel with a scope of "Internet" and the stunnel server works from within the corporate network. Meaning, I think, that the Windows firewall is not denying the connection (at least from within the same subnet). I am not a Windows AD guy, but is there a way to prevent network connections without using the Windows firewall? I mean, can a GPO be created that prevents connections from IP addresses not on the same subnet but that does not use the OS's firewall? If so, this could be the issue because from what I can see, neither the Watchguard nor the Windows firewalls are blocking the connection; yet I still cannot connect. Richard Carter Browne wrote: I use stunnel to protect RDP for a couple of sites using a mix of Watchguard Edge and V series firewalls. For computer ABC that I want to connect to, I create an entry in the hosts file: 127.0.0.n ABCs (where n is greater than 1) On the client side I have an entry: [ABC-RDP] accept = ADCs:12345 connect = ABC:54321 client = yes On the server sid I have an entry: [RDP-IN] accept = 54321 connect = 3389 client = no Port 54321 is enabled in both the Watchguard and the Windows firewalls. Using the 127.n.n.n ports are not processed by the firewalls. You can use 127.0.0.1 for everything, but I needed to connect to more that one host and wanted a standard setup. I have had a number of users confused by this setup whereby the program references a local port to connect to a remote computer. For stunnel, it is the connect string that determines the destination, so any local port works fine for the accept string. Carter

2 1

Problems accessing samba
by webmaster＠escoltesiguies.cat 27 Nov '07

27 Nov '07

I have a winXP machine which should connect to a linux samba. Everything installed following http://wiki.netbsd.se/index.php/How_to_secure_samba_with_stunnel but it don't connect. I have both loglevels set to 7, and as serverlog don't change I thing the error is at clientside. stunnel.conf is: client=yes debug = 7 [smb] accept=222.222.222.222:139 connect=85.48.253.144:8888 And the client log is: 2007.11.27 12:46:58 LOG7[3716:720]: RAND_status claims sufficient entropy for the PRNG 2007.11.27 12:46:58 LOG7[3716:720]: PRNG seeded successfully 2007.11.27 12:46:58 LOG7[3716:720]: Certificate: stunnel.pem 2007.11.27 12:46:58 LOG7[3716:720]: Certificate loaded 2007.11.27 12:46:58 LOG7[3716:720]: Key file: stunnel.pem 2007.11.27 12:46:58 LOG7[3716:720]: Private key loaded 2007.11.27 12:46:58 LOG7[3716:720]: SSL context initialized for service smb 2007.11.27 12:46:58 LOG5[3716:720]: stunnel 4.21 on x86-pc-mingw32-gnu with OpenSSL 0.9.8g 19 Oct 2007 2007.11.27 12:46:58 LOG5[3716:720]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2007.11.27 12:46:58 LOG5[3716:3292]: No limit detected for the number of clients 2007.11.27 12:46:59 LOG7[3716:3292]: FD 216 in non-blocking mode 2007.11.27 12:46:59 LOG7[3716:3292]: SO_REUSEADDR option set on accept socket 2007.11.27 12:46:59 LOG7[3716:3292]: smb bound to 222.222.222.222:139 2007.11.27 12:47:15 LOG7[3716:3292]: smb accepted FD=248 from 88.31.107.217:1625 2007.11.27 12:47:15 LOG7[3716:3292]: Creating a new thread 2007.11.27 12:47:15 LOG7[3716:3292]: New thread created 2007.11.27 12:47:15 LOG7[3716:4028]: smb started 2007.11.27 12:47:15 LOG7[3716:4028]: FD 248 in non-blocking mode 2007.11.27 12:47:15 LOG7[3716:4028]: TCP_NODELAY option set on local socket 2007.11.27 12:47:15 LOG5[3716:4028]: smb accepted connection from 88.31.107.217:1625 2007.11.27 12:47:15 LOG7[3716:4028]: FD 272 in non-blocking mode 2007.11.27 12:47:15 LOG7[3716:4028]: smb connecting 85.48.253.144:8888 2007.11.27 12:47:15 LOG7[3716:4028]: connect_wait: waiting 10 seconds 2007.11.27 12:47:25 LOG7[3716:3292]: smb accepted FD=308 from 88.31.107.217:1628 2007.11.27 12:47:25 LOG7[3716:3292]: Creating a new thread 2007.11.27 12:47:25 LOG7[3716:3292]: New thread created 2007.11.27 12:47:25 LOG7[3716:3012]: smb started 2007.11.27 12:47:25 LOG7[3716:3012]: FD 308 in non-blocking mode 2007.11.27 12:47:25 LOG7[3716:3012]: TCP_NODELAY option set on local socket 2007.11.27 12:47:25 LOG5[3716:3012]: smb accepted connection from 88.31.107.217:1628 2007.11.27 12:47:25 LOG7[3716:3012]: FD 340 in non-blocking mode 2007.11.27 12:47:25 LOG7[3716:3012]: smb connecting 85.48.253.144:8888 2007.11.27 12:47:25 LOG7[3716:3012]: connect_wait: waiting 10 seconds 2007.11.27 12:47:25 LOG6[3716:4028]: connect_wait: s_poll_wait timeout 2007.11.27 12:47:25 LOG5[3716:4028]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.11.27 12:47:25 LOG7[3716:4028]: smb finished (1 left) 2007.11.27 12:47:35 LOG6[3716:3012]: connect_wait: s_poll_wait timeout 2007.11.27 12:47:35 LOG5[3716:3012]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.11.27 12:47:35 LOG7[3716:3012]: smb finished (0 left) Where is the problem? Thanks

1 1

VeriSign Intermediate CA Certificate issue.
by Unai Rodriguez 27 Nov '07

27 Nov '07

Dear All, I am trying to set an https layer using stunnel. I am having problems with the intermediary certificate since it appears broken to the user. You may find a screenshot here: http://u-journal.org/stunnel/Root_Cert_Err.jpg My stunnel version is: 3.26 running on Debian 3.1 I run stunnel as standalone with this parameters: stunnel -d 10.123.16.103:443 -D 7 -R /etc/ssl/certs/stunnel.rnd \ -p /etc/ssl/certs/stunnel.pem -o /var/log/stunnel/stunnel.log \ -r 10.123.16.103:80 -N https You may find the output of my stunnel -V here: http://pastebin.ca/793495 uname -a: Linux lb2-dp-vm 2.6.8-3-686 #1 Tue Dec 5 21:26:38 UTC 2006 i686 GNU/Linux openssl version: OpenSSL 0.9.7e 25 Oct 2004 So, if I create my /etc/ssl/certs/stunnel.pem file like this: -----BEGIN RSA PRIVATE KEY----- rsa_priv_key -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- secured.behringer.com_certificate -----END CERTIFICATE----- -- OR -- -----BEGIN RSA PRIVATE KEY----- rsa_priv_key -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- secured.behringer.com_certificate -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- VeriSign Intermediate CA Certificate (https://www.verisign.com.sg/support/ssl/install/intermediate/secure.shtml) -----END CERTIFICATE----- I get the mentioned error. If I create the /etc/ssl/certs/stunnel.pem like this: -----BEGIN RSA PRIVATE KEY----- rsa_priv_key -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- VeriSign Intermediate CA Certificate (https://www.verisign.com.sg/support/ssl/install/intermediate/secure.shtml) -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- secured.behringer.com_certificate -----END CERTIFICATE----- I get the error: "[...] X509_check_private_key:key values mismatch" You may see the log here: http://pastebin.ca/793500 Any clues on what am I doing wrong? Thank you so much! unai

1 1

Re: [stunnel-users] More questions on RDP and port forwarding
by richard.woodman＠cox.net 26 Nov '07

26 Nov '07

OK, I took my configs, my certs, etc. and put them on two boxes in the lab - then I ensured I could use stunnel to connect using VNC. I then put a NAT box (Linksys BEFSR81) between the two and configured the Linksys to provide port forwarding. I then reconnected and everything worked first time. Therefore, I can only assume that either port-forwarding is misconfigured on my Watchguard SOHO 6tc -or- that the Windows firewall is causing problems (neither lab box has a firewall running). I'll keep you posted on what I find. Thanks. Richard My original post: I did read through the archives but I cannot determine how to get Stunnel working through the firewall. Here is what I wish to do: 1. Tunnel Windows Remote Desktop through stunnel. 2. I wish to connect from home to work; I have access to the firewall at work. Here's what I've done: 1. Installed stunnel on Windows XP at home and at work. I have self-signed certificates and am using verify = 3 (on both computers). Cacert.pem has the CA cert, the work cert, and the home cert in a single file. The server-cert.pem has the work computer's key and cert while the client-1-cert.pem (home computer) has it's own key and cert. 2. Stunnel at home has client = yes, stunnel at work has this commented out. Stunnel at work will become a "server" where multiple clients connect via stunnel and that single computer makes multiple RDP connections. Client (home) computer has [rdp1] accept = 4391 connect = <work outside interface IP>:44391 Server (work) computer has [rdp2] accept = 44391 connect = <work computer name>:3392 If I try this at work from within the corporate network (change the client connect string to the stunnel server's IP or hostname), then everything works fine. However, once I try from outside the work network, nothing works. Firewall is a Watchguard SOHO 6tc and I have a inbound rule permitting 44391 and directing it to X.X.X.52 (the stunnel server). I also have other rules allowing RDP (on port 3392 for instance) directly to the computer I wish to control and those rules work. Essentially, RDP directly through the firewall works but stunnel through the firewall does not. I assume there is no traffic destined for .52 on 44391 because the log file on the server (with debug = 7) only shows the startup sequence and port binding (netstat -a shows I am listening on 44391). I also tried this at home on my Juniper 5XT and was unsuccessful. Please help. Richard

1 0

Re: [stunnel-users] More questions on RDP and port forwarding
by richard.woodman＠cox.net 26 Nov '07

26 Nov '07

Craig, Thanks. Are you advising that I put "client = yes" in the service declaration rather than the main configuration? I already have "client = yes" on the client side (in the main configuration) and that line commented out of the server's configuration (I assume the default is client = no). When I review the log on the client computer, I can see where it times out waiting on a response from the work firewall's outside IP address. I do not see any connection attempts on the server side and both stunnel instances (client and server) have debug = 7 and logging to stunnel.log. Richard > -----Original Message----- > From: stunnel-users-bounces(a)mirt.net [mailto:stunnel-users- > bounces(a)mirt.net] On Behalf Of Richard Woodman > Sent: 26 November 2007 07:44 AM > To: stunnel-users(a)mirt.net > Subject: [stunnel-users] More questions on RDP and port forwarding > > I did read through the archives but I cannot determine how to get > Stunnel > working through the firewall. Here is what I wish to do: > > 1. Tunnel Windows Remote Desktop through stunnel. > 2. I wish to connect from home to work; I have access to the firewall > at > work. > > Here's what I've done: > > 1. Installed stunnel on Windows XP at home and at work. I have self- > signed > certificates and am using verify = 3 (on both computers). Cacert.pem > has > the CA cert, the work cert, and the home cert in a single file. The > server-cert.pem has the work computer's key and cert while the > client-1-cert.pem (home computer) has it's own key and cert. > 2. Stunnel at home has client = yes, stunnel at work has this > commented > out. Stunnel at work will become a "server" where multiple clients > connect > via stunnel and that single computer makes multiple RDP connections. > > Client (home) computer has > Try changing the client config to the following: [rdp1] client = yes accept = 4391 connect = <work outside interface IP>:44391 > > Server (work) computer has > > [rdp2] > accept = 44391 > connect = <work computer name>:3392 > > If I try this at work from within the corporate network (change the > client > connect string to the stunnel server's IP or hostname), then everything > works fine. However, once I try from outside the work network, nothing > works. Firewall is a Watchguard SOHO 6tc and I have a inbound rule > permitting 44391 and directing it to X.X.X.52 (the stunnel server). I > also > have other rules allowing RDP (on port 3392 for instance) directly to > the > computer I wish to control and those rules work. Essentially, RDP > directly > through the firewall works but stunnel through the firewall does not. > I > assume there is no traffic destined for .52 on 44391 because the log > file on > the server (with debug = 7) only shows the startup sequence and port > binding > (netstat -a shows I am listening on 44391). I also tried this at home > on my > Juniper 5XT and was unsuccessful. Please help. > > Richard > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users Cheers, Craig

1 0

More questions on RDP and port forwarding
by Richard Woodman 26 Nov '07

26 Nov '07

I did read through the archives but I cannot determine how to get Stunnel working through the firewall. Here is what I wish to do: 1. Tunnel Windows Remote Desktop through stunnel. 2. I wish to connect from home to work; I have access to the firewall at work. Here's what I've done: 1. Installed stunnel on Windows XP at home and at work. I have self-signed certificates and am using verify = 3 (on both computers). Cacert.pem has the CA cert, the work cert, and the home cert in a single file. The server-cert.pem has the work computer's key and cert while the client-1-cert.pem (home computer) has it's own key and cert. 2. Stunnel at home has client = yes, stunnel at work has this commented out. Stunnel at work will become a "server" where multiple clients connect via stunnel and that single computer makes multiple RDP connections. Client (home) computer has [rdp1] accept = 4391 connect = <work outside interface IP>:44391 Server (work) computer has [rdp2] accept = 44391 connect = <work computer name>:3392 If I try this at work from within the corporate network (change the client connect string to the stunnel server's IP or hostname), then everything works fine. However, once I try from outside the work network, nothing works. Firewall is a Watchguard SOHO 6tc and I have a inbound rule permitting 44391 and directing it to X.X.X.52 (the stunnel server). I also have other rules allowing RDP (on port 3392 for instance) directly to the computer I wish to control and those rules work. Essentially, RDP directly through the firewall works but stunnel through the firewall does not. I assume there is no traffic destined for .52 on 44391 because the log file on the server (with debug = 7) only shows the startup sequence and port binding (netstat -a shows I am listening on 44391). I also tried this at home on my Juniper 5XT and was unsuccessful. Please help. Richard

3 2

I'm very much a newbie to stunnel
by Harmon, Paul 26 Nov '07

26 Nov '07

Hi Guys, I'm very new to Stunnel. In fact I have no experience with it what so ever. My situation is this: I have server program and a client at the moment which know nothing about SSL. Yet the powers that be insist that my two machines, if they must use sockets, do so using SSL. After reading through the distribution, I found this very interesting program called Stunnel which sounds like it might solve my problem quite well. From what I've read so far, I gather this program can be used as an SSL wrapper for my server and my client. Would some kind soul please help me with the configuration process (the configuration file) so that my client and server can be safe and secure? My server uses a port which I have chosen (really quite arbitrarily). Basically I need the server to listen on that port and wait for incoming data which it will processs and in most cases not even reply. With normal sockets this is a no-brainer since Steven's book outlines it very well. If I understand the documentation I've read so far, Stunnel adds the encryption layer on top of that which I need. So how do I configure and invokestunnel in this environment? Sorry for stupid questions at the moment I just lack examples like this and confidence in using the program. Thanks, Paul

2 1

Certificate management
by Koenraad Lelong 23 Nov '07

23 Nov '07

Hi, Since a few months I'm playing with stunnel. Last month I installed a stunnel at a customer. This week he reported he could not connect any more. After testing here I discovered the CA cert had expired. I made this myself and I didn't see that it's only valid for one month. I made new certificates making sure they are valid for longer than one month, so this is solved for now. My question : are there good documents about management of certificates ? I'm specially interested in renewing the certificates. Regards, Koenraad Lelong.

2 1

some newbie questions
by Lluís Forns 23 Nov '07

23 Nov '07

Let me first explain what I want to do in order to see if stunnel is what I need: I have some laptops around the world and I want to let them login in my intranet. The login is versus a Samba server. So more or less the connection would be: Laptop (running winXP) --- router --- internet --- router --- linux ssh server(port 22 open) --- linux samba server Could stunnel help me achivieng this? any hint of how? I have read the documentation, but I am a little lost. thanks -- <http://www.escoltesiguies.cat>*Lluís Forns - Tècnic Informàtic * *Servei d'Informàtica* *Minyons Escoltes i Guies de Catalunya (MEG)* *Telèfon:* 93 590 27 00 *Fax:* 93 590 04 92 *www.escoltesiguies.cat* No m'imprimeixis si no és necessari. Protegim el medi ambient.

2 1

Re: [stunnel-users] Stunnel and Outlook Web Access Problems
by Craig Retief 20 Nov '07

20 Nov '07

I see that you have client = yes in the config file. When client = yes is set outside the service block, it becomes a global setting that tells all the services that it should tunnel that they are clients and not servers. If you specify the client = yes within a service eg. [pop3s] client = yes accept = 995 connect = 110 then stunnel knows that the specified service alone is a client. What I recommend is that you disable the client = yes in the global area and change you config file to something like this: I have removed the comments to shorten the config for explanation: socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 CRLpath = crls CRLfile = certnew.pem debug = 7 output = stunnel.log ;client = yes [https] accept = 443 connect = 192.168.0.5:443 TIMEOUTclose = 0 Try using this as your config and see if it works or not. Cheers Craig From: Dan Vespa [mailto:[email protected]] Sent: 19 November 2007 05:07 PM To: Craig Retief Subject: RE: [stunnel-users] Stunnel and Outlook Web Access Problems Craig, Here it is.... ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment ;cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = crls ; It's often easier to use CAfile ;CAfile = certnew.pem ; Don't forget to c_rehash CRLpath CRLpath = crls ; Alternatively you can use CRLfile CRLfile = certnew.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 [https] accept = 443 connect = 192.168.0.5:443 TIMEOUTclose = 0 ; vim:ft=dosini _____ From: Craig Retief Sent: Mon 19/11/2007 9:54 AM To: 'Dan Vespa' Cc: stunnel-users(a)mirt.net Subject: RE: [stunnel-users] Stunnel and Outlook Web Access Problems Please Post your stunnel configs. Makes life easier. Cheers Craig From: Dan Vespa [mailto:[email protected]] Sent: 19 November 2007 03:35 PM To: Craig Subject: RE: [stunnel-users] Stunnel and Outlook Web Access Problems Craig, I set the debug level higher and this is what my log outputs.... 2007.11.19 08:25:54 LOG7[1596:2656]: RAND_status claims sufficient entropy for the PRNG 2007.11.19 08:25:54 LOG7[1596:2656]: PRNG seeded successfully 2007.11.19 08:25:54 LOG7[1596:2656]: SSL context initialized for service https 2007.11.19 08:25:54 LOG5[1596:2656]: stunnel 4.21 on x86-pc-mingw32-gnu with OpenSSL 0.9.8g 19 Oct 2007 2007.11.19 08:25:54 LOG5[1596:2656]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2007.11.19 08:25:54 LOG5[1596:3012]: No limit detected for the number of clients 2007.11.19 08:25:54 LOG7[1596:3012]: FD 188 in non-blocking mode 2007.11.19 08:25:54 LOG7[1596:3012]: SO_REUSEADDR option set on accept socket 2007.11.19 08:25:54 LOG7[1596:3012]: https bound to 0.0.0.0:443 2007.11.19 08:26:32 LOG7[1596:3012]: https accepted FD=236 from 127.0.0.1:1409 2007.11.19 08:26:32 LOG7[1596:3012]: Creating a new thread 2007.11.19 08:26:32 LOG7[1596:3012]: New thread created 2007.11.19 08:26:32 LOG7[1596:2576]: https started 2007.11.19 08:26:32 LOG7[1596:2576]: FD 236 in non-blocking mode 2007.11.19 08:26:32 LOG7[1596:2576]: TCP_NODELAY option set on local socket 2007.11.19 08:26:32 LOG5[1596:2576]: https accepted connection from 127.0.0.1:1409 2007.11.19 08:26:32 LOG7[1596:2576]: FD 260 in non-blocking mode 2007.11.19 08:26:32 LOG7[1596:2576]: https connecting 192.168.0.5:443 2007.11.19 08:26:32 LOG7[1596:2576]: connect_wait: waiting 10 seconds 2007.11.19 08:26:32 LOG7[1596:2576]: connect_wait: connected 2007.11.19 08:26:32 LOG5[1596:2576]: https connected remote server from 192.168.0.24:1410 2007.11.19 08:26:32 LOG7[1596:2576]: Remote FD=260 initialized 2007.11.19 08:26:32 LOG7[1596:2576]: TCP_NODELAY option set on remote socket 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): before/connect initialization 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 write client hello A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 read server hello A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 read server certificate A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 read server done A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 write client key exchange A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 write change cipher spec A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 write finished A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 flush data 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 read finished A 2007.11.19 08:26:32 LOG7[1596:2576]: 1 items in the session cache 2007.11.19 08:26:32 LOG7[1596:2576]: 1 client connects (SSL_connect()) 2007.11.19 08:26:32 LOG7[1596:2576]: 1 client connects that finished 2007.11.19 08:26:32 LOG7[1596:2576]: 0 client renegotiations requested 2007.11.19 08:26:32 LOG7[1596:2576]: 0 server connects (SSL_accept()) 2007.11.19 08:26:32 LOG7[1596:2576]: 0 server connects that finished 2007.11.19 08:26:32 LOG7[1596:2576]: 0 server renegotiations requested 2007.11.19 08:26:32 LOG7[1596:2576]: 0 session cache hits 2007.11.19 08:26:32 LOG7[1596:2576]: 0 session cache misses 2007.11.19 08:26:32 LOG7[1596:2576]: 0 session cache timeouts 2007.11.19 08:26:32 LOG6[1596:2576]: SSL connected: new session negotiated 2007.11.19 08:26:32 LOG6[1596:2576]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2007.11.19 08:26:53 LOG7[1596:3012]: https accepted FD=288 from 127.0.0.1:1411 2007.11.19 08:26:53 LOG7[1596:3012]: Creating a new thread 2007.11.19 08:26:53 LOG7[1596:3012]: New thread created 2007.11.19 08:26:53 LOG7[1596:1060]: https started 2007.11.19 08:26:53 LOG7[1596:1060]: FD 288 in non-blocking mode 2007.11.19 08:26:53 LOG7[1596:1060]: TCP_NODELAY option set on local socket 2007.11.19 08:26:53 LOG5[1596:1060]: https accepted connection from 127.0.0.1:1411 2007.11.19 08:26:53 LOG7[1596:1060]: FD 312 in non-blocking mode 2007.11.19 08:26:53 LOG7[1596:1060]: https connecting 192.168.0.5:443 2007.11.19 08:26:53 LOG7[1596:1060]: connect_wait: waiting 10 seconds 2007.11.19 08:26:53 LOG7[1596:1060]: connect_wait: connected 2007.11.19 08:26:53 LOG5[1596:1060]: https connected remote server from 192.168.0.24:1412 2007.11.19 08:26:53 LOG7[1596:1060]: Remote FD=312 initialized 2007.11.19 08:26:53 LOG7[1596:1060]: TCP_NODELAY option set on remote socket 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): before/connect initialization 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 write client hello A 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 read server hello A 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 read finished A 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 write change cipher spec A 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 write finished A 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 flush data 2007.11.19 08:26:53 LOG7[1596:1060]: 1 items in the session cache 2007.11.19 08:26:53 LOG7[1596:1060]: 2 client connects (SSL_connect()) 2007.11.19 08:26:53 LOG7[1596:1060]: 2 client connects that finished 2007.11.19 08:26:53 LOG7[1596:1060]: 0 client renegotiations requested 2007.11.19 08:26:53 LOG7[1596:1060]: 0 server connects (SSL_accept()) 2007.11.19 08:26:53 LOG7[1596:1060]: 0 server connects that finished 2007.11.19 08:26:53 LOG7[1596:1060]: 0 server renegotiations requested 2007.11.19 08:26:53 LOG7[1596:1060]: 1 session cache hits 2007.11.19 08:26:53 LOG7[1596:1060]: 0 session cache misses 2007.11.19 08:26:53 LOG7[1596:1060]: 0 session cache timeouts 2007.11.19 08:26:53 LOG6[1596:1060]: SSL connected: previous session reused 2007.11.19 08:26:53 LOG7[1596:1060]: SSL socket closed on SSL_read 2007.11.19 08:26:53 LOG7[1596:1060]: Socket write shutdown 2007.11.19 08:26:53 LOG5[1596:1060]: Connection closed: 70 bytes sent to SSL, 164 bytes sent to socket 2007.11.19 08:26:53 LOG7[1596:1060]: https finished (1 left) 2007.11.19 08:27:53 LOG3[1596:2576]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2007.11.19 08:27:53 LOG5[1596:2576]: Connection reset: 1102 bytes sent to SSL, 1241 bytes sent to socket 2007.11.19 08:27:53 LOG7[1596:2576]: https finished (0 left) Does this make any sense to you???? Dan _____ From: Craig Sent: Mon 19/11/2007 1:34 AM To: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Stunnel and Outlook Web Access Problems OWA rewrites the URL when you log in and I have found that it causes problems when doing that with a Stunnel connection. What I think might be happening is that your initial connection says http://server.tld/ then when you log in OWA rewrites the URL to https://server.tld/ What I think is happening is that your stunnel is listening on port 80 and when you log in, OWA changes the listening port in the browser to port 443. Try running the listening server (stunnel server) to listen on port 443 instead of port 80 and see if that fixes the problem. Cheers Craig From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Dan Vespa Sent: 17 November 2007 07:21 PM To: stunnel-users(a)mirt.net Subject: [stunnel-users] Stunnel and Outlook Web Access Problems I am trying to use the latest version of stunnel to connect to OWA. I set stunnel to listen on port 80 (localhost) and then connect to myserverip on port 443. I get the login screen but can go no further after I Enter my credentials and Click OK. Checking the stunnel log screen it shows that a connect has been made? I don't understand why It won't connect any further?? OWA is on Exchange Server 2003 and I am using Windows XP SP2. I have also updated to Open SSL latest version. Thanks in Advance. Dan

1 0

Re: [stunnel-users] Stunnel and Outlook Web Access Problems
by Craig Retief 19 Nov '07

19 Nov '07

Please Post your stunnel configs. Makes life easier. Cheers Craig From: Dan Vespa [mailto:[email protected]] Sent: 19 November 2007 03:35 PM To: Craig Subject: RE: [stunnel-users] Stunnel and Outlook Web Access Problems Craig, I set the debug level higher and this is what my log outputs.... 2007.11.19 08:25:54 LOG7[1596:2656]: RAND_status claims sufficient entropy for the PRNG 2007.11.19 08:25:54 LOG7[1596:2656]: PRNG seeded successfully 2007.11.19 08:25:54 LOG7[1596:2656]: SSL context initialized for service https 2007.11.19 08:25:54 LOG5[1596:2656]: stunnel 4.21 on x86-pc-mingw32-gnu with OpenSSL 0.9.8g 19 Oct 2007 2007.11.19 08:25:54 LOG5[1596:2656]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2007.11.19 08:25:54 LOG5[1596:3012]: No limit detected for the number of clients 2007.11.19 08:25:54 LOG7[1596:3012]: FD 188 in non-blocking mode 2007.11.19 08:25:54 LOG7[1596:3012]: SO_REUSEADDR option set on accept socket 2007.11.19 08:25:54 LOG7[1596:3012]: https bound to 0.0.0.0:443 2007.11.19 08:26:32 LOG7[1596:3012]: https accepted FD=236 from 127.0.0.1:1409 2007.11.19 08:26:32 LOG7[1596:3012]: Creating a new thread 2007.11.19 08:26:32 LOG7[1596:3012]: New thread created 2007.11.19 08:26:32 LOG7[1596:2576]: https started 2007.11.19 08:26:32 LOG7[1596:2576]: FD 236 in non-blocking mode 2007.11.19 08:26:32 LOG7[1596:2576]: TCP_NODELAY option set on local socket 2007.11.19 08:26:32 LOG5[1596:2576]: https accepted connection from 127.0.0.1:1409 2007.11.19 08:26:32 LOG7[1596:2576]: FD 260 in non-blocking mode 2007.11.19 08:26:32 LOG7[1596:2576]: https connecting 192.168.0.5:443 2007.11.19 08:26:32 LOG7[1596:2576]: connect_wait: waiting 10 seconds 2007.11.19 08:26:32 LOG7[1596:2576]: connect_wait: connected 2007.11.19 08:26:32 LOG5[1596:2576]: https connected remote server from 192.168.0.24:1410 2007.11.19 08:26:32 LOG7[1596:2576]: Remote FD=260 initialized 2007.11.19 08:26:32 LOG7[1596:2576]: TCP_NODELAY option set on remote socket 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): before/connect initialization 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 write client hello A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 read server hello A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 read server certificate A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 read server done A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 write client key exchange A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 write change cipher spec A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 write finished A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 flush data 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 read finished A 2007.11.19 08:26:32 LOG7[1596:2576]: 1 items in the session cache 2007.11.19 08:26:32 LOG7[1596:2576]: 1 client connects (SSL_connect()) 2007.11.19 08:26:32 LOG7[1596:2576]: 1 client connects that finished 2007.11.19 08:26:32 LOG7[1596:2576]: 0 client renegotiations requested 2007.11.19 08:26:32 LOG7[1596:2576]: 0 server connects (SSL_accept()) 2007.11.19 08:26:32 LOG7[1596:2576]: 0 server connects that finished 2007.11.19 08:26:32 LOG7[1596:2576]: 0 server renegotiations requested 2007.11.19 08:26:32 LOG7[1596:2576]: 0 session cache hits 2007.11.19 08:26:32 LOG7[1596:2576]: 0 session cache misses 2007.11.19 08:26:32 LOG7[1596:2576]: 0 session cache timeouts 2007.11.19 08:26:32 LOG6[1596:2576]: SSL connected: new session negotiated 2007.11.19 08:26:32 LOG6[1596:2576]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2007.11.19 08:26:53 LOG7[1596:3012]: https accepted FD=288 from 127.0.0.1:1411 2007.11.19 08:26:53 LOG7[1596:3012]: Creating a new thread 2007.11.19 08:26:53 LOG7[1596:3012]: New thread created 2007.11.19 08:26:53 LOG7[1596:1060]: https started 2007.11.19 08:26:53 LOG7[1596:1060]: FD 288 in non-blocking mode 2007.11.19 08:26:53 LOG7[1596:1060]: TCP_NODELAY option set on local socket 2007.11.19 08:26:53 LOG5[1596:1060]: https accepted connection from 127.0.0.1:1411 2007.11.19 08:26:53 LOG7[1596:1060]: FD 312 in non-blocking mode 2007.11.19 08:26:53 LOG7[1596:1060]: https connecting 192.168.0.5:443 2007.11.19 08:26:53 LOG7[1596:1060]: connect_wait: waiting 10 seconds 2007.11.19 08:26:53 LOG7[1596:1060]: connect_wait: connected 2007.11.19 08:26:53 LOG5[1596:1060]: https connected remote server from 192.168.0.24:1412 2007.11.19 08:26:53 LOG7[1596:1060]: Remote FD=312 initialized 2007.11.19 08:26:53 LOG7[1596:1060]: TCP_NODELAY option set on remote socket 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): before/connect initialization 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 write client hello A 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 read server hello A 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 read finished A 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 write change cipher spec A 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 write finished A 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 flush data 2007.11.19 08:26:53 LOG7[1596:1060]: 1 items in the session cache 2007.11.19 08:26:53 LOG7[1596:1060]: 2 client connects (SSL_connect()) 2007.11.19 08:26:53 LOG7[1596:1060]: 2 client connects that finished 2007.11.19 08:26:53 LOG7[1596:1060]: 0 client renegotiations requested 2007.11.19 08:26:53 LOG7[1596:1060]: 0 server connects (SSL_accept()) 2007.11.19 08:26:53 LOG7[1596:1060]: 0 server connects that finished 2007.11.19 08:26:53 LOG7[1596:1060]: 0 server renegotiations requested 2007.11.19 08:26:53 LOG7[1596:1060]: 1 session cache hits 2007.11.19 08:26:53 LOG7[1596:1060]: 0 session cache misses 2007.11.19 08:26:53 LOG7[1596:1060]: 0 session cache timeouts 2007.11.19 08:26:53 LOG6[1596:1060]: SSL connected: previous session reused 2007.11.19 08:26:53 LOG7[1596:1060]: SSL socket closed on SSL_read 2007.11.19 08:26:53 LOG7[1596:1060]: Socket write shutdown 2007.11.19 08:26:53 LOG5[1596:1060]: Connection closed: 70 bytes sent to SSL, 164 bytes sent to socket 2007.11.19 08:26:53 LOG7[1596:1060]: https finished (1 left) 2007.11.19 08:27:53 LOG3[1596:2576]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2007.11.19 08:27:53 LOG5[1596:2576]: Connection reset: 1102 bytes sent to SSL, 1241 bytes sent to socket 2007.11.19 08:27:53 LOG7[1596:2576]: https finished (0 left) Does this make any sense to you???? Dan _____ From: Craig Sent: Mon 19/11/2007 1:34 AM To: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Stunnel and Outlook Web Access Problems OWA rewrites the URL when you log in and I have found that it causes problems when doing that with a Stunnel connection. What I think might be happening is that your initial connection says http://server.tld/ then when you log in OWA rewrites the URL to https://server.tld/ What I think is happening is that your stunnel is listening on port 80 and when you log in, OWA changes the listening port in the browser to port 443. Try running the listening server (stunnel server) to listen on port 443 instead of port 80 and see if that fixes the problem. Cheers Craig From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Dan Vespa Sent: 17 November 2007 07:21 PM To: stunnel-users(a)mirt.net Subject: [stunnel-users] Stunnel and Outlook Web Access Problems I am trying to use the latest version of stunnel to connect to OWA. I set stunnel to listen on port 80 (localhost) and then connect to myserverip on port 443. I get the login screen but can go no further after I Enter my credentials and Click OK. Checking the stunnel log screen it shows that a connect has been made? I don't understand why It won't connect any further?? OWA is on Exchange Server 2003 and I am using Windows XP SP2. I have also updated to Open SSL latest version. Thanks in Advance. Dan

1 0

Stunnel and Outlook Web Access Problems
by Dan Vespa 19 Nov '07

19 Nov '07

I am trying to use the latest version of stunnel to connect to OWA. I set stunnel to listen on port 80 (localhost) and then connect to myserverip on port 443. I get the login screen but can go no further after I Enter my credentials and Click OK. Checking the stunnel log screen it shows that a connect has been made? I don't understand why It won't connect any further?? OWA is on Exchange Server 2003 and I am using Windows XP SP2. I have also updated to Open SSL latest version. Thanks in Advance. Dan

2 1

NFS over stunnel
by Andy Wettstein 19 Nov '07

19 Nov '07

Hi, I wrote a document about how I am running NFS over stunnel. Using some firewall rules I was able to eliminate most of the complications for using secure NFS. It could probably use more detailed explanations, but the scripts I am using are all there. It still kind of in test phase, but I am currently mounting my home directory using stunnel. I haven't really noticed much of a speed problem in day to day activities. https://w3.physics.uiuc.edu/physwiki/doku.php?id=pcs:unix:nfs_over_stunnel Please send any questions you might have. -- andy wettstein unix administrator department of physics university of illinois at urbana-champaign

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users