- stunnel-users - stunnel.org

Newbie: Success, now failure???
by Roger Bohl (Sr.) 25 Jul '12

25 Jul '12

For several days, I've been using Stunnel (with Blat) successfully (possibly with no intervening re-boots). A day or so ago, the system was re booted Today, however, Stunnel failed. I got the following Stunnel reply message: No limit detected for the number of clients stunnel 4.53 on x86-pc-mingw32-gnu platform Compiled/running with OpenSSL 0.9.8s-fips 4 Jan 2012 Threading:WIN32 SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:SELECT+IPv6 Reading configuration from file stunnel.conf FIPS mode is enabled Compression not enabled Snagged 64 random bytes from .rnd Wrote 1024 new random bytes to .rnd PRNG seeded successfully Initializing inetd mode configuration Certificate: client.pem Certificate loaded Key file: client.pem Private key loaded SSL options set: 0x00000004 Accept option is not allowed in inetd mode Remove accept option or define a [section] Server is down The stunnel.conf file in the Stunnel directory is: CAfile = cert.pem cert = client.pem client = yes RNDfile = .rnd [gmail smtp] ; (I may have had this in or out before. In "cleaning up" various files, I may have thought this to be a comment, and removed it.) accept = 25 connect = smtp.gmail.com:465 The program fails both with and without the [gmail smtp] line included. Except, possibly, for removing ;[comment] lines, no other changes occurred. Can somebody give me a clue as to the cause, and suggest the fix. I'm running Windows Vista. (I found the 17+ page instruction file, by Michal Trojnara, but didn't see a solution, there.) Thanks. Roger Bohl rhbohl(a)gmail.com 707-939-8459 PDT

1 0

please unsubscribe my email - thx
by Rüdiger Konte 24 Jul '12

24 Jul '12

1 0

stunnel and http
by John 23 Jul '12

23 Jul '12

I am running the latest stunnel for Windows on 64-bit Win7 as an application, not as a service. I simply unzipped everything to one folder, configured the "stunnel.conf" file; and when I need to run the program, I can open a command prompt in its folder and type "stunnel stunnel.conf". It then reads my stunnel.conf file and works its magic. This works fine for capturing the data from those programs which I can configure to use localhost and a specific port because I can configure stunnel.conf with accept = ip.address:port Now I have a program that I want to use to download some text files from the internet using http or https. However, this program cannot be manually configured to make a connection with a certain IP and port. Instead, I have to give it an alias-like name, which it then maps to one of several different domain names, makes a DNS query for the IP and transmits to that address the instructions for downloading some text files. So, is it possible to have stunnel "capture" any and all http transports (port 80) or https transports (port 443) from a specific program, regardless of which IP that connection was destined for, so that I can then direct this data traffic from stunnel to socat or from stunnel to an http proxy which I can manually direct to a specific connection? Is this a kind of thing for which stunnel can be used? If so, where can I find the instructions for setting it up? Thanks.

2 2

Reboot Requires Manual: "service stunnel restart"
by John Vasko 21 Jul '12

21 Jul '12

On FreeBSD 9.0 stunnel 4.43 works fine after running "service stunnel restart", but stunnel fails loading on boot. My desired config includes: /usr/local/etc/stunnel/stunnel.conf -------------------------------------------- [attsmtp] client = yes verify = 0 accept = 2525 connect = smtp.att.yahoo.com:465 delay = yes Please advise. See below for messages after bootup: /var/run/stunnel/stunnel.log ------------------------------------ 2012.07.21 02:52:06 LOG7[1378:675300096]: No limit detected for the number of clients 2012.07.21 02:52:06 LOG7[1378:675300096]: signal_pipe: FD=3 allocated (non-blocking mode) 2012.07.21 02:52:06 LOG7[1378:675300096]: signal_pipe: FD=4 allocated (non-blocking mode) 2012.07.21 02:52:06 LOG5[1378:675300096]: stunnel 4.43 on i386-portbld-freebsd9.0 platform 2012.07.21 02:52:06 LOG5[1378:675300096]: Compiled/running with OpenSSL 1.0.0e 6 Sep 2011 2012.07.21 02:52:06 LOG5[1378:675300096]: Threading:PTHREAD SSL:ENGINE Auth:LIBWRAP Sockets:POLL,IPv6 2012.07.21 02:52:06 LOG5[1378:675300096]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf 2012.07.21 02:52:06 LOG7[1378:675300096]: Snagged 64 random bytes from //.rnd 2012.07.21 02:52:06 LOG7[1378:675300096]: Wrote 1024 new random bytes to //.rnd 2012.07.21 02:52:06 LOG7[1378:675300096]: PRNG seeded successfully 2012.07.21 02:52:08 LOG6[1378:675300096]: Initializing SSL context for service attsmtp 2012.07.21 02:52:08 LOG7[1378:675300096]: SSL options set: 0x00000004 2012.07.21 02:52:08 LOG6[1378:675300096]: SSL context initialized 2012.07.21 02:52:08 LOG5[1378:675300096]: Configuration successful 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=5 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=6 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=6 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=7 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=7 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=8 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=8 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=9 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=9 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=10 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: accept socket: FD=11 allocated (non-blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: Option SO_REUSEADDR set on accept socket 2012.07.21 02:52:08 LOG7[1378:675300096]: Service attsmtp bound to 0.0.0.0:2525 2012.07.21 02:52:08 LOG7[1378:675300096]: Service attsmtp opened FD=11 2012.07.21 02:52:08 LOG7[1378:675300096]: Created pid file /stunnel.pid 2012.07.21 02:52:15 LOG7[1378:675300096]: Dispatching signals from the signal pipe 2012.07.21 02:52:15 LOG3[1378:675300096]: Received signal 2; terminating 2012.07.21 02:52:15 LOG7[1378:675300096]: str_stats: 43 block(s), 3554 byte(s) 2012.07.21 02:52:15 LOG7[1378:675300096]: removing pid file /stunnel.pid

1 1

Re: [stunnel-users] Reverse tunnel with middle server
by Javier 19 Jul '12

19 Jul '12

[To the mailing list: Sorry for these non-english messages, I started, previously, a private communication to avoid it] On Thu, 19 Jul 2012 20:26:45 +0200 "Jorge A." <curruscataphractus(a)gmail.com> wrote: > Hola Javier, > > Igual no me he explicado bien. Lo que quiero es conectar dos > máquinas, una dentro de una NAT detrás de un router que no tiene > redirigidos los puertos a la máquina claro, pero que sí tiene > Internet y acceso a la máquina servidor. Esto me sigue sin quedar claro. Ya perdonarás. Una (Objetivo) está conectada a un router, que sirve internet a una red local, pero que no tiene redirigidos los puertos a la máquina que tiene el servidor http. Esta no tiene acceso a internet porque no se le ha configurado una puerta de enlace y además no la pueden alcanzar porque no hay puertos redirigidos hacia ella. Hasta ahí, todo bien ;) Lo que quería saber es si la máquina que hace de Servidor hacia internet está en la misma subred local o no que la máquina objetivo. El que la máquina objetivo vea al servidor no implica necesariamente que el servidor vea al objetivo. Además, si está conectada al mismo router, porque decías que era accesible desde internet. Lo que entiendo es que quieres redirigir el tráfico proveniente al servidor desde el exterior al objetivo http. Si el servidor, ve a la máquina http, bastaría con decir en la configuración de stunnel que conecte con el servidor http de esa maquina indicándole la ip:puerto. Por eso te dije que no tenía mayor complicación. En esa configuración no hace falta que la máquina objetivo tenga un servidor stunnel y viceversa para comunicarse entre ellos. La comunicación entre el servidor y la máquina objetivo puede ser abierta sin problemas. Lo importante ya existe, que el servidor haga de puente ssl entre internet y el objetivo http. > Durante el día de hoy lo he conseguido hacer más o menos usando > pppd y stunnel entre 2 linux pero no sé si sería posible hacerlo > sólo con stunnel (y *ifconfig*, *ip*, *route* o similares). Sobre > todo porque la máquina cliente objetivo está bastante limitada y no > puedo instalar de manera fácil pppd (tiene un kernel custom, hay > que compilar el módulo pppd del kernel, el demonio, etc). > > Lo que estoy mirando ahora es el comando *ip tunnel* para per si > puedo hacer algo parecido con pppd pero no sé si me estoy dando > golpes contra la pared. > > Muchas gracias de antemano por tu ayuda. De nada, aunque con Linux he topado. Conozco muy por encima los comandos. Pero, olvidándonos de las herramientas a utilizar, sabiendo exactamente el entorno en el que están esas máquinas, todo es coser y cantar, a no ser que sea un imposible ;) De ahí la importancia de saber si están en la misma red local o no, etc. Saludos.

1 1

Reverse tunnel with middle server
by Jorge A. 18 Jul '12

18 Jul '12

Hi everyone, I've search into archives trying to found a solution for my problem without success. The problem is simple: make a machine available on HTTP port when it's behind a e.g. common DSL. I have a middle server for which I have full access to install any program, linux. What I was trying to do is the following: Three machines: Middle server (Server), Target (linux machine behind DSL) and Client. Same stunnel version on both Server and Target. Latests. Server is available on the Internet, running stunnel Target is behind a nat router, e.g. inside a common DSL. I assume this must run stunnel as well. Client connects to Server and Server forwards traffic to Target seamlessly. As far as I know, running stunnel on client mode from e.g. Target and trying to connect to whichever service on Server does not work on reverse: you cannot connect backwards to target. Am I correct? If not, how do I configure both ends and how do I know port to use to connect to Target (log file?) ? What I've tested: 1. Run stunnel on Server on server mode accepting ('accept') connections on a fixed port, e.g. 5000. Here, as far as I know, you must define the 'connect' directive to forward traffic to either local or remote host. The problem is, from Server, you don't know Target ip nor it's accessible 2. Run stunnel on Server and, on Target launch stunnel on client mode to try Thanks in advance and congratulations as it's a great piece of software. Best regards, Jorge

1 0

Stunnel on WIndows Server 2008 R2 SP1 x 64 fails - Microsoft.VC90.CRT.MANIFEST
by Rüdiger Konte 15 Jul '12

15 Jul '12

Hi Stunnel users, I am trying to run stunnel "4.53 installer.exe" on a MS Windows Server 2008 R2 SP1 64 Bit (under VMWARE Workstation 6.5 as a virtual system; Physical Host OS is WIN7 Ultimate 32 BIT) The installation of stunnel was done as an "Administrator" and it ran through without issues. But I cannot se any service running. And when I try to launch the stunnel shortcut on the desktop, i got a error message like: "The application was unable to start correctly (0xc0150002). Click OK to close the application." I assume it has something to do with the Microsoft.VC90.CRT.MANIFEST file. But i am not an expert. This is shown in the Event log: ########################## Protokollname: Application Quelle: SideBySide Datum: 15.07.2012 12:17:01 Ereignis-ID: 35 Aufgabenkategorie:Keine Ebene: Fehler Schlüsselwörter:Klassisch Benutzer: Nicht zutreffend Computer: WIN-C1K2E115MV1 Beschreibung: Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files (x86)\stunnel\LIBEAY32.dll". Fehler in Manifest- oder Richtliniendatei "C:\Program Files (x86)\stunnel\Microsoft.VC90.CRT.MANIFEST" in Zeile 4. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8". Definition: Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Ereignis-XML: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="SideBySide" /> <EventID Qualifiers="49409">35</EventID> <Level>2</Level> <Task>0</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2012-07-15T10:17:01.000000000Z" /> <EventRecordID>197</EventRecordID> <Channel>Application</Channel> <Computer>WIN-C1K2E115MV1</Computer> <Security /> </System> <EventData> <Data>Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"</Data> <Data>Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161"</Data> <Data>C:\Program Files (x86)\stunnel\LIBEAY32.dll</Data> <Data>C:\Program Files (x86)\stunnel\Microsoft.VC90.CRT.MANIFEST</Data> <Data>4</Data> ########################## I ran the MS tool sxstrace.exe to get more details: See the outcome below: ######################################### INFORMATION: Die Manifestsdefinitionsidentität ist "Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161"". FEHLER: Die im Manifest gefundene Komponentenidentität stimmt nicht mit der Identität der angeforderten Komponente überein. Verweis: Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8". Definition: Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161". FEHLER: Bei der Generierung des Aktivierungskontextes ist ein Fehler aufgetreten. Beendet die Generierung des Aktivierungskontextes. ######################################### Is anything missing? .NET or another library ? Note: I installed on the same server in a different snapshot stunnel version 4.4 and it seems to work, at least no error message. But i want to use the latest version. Any help would be nice. Best Rudi

1 0

Conf question: HTTP to HTTPS with SNI
by John Moser 03 Jul '12

03 Jul '12

I have a particular task I need to accomplish in which an HTTP-only caching proxy server is to accept SSL. The architecture in mind is as follows: - Receive request { HTTP request: - Received by caching proxy at localhost:80 HTTPS request: - Received by Pound - Decoded to HTTP - X-FROM-SSL header added - Forwarded to localhost:80 (caching proxy) } Proxy receives HTTP request - Perform caching - If X-FROM-SSL, forward to localhost:8088 - Else forward to HTTP server It is at this point that two design options come into play, both using stunnel. Either use SNI or use stunnel and HTTP. Via SNI, this would appear as follows: Stunnel receives HTTP request - Forward to https://http-server:443/ with SNI This of course requires that stunnel can read the 'Host' header out of an HTTP request and use that for SNI automatically (there's some 300 virtual hosts on that server). If not, this is infeasible. Which is my question, of course: can this be done? If this isn't an option, then the next logical way to handle this problem is: Stunnel receives HTTP request: - SSL encrypt - Forward to http-server:8443 http-server receives HTTP over stunnel - stunnel receives on http-server:8443 - Decrypt and forward to http://localhost:80/ In this way the entire connection would be encrypted, and the HTTP server would see the Host: header and use that to figure out the virtual host etc. Is that the better/only way?

1 0

more than 1000 concurrent connections?
by Trenton Ashburn 03 Jul '12

03 Jul '12

Hi There - I'd like to use stunnel as the SSL termination point for a bunch of persistent TCP connections. I'm running it on an EC2 instance and it's only allowing me about 1000 concurrent connections. It doesn't matter if the connections come from one client IP or two. How can I raise this limit? I've already raised the OS tcp connection limit with ulimit and it doesn't improve things. Thanks, T

4 5

Re: [stunnel-users] Interoperability problems with .net client software
by josealf＠rocketmail.com 30 Jun '12

30 Jun '12

Not as far as I know. You need to check with the client application developers. Maybe they can use a debugger to trace the program flow and see where and why it fails (assuming they understand the protocols and the tools). The application must be coded to present the certificate, and my guess (just a guess), is that it isn't or is blocking before getting to that point. -----Original Message----- From: ProPharma Systems AG - Gregor Bürgisser <g.buergisser(a)propharma.ch> Date: Fri, 29 Jun 2012 06:59:14 To: <josealf(a)rocketmail.com> Subject: Re: [stunnel-users] Interoperability problems with .net client software Yes I did. Also the CA used to sign the server cert. All to no avail. Do you know if there are any (known) interoperability issues between stunnel and .net applications? On 06/28/2012 02:05 PM, josealf(a)rocketmail.com wrote: > Looks like your client is not presenting the certificate to the stunnel server. Maybe because it does not trust the server certificate? Did you import your stunnel server cert into windows certificate store? > > > -----Original Message----- > From: ProPharma Systems AG - Gregor Bürgisser > <g.buergisser(a)propharma.ch> > Sender: stunnel-users-bounces(a)stunnel.org > Date: Thu, 28 Jun 2012 12:48:53 > To:<stunnel-users(a)stunnel.org> > Subject: [stunnel-users] Interoperability problems with .net client software > > Hi all, > > I'm using stunnel 4.53 under Linux to secure a service. There are two > different clients connecting to this service: My own client, also Linux > based and using libcurl and another (third party!) client being > developed using Microsoft .net stuff. > > Of course with my own client all works well. But we are not able to get > the Microsoft client running. stunnel keeps on telling: > > SSL_accept: 140890C7: error:140890C7:SSL > routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate > > We have tried diffierent things... I will outline them here if you think > it is helpful (in short: tried using certificates generated on the > Microsoft side, then tried using certificates created on the Linux side). > If "verify" ist set to 0 or 1 it works (of course) but with a higher > value the above message is logged. > > Are there any known pitfalls, problems or whatsoever when using stunnel > with a .net client? > Any advice would be appreciated! > > Regards, > Gregor > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0