- stunnel-users - stunnel.org

Re: [stunnel-users] Win: sometines don't connect
by Miroslav Geisselreiter 04 Dec '06

04 Dec '06

Hi My comments inline .... >>>>>> Miroslav Geisselreiter <mg(a)intar.cz> 12/01/06 8:04 PM >>> <SNIP> someotherpc config is here: service = stunnel cert = stunnel.pem CAfile = cacerts.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 3 taskbar = yes [VNC] accept = 5600 connect = localhost:5900 I doubt how the "connect" option can be configured like this? should n't it be "connect = <yourfirstPC>:5900" and the accpet option should be "somotherpc:5600" <SNIP> Hope this helps! Regards Prem I think it is correct. On the first PC stunnel listens on localhost:5900 and passes securelly to second PC to port 5600. VNC on first PC connect to localhost port 5900. On the second PC stunnel accepts connection from any PC on port 5600 and passes to localhost (still second PC) to port 5900. VNC on second PC listens on port 5900. Miroslav Geisselreiter -- Odchozi zprava neobsahuje viry. Zkontrolovano AVG. Verze: 7.5.432 / Virova baze: 268.15.6/566 - datum vydani: 3.12.2006 16:36

1 0

performance configuration for rehl3 & JBoss
by Jones Scott - sjones 01 Dec '06

01 Dec '06

I am having problems will apache and stunnel being able to handle load. I am using stunnel to encrypt my ajp traffic from apache to jboss. This helps me bridge our internal firewall. But during load testing the system starts breaking down. It takes about 1/5 the load to break down apache and stunnel, than directly against my jboss node. Any performance tuning recommendations would be great. I am using stunnel straight out of the box. I will place the configuration file below. Thanks. ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode ;cert = /usr/local/stunnel/etc/stunnel/mail.pem ;key = /usr/local/stunnel/etc/stunnel/mail.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /usr/local/stunnel/var/lib/stunnel/ setuid = nobody setgid = nogroup ; PID is created inside chroot jail pid = /stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail CApath = certificates ; It's often easier to use CAfile CAfile = /usr/local/stunnel/etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/stunnel/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [ajp] accept = 8009 connect = xxxx2:8009 [sql] accept = 1433 connect = XXXX1:443 ************************************************************************* The information contained in this communication is confidential, is intended only for the use of the recipient named above, and may be legally privileged. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please resend this communication to the sender and delete the original message or any copy of it from your computer system. Thank you. *************************************************************************

1 0

Win: sometines don't connect
by Miroslav Geisselreiter 01 Dec '06

01 Dec '06

Hi, I use stunnel 4.16 on Windows 2000 and XP with this simple config: cert = stunnel.pem CAfile = cacerts.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 client = yes verify = 3 [VNC2] accept = localhost:5900 connect = someotherpc:5600 When I start stunnel (as Win service), sometimes it forwards to someotherpc:5600 (it is correct) but sometimes it doesn't. Here is the debug 7 info: 2006.12.01 14:52:32 LOG7[3676:4060]: RAND_status claims sufficient entropy for the PRNG 2006.12.01 14:52:32 LOG7[3676:4060]: PRNG seeded successfully 2006.12.01 14:52:32 LOG7[3676:4060]: Certificate: stunnel.pem 2006.12.01 14:52:32 LOG7[3676:4060]: Certificate loaded 2006.12.01 14:52:32 LOG7[3676:4060]: Key file: stunnel.pem 2006.12.01 14:52:32 LOG7[3676:4060]: Private key loaded 2006.12.01 14:52:32 LOG7[3676:4060]: Loaded verify certificates from cacerts.pem 2006.12.01 14:52:32 LOG7[3676:4060]: SSL context initialized for service VNC2 2006.12.01 14:52:32 LOG5[3676:4060]: stunnel 4.16 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.12.01 14:52:32 LOG5[3676:4060]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.12.01 14:52:32 LOG5[3676:3108]: No limit detected for the number of clients 2006.12.01 14:52:32 LOG7[3676:3108]: FD 180 in non-blocking mode 2006.12.01 14:52:32 LOG7[3676:3108]: SO_REUSEADDR option set on accept socket 2006.12.01 14:52:32 LOG7[3676:3108]: VNC2 bound to 127.0.0.1:5900 When it doesn't work correcly, it stops here, otherwise continues: 2006.12.01 14:52:34 LOG7[3676:3108]: VNC2 accepted FD=188 from 127.0.0.1:1364 2006.12.01 14:52:34 LOG7[3676:3108]: Creating a new thread 2006.12.01 14:52:34 LOG7[3676:3108]: New thread created 2006.12.01 14:52:34 LOG7[3676:4008]: VNC2 started 2006.12.01 14:52:34 LOG7[3676:4008]: FD 188 in non-blocking mode 2006.12.01 14:52:34 LOG7[3676:4008]: TCP_NODELAY option set on local socket 2006.12.01 14:52:34 LOG5[3676:4008]: VNC2 connected from 127.0.0.1:1364 2006.12.01 14:52:34 LOG7[3676:4008]: FD 212 in non-blocking mode 2006.12.01 14:52:34 LOG7[3676:4008]: VNC2 connecting 192.168.1.172:5600 2006.12.01 14:52:34 LOG7[3676:4008]: connect_wait: waiting 10 seconds 2006.12.01 14:52:34 LOG7[3676:4008]: connect_wait: connected 2006.12.01 14:52:34 LOG7[3676:4008]: Remote FD=212 initialized 2006.12.01 14:52:34 LOG7[3676:4008]: TCP_NODELAY option set on remote socket 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): before/connect initialization 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 write client hello A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 read server hello A 2006.12.01 14:52:34 LOG6[3676:4008]: *** starting OCSP verification *** 2006.12.01 14:52:34 LOG5[3676:4008]: VERIFY OK: depth=0, some info .... 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 read server certificate A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 read server certificate request A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 read server done A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 write client certificate A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 write client key exchange A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 write certificate verify A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 write change cipher spec A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 write finished A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 flush data 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 read finished A 2006.12.01 14:52:34 LOG7[3676:4008]: 1 items in the session cache 2006.12.01 14:52:34 LOG7[3676:4008]: 1 client connects (SSL_connect()) 2006.12.01 14:52:34 LOG7[3676:4008]: 1 client connects that finished 2006.12.01 14:52:34 LOG7[3676:4008]: 0 client renegotiations requested 2006.12.01 14:52:34 LOG7[3676:4008]: 0 server connects (SSL_accept()) 2006.12.01 14:52:34 LOG7[3676:4008]: 0 server connects that finished 2006.12.01 14:52:34 LOG7[3676:4008]: 0 server renegotiations requested 2006.12.01 14:52:34 LOG7[3676:4008]: 0 session cache hits 2006.12.01 14:52:34 LOG7[3676:4008]: 0 session cache misses 2006.12.01 14:52:34 LOG7[3676:4008]: 0 session cache timeouts 2006.12.01 14:52:34 LOG6[3676:4008]: SSL connected: new session negotiated 2006.12.01 14:52:34 LOG6[3676:4008]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 someotherpc config is here: service = stunnel cert = stunnel.pem CAfile = cacerts.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 3 taskbar = yes [VNC] accept = 5600 connect = localhost:5900 It runs as win service too. Please help. -- Miroslav Geisselreiter -- Odchozi zprava neobsahuje viry. Zkontrolovano AVG. Verze: 7.5.432 / Virova baze: 268.15.3/562 - datum vydani: 1.12.2006 13:12

2 1

HTTPS proxy authentication
by Brett.Carroll＠bpd.treas.gov 01 Dec '06

01 Dec '06

I am trying to get stunnel to work through a HTTPS proxy but the current version doesn't seem to include the patch for this. Does the latest version (4.20) include https proxying support?

1 0

Problem in Stunnel with too many connections
by ~ Kunal Sharma ~ 01 Dec '06

01 Dec '06

Hi Friends, I've just joined this group. I would take this as an oppurtunity to discuss a problem I've been facing in using Stunnel. I've been using Stunnel for quite some time now. It has worked very well all this while. Recently, I had to shift our webserver onto the Internet and Stunnel accepts the https connections on the server's behalf. The problem is there are about 4.5 million clients out there in the field and there's a client coming up to the server atleast every second, if not less. Stunnel accepts the connections and after a while (like an hour) it just dies ! I see that at a point there are about 950 active connections and thats the maximum I could see before it dies. Could someone help me diagnose the problem (or better to fix it) - Is there any performance related issue thats a known problem and I don't know of ? - What I can look at to see what could be the possible cause ? - I haven't had a chance to look at the logs yet. Probably they might tell me something. - Any other pointers / inputs / suggestions would be heartily welcome. I've not been to my office so I won't be able to attach the necessary information like the version of stunnel, the logs, configuration options etc. But promise to send them as soon as I'm back on Monday after Thanksgiving. Thanks and Regards, Kunal

4 8

stunnel 4.20 released
by Michal Trojnara 30 Nov '06

30 Nov '06

Dear Users, I have just released a new version of stunnel. Here is the ChangeLog entry: Version 4.20, 2006.11.30, urgency: MEDIUM: * Release notes - The new transfer() function has been well tested. I recommend upgrading any previous version with this one. * Bugfixes - Fixed support for encrypted passphases (broken in 4.19). - Reduced amount of debug logs. - A minor man page update. Home page/download: http://stunnel.mirt.net/ sha1sum for stunnel-4.20.tar.gz fie: a9a449b28a4f34ab22f6b4bfaa81c1904a5883c4 Best regards, Mike

1 0

Adding header to SMTP msgs
by Eric B. 27 Nov '06

27 Nov '06

Hi, I am looking at stunnel as a way to add SSL/TLS to an SMTP server, but my issue is that the SMTP server must be able to determine the address of the incoming connection to perform RBL checks, reverse MX record checks, PTR checks, etc. From what I can understand, however, the SMTP server will only see the client side of the pipe (localhost) as the originating address, instead of the originating machine IP. Is there any way to get the SMTP server to see that original IP address? Or baring that, is there anyway that stunnel can insert a header into the mail indicating the original IP address? Thanks! Eric

2 4

must restart stunnel to add a new cert before it recognized it...
by Rami Michael 22 Nov '06

22 Nov '06

Hello everyone, My stunnel setup is working fine, got mysql being hit from a couple of boxes but my question is this... I have stunnel setup so i copy the cert created from the remote client over to the local server so remote connections are authenticated. Now that works fine and dandy, the issue is, if i am adding a new remote client, i add the cert from the client to my certs.pem locally but i need to restart the stunnel process before stunnel will "read in" the new cert. I know this does not sound like a big deal, but if i have 20 machines connected through stunnel to this local box and i need to restart stunnel whenever i need to add a new box or take off an old one, i don't think its good. I use stunnel for mysql so i got these guys doing inserts and a broken connection would really mess things up for me... i think maybe there is a flag i can set? or maybe send the process some type of command to reload the certs? Any help would be appreciated... all relevant info included below. All requested info for posts to the group are found below Here is my stunnel.conf verify = 3 CAfile = /etc/stunnel/certs.pem cert = /etc/stunnel/stunnel.pem setuid = nobody setgid = nobody pid = /tmp/stunnel.pid debug = 7 output = /var/log/stunnel.log client = no [mysqls] accept = 3309 connect = 3306 Some output from the stunnel.log at high debug level 2006.11.13 23:03:10 LOG5[32244:3086689984]: stunnel 4.05 on i686-redhat-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 2006.11.13 23:03:10 LOG7[32244:3086689984]: Snagged 64 random bytes from /dev/urandom 2006.11.13 23:03:10 LOG7[32244:3086689984]: RAND_status claims sufficient entropy for the PRNG 2006.11.13 23:03:10 LOG6[32244:3086689984]: PRNG seeded successfully 2006.11.13 23:03:10 LOG7[32244:3086689984]: Certificate: /etc/stunnel/stunnel.pem 2006.11.13 23:03:10 LOG7[32244:3086689984]: Key file: /etc/stunnel/stunnel.pem 2006.11.13 23:03:10 LOG7[32244:3086689984]: Loaded verify certificates from /etc/stunnel/certs.pem 2006.11.13 23:03:10 LOG5[32244:3086689984]: FD_SETSIZE=1024, file ulimit=1024 -> 500 clients allowed 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 4 in non-blocking mode 2006.11.13 23:03:10 LOG7[32244:3086689984]: SO_REUSEADDR option set on accept socket 2006.11.13 23:03:10 LOG7[32244:3086689984]: mysqls bound to 0.0.0.0:3309 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 5 in non-blocking mode 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 6 in non-blocking mode 2006.11.13 23:03:10 LOG7[32245:3086689984]: Created pid file /tmp/stunnel.pid stunnel -V 2006.11.13 23:03:14 LOG3[32248:3086505664]: -V: No such file or directory (2) Syntax: stunnel [filename] | -fd [n] | -help | -version | -sockets filename - use specified config file instead of /etc/stunnel/stunnel.conf -fd n - read the config file from specified file descriptor -help - get config file help -version - display version and defaults -sockets - display default socket options uname -a Linux ramison 2.6.9-42.0.3.EL #1 Fri Oct 6 05:59:54 CDT 2006 i686 i686 i386 GNU/Linux gcc -v Reading specs from /usr/lib/gcc/i386-redhat-linux/3.4.6/specs Configured with: ../configure --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --enable-shared --enable-threads=posix --disable-checking --with-system-zlib --enable-__cxa_atexit --disable-libunwind-exceptions --enable-java-awt=gtk --host=i386-redhat-linux Thread model: posix gcc version 3.4.6 20060404 (Red Hat 3.4.6-3) openssl version OpenSSL 0.9.7a Feb 19 2003

4 7

s_poll_wait timeout errors
by James Brown 17 Nov '06

17 Nov '06

I'm trying to set up an SSL connection from stunnel to Postfix, but can not get it to work. stunnel log says: 2006.11.16 11:35:31 LOG7[5240:25188864]: ssmtp started 2006.11.16 11:35:31 LOG7[5240:25188864]: FD 9 in non-blocking mode 2006.11.16 11:35:31 LOG7[5240:25188864]: TCP_NODELAY option set on local socket 2006.11.16 11:35:31 LOG7[5240:25188864]: FD 10 in non-blocking mode 2006.11.16 11:35:31 LOG7[5240:25188864]: FD 11 in non-blocking mode 2006.11.16 11:35:31 LOG7[5240:25188864]: Connection from 192.168.1.12:51469 permitted by libwrap 2006.11.16 11:35:31 LOG5[5240:25188864]: ssmtp connected from 192.168.1.12:51469 2006.11.16 11:35:31 LOG7[5240:25188864]: FD 10 in non-blocking mode 2006.11.16 11:35:31 LOG7[5240:25188864]: ssmtp connecting 127.0.0.1:25 2006.11.16 11:35:31 LOG7[5240:25188864]: connect_wait: waiting 10 seconds 2006.11.16 11:35:31 LOG7[5240:25188864]: connect_wait: connected 2006.11.16 11:35:31 LOG7[5240:25188864]: Remote FD=10 initialized 2006.11.16 11:35:31 LOG7[5240:25188864]: TCP_NODELAY option set on remote socket 2006.11.16 11:35:31 LOG5[5240:25188864]: Negotiations for smtp (client side) started 2006.11.16 11:35:31 LOG7[5240:2684415368]: Cleaning up the signal pipe 2006.11.16 11:35:31 LOG6[5240:2684415368]: Child process 5251 finished with code 0 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 220 mail3.bordo.com.au ESMTP Postfix 2006.11.16 11:35:31 LOG7[5240:25188864]: -> 220 mail3.bordo.com.au ESMTP Postfix 2006.11.16 11:35:31 LOG7[5240:25188864]: -> EHLO localhost 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-mail3.bordo.com.au 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-SIZE 10240000 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-ETRN 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-AUTH PLAIN LOGIN 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-AUTH=PLAIN LOGIN 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-XFORWARD NAME ADDR PROTO HELO SOURCE 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-ENHANCEDSTATUSCODES 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-8BITMIME 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250 DSN 2006.11.16 11:35:31 LOG7[5240:25188864]: -> STARTTLS 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 220 2.0.0 Ready to start TLS 2006.11.16 11:35:31 LOG5[5240:25188864]: Protocol negotiations succeded 2006.11.16 11:35:31 LOG7[5240:25188864]: SSL state (connect): before/ connect initialization 2006.11.16 11:35:31 LOG7[5240:25188864]: SSL state (connect): SSLv2/ v3 write client hello A 2006.11.16 11:40:31 LOG6[5240:25188864]: init_ssl: s_poll_wait timeout 2006.11.16 11:40:31 LOG5[5240:25188864]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.11.16 11:40:31 LOG7[5240:25188864]: ssmtp finished (0 left) 2006.11.16 11:35:31 LOG7[5240:25188864]: ssmtp started Postfix's log shows: Nov 16 11:35:31 Fax-Machine postfix/smtpd[5252]: connect from localhost[127.0.0.1] Nov 16 11:35:31 Fax-Machine postfix/smtpd[5252]: setting up TLS connection from localhost[127.0.0.1] Nov 16 11:40:31 Fax-Machine postfix/smtpd[5252]: SSL_accept error from localhost[127.0.0.1]: -1 Nov 16 11:40:31 Fax-Machine postfix/smtpd[5252]: lost connection after STARTTLS from localhost[127.0.0.1] Nov 16 11:40:31 Fax-Machine postfix/smtpd[5252]: disconnect from localhost[127.0.0.1] stunnel.conf is: ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = /etc/postfix/smtpd.cert key = /etc/postfix/smtpd.key debug=7 output=/dev/stdout ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 ;output = stunnel.log ; Use it for client mode ;client = yes ; Service-level configuration protocol = smtp sslVersion = all ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 [ssmtp] client = yes accept = 465 connect = 25 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini Does anyone have any idea where I am going wrong? Thanks, James.

3 4

stunnel : remote connection refused
by Arunkumar Arumugam 16 Nov '06

16 Nov '06

Hi I am using stunnel 3.26 on i386 redhat -linux-gnu with PTHREAD+LIBWRAP with openssl 0.9.6b engine I am getting the following error when try to use stunnel to a remote ipadress on specific port Lets say the remote ip address be a.b.c.d and port P1 and local ipaddess e.f.g.h and port P2 e.f.g.h:P2 ------> a.b.c.d:P1 my logs say that a.b.c.d:p1 started a.b.c.d:p1 connected from 127.0.0.1:xxxxx a.b.c.d:p1 connecting a.b.c.d:p1 remote connect: connection refused (111) failed to initialize remote desccriptor abcd:p1 finished (0 left) I do not understand why after connecting from local host to a.b.c.d , a.b.c.d tries to reconnect to itself. I have the same setup in another server, it works fine. This one was working fine, until i rebooted the machine. Regards Arun A -- ARUN ARUMUGAM Galbraith's Law of Human Nature: Faced with the choice between changing ones' mind and proving that there is no need to do so, almost everybody gets busy on the proof.

1 0

Testing stunnel 4.19
by Michal Trojnara 15 Nov '06

15 Nov '06

Dear Users, Please test stunnel 4.19 in you environments and post any problem to the list, so I can fix it in stunnel 4.20 (to be released soon). I expect stunnel 4.20 to be the recommended stable release for quite a long time. 8-) Best regards, Mike

1 0

Re: [stunnel-users] No way to keep the key encrypted?
by Michal Trojnara 15 Nov '06

15 Nov '06

On Wednesday 15 November 2006 16:30, joe(a)strout.net wrote: > That's good news! ...But, how do I use it (in daemon mode)? I tried > launching stunnel with an encrypted key, and it simply failed saying > that the pass phrase was wrong. But it never asked me for a pass > phrase. How do I make it do so? I confirm it's broken in stunnel 4.19. I'll fix it in 4.20. 4.18 works fine. Best regards, Mike

1 1

Re: [stunnel-users] No way to keep the key encrypted?
by Hans Werner Strube 15 Nov '06

15 Nov '06

Michal Trojnara wrote: > Obviously private key encryption should not be used in inetd mode. It > works fine in daemon mode and on Win32 platform. Yes, but only when stunnel is started manually. When started automatically on system boot, there is usually nobody present to enter the password of the encrypted private key (except when the key is stored somewhere and its input provided by some script or program - again a security hole). This is not a special problem of stunnel but of all SSL-using servers.

1 0

Re: [stunnel-users] No way to keep the key encrypted?
by Michal Trojnara 15 Nov '06

15 Nov '06

Joe Strout wrote: > The private key cannot be encrypted [cut] > This seems very dangerous to me; This paragraph of the manual was obsolete so I've removed it. Obviously private key encryption should not be used in inetd mode. It works fine in daemon mode and on Win32 platform. Best regards, Mike

1 0

"wrong version number" error
by joe＠strout.net 15 Nov '06

15 Nov '06

With a cleartext key (see previous thread), I'm able to get stunnel to actually run. However, it's failing when I try to connect to my server with https, generating the following output: 2006.11.15 09:10:11 LOG5[18343:25188864]: https accepted connection from 67.174.105.26:39907 2006.11.15 09:10:11 LOG7[18343:25188864]: SSL state (accept): before/accept initialization 2006.11.15 09:10:11 LOG3[18343:25188864]: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2006.11.15 09:10:11 LOG5[18343:25188864]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.11.15 09:10:11 LOG7[18343:25188864]: https finished (0 left) The important part here I suppose is "SSL routines:SSL3_GET_RECORD:wrong version number". Can anyone elaborate on what this means, and what I can do about it? Thank you, - Joe -- Joe Strout -- joe(a)strout.net Verified Express, LLC "Making the Internet a Better Place" http://www.verex.com/

1 0

No way to keep the key encrypted?
by joe＠strout.net 15 Nov '06

15 Nov '06

I see from the manual: "Two things are important when generating certificate-key pairs for stunnel. The private key cannot be encrypted, because the server has no way to obtain the password from the user. To produce an unencrypted key add the -nodes option when running the req command from the OpenSSL kit." This seems very dangerous to me; anybody who gets ahold of that key file will then be able to impersonate my server, right? Symbian SSL Proxy will simply ask me for my pass phrase when I launch it. Is there any way to get stunnel to do something equivalent -- maybe by decrypting it on the fly and piping it to stunnel on launch, so that there is never a decrypted file on disk? Or maybe I can decrypt the key to a file, launch stunnel, and then immediately delete that file? How have others dealt with this? Thanks, - Joe -- Joe Strout -- joe(a)strout.net Verified Express, LLC "Making the Internet a Better Place" http://www.verex.com/

1 0

[RE][stunnel-users] ciphers=EDH-RSA-DES-CBC3-SHA
by algol sigfrid 15 Nov '06

15 Nov '06

2 1

Stunnel 4.19 released
by Michal Trojnara 15 Nov '06

15 Nov '06

Dear Users, A new version of stunnel has just been released. Version 4.19, 2006.11.11, urgency: LOW/EXPERIMENTAL: * Release notes - There are a lot of new features in this version. I recommend to test it well before upgrading your mission-critical systems. * New features - New service-level option to specify OCSP server flag: OCSPflag = <flag> - "protocolCredentials" option changed to "protocolUsername" and "protocolPassword" - NTLM support to be enabled with the new service-level option: protocolAuthentication = NTLM - imap protocol negotiation support added. - Passphrase cache was added so the user does not need to reenter the same passphrase for each defined service any more. - New service-level option to retry connect+exec section: retry = yes|no - Local IP and port is logged for each established connection. - Win32 DLLs for OpenSSL 0.9.8d. * Bugfixes - Serious problem with SSL_WANT_* retries fixed. The new code requires extensive testing! Homepage: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ sha1sum for stunnel-4.19.tar.gz: d58da8117278d71598279c77935585de81b74394 Best regards, Mike

2 1

Error when I try adding compression to stunnel.conf
by Rami Michael 15 Nov '06

15 Nov '06

So it seems i found the answer to my own question... compression was added in stunnel 4.06. I am using 4.05 :)

1 0

Does stunnel supports IPv6
by Ravi Gowda 14 Nov '06

14 Nov '06

Hi All, Can we use ipv6 addresses in stunnel? The problem that I am facing is I want to have secure ldap sessions using two IPv6 systems but none of them speak SSL... How to go about it??? Thanks in Advance Ravi Gowda

2 1

Error when I try adding compression to stunnel.conf
by Rami Michael 14 Nov '06

14 Nov '06

Hey everyone, I was going through the stunnel FAQ when I noticed you could add compression. I was very excited and wanted to give it a try but when I tried to add compression = zlib to my stunnel.cong I got this error when starting stunnel... Starting stunnel: file /etc/stunnel/stunnel.conf line 10: Specified option name is not valid here Line 10 is the exact place where i stuck this name value pair. I don't know where else i could put it, i tried putting it everywhere! All requested info for posts to the group are found below Here is my stunnel.conf verify = 3 CAfile = /etc/stunnel/certs.pem cert = /etc/stunnel/stunnel.pem setuid = nobody setgid = nobody pid = /tmp/stunnel.pid debug = 7 output = /var/log/stunnel.log client = no compression = zlib [mysqls] accept = 3309 connect = 3306 I am using centOS and installed stunnel and openssl via the available rpms, using yum. zlib is installed as well, but i don't think this is a zlib issue, it seems like it just doesn't like "compression". Was compression added in a version later than 4.05? Am i missing something incredinbly simple? Some output from the stunnel.log at high debug level 2006.11.13 23:03:10 LOG5[32244:3086689984]: stunnel 4.05 on i686-redhat-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 2006.11.13 23:03:10 LOG7[32244:3086689984]: Snagged 64 random bytes from /dev/urandom 2006.11.13 23:03:10 LOG7[32244:3086689984]: RAND_status claims sufficient entropy for the PRNG 2006.11.13 23:03:10 LOG6[32244:3086689984]: PRNG seeded successfully 2006.11.13 23:03:10 LOG7[32244:3086689984]: Certificate: /etc/stunnel/stunnel.pem 2006.11.13 23:03:10 LOG7[32244:3086689984]: Key file: /etc/stunnel/stunnel.pem 2006.11.13 23:03:10 LOG7[32244:3086689984]: Loaded verify certificates from /etc/stunnel/certs.pem 2006.11.13 23:03:10 LOG5[32244:3086689984]: FD_SETSIZE=1024, file ulimit=1024 -> 500 clients allowed 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 4 in non-blocking mode 2006.11.13 23:03:10 LOG7[32244:3086689984]: SO_REUSEADDR option set on accept socket 2006.11.13 23:03:10 LOG7[32244:3086689984]: mysqls bound to 0.0.0.0:3309 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 5 in non-blocking mode 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 6 in non-blocking mode 2006.11.13 23:03:10 LOG7[32245:3086689984]: Created pid file /tmp/stunnel.pid stunnel -V 2006.11.13 23:03:14 LOG3[32248:3086505664]: -V: No such file or directory (2) Syntax: stunnel [filename] | -fd [n] | -help | -version | -sockets filename - use specified config file instead of /etc/stunnel/stunnel.conf -fd n - read the config file from specified file descriptor -help - get config file help -version - display version and defaults -sockets - display default socket options uname -a Linux ramison 2.6.9-42.0.3.EL #1 Fri Oct 6 05:59:54 CDT 2006 i686 i686 i386 GNU/Linux gcc -v Reading specs from /usr/lib/gcc/i386-redhat-linux/3.4.6/specs Configured with: ../configure --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --enable-shared --enable-threads=posix --disable-checking --with-system-zlib --enable-__cxa_atexit --disable-libunwind-exceptions --enable-java-awt=gtk --host=i386-redhat-linux Thread model: posix gcc version 3.4.6 20060404 (Red Hat 3.4.6-3) openssl version OpenSSL 0.9.7a Feb 19 2003

1 0

setting up HTTPS service?
by joe＠strout.net 13 Nov '06

13 Nov '06

Complete newbie here, so please bear with me. I want to set up HTTPS service on a Mac OS X (10.4.7) machine running a custom web server. I imagine that Stunnel could be made to listen on the standard HTTPS port (443), do the encryption/decryption, and pass the resulting data to/from the HTTP port (80, or a custom port I specify). This is probably very easy, but none of the documentation or examples I found covered this. Has anyone done this? Or if not, can you sketch out how I would go about it? Any gotchas or caveats I should be aware of? Many thanks, - Joe

3 3

resending FD_SETSIZE and file ulimit
by Arunkumar Arumugam 10 Nov '06

10 Nov '06

Hi Guys - I have a stunnel setup in a linux box kernel 2.4 Advanced sever release 2.1AS (pensacola) . I am trying to increase the number of file descriptors with which stunnel could handle. So I did a ulimit -n 4096 for root and restarted the stunnel process. Now in the stunnel logs i see, ..... FD_SETSIZE=1024, file ulimit=4096- > 500 clients allowed. I dont completely understand the relation between FD_SETSIZE and file ulimit. I also read that a single stunnel connection might use around 2 or 3 file descriptors. So what is the cap on the number of file descriptors used by stunnel. To make it use , around 4096 file descriptors should i recompile the stunnel again with FD_SETSIZE set to 4096.? -- ARUN ARUMUGAM Galbraith's Law of Human Nature: Faced with the choice between changing ones' mind and proving that there is no need to do so, almost everybody gets busy on the proof.

1 0

stunnel on Windows with pkcs11
by Neil M. 10 Nov '06

10 Nov '06

Can anyone provide more details in how to get this setup working? I've setup stunnel in client mode just fine for normal SSL operations, but now I need to load a client certificate from a token. I've looked at the example in the documentation and changed the paths accordingly, but that doesn't seem to work, stunnel errors out complaining about a DSO. Neil

1 0

FD_SETSIZE and file ulimit
by Arunkumar Arumugam 10 Nov '06

10 Nov '06

Hi Guys - I have a stunnel setup in a linux box kernel 2.4 Advanced sever release 2.1AS (pensacola) . I am trying to increase the number of file descriptors with which stunnel could handle. So I did a ulimit -n 4096 for root and restarted the stunnel process. Now in the stunnel logs i see, ..... FD_SETSIZE=1024, file ulimit=4096- > 500 clients allowed. I dont completely understand the relation between FD_SETSIZE and file ulimit. I also read that a single stunnel connection might use around 2 or 3 file descriptors. So what is the cap on the number of file descriptors used by stunnel. To make it use , around 4096 file descriptors should i recompile the stunnel again with FD_SETSIZE set to 4096.? -- ARUN ARUMUGAM Galbraith's Law of Human Nature: Faced with the choice between changing ones' mind and proving that there is no need to do so, almost everybody gets busy on the proof.

2 1

stunnel 4.16 wrapped around an ldap server causing very slow binds
by Mark McCoy 05 Nov '06

05 Nov '06

Hey all, I have an instance of stunnel 4.16 on Solaris 10 that I am trying to use to wrap Sun Directory Server LDAP traffic in SSL. LDAP 'binds' take over 2 minutes to complete using stunnel, but only a split second (as they should) when using an SSH tunnel. I have disabled tcpwrappers per the stunnel FAQ with no results, and tried settting delay = "yes" and "no", with no differences in the results. An interesting thing is that if I try to bind using the wrong password, the "Invalid Credentials" error returns immediately. Using the correct password, the bind hangs for over 2 minutes. Any ideas on what to look for? ------------- Output of stunnel -version: stunnel 4.16 on sparc-sun-solaris2.10 with OpenSSL 0.9.8c 05 Sep 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Global options debug = 5 pid = /usr/local/stunnel/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/stunnel/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /usr/local/stunnel/etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none -------------- -- Mark McCoy -- Professional Unix geek Here in America we are descended in blood and in spirit from revolutionists and rebels - men and women who dared to dissent from accepted doctrine. As their heirs, may we never confuse honest dissent with disloyal subversion. -- Dwight D. Eisenhower

2 1

newbie sendmail + smtp question
by Fred nietzsche 03 Nov '06

03 Nov '06

My ISP requires all my mail to go to mail.myISP.net via SSL to port 465. I have sendmail compiled with STARTTLS, configured authinfo and I've set up sendmail's smarthost to send everything to mail.myISP.net I run stunnel like this. stunnel /etc/stunnel/stunnel.conf -c -d 25 -r mail.myISP.net:465 There are no errors in the log. I can see stunnel listening on 25 with netstat. When I try to send mail I get: bash-3.00# sendmail -v sc00b123(a)yahoo.com <test sc00b123(a)yahoo.com... Connecting to [127.0.0.1] via relay... Which just hangs for ever. My stunnel.conf looks like: cert = /etc/stunnel/mail.pem chroot = /var/stunnel/ setuid = nobody setgid = nogroup pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel.log [smtp] accept = 25 connect = 465 Thanks for any help, hints, etc.. --------------------------------- Low, Low, Low Rates! Check out Yahoo! Messenger's cheap PC-to-Phone call rates.

1 0

stunnel[2840]: Error binding pop3s to 0.0.0.0:995
by fxper 02 Nov '06

02 Nov '06

I'm trying to use stunnel on a redhat machine to securely check email, via xinetd via pop3d. My /etc/xinetd.d/pop3s looks like this: service pop3s { socket_type = stream wait = no user = root server = /usr/sbin/stunnel log_on_success += USERID log_on_failure += USERID disable = no } And netstat just shows xinetd on 995: netstat -apn|grep 995 tcp 0 0 0.0.0.0:995 0.0.0.0:* LISTEN 2797/xinetd When I try to check mail with my client hitting port 995, I get this in /var/log/secure using debug level 7: Nov 1 16:17:24 myhostname xinetd[2797]: START: pop3s pid=2840 from=x.x.x.x Nov 1 16:17:54 myhostname stunnel[2840]: stunnel 4.04 on i386-redhat-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 Nov 1 16:17:54 myhostname stunnel[2840]: Snagged 64 random bytes from /dev/urandom Nov 1 16:17:54 myhostname stunnel[2840]: RAND_status claims sufficient entropy for the PRNG Nov 1 16:17:54 myhostname stunnel[2840]: PRNG seeded successfully Nov 1 16:17:54 myhostname stunnel[2840]: Certificate: /usr/share/ssl/certs/stunnel.pem Nov 1 16:17:54 myhostname stunnel[2840]: Key file: /usr/share/ssl/certs/stunnel.pem Nov 1 16:17:54 myhostname stunnel[2840]: FD_SETSIZE=1024, file ulimit=1024 -> 500 clients allowed Nov 1 16:17:54 myhostname stunnel[2840]: FD 4 in non-blocking mode Nov 1 16:17:54 myhostname stunnel[2840]: SO_REUSEADDR option set on accept socket Nov 1 16:17:54 myhostname stunnel[2840]: Error binding pop3s to 0.0.0.0:995 Nov 1 16:17:54 myhostname stunnel[2840]: bind: Address already in use (98) Any suggestions? Thanks! --------------------------------- Want to start your own business? Learn how on Yahoo! Small Business.

1 0

How to disable SSLv2
by Tommi Nieminen 30 Oct '06

30 Oct '06

I'm using Stunnel 4.18. I would like to disable SSLv2, but allow SSLv3 and TLSv1. Is this currently possible in Stunnel? I've tried two things so far: first I tried to use the option options = SSL_OP_NO_SSLv2 (from "man SSL_CTX_set_options") It didn't work. This is what I got: 2006.10.27 18:32:48 LOG7[6358:3082897088]: Snagged 64 random bytes from /root/.rnd 2006.10.27 18:32:48 LOG7[6358:3082897088]: Wrote 1024 new random bytes to /root/.rnd 2006.10.27 18:32:48 LOG7[6358:3082897088]: RAND_status claims sufficient entropy for the PRNG 2006.10.27 18:32:48 LOG7[6358:3082897088]: PRNG seeded successfully file /etc/stunnel/stunnel.conf line 18: Illegal SSL option Nothing gets logged, the above is the response to the startup command. The other thing I tried, though I really didn't expect it to work, was replacing the "options" option with sslVersion = SSLv3 TLSv1 This option seems to accept only one version at a time, or alternatively all of them with "all" on the right hand side, so this failed, stunnel didn't start. Any suggestions? The only thing I can think of is that the SSL option SSL_OP_NO_SSLv2 is something that should have been when configuring the OpenSSL installation, and since I have a readily wrapped package, it has not been included there. In that case I could install OpenSSL from the scratch. But before I try that, I thought I would ask if somebody were already familiar with the problem. Tommi Nieminen --------------------------------------------------- Here is the stunnel config file I was using: CAfile = /etc/stunnel/root-cert.pem cert = /etc/stunnel/device-cert.pem key = /etc/stunnel/device-key.pem output = /var/log/stunnel/stunnel.log pid = /var/run/stunnel/stunnel.pid debug = 7 client = no [https] accept = 443 connect = 192.168.10.17:5010 verify = 1 options = SSL_OP_NO_SSLv2 ;sslVersion = SSLv3 TLSv1

2 2

stunnel patch for extra logging
by Steven Van Acker 29 Oct '06

29 Oct '06

Hi, we use stunnel in server-mode where an SSL enabled client can connect to our stunnel, and then stunnel connects to a non-SSL backend server. The backend server logs incoming connections from stunnel (source IP and port), but stunnel doesn't log the same information. This makes it difficult to match logs between stunnel and the backend. This patch solves exactly this problem. I rewrote the patch so that it can be cleanly applied to any future (and past) version of stunnel. >From the website: "How do I get a patch included into the release versions of Stunnel? Only patches released into the public domain stand a chance of getting into the actual Stunnel source. This means revised BSD patches are likely acceptable. Original BSD and GNU patches are not for example." Since I would like very much that this patch makes it into the next release, I'll release it into the public domain or any other license that makes this possible. kind regards, Steven -- My amazon wishlist: http://www.amazon.com/gp/registry/1DB4XNEIEQBPB

2 1

Re: [stunnel-users] Fork Error
by Michal Trojnara 29 Oct '06

29 Oct '06

On Friday 27 October 2006 22:39, John O'Fallon wrote: > I do believe, though, that the problem is due to a change in Stunnel > between version 4.15 and 4.17, since the crash occurs when running > 4.17, but reverting to 4.15 on exactly the same system clears it up. > I have seen this on at least 2 different Mac servers. Please make some tests for me: 1. Try: ./configure --disable-libwrap make clean make make install 2. Check if there are some zombies produced by stunnel. 3. Include your configuration file and the output of "stunnel -version" with your next email. Best regards, Mike

1 0

SMTP & TLS
by Eric B. 27 Oct '06

27 Oct '06

Hi, I've been looking over using stunnel to secure SMTP connections, but am a little confused about how the protocol works. From what I've read, the STARTTLS command is used to allow a client/server to upgrade a connection from plaintext to SSL secured. Further to that, from what I understand, the concept is to allow/use a single port to initiate all connections - ex: port 25. >From what I can tell from stunnel however, is that once stunnel issues the STARTTLS command, if the client doesn't respond in kind, then the connection is terminated. I've tried reading the RFC, but can't seem to find what happens in the case where the client rejects or does not respond to the STARTTLS command. Logicially, I would expect the SMTP connection to continue normally in plaintext. Apparently, this is not how stunnel works. Can someone please help fill in the blanks for me please? What is supposed to happen if the client refuses the STARTTLS request from the server? If the connection is supposed to die, why bother with the STARTTLS request at all, and not just impose the SSL encrypted tunnel from the very beginning (as per the old SSMTP specs)? Thanks, Eric

1 0

Fork Error
by John O'Fallon 27 Oct '06

27 Oct '06

Since upgrading to Stunnel 4.17, I occasionally get the following error: 2006.10.18 23:08:45 LOG3[7007:25232896]: fork: Resource temporarily unavailable (35) 2006.10.18 23:08:45 LOG5[7007:25232896]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket The problem doesn't occur right away, but after some number of hits on the server. Reverting to Stunnel 4.15 corrects the problem. This is an OS X 10.4 Mac. I haven't confirmed the problem with 4.18, because the release notes indicate mainly changes relevant to Win32. Has any one else seen the problem? Michal, any thoughts? TIA, John

2 1

Stunnel hangs on big flows of data
by Dario Mariani 27 Oct '06

27 Oct '06

Hi... I'm deploying stunnel on some servers. I did some tests, and i never had problems. For example, i tried 5k parallel connections, and i didn't have any problem. But, i have problems when a small number of connections wants to transfer big chunks of information; the connection hangs. This is a snippet of logs: Server side: 2006.10.20 16:00:58 LOG7[20302:1]: oracle11521 accepted FD=226 from 192.168.22.10:39721 2006.10.20 16:00:58 LOG7[20302:200]: oracle11521 started 2006.10.20 16:00:58 LOG7[20302:200]: FD 226 in non-blocking mode 2006.10.20 16:00:58 LOG7[20302:200]: TCP_NODELAY option set on local socket 2006.10.20 16:00:58 LOG5[20302:200]: oracle11521 connected from 192.168.22.10:39721 2006.10.20 16:00:58 LOG7[20302:200]: SSL state (accept): before/ accept initialization 2006.10.20 16:00:58 LOG7[20302:200]: SSL state (accept): SSLv3 read client hello A 2006.10.20 16:00:58 LOG7[20302:200]: SSL state (accept): SSLv3 write server hello A 2006.10.20 16:00:58 LOG7[20302:200]: SSL state (accept): SSLv3 write change cipher spec A 2006.10.20 16:00:58 LOG7[20302:200]: SSL state (accept): SSLv3 write finished A 2006.10.20 16:00:58 LOG7[20302:200]: SSL state (accept): SSLv3 flush data 2006.10.20 16:00:58 LOG7[20302:200]: SSL state (accept): SSLv3 read finished A 2006.10.20 16:00:58 LOG7[20302:200]: 3 items in the session cache 2006.10.20 16:00:58 LOG7[20302:200]: 0 client connects (SSL_connect ()) 2006.10.20 16:00:58 LOG7[20302:200]: 0 client connects that finished 2006.10.20 16:00:58 LOG7[20302:200]: 0 client renegotiations requested 2006.10.20 16:00:58 LOG7[20302:200]: 199 server connects (SSL_accept()) 2006.10.20 16:00:58 LOG7[20302:200]: 194 server connects that finished 2006.10.20 16:00:58 LOG7[20302:200]: 0 server renegotiations requested 2006.10.20 16:00:58 LOG7[20302:200]: 173 session cache hits 2006.10.20 16:00:58 LOG7[20302:200]: 0 session cache misses 2006.10.20 16:00:58 LOG7[20302:200]: 18 session cache timeouts 2006.10.20 16:00:58 LOG6[20302:200]: SSL accepted: previous session reused 2006.10.20 16:00:58 LOG7[20302:200]: FD 227 in non-blocking mode 2006.10.20 16:00:58 LOG7[20302:200]: oracle11521 connecting 192.168.22.13:1521 2006.10.20 16:00:58 LOG7[20302:200]: connect_wait: waiting 10 seconds 2006.10.20 16:00:58 LOG7[20302:200]: connect_wait: connected 2006.10.20 16:00:58 LOG7[20302:200]: Remote FD=227 initialized 2006.10.20 16:00:58 LOG7[20302:200]: TCP_NODELAY option set on remote socket 2006.10.20 16:00:58 LOG7[20302:75]: SSL_read returned WANT_READ: retrying 2006.10.20 16:00:58 LOG7[20302:75]: SSL_read returned WANT_READ: retrying 2006.10.20 16:00:58 LOG7[20302:75]: SSL_read returned WANT_READ: retrying client side: 2006.10.20 16:16:01 LOG6[12415:91]: SSL connected: new session negotiated 2006.10.20 16:16:01 LOG6[12415:91]: Negotiated ciphers: DES-CBC3- SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2006.10.20 16:16:01 LOG7[12415:91]: Socket closed on read 2006.10.20 16:16:01 LOG7[12415:91]: SSL write shutdown 2006.10.20 16:16:01 LOG7[12415:91]: SSL alert (write): warning: close notify 2006.10.20 16:16:01 LOG7[12415:91]: SSL_shutdown retrying 2006.10.20 16:16:01 LOG7[12415:91]: SSL doesn't need to read or write 2006.10.20 16:16:01 LOG7[12415:91]: SSL alert (read): warning: close notify 2006.10.20 16:16:01 LOG7[12415:91]: SSL closed on SSL_read 2006.10.20 16:16:01 LOG7[12415:91]: Socket write shutdown 2006.10.20 16:16:01 LOG5[12415:91]: Connection closed: 3663 bytes sent to SSL, 5239 bytes sent to socket 2006.10.20 16:16:01 LOG7[12415:91]: oracle11521 finished (3 left) The timings are shifted, i don't know if the delta of time is related to a misconfiguration of clock on the machines, or are snippets taken from different events... i don't have direct access to the machines. I tried to make a test (client and server on the same machine) client: nc localhost 10001 >>/dev/null stunnel accept on 10001 and connect to localhost:11521 on the server side: stunnel accept on 11521 and connect on 1521 cat 230megsfile | nc -l -p 1521 & 2>&1 >>/dev/null so, when the nc on client side connects, the server starts the cat. It did complete correctly within a pair of minutes on an ibook 64 1.33 1g ram, but with LOADS of want_read and want_write errors on both sides of stunnel. The server and client are working on "big iron", i mean some superdome hardware with 30-40 cpu on both sides, and with an estimated traffic of 10gig/day And, important... the version of the stunnel instances is 4.15 Can you help me? Bye, dario.

2 4

Fwd: [stunnel-users] Stunnel client not sending data
by Jeremiah Martell 26 Oct '06

26 Oct '06

I forgot to send this to the entire group. My server program was listening on the wrong port. :-) Thanks, - Jeremiah ---------- Forwarded message ---------- From: Jeremiah Martell <inlovewithgod(a)gmail.com> Date: Oct 25, 2006 8:59 AM Subject: Re: [stunnel-users] Stunnel client not sending data To: Carter Browne <cbrowne(a)cbcs-usa.com> HA! Such a simple thing, but yes, that was the problem. I had the wrong port. :-) Thanks, - Jeremiah On 10/25/06, Carter Browne <cbrowne(a)cbcs-usa.com> wrote: > Jeremiah, > > I set the debug level on a stunnel configuration to 7 to understand better where you are failing. You have established > good connection to stunnel, but stunnel cannot get to 127.0.0.1:10000. So is your application listening on > 127.0.0.1:10000? Have you tried running netstat -an to establish that there is a process listening to the port? > > Carter > > Jeremiah Martell wrote: > > Carter, > > > > You're right. That was a typo error on my part. My config says 1.2.3.70. > > > > Anything other ideas? > > > > Thanks, > > - Jeremiah > > > > On 10/25/06, Carter Browne <cbrowne(a)cbcs-usa.com> wrote: > >> On the server side, I think you should be receiving on 1.2.3.70 (since > >> that is where you are sending the data). > >> > >> Carter > >> > >> Jeremiah Martell wrote: > >> > Hello, > >> > > >> > I have a program that opens up a connection to port 10000 of a server > >> > and sends it some data. It works normally. I'm trying to "stunnel" > >> > both ends. > >> > > >> > In my program I create a socket, connect to local port 7033, send my > >> > data, and close the socket. I verified that every function call > >> > returns success (socket, setsockopt (for TCP_NODELAY), gethostbyname, > >> > connect, and send). > >> > > >> >> From what the logs show below, it seems that server stunnel gets the > >> > connection from the client stunnel, they successfully negotiate the > >> > SSL stuff, then the client stunnel waits for any data to proxy to the > >> > server stunnel. The server stunnel is waiting too, and after 10 > >> > seconds of no data, it closes the socket. > >> > > >> > For some reason the client stunnel is not getting my data and > >> > therefore doesn't forward anything over to the server stunnel. I'm not > >> > sure why this is happening, because my program works normally and I've > >> > verified that everything returned success. > >> > > >> > Any ideas? > >> > > >> > - Jeremiah > >> > > >> > ----------------------------- > >> > > >> > ON CLIENT (1.2.3.60) > >> > > >> > Linux > >> > stunnel 4.16 > >> > OpenSSL 0.9.7c > >> > > >> > stunnel.conf is... > >> > pid = > >> > client = yes > >> > > >> > [7033] > >> > accept = 127.0.0.1:7033 > >> > connect = 1.2.3.70:7033 > >> > > >> > ----------------------------- > >> > > >> > ON SERVER (1.2.3.70) > >> > > >> > Windows > >> > stunnel 4.16 windows binary installer (Aug 31 2006) > >> > > >> > stunnel.conf is... > >> > > >> > cert = stunnel.pem > >> > socket = l:TCP_NODELAY=1 > >> > socket = r:TCP_NODELAY=1 > >> > debug = 7 > >> > > >> > [7033] > >> > accept = 1.2.3.60:7033 > >> > connect = 127.0.0.1:10000 > >> > > >> > ----------------------------- > >> > > >> > On client I see this debug... > >> > > >> > Oct 24 14:38:22 stunnel: LOG5[2892:258]: 7033 connected from > >> > 127.0.0.1:10251 > >> > Oct 24 14:38:32 stunnel: LOG3[2892:258]: SSL_read: Connection reset by > >> > peer (104) > >> > Oct 24 14:38:32 stunnel: LOG5[2892:258]: Connection reset: 56 bytes > >> > sent to SSL, 0 bytes send to socket > >> > > >> > ----------------------------- > >> > > >> > On server I see this debug... > >> > > >> > 2006.10.24 14:43:08 LOG7[2596:4068]: 7033 accepted FD=196 from > >> > 1.2.3.60:10252 > >> > 2006.10.24 14:43:08 LOG7[2596:4068]: Creating a new thread > >> > 2006.10.24 14:43:09 LOG7[2596:4068]: New thread created > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 7033 started > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: FD 196 in non-blocking mode > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: TCP_NODELAY option set on local > >> socket > >> > 2006.10.24 14:43:09 LOG5[2596:2372]: 7033 connected from 1.2.3.60:10252 > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): before/accept > >> > initialization > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 read > >> > client hello A > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write > >> > server hello A > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write > >> > certificate A > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write > >> > server done A > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 flush > >> data > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 read > >> > client key exchange A > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 read > >> > finished A > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write > >> > change cipher spec A > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write > >> > finished A > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 flush > >> data > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 3 items in the session cache > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 0 client connects > >> (SSL_connect()) > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 0 client connects that finished > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 0 client renegotiations > >> requested > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 5 server connects > >> (SSL_accept()) > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 5 server connects that finished > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 0 server renegotiations > >> requested > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 1 session cache hits > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 1 session cache misses > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 1 session cache timeouts > >> > 2006.10.24 14:43:09 LOG6[2596:2372]: SSL accepted: new session > >> negotiated > >> > 2006.10.24 14:43:09 LOG6[2596:2372]: Negotiated ciphers: AES256-SHA > >> > SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: FD 180 in non-blocking mode > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 7033 connecting 127.0.0.1:10000 > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: connect_wait: waiting 10 seconds > >> > 2006.10.24 14:43:19 LOG6[2596:2372]: connect_wait: s_poll_wait timeout > >> > 2006.10.24 14:43:19 LOG5[2596:2372]: Connection reset: 0 bytes sent to > >> > SSL, 0 bytes sent to socket > >> > 2006.10.24 14:43:19 LOG7[2596:2372]: 7033 finished (0 left) > >> > _______________________________________________ > >> > stunnel-users mailing list > >> > stunnel-users(a)mirt.net > >> > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > >> > > >> > >> > >> > > > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > >

1 0

Trying to redirect with stunnel - seems to hang
by Len DiMaggio 26 Oct '06

26 Oct '06

'Evening everyone, I'm wondering if anyone has already seen a problem like this. Background - I'm trying to use stunnel to act as an SSL server and redirect connections so that I can use the JMeter script recorder to build automated tests for an app's web GUI. (The recorder does not support SSL.) The software versions are: stunnel 4.15 on i686-redhat-linux-gnu with OpenSSL 0.9.8b 04 May 2006 I'm able to set up the redirection, and everything in the stunnel log looks OK - and, this is just making the connection manually - without JMeter - but trying to access the target app just hangs in the browser with a "connecting to..." status message. Here's the stunnel config file that I'm using - the log is attached. client=yes output=/tmp/stunnel.log debug=debug [8084] accept=hostname:8079 connect=hostname:8084 Interestingly - when I kill the stunnel process, the browser displays (most of) the target app's top level page. Thanks in advance, Len DiMaggio ldimaggi(a)redhat.com The stunnel log sez: 2006.10.24 04:58:33 LOG5[5869:3086362304]: stunnel 4.15 on i686-redhat-linux-gnu with OpenSSL 0.9.8b 04 May 2006 2006.10.24 04:58:33 LOG5[5869:3086362304]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2006.10.24 04:58:33 LOG6[5869:3086362304]: file ulimit = 1024 (can be changed with 'ulimit -n') 2006.10.24 04:58:33 LOG6[5869:3086362304]: poll() used - no FD_SETSIZE limit for file descriptors 2006.10.24 04:58:33 LOG5[5869:3086362304]: 500 clients allowed 2006.10.24 04:58:33 LOG7[5869:3086362304]: FD 4 in non-blocking mode 2006.10.24 04:58:33 LOG7[5869:3086362304]: FD 5 in non-blocking mode 2006.10.24 04:58:33 LOG7[5869:3086362304]: FD 6 in non-blocking mode 2006.10.24 04:58:33 LOG7[5869:3086362304]: SO_REUSEADDR option set on accept socket 2006.10.24 04:58:33 LOG7[5869:3086362304]: 8084 bound to 10.15.49.274:8079 2006.10.24 04:58:33 LOG7[5870:3086362304]: Created pid file /var/run/stunnel.pid 2006.10.24 04:58:52 LOG7[5870:3086362304]: 8084 accepted FD=7 from 172.16.83.99:58417 2006.10.24 04:58:52 LOG7[5870:3086359440]: 8084 started 2006.10.24 04:58:52 LOG7[5870:3086359440]: FD 7 in non-blocking mode 2006.10.24 04:58:52 LOG7[5870:3086359440]: FD 8 in non-blocking mode 2006.10.24 04:58:52 LOG7[5870:3086359440]: FD 9 in non-blocking mode 2006.10.24 04:58:52 LOG7[5870:3086362304]: Cleaning up the signal pipe 2006.10.24 04:58:52 LOG6[5870:3086362304]: Child process 5874 finished with code 0 2006.10.24 04:58:52 LOG7[5870:3086359440]: Connection from 172.16.83.99:58417 permitted by libwrap 2006.10.24 04:58:52 LOG5[5870:3086359440]: 8084 connected from 172.16.83.99:58417 2006.10.24 04:58:52 LOG7[5870:3086359440]: FD 8 in non-blocking mode 2006.10.24 04:58:52 LOG7[5870:3086359440]: 8084 connecting 10.15.49.274:8084 2006.10.24 04:58:52 LOG7[5870:3086359440]: connect_wait: waiting 10 seconds 2006.10.24 04:58:52 LOG7[5870:3086359440]: connect_wait: connected 2006.10.24 04:58:52 LOG7[5870:3086359440]: Remote FD=8 initialized 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): before/connect initialization 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 write client hello A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 read server hello A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 read server certificate A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 read server done A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 write client key exchange A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 write change cipher spec A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 write finished A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 flush data 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 read finished A 2006.10.24 04:58:52 LOG7[5870:3086359440]: 1 items in the session cache 2006.10.24 04:58:52 LOG7[5870:3086359440]: 1 client connects (SSL_connect()) 2006.10.24 04:58:52 LOG7[5870:3086359440]: 1 client connects that finished 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 client renegotiations requested 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 server connects (SSL_accept()) 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 server connects that finished 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 server renegotiations requested 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 session cache hits 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 session cache misses 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 session cache timeouts 2006.10.24 04:58:52 LOG6[5870:3086359440]: SSL connected: new session negotiated 2006.10.24 04:58:52 LOG6[5870:3086359440]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 -- Len DiMaggio (ldimaggi(a)redhat.com) Red Hat USA 10 Technology Park Drive Westford, MA 01886 tel: 978.392.3179 cell: 617.872.3673 http://www.redhat.com

3 2

status of www.stunnel.org
by Steven Van Acker 26 Oct '06

26 Oct '06

Hi, I noticed how the website http://www.stunnel.org is out of sync with the latest releases of stunnel. Are there plans to update this site ? And if not, would it be possible to redirect its visitors to http://stunnel.mirt.net/ automatically ? kind regards, -- Steven Van Acker -- My amazon wishlist: http://www.amazon.com/gp/registry/1DB4XNEIEQBPB

2 1

Stunnel client not sending data
by Jeremiah Martell 26 Oct '06

26 Oct '06

Hello, I have a program that opens up a connection to port 10000 of a server and sends it some data. It works normally. I'm trying to "stunnel" both ends. In my program I create a socket, connect to local port 7033, send my data, and close the socket. I verified that every function call returns success (socket, setsockopt (for TCP_NODELAY), gethostbyname, connect, and send). >From what the logs show below, it seems that server stunnel gets the connection from the client stunnel, they successfully negotiate the SSL stuff, then the client stunnel waits for any data to proxy to the server stunnel. The server stunnel is waiting too, and after 10 seconds of no data, it closes the socket. For some reason the client stunnel is not getting my data and therefore doesn't forward anything over to the server stunnel. I'm not sure why this is happening, because my program works normally and I've verified that everything returned success. Any ideas? - Jeremiah ----------------------------- ON CLIENT (1.2.3.60) Linux stunnel 4.16 OpenSSL 0.9.7c stunnel.conf is... pid = client = yes [7033] accept = 127.0.0.1:7033 connect = 1.2.3.70:7033 ----------------------------- ON SERVER (1.2.3.70) Windows stunnel 4.16 windows binary installer (Aug 31 2006) stunnel.conf is... cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 [7033] accept = 1.2.3.60:7033 connect = 127.0.0.1:10000 ----------------------------- On client I see this debug... Oct 24 14:38:22 stunnel: LOG5[2892:258]: 7033 connected from 127.0.0.1:10251 Oct 24 14:38:32 stunnel: LOG3[2892:258]: SSL_read: Connection reset by peer (104) Oct 24 14:38:32 stunnel: LOG5[2892:258]: Connection reset: 56 bytes sent to SSL, 0 bytes send to socket ----------------------------- On server I see this debug... 2006.10.24 14:43:08 LOG7[2596:4068]: 7033 accepted FD=196 from 1.2.3.60:10252 2006.10.24 14:43:08 LOG7[2596:4068]: Creating a new thread 2006.10.24 14:43:09 LOG7[2596:4068]: New thread created 2006.10.24 14:43:09 LOG7[2596:2372]: 7033 started 2006.10.24 14:43:09 LOG7[2596:2372]: FD 196 in non-blocking mode 2006.10.24 14:43:09 LOG7[2596:2372]: TCP_NODELAY option set on local socket 2006.10.24 14:43:09 LOG5[2596:2372]: 7033 connected from 1.2.3.60:10252 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): before/accept initialization 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 read client hello A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write server hello A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write certificate A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write server done A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 flush data 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 read client key exchange A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 read finished A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write change cipher spec A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write finished A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 flush data 2006.10.24 14:43:09 LOG7[2596:2372]: 3 items in the session cache 2006.10.24 14:43:09 LOG7[2596:2372]: 0 client connects (SSL_connect()) 2006.10.24 14:43:09 LOG7[2596:2372]: 0 client connects that finished 2006.10.24 14:43:09 LOG7[2596:2372]: 0 client renegotiations requested 2006.10.24 14:43:09 LOG7[2596:2372]: 5 server connects (SSL_accept()) 2006.10.24 14:43:09 LOG7[2596:2372]: 5 server connects that finished 2006.10.24 14:43:09 LOG7[2596:2372]: 0 server renegotiations requested 2006.10.24 14:43:09 LOG7[2596:2372]: 1 session cache hits 2006.10.24 14:43:09 LOG7[2596:2372]: 1 session cache misses 2006.10.24 14:43:09 LOG7[2596:2372]: 1 session cache timeouts 2006.10.24 14:43:09 LOG6[2596:2372]: SSL accepted: new session negotiated 2006.10.24 14:43:09 LOG6[2596:2372]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2006.10.24 14:43:09 LOG7[2596:2372]: FD 180 in non-blocking mode 2006.10.24 14:43:09 LOG7[2596:2372]: 7033 connecting 127.0.0.1:10000 2006.10.24 14:43:09 LOG7[2596:2372]: connect_wait: waiting 10 seconds 2006.10.24 14:43:19 LOG6[2596:2372]: connect_wait: s_poll_wait timeout 2006.10.24 14:43:19 LOG5[2596:2372]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.10.24 14:43:19 LOG7[2596:2372]: 7033 finished (0 left)

3 4

[OT] Questions about OpenSSL
by Gonzalo Diethelm 25 Oct '06

25 Oct '06

Hello everyone, I have a slightly off-topic question but one I think stunnel's developers are in a good position to assist me with. I need to implement what amounts to an embedded web server for a process that will be deployed on a "hostile" server (Win32), meaning that I don't want the people in that server to mess around with either the process or the network traffic to/from the process. The goal is to deploy a binary and a set of DLLs to the hostile server (no configuration files). To this effect, I have found a couple of usable HTTP server libraries, and I have implemented the functionality I need over clean HTTP. Now, I would like to use SSL to encrypt the data coming and going to my process; alas, I have not found any open source HTTP library that also supports HTTPS. Therefore, I have come to the conclusion that I will have to integrate OpenSSL into one of the HTTP libraries myself. The first question is: how difficult is it to integrate OpenSSL in "server mode" into an application? I tried taking a peek at Apache's mod_ssl, but being unfamiliar with Apache's internals, I was completely lost. Then it occurred to me that stunnel must do something similar to what I need, and indeed I could follow the code in stunnel to a point; before going any further, I wanted to first hear comments, opinions and hints from the developers. It also occurred to me that I could do what I need if stunnel offered some kind of "in process" handling of requests: instead of forwarding to a certain host:port the requests it gets, maybe stunnel itself could be configured to process the requests somehow, generate the responses and send them back; for instance, what I need to do is basically query a MySQL DB and send some records back. I am pretty sure this is not supported in stunnel today, but if it is something that anyone (besides me) sees as useful, I could volunteer to do at least part of the development. Alternatively, please feel free to educate me on why this is a moronic idea... In any case, thanks for a great product and best regards, -- Gonzalo Diethelm gonzalo.diethelm(a)aditiva.com

1 0

Connection problems and TCP frame checksum errors
by Tommi Nieminen 23 Oct '06

23 Oct '06

I have the following kind of test environment: SSL clients call a public ip address from which the calls are forwarded to a linux server with Stunnel. The linux server is in a private network. Stunnel decrypts the data and sends it forward. I have been testing this with a browser, monitoring the traffic on the server to see that Stunnel forwards the calls. Some strange things happen there that I can't explain. First of all: sometimes the calls go through the server as expected, sometimes the server doesn't respond in any way to the client. If I have two terminal windows open, one with tcpdump and another with tail -f stunnel.log - nothing comes into the log in spite of the incoming connections attempts. Then on other occasions when the calls come to the server, it forwards them beautifully to the address and port set in the configuration file. Does anyone have any clue, what this could be due to? I haven't been able to explain why it sometimes works and sometimes doesn't. Another thing that bothers me is, that sometimes there are TCP frames with incorrect checksum. I've monitored with Ethereal and tcpdump. Both show incorrect frames, and they are always from the stunnel-end of the connection. What could be the cause of those broken frames? Tommi Nieminen -------------------------------------------------------- My stunnel.conf looks like this: (any constructive criticism would be welcome :-)) CAfile = /home/tommi/cert/7/demoCA/cacert.pem cert = /home/tommi/cert/7/newcert.pem key = /home/tommi/cert/7/newkey.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 output = /var/log/stunnel/stunnel.log pid = /var/run/stunnel/stunnel.pid debug = 7 client = no [https] accept = 443 connect = 192.168.10.17:5010 TIMEOUTclose = 0 -------------------------------------------------------- A succesful connection from stunnel.log: 2006.10.09 18:01:43 LOG7[11889:3083744960]: https accepted FD=7 from 131.177.254.92:2689 2006.10.09 18:01:43 LOG7[11889:3083742128]: https started 2006.10.09 18:01:43 LOG7[11889:3083742128]: FD 7 in non-blocking mode 2006.10.09 18:01:43 LOG7[11889:3083742128]: TCP_NODELAY option set on local socket 2006.10.09 18:01:43 LOG5[11889:3083742128]: https connected from 131.177.254.92:2689 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): before/accept initialization 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 read client hello A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 write server hello A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 write certificate A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 write server done A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 flush data 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 read client key exchange A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 read finished A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 write change cipher spec A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 write finished A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 flush data 2006.10.09 18:01:43 LOG7[11889:3083742128]: 2 items in the session cache 2006.10.09 18:01:43 LOG7[11889:3083742128]: 0 client connects (SSL_connect()) 2006.10.09 18:01:43 LOG7[11889:3083742128]: 0 client connects that finished 2006.10.09 18:01:43 LOG7[11889:3083742128]: 0 client renegotiations requested 2006.10.09 18:01:43 LOG7[11889:3083742128]: 8 server connects (SSL_accept()) 2006.10.09 18:01:43 LOG7[11889:3083742128]: 7 server connects that finished 2006.10.09 18:01:43 LOG7[11889:3083742128]: 0 server renegotiations requested 2006.10.09 18:01:43 LOG7[11889:3083742128]: 4 session cache hits 2006.10.09 18:01:43 LOG7[11889:3083742128]: 1 session cache misses 2006.10.09 18:01:43 LOG7[11889:3083742128]: 1 session cache timeouts 2006.10.09 18:01:43 LOG6[11889:3083742128]: SSL accepted: new session negotiated 2006.10.09 18:01:43 LOG6[11889:3083742128]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2006.10.09 18:01:43 LOG7[11889:3083742128]: FD 8 in non-blocking mode 2006.10.09 18:01:43 LOG7[11889:3083742128]: https connecting 192.168.10.17:5010 2006.10.09 18:01:43 LOG7[11889:3083742128]: connect_wait: waiting 10 seconds 2006.10.09 18:01:43 LOG7[11889:3083742128]: connect_wait: connected 2006.10.09 18:01:43 LOG7[11889:3083742128]: Remote FD=8 initialized 2006.10.09 18:01:43 LOG7[11889:3083742128]: TCP_NODELAY option set on remote socket 2006.10.09 18:02:45 LOG7[11889:3083742128]: Socket closed on read 2006.10.09 18:02:45 LOG7[11889:3083742128]: SSL write shutdown 2006.10.09 18:02:45 LOG7[11889:3083742128]: SSL alert (write): warning: close notify 2006.10.09 18:02:45 LOG7[11889:3083742128]: SSL_shutdown retrying 2006.10.09 18:02:45 LOG7[11889:3083742128]: SSL doesn't need to read or write 2006.10.09 18:02:45 LOG6[11889:3083742128]: s_poll_wait timeout: connection close 2006.10.09 18:02:45 LOG5[11889:3083742128]: Connection closed: 0 bytes sent to SSL, 405 bytes sent to socket 2006.10.09 18:02:45 LOG7[11889:3083742128]: https finished (0 left) (and the failed connections leave also no mark in the log, but tcpdump sees the attempts on the server) -------------------------------------------------------- A sample of tcpdump's output with incorrect checksum: 18:02:45.150656 IP (tos 0x0, ttl 64, id 11218, offset 0, flags [DF], proto: TCP (6), length: 77) 192.168.20.18.https > 131.177.254.92.2689: P, cksum 0x5708 (incorrect (-> 0xf1bf), 1035:1072(37) ack 756 win 7504

2 6

Thank you very much for all your donations
by Michal Trojnara 21 Oct '06

21 Oct '06

Dear Users, I want you to know how much grateful I am for all your donations. Thank you very much. Some day stunnel may be full-time job. 8-) Even now sponsored features make a substantial addition to my budget. BTW: I have updated currency to USD. I hope it's more convenient. http://stunnel.mirt.net/ Best regards, Mike

1 0

error 1703, service already exists.
by Joop Blokker 20 Oct '06

20 Oct '06

Hello, I'm using sTunnel v4.18 under Windows XP as a client. I start the serv= ice with sTunnel -install -quiet If, for any reason, the same command is given again then the error mes= sage "Create service; error 1703; the specified service already exists= " pops up. In that case the -quiet parameter does not work. I do not w= ant to see that error message; if the service is running then it's oka= y. Q:. How can I suppress that error message? If that is not an option, h= ow can I detect that the sTunnel service is installed already? I'm programming in PowerBASIC - I know how to detect sTunnel once it h= as started with -start -quiet Thanks in advance for any idea! Joop. +++ Too far East is West. - Proverb (English) +++

2 1

stunnel client without any configuration
by Thomas Stegbauer 18 Oct '06

18 Oct '06

hi ml, i searched the list about an idea, but didn't find the complete answer, so i would ask: i am thinking about a https website (with logon), where you can download a completly preconfigured package (java-applet?) which checks HTTP_PROXY on unix and the msie registry settings on windows and connect a local port to a remote running stunnel, listening on port 443 (the stunnel ist running on a different ip). currently there are imho two points, which need solved: 1.) there is no proxy support, without a patch 2.) it is currently not possible to download a preconfigured package are there some thoughts? greetings thomas -- # Thomas Stegbauer # https://keyserver1.pgp.com/vkd/DownloadKey.event?keyid=0x9A3F1866FC68E91D # Key fingerprint = 5A2D FEDC 8A50 F1BB 25FB 967B 9A3F 1866 FC68 E91D

2 1

Infinite client timeout
by Dario Mariani 18 Oct '06

18 Oct '06

Hi all, i'm a new user :) I'm deploying stunnel into a big enterprise, so i have met a lot of interesting details about Stunnel :) I have a little problem now: a Stunnel channel connecting BEA Weblogic -> Oracle listener. BEA has the BIG problem of _completely locking_ when the connection goes down: when the connection comes up again, bea doesn't work. This is not an issue, because there's a keepalive feature that can be activated in BEA. In a case, we _cannot_ activate the keepalive, so we must try to keep the BEA -> stunnel client conection open indefinitely. I think this must apply to the other parts of the connection, but i'm not sure (if the bea -> client connection remains active, the client then can renegotiate the connection without bea noticing it? and the server -> oracle connection?) Ok, i'm a little confused here :) Can you help me with this issue? Bye, dario.

1 0

New feature - PayPal donations
by Michal Trojnara 16 Oct '06

16 Oct '06

Dear Users, Since PayPal finally decided to provide full support for users in Poland I've added a donation button on the web page. http://stunnel.mirt.net/ I really appreciate each donation. 8-) Best regards, Mike

1 0

"Peer suddenly disconnected" after upgrade to 4.18
by Asarian 13 Oct '06

13 Oct '06

Hello, I'm a long time user of stunnel. Yesterday I finally upgraded to stunnel 4.18. Can't get it to work anymore, though. :( Here is the relevant part of my config: ----------------------- cert = /etc/stunnel.pem key = /etc/stunnel.pem ciphers = ALL:!ADH:RC4+RSA:+SSLv2:@STRENGTH sslVersion = SSLv2 setuid = nobody setgid = nobody socket = l:TCP_NODELAY=1 debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none [pop3s] accept = 995 exec = /usr/local/libexec/inet-qpopper execargs = inet-qpopper -s transparent = yes [imaps] accept = 993 exec = /usr/local/libexec/imapd execargs = imapd transparent = yes ----------------------- With the exception of a few keyword changes, this is the config I've always used. But I always get these errors now: Oct 14 00:57:40 asarian-host stunnel: LOG5[49682:134621184]: pop3s connected from 192.168.79.4:2576 Oct 14 00:57:40 asarian-host stunnel: LOG3[49682:134621184]: SSL_accept: Peer suddenly disconnected Oct 14 00:57:40 asarian-host stunnel: LOG3[49682:134621184]: SSL_accept: Peer suddenly disconnected Oct 14 00:57:40 asarian-host stunnel: LOG5[49682:134621184]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Oct 14 00:57:40 asarian-host stunnel: LOG5[49682:134621184]: pop3s connected from 192.168.1.4:2579 Oct 14 00:57:40 asarian-host stunnel: LOG3[49682:134621184]: SSL_accept: Peer suddenly disconnected Oct 14 00:57:40 asarian-host stunnel: LOG5[49682:134621184]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket The cert and key are good (I use em for Apache, too). I also tried SSLv3, but got this error: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number But I like to get it working with SSLv2 first; then I'll worry about the other thing later. :) I hope someone can tell me what I'm doing wrong. Thanks, - Mark

1 0

SegFault with stunnel
by Beyerle, Christian 12 Oct '06

12 Oct '06

Hello Everyone, I try to encrypt a Mysql-Connection between two host which run Suse Linux 10.1. On the Server runs a mysql database, on the client runs barnyard (a plugin for snort) which should write into the mysql database. I installed stunnel 4.14 on x86_64-suse-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 on both servers. The Configuration file on the Server (mysql) looks like: client = no debug = 7777777 output = /var/log/stunnel.log [mysqls] accept = 10439 connect = 127.0.0.1:3306 Stunnel seems to run well: lsof -i -n | grep stunnel stunnel 25330 stunnel 6u IPv4 371490 TCP *:10439 (LISTEN) On the client: [mysqls] client = yes accept = 127.0.0.1:3306 connect = 172.16.1.80:10439 Stunnel seems to run as well as on the server: stunnel 16634 stunnel 6u IPv4 22487 TCP 127.0.0.1:mysql (LISTEN) If i start barnyard that should connect to port 3306, barnyard cannot open the port and quits. I looked in my syslog and found the following entry: Oct 12 14:10:28 CLIENT kernel: stunnel[10991]: segfault at 0000000055697fb0 rip 000055555555b793 rsp 00005555556b0520 error 4 Oct 12 14:10:28 CLIENT barnyard[10997]: FATAL ERROR: Failed to connect to database snort:[email protected]/sensors: Lost connection to MySQL server during query Oct 12 14:10:28 CLIENT barnyard[10997]: Exiting I find no log of stunnel which help me to understand the reason of the crash. After this stunnel not too seem runnign anymore on the port: lsof -i -n | grep stunnel (no output) Does anybody have an idea??? Thank you for the help, -- Chris

1 0

[stunnel-users]Plan for new authorisation method in Stunnel
by Thomas Thiele 11 Oct '06

11 Oct '06

Hello Stunnel Users, I am planning to develop a new authorisation method for Stunnel which I need for work. This method will be an addition to the existing methods for checking certificates. The idea is to use the subject names and the alternative names of the certificates to allow or drop connections. The subject and alternative names of the machines/clients that are allowed to connect to the server will be written into the Stunnel config. While checking the certificates, the subject and alternative names from the Stunnel config will be compared with the subject and alternative names in the certirficate from the connection request. If one of the names from the Stunnel config matches with the names from the certificate then the connection will be allowed. This is the basic idea of my project. Is anyone already working on something like that or do you have any ideas or suggestions for me? Best Regards, Thomas Thiele -- GMX DSL-Flatrate 0,- Euro* - Überall, wo DSL verfügbar ist! NEU: Jetzt bis zu 16.000 kBit/s! http://www.gmx.net/de/go/dsl

2 1

libstunnel.so
by Andrew Schulman 05 Oct '06

05 Oct '06

The Debian stunnel (actually stunnel4) package includes /usr/lib/libstunnel.so. I have two questions about this file: (1) What is its purpose? ldd shows that /usr/bin/stunnel doesn't depend on it. So is this the shared library referred to in stunnel(1), under the 'transparent' option? The man page says that to use 'transparent' one has to LD_PRELOAD env.so, but I don't find any env.so. I see that env.c is used in building libstunnel.a, so I'm guessing that the man page meant to say libstunnel.so instead of env.so. (2) How does one build it? configure includes a --with-shared-libs option, but even when that's enabled I don't get a libstunnel.so when I build. And I can't find any make targets for any .so files. Yet Debian includes this file. Thanks, Andrew.

1 0

Configure can't find openssl in Ubuntu
by Tommi Nieminen 04 Oct '06

04 Oct '06

Hello, I have an Ubuntu 6.06.1 (Dapper) where I'm trying to install Stunnel. First I tried to install Stunnel using Ubuntu's package manager (apt-get install stunnel4). The installation went very smoothly but the fact that stunnel didn't recognize the -V switch left me with an uneasy feeling that something else might be lacking, too. The Ubuntu package in question contains Stunnel 4.14. Stunnel 3.26, installed from another package, does recognize the -V switch. So then I tried several times installing stunnel from source. A few obstacles I managed to overcome, but now that the configure script stops telling that it can't find SSL directory checking for SSL directory... Not found Couldn't find your SSL library installation dir Use --with-ssl option to fix this problem I'm out of resources. The script seems to check the existence of ssl.h file: checkssldir() { : if test -f "$1/include/openssl/ssl.h" Despite the fact that I have OpenSSL 0.9.8a on my machine, I don't have ssl.h file anywhere, I checked that with find. I tried installing Linux headers, but that didn't help (well I didn't expect it to help, but I couldn't think of anything). Is there some package I should get, that doesn't come with the openssl package or how should I solve this problem? Any ideas? Another problem that I had when I was experimenting with Stunnel 3.26 was the fact, that I couldn't start it up. It kept asking for the -r or -l switch. What I want to do with Stunnel is to decrypt the traffic coming in on one interface and then forward it to another machine through another interface. I tried several different configuration files, this is one of them (without indentations): cert = stunnel.pem key = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 1 debug = 7 output = stunnel.log client = no [https] accept = 443 connect = 192.168.10.17:5010 TIMEOUTclose = 0 I didn't get any debug information and -f switch didn't give anything more. I tried the Windows version (4.18) on another pc and it seemed to do exactly what I wanted. (the config file may have been slightly different, at least no debug was set. I really would like to get this working on a Linux box, too. Tommi Nieminen

3 3

Convert to SSL
by Bob 04 Oct '06

04 Oct '06

Hello all, I have been looking online at the examples but can't seem to quite figure out how to do this. We are currently using stunnel to receive SSL message and redirect them as regular messages but now I need to go the other way first. Is it possible to setup stunnel to receive an non-SSL messages and redirect it as an SSL message? and can this be done in the current config file or do I have to run 2 stunnel daemons? Also, the new one has to validate certificates. -- _______________________________________________________________________ Thanks, Bob (bobif(a)adelphia.net) YahooIM: bobifx AOLIM: bobifmd ICQ: 111083556

1 0

"SSL3_GET_RECORD:wrong version number" error
by James Brown 04 Oct '06

04 Oct '06

I am having problems connecting to stunnel and was hoping someone could help me. When starting stunnel and then trying to send an SSL-encrypted email through it I get: $ sudo /usr/local/sbin/stunnel /sw/etc/stunnel/stunnel.conf -D 465 -r 25 2006.10.04 11:03:28 LOG7[29230:2684415368]: Snagged 64 random bytes from /Users/jlbrown/.rnd 2006.10.04 11:03:28 LOG7[29230:2684415368]: Wrote 1024 new random bytes to /Users/jlbrown/.rnd 2006.10.04 11:03:28 LOG7[29230:2684415368]: RAND_status claims sufficient entropy for the PRNG 2006.10.04 11:03:28 LOG7[29230:2684415368]: PRNG seeded successfully 2006.10.04 11:03:28 LOG7[29230:2684415368]: Certificate: /Users/ jlbrown/%1.pem 2006.10.04 11:03:28 LOG7[29230:2684415368]: Certificate loaded 2006.10.04 11:03:28 LOG7[29230:2684415368]: Key file: /Users/jlbrown/% 1.pem 2006.10.04 11:03:28 LOG7[29230:2684415368]: Private key loaded 2006.10.04 11:03:28 LOG7[29230:2684415368]: SSL context initialized for service ssmtp 2006.10.04 11:03:28 LOG5[29230:2684415368]: stunnel 4.18 on powerpc- apple-darwin8.8.0 with OpenSSL 0.9.7i 14 Oct 2005 2006.10.04 11:03:28 LOG5[29230:2684415368]: Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv4 Auth:LIBWRAP 2006.10.04 11:03:28 LOG6[29230:2684415368]: file ulimit = 256 (can be changed with 'ulimit -n') 2006.10.04 11:03:28 LOG6[29230:2684415368]: FD_SETSIZE = 1024 (some systems allow to increase this value) 2006.10.04 11:03:28 LOG5[29230:2684415368]: 125 clients allowed 2006.10.04 11:03:28 LOG7[29230:2684415368]: FD 6 in non-blocking mode 2006.10.04 11:03:28 LOG7[29230:2684415368]: FD 7 in non-blocking mode 2006.10.04 11:03:28 LOG7[29230:2684415368]: FD 8 in non-blocking mode 2006.10.04 11:03:28 LOG7[29230:2684415368]: SO_REUSEADDR option set on accept socket 2006.10.04 11:03:28 LOG7[29230:2684415368]: ssmtp bound to 0.0.0.0:465 James-Browns-Computer-2:~/stunnel-4.18 jlbrown$ 2006.10.04 11:03:28 LOG7[29231:2684415368]: Created pid file /usr/local/var/run/stunnel/ stunnel.pid 2006.10.04 11:08:08 LOG7[29231:2684415368]: ssmtp accepted FD=9 from 127.0.0.1:64235 2006.10.04 11:08:08 LOG7[29231:25188864]: ssmtp started 2006.10.04 11:08:08 LOG7[29231:25188864]: FD 9 in non-blocking mode 2006.10.04 11:08:08 LOG7[29231:25188864]: TCP_NODELAY option set on local socket 2006.10.04 11:08:08 LOG7[29231:25188864]: FD 10 in non-blocking mode 2006.10.04 11:08:08 LOG7[29231:25188864]: FD 11 in non-blocking mode 2006.10.04 11:08:08 LOG7[29231:25188864]: Connection from 127.0.0.1:64235 permitted by libwrap 2006.10.04 11:08:08 LOG5[29231:25188864]: ssmtp connected from 127.0.0.1:64235 2006.10.04 11:08:08 LOG7[29231:2684415368]: Cleaning up the signal pipe 2006.10.04 11:08:08 LOG7[29231:25188864]: FD 10 in non-blocking mode 2006.10.04 11:08:08 LOG7[29231:25188864]: ssmtp connecting 127.0.0.1:25 2006.10.04 11:08:08 LOG7[29231:25188864]: connect_wait: waiting 10 seconds 2006.10.04 11:08:08 LOG6[29231:2684415368]: Child process 29421 finished with code 0 2006.10.04 11:08:08 LOG7[29231:25188864]: connect_wait: connected 2006.10.04 11:08:08 LOG7[29231:25188864]: Remote FD=10 initialized 2006.10.04 11:08:08 LOG7[29231:25188864]: TCP_NODELAY option set on remote socket 2006.10.04 11:08:08 LOG7[29231:25188864]: SSL state (connect): before/ connect initialization 2006.10.04 11:08:08 LOG7[29231:25188864]: SSL state (connect): SSLv3 write client hello A 2006.10.04 11:08:08 LOG7[29231:25188864]: SSL alert (write): fatal: handshake failure 2006.10.04 11:08:08 LOG3[29231:25188864]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2006.10.04 11:08:08 LOG5[29231:25188864]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.10.04 11:08:08 LOG7[29231:25188864]: ssmtp finished (0 left) Any suggestions as to what is causing this and how I can fix it? I got the same thing on another machine, with stunnel 4.04 and OpenSSL 0.9.7d. My stunnel.conf file is: cert = /Users/jlbrown/%1.pem key = /Users/jlbrown/%1.pem debug=7 output=/dev/stdout ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Service-level configuration [ssmtp] client = yes accept = 465 connect = 192.168.1.31:25 Thanks, James.

2 1

Thanks
by Eric S. Eberhard 03 Oct '06

03 Oct '06

For the help ... I believe I got it. Was I got that debug bug fixed I could tell what was going on. In the end I just stopped fighting it and downloaded prngd and ran it for a while. Interestingly, once I did this, it continues to work fine w/out prngd up and running. It did something I don't understand to my random file (apparently the old one was not good enough) and now it works!##$ Don't understand it, but it works! I still have some other application problem but I appear to get responses now. Thanks, Eric This email sent by: Eric S. Eberhard (928) 567-3727 Voice (928) 567-6122 Fax 928-301-7537 -- you may call any time day or night, I turn it off when I sleep :-) Please try to use a land line first (reception often poor). Note the change in the domain from vicspdi.com to vicsmba.com !!!! For Metropolis support and VICS MBA Support!!!! http://www.vicsmba.com Completely updated web site of personal pictures with many new pictures! Includes horses, dogs, Corvairs, and more. http://www.vicsmba.com/ourpics/index.html Corvair pictures including the Judson setup on our 62 Sedan and lots of pictures of Cheryl's 62 Monza Wagon and our 62 Spyder convertible. http://www.vicsmba.com/ourpics/corvairs.html My younger brother Martin has started a very serious car company. A hot rod (very fast) electric roadster is the first offering. The chassis is built by Lotus to their specs. Check it out: http://www.teslamotors.com

1 0

Re: [stunnel-users] Help please - debug and random file
by Eric S. Eberhard 02 Oct '06

02 Oct '06

Mike, Ah -- you are an expert! Amazing product in that I last download this in 2000 and have used it without incident ever since. Too bad I am forced to upgrade. I have hunted down the problem some more -- it has to do with the randomness. Using dbx I have found that it is blocking on a socked read for DEVRANDOM_EGD ... I did not specifically set up any sockets for randomness anyplace. Or set any options. I don't really want a socket, I was perfectly happy with my little 1024 byte .rnd file. If I copy a file (at random :-) ) and specify that it use that file for randomness, it reads it and sets it to zero bytes (unless I tell it not to overwrite). It then goes to read the socket and hangs. I suspect this is more an openssl problem than stunnel unless you can think of a way to 1) make it not wipe out my random file 2) make it not try and access a socket I hope you put my little fix in to s_log. Thanks, Eric At 01:51 PM 10/2/2006, you wrote: >On Monday 02 October 2006 21:19, you wrote: > > Are you an openssl/stunnel expert? > >I wrote stunnel. I could say I'm an expert (who an expert is otherwise?). > > > If I gave you access to my rs6000 > > and paid you, could you get this to work for me? Since I only need > > to compil this every 5-10 years, it makes little sense for me to > > invest a lot of time learning it! > >Good idea. > >Best regards, > Mike > This email sent by: Eric S. Eberhard (928) 567-3727 Voice (928) 567-6122 Fax 928-301-7537 -- you may call any time day or night, I turn it off when I sleep :-) Please try to use a land line first (reception often poor). Note the change in the domain from vicspdi.com to vicsmba.com !!!! For Metropolis support and VICS MBA Support!!!! http://www.vicsmba.com Completely updated web site of personal pictures with many new pictures! Includes horses, dogs, Corvairs, and more. http://www.vicsmba.com/ourpics/index.html Corvair pictures including the Judson setup on our 62 Sedan and lots of pictures of Cheryl's 62 Monza Wagon and our 62 Spyder convertible. http://www.vicsmba.com/ourpics/corvairs.html My younger brother Martin has started a very serious car company. A hot rod (very fast) electric roadster is the first offering. The chassis is built by Lotus to their specs. Check it out: http://www.teslamotors.com

1 0

Help please - debug and random file
by Eric S. Eberhard 02 Oct '06

02 Oct '06

Hello everyone. I have not been on the list for a long time. I last compiled openssl and stunnel in 2000 or so and have been using the same code ever since. I use it very simply in client mode ... I have an application to authorize credit cards and it connect to stunnel in inetd mode (with -c in the command line). visanet is now requiring version 2 SSL so I have to change so I got all the new stuff and compiled it up and made a .conf file. I have two problems (for now :-) ): 1) No matter what I do it seems that at least some debug is coming back through the socket, and no debug is going to my debug file 2) The debug I am getting is very strange -- the first time it says "Snagged 64 from bytes from stunnel.rnd" The second time it says "Unable to retrieve any random data from stunnel.rnd" When I examine the file it has a current date and zero bytes. If I copy back my old (2000) stunnel.rnd it always reads once, and then writes it back out with zero bytes. I am AIX 4.3.3 and I compiled with xlc and the only option I used that was not default was to not link in the wrappers. I did get a ton of warnings that the "-pthreaded" option was not valid ... but it executes and responds so I am not sure that matters? Or should I do something (what?) about that? My configuration files for the service (visanet) is: output = /tmp/stunnel.log debug = 7 RNDfile = /visanet/ssl/stunnel.rnd [visanet] client = yes connect = ssllab.pgs.wcom.net:443 sslVersion = SSLv2 protocol = smtp cert = /viasanet/ssl/stunnel.pem The rnd file and cert file are from 2000 (old old old!). I would have expected a file /tmp/stunnel.log -- the file is not even created! The old inetd line was: (blah blah) stunnel -r ssllab.pgs.wcom.net:443 -c -R /visanet/sslold/stunnel.rnd What stupid thing am I doing wrong? Does anyone else have experience using stunnel with visanet and can they give me any pointers? Thanks! Eric This email sent by: Eric S. Eberhard (928) 567-3727 Voice (928) 567-6122 Fax 928-301-7537 -- you may call any time day or night, I turn it off when I sleep :-) Please try to use a land line first (reception often poor). Note the change in the domain from vicspdi.com to vicsmba.com !!!! For Metropolis support and VICS MBA Support!!!! http://www.vicsmba.com Completely updated web site of personal pictures with many new pictures! Includes horses, dogs, Corvairs, and more. http://www.vicsmba.com/ourpics/index.html Corvair pictures including the Judson setup on our 62 Sedan and lots of pictures of Cheryl's 62 Monza Wagon and our 62 Spyder convertible. http://www.vicsmba.com/ourpics/corvairs.html My younger brother Martin has started a very serious car company. A hot rod (very fast) electric roadster is the first offering. The chassis is built by Lotus to their specs. Check it out: http://www.teslamotors.com

2 3

One bug solved/fixed -- bug in log.c or perhaps options.c
by Eric S. Eberhard 02 Oct '06

02 Oct '06

Because I am using inetd mode, any unintended output by stunnel to stdout is BAD as this is accepted as input through inetd to my calling program. The problem with stunnel is that in main it does main_initialize which has the final function "log_open" However, somewhere in "parse_config" a call is made to "s_log" (with the text "Snagged 64 bytes from ..." and since this is before the log_open, the output ends up on stdout rather than being logged. Rather than try and hunt down the function that outputs the premature error message, I modified s_log to open the log files itself if not already open. I fixed it as follows (suggest you put in to the release?): void s_log(int level, const char *format, ...) { va_list arglist; char text[STRLEN], timestamped[STRLEN]; time_t gmt; struct tm *timeptr; #if defined(HAVE_LOCALTIME_R) && defined(_REENTRANT) struct tm timestruct; #endif if(level>options.debug_level) return; va_start(arglist, format); #ifdef HAVE_VSNPRINTF vsnprintf(text, STRLEN, format, arglist); #else vsprintf(text, format, arglist); #endif va_end(arglist); #if !defined (USE_WIN32) && !defined (__vms) /******************** NEW CODE, NEXT 2 LINES *******/ if(!outfile && options.output_file) /* 'output' option specified, not open */ log_open(); if(!outfile && options.option.syslog) { syslog(level, "LOG%d[%lu:%lu]: %s", So now I don't get the "Snagged" message back on stdout ... but it still does not work for me (yet :-) ) Eric This email sent by: Eric S. Eberhard (928) 567-3727 Voice (928) 567-6122 Fax 928-301-7537 -- you may call any time day or night, I turn it off when I sleep :-) Please try to use a land line first (reception often poor). Note the change in the domain from vicspdi.com to vicsmba.com !!!! For Metropolis support and VICS MBA Support!!!! http://www.vicsmba.com Completely updated web site of personal pictures with many new pictures! Includes horses, dogs, Corvairs, and more. http://www.vicsmba.com/ourpics/index.html Corvair pictures including the Judson setup on our 62 Sedan and lots of pictures of Cheryl's 62 Monza Wagon and our 62 Spyder convertible. http://www.vicsmba.com/ourpics/corvairs.html My younger brother Martin has started a very serious car company. A hot rod (very fast) electric roadster is the first offering. The chassis is built by Lotus to their specs. Check it out: http://www.teslamotors.com

1 0

Setting up TLS for SMTP
by James Brown 01 Oct '06

01 Oct '06

I am trying to set up stunnel so that it accepts SSL encrypted traffic from the internet on port 2525 and sends it to my mail server on port 25. To create the certificate, I used: sudo openssl req -new -outform PEM -out smtpd.cert \ -newkey rsa:2048 -nodes -keyout smtpd.key -keyform PEM \ -days 365 -x509 My stunnel.conf is: ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment ;cert = stunnel.pem cert = /smtpd.cert ;key = stunnel.pem key = /smtpd.key ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 ;output = stunnel.log ; Use it for client mode ;client = yes ; Service-level configuration ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini I am trying it in standalone mode. Using Stunnel 4.04. OpenSSL 0.9.7i 14 Oct 2005 Output of gcc -v is: Using built-in specs. Target: powerpc-apple-darwin8 Configured with: /private/var/tmp/gcc/gcc-5341.obj~1/src/configure -- disable-checking -enable-werror --prefix=/usr --mandir=/share/man -- enable-languages=c,objc,c++,obj-c++ --program-transform-name=/^[cg] [^.-]*$/s/$/-4.0/ --with-gxx-include-dir=/include/c++/4.0.0 --with- slibdir=/usr/lib --build=powerpc-apple-darwin8 --host=powerpc-apple- darwin8 --target=powerpc-apple-darwin8 Thread model: posix gcc version 4.0.1 (Apple Computer, Inc. build 5341) Whenever I try to start Stunnel, I get a message saying that there is no such file. Eg: $ stunnel -p /smtpd.cert -d 2525 -r 25 2006.10.01 00:36:46 LOG3[638:2684415368]: -p: No such file or directory (2) Syntax: stunnel [filename] | -help | -version | -sockets filename - use specified config file instead of /sw/etc/ stunnel/stunnel.conf -help - get config file help -version - display version and defaults -sockets - display default socket options I am using Mac OS X 10.4.8, Stunnel was built using Fink. Does anybody have any suggestions as to what I am doing wrong? Thanks, James.

1 0

stunnel on osX
by fmgre-dell＠yahoo.fr 30 Sep '06

30 Sep '06

>From: Michal Trojnara <Michal.Trojnara(a)mobi-com.net> >Subject: Re: [stunnel-users] Tr: failure notice >To: stunnel-users(a)mirt.net >Message-ID: <200609292118.57291.Michal.Trojnara(a)mobi-com.net> >Content-Type: text/plain; charset="utf-8" >On Friday 29 September 2006 16:11, fmgre-dell(a)yahoo.fr wrote: >> We have been using stunnel for 2 years now. >> We need to renew our keys, and we usually proceed to a >> software upgrade at the same time. >> Â >> - I have noticed changes in stunnel-client ( 4.16 ) >> running on OSX : now, stunnel asks for the key >> password for each service it is launching. > >Just password from your private key. 8-) > Hello, What i mean is that we have 8 different services running. they are all locked with the same key. We distribute the private key to other non-computer persons, who don t know how to remove a password from a key ( and we 'd like to keep the key locked ) With the former version of stunnel, we could unlock the 8 services with typing the password only once With the latest version, we need to type in the keyword once for every service ( i.e. 8 times !!! ) Is there any way to 'ease' the use of the latest version while keeping the key passworded ? bon week end fred ___________________________________________________________________________ Découvrez un nouveau moyen de poser toutes vos questions quelque soit le sujet ! Yahoo! Questions/Réponses pour partager vos connaissances, vos opinions et vos expériences. http://fr.answers.yahoo.com

2 1

Help please - debug and random file
by Eric S. Eberhard 29 Sep '06

29 Sep '06

Hello everyone. I have not been on the list for a long time. I last compiled openssl and stunnel in 2000 or so and have been using the same code ever since. I use it very simply in client mode ... I have an application to authorize credit cards and it connect to stunnel in inetd mode (with -c in the command line). visanet is now requiring version 2 SSL so I have to change so I got all the new stuff and compiled it up and made a .conf file. I have two problems (for now :-) ): 1) No matter what I do it seems that at least some debug is coming back through the socket, and no debug is going to my debug file 2) The debug I am getting is very strange -- the first time it says "Snagged 64 from bytes from stunnel.rnd" The second time it says "Unable to retrieve any random data from stunnel.rnd" When I examine the file it has a current date and zero bytes. If I copy back my old (2000) stunnel.rnd it always reads once, and then writes it back out with zero bytes. I am AIX 4.3.3 and I compiled with xlc and the only option I used that was not default was to not link in the wrappers. I did get a ton of warnings that the "-pthreaded" option was not valid ... but it executes and responds so I am not sure that matters? Or should I do something (what?) about that? My configuration files for the service (visanet) is: output = /tmp/stunnel.log debug = 7 RNDfile = /visanet/ssl/stunnel.rnd [visanet] client = yes connect = ssllab.pgs.wcom.net:443 sslVersion = SSLv2 protocol = smtp cert = /viasanet/ssl/stunnel.pem The rnd file and cert file are from 2000 (old old old!). I would have expected a file /tmp/stunnel.log -- the file is not even created! The old inetd line was: (blah blah) stunnel -r ssllab.pgs.wcom.net:443 -c -R /visanet/sslold/stunnel.rnd What stupid thing am I doing wrong? Does anyone else have experience using stunnel with visanet and can they give me any pointers? Thanks! Eric This email sent by: Eric S. Eberhard (928) 567-3727 Voice (928) 567-6122 Fax 928-301-7537 -- you may call any time day or night, I turn it off when I sleep :-) Please try to use a land line first (reception often poor). Note the change in the domain from vicspdi.com to vicsmba.com !!!! For Metropolis support and VICS MBA Support!!!! http://www.vicsmba.com Completely updated web site of personal pictures with many new pictures! Includes horses, dogs, Corvairs, and more. http://www.vicsmba.com/ourpics/index.html Corvair pictures including the Judson setup on our 62 Sedan and lots of pictures of Cheryl's 62 Monza Wagon and our 62 Spyder convertible. http://www.vicsmba.com/ourpics/corvairs.html My younger brother Martin has started a very serious car company. A hot rod (very fast) electric roadster is the first offering. The chassis is built by Lotus to their specs. Check it out: http://www.teslamotors.com

1 0

Tr: failure notice
by fmgre-dell＠yahoo.fr 29 Sep '06

29 Sep '06

Hello, We have been using stunnel for 2 years now. We need to renew our keys, and we usually proceed to a software upgrade at the same time. - I have noticed changes in stunnel-client ( 4.16 ) running on OSX : now, stunnel asks for the key password for each service it is launching. - a collegue is running stunnel ( client ) on windows and told me that the 4.15 and 4.16 version keeps on crashing on windows. Anybody with the same symptoms ( and possiby a workaround ? ) :-) ( we use keys which are protected by a password, we launch the stunnel ( client ) manually and type in the password for the service to start ) Sincerely, Fred ___________________________________________________________________________ Découvrez un nouveau moyen de poser toutes vos questions quelque soit le sujet ! Yahoo! Questions/Réponses pour partager vos connaissances, vos opinions et vos expériences. http://fr.answers.yahoo.com

2 1

create_client failed
by James 29 Sep '06

29 Sep '06

I am running Debian 3.1 (stable) with stunnel 3.26 (Debian package) to wrap my qmail pop3 daemon. Stunnel works properly for a good amount of time, but at a point (I am unable to find any specific influencing factors) it begins to fail with the error, "Connection reject: create_client failed" (see below for more info). To fix the error I have to kill and restart stunnel. I have adjusted the timeouts for both stunnel and the pop3 daemon, but nothing appears to have a lasting affect. When stunnel errors out the pop3 daemon is still available and can be connected to, so it does not appear to be an issue related to stunnel not being able to talk to the pop3 daemon. Below I have some of the debugging and system information regarding the system and problem. I would be more than appreciative if anyone had some input. Thank you. # Error stunnel[2500]: pop3 accepted FD=9 ###.###.###.### stunnel[2500]: Connection rejected: create_client failed # strace -p select(7, [4 6], NULL, NULL, NULL) = 1 (in [6]) fcntl64(6, F_GETFL) = 0x2 (flags O_RDWR) fcntl64(6, F_SETFL, O_RDWR|O_NONBLOCK) = 0 accept(6, {sa_family=AF_INET, sin_port=htons(63759), sin_addr=inet_addr("###.###.###.###")}, [16]) = 9 fcntl64(6, F_SETFL, O_RDWR) = 0 fcntl64(9, F_SETFD, FD_CLOEXEC) = 0 rt_sigprocmask(SIG_BLOCK, [HUP INT QUIT TERM CHLD], [], 8) = 0 mmap2(NULL, 8388608, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = -1 ENOMEM (Cannot allocate memory) rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 close(9) = 0 time([1159535901]) = 1159535901 getpid() = 21864 rt_sigaction(SIGPIPE, {0x40253a70, [], 0}, {SIG_IGN}, 8) = 0 send(3, "<27>Sep 29 09:18:21 stunnel[2186"..., 77, 0) = 77 rt_sigaction(SIGPIPE, {SIG_IGN}, NULL, 8) = 0 close(9) = -1 EBADF (Bad file descriptor) # uname -a 2.6.8-3-686-smp #1 SMP Thu Sep 7 04:39:15 UTC 2006 i686 GNU/Linux # libc version GNU C Library stable release version 2.3.2 # Command Running /usr/sbin/stunnel -d pop3s -r pop3 -p /etc/ssl/certs/pop3d.pem -R /dev/urandom -s nobody -g root # stunnel -V stunnel 3.26 on i386-pc-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 Default behaviour: run in inetd mode (unless -d used) run in background (unless -f used) run in ssl server mode (unless -c used) Compile time defaults: -v level no verify -a directory /etc/ssl/certs -A file (none) -S sources 3 -t timeout 300 seconds -B bytes 64 -D level 5 -P pid dir /var/run/stunnel/ -p pemfile in server mode: /etc/ssl/certs/stunnel.pem in client mode: none Socket option defaults: Option Accept Local Remote OS default SO_DEBUG -- -- -- 0 SO_DONTROUTE -- -- -- 0 SO_KEEPALIVE -- -- -- 0 SO_LINGER -- -- -- 0:0 SO_OOBINLINE -- -- -- 0 SO_RCVBUF -- -- -- 87380 SO_SNDBUF -- -- -- 16384 SO_RCVLOWAT -- -- -- 1 SO_SNDLOWAT -- -- -- 1 SO_RCVTIMEO -- -- -- 0:0 SO_SNDTIMEO -- -- -- 0:0 SO_REUSEADDR 1 -- -- 0 SO_BINDTODEVICE -- -- -- -- IP_TOS -- -- -- 0 IP_TTL -- -- -- 64 TCP_NODELAY -- -- -- 0

1 0

SSL and keep alive
by Alex Turner 29 Sep '06

29 Sep '06

All, I am load testing stunnel as a front end to a web server. The problem I have is that the connection is dropping even though JMeter is set to keep-alive on the http sampler. I was wondering if anyone knew if this was a JMeter issue – IE it does not do http1.1 properly with SSL or should I dig deeper? The stunnel log just shows the socket being closed down at the end of each request. Now – as stunnel should not care what data is going over ssl, then there must be something from JMeter that is triggering it to drop the socket. My thinking is that this is either an SSL session end or an actual FIN. In the absence of any feedback – I think I will try using stunnel in both client and server modes and, as I already know JMeter is OK at keep-alive non https – I should thus find out where the issue lays. Thanks for any info AJ PS – I am working on XP both ends with JMeter 2.2 and the latest stunnel. PPS – Naturally, once I have this figured I will post the method and results to nerds-central Alexander J Turner Ph.D. HYPERLINK "http://www.deployview.com"www.deployview.com HYPERLINK "http://www.nerds-central.blogspot.com"www.nerds-central.blogspot.com HYPERLINK "http://www.project-network.com"www.project-network.com -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.405 / Virus Database: 268.12.9/457 - Release Date: 26/09/2006

2 3

Zombies in 4.17?
by Pete Resnick 28 Sep '06

28 Sep '06

I'm running 4.17 on a Mac Mini (Intel) running MacOSX 10.4.7 and I'm seeing a slew of zombies. Anything I can do to track down what the problem is? pr -- Pete Resnick <http://www.episteme-software.com/> All connections to the world are tenuous at best

2 2

stunnel 4.18 released
by Michal Trojnara 26 Sep '06

26 Sep '06

Version 4.18, 2006.09.26, urgency: MEDIUM: * Bugfixes - GPF on entering private key pass phrase on Win32 fixed. - Updated Win32 OpenSSL DLLs. - Minor configure script update. Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ sha1sum for stunnel-4.18.tar.gz: 3ed3eaefae91d80fcfcbb29dd285d0f773756397 Best regards, Mike

1 0

Windows OpenSSL DLL Version
by algol sigfrid 26 Sep '06

26 Sep '06

2 1

seg fault stunnel 4-14 on SLES10
by Jon Howse 22 Sep '06

22 Sep '06

Hi, I am getting a seg fault with stunnel on an installation of SLES10. This is the first SLES10 server I have set up after having set up many SLES9 servers (approx twelve) which all communicate through stunnel to a central syslog server. The version of stunnel we are using on SLES9 is: stunnel-4.05-20.1. The other machines are a mix of 32bit and 64bit Xeons. The seg fault seems to happen when syslog starts to talk through stunnel. The program is a binary rpm install for 64bit SLES10 and is being run in standalone mode as a client connecting to a stunnel/syslog server running SLES9. OS:- SLES10 x86_64 Packages:- Stunnel 4-14-14.2 Syslog-ng-1.6.8-20.4 Openssl-0.9.8a-18.4 uname -a: Linux server 2.6.16.21-0.15-smp #1 SMP Tue Jul 25 15:28:49 UTC 2006 x86_64 x86_64 x86_64 GNU/Linux libc version: libc.so.6 => /lib64/libc.so.6 (0x00002ae068cf2000) openssl version: OpenSSL 0.9.8a 11 Oct 2005 stunnel.conf:- # Copyright by Michal Trojnara 2002-2004 # --with changes for SuSE package # client = yes | no # client mode (remote service uses SSL) # default: no (server mode) client = yes # # chroot + user (comment out to disable) # chroot = /var/lib/stunnel/ setuid = stunnel setgid = nogroup # note about the chroot feature and the "exec" keyword to start other # services... # while the init script /etc/init.d/stunnel will copy the binaries and libraries # into the chroot jail, more files might be needed in the jail (configuration files etc.) pid = /var/run/stunnel.pid # # debugging # debug = 7 output = /var/log/stunnel.log # # Some performance tunings # # disable Nagle algorithm (a.k.a. tinygram prevention, see man 7 tcp) socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 # compression = rle # Workaround for Eudora bug #options = DONT_INSERT_EMPTY_FRAGMENTS # Authentication stuff # verify = 2 # Don't forget to c_rehash CApath; CApath is located inside chroot jail: # CApath = /certs # It's often easier to use CAfile: # CAfile = /etc/stunnel/certs.pem # Don't forget to c_rehash CRLpath; CRLpath is located inside chroot jail: # CRLpath = /crls # Alternatively you can use CRLfile: # CRLfile = /etc/stunnel/crls.pem CAfile = /etc/openldap/rootcert.pem cert = /etc/ssl/certs/thorincert.pem key = /etc/ssl/certs/thorinkey.pem verify = 2 [5140] accept = 127.0.0.1:514 connect = xxx.xxx.xxx.xxx:5140 /var/log/messages:- kernel: Kernel logging (proc) stopped. Sep 21 13:51:00 thorin kernel: Kernel log daemon terminating. Sep 21 13:51:01 thorin syslog-ng[3146]: syslog-ng version 1.6.8 going down Sep 21 13:51:01 thorin syslog-ng[3769]: syslog-ng version 1.6.8 starting Sep 21 13:51:01 thorin syslog-ng[3769]: Changing permissions on special file /dev/tty10 Sep 21 13:51:01 thorin syslog-ng[3769]: Connection broken to AF_INET(127.0.0.1:514), reopening in 60 seconds Sep 21 13:51:06 thorin kernel: klogd 1.4.1, log source = /proc/kmsg started. Sep 21 13:51:06 thorin kernel: stunnel[3739]: segfault at 000000005569a9f0 rip 000055555555b793 rsp 00005555556b2f60 error 4 var/log/stunnel.log:- stunnel 4.14 on x86_64-suse-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 2006.09.21 13:48:25 LOG7[3396:1]: RAND_status claims sufficient entropy for the PRNG 2006.09.21 13:48:25 LOG6[3396:1]: PRNG seeded successfully 2006.09.21 13:48:25 LOG7[3396:1]: Certificate: /etc/ssl/certs/thorincert.pem 2006.09.21 13:48:25 LOG7[3396:1]: Key file: /etc/ssl/certs/thorinkey.pem 2006.09.21 13:48:25 LOG7[3396:1]: Loaded verify certificates from /etc/openldap/rootcert.pem 2006.09.21 13:48:25 LOG6[3396:1]: file ulimit = 1024 (can be changed with 'ulimit -n') 2006.09.21 13:48:25 LOG6[3396:1]: poll() used - no FD_SETSIZE limit for file descriptors 2006.09.21 13:48:25 LOG5[3396:1]: 500 clients allowed 2006.09.21 13:48:25 LOG7[3396:1]: FD 4 in non-blocking mode 2006.09.21 13:48:25 LOG7[3396:1]: FD 5 in non-blocking mode 2006.09.21 13:48:25 LOG7[3396:1]: FD 6 in non-blocking mode 2006.09.21 13:48:25 LOG7[3396:1]: SO_REUSEADDR option set on accept socket 2006.09.21 13:48:25 LOG7[3396:1]: 5140 bound to 127.0.0.1:514 2006.09.21 13:48:25 LOG7[3397:1]: Created pid file /var/run/stunnel.pid 2006.09.21 13:48:25 LOG7[3397:0]: Waiting -1 second(s) for 2 file descriptor(s) 2006.09.21 13:49:20 LOG7[3397:0]: CONTEXT 1, FD=4, (IN)->() 2006.09.21 13:49:20 LOG7[3397:0]: CONTEXT 1, FD=6, (IN)->(IN) 2006.09.21 13:49:20 LOG7[3397:1]: 5140 accepted FD=7 from 127.0.0.1:7323 2006.09.21 13:49:20 LOG7[3397:1]: Creating a new context 2006.09.21 13:49:20 LOG7[3397:1]: Context 2 created 2006.09.21 13:49:20 LOG7[3397:2]: Context swap: 1 -> 2 It waits at the last entry until syslog tries to connect. And that's where the useful logging stops, after that it's a seg fault. Hope you can point me in the right direction... Jon Howse ---------------------------------------------------------------------------- St Brendan's Sixth Form College --- STAFF e-mail Please consider the environment before printing this email. This e-mail is confidential and intended solely for the use of the individual to whom it is addressed. Any views or opinions presented are solely those of the author and do not necessarily represent those of St Brendan's Sixth Form College. If you are not the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing, or copying of this e-mail is strictly prohibited. If you have received this e-mail in error please contact the sender. Please report any abuse of this e-mail service to postmaster(a)stbrn.ac.uk ---------------------------------------------------------------------------- *** This e-mail has been scanned by Symantec Anti-Virus software. ***

1 0

Would you plz help me? I have problem with defining ciphers in stunnel
by hjanzadeh＠sinamicro.com 19 Sep '06

19 Sep '06

1 0

4.17 stunnel with syslog-ng
by Jason Englander 15 Sep '06

15 Sep '06

I have a logging server at home set up with syslog-ng and stunnel. Earlier this morning, I upgraded stunnel on a logging client machine from 4.15 to 4.17, no problems. I upgraded the server from 4.15 to 4.17 and stunnel seemed to hang (run, but not detach) on startup. Very long story short (it was too early, I hadn't had enough coffee yet <g>), stunnel was trying to log to syslog, which wasn't running yet. Putting aside that I should've been using "output = /var/log/stunnel.log" instead, for a log server of all things :-), did something change in stunnel or did I screw something up that I don't remember doing? My startup script has been starting stunnel, then syslog-ng for years. I haven't downgraded to verify that it does/doesn't happen starting with a particular version, but I might do that later today out of curiosity. (before fixing, upgrading "important" machines) Also, FYI - configure created a file named "6," in the source directory with this in it: no LIBS=-lz -ldl -lutil -lpthread -L/usr/local/ssl/lib -lssl -lcrypto This seems to be the offending line in configure: echo "${ECHO_T}no" >&6, LIBS="$saved_LIBS" -> echo "${ECHO_T}no" >&6; LIBS="$saved_LIBS" I ran 'autoreconf -f -i' (autoconf 2.60, automake 1.9.6) and the line isn't in the new ./configure any more. Jason -- Jason Englander <jason(a)englanders.cc> 394F 7E02 C105 7268 777A 3F5A 0AC0 C618 0675 80CA

2 1

cannot compile stunnel on solaris 10 in a zone
by tomvo＠absi.be 15 Sep '06

15 Sep '06

Hi, I'm trying to compile stunnel on a solaris 10 (06/06 release) in a normal (non-global) zone. the compile fails at the mknod command. How do I install stunnel ? I could ofcourse create the device myself in the global zone, but i think it was in /usr/local/var/lib/stunnel/dev, I don't think that our user zone will have access to this device if we create it in the global zone. Anyone else struggled with the same problem ? thx, Tom. --------------------------------------------------------------------------- Tom Van Overbeke - ABSI Service Delivery Coordinator email: tomvo(a)absi.be Tel: +32 2 333 40 00 - Fax: +32 2 333 40 60 website: http://www.absi.be ---------------------------------------------------------------------------

1 0

stunnel problem on hp-ux 11.11
by matt.miller＠accenture.com 13 Sep '06

13 Sep '06

System specs: HP-UX 11.11 Stunnel 4.15 OpenSSL 0.8.7i Config File: ; Certificate/key is needed in server mode and optional in client mode ;cert = /opt/iexpress/stunnel/etc/stunnel/mail.pem ;key = /opt/iexpress/stunnel/etc/stunnel/mail.pem ; Some security enhancements for UNIX systems - comment them out on Win32 ;chroot = /opt/iexpress/stunnel/var/lib/stunnel/ ;setuid = nobody ;setgid = nogroup ; PID is created inside chroot jail pid = /tmp/stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /opt/iexpress/stunnel/etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /opt/iexpress/stunnel/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ;foreground = yes output = stunnel.log ; Service-level configuration [pop3s] ; Use it for client mode client = yes ;accept = 995 ;connect = 110 accept = localhost:110 connect = POP3S.MAILSERVER:995 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini Problem: When I try to execute the following command "telnet localhost 110" I get an entry in the stunnel log file and I am unable to connect to the secure pop3 server. I know that this is not a firewall issue because I can telnet directly to the POP3S.MAILSERVER on port 995 and establish a connection, I also know that the server works fine because I set up stunnel on my windows xp machine and that did not have a problem establishing a connection. Any help on this issue would be great. Here is the log I am getting 2006.08.10 18:23:03 LOG5[16138:1]: stunnel 4.15 on hppa2.0w-hp-hpux11.11 with Op 2006.08.10 09:43:55 LOG5[7158:1]: 2000 clients allowed 2006.08.10 09:43:55 LOG7[7158:1]: FD 4 in non-blocking mode 2006.08.10 09:43:55 LOG7[7158:1]: FD 5 in non-blocking mode 2006.08.10 09:43:55 LOG7[7158:1]: FD 6 in non-blocking mode 2006.08.10 09:43:55 LOG7[7158:1]: SO_REUSEADDR option set on accept socket 2006.08.10 09:43:55 LOG7[7158:1]: pop3s bound to 127.0.0.1:110 2006.08.10 09:43:55 LOG7[7263:1]: Created pid file /tmp/stunnel.pid 2006.08.10 16:15:45 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57040 2006.08.10 16:15:45 LOG3[7263:1]: Connection rejected: create_client failed 2006.08.10 16:30:34 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57156 2006.08.10 16:30:34 LOG3[7263:1]: Connection rejected: create_client failed 2006.08.10 16:45:34 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57275 2006.08.10 16:45:34 LOG3[7263:1]: Connection rejected: create_client failed 2006.08.10 17:00:36 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57401 2006.08.10 17:00:36 LOG3[7263:1]: Connection rejected: create_client failed 2006.08.10 17:15:36 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57506 2006.08.10 17:15:36 LOG3[7263:1]: Connection rejected: create_client failed 2006.08.10 17:30:35 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57614 2006.08.10 17:30:35 LOG3[7263:1]: Connection rejected: create_client failed Matt T. Miller Accenture Minneapolis, MN USA 612-277-1826 aim: mttmiller8 email: matt.miller(a)accenture.com This message is for the designated recipient only and may contain privileged, proprietary, or otherwise private information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the email by you is prohibited.

1 0

RE: [stunnel-users] stunnel and AJP
by Jones Scott - sjones 13 Sep '06

13 Sep '06

Any chance you could send me a sample configuration file? :) Just got it install and going to start trying to get it setup. I am going to try to end the tunnel on a BigIP box. So just set it up on the apache server and hope it can end on the BigIP box. Thanks -----Original Message----- From: Richard.Hall [mailto:[email protected]] Sent: Friday, August 25, 2006 4:08 PM To: Jones Scott - sjones Cc: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] stunnel and AJP Jason, On Fri, 25 Aug 2006, Jones Scott - sjones wrote: > Has anyone used stunnel to secure AJP traffic from apache to jboss Short answer: Yes. - Apache + mod_jk configured to talk to stunnel client on localhost rather than to JBoss AJP13 port - stunnel client talks to remote stunnel server - stunnel server talks to JBoss AJP13 port on _its_ localhost. Works a treat :-) We've even done it with a third machine in the middle, running an stunnel server and client back-to-back. Just don't ask why! HTH, Richard ************************************************************************* The information contained in this communication is confidential, is intended only for the use of the recipient named above, and may be legally privileged. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please resend this communication to the sender and delete the original message or any copy of it from your computer system. Thank you. *************************************************************************

2 1

stunnel going to BigIP ssl
by Jones Scott - sjones 13 Sep '06

13 Sep '06

Has anyone used stunnel to end at a BipIP to decode the ssl traffic? If so, any issues or concerns? Thanks *************************************************************************** The information contained in this communication is confidential, is intended only for the use of the recipient named above, and may be legally privileged. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please resend this communication to the sender and delete the original message or any copy of it from your computer system. Thank You. ****************************************************************************

1 0

"SSL_read returned WANT_READ: retrying" at 30Hz
by Vincent Lascaux 12 Sep '06

12 Sep '06

Hi, I'm trying to use rsync (2.6.8) through STunnel (4.16) to synchronize two PC over the internet (they both have the same version of stunnel and rsync). On the server, I have STunnel running with this configuration: cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=0 socket = r:TCP_NODELAY=0 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log [rsync] accept = 273 connect = 873 On the client I have this configuration: cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=0 socket = r:TCP_NODELAY=0 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log client = yes [rsync] accept = 873 connect = UrlOfMyServer:273 Then I connect with rsync using rsync -a -h --progress --stats --partial Account@localhost::RemotePath LocalPath I think the connection is not really stable. RSync sometimes hang. The log file on the client side show 2006.09.11 21:33:11 LOG7[2008:1468]: SSL_read returned WANT_READ: retrying at 30Hz (that's right, it means 30 times a second). My log file nearly gets bigger faster than my downloaded file ;) Is it expected? What does this line mean? I turned TCP_NODELAY to 0 thinking that it my give me synchronous sockets and that it would remove that error, but it didn't... Any help appreciated, Thanks -- Vincent

2 3

Stunnel 4.17 released
by Michal Trojnara 10 Sep '06

10 Sep '06

This is a bugfix release. Upgrade is recommended. Version 4.17, 2006.09.10, urgency: MEDIUM: * New features - Win32 DLLs for OpenSSL 0.9.8c. * Bugfixes - Problem with detecting getaddrinfo() in ./configure fixed. - Compilation problem due to misplaced #endif in ssl.c fixed. - Duplicate 220 in smtp_server() function in protocol.c fixed. - Minor os2.mak update. - Minor update of safestring()/safename() macros. sha1sum for stunnel-4.17.tar.gz file: 7a0ea800935e798bf938756000b57d002a99c280 Homepage and download: http://stunnel.mirt.net/ Best regards, Mike

1 0

Multiple HTTPS endpoints
by Andrew Culross 07 Sep '06

07 Sep '06

Can I use stunnel to connect mutiple https endpoints? I'm wondering if a config file like the below would work: [https] accept = 9876 connect = xxx.xxx.xxx.xxx:443 [https] accept = 9875 connect =yyy.yyy.yyy.yyy:443 Thanks in advance ! Andrew Culross TwoFour Systems (914) 220-8849 www.TwoFour.Com The views and opinions expressed in this e-mail message are the sender's own and do not necessarily represent the views and opinions of {TwoFour Systems, LLC or F-O-R Software, LLC}

1 0

Re: [stunnel-users] RFC 2487 test in smtp_server not reliable
by Hans Werner Strube 07 Sep '06

07 Sep '06

Hans Werner Strube wrote: > Michal Trojnara wrote: ... > > I'm going to do it the hard way and add another parameter to > > s_poll_wait() function. > > > > IMHO the timeout should be between 100ms and 500ms. What do you think? > > I have not tested the minimum required. However, it should be as short > as possible, since for a client using TLS, the full delay will always > occur on starting a connection. ... I have now done some measurements using snoop on a Solaris Ultra 2 SMTP server (100 MBit/s) with a Windows XP SP2 client (AMD Duron 1 GHz, 56 kBit/s phone-line modem, SeaMonkey 1.04 mail sender [equivalent to Thunderbird 1.5.x]). The delays between the end of initial connection handshake and the first nonzero data packet for six connections were usually between 10 and 100 ms but once reached 150 ms. Thus, 200 ms may be a reasonable value (although the sample is too small to rule out rare failures).

1 0

windows load levels
by Alex Turner 05 Sep '06

05 Sep '06

Guys, Bit of a newbie question here - but very import to me at least. We are looking to secure a web server that does no currently support SSL. One reason for this is that we want to be able to run the server on multiple hosts and doing so means sharing the sessions etc :-( So - I am interested if anyone has tested the stuffing out of stunnel on windows. IE seeing how well it could handle several hundred sockets simultaneously. Not only from a resource point of view, but from a scaling (n, n**2 etc) point of view. Any input at all will be very welcome. Soon I will be starting some test of my own using JMeter to load test. If anyone is interested in the results I will be happy to post. Cheers AJ Alexander J Turner Ph.D. HYPERLINK "http://www.deployview.com"www.deployview.com HYPERLINK "http://www.nerds-central.blogspot.com"www.nerds-central.blogspot.com HYPERLINK "http://www.project-network.com"www.project-network.com -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.405 / Virus Database: 268.11.7/437 - Release Date: 04/09/2006

2 1

Stunnel and CryptoApi
by Marco Aldegheri 05 Sep '06

05 Sep '06

Hello list! Someone knows if there is any way to integrate a Windows stunnel in client mode with the Windows Certificate Store? As OpenVPN does with the cryptoapicert parameter in my opinion it would be very useful because: 1. the private key would not just reside in a pem file but could be set not exportable. 2. the private key could be saved on a smartcard. I found a japaneese wstunnel project that seems to do it but I couldn't find any document about it in english and the gui is only in japaneese. Any hints? Thank you, Marco Aldegheri __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Real address of client
by Gonzalo Diethelm 03 Sep '06

03 Sep '06

Hello, linux: Linux asus-gonzo 2.6.15-26-686 #1 SMP PREEMPT Thu Aug 3 03:13:28 UTC 2006 i686 GNU/Linux stunnel: stunnel 4.14 on i486-pc-linux-gnu PTHREAD+POLL+IPv6+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 apache: Apache/2.0.55 I am using stunnel in Ubuntu to provide https serving to an http-only Apache installation. The stunnel config is: cert = /home/gonzo/src/bg/run/SSL/server.crt key = /home/gonzo/src/bg/run/SSL/server.crt chroot = /var/run/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = no [https] accept = 443 connect = 80 TIMEOUTclose = 0 Everything works perfectly, except for one minor detail: on the server, my PHP scripts do not have access to the real IP address of the client, and they always see this value as 127.0.0.1. I am aware the manual says that, if you use -l or -L, there will be an additional REMOTE_HOST environment variable with the desired IP address, but I am not sure how to make this work from a setup like mine, where the http server process is already running. Any help or hints are greatly appreciated. Best regards, -- Gonzalo Diethelm gonzalo.diethelm(a)aditiva.com

2 1

4.16 compilation fails for openssl without engine
by Hans Werner Strube 01 Sep '06

01 Sep '06

When openssl was compiled without engine support, compilation of src/ssl.c in stunnel-4.16 fails because of a misplaced #endif. Patch: --- src/ssl.c.ORI Thu Jun 29 23:12:03 2006 +++ src/ssl.c Fri Sep 1 11:30:25 2006 @@ -286,8 +286,6 @@ s_log(LOG_DEBUG, "Engine %d initialized", current_engine+1); } -#endif - ENGINE *get_engine(int i) { if(i<1 || i>current_engine) return NULL; @@ -294,4 +292,6 @@ return engines[i-1]; } +#endif + /* End of ssl.c */

1 0

Duplicate 220 in protocol.c, smtp_server
by Hans Werner Strube 01 Sep '06

01 Sep '06

At least since stunnel 4.15 - but not yet in 4.09 (don't know about the intermediate versions) - there is a (cosmetic only?) bug in the "welcome" forwarding of the smtp_server in protocol.c (lines 177-187 in 4.16): fdgetline(c, c->remote_fd.fd, line); if(!isprefix(line, "220")) { s_log(LOG_ERR, "Unknown server welcome"); longjmp(c->err, 1); } fdprintf(c, c->local_wfd.fd, "220%s + stunnel", line); fdgetline(c, c->local_rfd.fd, line); if(!isprefix(line, "EHLO ")) { s_log(LOG_ERR, "Unknown client EHLO"); longjmp(c->err, 1); } Although the line read from remote_fd.fd already starts with "220", another 220 is prepended in forwarding to local_wfd.fd, line 182. This seems to haveno adverse effects, but this line should better be changed to: fdprintf(c, c->local_wfd.fd, "%s + stunnel", line);

1 0

stunnel 4.16 released
by Michal Trojnara 01 Sep '06

01 Sep '06

A new version of stunnel has been released. Version 4.16, 2006.08.31, urgency: MEDIUM: * New features sponsored by Hewlett-Packard - A new global option to control engine: engineCtrl = <command>[:<parameter>] - A new service-level option to select engine to read private key: engineNum = <engine number> - OCSP support: ocsp = <URL> * New features - A new option to select version of SSL protocol: sslVersion = all|SSLv2|SSLv3|TLSv1 - Visual Studio vc.mak by David Gillingham <dgillingham(a)gmail.com>. - OS2 support by Paul Smedley (http://smedley.info) * Bugfixes - An ordinary user can install stunnel again. - Compilation problem with --enable-dh fixed. - Some minor compilation warnings fixed. - Service-level CRL cert store implemented. - GPF on protocol negotiations fixed. - Problem detecting addrinfo() on Tru64 fixed. - Default group is now detected by configure script. - Check for maximum number of defined services added. - OpenSSL_add_all_algorithms() added to SSL initialization. - configure script sections reordered to detect pthread library funcions. - RFC 2487 autodetection improved (thx to Hans Werner Strube). High resolution s_poll_wait() not currently supported by UCONTEXT threading. - More precise description of cert directory file names (thx to Muhammad Muquit). * Other changes - Maximum number of services increased from 64 to 256 when poll() is used. Homepage: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ sha1 hash for stunnel-4.16.tar.gz file: 6772e0c7f26c2596564ba66978597db8cd229a72 Best regards, Mike

2 1

Windows simultaneous sockets
by Alex 26 Aug '06

26 Aug '06

Guys, Bit of a newbie question here - but very import to me at least. We are looking to secure a web server that does no currently support SSL. One reason for this is that we want to be able to run the server on multiple hosts and doing so means sharing the sessions etc :-( So - I am interested if anyone has tested the stuffing out of stunnel on windows. IE seeing how well it could handle several hundred sockets simultaneously. Not only from a resource point of view, but from a scaling (n, n**2 etc) point of view. Any input at all will be very welcome. Soon I will be starting some test of my own using JMeter to load test. If anyone is interested in the results I will be happy to post. Cheers AJ -- www.deployview.com www.nerds-central.com www.project-network.com

1 0

stunnel and AJP
by Jones Scott - sjones 25 Aug '06

25 Aug '06

Has anyone used stunnel to secure AJP traffic from apache to jboss *************************************************************************** The information contained in this communication is confidential, is intended only for the use of the recipient named above, and may be legally privileged. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please resend this communication to the sender and delete the original message or any copy of it from your computer system. Thank You. ****************************************************************************

2 1

stunnel 4-15 through proxy server
by Ingvar Tjøstheim 25 Aug '06

25 Aug '06

Hello I am on a network at work behind a firewall and a proxy server. I can connect to my friends linux computer with putty using proxy configuration and port 443. My friend set up his SSH server on port 443, of course. Yesterday, back home, I installed the following on my Windows2000 computer: Win32OpenSSL-v0.9.8b stunnel ver 4-14 FreeProxy version 3.92 This is the stunnel config file for my home computer: client=no verify=0 [wow] accept = 443 connect = 127.0.0.1:3456 TIMEOUTclose = 0 I set up my router to forward port 443 to this computer. I also registered a DynDNS domain and set up a client to update it. Then, still at home, I prepared another computer which I brought to work today. I installed the following on an XP machine: Win32OpenSSL-v0.9.8b stunnel ver 4-14 (which I upgraded to 4.15 today) SockScap_sc32r238 I set up SockScap to connect to 127.0.0.1 on port 2345 and used it to tunnel a program to the internet through my LAN and this Win2K computer. This was working fine when I was at home. My network at home has no proxy server, and I changed stunnel on my XP computer once at work to version 4-15. Then I added the two protocol lines in the config file as you see below. This is the config file on my XP computer at work: verify = 0 client = yes [wow] accept = 2345 protocol = connect protocolHost = www-proxy.DOMAINNAME.no:80 connect = MYDOMAINNAME.dnsalias.com:443 TIMEOUTclose = 0 Now, the funny thing is that it doesn't work. I used to have a SSH server on my computer at home (which is not running now), and I could connect to it from work. I know the setup could work if I just did things right. I know the FreeProxy and SockScap stuff works, cause it did at home. stunnel and the network is the only difference. Still I get these messages on the XP machine running stunnel as client at work when the SockScap program connects to it: 2006.08.25 10:02:29 LOG5[1280:2940]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.08.25 10:02:29 LOG5[1280:2940]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.08.25 10:02:29 LOG5[1280:2156]: No limit detected for the number of clients 2006.08.25 10:02:59 LOG5[1280:664]: wow connected from 127.0.0.1:3723 2006.08.25 10:03:05 LOG5[1280:972]: wow connected from 127.0.0.1:3725 2006.08.25 10:03:09 LOG5[1280:664]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.08.25 10:03:15 LOG5[1280:972]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket ...and it doesn't work. The program I try using through the tunnel never manages to connect. Anyone have a clue? Thank you very much!

1 0

Re: [stunnel-users] safestring and safename insecure
by Hans Werner Strube 24 Aug '06

24 Aug '06

Michal Trojnara wrote: > Assuming on some systems isprint(x) != isprint(x&0xff): any idea how to > exploit this "insecure" code? > > BTW: At least on Linux and Mac OS X isprint() returns 0 in both cases. The same holds for Solaris. I did not actually encounter an error but just got the idea that something may be insecure here by looking at the lines. After all, isprint etc. are often table-based macros without range-checking the argument. And "man isprint" clearly says that the character is unsigned: (Solaris:) The macro isascii() is defined on all integer values; the rest are defined only where the argument is an int, the value of which is representable as an unsigned char, or EOF, (Linux:) These functions check whether c, which must have the value of an unsigned char or EOF, falls into a certain character class according to the current locale.

1 0

safestring and safename insecure
by Hans Werner Strube 24 Aug '06

24 Aug '06

The macros safestring and safename in common.h are insecure if called for a character with high bit set, because (int)*p will sign-extend the byte on machines where char is signed. Possible patch (here for safestring; for safename correspondingly with isprint -> isalnum): do {char *p; for(p=(s); *p; p++) if(!isprint((int)*(unsigned char *)p)) *p='.';} while(0)

2 1

Re: [stunnel-users] accept is not allowed in inetd mode
by Tomasz Feliksiak 24 Aug '06

24 Aug '06

> I'm afraid I won't be able to tell you what's wrong with your > /etc/stunnel/smtps.conf without your /etc/stunnel/smtps.conf file. > 8-) > I guess you didn't define any service section. > > BTW. Please make sure to read the fine manual. There's also a Polish > version. > http://stunnel.mirt.net/static/stunnel.pl.html > > Greetings from Poland, > Mike You were right. I only define ports but dont uncomment protocol names in [] (like [pop3s]). [pop3s] accept = 995 connect = 110 ;[imaps] ;accept = 993 ;connect = 143 [ssmtp] accept = 465 connect = 25 Now it looks like this and it's working (earlier i have two configs, one per service). Poor thing about this is that it don't log anything before you dont uncomment this [] :P - hope no one other make this mistake. When I uncomment everything else was simple cause I have log :) and know what's going on. There was a problem with binding to ports cause I try to run it by inetd but I find your post at google to not run it by inetd. I change stunnel-inetd-4.15-1 to stunnel-standalone-4.15-1 (PLD Rulez :P) and problems gone. Is possible to run stunnel by inetd??? Thanks for help Michal. Stunnel is great :) Ps. I read the manual, english version. Sad thing is that I dont find out where I make mistake and when I read Polish wersion I do. Good thing is that it will be help for others who make this simple mistake. -- Pozdrawiam Tomasz Feliksiak vonom(a)intertel.net.pl

2 2

Stunnel Crash: Gmail SMTP over TLS
by Shatadal Ghosh 23 Aug '06

23 Aug '06

Hi, I am using stunnel 4.15 on Windows XP SP1 with Mozilla Thunderbird as the e-mail client. I do not have openSSL installed locally. I do have the libssl32.dll and libeay32.dll in the same directory as stunnel.exe (C:\Program Files\stunnel). I am running stunnel as a service. Stunnel crashes when I use it to send e-mail (SMTP via TLS) via gmail. According to the e-mail client configuration page on the gmail website http://mail.google.com/support/bin/answer.py?answer=13287&topic=1555 I tried to use SMTP over TLS to connect to smtp.gmail.com:587 My gmail-smtps block in stunnel.conf was ; SMTP service, listens on localhost:250 [gmail-smtps] protocol=smtp accept=localhost:250 connect=smtp.gmail.com:587 On trying to send an e-mail message via the above configuration stunnel crashed. The log file is as follows 2006.06.14 03:17:15 LOG5[3956:3512]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.06.14 03:17:15 LOG5[3956:3512]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.06.14 03:17:15 LOG5[3956:3600]: No limit detected for the number of clients 2006.06.14 03:17:15 LOG7[3956:3600]: FD 172 in non-blocking mode 2006.06.14 03:17:15 LOG7[3956:3600]: SO_REUSEADDR option set on accept socket 2006.06.14 03:17:15 LOG7[3956:3600]: gmail-pop3s bound to 127.0.0.1:1100 2006.06.14 03:17:15 LOG7[3956:3600]: FD 180 in non-blocking mode 2006.06.14 03:17:15 LOG7[3956:3600]: SO_REUSEADDR option set on accept socket 2006.06.14 03:17:15 LOG7[3956:3600]: gmail-smtps bound to 127.0.0.1:250 ....# info about other mail connections 2006.06.14 03:17:26 LOG7[3956:3600]: gmail-smtps accepted FD=236 from 127.0.0.1:3665 2006.06.14 03:17:26 LOG7[3956:3600]: Creating a new thread 2006.06.14 03:17:26 LOG7[3956:3600]: New thread created 2006.06.14 03:17:26 LOG7[3956:2812]: gmail-smtps started 2006.06.14 03:17:26 LOG7[3956:2812]: FD 236 in non-blocking mode 2006.06.14 03:17:26 LOG7[3956:2812]: TCP_NODELAY option set on local socket 2006.06.14 03:17:26 LOG5[3956:2812]: gmail-smtps connected from 127.0.0.1:3665 2006.06.14 03:17:26 LOG7[3956:2812]: FD 268 in non-blocking mode 2006.06.14 03:17:26 LOG7[3956:2812]: gmail-smtps connecting 64.233.167.111:587 2006.06.14 03:17:26 LOG7[3956:2812]: connect_wait: waiting 10 seconds 2006.06.14 03:17:26 LOG7[3956:2812]: connect_wait: connected 2006.06.14 03:17:26 LOG7[3956:2812]: Remote FD=268 initialized 2006.06.14 03:17:26 LOG7[3956:2812]: TCP_NODELAY option set on remote socket 2006.06.14 03:17:26 LOG5[3956:2812]: Negotiations for smtp (client side) started 2006.06.14 03:17:26 LOG7[3956:2812]: <- 220 mx.gmail.com ESMTP w66sm450524pyw 2006.06.14 03:17:26 LOG7[3956:2812]: -> 220 mx.gmail.com ESMTP w66sm450524pyw <logfile ends> What mistake am I making? Fortunately it seems that gmail supports SMTP over SSL too (smtp.gmail.com:465) and I am using that. However I am also facing this problem with another account which unfortunately allows SMTP only over TLS. Thanks, Shatadal. --- avast! Antivirus: Outbound message clean. Virus Database (VPS): 0624-1, 06/13/2006 Tested on: 6/14/2006 6:22:04 AM avast! - copyright (c) 2000-2006 ALWIL Software. http://www.avast.com _________________________________________________________________ Is your PC infected? Get a FREE online computer virus scan from McAfee® Security. http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963

2 1

Re: [stunnel-users] RFC 2487 test in smtp_server not reliable
by Hans Werner Strube 23 Aug '06

23 Aug '06

Michal Trojnara wrote: > On 2006-08-22, at 10:55, Hans Werner Strube wrote: > > Instead of waiting, a better method would > > be to have a finer timeout resolution than 1 sec in > > s_poll_wait(...,...); > > setting the timeout to 1 (sec) would be too embarrassing for TLS > > connections. But this would require major changes in the sources. > > I'm going to do it the hard way and add another parameter to > s_poll_wait() function. > > IMHO the timeout should be between 100ms and 500ms. What do you think? I have not tested the minimum required. However, it should be as short as possible, since for a client using TLS, the full delay will always occur on starting a connection. It should be documented somewhere how this new constant could be configured in compilation.

1 0

RFC 2487 test in smtp_server not reliable
by Hans Werner Strube 23 Aug '06

23 Aug '06

In protocol.c, function smtp_server(), a test for plain SSL or STARTTLS usage (RFC 2487) is based on the availability of data from the client (c->local_rfd.fd). This works well in fast LANs but often fails for WAN connections through slow V90 modems. Especially with new Mozilla-based clients (also KMail and Evolution reported by other users) under Windows XP SP2 the test for data fails almost always, incorrectly resulting in an RFC 2487 handshake with error "Unknown client EHLO". This depends to some extent on the client: Outlook Express mostly works, Mozilla 1.7.x often worked after initial failure, SeaMonkey 1.x always fails. This seems to be a timing problem. I tried inserting a "usleep(50000);" before the switch(s_poll_wait(...)), which made SSL work with SeaMonkey (but often not for the first mail-sending attempt). Unfortunately, in Solaris 7 (where I tested stunnel), usleep is not yet thread-safe, maybe nanosleep(...,...) is preferable. Instead of waiting, a better method would be to have a finer timeout resolution than 1 sec in s_poll_wait(...,...); setting the timeout to 1 (sec) would be too embarrassing for TLS connections. But this would require major changes in the sources.

2 1

accept is not allowed in inetd mode
by vonom 23 Aug '06

23 Aug '06

Hello When i try to run stunnel by scripts or by hand stunnel /etc/stunnel/stunnel.conf (or other config) i see something like that: -bash-3.1# stunnel /etc/stunnel/pop3s.conf 2006.08.23 01:45:17 LOG7[24189:3083933376]: RAND_status claims sufficient entropy for the PRNG 2006.08.23 01:45:17 LOG6[24189:3083933376]: PRNG seeded successfully 2006.08.23 01:45:17 LOG7[24189:3083933376]: Certificate: /etc/stunnel/host-cert.pem 2006.08.23 01:45:17 LOG7[24189:3083933376]: Key file: /etc/stunnel/host-key.pem 2006.08.23 01:45:17 LOG7[24189:3083933376]: SSL context initialized for service stunnel file /etc/stunnel/pop3s.conf line 64: accept is not allowed in inetd mode No stunnel sesion, open ports or anything. I was very happy when I find out that I have stunnel-inetd-4.15-1 in my disto and it runs and ports are open. Everything great but when i try to send or receive email (postfix) it dont work. I spend a lot of time and a while ago i write telnet localhost 465 (or 995), ehlo hostname and see: -bash-3.1# telnet localhost 465 Trying 127.0.0.1.465... Connected to localhost. Escape character is '^]'. 2006.08.23 01:56:20 LOG7[24343:3083708096]: RAND_status claims sufficient entropy for the PRNG 2006.08.23 01:56:20 LOG6[24343:3083708096]: PRNG seeded successfully 2006.08.23 01:56:20 LOG7[24343:3083708096]: Certificate: /etc/stunnel/host-cert.pem 2006.08.23 01:56:20 LOG7[24343:3083708096]: Key file: /etc/stunnel/host-key.pem 2006.08.23 01:56:20 LOG7[24343:3083708096]: SSL context initialized for service stunnel file /etc/stunnel/smtps.conf line 64: accept is not allowed in inetd mode Connection closed by foreign host. When I write telnet localhost 25 -bash-3.1# telnet localhost 25 Trying 127.0.0.1.25... Connected to localhost. Escape character is '^]'. 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-STARTTLS 250 8BITMIME So It's OK I think. file /etc/stunnel/smtps.conf line 64: accept is not allowed in inetd mode Connection closed by foreign host. -line 64 point just last line of config file. I have no idea what it could be. Anyone know how to fix that?

2 1

Protocol using Connect
by Hutchison, Alan 21 Aug '06

21 Aug '06

I am trying to use the protocol entries in the config file as shown below (xyz substituted to protect employer & vendor). Below is the log. Stunnel abends as it is trying to authenticate to our corporate proxy. The network guys are seeing the attempt to authenticate but it does not appear to complete. Any thoughts? key=maxstpb.crt debug=7 output=stunnel.log client=yes [MarketAxess] accept=127.0.0.1:12345 delay=yes TIMEOUTbusy=120 TIMEOUTconnect=120 connect=xyz.xyz.com:80 protocol=connect protocolHost=xyz.xyz.com:443 protocolCredentials=xyz:xyz 2006.08.21 15:13:24 LOG5[2520:1312]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.08.21 15:13:24 LOG5[2520:1312]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv4 2006.08.21 15:13:24 LOG5[2520:3184]: No limit detected for the number of clients 2006.08.21 15:13:24 LOG7[2520:3184]: FD 192 in non-blocking mode 2006.08.21 15:13:24 LOG7[2520:3184]: SO_REUSEADDR option set on accept socket 2006.08.21 15:13:24 LOG7[2520:3184]: MarketAxess bound to 127.0.0.1:12345 2006.08.21 15:14:00 LOG7[2520:3184]: MarketAxess accepted FD=200 from 127.0.0.1:4200 2006.08.21 15:14:00 LOG7[2520:3184]: Creating a new thread 2006.08.21 15:14:00 LOG7[2520:3184]: New thread created 2006.08.21 15:14:00 LOG7[2520:2560]: MarketAxess started 2006.08.21 15:14:00 LOG7[2520:2560]: FD 200 in non-blocking mode 2006.08.21 15:14:00 LOG5[2520:2560]: MarketAxess connected from 127.0.0.1:4200 2006.08.21 15:14:00 LOG7[2520:2560]: FD 416 in non-blocking mode 2006.08.21 15:14:00 LOG7[2520:2560]: MarketAxess connecting xyz.xyz.xyz.xyz:80 2006.08.21 15:14:00 LOG7[2520:2560]: connect_wait: waiting 120 seconds 2006.08.21 15:14:00 LOG7[2520:2560]: connect_wait: connected 2006.08.21 15:14:00 LOG7[2520:2560]: Remote FD=416 initialized 2006.08.21 15:14:00 LOG5[2520:2560]: Negotiations for connect (client side) started 2006.08.21 15:14:00 LOG7[2520:2560]: -> CONNECT xyz.xyz.com:443 HTTP/1.1 Alan R. Hutchison 515-362-1272 -----Message Disclaimer----- This e-mail message is intended only for the use of the individual or entity to which it is addressed, and may contain information that is privileged, confidential and exempt from disclosure under applicable law. If you are not the intended recipient, any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by reply email to Connect(a)principal.com and delete or destroy all copies of the original message and attachments thereto. Email sent to or from the Principal Financial Group or any of its member companies may be retained as required by law or regulation. Nothing in this message is intended to constitute an Electronic signature for purposes of the Uniform Electronic Transactions Act (UETA) or the Electronic Signatures in Global and National Commerce Act ("E-Sign") unless a specific statement to the contrary is included in this message. While this communication may be used to promote or market a transaction or an idea that is discussed in the publication, it is intended to provide general information about the subject matter covered and is provided with the understanding that The Principal is not rendering legal, accounting, or tax advice. It is not a marketed opinion and may not be used to avoid penalties under the Internal Revenue Code. You should consult with appropriate counsel or other advisors on all matters pertaining to legal, tax, or accounting obligations and requirements.

1 0

limit connections per certificate
by Eric H. Jung 14 Aug '06

14 Aug '06

Hi, I'd like to limit the number of connections to stunnel (in server mode) by client certificate. In other words, I want all clients to only have 1 open socket connection to the server at a time. Is this possible with stunnel out-of-the-box, or must I write a patch to handle it? Thank you, grimholtz

1 0

stunnel through xinetd: process not terminating after use
by Alex Forrow 07 Aug '06

07 Aug '06

Hi, Im using stunnel through xinetd to forward some local unencrypted ldap connections to our ssl ldap server. Seems to work ok but after each use the stunnel process does not terminate, so I end up with losts of processes not doing anything. After a few days, these processes reach a limit and connections fail. As you can see, the connection has finished, but the process still exists: [root@lynx stunnel]# ps -e | grep stunnel 2396 ? 00:00:00 stunnel 2517 ? 00:00:00 stunnel 2575 ? 00:00:00 stunnel 2576 ? 00:00:00 stunnel [root@lynx stunnel]# netstat -p | grep stunnel tcp 0 0 lynx.seekit.co.uk:ldaplo lynx.seekit.co.uk:60390 CLOSE_WAIT 2396/stunnel unix 2 [ ] DGRAM 3204569 2576/stunnel unix 2 [ ] DGRAM 3204562 2575/stunnel unix 2 [ ] DGRAM 3203127 2517/stunnel unix 2 [ ] DGRAM 3202108 2396/stunnel Heres the xinetd configuration for stunnel (/etc/xinetd.d/ldaplo): # default: on # description: Stunnel to connect to LDAP for an insecure local session service ldaplo { disable = no #flags = REUSE port = 390 socket_type = stream wait = no user = nobody server = /usr/sbin/stunnel server_args = /etc/stunnel/ldap.conf # log_on_failure += USERID } Heres the stunnel configuration file (/etc/stunnel/ldap.conf): client = yes connect = 636 Cheers, Alex Forrow

1 0

Stunnel without certificates
by Shane 04 Aug '06

04 Aug '06

Hi, I am new to this group and also to Stunnel utility. I would like to use Stunnel to secure my http connections. Here is a twist. I just want to encrypt the link and don't bother much about the authentication. 1. Can I use Stunnel without certificates? 2. If certificate is mandatory, can I use only the file which contains "keys" but not use other authentication credentials? 3. Can I use anonymous DH Ciphers so that authentication phase is assumed done and both client and servers generate the keys? Any help and guidance will useful. Thanks, -Ravi Joshi __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

TIMEOUTbusy
by Martin Beauchamp 02 Aug '06

02 Aug '06

Hi List, I'm running Stunnel 4.15 under win32 in client mode. Can someone give me a better idea about what TIMEOUTbusy does? The docs state that it is "time to wait for expected data." But what does Stunnel do after this period? Does it disconnect from the remote server? Does it attempt another SSL session after some interval? Thanks for any addition information! Martin -- Martín Beauchamp Systems Engineer Park Slope Food Coop, Inc. (718) 783-2187 (718) 622-5685 Fax

1 0

stunnel crashing on connect
by Kevin King 24 Jul '06

24 Jul '06

Hi, I am attempting to run stunnel on Windows XP Pro but it is crashing as soon as anything connects to it. I am using it to create a secure TLS tunnel in front of an SMTP mail server and from what I read I should be able to do this and stunnel will handle the STARTLS commands. I downloaded the following windows binary: 562589 Mar 11 13:02:35 2006 stunnel-4.15-installer.exe I made minimal changes to stunnel.conf: 1) added the line "protocol = smtp" 2) uncommented the debug lines (still crashes if I leave these lines alone) I then start stunnel, either as a service or from cmd line - same thing happens >From a command prompt I then "telnet localhost 465" and send "EHLO mydomain.com hi" Stunnel responds with "250-EHLO mydomain.com hi Welcome". I am also running hMailServer on the same machine listening on port 25. It looks like stunnel is forwarded the initial EHLO to hMailServer, then hMailServer responds correctly and stunnel forwards that response back to me. Then stunnel crashes immediatly. Following is the log: 2006.07.20 10:28:41 LOG7[112:1656]: RAND_status claims sufficient entropy for the PRNG 2006.07.20 10:28:41 LOG6[112:1656]: PRNG seeded successfully 2006.07.20 10:28:41 LOG7[112:1656]: Certificate: stunnel.pem 2006.07.20 10:28:41 LOG7[112:1656]: Key file: stunnel.pem 2006.07.20 10:28:41 LOG7[112:1656]: SSL context initialized for service pop3s 2006.07.20 10:28:41 LOG7[112:1656]: Certificate: stunnel.pem 2006.07.20 10:28:41 LOG7[112:1656]: Key file: stunnel.pem 2006.07.20 10:28:41 LOG7[112:1656]: SSL context initialized for service imaps 2006.07.20 10:28:41 LOG7[112:1656]: Certificate: stunnel.pem 2006.07.20 10:28:41 LOG7[112:1656]: Key file: stunnel.pem 2006.07.20 10:28:41 LOG7[112:1656]: SSL context initialized for service ssmtp 2006.07.20 10:28:41 LOG5[112:1656]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.07.20 10:28:41 LOG5[112:1656]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.07.20 10:28:41 LOG5[112:2564]: No limit detected for the number of clients 2006.07.20 10:28:41 LOG7[112:2564]: FD 1884 in non-blocking mode 2006.07.20 10:28:41 LOG7[112:2564]: SO_REUSEADDR option set on accept socket 2006.07.20 10:28:41 LOG7[112:2564]: pop3s bound to 0.0.0.0:995 2006.07.20 10:28:41 LOG7[112:2564]: FD 1872 in non-blocking mode 2006.07.20 10:28:41 LOG7[112:2564]: SO_REUSEADDR option set on accept socket 2006.07.20 10:28:41 LOG7[112:2564]: imaps bound to 0.0.0.0:993 2006.07.20 10:28:41 LOG7[112:2564]: FD 1864 in non-blocking mode 2006.07.20 10:28:41 LOG7[112:2564]: SO_REUSEADDR option set on accept socket 2006.07.20 10:28:41 LOG7[112:2564]: ssmtp bound to 0.0.0.0:465 2006.07.20 10:28:59 LOG7[112:2564]: ssmtp accepted FD=1840 from 127.0.0.1:1543 2006.07.20 10:28:59 LOG7[112:2564]: Creating a new thread 2006.07.20 10:28:59 LOG7[112:2564]: New thread created 2006.07.20 10:28:59 LOG7[112:2936]: ssmtp started 2006.07.20 10:28:59 LOG7[112:2936]: FD 1840 in non-blocking mode 2006.07.20 10:28:59 LOG7[112:2936]: TCP_NODELAY option set on local socket 2006.07.20 10:28:59 LOG5[112:2936]: ssmtp connected from 127.0.0.1:1543 2006.07.20 10:28:59 LOG7[112:2936]: FD 1812 in non-blocking mode 2006.07.20 10:28:59 LOG7[112:2936]: ssmtp connecting 127.0.0.1:25 2006.07.20 10:28:59 LOG7[112:2936]: connect_wait: waiting 10 seconds 2006.07.20 10:28:59 LOG7[112:2936]: connect_wait: connected 2006.07.20 10:28:59 LOG7[112:2936]: Remote FD=1812 initialized 2006.07.20 10:28:59 LOG7[112:2936]: TCP_NODELAY option set on remote socket 2006.07.20 10:28:59 LOG5[112:2936]: Negotiations for smtp (server side) started 2006.07.20 10:28:59 LOG7[112:2936]: RFC 2487 detected 2006.07.20 10:28:59 LOG7[112:2936]: <- 220 hmailserver ESMTP 2006.07.20 10:28:59 LOG7[112:2936]: -> 220220 hmailserver ESMTP + stunnel 2006.07.20 10:29:09 LOG7[112:2936]: <- EHLO mydomain.com hi 2006.07.20 10:29:09 LOG7[112:2936]: -> 250-EHLO mydomain.com hi Welcome Here is the output of stunnel -version: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 Global options debug = 5 RNDbytes = 64 RNDoverwrite = yes service = stunnel taskbar = yes Service-level options cert = stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = stunnel.pem session = 300 seconds TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none 2006.07.20 10:25:04 LOG3[3256:3456]: Server is down I tried building the source and debugging it but I only found some batch files refering to the MS embedded compiler. Why would I want to compile this for an embedded or mobile device? That is what that compiler is for. What makefile or compiler should I be using on windows if I wish to build stunnel on windows? Which I would rather not have to do, I would like to just use the binary but it is crashing before I ever get a chance to test it. Any help would greatly be appreciated. thanks, -Kevin

1 0

stunnel version issue?
by NobbyNoMates 22 Jul '06

22 Jul '06

Dear all - I am trying to set up an stunnel connection on an Ubuntu Dapper box. This system seems to give me (stunnel -V) : stunnel 3.26 on i486-pc-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 and no matter where I look. I cannot seem to find an option to specify a config file when starting stunnel. Unfortunately, the instructions which I have received for setting up my (Direct Connect) client, contain such a config file which is supposed to be needed. It contains the following: client = yes delay = yes output = stunnel.log debug = notice pid = stunnel.pid [DC Server] connect = server.address.org:AAAAA accept = 127.0.0.1:BBBBB where of course the AAAA and BBBB are port numbers. Now I wonder if there is any way to make my stunnel version function in the specified way without the config file? Or is there some alternative way to specify this kind of config? Any suggestion would be much appreciated! Best regards, Erik

2 2

Clearer and Detailed version of the mail Stunnel for HTTP encription
by LoopBack Inc 20 Jul '06

20 Jul '06

Hello. I rewrote some parts of the question, and illustrated it by a small ASCII picture to clearifiy the whole situation. I don't know why I haven't got a single answer, because over 350 people are subscribed to the list, so I hope that I'll get some help now. It would be grateful. I use SocksCap to forward the iexplore cnnections to another port, a port on which stunnel listens. On PC1, the client, stunnel is listening on port 500. So when I start iexplore.exe with SocksCap every connection goes to 127.0.0.1:500. PC1 connects to PC2, with connect = 192.168.0.2:123 On PC2, the server, stunnel listens on port 500. then is connects to the internet with connect = 127.0.0.1:80. Here is the problem, stunnel doesn't connect to the internet over 127.0.0.1:80. I don't know why, but it doesnt. ---Stunnel.conf SERVER--- .. [inet] accept = 127.0.0.1:123 connect = 127.0.0.1:80 ---Stunnel.conf CLIENT--- .. [inet] accept = 127.0.0.1:500 connect = 192.168.0.2:123 LOGs from the SERVER: 2006.07.18 16:56:07 LOG7[2332:2720]: inet accepted FD=208 from 192.168.0.1:2156 2006.07.18 16:56:07 LOG7[2332:2720]: Creating a new thread 2006.07.18 16:56:07 LOG7[2332:2720]: New thread created 2006.07.18 16:56:07 LOG7[2332:1880]: inet started 2006.07.18 16:56:07 LOG7[2332:1880]: FD 208 in non-blocking mode 2006.07.18 16:56:07 LOG5[2332:1880]: inet connected from 192.168.0.1:2156 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): before/accept initialization 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 read client hello A 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 write server hello A 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 write change cipher spec A 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 write finished A 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 flush data 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 read finished A 2006.07.18 16:56:07 LOG7[2332:1880]: 1 items in the session cache 2006.07.18 16:56:07 LOG7[2332:1880]: 0 client connects (SSL_connect()) 2006.07.18 16:56:07 LOG7[2332:1880]: 0 client connects that finished 2006.07.18 16:56:07 LOG7[2332:1880]: 0 client renegotiations requested 2006.07.18 16:56:07 LOG7[2332:1880]: 7 server connects (SSL_accept()) 2006.07.18 16:56:07 LOG7[2332:1880]: 7 server connects that finished 2006.07.18 16:56:07 LOG7[2332:1880]: 0 server renegotiations requested 2006.07.18 16:56:07 LOG7[2332:1880]: 5 session cache hits 2006.07.18 16:56:07 LOG7[2332:1880]: 1 session cache misses 2006.07.18 16:56:07 LOG7[2332:1880]: 1 session cache timeouts 2006.07.18 16:56:07 LOG6[2332:1880]: SSL accepted: previous session reused 2006.07.18 16:56:07 LOG7[2332:1880]: FD 244 in non-blocking mode 2006.07.18 16:56:07 LOG7[2332:1880]: inet connecting 127.0.0.1:80 2006.07.18 16:56:07 LOG7[2332:1880]: connect_wait: waiting 10 seconds 2006.07.18 16:56:07 LOG7[2332:1880]: connect_wait: connected 2006.07.18 16:56:07 LOG7[2332:1880]: Remote FD=244 initialized After nothing happend for 52 seconds I aborted in the iexplore.exe to open the page. 2006.07.18 16:56:59 LOG7[2332:1880]: SSL alert (read): warning: close notify 2006.07.18 16:56:59 LOG7[2332:1880]: SSL closed on SSL_read 2006.07.18 16:56:59 LOG7[2332:1880]: Socket write shutdown 2006.07.18 16:56:59 LOG7[2332:1880]: SSL write shutdown 2006.07.18 16:56:59 LOG7[2332:1880]: SSL alert (write): warning: close notify 2006.07.18 16:56:59 LOG6[2332:1880]: SSL_shutdown successfully sent close_notify 2006.07.18 16:56:59 LOG5[2332:1880]: Connection closed: 0 bytes sent to SSL, 3 bytes sent to socket 2006.07.18 16:56:59 LOG7[2332:1880]: inet finished (0 left) LOGs from the CLIENT: 2006.07.18 17:10:11 LOG7[1756:4756]: inet accepted FD=444 from 127.0.0.1:2284 2006.07.18 17:10:11 LOG7[1756:4756]: Creating a new thread 2006.07.18 17:10:11 LOG7[1756:4756]: New thread created 2006.07.18 17:10:11 LOG7[1756:2840]: inet started 2006.07.18 17:10:11 LOG7[1756:2840]: FD 444 in non-blocking mode 2006.07.18 17:10:11 LOG7[1756:2840]: TCP_NODELAY option set on local socket 2006.07.18 17:10:11 LOG5[1756:2840]: inet connected from 127.0.0.1:2284 2006.07.18 17:10:11 LOG7[1756:2840]: FD 348 in non-blocking mode 2006.07.18 17:10:11 LOG7[1756:2840]: inet connecting 192.168.0.2:123 2006.07.18 17:10:11 LOG7[1756:2840]: connect_wait: waiting 10 seconds 2006.07.18 17:10:11 LOG7[1756:2840]: connect_wait: connected 2006.07.18 17:10:11 LOG7[1756:2840]: Remote FD=348 initialized 2006.07.18 17:10:11 LOG7[1756:2840]: TCP_NODELAY option set on remote socket 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): before/connect initialization 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 write client hello A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 read server hello A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 read finished A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 write change cipher spec A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 write finished A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 flush data 2006.07.18 17:10:11 LOG7[1756:2840]: 17 items in the session cache 2006.07.18 17:10:11 LOG7[1756:2840]: 65 client connects (SSL_connect()) 2006.07.18 17:10:11 LOG7[1756:2840]: 65 client connects that finished 2006.07.18 17:10:11 LOG7[1756:2840]: 0 client renegotiations requested 2006.07.18 17:10:11 LOG7[1756:2840]: 0 server connects (SSL_accept()) 2006.07.18 17:10:11 LOG7[1756:2840]: 0 server connects that finished 2006.07.18 17:10:11 LOG7[1756:2840]: 0 server renegotiations requested 2006.07.18 17:10:11 LOG7[1756:2840]: 48 session cache hits 2006.07.18 17:10:11 LOG7[1756:2840]: 0 session cache misses 2006.07.18 17:10:11 LOG7[1756:2840]: 0 session cache timeouts 2006.07.18 17:10:11 LOG6[1756:2840]: SSL connected: previous session reused Nothing happendend, I aborted iexplore.exe 2006.07.18 17:10:25 LOG7[1756:2840]: Socket closed on read 2006.07.18 17:10:25 LOG7[1756:2840]: SSL write shutdown 2006.07.18 17:10:25 LOG7[1756:2840]: SSL alert (write): warning: close notify 2006.07.18 17:10:25 LOG7[1756:2840]: SSL_shutdown retrying 2006.07.18 17:10:25 LOG7[1756:2840]: SSL doesn't need to read or write 2006.07.18 17:10:25 LOG7[1756:2840]: SSL alert (read): warning: close notify 2006.07.18 17:10:26 LOG7[1756:2840]: SSL closed on SSL_read 2006.07.18 17:10:26 LOG7[1756:2840]: Socket write shutdown 2006.07.18 17:10:26 LOG5[1756:2840]: Connection closed: 3 bytes sent to SSL, 0 bytes sent to socket 2006.07.18 17:10:26 LOG7[1756:2840]: inet finished (0 left) So the problem is that stunnel doesn't connect to the internet on PC2. I think i have to use something different than connect = 127.0.0.1:80 on PC2, but not sure. The version of stunnel is 4.15 I'm using Windows. _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today - it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

4 3