- stunnel-users - stunnel.org

firewall very restricted!!
by Pitoniso Rikito Rikin 17 Apr '07

17 Apr '07

Ok guys look this... my only contact with the world is trought the WEB port 80 how i can establish a ssh connection trought this port, the only method avaible is the GET or POST.... well how i do this... help --------------------------------- LLama Gratis a cualquier PC del Mundo. Llamadas a fijos y móviles desde 1 céntimo por minuto. http://es.voice.yahoo.com

2 1

Using Client Authentication
by Ravi Gowda 16 Apr '07

16 Apr '07

Hi All, I am trying to have a setup where stunnel acts as a client to a server which requires client-Authentication. This is the snapshot of my stunnel.conf # Sample stunnel configuration file # Copyright by Michal Trojnara 2002 setuid = nobody setgid = nobody output = /etc/stunnel/out cert = /etc/stunnel/rtca-client.pem key = /etc/stunnel/rtca-client.ky # Authentication stuff verify = 2 # don't forget about c_rehash CApath # it is located inside chroot jail: #CApath = /certs # or simply use CAfile instead: CAfile = /etc/stunnel/rtca.pem ciphers = DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:DES-CBC3-MD5:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-SHA:IDEA-CBC-SHA:IDEA-CBC-MD5:RC2-CBC-MD5:DHE-DSS-RC4-SHA:RC4-SHA:RC4-MD5:RC4-MD5:RC4-64-MD5:EXP1024-DHE-DSS-DES-CBC-SHA:EXP1024-DES-CBC-SHA:EXP1024-RC2-CBC-MD5:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:DES-CBC-MD5:EXP1024-DHE-DSS-RC4-SHA:EXP1024-RC4-SHA:EXP1024-RC4-MD5:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-RC2-CBC-MD5:EXP-RC4-MD5:EXP-RC4-MD5 # Some debugging stuff debug = 7 output = /etc/stunnel/stunnel.log # Use it for client mode client = yes when I try to connect to the server, I am seeing that Stunnel is sending an empty certificate..which is making my server to reject connections. Can someone please help me out?? Thanks in Advance Ravi Gowda

1 0

Re: [stunnel-users] Setting up chain certificates on Stunnel.
by Hans Werner Strube 13 Apr '07

13 Apr '07

Satyajit Das wrote: > My server certificate > signed by intermediate CA > signed by Verisign CA > > I have the Verisign certificate on my clients trusted root CAs, however I am > > not able to get the SSL communication through. I believe this is because > stunnel should send all the three certificates for authentication and I > couldnt > configure stunnel to send across all the three certificates. > > Can anybody please help install all these certificates on stunnel. Simply concatenate the certificates (in PEM format) in the file specified by "cert = ..." and supply the key of your server certificate either in the same file or in the file specified by "key = ...".

1 0

stunnel-4.20 crash on AIX
by Peter O'Gorman 12 Apr '07

12 Apr '07

Hi, We built stunnel-4.20 on solaris, hpux, aix, tru64. irix and various linux hosts, and it works fine everywhere except hpux10.20 and aix. stunnel crashes with similar backtraces on AIX-4.3,5.1,5.2 and 5.3, not on the first client connect (using stunnel client=yes, connecting to s secure daytime server on another host, because everyone needs a secure daytime server :-p) but on the second connection. We have not tried server side yet, I assume results are similar. The backtrace looks like this: GDB: Program terminated with signal 11, Segmentation fault. #0 0xd0126b1c in _sigsetmask () from /usr/lib/libpthreads.a(shr_xpg5.o) (gdb) bt #0 0xd0126b1c in _sigsetmask () from /usr/lib/libpthreads.a(shr_xpg5.o) #1 0xd0127e5c in _p_sigaction () from /usr/lib/libpthreads.a(shr_xpg5.o) #2 0xd0315544 in sigaction () from /usr/lib/libc.a(shr.o) #3 0xd038beac in signal () from /usr/lib/libc.a(shr.o) #4 0x10006200 in sigchld_handler (sig=0) at network.c:350 #5 0x00004378 in ?? () Previous frame inner to this frame (corrupt stack?) dbx: sigchld_handler(sig = 0), line 350 in "network.c" _sigsetmask(??, ??, ??) at 0xd0126b1c _p_sigaction(??, ??, ??) at 0xd0127e58 raise.sigaction(??, ??, ??) at 0xd0315540 signal(??, ??) at 0xd038bea8 sigchld_handler(sig = 0), line 350 in "network.c" _sigsetmask(??, ??, ??) at 0xd0126b1c _p_sigaction(??, ??, ??) at 0xd0127e58 raise.sigaction(??, ??, ??) at 0xd0315540 signal(??, ??) at 0xd038bea8 sigchld_handler(sig = 0), line 350 in "network.c" _sigsetmask(??, ??, ??) at 0xd0126b1c _p_sigaction(??, ??, ??) at 0xd0127e58 raise.sigaction(??, ??, ??) at 0xd0315540 signal(??, ??) at 0xd038bea8 repeated forever. Line 350 of network.c says: signal(SIGCHLD, sigchld_handler); And that is in the signal handler, it seems like a normal thing to do, and I have no idea why, on AIX, it crashes. putting an #ifndef _AIX #endif around the signal() call "fixes" the crash, alternatively setting SIGCHLD to SIG_IGN on AIX "fixes" it, but I don't think that either solution is correct. I don't believe the signal handler will get called again as we do not reset the signal. (tests that assumtion and finds answer to riddle) Okay, problem identified. The signal_handler is being called repeatedly, causing an infinite loop that can only end in a crash. According to the AIX signal man page: The signal in libc.a does not set the SA_RESTART flag. It sets the signal mask to the signal whose action is being specified, and sets flags to SA_OLDSTYLE. The Berkeley Software Distribution (BSD) version of signal sets the SA_RESTART flag and preserves the current settings of the signal mask and flags. The BSD version can be used by compiling with the Berkeley Compatibility Library (libbsd.a). And indeed, no patches are required if I add -lbsd. Another solution would probably be to use sigaction if it is available. Meanwhile, please find attached a patch to add -lbsd on aix. Thanks for bearing with me while I figured this out :-) Peter

1 0

Setting up chain certificates on Stunnel.
by Satyajit Das 12 Apr '07

12 Apr '07

Hi , I am using stunnel as a wrapper to provide SSL functionalities for my server. Right now I am having problems setting up chained certificates on stunnel. My Problem -> My server certificate > signed by intermediate CA > signed by Verisign CA I have the Verisign certificate on my clients trusted root CAs, however I am not able to get the SSL communication through. I believe this is because stunnel should send all the three certificates for authentication and I couldnt configure stunnel to send across all the three certificates. Can anybody please help install all these certificates on stunnel. Thanks in advance, Satyajit

1 0

Cannot install stunnel as a service on Vista
by Neil Aggarwal 12 Apr '07

12 Apr '07

Hello: I cannot install stunnel as a service on Vista. I get a permission denied error. Is there a way to work around it? Thanks, Neil -- Neil Aggarwal, (214)986-3533, www.JAMMConsulting.com FREE! Eliminate junk email and reclaim your inbox. Visit http://www.spammilter.com for details.

2 1

forcing checking of local certificates every time
by san san 11 Apr '07

11 Apr '07

Hi, I am using stunnel with verify option with value 3. In value 3 the authentication is carried out using the local trusted certificates. I think stunnel does not check the local trusted certificates directory each and every time. If the connection has already been established then it does not check local trusted certificates , connection can be established using the certificates in cache. Is it possible to force to check the local trusted certificates every time. Regards

2 1

stunnel work with NAT
by atsushi kataoka 11 Apr '07

11 Apr '07

I have one question , does stunnel work with NAT ? I will explain the architecture There are some 10.0.0.XXXX machines and some are 192.0.0.XXXX machines. They are connected to each other via Router which does NAT. My VNC servers are installed on 10.0.0.XXXX and vnc clients on 192.0.0.XXXX I am not able to do the vnc from client to server. Now I want to encrypt the VNC traffic , can stunnel work with NAT? A Kataoka

1 0

running concurrent stunnel instances
by John Taylor 10 Apr '07

10 Apr '07

Greetings, I am running rsync through stunnel 4.20. Each end is a Dell dual cpu, dual core Xeon (each core with hyper-threading) 8 gigs of memory, running Win 2003 Server. The disks are 10K RPM Ultra-320 drives that use hardware raid-5. Right now, I have anywhere between 5 and 8 Scheduled Tasks running at the same time. The reason for this is that the backups need to run in parallel in order to finish within the 15 hour time window. Although I am not certain about an exact number, I believe I would be transferring about 300-400 gig of data each time. Even though I have a gigabit connection between the two servers, I am only seeing 5-6% network utilization. When running the same rsync batch file without stunnel encryption, the throughput was much higher. I would like to see about increasing my throughput with stunnel encryption running. I don't expect it to be as fast as running without stunnel, but I still think I should be able to do better than 5-6% throughput. I am also running a enhanced version of rsync that does not have any issues with NTFS disk fragmentation, since it preallocates the files to the final size before writing. I think the bottleneck is the CPU. To test out this theory, I would like to have multiple copies of the stunnel.exe running, each using their own config file and own port numbers. I don't think the problem is with rsync because it spawns a new process for each connection. Thus, the multiple rsync.exe processes get the advantage of running on top of multiple cores. This is not the case with stunnel.exe. It only uses 1 process, but 8 threads. I am hoping that multiple stunnel.exe instances will fix the bottleneck because each stunnel.exe process could then be running on it's own core. How can I accomplish this? Also, what is the fastest encryption cipher that stills has good security, over 64 bit, preferably at least 128 bit. Any help would be greatly appreciated. Thanks, -John Stunnel.conf on server: cert = my.pem verify = 3 CAfile = my.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 taskbar=no debug = 5 output = stunnel.log [rsynctnl] accept=12345 connect=873 ciphers = AES128-SHA Stunnel.conf on client: cert = my.pem taskbar = no socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 5 output = stunnel.log client = yes [rsynctnl] accept=12345 connect=10.9.8.7:12345 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

3 2

stunnel as ssh client and self signed certificates
by san san 07 Apr '07

07 Apr '07

Hi, I was planning to use stunnel for my rdp based product. I have several trivial doubts,but since i would be using the same in my product. I would like to know following 1.Actually i want to use stunnel in the same way as ssh i.e Client authentication only , i don't want server authentication at all in my client. So it is possible to not check any server certificate from client side. If i will be using client certificate 2.Is it possible to use self-signed certificate ? I am aware of the drawbacks of using self-signed certificates but because of some inevitable reason i have to use self-signed certificates. I am sorry for my poor knowledge. Regards

1 0

Is it possible to see the "real" IP of the client?
by Konrad Hammerer 05 Apr '07

05 Apr '07

Hi! I want to use STunnel to secure my IMAP connections to my mail server. It works fine but from now on the mail server shows 127.0.0.1 for the open imap client connections. Is there a way to get STunnel forward the real IP or is this impossible? Thanks, Konrad

2 1

How to generate my own certificate for my dynamic dns
by Konrad Hammerer 05 Apr '07

05 Apr '07

Hi! I read somewere, that it is possible to generate a certificate for STunnel. The certificate shipped with the stunnel installer is just for testing purpose, isn't it? So were can I get my own, secure certificate? Thanks, Konrad

2 1

User nobody logging in
by Dimitri Yioulos 29 Mar '07

29 Mar '07

Hi, folks. I've been using stunnel on our mail server (sendmail, spamassassin, clamav, mailscanner, mailwatch). I note the following being written to syslog, and wonder if stunnel is causing it: Mar 29 14:07:31 mail1 su(pam_unix)[29493]: session closed for user nobody Mar 29 14:08:00 mail1 stunnel: LOG5[15993:3076422576]: pop3s accepted connection from 192.168.100.58:1723 Mar 29 14:08:00 mail1 stunnel: LOG5[15993:3076422576]: pop3s connected remote server from 127.0.0.1:33540 Mar 29 14:08:00 mail1 stunnel: LOG5[15993:3076422576]: Connection closed: 138 bytes sent to SSL, 42 bytes sent to socket Mar 29 14:08:43 mail1 su(pam_unix)[29640]: session opened for user nobody by (uid=0) Mar 29 14:08:43 mail1 su(pam_unix)[29640]: session closed for user nobody Mar 29 14:09:00 mail1 stunnel: LOG5[15993:3076422576]: pop3s accepted connection from 192.168.100.58:1724 Mar 29 14:09:00 mail1 stunnel: LOG5[15993:3076422576]: pop3s connected remote server from 127.0.0.1:33544 Mar 29 14:09:00 mail1 stunnel: LOG5[15993:3076422576]: Connection closed: 138 bytes sent to SSL, 42 bytes sent to socket Mar 29 14:10:00 mail1 stunnel: LOG5[15993:3076422576]: pop3s accepted connection from 192.168.100.58:1725 Mar 29 14:10:00 mail1 stunnel: LOG5[15993:3076422576]: pop3s connected remote server from 127.0.0.1:33546 Mar 29 14:10:00 mail1 stunnel: LOG5[15993:3076422576]: Connection closed: 138 bytes sent to SSL, 42 bytes sent to socket Mar 29 14:10:11 mail1 su(pam_unix)[30025]: session opened for user nobody by (uid=0) Mar 29 14:10:11 mail1 su(pam_unix)[30025]: session closed for user nobody Mar 29 14:10:33 mail1 su(pam_unix)[30075]: session opened for user nobody by (uid=0) Mar 29 14:10:33 mail1 su(pam_unix)[30075]: session closed for user nobody Mar 29 14:11:00 mail1 stunnel: LOG5[15993:3076422576]: pop3s accepted connection from 192.168.100.58:1726 Mar 29 14:11:00 mail1 stunnel: LOG5[15993:3076422576]: pop3s connected remote server from 127.0.0.1:33559 Mar 29 14:11:00 mail1 stunnel: LOG5[15993:3076422576]: Connection closed: 138 bytes sent to SSL, 42 bytes sent to socket Mar 29 14:11:03 mail1 su(pam_unix)[30206]: session opened for user nobody by (uid=0) Mar 29 14:11:03 mail1 su(pam_unix)[30206]: session closed for user nobody Mar 29 14:11:06 mail1 su(pam_unix)[30215]: session opened for user nobody by (uid=0) Mar 29 14:11:06 mail1 su(pam_unix)[30215]: session closed for user nobody It's the sessions opened and closed for the user nobody that has me concerned. stunnel appears to be the only process being run by the user nobody. If, in fact, this is caused by stunnel, do I keep these (and only these) session opened/closed instances from being logged? Thanks. Dimitri -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

trouble shooting Pan issue
by eph man 29 Mar '07

29 Mar '07

hi, i'm trying to trouble shoot a problem with a newsreader called pan that i might be having. here's my setup: ubuntu 6.10 kernel 2.6.17 pan 0.14.2 stunnel4 4.150 i created a snntp.conf file with only: client = yes foreground = yes debug = 7 [nntps] accept = localhost:2000 connect = inetnews.worldnet.att.net:563 then i run stunnel4 and this is the output: ephman@wintermute:~$ sudo stunnel4 /etc/stunnel/snntp.conf 2007.03.29 13:54:47 LOG7[13414:3083015856]: RAND_status claims sufficient entropy for the PRNG 2007.03.29 13:54:47 LOG6[13414:3083015856]: PRNG seeded successfully 2007.03.29 13:54:47 LOG7[13414:3083015856]: SSL context initialized for service nntps 2007.03.29 13:54:47 LOG5[13414:3083015856]: stunnel 4.15 on i486-pc-linux-gnu with OpenSSL 0.9.8b 04 May 2006 2007.03.29 13:54:47 LOG5[13414:3083015856]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2007.03.29 13:54:47 LOG6[13414:3083015856]: file ulimit = 1024 (can be changed with 'ulimit -n') 2007.03.29 13:54:47 LOG6[13414:3083015856]: poll() used - no FD_SETSIZE limit for file descriptors 2007.03.29 13:54:47 LOG5[13414:3083015856]: 500 clients allowed 2007.03.29 13:54:47 LOG7[13414:3083015856]: FD 3 in non-blocking mode 2007.03.29 13:54:47 LOG7[13414:3083015856]: FD 4 in non-blocking mode 2007.03.29 13:54:47 LOG7[13414:3083015856]: FD 5 in non-blocking mode 2007.03.29 13:54:47 LOG7[13414:3083015856]: SO_REUSEADDR option set on accept socket 2007.03.29 13:54:47 LOG7[13414:3083015856]: nntps bound to 127.0.0.1:2000 2007.03.29 13:54:47 LOG7[13414:3083015856]: Created pid file /var/run/stunnel4.pid i then startup pan and it won't connect to the server the log file says: Thu, 29 Mar 2007 13:58:15 - Pan 0.14.2.91 Started Thu, 29 Mar 2007 13:58:15 - Directory "/home/ephman/.pan/messages/cache" contains 0.0 MB in 0 files Thu, 29 Mar 2007 13:58:15 - Directory "/home/ephman/.pan/messages/folders/pan.sent" contains 0.0 MB in 0 files Thu, 29 Mar 2007 13:58:15 - Directory "/home/ephman/.pan/messages/folders/pan.sendlater" contains 0.0 MB in 0 files Thu, 29 Mar 2007 13:58:15 - News server connection count: 0 Thu, 29 Mar 2007 13:58:19 - New connection 0x846da08 for inetnews.worldnet.att.net, port 563 Thu, 29 Mar 2007 13:59:21 - NNTP handshake failed: Error reading from socket. Thu, 29 Mar 2007 13:59:21 - Handshake failed: Error reading from socket. Thu, 29 Mar 2007 13:59:26 - New connection 0x84a5850 for inetnews.worldnet.att.net, port 563 any help or hints would be really helpful. thanks. be well, ephman

1 0

Simple Stunnel Question
by mdpeters 28 Mar '07

28 Mar '07

My goal is to have a web server transfer MySQL data via an AES tunnel to a MySQL database server with an added encryption card. Both systems have the same SSL and Stunnel software installed. My web servers database seems to be functioning as normal. I would like to verify that what I have is complete and effective. It is not apparent to me if I have finished construction or how to verify this works like I want it to. I'm not sure how I would verify that Stunnel is being used? Do I need to run Stunnel as a background service full time? Is there something I am missing here? Comments and advice is appreciated! ++++++ # /usr/local/sbin/stunnel -version stunnel 4.20 on sparc-sun-solaris2.10 with OpenSSL 0.9.8e 23 Feb 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none # gcc -v Reading specs from /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/specs Configured with: ../configure --with-as=/usr/ccs/bin/as --with-ld=/usr/ccs/bin/ld --disable-nls Thread model: posix gcc version 3.3.2 # uname -a SunOS slinky 5.10 Generic_118833-17 sun4u sparc SUNW,Ultra-80 # /usr/local/sbin/stunnel -sockets Socket option defaults: Option Accept Local Remote OS default SO_DEBUG -- -- -- 0 SO_DONTROUTE -- -- -- 0 SO_KEEPALIVE -- -- -- 0 SO_LINGER -- -- -- 0:0 SO_OOBINLINE -- -- -- 0 SO_RCVBUF -- -- -- 65535 SO_SNDBUF -- -- -- 65535 SO_RCVLOWAT -- -- -- -- SO_SNDLOWAT -- -- -- -- SO_RCVTIMEO -- -- -- -- SO_SNDTIMEO -- -- -- -- SO_REUSEADDR 1 -- -- 0 IP_TOS -- -- -- 0 IP_TTL -- -- -- 64 TCP_NODELAY -- -- -- 0 # openssl ciphers -v DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 DHE-DSS-AES256-SHA SSLv3 Kx=DH Au=DSS Enc=AES(256) Mac=SHA1 AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 EDH-RSA-DES-CBC3-SHA SSLv3 Kx=DH Au=RSA Enc=3DES(168) Mac=SHA1 EDH-DSS-DES-CBC3-SHA SSLv3 Kx=DH Au=DSS Enc=3DES(168) Mac=SHA1 DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 DES-CBC3-MD5 SSLv2 Kx=RSA Au=RSA Enc=3DES(168) Mac=MD5 DHE-RSA-AES128-SHA SSLv3 Kx=DH Au=RSA Enc=AES(128) Mac=SHA1 DHE-DSS-AES128-SHA SSLv3 Kx=DH Au=DSS Enc=AES(128) Mac=SHA1 AES128-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 IDEA-CBC-SHA SSLv3 Kx=RSA Au=RSA Enc=IDEA(128) Mac=SHA1 IDEA-CBC-MD5 SSLv2 Kx=RSA Au=RSA Enc=IDEA(128) Mac=MD5 RC2-CBC-MD5 SSLv2 Kx=RSA Au=RSA Enc=RC2(128) Mac=MD5 RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 RC4-MD5 SSLv2 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 EDH-RSA-DES-CBC-SHA SSLv3 Kx=DH Au=RSA Enc=DES(56) Mac=SHA1 EDH-DSS-DES-CBC-SHA SSLv3 Kx=DH Au=DSS Enc=DES(56) Mac=SHA1 DES-CBC-SHA SSLv3 Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 DES-CBC-MD5 SSLv2 Kx=RSA Au=RSA Enc=DES(56) Mac=MD5 EXP-EDH-RSA-DES-CBC-SHA SSLv3 Kx=DH(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-EDH-DSS-DES-CBC-SHA SSLv3 Kx=DH(512) Au=DSS Enc=DES(40) Mac=SHA1 export EXP-DES-CBC-SHA SSLv3 Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-RC2-CBC-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC2-CBC-MD5 SSLv2 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC4-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export EXP-RC4-MD5 SSLv2 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export ++++++

1 0

Stunnel support or OpenSSL in FIPS mode
by George Henson 26 Mar '07

26 Mar '07

All, Are there any current plans to include FIPS complaint mode in stunnel? I have asked some of my peers on other US Government projects and they indicated this would be a help to them as well. Looking at the users guide from the OpenSSL site (http://www.openssl.org/docs/fips/UserGuide-1.1.1.pdf) it would not appear to be a great amount of effort to make a stunnel that functions in a FIPS complaint mode. Attached I have included the patch I have created (with some help from friends). It does not do the final linking correctly as I am not very good with autmake. Please let me know what you think. Thank you George diff -u -r @stunnel-4.20/configure.ac stunnel-4.20/configure.ac --- @stunnel-4.20/configure.ac 2006-11-11 09:58:01.000000000 -0500 +++ stunnel-4.20/configure.ac 2007-03-26 18:35:09.000000000 -0400 @@ -260,6 +260,51 @@ CFLAGS="$CFLAGS -I$ssldir/include" LIBS="$LIBS -L$ssldir/lib -lssl -lcrypto" +AC_ARG_WITH(fips, + [ --with-fips Enable OpenSSL FIPS mode], + [ + if test "x$withval" != "xno" ; then + INCLUDES="=l$ssldir/include" + AC_CACHE_CHECK([for FIPS mode], ac_cv_fips, [ + AC_TRY_COMPILE( + [ #include <openssl/fips.h> ], + [ FIPS_mode_set(1); ], + [ ac_cv_fips="yes" ], + [ ac_cv_fips="no" ] + ) + ]) + fi + ] +) +if test "x$ac_cv_fips" = "xyes" ; then + CPPFLAGS="$CPPFLAGS -DOPENSSL_FIPS" + FIPS_MODE=yes + AC_SUBST(FIPS_MODE) +fi + +AC_ARG_WITH(fips, + [ --with-fips Enable OpenSSL FIPS mode], + [ + if test "x$withval" != "xno" ; then + INCLUDES="=l$ssldir/include" + AC_CACHE_CHECK([for FIPS mode], ac_cv_fips, [ + AC_TRY_COMPILE( + [ #include <openssl/fips.h> ], + [ FIPS_mode_set(1); ], + [ ac_cv_fips="yes" ], + [ ac_cv_fips="no" ] + ) + ]) + fi + ] +) +if test "x$ac_cv_fips" = "xyes" ; then + CPPFLAGS="$CPPFLAGS -DOPENSSL_FIPS" + FIPS_MODE=yes + AC_SUBST(FIPS_MODE) +fi +AM_CONDITIONAL(FIPS_MODE, test x$ac_cv_fips = xyes) + # Check for obsolete RSAref library AC_MSG_CHECKING([for obsolete RSAref library]) saved_LIBS="$LIBS" Only in stunnel-4.20: configure.ac.orig diff -u -r @stunnel-4.20/src/common.h stunnel-4.20/src/common.h --- @stunnel-4.20/src/common.h 2006-11-17 04:03:18.000000000 -0500 +++ stunnel-4.20/src/common.h 2007-03-26 18:35:03.000000000 -0400 @@ -321,6 +321,9 @@ #if SSLEAY_VERSION_NUMBER >= 0x00907000L #include <openssl/ocsp.h> #endif /* OpenSSL-0.9.7 */ +#ifdef OPENSSL_FIPS +#include <openssl/fips.h> +#endif #else /* HAVE_OPENSSL */ #include <lhash.h> #include <ssl.h> diff -u -r @stunnel-4.20/src/options.c stunnel-4.20/src/options.c --- @stunnel-4.20/src/options.c 2006-11-05 08:04:37.000000000 -0500 +++ stunnel-4.20/src/options.c 2007-03-26 18:35:03.000000000 -0400 @@ -556,7 +556,11 @@ /* ciphers */ switch(cmd) { case CMD_INIT: +#ifndef OPENSSL_FIPS section->cipher_list=SSL_DEFAULT_CIPHER_LIST; +#else + section->cipher_list="!ADH:!RC4:!RC2:!IDEA:!MD5:!NULL:TLSv1"; +#endif break; case CMD_EXEC: if(strcasecmp(opt, "ciphers")) @@ -564,7 +568,11 @@ section->cipher_list=stralloc(arg); return NULL; /* OK */ case CMD_DEFAULT: +#ifndef OPENSSL_FIPS log_raw("%-15s = %s", "ciphers", SSL_DEFAULT_CIPHER_LIST); +#else + log_raw("%-15s = %s", "ciphers", "!ADH:!RC4:!RC2:!IDEA:!MD5:!NULL:TLSv1"); +#endif break; case CMD_HELP: log_raw("%-15s = list of permitted SSL ciphers", "ciphers"); @@ -726,6 +734,31 @@ } #endif + /* fips mode */ +#ifndef USE_WIN32 + switch(cmd) { + case CMD_INIT: + options.option.fips_mode=0; + break; + case CMD_EXEC: + if(strcasecmp(opt, "fips")) + break; + if(!strcasecmp(arg, "yes")) + options.option.fips_mode = 1; + else if(!strcasecmp(arg, "no")) + options.option.fips_mode = 0; + else + return "argument should be either 'yes' or 'no'"; + return NULL; /* OK */ + case CMD_DEFAULT: + break; + case CMD_HELP: + log_raw("%-15s = yes|no FIPS mode", + "fips"); + break; + } +#endif + /* execargs */ #ifndef USE_WIN32 switch(cmd) { diff -u -r @stunnel-4.20/src/prototypes.h stunnel-4.20/src/prototypes.h --- @stunnel-4.20/src/prototypes.h 2006-11-11 08:03:05.000000000 -0500 +++ stunnel-4.20/src/prototypes.h 2007-03-26 18:35:03.000000000 -0400 @@ -142,6 +142,7 @@ unsigned int foreground:1; unsigned int syslog:1; /* log to syslog */ unsigned int rand_write:1; /* overwrite rand_file */ + unsigned int fips_mode:1; #ifdef USE_WIN32 unsigned int taskbar:1; /* enable the taskbar icon */ #endif diff -u -r @stunnel-4.20/src/stunnel.c stunnel-4.20/src/stunnel.c --- @stunnel-4.20/src/stunnel.c 2006-11-30 15:47:45.000000000 -0500 +++ stunnel-4.20/src/stunnel.c 2007-03-26 18:35:03.000000000 -0400 @@ -59,6 +59,7 @@ #ifndef USE_WIN32 int main(int argc, char* argv[]) { /* execution begins here 8-) */ +unsigned long e; main_initialize(argc>1 ? argv[1] : NULL, argc>2 ? argv[2] : NULL); signal(SIGPIPE, SIG_IGN); /* avoid 'broken pipe' signal */ @@ -72,6 +73,21 @@ signal(SIGHUP, signal_handler); /* signal(SIGSEGV, signal_handler); */ +#ifdef OPENSSL_FIPS + if(options.option.fips_mode) { + if (!FIPS_mode_set(1)) { + log_raw("Failed to enter FIPS mode"); + ERR_load_crypto_strings(); + while((e = ERR_get_error())) { + log_raw(ERR_error_string(e,NULL)); + } + return 1; /* failure */ + } else { + log_raw("FIPS mode enabled"); + } + } +#endif + main_execute(); return 0; /* success */

1 0

using an ocsp
by Samuel Landau 26 Mar '07

26 Mar '07

Hello, I am using stunnel 4.18 and openca-ocspd 1.5.1. The OCSPd uses a delegate certificate and the setup works when tested with openssl: $ openssl ocsp -issuer /home/landau/ssl/cacert.pem -serial 3 -url http://localhost:2560 -CAfile /home/landau/ssl/cacert.pem Response verify OK 3: good This Update: Mar 23 18:27:37 2007 GMT Next Update: Mar 26 10:56:33 2007 GMT But when it comes to using stunnel, I cannot figure out how to make it use properly the OCSP. I could see that stunnel 4.19 had more options for ocsp, but I am unsure this is related to my current issue. Besides, is there a way to have stunnel fall back on local cert/crl files if the ocsp server is not available ? Regards, -- Samuel Landau ____________________________________________________________________________ This email and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to which they are addressed. Access to this e-mail by anyone else is unauthorised. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited. E-mail messages are not necessarily secure. Archos does not accept responsibility for any changes made to this message after it was sent. 2007.03.26 12:59:05 LOG5[29250:3083020512]: stunnel 4.18 on i486-pc-linux-gnu with OpenSSL 0.9.8c 05 Sep 2006 2007.03.26 12:59:05 LOG5[29250:3083020512]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2007.03.26 12:59:05 LOG6[29250:3083020512]: file ulimit = 1024 (can be changed with 'ulimit -n') 2007.03.26 12:59:05 LOG6[29250:3083020512]: poll() used - no FD_SETSIZE limit for file descriptors 2007.03.26 12:59:05 LOG5[29250:3083020512]: 500 clients allowed 2007.03.26 12:59:05 LOG7[29250:3083020512]: FD 4 in non-blocking mode 2007.03.26 12:59:05 LOG7[29250:3083020512]: FD 5 in non-blocking mode 2007.03.26 12:59:05 LOG7[29250:3083020512]: FD 6 in non-blocking mode 2007.03.26 12:59:05 LOG7[29250:3083020512]: SO_REUSEADDR option set on accept socket 2007.03.26 12:59:05 LOG7[29250:3083020512]: server bound to 127.0.0.1:12345 2007.03.26 12:59:05 LOG7[29250:3083020512]: Created pid file /home/landau/stunnel4.pid 2007.03.26 12:59:12 LOG7[29250:3083020512]: server accepted FD=7 from 127.0.0.1:36200 2007.03.26 12:59:12 LOG7[29250:3082972080]: server started 2007.03.26 12:59:12 LOG7[29250:3082972080]: FD 7 in non-blocking mode 2007.03.26 12:59:12 LOG7[29250:3082972080]: TCP_NODELAY option set on local socket 2007.03.26 12:59:12 LOG7[29250:3082972080]: FD 8 in non-blocking mode 2007.03.26 12:59:12 LOG7[29250:3082972080]: FD 9 in non-blocking mode 2007.03.26 12:59:12 LOG7[29250:3083020512]: Cleaning up the signal pipe 2007.03.26 12:59:12 LOG6[29250:3083020512]: Child process 29252 finished with code 0 2007.03.26 12:59:12 LOG7[29250:3082972080]: Connection from 127.0.0.1:36200 permitted by libwrap 2007.03.26 12:59:12 LOG5[29250:3082972080]: server connected from 127.0.0.1:36200 2007.03.26 12:59:12 LOG7[29250:3082972080]: SSL state (accept): before/accept initialization 2007.03.26 12:59:12 LOG7[29250:3082972080]: SSL state (accept): SSLv3 read client hello A 2007.03.26 12:59:12 LOG7[29250:3082972080]: SSL state (accept): SSLv3 write server hello A 2007.03.26 12:59:12 LOG7[29250:3082972080]: SSL state (accept): SSLv3 write certificate A 2007.03.26 12:59:12 LOG7[29250:3082972080]: SSL state (accept): SSLv3 write certificate request A 2007.03.26 12:59:12 LOG7[29250:3082972080]: SSL state (accept): SSLv3 flush data 2007.03.26 12:59:12 LOG6[29250:3082972080]: *** starting OCSP verification *** 2007.03.26 12:59:12 LOG7[29250:3082972080]: FD 8 in non-blocking mode 2007.03.26 12:59:12 LOG7[29250:3082972080]: connect_wait: waiting 10 seconds 2007.03.26 12:59:12 LOG7[29250:3082972080]: connect_wait: connected 2007.03.26 12:59:12 LOG7[29250:3082972080]: OCSP server connected 2007.03.26 12:59:12 LOG7[29250:3082972080]: FD 8 in blocking mode 2007.03.26 12:59:12 LOG7[29250:3082972080]: FD 8 in non-blocking mode 2007.03.26 12:59:12 LOG6[29250:3082972080]: OCSP response received 2007.03.26 12:59:12 LOG3[29250:3082972080]: OCSP_basic_verify: 27069076: error:27069076:OCSP routines:OCSP_basic_verify:signer certificate not found 2007.03.26 12:59:12 LOG7[29250:3082972080]: SSL alert (write): fatal: certificate unknown 2007.03.26 12:59:12 LOG3[29250:3082972080]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2007.03.26 12:59:12 LOG5[29250:3082972080]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.03.26 12:59:12 LOG7[29250:3082972080]: server finished (0 left) 2007.03.26 12:59:16 LOG3[29250:3083020512]: Received signal 2; terminating 2007.03.26 12:59:16 LOG7[29250:3083020512]: removing pid file /home/landau/stunnel4.pid cert = landau.pem key = landau.key sslVersion = SSLv3 pid =/home/landau/ssl/stunnel4.pid socket =l:TCP_NODELAY=1 socket =r:TCP_NODELAY=1 compression =zlib foreground =yes verify =3 CApath =/home/landau/ssl/ CAfile =/home/landau/ssl/cacert.pem debug =7 output =/home/landau/ssl/stunnel4.log client =no [server] accept =localhost:12345 ocsp =http://localhost:2560 pty =no exec =/bin/bash execargs =bash

1 0

[win32] stunnel/OpenSSL/Synergy howto
by P. Jansen 25 Mar '07

25 Mar '07

Hi stunnel users and especially newbies, on http://stunnel.mirt.net/docs.html you can find a link to a stunnel/OpenSSL/Synergy howto for the Win32 platform. It is a short but hopefully useful doc how to install, configure and use stunnel. Feedback and comments are welcome. - Patrick

1 0

Solaris 10 and MySQL questions
by mdpeters 25 Mar '07

25 Mar '07

My goal is to have a web server transfer MySQL data via an AES tunnel to a MySQL database server with an added encryption card. Both systems have the same SSL and Stunnel software installed. My web servers database seems to be functioning as normal. I would like to verify that what I have is complete and effective. It is not apparent to me if I have finished construction or how to verify this works like I want it to. I'm not sure how I would verify that Stunnel is being used. Do I need to run Stunnel as a background service full time? Is there something I am missing here? ++++++ # /usr/local/sbin/stunnel -version stunnel 4.20 on sparc-sun-solaris2.10 with OpenSSL 0.9.8e 23 Feb 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none # gcc -v Reading specs from /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/specs Configured with: ../configure --with-as=/usr/ccs/bin/as --with-ld=/usr/ccs/bin/ld --disable-nls Thread model: posix gcc version 3.3.2 # uname -a SunOS slinky 5.10 Generic_118833-17 sun4u sparc SUNW,Ultra-80 # /usr/local/sbin/stunnel -sockets Socket option defaults: Option Accept Local Remote OS default SO_DEBUG -- -- -- 0 SO_DONTROUTE -- -- -- 0 SO_KEEPALIVE -- -- -- 0 SO_LINGER -- -- -- 0:0 SO_OOBINLINE -- -- -- 0 SO_RCVBUF -- -- -- 65535 SO_SNDBUF -- -- -- 65535 SO_RCVLOWAT -- -- -- -- SO_SNDLOWAT -- -- -- -- SO_RCVTIMEO -- -- -- -- SO_SNDTIMEO -- -- -- -- SO_REUSEADDR 1 -- -- 0 IP_TOS -- -- -- 0 IP_TTL -- -- -- 64 TCP_NODELAY -- -- -- 0 # openssl ciphers -v DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 DHE-DSS-AES256-SHA SSLv3 Kx=DH Au=DSS Enc=AES(256) Mac=SHA1 AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 EDH-RSA-DES-CBC3-SHA SSLv3 Kx=DH Au=RSA Enc=3DES(168) Mac=SHA1 EDH-DSS-DES-CBC3-SHA SSLv3 Kx=DH Au=DSS Enc=3DES(168) Mac=SHA1 DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 DES-CBC3-MD5 SSLv2 Kx=RSA Au=RSA Enc=3DES(168) Mac=MD5 DHE-RSA-AES128-SHA SSLv3 Kx=DH Au=RSA Enc=AES(128) Mac=SHA1 DHE-DSS-AES128-SHA SSLv3 Kx=DH Au=DSS Enc=AES(128) Mac=SHA1 AES128-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 IDEA-CBC-SHA SSLv3 Kx=RSA Au=RSA Enc=IDEA(128) Mac=SHA1 IDEA-CBC-MD5 SSLv2 Kx=RSA Au=RSA Enc=IDEA(128) Mac=MD5 RC2-CBC-MD5 SSLv2 Kx=RSA Au=RSA Enc=RC2(128) Mac=MD5 RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 RC4-MD5 SSLv2 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 EDH-RSA-DES-CBC-SHA SSLv3 Kx=DH Au=RSA Enc=DES(56) Mac=SHA1 EDH-DSS-DES-CBC-SHA SSLv3 Kx=DH Au=DSS Enc=DES(56) Mac=SHA1 DES-CBC-SHA SSLv3 Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 DES-CBC-MD5 SSLv2 Kx=RSA Au=RSA Enc=DES(56) Mac=MD5 EXP-EDH-RSA-DES-CBC-SHA SSLv3 Kx=DH(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-EDH-DSS-DES-CBC-SHA SSLv3 Kx=DH(512) Au=DSS Enc=DES(40) Mac=SHA1 export EXP-DES-CBC-SHA SSLv3 Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-RC2-CBC-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC2-CBC-MD5 SSLv2 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC4-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export EXP-RC4-MD5 SSLv2 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export ++++++

1 0

How to surf the web over proxy?
by P. Jansen 25 Mar '07

25 Mar '07

Hi, I know there is a way to do the following with SSH+PuTTY, with stunnel too? Do I need further software? Windows office computer --> (HTTP) --> Corporate firewall/proxy --> (HTTP) --> Home computer --> WWW Regards, Patrick

1 0

Stunnel 4.20 with TCP Wrappers 7.6 problem in configure.ac
by lists＠d-ra.ath.cx 18 Mar '07

18 Mar '07

Hi, the following patch makes stunnel 4.20 to operate with TCP wrappers 7.6. I had not tried other versions of stunnel nor TCP wrappers. The problem is the missing libnsl, so TCP wrappers will never be activated in ./configure Regards Dieter --- configure.ac.orig 2007-03-17 12:57:32.000000000 +0100 +++ configure.ac 2007-03-17 12:55:19.000000000 +0100 @@ -310,7 +310,7 @@ AC_MSG_RESULT([no (autodetecting)]) AC_MSG_CHECKING([for hosts_access in -lwrap]) saved_LIBS="$LIBS" - LIBS="$saved_LIBS -lwrap" + LIBS="$saved_LIBS -lwrap -lnsl" AC_LINK_IFELSE( [AC_LANG_PROGRAM( [[int hosts_access(); int allow_severity, deny_severity;]],

2 9

Getting a "Peer suddenly disconnected" error
by David Goodwin 09 Mar '07

09 Mar '07

Hey all, I'm getting this in the /var/adm/messages log on the server side when attempting to connect from the client: Mar 8 22:23:33 SERVERNAME stunnel: [ID 821868 daemon.error] LOG3[27429:4]: SSL_connect: Peer suddenly disconnected I have the server configured as follows: cat /etc/stunnel/stunnel.test.conf client=yes debug=debug cert=/etc/stunnel/stunnel.pem [sunrpc] accept=112 connect=127.0.0.1:111 TIMEOUTclose=10 This is started just by running stunnel with the config file and then starting rpcbind normally. The client is configured as follows: # cat /etc/stunnel/stunnel.test.conf client=yes debug=debug cert=/etc/stunnel/imnxnsm0.pem [sunrpc] accept=111 connect=SERVERNAME:112 The error shows up when I attempt to run "rpcinfo -p 127.0.0.1". Snoop is showing the following (adjusted to remove hostnames/ips): CLIENT -> SERVER TCP D=112 S=63986 Syn Seq=867918817 Len=0 Win=24820 Options=<nop,nop,sackOK,mss 1460> SERVER -> CLIENT TCP D=63986 S=112 Syn Ack=867918818 Seq=209756753 Len=0 Win=24820 Options=<nop,nop,sackOK,mss 1460> CLIENT -> SERVER TCP D=112 S=63986 Ack=209756754 Seq=867918818 Len=0 Win=24820 CLIENT -> SERVER TCP D=112 S=63986 Ack=209756754 Seq=867918818 Len=88 Win=24820 SERVER -> CLIENT TCP D=63986 S=112 Ack=867918906 Seq=209756754 Len=0 Win=24820 SERVER -> CLIENT TCP D=63986 S=112 Rst Seq=209756754 Len=0 Win=24820 I'm pretty new to stunnel, and am having a heck of a time getting this to work. This configuration is the closest I've been to success so far. Is there a better way for me to wrap rpcbind perhaps? Any help with this will be appreciated. Thanks, Civil

2 2

DLLs for OpenSSL 0.9.8e
by Michal Trojnara 09 Mar '07

09 Mar '07

Dear Users, I've built the DLLs for OpenSSL 0.9.8e. They're available for download from: ftp://stunnel.mirt.net/openssl/binary-0.9.8e-zdll/ Best regards, Mike

1 0

problem accesing a https site as a Windows version client
by Gustavo 09 Mar '07

09 Mar '07

I'm running stunnel version 4.2 on Windows XP I can access a lot of websites, example https://servicios.afip.gov.ar/tramites_con_clave_fiscal/misAportes/images/t… but CAN'T access https://apwebserver.rentasgcba.gov.ar/ablpatib_ssl/images/Actitud_BsAs_negr… apparently a response never arrives to my PC my conf file is cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 ; Use it for client mode client = yes ; Service-level configuration [https1] client = yes accept = 6001 connect = servicios.afip.gov.ar:443 TIMEOUTclose = 0 [https] client = yes accept = 6002 connect = apwebserver.rentasgcba.gov.ar:443 TIMEOUTclose = 5 ; vim:ft=dosini

2 1

Download speed affected with stunnel help needed please.
by tom hammond 07 Mar '07

07 Mar '07

Using HFS 2.1d http://www.rejetto.com and Stunnel 4.20 on single WinXP machine. The list of parameters you are using for stunnel, and if you are running it standalone or from inetd/xinetd: socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [https] accept = # connect = # TIMOUTclose = 0 I dont'understand 3-7 as given here: http://www.stunnel.org/support/ only used OpenSSL to make CERT Win32 OpenSSL v0.9.8e Light *************************************** Description: HFS is a webserver that can only utilize HTTP, therefore I turned to Stunnel to implement https. When using HTTPs: for UPLOADING I get full speed. When using HTTPs: for DOWNLoADING the speed in cut drastically, 20x slower. The odd thing is, multiple downloads can go at once eg: 20 connections @80kb/second However no single connection will get over 80 or 100kb/second I searched the net and couldn't find a solution, but continuously came across mention of "loopback" problems with stunnel and http servers (old posts) or saying stuff about Microsoft winsock, found a few mentions of VNC server having an option to "enable loopback connections" Another thing I saw but closed (oops) was mention of disabling an HTTP server in order to avoid loopback problems with HTTPS serving.(HFS has no option because it is designed to serve ONLY HTTP) I have tons of hope for an easy solution for the following reasons: #1, uploading works perfect #2 just downloaded demo of Easy File Sharing Web Server(not free like HFS) and the download speed works through HTTPS. I have no clue as to how to fix this, saw one entry in the stunnel config at ssl.org: socket = a:SO_BINDTODEVICE=lo I DID attempt to enter this line into the config under my 2 original entries, but then stunnel would not start. Thank you --------------------------------- TV dinner still cooling? Check out "Tonight's Picks" on Yahoo! TV.

1 0

init_ssl: s_poll_wait timeout
by William Biagi 06 Mar '07

06 Mar '07

I am using a Eudora client configured to use STARTLS to send mail through stunnel to a sendmail server. The stunnel config is as follows: cert = /usr/local/etc/stunnel/stunnel.pem key = /usr/local/etc/stunnel/stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 options = DONT_INSERT_EMPTY_FRAGMENTS delay = yes TIMEOUTconnect = 300 TIMEOUTbusy = 300 setuid = smtpauth setgid = smtpauth debug = 7 client = no foreground = yes pid = [smtps] accept = 465 connect = localhost:25 protocol=smtp When I send mail the connection is established with port 465 on stunnel but it fails to negotiate the ssl session. THis is the log: 2007.03.06 15:45:08 LOG7[17753:1024]: Snagged 64 random bytes from /root/.rnd 2007.03.06 15:45:08 LOG7[17753:1024]: Wrote 1024 new random bytes to /root/.rnd 2007.03.06 15:45:08 LOG7[17753:1024]: RAND_status claims sufficient entropy for the PRNG 2007.03.06 15:45:08 LOG7[17753:1024]: PRNG seeded successfully 2007.03.06 15:45:08 LOG7[17753:1024]: Configuration SSL options: 0x00000800 2007.03.06 15:45:08 LOG7[17753:1024]: SSL options set: 0x00000800 2007.03.06 15:45:08 LOG7[17753:1024]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2007.03.06 15:45:08 LOG7[17753:1024]: Certificate loaded 2007.03.06 15:45:08 LOG7[17753:1024]: Key file: /usr/local/etc/stunnel/stunnel.pem 2007.03.06 15:45:08 LOG7[17753:1024]: Private key loaded 2007.03.06 15:45:08 LOG7[17753:1024]: SSL context initialized for service smtps 2007.03.06 15:45:08 LOG5[17753:1024]: stunnel 4.20 on i686-pc-linux-gnu with OpenSSL 0.9.7l 28 Sep 2006 2007.03.06 15:45:08 LOG5[17753:1024]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 2007.03.06 15:45:08 LOG6[17753:1024]: file ulimit = 1024 (can be changed with 'ulimit -n') 2007.03.06 15:45:08 LOG6[17753:1024]: poll() used - no FD_SETSIZE limit for file descriptors 2007.03.06 15:45:08 LOG5[17753:1024]: 500 clients allowed 2007.03.06 15:45:08 LOG7[17753:1024]: FD 3 in non-blocking mode 2007.03.06 15:45:08 LOG7[17753:1024]: FD 4 in non-blocking mode 2007.03.06 15:45:08 LOG7[17753:1024]: FD 5 in non-blocking mode 2007.03.06 15:45:08 LOG7[17753:1024]: SO_REUSEADDR option set on accept socket 2007.03.06 15:45:08 LOG7[17753:1024]: smtps bound to 0.0.0.0:465 2007.03.06 15:45:08 LOG7[17753:1024]: No pid file being created 2007.03.06 15:45:18 LOG7[17753:1024]: smtps accepted FD=6 from 208.41.111.165:2542 2007.03.06 15:45:18 LOG7[17755:1026]: smtps started 2007.03.06 15:45:18 LOG7[17755:1026]: FD 6 in non-blocking mode 2007.03.06 15:45:18 LOG7[17755:1026]: TCP_NODELAY option set on local socket 2007.03.06 15:45:18 LOG5[17755:1026]: smtps accepted connection from 208.41.111.165:2542 2007.03.06 15:45:18 LOG7[17755:1026]: SSL state (accept): before/accept initialization 2007.03.06 15:45:20 LOG6[17755:1026]: init_ssl: s_poll_wait timeout 2007.03.06 15:45:20 LOG5[17755:1026]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.03.06 15:45:20 LOG7[17755:1026]: smtps finished (0 left) 2007.03.06 15:47:00 LOG3[17753:1024]: Received signal 2; terminating Can anyone tell me what I am doing wrong? BB

1 0

High CPU system usage on Solaris
by armando.salvatori＠accenture.com 05 Mar '07

05 Mar '07

We use stunnel process to encrypt Oracle connections from a set of 4-6 application server. On the DB server, 20 cpus Solaris machine running Oracle, we have more then 400 LWPS for stunnel and the relative 400 oracle connections. We experience a huge amount of cpu usage (system component), about 40%, after stunnel setup (stunnel 4.15 version) Is it usual? Do you have experience on similar situation? Do you have any suggestions to improve cpu usage or to address performance issue/tuning? Thank you very much AS This message is for the designated recipient only and may contain privileged, proprietary, or otherwise private information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the email by you is prohibited.

1 0

make compile error options.c parse_ocsp_url
by William Biagi 03 Mar '07

03 Mar '07

./configure was successful but the make gave me the following: Making all in src make[1]: Entering directory `/home/bbiagi/stunnel-4.20/src' if gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.20\" -DPACKAGE_STRING=\"stunnel\ 4.20\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.20\" -DHOST=\"i686-pc-linux-gnu\" -DCPU_I686=1 -DVENDOR_PC=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_TCPD_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBZ=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_GETCONTEXT=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/usr\" -DHAVE_OSSL_ENGINE_H=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/include -MT options.o -MD -MP -MF ".deps/options.Tpo" -c -o options.o options.c; \ then mv -f ".deps/options.Tpo" ".deps/options.Po"; else rm -f ".deps/options.Tpo"; exit 1; fi options.c: In function `parse_ocsp_url': options.c:1762: warning: implicit declaration of function `OCSP_parse_url' options.c:1767: structure has no member named `ocsp_addr' options.c:1769: structure has no member named `ocsp_path' options.c: In function `parse_ocsp_flag': options.c:1786: `OCSP_NOCERTS' undeclared (first use in this function) options.c:1786: (Each undeclared identifier is reported only once options.c:1786: for each function it appears in.) options.c:1787: `OCSP_NOINTERN' undeclared (first use in this function) options.c:1788: `OCSP_NOSIGS' undeclared (first use in this function) options.c:1789: `OCSP_NOCHAIN' undeclared (first use in this function) options.c:1790: `OCSP_NOVERIFY' undeclared (first use in this function) options.c:1791: `OCSP_NOEXPLICIT' undeclared (first use in this function) options.c:1792: `OCSP_NOCASIGN' undeclared (first use in this function) options.c:1793: `OCSP_NODELEGATED' undeclared (first use in this function) options.c:1794: `OCSP_NOCHECKS' undeclared (first use in this function) options.c:1795: `OCSP_TRUSTOTHER' undeclared (first use in this function) options.c:1796: `OCSP_RESPID_KEY' undeclared (first use in this function) options.c:1797: `OCSP_NOTIME' undeclared (first use in this function) options.c: At top level: options.c:1758: warning: `parse_ocsp_url' defined but not used options.c:1781: warning: `parse_ocsp_flag' defined but not used make[1]: *** [options.o] Error 1 make[1]: Leaving directory `/home/bbiagi/stunnel-4.20/src' make: *** [all-recursive] Error 1 I am trying to install on a red hat 7.3 with openssl-0.9.6b-18

2 1

RE: Stunnel Forks Out of Control
by Duncan Brown 24 Feb '07

24 Feb '07

Hi all, Ok, I've gone through my last log file for when this issue happens. There's "1130 finished (2 left)" (where 1030 is the port we're listening on) at 10:22am, for example. Then, the next "1130 finished" doesn't happen for about another 20 minutes (which is weird), and then says, "1131 finished (124 left)". It's at this point that a lot of "connection reset by peer"'s happen and "0 bytes sent to SSL" also happen. It looks as though there are a bunch of connections being accepted but not handled. Can anyone assist? The debug level 7 log file is available if necessary. Thanks again, guys. Cheers, Duncan

2 1

RE: Stunnel Forks Out of Control
by Duncan Brown 23 Feb '07

23 Feb '07

Hi all, As an update, it looks like I'm using Stunnel 4.15. I thought it said 4.20, unless I managed to compile an older version. Regardless, I think the problem is happening in both versions. It looks as though it can't catch up on processing cached requests or something. Does that help at all? Cheers, Duncan

1 0

Stunnel Forks Out of Control
by Duncan Brown 21 Feb '07

21 Feb '07

Hi all, I apologize if this issue appears in the archives but I've scoured them and can't find any similar instances (if this problem does occur in the archives then if someone could point it out to me I'd be grateful as well). So, here goes: I'm running Stunnel on Debian Linux. I run it in daemon mode and have the .conf file set to listen on a specific port and redirect to another port. Listening on the connecting end of Stunnel is another daemon I've created that listens on the same port for TCP traffic as part of a client-server application I have (a new process is forked for each connection). On the client end is a .NET application that communicates with the server via TCP with Stunnel installed. In my code, I've made sure that whenever a client-server session is finished, the server closes the socket, whether or not there was an error. Now, everything seems to work flawlessly for a period of time (this period of time is variable, from anywhere between 1 day to 1 month). Then, all of a sudden, Stunnel "explodes"; for example, while there might be one or two forks of my own daemon, there might be 128 instances of Stunnel, all of which are in a sleeping state (that is, if I run ps -aux, their "STAT" attribute is "S"), whereas before it exploded it was pretty much a 1:1 relationship. When it "explodes", I have to kill Stunnel and restart it, which is a pain in the rear-end given what I'm trying to do. Why is it doing this? How do I stop it from happening? I apologize again if this has already been brought up somewhere else, but I've been unable to find any references to any similar problems. If it's a "newbie" mistake or something I'll gladly accept it and learn from it. Please find below the information requested for a problem for the mailing list: - I'm using v4.20 - No parameters are used from the command-line when starting Stunnel; it just uses the standard .conf file which I've edited. - Output of "uname -a" : "Linux buffed 2.4.27-2-386 #1 Wed Aug 17 09:33:35 UTC 2005 i686 GNU/Linux" - I'm using libc v6 - Output of "gcc -v" : Reading specs from /usr/lib/gcc-lib/i486-linux/3.3.5/specs Configured with: ../src/configure -v --enable-languages=c,c++,java,f77,pascal,objc,ada,treelang --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --with-gxx-include-dir=/usr/include/c++/3.3 --enable-shared --enable-__cxa_atexit --with-system-zlib --enable-nls --without-included-gettext --enable-clocale=gnu --enable-debug --enable-java-gc=boehm --enable-java-awt=xlib --enable-objc-gc i486-linux Thread model: posix gcc version 3.3.5 (Debian 1:3.3.5-13) - I'm using OpenSSL v0.9.7e (25 Oct 2004) Thanks in advance for any help. Cheers, Duncan

1 0

Stunnel proxy aware
by Kennet Svanberg 21 Feb '07

21 Feb '07

Hi, I'm quite happy with stunnel-4.05 but don't know how to add any of the proxy patches to make my own windows binaries. I also saw that others have wondered http://linode.mirt.net/pipermail/stunnel-users/2006-December/001404.html

1 0

Stunnel on AIX 5.3 and AIX 5.2 - Solution
by Trevor Maistry 21 Feb '07

21 Feb '07

Hi, I downloaded stunnel version 4.05, changed the configuration file to use "cc" instead of "gcc" and compiled on AIX 5300-04 and AIX 5200-03. Compilations worked fine. However, you must compile on the machine you want to use it on. Otherwise you will have problems. Copy the "stunnel", "stunnel.pem" and sample "stunnel.conf-sample.in" files into /usr/local/bin. Rename the "stunnel.conf-sample.in" to " "stunnel.conf". Change the "stunnel.conf" accordingly and start "stunnel" like so "./stunnel stunnel.conf". Hope this helps. Regards, Trevor Maistry Principal Systems Consultant ============================================= Information and Communication Technology Division University of KwaZulu-Natal King George v Avenue, Durban, 4041 Tel : +2731-2602475 Fax: +2731-2602125 Cell: +2782-787-5583 Email : maistryt(a)ukzn.ac.za =============================================: Please find our Email Disclaimer here: http://www.ukzn.ac.za/disclaimer/

1 0

Re: new Cygwin maintainer for stunnel
by Michal Trojnara 20 Feb '07

20 Feb '07

On Tuesday 20 February 2007 20:59, Andrew Schulman wrote: > Please add Cygwin to the list of "known good" OSes at > http://stunnel.mirt.net/, and add me to the list of maintainers in the > PORTS file. Done. Thank you. Mike

1 0

help
by RICH 16 Feb '07

16 Feb '07

Hi to all i need help i have install stunnel rpm in mandriva but can not find the config file

1 0

stunnel on Qnx 6.3
by Rajashekhar Durgadmath 15 Feb '07

15 Feb '07

Hello All, I am facing problems running stunnel for Qnx 6.3 cross compiled on solaris. I want to provide a https front end to thtttpd (www.acme.com). stunnel starts but fails. Logs are like this: 1980.01.01 15:01:46 LOG5[1069085:1]: stunnel 4.20 on sparc-sun-solaris2.9 with OpenSSL 0.9.8 05 Jul 2005 1980.01.01 15:01:46 LOG5[1069085:1]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 1980.01.01 15:01:46 LOG6[1069085:1]: file ulimit = 1000 (can be changed with 'ulimit -n') 1980.01.01 15:01:46 LOG6[1069085:1]: poll() used - no FD_SETSIZE limit for file descriptors 1980.01.01 15:01:46 LOG5[1069085:1]: 488 clients allowed 1980.01.01 15:01:46 LOG7[1069085:1]: FD 4 in non-blocking mode 1980.01.01 15:01:46 LOG7[1069085:1]: FD 5 in non-blocking mode 1980.01.01 15:01:46 LOG7[1069085:1]: FD 6 in non-blocking mode 1980.01.01 15:01:46 LOG7[1069085:1]: SO_REUSEADDR option set on accept socket 1980.01.01 15:01:46 LOG7[1069085:1]: stunnel bound to xxx.xx.xxx.xxx:443 1980.01.01 15:01:46 LOG7[1073200:1]: Created pid file /stunnel.pid <Browser connects> 1980.01.01 15:05:12 LOG7[1073200:1]: stunnel accepted FD=7 from yyy.yy.yyy.yyy:64822 1980.01.01 15:05:12 LOG7[1073200:2]: stunnel started 1980.01.01 15:05:12 LOG7[1073200:2]: FD 7 in non-blocking mode 1980.01.01 15:05:12 LOG7[1073200:2]: TCP_NODELAY option set on local socket 1980.01.01 15:05:12 LOG5[1073200:2]: stunnel accepted connection from qqq.qqq.qqq.qqq:64822 1980.01.01 15:05:12 LOG5[1073200:2]: Server mode 1980.01.01 15:05:12 LOG7[1073200:2]: SSL state (accept): before/accept initialization 1980.01.01 15:05:12 LOG7[1073200:2]: SSL state (accept): SSLv3 read client hello A 1980.01.01 15:05:12 LOG7[1073200:2]: SSL state (accept): SSLv3 write server hello A 1980.01.01 15:05:12 LOG7[1073200:2]: SSL state (accept): SSLv3 write certificate A 1980.01.01 15:05:12 LOG7[1073200:2]: SSL state (accept): SSLv3 write server done A 1980.01.01 15:05:12 LOG7[1073200:2]: SSL state (accept): SSLv3 flush data 1980.01.01 15:05:12 LOG7[1073200:2]: SSL state (accept): SSLv3 read client key exchange A 1980.01.01 15:05:13 LOG7[1073200:2]: SSL state (accept): SSLv3 read finished A 1980.01.01 15:05:13 LOG7[1073200:2]: SSL state (accept): SSLv3 write change cipher spec A 1980.01.01 15:05:13 LOG7[1073200:2]: SSL state (accept): SSLv3 write finished A 1980.01.01 15:05:13 LOG7[1073200:2]: SSL state (accept): SSLv3 flush data 1980.01.01 15:05:13 LOG7[1073200:2]: 1 items in the session cache 1980.01.01 15:05:13 LOG7[1073200:2]: 0 client connects (SSL_connect()) 1980.01.01 15:05:13 LOG7[1073200:2]: 0 client connects that finished 1980.01.01 15:05:13 LOG7[1073200:2]: 0 client renegotiations requested 1980.01.01 15:05:13 LOG7[1073200:2]: 1 server connects (SSL_accept()) 1980.01.01 15:05:13 LOG7[1073200:2]: 1 server connects that finished 1980.01.01 15:05:13 LOG7[1073200:2]: 0 server renegotiations requested 1980.01.01 15:05:13 LOG7[1073200:2]: 0 session cache hits 1980.01.01 15:05:13 LOG7[1073200:2]: 1 session cache misses 1980.01.01 15:05:13 LOG7[1073200:2]: 0 session cache timeouts 1980.01.01 15:05:13 LOG6[1073200:2]: SSL accepted: new session negotiated 1980.01.01 15:05:13 LOG6[1073200:2]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 < SSL Negotiation done > 1980.01.01 15:08:49 LOG3[1073200:2]: remote socket: Address family not supported by protocol family (247) <<<<<< 1980.01.01 15:08:49 LOG5[1073200:2]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 1980.01.01 15:08:49 LOG7[1073200:2]: stunnel finished (0 left) I checked the address family; it is AF_INET :) socket syscall in client.c:989 is failing. I know the error "Address family not supported by protocol family (247)" says it all, but there are other applications running on the box which do the same thing and it works for them. Versions: OpenSSL 0.9.8 and stunnel 4.20. stunnel.conf ## stunnel.conf starts cert = /etc/localhost_cert.pem key = /etc/localhost_key.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = all ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /some_dir setuid = root setgid = root ; PID is created inside chroot jail pid = /stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /some_dir/stunnel.log [https] accept = <Qnx box IP>:443 connect = <Qnx box IP>:80 ## stunnel.conf end # uname -a QNX localhost 6.3.0 2006/04/27-13:08:16EST armbe It was configured thus: ./configure --prefix=/vob/nmi/3rd_party/stunnel --enable-dependency-tracking --with-ssl=/vob/nmi/3rd_party/openssl/ --build=armbe-qnx --host=sparc-sun-solaris2.9 --with-threads=pthread --disable-libwrap Removing the --disable-libwrap does not help. stunnel is started like this: stunnel /etc/stunnel.conf -d http -r localhost:http -p /etc This also did not help: stunnel /etc/stunnel.conf -d https -r localhost:http -p /etc stunnel /etc/stunnel.conf # stunnel -version stunnel 4.20 on sparc-sun-solaris2.9 with OpenSSL 0.9.8 05 Jul 2005 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Global options debug = 5 pid = /some_path/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /some_path/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /some_path/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Please reply, All comments appreciated. Cheers, Raj --------------------------------- New Yahoo! Mail is the ultimate force in competitive emailing. Find out more at the Yahoo! Mail Championships. Plus: play games and win prizes.

1 0

slow transfer of smtp
by jason kawaja 15 Feb '07

15 Feb '07

greetings. clients connects normally when not using ssl (stunnel). when using ssl the connection on the client end appears to take about a minute but does eventually work (mail is sent through encrypted). shown below is the log with debug=7 and a space between the area where a "pause" seems to be, ideas on what could be occurring during this time to induce the "pause"? client = machine making connection. server = machine running stunnel accepting the connection. 2007.02.14 12:24:06 LOG7[69377:134631424]: imaps accepted FD=9 from client:62847 2007.02.14 12:24:06 LOG7[69377:134633984]: imaps started 2007.02.14 12:24:06 LOG7[69377:134633984]: FD 9 in non-blocking mode 2007.02.14 12:24:06 LOG7[69377:134633984]: TCP_NODELAY option set on local socket 2007.02.14 12:24:06 LOG7[69377:134633984]: FD 10 in non-blocking mode 2007.02.14 12:24:06 LOG7[69377:134633984]: FD 11 in non-blocking mode 2007.02.14 12:24:06 LOG7[69377:134633984]: Connection from client: 62847 permitted by libwrap 2007.02.14 12:24:06 LOG5[69377:134633984]: imaps connected from client:62847 2007.02.14 12:24:06 LOG7[69377:134631424]: Cleaning up the signal pipe 2007.02.14 12:24:06 LOG6[69377:134631424]: Child process 69387 finished with code 0 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): before/ accept initialization 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 read client hello A 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 write server hello A 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 write certificate A 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 write server done A 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 flush data 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 read client key exchange A 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 read finished A 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 write change cipher spec A 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 write finished A 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 flush data 2007.02.14 12:24:06 LOG7[69377:134633984]: 1 items in the session cache 2007.02.14 12:24:06 LOG7[69377:134633984]: 0 client connects (SSL_connect()) 2007.02.14 12:24:06 LOG7[69377:134633984]: 0 client connects that finished 2007.02.14 12:24:06 LOG7[69377:134633984]: 0 client renegotiatations requested 2007.02.14 12:24:06 LOG7[69377:134633984]: 1 server connects (SSL_accept()) 2007.02.14 12:24:06 LOG7[69377:134633984]: 1 server connects that finished 2007.02.14 12:24:06 LOG7[69377:134633984]: 0 server renegotiatiations requested 2007.02.14 12:24:06 LOG7[69377:134633984]: 0 session cache hits 2007.02.14 12:24:06 LOG7[69377:134633984]: 0 session cache misses 2007.02.14 12:24:06 LOG7[69377:134633984]: 0 session cache timeouts 2007.02.14 12:24:06 LOG6[69377:134633984]: SSL accepted: new session negotiated 2007.02.14 12:24:06 LOG6[69377:134633984]: Negotiated ciphers: AES128- SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 2007.02.14 12:24:06 LOG7[69377:134633984]: FD 10 in non-blocking mode 2007.02.14 12:24:06 LOG7[69377:134633984]: imaps connecting server:143 2007.02.14 12:24:06 LOG7[69377:134633984]: connect_wait: waiting 10 seconds 2007.02.14 12:24:06 LOG7[69377:134633984]: connect_wait: connected 2007.02.14 12:24:06 LOG7[69377:134633984]: Remote FD=10 initialized 2007.02.14 12:24:06 LOG7[69377:134633984]: TCP_NODELAY option set on remote socket 2007.02.14 12:24:08 LOG7[69377:134631424]: ssmtp accepted FD=11 from client:62848 2007.02.14 12:24:08 LOG7[69377:134881280]: ssmtp started 2007.02.14 12:24:08 LOG7[69377:134881280]: FD 11 in non-blocking mode 2007.02.14 12:24:08 LOG7[69377:134881280]: TCP_NODELAY option set on local socket 2007.02.14 12:24:08 LOG7[69377:134881280]: FD 12 in non-blocking mode 2007.02.14 12:24:08 LOG7[69377:134881280]: FD 13 in non-blocking mode 2007.02.14 12:24:08 LOG7[69377:134881280]: Connection from client: 62848 permitted by libwrap 2007.02.14 12:24:08 LOG5[69377:134881280]: ssmtp connected from client:62848 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): before/ accept initialization 2007.02.14 12:24:08 LOG7[69377:134631424]: Cleaning up the signal pipe 2007.02.14 12:24:08 LOG6[69377:134631424]: Child process 69391 finished with code 0 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 read client hello A 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 write server hello A 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 write certificate A 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 write server done A 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 flush data 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 read client key exchange A 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 read finished A 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 write change cipher spec A 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 write finished A 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 flush data 2007.02.14 12:24:08 LOG7[69377:134881280]: 2 items in the session cache 2007.02.14 12:24:08 LOG7[69377:134881280]: 0 client connects (SSL_connect()) 2007.02.14 12:24:08 LOG7[69377:134881280]: 0 client connects that finished 2007.02.14 12:24:08 LOG7[69377:134881280]: 0 client renegotiatations requested 2007.02.14 12:24:08 LOG7[69377:134881280]: 2 server connects (SSL_accept()) 2007.02.14 12:24:08 LOG7[69377:134881280]: 2 server connects that finished 2007.02.14 12:24:08 LOG7[69377:134881280]: 0 server renegotiatiations requested 2007.02.14 12:24:08 LOG7[69377:134881280]: 0 session cache hits 2007.02.14 12:24:08 LOG7[69377:134881280]: 0 session cache misses 2007.02.14 12:24:08 LOG7[69377:134881280]: 0 session cache timeouts 2007.02.14 12:24:08 LOG6[69377:134881280]: SSL accepted: new session negotiated 2007.02.14 12:24:08 LOG6[69377:134881280]: Negotiated ciphers: AES128- SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 2007.02.14 12:24:08 LOG7[69377:134881280]: FD 12 in non-blocking mode 2007.02.14 12:24:08 LOG7[69377:134881280]: ssmtp connecting server:25 2007.02.14 12:24:08 LOG7[69377:134881280]: connect_wait: waiting 10 seconds 2007.02.14 12:24:08 LOG7[69377:134881280]: connect_wait: connected 2007.02.14 12:24:08 LOG7[69377:134881280]: Remote FD=12 initialized 2007.02.14 12:24:08 LOG7[69377:134881280]: TCP_NODELAY option set on remote socket 2007.02.14 12:25:06 LOG7[69377:134631424]: imaps accepted FD=13 from client:62850 2007.02.14 12:25:06 LOG7[69377:134882816]: imaps started 2007.02.14 12:25:06 LOG7[69377:134882816]: FD 13 in non-blocking mode 2007.02.14 12:25:06 LOG7[69377:134882816]: TCP_NODELAY option set on local socket 2007.02.14 12:25:06 LOG7[69377:134882816]: FD 14 in non-blocking mode 2007.02.14 12:25:06 LOG7[69377:134882816]: FD 15 in non-blocking mode 2007.02.14 12:25:06 LOG7[69377:134882816]: Connection from client: 62850 permitted by libwrap 2007.02.14 12:25:06 LOG5[69377:134882816]: imaps connected from client:62850 2007.02.14 12:25:06 LOG7[69377:134631424]: Cleaning up the signal pipe 2007.02.14 12:25:06 LOG7[69377:134882816]: SSL state (accept): before/ accept initialization 2007.02.14 12:25:06 LOG6[69377:134631424]: Child process 69478 finished with code 0 2007.02.14 12:25:06 LOG7[69377:134882816]: SSL state (accept): SSLv3 read client hello A 2007.02.14 12:25:06 LOG7[69377:134882816]: SSL state (accept): SSLv3 write server hello A 2007.02.14 12:25:06 LOG7[69377:134882816]: SSL state (accept): SSLv3 write change cipher spec A 2007.02.14 12:25:06 LOG7[69377:134882816]: SSL state (accept): SSLv3 write finished A 2007.02.14 12:25:06 LOG7[69377:134882816]: SSL state (accept): SSLv3 flush data 2007.02.14 12:25:06 LOG7[69377:134882816]: SSL state (accept): SSLv3 read finished A 2007.02.14 12:25:06 LOG7[69377:134882816]: 2 items in the session cache 2007.02.14 12:25:06 LOG7[69377:134882816]: 0 client connects (SSL_connect()) 2007.02.14 12:25:06 LOG7[69377:134882816]: 0 client connects that finished 2007.02.14 12:25:06 LOG7[69377:134882816]: 0 client renegotiatations requested 2007.02.14 12:25:06 LOG7[69377:134882816]: 3 server connects (SSL_accept()) 2007.02.14 12:25:06 LOG7[69377:134882816]: 3 server connects that finished 2007.02.14 12:25:06 LOG7[69377:134882816]: 0 server renegotiatiations requested 2007.02.14 12:25:06 LOG7[69377:134882816]: 1 session cache hits 2007.02.14 12:25:06 LOG7[69377:134882816]: 0 session cache misses 2007.02.14 12:25:06 LOG7[69377:134882816]: 0 session cache timeouts 2007.02.14 12:25:06 LOG6[69377:134882816]: SSL accepted: previous session reused 2007.02.14 12:25:06 LOG7[69377:134882816]: FD 14 in non-blocking mode 2007.02.14 12:25:06 LOG7[69377:134882816]: imaps connecting server:143 2007.02.14 12:25:06 LOG7[69377:134882816]: connect_wait: waiting 10 seconds 2007.02.14 12:25:06 LOG7[69377:134882816]: connect_wait: connected 2007.02.14 12:25:06 LOG7[69377:134882816]: Remote FD=14 initialized 2007.02.14 12:25:06 LOG7[69377:134882816]: TCP_NODELAY option set on remote socket -- Jason Kawaja, 2-4568 IT Expert, UF Dept of ECE

1 1

configure/compile issue on AIX&In-Reply-To=
by Trevor Maistry 09 Feb '07

09 Feb '07

Hi, Does anyone have a version of Stunnel which runs on AIX 5.3? Also, what is the idle timeout set to and how do I change it? Many thanks. Regards, Trevor Maistry Principal Systems Consultant ============================================= Information and Communication Technology Division University of KwaZulu-Natal King George v Avenue, Durban, 4041 Tel : +2731-2602475 Fax: +2731-2602125 Cell: +2782-787-5583 Email : maistryt(a)ukzn.ac.za =============================================: Please find our Email Disclaimer here: http://www.ukzn.ac.za/disclaimer/

1 0

"The most recent stable Stunnel version?"
by Roger Fulton 04 Feb '07

04 Feb '07

Hi, I've checked the support pages. I've browsed the mailing list archives. I've perused the ChangeLog file. I can't find an answer to this question: At http://www.stunnel.org/download/binaries.html is stated "The most recent stable Stunnel version is flagged with a red asterisk (*)." I've used two different browsers, and I'll be danged if I see *any* version marked with *any* asterisk, red or otherwise. Would someone kindly direct this Stunnel newbie to the "most recent stable Stunnel version?" TIA.

2 1

Oracle JDBC Failover not working
by Dario Mariani 02 Feb '07

02 Feb '07

Hi all. We have a problem here with this configuration. before stunnel: BEA Weblogic, 2 JDBC, server1:1521 and server2:1521 Two SunCluster nodes with Oracle OPS/RAC (active-active conf), with NO shared address. So "server1" and "server2" are the phisical address. after stunnel: the JDBC config is 127.0.0.1:10001 and 127.0.0.1:10002 stunnel client is 10001->server1:11521 and 10002->server2:11521 stunnel server is 11521->localhost:1521 When we shut down the server1 (so oracle, listener and stunnel server is not responding), BEA cannot failover. A quick analisys shows that: 1. the JDBC connects to stunnel client, that accept the connection 2. stunnel client fails to connect to stunnel server 3. stunnel client close the connection with the JDBC 4. the JDBC cannot deal with the situation and doesn't failover. It seems like JDBC doesn't failover when he can open a connection but oracle doesn't reply. What i need is: is possible for Stunnel client to FIRST try to connect to the server, and then eventually accept the connection from the jdbc? Bye, dario.

2 1

Intermediate Cert validation problem
by Eric McCombs 31 Jan '07

31 Jan '07

I'm experiencing a problem validating intermediate cert on our Stunnel configuration. We are using Stunnel to forward IMAP, POP and SMTP SSL ports from our vpn server to our internal mail server. We originally used a self-signed cert on the vpn server. When clients connect via Outlook, Outlook Express, Thunderbird and various cell phone mail programs they received a warning message (Unable to verify identity of xxx) about the self-signed cert. To resolve this issue we purchased a SSL cert from Verisign to install on the vpn server. We generated the key and CSR and received the new cert from Verisign, which also requires an intermediate cert for verification. We have tried various methods to have the certs validated, combining the key, intermediate cert and server cert in one file, pointing to the CA_file, etc. but continue to see the Unable to verify identity message. Has anybody else encountered this problem and found a way to resolve the problem? Thanks in advance. Eric McCombs

1 1

(no subject)
by Hemesath, Dean CTR USTRANSCOM J6 25 Jan '07

25 Jan '07

To all, Can Stunnel communicate bi-directionally over a single port? Or does it listen on one and communicate on a different one? Thanks Dean

1 0

dude using stunnel
by aza zel 24 Jan '07

24 Jan '07

hi, is my first message in this list and i send to all of members a great greeting i want to now if this stage is posible (i look the example in your web site that inspired me) NET +---------+ | | +--------+ | non-SSL | -ST---- | | --- | LDAP | | enabled | | | | WITH | | client | | | | SSL | +---------+ | | +--------+ winXP CLIENT | | LDAP SERVER | | +---------+ | | | | ------- | | | | | | | client | +---------+ linux CLIENT In client side i have: - linux clients autenticate via pam and using tls (here i not have problems) :) - win xp (sp2) clients auntenticate via pgina without ssl or tls (i cant make work ssl in pgina (its posible the problem was the server certificate)) :( in server side i have a solaris when run a sun ldap server using a self signed certificate and accepting ssl/tls or not ssl/tls connections :) so, ¿with stunnel only in win side can i have this stage using the self signed cetificate provided by server? Salu2 :D

1 0

Re: [stunnel-users] How is stunnel started ? / Searching stunnel service name
by Ben Stover 22 Jan '07

22 Jan '07

Hmm that is very curious. I investigated now all runnig services and did not found the stunnel service. The only reason I can find for this is that the service name does not contain "stunnel" in its name. How is it called otherwise? My services here (under Win2000) are (when I type "net start" at the command prompt): Alerter AVK Monitor AVK Service AVKProxy COM+ Event System Computer Browser DHCP Client Distributed Link Tracking Client Event Log IPSEC Policy Agent Logical Disk Manager MGABGEXE Network Connections PDFCreatorMessages PDScheduler Plug and Play Print Spooler Protected Storage Remote Access Connection Manager Remote Procedure Call (RPC) Remote Registry Service Removable Storage RunAs Service Security Accounts Manager Server Still Image Service System Event Notification Task Scheduler TCP/IP NetBIOS Helper Service Telephony Washer AutoComplete Windows Management Instrumentation Windows Management Instrumentation Driver Extensions Workstation Is it IPSEC Policy agent the service for stunnel ? Regards Ben On Fri, 19 Jan 2007 08:24:56 -0500, Carter Browne wrote: >One of the installation options is to have it run as a service in which >case it starts automatically as you note. This behavior can be >controlled from the services option in the administrative options of the >control panel (entering services.msc from the command line will also >bring it up). Then name of the service is stunnel. > >Carter > >Ben Stover wrote: >> After installation stunnel started automatically at Windows startup time. >> >> I tried to investigate how it is started. >> But did neither a classic startup folder entry nor a running service entry. >> Did I miss something? >> >> How is stunnel started ? >> >> Ben >> >> >> >> >> ___________________________________________________________ >> All New Yahoo! Mail â¬ Tired of Vi@gr@! come-ons? Let our SpamGuard protect you. http://uk.docs.yahoo.com/nowyoucan.html >> _______________________________________________ >> stunnel-users mailing list >> stunnel-users(a)mirt.net >> http://stunnel.mirt.net/mailman/listinfo/stunnel-users >> >> ___________________________________________________________ Now you can scan emails quickly with a reading pane. Get the new Yahoo! Mail. http://uk.docs.yahoo.com/nowyoucan.html

2 1

SCO 6 Compil of libxml2
by Eric S. Eberhard 22 Jan '07

22 Jan '07

Everyone, With a lot of help from Daniel I got it to work under the new SCO. It takes a few trick: chsysinfo uw7 ./configure --without-zlib --without-threads chsysinfo default make In case anyone else needs to do this :-) Thanks! Eric This email sent by: Eric S. Eberhard (928) 567-3727 Voice http://www.vicsmba.com

1 0

SCO 6 Compil of libxml2
by Eric S. Eberhard 22 Jan '07

22 Jan '07

Everyone, With a lot of help from Daniel I got it to work under the new SCO. It takes a few trick: chsysinfo uw7 ./configure --without-zlib --without-threads chsysinfo default make In case anyone else needs to do this :-) Thanks! Eric This email sent by: Eric S. Eberhard (928) 567-3727 Voice

1 0

Re: [stunnel-users] patch: round robin load balancing
by Michal Trojnara 20 Jan '07

20 Jan '07

Luke wrote: > Here is a simple patch which allows the "connect" option to accept a > comma separated list of names instead of just a single name. This feature is already implemented since version 4.06, 2004.12.26. Here is the relevant frament of ChangeLog: "Multiple connect=host:port options are allowed in a single service section. Remote hosts are connected using round-robin algorithm. This feature is not compatible with delayed resolver." Best regards, Mike

2 2

Error I am receiving in stunnel logfile (help please!)
by Eric S. Eberhard 20 Jan '07

20 Jan '07

Hello Everyone, I tried it on 4.3.3 as well with my re-compiled version ... below are all 5 lines in the log file. stunnel 4.16 on powerpc-ibm-aix4.3.3.0 with OpenSSL 0.9.8c 05 Sep 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 stunnel connected from 127.0.0.1:37690 remote socket: Addr family not supported by protocol (66) Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket I also recompiled the latest stunnel with and without IPv6 ... same result with IPv6 as with IPv4 and same result with the new version: stunnel 4.20 on powerpc-ibm-aix4.3.3.0 with OpenSSL 0.9.8c 05 Sep 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 stunnel accepted connection from ::ffff:127.0.0.1:59274 remote socket: Addr family not supported by protocol (66) Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket I have been using this for a while but I had to transfer to a new machine (AIX 4.3 to 5.3) and had to recompile my software and get a newer stunnel. I am now on 4.20 I thought it might be related to ipv4 versus ipv6 ... according to AIX documentation I had it set up for ipv4. I tried ipv6 for ducks, no difference. My inetd.conf line is: visanet stream tcp nowait root /visanet/ssl/stunnel stunnel visanet stream tcp6 nowait root /visanet/ssl/stunnel stunnel The second is IPv6. The error is somehow on the remote though. I can connect to the remote with telnet ... just not stunnel. It seems that depending on how inetd is configured, stunnel accepts either the IPv4 or IPv6 whether or not I compil it using USE_IPv6 1 or not ... what am I missing!? I really only need to hack it to connect to this one site, at least for the moment. /visanet/ssl/visanet.conf My .conf file is: output = /tmp/stunnel.log debug = 5 RNDfile = /visanet/ssl/stunnel.rnd RNDoverwrite = yes client = yes connect = ssllab.pgs.wcom.net:443 sslVersion = SSLv2 cert = /visanet/ssl/stunnel.pem EGD = /etc/egd-pool My guess is that this is something really stupid I am doing, but it is not obvious. Any help would be appreciated. I would even take an AIX executable for stunnel that works! Or whatever the correct configure options are. Or???? Thanks, Eric This email sent by: Eric S. Eberhard (928) 567-3727 Voice (928) 567-6122 Fax 928-301-7537 -- you may call any time day or night, I turn it off when I sleep :-) Please try to use a land line first (reception often poor). Note the change in the domain from vicspdi.com to vicsmba.com !!!! For Metropolis support and VICS MBA Support!!!! http://www.vicsmba.com Completely updated web site of personal pictures with many new pictures! Includes horses, dogs, Corvairs, and more. http://www.vicsmba.com/ourpics/index.html Corvair pictures including the Judson setup on our 62 Sedan and lots of pictures of Cheryl's 62 Monza Wagon and our 62 Spyder convertible. http://www.vicsmba.com/ourpics/corvairs.html My younger brother Martin has started a very serious car company. A hot rod (very fast) electric roadster is the first offering. The chassis is built by Lotus to their specs. Check it out: http://www.teslamotors.com _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users This email sent by: Eric S. Eberhard (928) 567-3727 Voice (928) 567-6122 Fax 928-301-7537 -- you may call any time day or night, I turn it off when I sleep :-) Please try to use a land line first (reception often poor). Note the change in the domain from vicspdi.com to vicsmba.com !!!! For Metropolis support and VICS MBA Support!!!! http://www.vicsmba.com Completely updated web site of personal pictures with many new pictures! Includes horses, dogs, Corvairs, and more. http://www.vicsmba.com/ourpics/index.html Corvair pictures including the Judson setup on our 62 Sedan and lots of pictures of Cheryl's 62 Monza Wagon and our 62 Spyder convertible. http://www.vicsmba.com/ourpics/corvairs.html My younger brother Martin has started a very serious car company. A hot rod (very fast) electric roadster is the first offering. The chassis is built by Lotus to their specs. Check it out: http://www.teslamotors.com

1 0

Re: [stunnel-users] How is stunnel started ?
by Gonzalo Diethelm 19 Jan '07

19 Jan '07

Probably through a Run entry in the registry. You should definitely try to use something like CodeStuff's Starter: http://members.lycos.co.uk/codestuff/ Best regards. On Fri, 2007-01-19 at 09:31 +0100, Ben Stover wrote: > After installation stunnel started automatically at Windows startup time. > > I tried to investigate how it is started. > But did neither a classic startup folder entry nor a running service entry. > Did I miss something? > > How is stunnel started ? > > Ben > > > > > ___________________________________________________________ > All New Yahoo! Mail – Tired of Vi@gr@! come-ons? Let our SpamGuard protect you. http://uk.docs.yahoo.com/nowyoucan.html > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > -- Gonzalo Diethelm gonzalo.diethelm(a)aditiva.com

2 2

Error I am receiving in stunnel logfile (more info)
by Eric S. Eberhard 18 Jan '07

18 Jan '07

Hello Everyone, I tried it on 4.3.3 as well with my re-compiled version ... below are all 5 lines in the log file. stunnel 4.16 on powerpc-ibm-aix4.3.3.0 with OpenSSL 0.9.8c 05 Sep 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 stunnel connected from 127.0.0.1:37690 remote socket: Addr family not supported by protocol (66) Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket I have been using this for a while but I had to transfer to a new machine (AIX 4.3 to 5.3) and had to recompile my software and get a newer stunnel. My version is stunnel-3.8p4: I thought it might be related to ipv4 versus ipv6 ... according to AIX documentation I had it set up for ipv4. I tried ipv6 for ducks, no difference. My inetd.conf line is: visanet stream tcp nowait root /visanet/ssl/stunnel stunnel /visanet/ssl/visanet.conf My .conf file is: output = /tmp/stunnel.log debug = 5 RNDfile = /visanet/ssl/stunnel.rnd RNDoverwrite = yes client = yes connect = ssllab.pgs.wcom.net:443 sslVersion = SSLv2 cert = /visanet/ssl/stunnel.pem EGD = /etc/egd-pool My guess is that this is something really stupid I am doing, but it is not obvious. Any help would be appreciated. Thanks, Eric This email sent by: Eric S. Eberhard (928) 567-3727 Voice (928) 567-6122 Fax 928-301-7537 -- you may call any time day or night, I turn it off when I sleep :-) Please try to use a land line first (reception often poor). Note the change in the domain from vicspdi.com to vicsmba.com !!!! For Metropolis support and VICS MBA Support!!!! http://www.vicsmba.com Completely updated web site of personal pictures with many new pictures! Includes horses, dogs, Corvairs, and more. http://www.vicsmba.com/ourpics/index.html Corvair pictures including the Judson setup on our 62 Sedan and lots of pictures of Cheryl's 62 Monza Wagon and our 62 Spyder convertible. http://www.vicsmba.com/ourpics/corvairs.html My younger brother Martin has started a very serious car company. A hot rod (very fast) electric roadster is the first offering. The chassis is built by Lotus to their specs. Check it out: http://www.teslamotors.com

1 0

Error I am receiving in stunnel logfile
by Eric S. Eberhard 18 Jan '07

18 Jan '07

Hello Everyone, remote socket: Addr family not supported by protocol (66) I have been using this for a while but I had to transfer to a new machine (AIX 4.3 to 5.3) and had to recompile my software and get a newer stunnel. My version is stunnel-3.8p4: My .conf file is: output = /tmp/stunnel.log debug = 5 RNDfile = /visanet/ssl/stunnel.rnd RNDoverwrite = yes client = yes connect = ssllab.pgs.wcom.net:443 sslVersion = SSLv2 cert = /visanet/ssl/stunnel.pem EGD = /etc/egd-pool My guess is that this is something really stupid I am doing, but it is not obvious. Any help would be appreciated. Thanks, Eric This email sent by: Eric S. Eberhard (928) 567-3727 Voice (928) 567-6122 Fax 928-301-7537 -- you may call any time day or night, I turn it off when I sleep :-) Please try to use a land line first (reception often poor). Note the change in the domain from vicspdi.com to vicsmba.com !!!! For Metropolis support and VICS MBA Support!!!! http://www.vicsmba.com Completely updated web site of personal pictures with many new pictures! Includes horses, dogs, Corvairs, and more. http://www.vicsmba.com/ourpics/index.html Corvair pictures including the Judson setup on our 62 Sedan and lots of pictures of Cheryl's 62 Monza Wagon and our 62 Spyder convertible. http://www.vicsmba.com/ourpics/corvairs.html My younger brother Martin has started a very serious car company. A hot rod (very fast) electric roadster is the first offering. The chassis is built by Lotus to their specs. Check it out: http://www.teslamotors.com

1 0

RE: [stunnel-users] Does editing *.conf file require restart of stunnel ?
by Stunnel 15 Jan '07

15 Jan '07

Hi, As far as I know the service needs to be restarted to load the new configuration. Regards Craig -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Ben Stover Sent: 15 January 2007 01:16 PM To: stunnel-users(a)mirt.net Subject: [stunnel-users] Does editing *.conf file require restart of stunnel ? Hello, sorry for this newbie question. I did not found the answer in the FAQ. Assume I edit the *.conf file. Is it required to restrat stunnel (service) to enable the changes ? Or is the *.conf file read at ever new stunnel call? If explicit restart is required: would it be possible to add a context menu entry to the Windows systray-Stunnel-icon "restart". This would make handling much more comfortable than always opening a command line window and entering all the commands manually. Thank you Ben ___________________________________________________________ Try the all-new Yahoo! Mail. "The New Version is radically easier to use" - The Wall Street Journal http://uk.docs.yahoo.com/nowyoucan.html _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

re: Problem with certificates using smtp/pop
by Klaas 12 Jan '07

12 Jan '07

> cert = /path/to/certnew.cer > key = /path/to/stunnel.pem > Or concatenate them into one file and use cert = ... only > (no key = ...). > Also take care that the CN is the server FQDN to which the client > connects. Thanks, it works now perfect!

1 0

Re: [stunnel-users] re: Problem with certificates using smtp/pop
by Hans Werner Strube 11 Jan '07

11 Jan '07

"Klaas" wrote: > I have a part I sent to CA created whit openssl req -new -days > 365 -nodes -config stunnel.cnf -out certreq.pem -keyout stunnel.pem > > I have get return a file certnew.cer and I have the file stunnel.pem. And > now I don't know what I have to do next to get this certificate. I have > tried several options but no one works. cert = /path/to/certnew.cer key = /path/to/stunnel.pem Or concatenate them into one file and use cert = ... only (no key = ...). Also take care that the CN is the server FQDN to which the client connects.

1 0

re: Problem with certificates using smtp/pop
by Klaas 11 Jan '07

11 Jan '07

Sorry David that I have misted you e-mail. I'm using stunnel on a Windows server and I have working it all. I use outlook express as mail client and when I pres OK on the message of the certificate it works. But I want to install a real certificate. Only I don't exactly where I have place which part of the certificate and what I place into the stunnel.conf I have a part I sent to CA created whit openssl req -new -days 365 -nodes -config stunnel.cnf -out certreq.pem -keyout stunnel.pem I have get return a file certnew.cer and I have the file stunnel.pem. And now I don't know what I have to do next to get this certificate. I have tried several options but no one works.

1 0

Problems with Powerposter?
by Roger Stevens 10 Jan '07

10 Jan '07

I'm curious if anyone else has tried Stunnel with Powerposter on the Giganews Usenet network. I (and many other users) have reported problems whereby the post does not complete and just hangs. Per Giganews, this is a software problem and not their servers. Non-SSL posting in Powerposter works fine. but hangs when Stunnel is used usually after a couple of files are successfully uploaded. Any else run into this? TIA! Roger

1 0

re: Problem with certificates using smtp/pop
by David Chase 10 Jan '07

10 Jan '07

I tried sending directly to you, I must have looked like a spammer. I am ever so slightly pleased to see that I have some company in my frustration with this software. I'll try to help, since the experts seem to be too busy. I've only used it twice, and it was painful both times. Have you gotten it to work at all? That is, what do you see? Do you get a running stunnel process? Do you have (with permissions) ls -l /usr/local/etc/stunnel/mail.pem -rw------- 1 root staff 2233 Jan 5 17:25 /usr/local/etc/stunnel/ mail.pem I created it by running this command in that directory: sudo openssl req -new -out mail.pem -keyout mail.pem -nodes -x509 - days 365 I created a stupid certificate, because at some point it looked like it was asking me for my name (David Chase) when what they wanted was my fully qualified domain name (dr2chase.org), so that part of the certificate is wrong. The certificate creation in the makefile asked for this in a slightly more sensible way, using the abbreviation "FQDN", though you have to wonder how busy the authors of some of this security software are, that they cannot take the time to type in "Fully qualified domain name", and instead expect us to figure it out. It can be whiny about permissions, in a non-specific way (as if the software ran a one-way-hash on the permissions, didn't get a match, and expected you to just guess till it worked.) sudo chmod 600 /usr/local/etc/stunnel/mail.pem sudo chmod 755 /usr/local/etc/stunnel/ sudo chown root /usr/local/etc/stunnel/stunnel.conf You'll need to copy the sample stunnel.conf file into the real one: sudo cp /usr/local/etc/stunnel/stunnel.conf-sample /usr/local/etc/ stunnel/stunnel.conf You might want to look it over, though I don't recall changing much in mine. You might want to turn on debug logging there; mine seemed to spew in the invoking terminal, instead of any file that I could find, but that was good enough for a start: debug = 7 output = stunnel.log Some part of stunnel created its chroot directory with incorrect (for MacOS, at least) permissions: % ls -ld /usr/local/var/lib/stunnel/ 948 drwxrwx--T 2 root wheel 68 Jan 5 16:55 /usr/local/var/lib/ stunnel/ That's the one that didn't work, and clearly someone thought carefully about giving it the wrong permissions -- that "T" didn't get there accidentally. This caused silent failure for me. What worked, but might not be secure, is drwxrwxrwx 2 root wheel 68 Jan 6 00:16 /usr/local/var/lib/stunnel/ My guess is that it would be better if it were owned by nobody/nogroup, but this is clearly something that trained experts should GET RIGHT, instead of leaving it busted for novices to tinker with. What mail reader are you using? For example, Apple Mail's "connection doctor" will treat an unofficial certificate as a connection failure; only when you actually try to receive or send mail, will you get a chance to trust the certificate. Perhaps my sarcastic remarks will cause someone to actually fix something. Who knows. yours, David Chase

1 0

STunnel not creating connections.
by Paul Morrison 09 Jan '07

09 Jan '07

I have a problem perhaps someone can help me with. I have setup Stunnel and OpenSSL on a Windows 2003 server. It is configured to accept data on TCP port 2000, decrypt it, then pass it on to TCP port 8014. I have placed the certificates provided for this in a directory and I have told STunnel where these certificates are. The problem I am having is I can see the connection from port 2000 coming in to the system, but STunnel then does nothing before finally dropping the connection. The version of STunnel and OpenSSL are (stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005) I have the same setup at a different site on a different server and it works fine. In the debug.log the following is output: 2007.01.09 13:41:02 LOG7[684:352]: MATSU_GPRS started 2007.01.09 13:41:02 LOG7[684:352]: FD 196 in non-blocking mode 2007.01.09 13:41:02 LOG5[684:352]: MATSU_GPRS connected from 212.183.136.192:57511 2007.01.09 13:41:02 LOG7[684:352]: SSL state (accept): before/accept initialization 2007.01.09 13:41:22 LOG3[684:352]: SSL_accept: Peer suddenly disconnected 2007.01.09 13:41:22 LOG5[684:352]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.01.09 13:41:22 LOG7[684:352]: MATSU_GPRS finished (0 left) I would normally expect to see details of the SSL connection and the certificates being checked after the line 2007.01.09 13:41:02 LOG7[684:352]: SSL state (accept): before/accept initialization, but as you can see it does nothing before dropping the connection after 20 seconds. Does anyone know why this installation of STunnel does not seem to be attempting to use the certificates provided? I would be very grateful for any advice. P.S. Do I need to have a Certifcate Authority server setup at the site in order for STunnel to work? Paul Morrison IT Support Specialist TS3 Services Ltd Castle Court, Carnegie Campus Dunfermline KY11 8PB TEL: 01383 629900 Mob: 07918078864 EMAIL: Paul.Morrison(a)ts3services.co.uk <BLOCKED::mailto:[email protected]>

1 0

Problem with certificates using smtp /pop
by Klaas 09 Jan '07

09 Jan '07

Isn't there no one who knows how do deal with certificate? > Is there no one who can tell me exactly which part of the > certificate I have to place where and how I must configure > stunnel.conf for the certificate >> I have installed stunnel 4.20 on Windows2003 server and have >> created my private key as follow: >> openssl req -new -days 365 -nodes -config stunnel.cnf -out >> certreq.pem -keyout stunnel.pem >> >> After that I have send certreq.pem to my own CA and have >> received a certnew.cer file. But what I have to do next because >> I still receive the message that the CN-name of the certificate >> is not the same with the given name. >> >> I append this certificate (certnew.cer) to my stunnel.pem file like: >> -----BEGIN RSA PRIVATE KEY----- >> data here >> -----END RSA PRIVATE KEY----- >> -----BEGIN CERTIFICATE----- >> data here >> -----END CERTIFICATE----- >> >> But this doesn't work. Still receive the message that I also read >> on the stunnel.conf must I config something here? >> cert = stunnel.pem >> key = stunnel.pem >> >> ; Authentication stuff >> ;verify = 2 >> ; Don't forget to c_rehash CApath >> ;CApath = certs >> ; It's often easier to use CAfile >> ;CAfile = certs.pem >> ; Don't forget to c_rehash CRLpath >> ;CRLpath = crls >> ; Alternatively you can use CRLfile >> ;CRLfile = crls.pem >> >> Can anyone tell me please what certificate I place where and how config >> the stunnel.conf so I get this working?

1 0

RE: [stunnel-users] URL changes in browser to http from https
by Casey Rayman 08 Jan '07

08 Jan '07

I figured it out. The webserver was redirecting me to the index.html page so that is where the protocol was getting changed. So now the question changes. Is there a function in stunnel for URL rewriting? In otherwords the webserver sends back "redirect yourself to http:// but stunnel intercepts that before it gets back to your browser to keep the connection secure? Thanks, Casey -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Casey Rayman Sent: Monday, January 08, 2007 10:10 AM To: stunnel-users(a)mirt.net Subject: [stunnel-users] URL changes in browser to http from https I am just starting to experiment with stunnel on Debian Linux, using the standard debian packages. I've got it working so far accepting requests on the local port 443 and connecting on 80, but when the page loads the URL changes back to a non-secure address. To illustrate: https://192.168.1.10 loads a simple static web page and you get the normal warning for the certificate, but after the page loads the URL changes to http://192/168.1.10 . I thought this might just be IE or something but Firefox does it too. Could I be missing a setting in stunnel? Any ideas? Thank you, Casey _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

URL changes in browser to http from https
by Casey Rayman 08 Jan '07

08 Jan '07

I am just starting to experiment with stunnel on Debian Linux, using the standard debian packages. I've got it working so far accepting requests on the local port 443 and connecting on 80, but when the page loads the URL changes back to a non-secure address. To illustrate: https://192.168.1.10 loads a simple static web page and you get the normal warning for the certificate, but after the page loads the URL changes to http://192/168.1.10 . I thought this might just be IE or something but Firefox does it too. Could I be missing a setting in stunnel? Any ideas? Thank you, Casey

1 0

Problem with certificates using smtp /pop
by Klaas 08 Jan '07

08 Jan '07

Is there no one who can tell me exactly which part of the certificate I have to place where and how I must configure stunnel.conf for the certificate

1 0

patch: round robin load balancing
by Luke Deller 08 Jan '07

08 Jan '07

Hi, I noticed that stunnel already does round-robin load balancing of connections when the DNS name specified by the "connect" option resolves to multiple IP addresses. Here is a simple patch which allows the "connect" option to accept a comma separated list of names instead of just a single name. This can be used to load balance tunnelled connections across several servers. For example, to load balance HTTPS connections across 3 HTTP servers (localhost:80, anotherhost:8080 and anotherhost:8081), we could specify: [https] accept = 443 connect = 80,anotherhost:8080,anotherhost:8081 Regards, Luke. ********************************************************************************************** Important Note This email (including any attachments) contains information which is confidential and may be subject to legal privilege. If you are not the intended recipient you must not use, distribute or copy this email. If you have received this email in error please notify the sender immediately and delete this email. Any views expressed in this email are not necessarily the views of XPlan Technology. It is the duty of the recipient to virus scan and otherwise test the information provided before loading onto any computer system. Xplan Technology does not warrant that the information is free of a virus or any other defect or error. **********************************************************************************************

1 0

re: I am clearly doing something wrong
by David Chase 06 Jan '07

06 Jan '07

Foolishly, I trusted it to create /usr/local/var/lib/stunnel/ with the correct permissions. The directory that appeared had these permissions: ls -ld /usr/local/var/lib/stunnel/ drwxrwx--T 2 root wheel 68 Jan 5 16:55 /usr/local/var/lib/stunnel/ When I replaced it with this directory ls -ld /usr/local/var/lib/stunnel/ drwxrwxrwx 3 root wheel 102 Jan 5 20:43 /usr/local/var/lib/stunnel/ Suddenly, when I ran stunnel, it continued to run. I'd call this a bug. Still not doing quite what I want, (not connecting to elsewhere.com like I expect) but I'm closer. David Chase

1 0

I am clearly doing something wrong
by David Chase 05 Jan '07

05 Jan '07

But I think the documentation has some serious gaps in it, too. I compiled stunnel, installed it, created certificates, and even turned on debugging in the configuration file. Now, all I want to do is forward port 443 locally to port 80 elsewhere. Says my config file: cert = /usr/local/etc/stunnel/mail.pem ;key = /usr/local/etc/stunnel/mail.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /usr/local/var/lib/stunnel/ setuid = nobody setgid = nogroup ; PID is created inside chroot jail pid = /stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode ; client = yes ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 25 [https] accept = 443 connect = elsewhere.com:80 TIMEOUTclose = 0 and when I run it, it says: sudo /usr/local/sbin/stunnel Password: 2007.01.05 18:51:01 LOG7[13470:2684415368]: Snagged 64 random bytes from /Users/chase/.rnd 2007.01.05 18:51:01 LOG7[13470:2684415368]: Wrote 1024 new random bytes to /Users/chase/.rnd 2007.01.05 18:51:01 LOG7[13470:2684415368]: RAND_status claims sufficient entropy for the PRNG 2007.01.05 18:51:01 LOG7[13470:2684415368]: PRNG seeded successfully 2007.01.05 18:51:01 LOG7[13470:2684415368]: Certificate: /usr/local/ etc/stunnel/mail.pem 2007.01.05 18:51:01 LOG7[13470:2684415368]: Certificate loaded 2007.01.05 18:51:01 LOG7[13470:2684415368]: Key file: /usr/local/etc/ stunnel/mail.pem 2007.01.05 18:51:01 LOG7[13470:2684415368]: Private key loaded 2007.01.05 18:51:01 LOG7[13470:2684415368]: SSL context initialized for service pop3s 2007.01.05 18:51:01 LOG7[13470:2684415368]: Certificate: /usr/local/ etc/stunnel/mail.pem 2007.01.05 18:51:01 LOG7[13470:2684415368]: Certificate loaded 2007.01.05 18:51:01 LOG7[13470:2684415368]: Key file: /usr/local/etc/ stunnel/mail.pem 2007.01.05 18:51:01 LOG7[13470:2684415368]: Private key loaded 2007.01.05 18:51:01 LOG7[13470:2684415368]: SSL context initialized for service imaps 2007.01.05 18:51:01 LOG7[13470:2684415368]: Certificate: /usr/local/ etc/stunnel/mail.pem 2007.01.05 18:51:01 LOG7[13470:2684415368]: Certificate loaded 2007.01.05 18:51:01 LOG7[13470:2684415368]: Key file: /usr/local/etc/ stunnel/mail.pem 2007.01.05 18:51:01 LOG7[13470:2684415368]: Private key loaded 2007.01.05 18:51:01 LOG7[13470:2684415368]: SSL context initialized for service ssmtp 2007.01.05 18:51:01 LOG7[13470:2684415368]: Certificate: /usr/local/ etc/stunnel/mail.pem 2007.01.05 18:51:01 LOG7[13470:2684415368]: Certificate loaded 2007.01.05 18:51:01 LOG7[13470:2684415368]: Key file: /usr/local/etc/ stunnel/mail.pem 2007.01.05 18:51:01 LOG7[13470:2684415368]: Private key loaded 2007.01.05 18:51:01 LOG7[13470:2684415368]: SSL context initialized for service https I see nothing that looks like a complaint, but when I go looking for a stunnel process, there is not one, nor is anyone listening on port 443 at localhost. I cannot be the first person who wanted to do this, but I found both the FAQ and the documentation to be uninformative. How do I keep stunnel running and listening for connections on 443? I tried client=yes, that didn't seem to help. I am running Stunnel 4.20 on MacOS 10.4.8 David Chase

1 0

STunnel transparent + Solaris
by Corey Johnston 05 Jan '07

05 Jan '07

The documentation mentions that Solaris should support transparent mode for stunnel, yet I receive bind errors when I try to do this. "bind transparent: Cannot assign requested adddress (126)" Seems to suggest that either its actually not possible, or I've got to include something beyond "transparent = yes" in the conf file, or during compilation. Does anybody know if there's anything else special to make this work? Thanks in advance, Corey

2 1

Red Hat 7.0, Stunnel 4.20, and my Transparent Proxy Woes
by Richard Anderson 03 Jan '07

03 Jan '07

All, I'm attempting to setup Stunnel 4.20 on a RH7.0 box in transparent mode to essentially act as an SSL accelerator. I've gotten the SSL accelerator part to work (which means RH and Stunnel are working fine). But it's when I enable the transparent feature of stunnel I start having problems. The error it returns is : bind transparent: Cannot assign requested address (99) What I know is this: For transparent option to work with stunnel you must be using linux kernel 2.2. (check...red hat 7.0) Transparent proxy option must be enabled in kernel. (check, enabled, recompiled, and booted off that image) IP_FORWARD must be enabled. (check, set this in the sysctl.conf to do it on bootup) But it still won't work. Does anybody have any other ideas as to what I'm missing? thanks, rich _________________________________________________________________ Get FREE Web site and company branded e-mail from Microsoft Office Live http://clk.atdmt.com/MRT/go/mcrssaub0050001411mrt/direct/01/

1 0

Problem with certificates using smtp /pop
by Klaas 29 Dec '06

29 Dec '06

Hello, I have installed stunnel 4.20 on Windows2003 server and have created my private key as follow: openssl req -new -days 365 -nodes -config stunnel.cnf -out certreq.pem -keyout stunnel.pem After that I have send certreq.pem to my own CA and have received a certnew.cer file. But what I have to do next because I still receive the message that the CN-name of the certificate is not the same with the given name. I append this certificate (certnew.cer) to my stunnel.pem file like: -----BEGIN RSA PRIVATE KEY----- data here -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- data here -----END CERTIFICATE----- But this doesn't work. Still receive the message that I also read on the stunnel.conf must I config something here? cert = stunnel.pem key = stunnel.pem ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem Can anyone tell me what certificate I place where and how config the stunnel.conf so I get this working?

1 0

Avira Anti-Vir Detects stunnel as virus
by Daniel Tschinder 26 Dec '06

26 Dec '06

I'm using Avira AntiVir (www.free-av.de) and it detects stunnel 4.20 as virus APPL/Stunnel.A . I do not know what to do against it... as you can see in this list, stunnel was added to the signatures Database of AntiVir: http://www.avira.de/en/threats/section/vdfhistory/vdf_no/6.37.00.53/6.37.00… Maybe one of the devs can check back with avira.... best regards, daniel

2 1

Benchmarks
by Michal Trojnara 17 Dec '06

17 Dec '06

Dear Users, I have updated stunnel performance benchmarks: http://stunnel.mirt.net/perf.html I hope you'll find them useful. The funny thing I currently have 2 hardware accelerator cards, but none of them works: - one of them is too obsolete and its proprietary drivers are no longer available; - the other one is too modern and its PCI-X slot does not work with my ASUS P5WDG2 WS Professional motherboard. I'm pretty sure most users won't even be able to utilize the performance provided by software implementation. The bottleneck will most likely be network connection or the destination server performance. Best regards, Mike

1 0

service reconfiguration by SIGHUP
by Matthew Eaton 15 Dec '06

15 Dec '06

Hi, I've created a patch to Stunnel that reloads all accepting connections from the config file. This will not work for privileged ports in the current implementation. Test at your own risk :) Feedback welcome. Best regards, Matthew diff -urb stunnel-orig/stunnel-4.20/src/stunnel.c stunnel-4.20/src/stunnel.c --- stunnel-orig/stunnel-4.20/src/stunnel.c 2006-11-30 15:47:45.000000000 -0500 +++ stunnel-4.20/src/stunnel.c 2006-12-12 03:34:36.000000000 -0500 @@ -53,12 +53,12 @@ #endif int volatile num_clients=0; /* Current number of clients */ +int volatile conf_updated=0; /* Conf updated ? */ /* Functions */ #ifndef USE_WIN32 int main(int argc, char* argv[]) { /* execution begins here 8-) */ - main_initialize(argc>1 ? argv[1] : NULL, argc>2 ? argv[2] : NULL); signal(SIGPIPE, SIG_IGN); /* avoid 'broken pipe' signal */ @@ -78,12 +78,17 @@ } #endif +char *cfg_arg1 = NULL; +char *cfg_arg2 = NULL; + void main_initialize(char *arg1, char *arg2) { ssl_init(); /* initialize SSL library */ sthreads_init(); /* initialize critical sections & SSL callbacks */ parse_config(arg1, arg2); log_open(); stunnel_info(0); + cfg_arg1 = arg1; + cfg_arg2 = arg2; } void main_execute(void) { @@ -105,6 +110,7 @@ SOCKADDR_UNION addr; s_poll_set fds; LOCAL_OPTIONS *opt; + int i; get_limits(); s_poll_zero(&fds); #if !defined(USE_WIN32) && !defined(USE_OS2) @@ -173,6 +179,42 @@ accept_connection(opt); } + if(conf_updated) { + for(i=0; i<fds.nfds; i++) + close(fds.ufds[i].fd); + + /* re-bind local ports */ + for(opt=local_options.next; opt; opt=opt->next) { + if(!opt->option.accept) /* no need to bind this service */ + continue; + memcpy(&addr, &opt->local_addr.addr[0], sizeof(SOCKADDR_UNION)); + if((opt->fd=socket(addr.sa.sa_family, SOCK_STREAM, 0))<0) { + sockerror("local socket"); + exit(1); + } + if(alloc_fd(opt->fd)) + exit(1); + if(set_socket_options(opt->fd, 0)<0) + exit(1); + s_ntop(opt->local_address, &addr); + if(bind(opt->fd, &addr.sa, addr_len(addr))) { + s_log(LOG_ERR, "Error binding %s to %s", + opt->servname, opt->local_address); + sockerror("bind"); + exit(1); + } + s_log(LOG_DEBUG, "%s bound to %s", opt->servname, opt->local_address); + if(listen(opt->fd, 5)) { + sockerror("listen"); + exit(1); + } +#ifdef FD_CLOEXEC + fcntl(opt->fd, F_SETFD, FD_CLOEXEC); /* close socket in child execvp */ +#endif + s_poll_add(&fds, opt->fd, 1, 0); + } + conf_updated = 0; + } } s_log(LOG_ERR, "INTERNAL ERROR: End of infinite loop 8-)"); } @@ -413,9 +455,16 @@ } static void signal_handler(int sig) { /* signal handler */ + if((sig==SIGHUP) && local_options.next) { /* only in service mode */ + s_log(LOG_NOTICE, "Re-reading configuration"); + parse_config(cfg_arg1, cfg_arg2); + conf_updated = 1; + } + else { s_log(sig==SIGTERM ? LOG_NOTICE : LOG_ERR, "Received signal %d; terminating", sig); exit(3); + } } #endif /* !defined USE_WIN32 */

1 2

stunnel patch to support URL lookups for parameters (take 2)
by Dan Jakubiec 13 Dec '06

13 Dec '06

Attached is a patch which extends the "connect=" and "CApath=" options to allow these parameters to be obtained dynamically at connect-time via a URL lookup, rather than statically from the stunnel configuration file. It is a generalization of an earlier patch to 4.04 submitted by Jan Piet-Mens which does something similar using LDAP lookups. Feedback is appreciated! Here is a summary of the functionality, along with some notes: 1. The patch was written to allow stunnel to dynamically route and authenticate incoming connections based on parameters found in the client's certificate. 2. Routing and authentication information is obtained by issuing a URL lookup, so the information can be obtained from a variety of local or remote sources. 3. It is particularly useful in high-volume, load-balancing scenarios where many copies of stunnel are running on multiple front-end servers. It allows the destination socket and client certificate verification info to be obtained on-the-fly from a centralized database. 4. Although primarily intended for use with HTTP, this patch uses the libcurl URL library and should work with all of its supported protocols: HTTP, HTTPS, FTP, FTPS, TFTP, DICT, TELNET, LDAP or FILE. As a brief example, an end-user might configure their stunnel as follows: cert = id.pem verify = 2 CApath = ca_dir CAlookup = http://database.stunnel.org/map_client.php?hash=%h [dynamic] accept = 50000 connect = @http://database.stunnel.org/map_client.php?common_name=%n In this scenario, an incoming stunnel connection would obtain it's connect info from database.stunnel.org by sending an HTTP request and passing the common name found in the client certificate. Similarly, the client's certificate would be verified using CA certificates obtained via HTTP lookup to the same host. Comments are appreciated. Thanks, Dan Jakubiec

1 0

stunnel patch to support URL lookups for parameters
by Dan Jakubiec 13 Dec '06

13 Dec '06

Attached is a patch which extends the "connect=" and "CApath=" options to allow these parameters to be obtained dynamically at connect-time via a URL lookup, rather than statically from the stunnel configuration file. It is a generalization of an earlier patch to 4.04 submitted by Jan Piet-Mens which does something similar using LDAP lookups. Feedback is appreciated! Here is a summary of the functionality, along with some notes: 1. The patch was written to allow stunnel to dynamically route and authenticate incoming connections based on parameters found in the client's certificate. 2. Routing and authentication information is obtained by issuing a URL lookup, so the information can be obtained from a variety of local or remote sources. 3. It is particularly useful in high-volume, load-balancing scenarios where many copies of stunnel are running on multiple front-end servers. It allows the destination socket and client certificate verification info to be obtained on-the-fly from a centralized database. 4. Although primarily intended for use with HTTP, this patch uses the libcurl URL library and should work with all of its supported protocols: HTTP, HTTPS, FTP, FTPS, TFTP, DICT, TELNET, LDAP or FILE. As a brief example, an end-user might configure their stunnel as follows: cert = id.pem verify = 2 CApath = ca_dir CAlookup = http://database.stunnel.org/map_client.php?hash=%h <http://database.stunnel.org/map_client.php?hash=%25h> [dynamic] accept = 50000 connect = @http://database.stunnel.org/map_client.php?common_name=%n<http://database.stunnel.org/map_client.php?common_name=%25n> In this scenario, an incoming stunnel connection would obtain it's connect info from database.stunnel.org by sending an HTTP request and passing the common name found in the client certificate. Similarly, the client's certificate would be verified using CA certificates obtained via HTTP lookup to the same host. Comments are appreciated. Thanks, Dan Jakubiec

1 0

Re: [stunnel-users] service reconfiguration by SIGHUP
by Hans Werner Strube 13 Dec '06

13 Dec '06

Matthew Eaton wrote: > I've created a patch to Stunnel that reloads all accepting connections > from the config file. This will not work for privileged ports in the > current implementation. Please explain why it will not work for privileged ports. Does this hold even if the master stunnel process runs as root? And what happens to active connections on SIGHUP? Are they simply broken?

2 1

Re: [stunnel-users] STunnel performance Issues
by Michal Trojnara 11 Dec '06

11 Dec '06

"Jones Scott - sjones" <Scott.Jones(a)acxiom.com> wrote: > But during load testing the system starts breaking down. It takes about > 1/5 the load to break down apache and stunnel, than directly against my > jboss node. Could you elaborate on "break down", please? Is there an error? A core dump? What is the error message? A core dump stack backtrace? First performance recommendation is to disable libwrap support: ./configure --disable-libwrap && make clean && make && make install Best regards, Mike

1 0

STunnel performance Issues
by Jones Scott - sjones 11 Dec '06

11 Dec '06

I am having problems will apache and stunnel being able to handle load. I am using stunnel to encrypt my ajp traffic from apache to jboss. This helps me bridge our internal firewall. But during load testing the system starts breaking down. It takes about 1/5 the load to break down apache and stunnel, than directly against my jboss node. Any performance tuning recommendations would be great. I am using stunnel straight out of the box. I will place the configuration file below. Thanks. ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode ;cert = /usr/local/stunnel/etc/stunnel/mail.pem ;key = /usr/local/stunnel/etc/stunnel/mail.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /usr/local/stunnel/var/lib/stunnel/ setuid = nobody setgid = nogroup ; PID is created inside chroot jail pid = /stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail CApath = certificates ; It's often easier to use CAfile CAfile = /usr/local/stunnel/etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/stunnel/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [ajp] accept = 8009 connect = xxxx2:8009 [sql] accept = 1433 connect = XXXX1:443 *************************************************************************** The information contained in this communication is confidential, is intended only for the use of the recipient named above, and may be legally privileged. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please resend this communication to the sender and delete the original message or any copy of it from your computer system. Thank You. ****************************************************************************

1 0

SSL_accept: Peer suddenly disconnected
by James Brown 08 Dec '06

08 Dec '06

I'm trying to send an email through stunnel (which is running on the mail server), but I keep getting an error. $ sudo /usr/local/sbin/stunnel 2006.12.07 15:35:27 LOG7[6092:2684407744]: Snagged 64 random bytes from /Users/jlbrown/.rnd 2006.12.07 15:35:27 LOG7[6092:2684407744]: Wrote 1024 new random bytes to /Users/jlbrown/.rnd 2006.12.07 15:35:27 LOG7[6092:2684407744]: RAND_status claims sufficient entropy for the PRNG 2006.12.07 15:35:27 LOG7[6092:2684407744]: PRNG seeded successfully 2006.12.07 15:35:27 LOG7[6092:2684407744]: Certificate: /etc/postfix/ smtpd.cert 2006.12.07 15:35:27 LOG7[6092:2684407744]: Certificate loaded 2006.12.07 15:35:27 LOG7[6092:2684407744]: Key file: /etc/postfix/ smtpd.key 2006.12.07 15:35:27 LOG7[6092:2684407744]: Private key loaded 2006.12.07 15:35:27 LOG7[6092:2684407744]: SSL context initialized for service ssmtp 2006.12.07 15:35:27 LOG5[6092:2684407744]: stunnel 4.19 on i686-apple- darwin8.8.1 with OpenSSL 0.9.7l 28 Sep 2006 2006.12.07 15:35:27 LOG5[6092:2684407744]: Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv4 Auth:LIBWRAP 2006.12.07 15:35:27 LOG6[6092:2684407744]: file ulimit = 256 (can be changed with 'ulimit -n') 2006.12.07 15:35:27 LOG6[6092:2684407744]: FD_SETSIZE = 1024 (some systems allow to increase this value) 2006.12.07 15:35:27 LOG5[6092:2684407744]: 125 clients allowed 2006.12.07 15:35:27 LOG7[6092:2684407744]: FD 6 in non-blocking mode 2006.12.07 15:35:27 LOG7[6092:2684407744]: FD 7 in non-blocking mode 2006.12.07 15:35:27 LOG7[6092:2684407744]: FD 8 in non-blocking mode 2006.12.07 15:35:27 LOG7[6092:2684407744]: SO_REUSEADDR option set on accept socket 2006.12.07 15:35:27 LOG7[6092:2684407744]: ssmtp bound to 0.0.0.0:465 2006.12.07 15:35:27 LOG7[6093:2684407744]: Created pid file /usr/ local/var/run/stunnel/stunnel.pid 2006.12.07 15:35:52 LOG7[6093:2684407744]: ssmtp accepted FD=9 from 192.168.1.4:62929 2006.12.07 15:35:52 LOG7[6093:25188864]: ssmtp started 2006.12.07 15:35:52 LOG7[6093:25188864]: FD 9 in non-blocking mode 2006.12.07 15:35:52 LOG7[6093:25188864]: TCP_NODELAY option set on local socket 2006.12.07 15:35:52 LOG7[6093:25188864]: FD 10 in non-blocking mode 2006.12.07 15:35:52 LOG7[6093:25188864]: FD 11 in non-blocking mode 2006.12.07 15:35:52 LOG7[6093:25188864]: Connection from 192.168.1.4:62929 permitted by libwrap 2006.12.07 15:35:52 LOG7[6093:2684407744]: Cleaning up the signal pipe 2006.12.07 15:35:52 LOG5[6093:25188864]: ssmtp accepted connection from 192.168.1.4:62929 2006.12.07 15:35:52 LOG6[6093:2684407744]: Child process 6094 finished with code 0 2006.12.07 15:35:52 LOG7[6093:25188864]: SSL state (accept): before/ accept initialization 2006.12.07 15:35:52 LOG7[6093:25188864]: SSL state (accept): SSLv3 read client hello A 2006.12.07 15:35:52 LOG7[6093:25188864]: SSL state (accept): SSLv3 write server hello A 2006.12.07 15:35:52 LOG7[6093:25188864]: SSL state (accept): SSLv3 write certificate A 2006.12.07 15:35:52 LOG7[6093:25188864]: SSL state (accept): SSLv3 write server done A 2006.12.07 15:35:52 LOG7[6093:25188864]: SSL state (accept): SSLv3 flush data 2006.12.07 15:35:52 LOG3[6093:25188864]: SSL_accept: Peer suddenly disconnected 2006.12.07 15:35:52 LOG5[6093:25188864]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.12.07 15:35:52 LOG7[6093:25188864]: ssmtp finished (0 left) My stunnel.conf is: cert = /etc/postfix/smtpd.cert key = /etc/postfix/smtpd.key sslVersion = all socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel.log [ssmtp] client = no accept = 465 connect = 25 Does this mean that the SMTP proxy listening on port 25 is not accepting the connection from stunnel? Thanks, James.

2 4

Installing stunnel without need a compiler
by Boxall, John 05 Dec '06

05 Dec '06

Mike et al, I want to be able to automate the installation of stunnel in the same manner that I've already automated our openssh installation, however, I've run into a problem (lack of knowledge) with the "make install" step. This is for Solaris (2.5.1 to 10) and AIX (5.1 to 5.3). I'm not quite ready to create the packages in either Solaris (pkg) or AIX (rpm) formats. At a high level, here is what I would like to achieve: - On a build server (per OS version) - transfer all of the necessary stuff (gcc, openssl, stunnel source, etc.) - install the necessary stuff (gcc, openssl, etc.) - un'tar the stunnel package - run configure (with the appropriate options and paths) - run "make" - tar the stunnel directory & transfer it to a holding system - Put together the necessary pieces on the holding system to install stunnel on all targets. - On a target system (per OS version) - transfer all of the necessary stuff (libgcc, openssl, tar'ed stunnel directory, etc.) - install the necessary stuff (libgcc, openssl, zlib, etc.) - un-tar the stunnel file - run "make install" Using the same flow with our openssh packages, I do not have to install a compiler (gcc) and its support packages. What, if anything, can I do with the stunnel installation to not have to install a compiler? Regards, John Boxall

2 1

Re: [stunnel-users] Win: sometines don't connect
by Miroslav Geisselreiter 04 Dec '06

04 Dec '06

Hi My comments inline .... >>>>>> Miroslav Geisselreiter <mg(a)intar.cz> 12/01/06 8:04 PM >>> <SNIP> someotherpc config is here: service = stunnel cert = stunnel.pem CAfile = cacerts.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 3 taskbar = yes [VNC] accept = 5600 connect = localhost:5900 I doubt how the "connect" option can be configured like this? should n't it be "connect = <yourfirstPC>:5900" and the accpet option should be "somotherpc:5600" <SNIP> Hope this helps! Regards Prem I think it is correct. On the first PC stunnel listens on localhost:5900 and passes securelly to second PC to port 5600. VNC on first PC connect to localhost port 5900. On the second PC stunnel accepts connection from any PC on port 5600 and passes to localhost (still second PC) to port 5900. VNC on second PC listens on port 5900. Miroslav Geisselreiter -- Odchozi zprava neobsahuje viry. Zkontrolovano AVG. Verze: 7.5.432 / Virova baze: 268.15.6/566 - datum vydani: 3.12.2006 16:36

1 0

performance configuration for rehl3 & JBoss
by Jones Scott - sjones 01 Dec '06

01 Dec '06

I am having problems will apache and stunnel being able to handle load. I am using stunnel to encrypt my ajp traffic from apache to jboss. This helps me bridge our internal firewall. But during load testing the system starts breaking down. It takes about 1/5 the load to break down apache and stunnel, than directly against my jboss node. Any performance tuning recommendations would be great. I am using stunnel straight out of the box. I will place the configuration file below. Thanks. ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode ;cert = /usr/local/stunnel/etc/stunnel/mail.pem ;key = /usr/local/stunnel/etc/stunnel/mail.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /usr/local/stunnel/var/lib/stunnel/ setuid = nobody setgid = nogroup ; PID is created inside chroot jail pid = /stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail CApath = certificates ; It's often easier to use CAfile CAfile = /usr/local/stunnel/etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/stunnel/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [ajp] accept = 8009 connect = xxxx2:8009 [sql] accept = 1433 connect = XXXX1:443 ************************************************************************* The information contained in this communication is confidential, is intended only for the use of the recipient named above, and may be legally privileged. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please resend this communication to the sender and delete the original message or any copy of it from your computer system. Thank you. *************************************************************************

1 0

Win: sometines don't connect
by Miroslav Geisselreiter 01 Dec '06

01 Dec '06

Hi, I use stunnel 4.16 on Windows 2000 and XP with this simple config: cert = stunnel.pem CAfile = cacerts.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 client = yes verify = 3 [VNC2] accept = localhost:5900 connect = someotherpc:5600 When I start stunnel (as Win service), sometimes it forwards to someotherpc:5600 (it is correct) but sometimes it doesn't. Here is the debug 7 info: 2006.12.01 14:52:32 LOG7[3676:4060]: RAND_status claims sufficient entropy for the PRNG 2006.12.01 14:52:32 LOG7[3676:4060]: PRNG seeded successfully 2006.12.01 14:52:32 LOG7[3676:4060]: Certificate: stunnel.pem 2006.12.01 14:52:32 LOG7[3676:4060]: Certificate loaded 2006.12.01 14:52:32 LOG7[3676:4060]: Key file: stunnel.pem 2006.12.01 14:52:32 LOG7[3676:4060]: Private key loaded 2006.12.01 14:52:32 LOG7[3676:4060]: Loaded verify certificates from cacerts.pem 2006.12.01 14:52:32 LOG7[3676:4060]: SSL context initialized for service VNC2 2006.12.01 14:52:32 LOG5[3676:4060]: stunnel 4.16 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.12.01 14:52:32 LOG5[3676:4060]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.12.01 14:52:32 LOG5[3676:3108]: No limit detected for the number of clients 2006.12.01 14:52:32 LOG7[3676:3108]: FD 180 in non-blocking mode 2006.12.01 14:52:32 LOG7[3676:3108]: SO_REUSEADDR option set on accept socket 2006.12.01 14:52:32 LOG7[3676:3108]: VNC2 bound to 127.0.0.1:5900 When it doesn't work correcly, it stops here, otherwise continues: 2006.12.01 14:52:34 LOG7[3676:3108]: VNC2 accepted FD=188 from 127.0.0.1:1364 2006.12.01 14:52:34 LOG7[3676:3108]: Creating a new thread 2006.12.01 14:52:34 LOG7[3676:3108]: New thread created 2006.12.01 14:52:34 LOG7[3676:4008]: VNC2 started 2006.12.01 14:52:34 LOG7[3676:4008]: FD 188 in non-blocking mode 2006.12.01 14:52:34 LOG7[3676:4008]: TCP_NODELAY option set on local socket 2006.12.01 14:52:34 LOG5[3676:4008]: VNC2 connected from 127.0.0.1:1364 2006.12.01 14:52:34 LOG7[3676:4008]: FD 212 in non-blocking mode 2006.12.01 14:52:34 LOG7[3676:4008]: VNC2 connecting 192.168.1.172:5600 2006.12.01 14:52:34 LOG7[3676:4008]: connect_wait: waiting 10 seconds 2006.12.01 14:52:34 LOG7[3676:4008]: connect_wait: connected 2006.12.01 14:52:34 LOG7[3676:4008]: Remote FD=212 initialized 2006.12.01 14:52:34 LOG7[3676:4008]: TCP_NODELAY option set on remote socket 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): before/connect initialization 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 write client hello A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 read server hello A 2006.12.01 14:52:34 LOG6[3676:4008]: *** starting OCSP verification *** 2006.12.01 14:52:34 LOG5[3676:4008]: VERIFY OK: depth=0, some info .... 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 read server certificate A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 read server certificate request A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 read server done A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 write client certificate A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 write client key exchange A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 write certificate verify A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 write change cipher spec A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 write finished A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 flush data 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 read finished A 2006.12.01 14:52:34 LOG7[3676:4008]: 1 items in the session cache 2006.12.01 14:52:34 LOG7[3676:4008]: 1 client connects (SSL_connect()) 2006.12.01 14:52:34 LOG7[3676:4008]: 1 client connects that finished 2006.12.01 14:52:34 LOG7[3676:4008]: 0 client renegotiations requested 2006.12.01 14:52:34 LOG7[3676:4008]: 0 server connects (SSL_accept()) 2006.12.01 14:52:34 LOG7[3676:4008]: 0 server connects that finished 2006.12.01 14:52:34 LOG7[3676:4008]: 0 server renegotiations requested 2006.12.01 14:52:34 LOG7[3676:4008]: 0 session cache hits 2006.12.01 14:52:34 LOG7[3676:4008]: 0 session cache misses 2006.12.01 14:52:34 LOG7[3676:4008]: 0 session cache timeouts 2006.12.01 14:52:34 LOG6[3676:4008]: SSL connected: new session negotiated 2006.12.01 14:52:34 LOG6[3676:4008]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 someotherpc config is here: service = stunnel cert = stunnel.pem CAfile = cacerts.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 3 taskbar = yes [VNC] accept = 5600 connect = localhost:5900 It runs as win service too. Please help. -- Miroslav Geisselreiter -- Odchozi zprava neobsahuje viry. Zkontrolovano AVG. Verze: 7.5.432 / Virova baze: 268.15.3/562 - datum vydani: 1.12.2006 13:12

2 1

HTTPS proxy authentication
by Brett.Carroll＠bpd.treas.gov 01 Dec '06

01 Dec '06

I am trying to get stunnel to work through a HTTPS proxy but the current version doesn't seem to include the patch for this. Does the latest version (4.20) include https proxying support?

1 0

Problem in Stunnel with too many connections
by ~ Kunal Sharma ~ 01 Dec '06

01 Dec '06

Hi Friends, I've just joined this group. I would take this as an oppurtunity to discuss a problem I've been facing in using Stunnel. I've been using Stunnel for quite some time now. It has worked very well all this while. Recently, I had to shift our webserver onto the Internet and Stunnel accepts the https connections on the server's behalf. The problem is there are about 4.5 million clients out there in the field and there's a client coming up to the server atleast every second, if not less. Stunnel accepts the connections and after a while (like an hour) it just dies ! I see that at a point there are about 950 active connections and thats the maximum I could see before it dies. Could someone help me diagnose the problem (or better to fix it) - Is there any performance related issue thats a known problem and I don't know of ? - What I can look at to see what could be the possible cause ? - I haven't had a chance to look at the logs yet. Probably they might tell me something. - Any other pointers / inputs / suggestions would be heartily welcome. I've not been to my office so I won't be able to attach the necessary information like the version of stunnel, the logs, configuration options etc. But promise to send them as soon as I'm back on Monday after Thanksgiving. Thanks and Regards, Kunal

4 8

stunnel 4.20 released
by Michal Trojnara 30 Nov '06

30 Nov '06

Dear Users, I have just released a new version of stunnel. Here is the ChangeLog entry: Version 4.20, 2006.11.30, urgency: MEDIUM: * Release notes - The new transfer() function has been well tested. I recommend upgrading any previous version with this one. * Bugfixes - Fixed support for encrypted passphases (broken in 4.19). - Reduced amount of debug logs. - A minor man page update. Home page/download: http://stunnel.mirt.net/ sha1sum for stunnel-4.20.tar.gz fie: a9a449b28a4f34ab22f6b4bfaa81c1904a5883c4 Best regards, Mike

1 0

Adding header to SMTP msgs
by Eric B. 27 Nov '06

27 Nov '06

Hi, I am looking at stunnel as a way to add SSL/TLS to an SMTP server, but my issue is that the SMTP server must be able to determine the address of the incoming connection to perform RBL checks, reverse MX record checks, PTR checks, etc. From what I can understand, however, the SMTP server will only see the client side of the pipe (localhost) as the originating address, instead of the originating machine IP. Is there any way to get the SMTP server to see that original IP address? Or baring that, is there anyway that stunnel can insert a header into the mail indicating the original IP address? Thanks! Eric

2 4

must restart stunnel to add a new cert before it recognized it...
by Rami Michael 22 Nov '06

22 Nov '06

Hello everyone, My stunnel setup is working fine, got mysql being hit from a couple of boxes but my question is this... I have stunnel setup so i copy the cert created from the remote client over to the local server so remote connections are authenticated. Now that works fine and dandy, the issue is, if i am adding a new remote client, i add the cert from the client to my certs.pem locally but i need to restart the stunnel process before stunnel will "read in" the new cert. I know this does not sound like a big deal, but if i have 20 machines connected through stunnel to this local box and i need to restart stunnel whenever i need to add a new box or take off an old one, i don't think its good. I use stunnel for mysql so i got these guys doing inserts and a broken connection would really mess things up for me... i think maybe there is a flag i can set? or maybe send the process some type of command to reload the certs? Any help would be appreciated... all relevant info included below. All requested info for posts to the group are found below Here is my stunnel.conf verify = 3 CAfile = /etc/stunnel/certs.pem cert = /etc/stunnel/stunnel.pem setuid = nobody setgid = nobody pid = /tmp/stunnel.pid debug = 7 output = /var/log/stunnel.log client = no [mysqls] accept = 3309 connect = 3306 Some output from the stunnel.log at high debug level 2006.11.13 23:03:10 LOG5[32244:3086689984]: stunnel 4.05 on i686-redhat-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 2006.11.13 23:03:10 LOG7[32244:3086689984]: Snagged 64 random bytes from /dev/urandom 2006.11.13 23:03:10 LOG7[32244:3086689984]: RAND_status claims sufficient entropy for the PRNG 2006.11.13 23:03:10 LOG6[32244:3086689984]: PRNG seeded successfully 2006.11.13 23:03:10 LOG7[32244:3086689984]: Certificate: /etc/stunnel/stunnel.pem 2006.11.13 23:03:10 LOG7[32244:3086689984]: Key file: /etc/stunnel/stunnel.pem 2006.11.13 23:03:10 LOG7[32244:3086689984]: Loaded verify certificates from /etc/stunnel/certs.pem 2006.11.13 23:03:10 LOG5[32244:3086689984]: FD_SETSIZE=1024, file ulimit=1024 -> 500 clients allowed 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 4 in non-blocking mode 2006.11.13 23:03:10 LOG7[32244:3086689984]: SO_REUSEADDR option set on accept socket 2006.11.13 23:03:10 LOG7[32244:3086689984]: mysqls bound to 0.0.0.0:3309 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 5 in non-blocking mode 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 6 in non-blocking mode 2006.11.13 23:03:10 LOG7[32245:3086689984]: Created pid file /tmp/stunnel.pid stunnel -V 2006.11.13 23:03:14 LOG3[32248:3086505664]: -V: No such file or directory (2) Syntax: stunnel [filename] | -fd [n] | -help | -version | -sockets filename - use specified config file instead of /etc/stunnel/stunnel.conf -fd n - read the config file from specified file descriptor -help - get config file help -version - display version and defaults -sockets - display default socket options uname -a Linux ramison 2.6.9-42.0.3.EL #1 Fri Oct 6 05:59:54 CDT 2006 i686 i686 i386 GNU/Linux gcc -v Reading specs from /usr/lib/gcc/i386-redhat-linux/3.4.6/specs Configured with: ../configure --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --enable-shared --enable-threads=posix --disable-checking --with-system-zlib --enable-__cxa_atexit --disable-libunwind-exceptions --enable-java-awt=gtk --host=i386-redhat-linux Thread model: posix gcc version 3.4.6 20060404 (Red Hat 3.4.6-3) openssl version OpenSSL 0.9.7a Feb 19 2003

4 7

s_poll_wait timeout errors
by James Brown 17 Nov '06

17 Nov '06

I'm trying to set up an SSL connection from stunnel to Postfix, but can not get it to work. stunnel log says: 2006.11.16 11:35:31 LOG7[5240:25188864]: ssmtp started 2006.11.16 11:35:31 LOG7[5240:25188864]: FD 9 in non-blocking mode 2006.11.16 11:35:31 LOG7[5240:25188864]: TCP_NODELAY option set on local socket 2006.11.16 11:35:31 LOG7[5240:25188864]: FD 10 in non-blocking mode 2006.11.16 11:35:31 LOG7[5240:25188864]: FD 11 in non-blocking mode 2006.11.16 11:35:31 LOG7[5240:25188864]: Connection from 192.168.1.12:51469 permitted by libwrap 2006.11.16 11:35:31 LOG5[5240:25188864]: ssmtp connected from 192.168.1.12:51469 2006.11.16 11:35:31 LOG7[5240:25188864]: FD 10 in non-blocking mode 2006.11.16 11:35:31 LOG7[5240:25188864]: ssmtp connecting 127.0.0.1:25 2006.11.16 11:35:31 LOG7[5240:25188864]: connect_wait: waiting 10 seconds 2006.11.16 11:35:31 LOG7[5240:25188864]: connect_wait: connected 2006.11.16 11:35:31 LOG7[5240:25188864]: Remote FD=10 initialized 2006.11.16 11:35:31 LOG7[5240:25188864]: TCP_NODELAY option set on remote socket 2006.11.16 11:35:31 LOG5[5240:25188864]: Negotiations for smtp (client side) started 2006.11.16 11:35:31 LOG7[5240:2684415368]: Cleaning up the signal pipe 2006.11.16 11:35:31 LOG6[5240:2684415368]: Child process 5251 finished with code 0 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 220 mail3.bordo.com.au ESMTP Postfix 2006.11.16 11:35:31 LOG7[5240:25188864]: -> 220 mail3.bordo.com.au ESMTP Postfix 2006.11.16 11:35:31 LOG7[5240:25188864]: -> EHLO localhost 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-mail3.bordo.com.au 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-SIZE 10240000 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-ETRN 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-AUTH PLAIN LOGIN 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-AUTH=PLAIN LOGIN 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-XFORWARD NAME ADDR PROTO HELO SOURCE 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-ENHANCEDSTATUSCODES 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-8BITMIME 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250 DSN 2006.11.16 11:35:31 LOG7[5240:25188864]: -> STARTTLS 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 220 2.0.0 Ready to start TLS 2006.11.16 11:35:31 LOG5[5240:25188864]: Protocol negotiations succeded 2006.11.16 11:35:31 LOG7[5240:25188864]: SSL state (connect): before/ connect initialization 2006.11.16 11:35:31 LOG7[5240:25188864]: SSL state (connect): SSLv2/ v3 write client hello A 2006.11.16 11:40:31 LOG6[5240:25188864]: init_ssl: s_poll_wait timeout 2006.11.16 11:40:31 LOG5[5240:25188864]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.11.16 11:40:31 LOG7[5240:25188864]: ssmtp finished (0 left) 2006.11.16 11:35:31 LOG7[5240:25188864]: ssmtp started Postfix's log shows: Nov 16 11:35:31 Fax-Machine postfix/smtpd[5252]: connect from localhost[127.0.0.1] Nov 16 11:35:31 Fax-Machine postfix/smtpd[5252]: setting up TLS connection from localhost[127.0.0.1] Nov 16 11:40:31 Fax-Machine postfix/smtpd[5252]: SSL_accept error from localhost[127.0.0.1]: -1 Nov 16 11:40:31 Fax-Machine postfix/smtpd[5252]: lost connection after STARTTLS from localhost[127.0.0.1] Nov 16 11:40:31 Fax-Machine postfix/smtpd[5252]: disconnect from localhost[127.0.0.1] stunnel.conf is: ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = /etc/postfix/smtpd.cert key = /etc/postfix/smtpd.key debug=7 output=/dev/stdout ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 ;output = stunnel.log ; Use it for client mode ;client = yes ; Service-level configuration protocol = smtp sslVersion = all ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 [ssmtp] client = yes accept = 465 connect = 25 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini Does anyone have any idea where I am going wrong? Thanks, James.

3 4

stunnel : remote connection refused
by Arunkumar Arumugam 16 Nov '06

16 Nov '06

Hi I am using stunnel 3.26 on i386 redhat -linux-gnu with PTHREAD+LIBWRAP with openssl 0.9.6b engine I am getting the following error when try to use stunnel to a remote ipadress on specific port Lets say the remote ip address be a.b.c.d and port P1 and local ipaddess e.f.g.h and port P2 e.f.g.h:P2 ------> a.b.c.d:P1 my logs say that a.b.c.d:p1 started a.b.c.d:p1 connected from 127.0.0.1:xxxxx a.b.c.d:p1 connecting a.b.c.d:p1 remote connect: connection refused (111) failed to initialize remote desccriptor abcd:p1 finished (0 left) I do not understand why after connecting from local host to a.b.c.d , a.b.c.d tries to reconnect to itself. I have the same setup in another server, it works fine. This one was working fine, until i rebooted the machine. Regards Arun A -- ARUN ARUMUGAM Galbraith's Law of Human Nature: Faced with the choice between changing ones' mind and proving that there is no need to do so, almost everybody gets busy on the proof.

1 0

Testing stunnel 4.19
by Michal Trojnara 15 Nov '06

15 Nov '06

Dear Users, Please test stunnel 4.19 in you environments and post any problem to the list, so I can fix it in stunnel 4.20 (to be released soon). I expect stunnel 4.20 to be the recommended stable release for quite a long time. 8-) Best regards, Mike

1 0

Re: [stunnel-users] No way to keep the key encrypted?
by Michal Trojnara 15 Nov '06

15 Nov '06

On Wednesday 15 November 2006 16:30, joe(a)strout.net wrote: > That's good news! ...But, how do I use it (in daemon mode)? I tried > launching stunnel with an encrypted key, and it simply failed saying > that the pass phrase was wrong. But it never asked me for a pass > phrase. How do I make it do so? I confirm it's broken in stunnel 4.19. I'll fix it in 4.20. 4.18 works fine. Best regards, Mike

1 1

Re: [stunnel-users] No way to keep the key encrypted?
by Hans Werner Strube 15 Nov '06

15 Nov '06

Michal Trojnara wrote: > Obviously private key encryption should not be used in inetd mode. It > works fine in daemon mode and on Win32 platform. Yes, but only when stunnel is started manually. When started automatically on system boot, there is usually nobody present to enter the password of the encrypted private key (except when the key is stored somewhere and its input provided by some script or program - again a security hole). This is not a special problem of stunnel but of all SSL-using servers.

1 0

Re: [stunnel-users] No way to keep the key encrypted?
by Michal Trojnara 15 Nov '06

15 Nov '06

Joe Strout wrote: > The private key cannot be encrypted [cut] > This seems very dangerous to me; This paragraph of the manual was obsolete so I've removed it. Obviously private key encryption should not be used in inetd mode. It works fine in daemon mode and on Win32 platform. Best regards, Mike

1 0

"wrong version number" error
by joe＠strout.net 15 Nov '06

15 Nov '06

With a cleartext key (see previous thread), I'm able to get stunnel to actually run. However, it's failing when I try to connect to my server with https, generating the following output: 2006.11.15 09:10:11 LOG5[18343:25188864]: https accepted connection from 67.174.105.26:39907 2006.11.15 09:10:11 LOG7[18343:25188864]: SSL state (accept): before/accept initialization 2006.11.15 09:10:11 LOG3[18343:25188864]: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2006.11.15 09:10:11 LOG5[18343:25188864]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.11.15 09:10:11 LOG7[18343:25188864]: https finished (0 left) The important part here I suppose is "SSL routines:SSL3_GET_RECORD:wrong version number". Can anyone elaborate on what this means, and what I can do about it? Thank you, - Joe -- Joe Strout -- joe(a)strout.net Verified Express, LLC "Making the Internet a Better Place" http://www.verex.com/

1 0

No way to keep the key encrypted?
by joe＠strout.net 15 Nov '06

15 Nov '06

I see from the manual: "Two things are important when generating certificate-key pairs for stunnel. The private key cannot be encrypted, because the server has no way to obtain the password from the user. To produce an unencrypted key add the -nodes option when running the req command from the OpenSSL kit." This seems very dangerous to me; anybody who gets ahold of that key file will then be able to impersonate my server, right? Symbian SSL Proxy will simply ask me for my pass phrase when I launch it. Is there any way to get stunnel to do something equivalent -- maybe by decrypting it on the fly and piping it to stunnel on launch, so that there is never a decrypted file on disk? Or maybe I can decrypt the key to a file, launch stunnel, and then immediately delete that file? How have others dealt with this? Thanks, - Joe -- Joe Strout -- joe(a)strout.net Verified Express, LLC "Making the Internet a Better Place" http://www.verex.com/

1 0

[RE][stunnel-users] ciphers=EDH-RSA-DES-CBC3-SHA
by algol sigfrid 15 Nov '06

15 Nov '06

2 1

Stunnel 4.19 released
by Michal Trojnara 15 Nov '06

15 Nov '06

Dear Users, A new version of stunnel has just been released. Version 4.19, 2006.11.11, urgency: LOW/EXPERIMENTAL: * Release notes - There are a lot of new features in this version. I recommend to test it well before upgrading your mission-critical systems. * New features - New service-level option to specify OCSP server flag: OCSPflag = <flag> - "protocolCredentials" option changed to "protocolUsername" and "protocolPassword" - NTLM support to be enabled with the new service-level option: protocolAuthentication = NTLM - imap protocol negotiation support added. - Passphrase cache was added so the user does not need to reenter the same passphrase for each defined service any more. - New service-level option to retry connect+exec section: retry = yes|no - Local IP and port is logged for each established connection. - Win32 DLLs for OpenSSL 0.9.8d. * Bugfixes - Serious problem with SSL_WANT_* retries fixed. The new code requires extensive testing! Homepage: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ sha1sum for stunnel-4.19.tar.gz: d58da8117278d71598279c77935585de81b74394 Best regards, Mike

2 1

Error when I try adding compression to stunnel.conf
by Rami Michael 15 Nov '06

15 Nov '06

So it seems i found the answer to my own question... compression was added in stunnel 4.06. I am using 4.05 :)

1 0

Does stunnel supports IPv6
by Ravi Gowda 14 Nov '06

14 Nov '06

Hi All, Can we use ipv6 addresses in stunnel? The problem that I am facing is I want to have secure ldap sessions using two IPv6 systems but none of them speak SSL... How to go about it??? Thanks in Advance Ravi Gowda

2 1

Error when I try adding compression to stunnel.conf
by Rami Michael 14 Nov '06

14 Nov '06

Hey everyone, I was going through the stunnel FAQ when I noticed you could add compression. I was very excited and wanted to give it a try but when I tried to add compression = zlib to my stunnel.cong I got this error when starting stunnel... Starting stunnel: file /etc/stunnel/stunnel.conf line 10: Specified option name is not valid here Line 10 is the exact place where i stuck this name value pair. I don't know where else i could put it, i tried putting it everywhere! All requested info for posts to the group are found below Here is my stunnel.conf verify = 3 CAfile = /etc/stunnel/certs.pem cert = /etc/stunnel/stunnel.pem setuid = nobody setgid = nobody pid = /tmp/stunnel.pid debug = 7 output = /var/log/stunnel.log client = no compression = zlib [mysqls] accept = 3309 connect = 3306 I am using centOS and installed stunnel and openssl via the available rpms, using yum. zlib is installed as well, but i don't think this is a zlib issue, it seems like it just doesn't like "compression". Was compression added in a version later than 4.05? Am i missing something incredinbly simple? Some output from the stunnel.log at high debug level 2006.11.13 23:03:10 LOG5[32244:3086689984]: stunnel 4.05 on i686-redhat-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 2006.11.13 23:03:10 LOG7[32244:3086689984]: Snagged 64 random bytes from /dev/urandom 2006.11.13 23:03:10 LOG7[32244:3086689984]: RAND_status claims sufficient entropy for the PRNG 2006.11.13 23:03:10 LOG6[32244:3086689984]: PRNG seeded successfully 2006.11.13 23:03:10 LOG7[32244:3086689984]: Certificate: /etc/stunnel/stunnel.pem 2006.11.13 23:03:10 LOG7[32244:3086689984]: Key file: /etc/stunnel/stunnel.pem 2006.11.13 23:03:10 LOG7[32244:3086689984]: Loaded verify certificates from /etc/stunnel/certs.pem 2006.11.13 23:03:10 LOG5[32244:3086689984]: FD_SETSIZE=1024, file ulimit=1024 -> 500 clients allowed 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 4 in non-blocking mode 2006.11.13 23:03:10 LOG7[32244:3086689984]: SO_REUSEADDR option set on accept socket 2006.11.13 23:03:10 LOG7[32244:3086689984]: mysqls bound to 0.0.0.0:3309 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 5 in non-blocking mode 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 6 in non-blocking mode 2006.11.13 23:03:10 LOG7[32245:3086689984]: Created pid file /tmp/stunnel.pid stunnel -V 2006.11.13 23:03:14 LOG3[32248:3086505664]: -V: No such file or directory (2) Syntax: stunnel [filename] | -fd [n] | -help | -version | -sockets filename - use specified config file instead of /etc/stunnel/stunnel.conf -fd n - read the config file from specified file descriptor -help - get config file help -version - display version and defaults -sockets - display default socket options uname -a Linux ramison 2.6.9-42.0.3.EL #1 Fri Oct 6 05:59:54 CDT 2006 i686 i686 i386 GNU/Linux gcc -v Reading specs from /usr/lib/gcc/i386-redhat-linux/3.4.6/specs Configured with: ../configure --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --enable-shared --enable-threads=posix --disable-checking --with-system-zlib --enable-__cxa_atexit --disable-libunwind-exceptions --enable-java-awt=gtk --host=i386-redhat-linux Thread model: posix gcc version 3.4.6 20060404 (Red Hat 3.4.6-3) openssl version OpenSSL 0.9.7a Feb 19 2003

1 0

setting up HTTPS service?
by joe＠strout.net 13 Nov '06

13 Nov '06

Complete newbie here, so please bear with me. I want to set up HTTPS service on a Mac OS X (10.4.7) machine running a custom web server. I imagine that Stunnel could be made to listen on the standard HTTPS port (443), do the encryption/decryption, and pass the resulting data to/from the HTTP port (80, or a custom port I specify). This is probably very easy, but none of the documentation or examples I found covered this. Has anyone done this? Or if not, can you sketch out how I would go about it? Any gotchas or caveats I should be aware of? Many thanks, - Joe

3 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users