stunnel-users

3306 discussions

Using Stunnel client but not Stunnel server with Apache mod_ssl
by Lilienberg, Daniel () 27 Apr '12

27 Apr '12

Hi, My supplier is using a somewhat strange setup looking like this: CLIENT: Stunnel running in client mode accepting incoming requests on port 8080. It will forward it to port to a server, port 443. SERVER: NOT running Stunnel at all, but running Apache with mod_ssl. It also acts as a proxy server, proxying all requests. Can this work, if so, how do I set it up ? [http://www.volvocars.net/support/IT/Services/IT_workplace/Email/outlook/sig…] Daniel Lilienberg Architect Connectivity Foundation Volvo Car Corporation Dept. 61630/PV2A Göteborg Sweden Telephone +46-31-3542317 dlilien2(a)volvocars.com<mailto:[email protected]> www.volvocars.com<http://www.volvocars.com/> Registered Office Göteborg, Sweden Registration No. 556074-3089

1 0

Windows 7 64-Bit
by Thomas Eifert 23 Apr '12

23 Apr '12

Has anyone attempted to install and run Stunnel on Windows 7 64-bit? If so, which version did you use, and were any issues experienced? Regards. Thomas -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

1 0

Possible error in stunnel 4.20
by Andreea Ion 20 Apr '12

20 Apr '12

Hi, I am running stunnel 4.2 on windows and I get the following log. I don't know if it's ok, if the problem is at the stunnel lovel or at the application level. SSL state (connect): before/connect initialization 2012.04.20 11:46:09 LOG7[5684:4492]: SSL state (connect): SSLv3 write client hello A 2012.04.20 11:46:09 LOG7[5684:4492]: SSL state (connect): SSLv3 read server hello A 2012.04.20 11:46:09 LOG7[5684:4492]: SSL state (connect): SSLv3 read finished A 2012.04.20 11:46:09 LOG7[5684:4492]: SSL state (connect): SSLv3 write change cipher spec A 2012.04.20 11:46:09 LOG7[5684:4492]: SSL state (connect): SSLv3 write finished A 2012.04.20 11:46:09 LOG7[5684:4492]: SSL state (connect): SSLv3 flush data 2012.04.20 11:46:09 LOG7[5684:4492]: 2 items in the session cache 2012.04.20 11:46:09 LOG7[5684:4492]: 5 client connects (SSL_connect()) 2012.04.20 11:46:09 LOG7[5684:4492]: 5 client connects that finished 2012.04.20 11:46:09 LOG7[5684:4492]: 0 client renegotiations requested 2012.04.20 11:46:09 LOG7[5684:4492]: 0 server connects (SSL_accept()) 2012.04.20 11:46:09 LOG7[5684:4492]: 0 server connects that finished 2012.04.20 11:46:09 LOG7[5684:4492]: 0 server renegotiations requested 2012.04.20 11:46:09 LOG7[5684:4492]: 3 session cache hits 2012.04.20 11:46:09 LOG7[5684:4492]: 0 session cache misses 2012.04.20 11:46:09 LOG7[5684:4492]: 0 session cache timeouts 2012.04.20 11:46:09 LOG6[5684:4492]: SSL connected: previous session reused 2012.04.20 11:46:54 LOG3[5684:4492]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2012.04.20 11:46:54 LOG5[5684:4492]: Connection reset: 154 bytes sent to SSL, 0 bytes sent to socket 2012.04.20 11:46:54 LOG7[5684:4492]: Session finished (0 left) The last 3 lines are those that interests me most. Is this ok ? Regards, Andreea

1 0

(no subject)
by Guylhem 18 Apr '12

18 Apr '12

Hello With verify=3 and the certs loaded in the conf file with CAfile=startssl-chain.pem cert=mycert.pem, I get : CERT: Certificate not found in local repository Using the latest stunnel recompiled on a debian squeeze, the best I can get is: error queue: 140B0009: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib SSL_CTX_use_PrivateKey_file: 906D06C: error:0906D06C:PEM routines:PEM_read_bio:no start line However, if I put these very same pem files in a directory as a CApath option instead (c_rehash applied) everything works fine. But The pem files are identical ! I've read http://stunnel.mirt.net/pipermail/stunnel-users/2010-November/002854.html but it seems a bit different The startssl-chain.pem was created with: wget http://www.startssl.com/certs/ca.pem wget http://www.startssl.com/certs/startssl.ca.pem cat sub.class1.server.ca.pem ca.pem > startssl-chain.pem I guess that may be the cause of the problem? What should I do to pass these pem files as stunnel.conf options instead of using the CApath? Guylhem

1 0

(no subject)
by Marco Tulio Jimenez Abrego 18 Apr '12

18 Apr '12

Buenos días El mensaje de error es: Error resolving 'smtp.gmail.com': Neither nodename nor servname known (EAI_NONAME). Gracias por su atención. -- Saludos. Att. Marco T. Jiménez ================ Tel. 6619-6782

3 2

Stunnel compiled with openssl 1.0.1 local binaries are 0.9.8k
by Michael Curran 11 Apr '12

11 Apr '12

Are there any potential known issues with stunnel being compiled using openssl 1.0.1 build and leaving the local system binaries at 0.9.8k Do you know of any way to test this for any incompatibilities? This was not my design, Im just being asked to support it and Im looking to make sure this method is not going to cause anything unusual.

2 1

PPID of child process
by Philip Wong 11 Apr '12

11 Apr '12

Hi, I’m trying to setup stunnel listening to multiple ports. The PPID of processes created are always root. Can we change that to the right PPID? Here I can see all the processes by killing 10764 and I expect this is the PPID. But all the children PPID are still 1; UID PID PPID C STIME TTY TIME CMD philwong 10759 1 0 16:27 pts/78 00:00:00 stunnel self.conf philwong 10760 1 0 16:27 pts/78 00:00:00 stunnel self.conf philwong 10761 1 0 16:27 pts/78 00:00:00 stunnel self.conf philwong 10762 1 0 16:27 pts/78 00:00:00 stunnel self.conf philwong 10763 1 0 16:27 pts/78 00:00:00 stunnel self.conf philwong 10764 1 0 16:27 ? 00:00:00 stunnel self.conf Regards, Philip

3 6

the connection had to be retried using SSL 3.0. This typically means that the server is using very old software and may have other security issues :(
by Thomas Manson 10 Apr '12

10 Apr '12

Hi, while I'm trying to get stunnel working for more than a few hours, I've also notice this warning in google chrome : the connection had to be retried using SSL 3.0. This typically means that > the server is using very old software and may have other security issues. [image: Inline image 1] gmail for example has AES_128_CBC for crypting, can we get that without much effort? What should be set to get rid of this warning ? I thought SSL v3 was the best (quickly pick acrross several example on the net) what is the best setting for this ? Thanks for your help, Thomas. My config : debug = 7 output = /var/log/stunnel4/extranet.service.com_stunnel.log setuid = stunnel4 setgid = stunnel4 pid = /var/run/stunnel4/extranet.service.com.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [extranet.service.com] key = /etc/stunnel/sites/extranet.service.com/extranet.service.com.key cert = /etc/stunnel/sites/extranet.service.com/extranet.service.com.crt accept = 8.90.17.4:443 connect = 127.0.0.1:82 sslVersion = SSLv3 TIMEOUTclose = 0

3 4

[Stunnel Guru needed] stunnel running, but no longer serve connection after a while ("Dispatching signals from the signal pipe" in logs ==> all stops)
by Thomas Manson 09 Apr '12

09 Apr '12

Hi All, I'm really struggling to make stunnel working for more than a few hours. (and the client is yelling hard...) (I solved some other issue : logging per website and making more than one stunnel works) To put it in a nutshell : - stunnel is running and working correctly (I can reach the website in https correctly) - after some hours I get the following situation : - stunnel is still running on linux - trying to connect to a website result in the connection taking very long time and then fails : "*The connection to * extranet.serviceplus-hse.com <http://extranet.website.com>* was interrupted. Error 101 (net::ERR_CONNECTION_RESET): The connection was reset.*" (Chrome) Same symptoms on IE9, Firefox & Lynx (on the server that runs stunnel) (see logs below) - The following logs are the last one seen in the log file : - 2012.04.03 23:33:28 LOG5[24792:140152610346752]: Service extranet.serviceplus-hse.com connected remote server from 127.0.0.1:36256 - 2012.04.03 23:33:28 LOG7[24792:140152610346752]: Remote FD=1 initialized - 2012.04.03 23:33:28 LOG7[24792:140152610346752]: Option TCP_NODELAY set on remote socket - 2012.04.03 23:33:41 LOG7[24792:140152610346752]: Socket closed on read - 2012.04.03 23:33:41 LOG7[24792:140152610346752]: Sending SSL write shutdown - 2012.04.03 23:33:41 LOG7[24792:140152610346752]: SSL alert (write): warning: close notify - 2012.04.03 23:33:41 LOG6[24792:140152610346752]: SSL_shutdown successfully sent close_notify - 2012.04.03 23:33:41 LOG3[24792:140152610346752]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing - 2012.04.03 23:33:41 LOG5[24792:140152610346752]: Connection closed: 186584 bytes sent to SSL, 3275 bytes sent to socket - 2012.04.03 23:33:41 LOG7[24792:140152610346752]: Service extranet.serviceplus-hse.com finished (0 left) - 2012.04.04 06:25:04 LOG7[24792:140152610629408]: *Dispatching signals from the signal pipe * stopping the firewall & fail2ban do not change anything. (the last line is logged by this function : *static void signal_pipe_empty(void) ) * the base stunnel.log has the same ending : - 2012.04.03 21:10:42 LOG7[24778:139641780209408]: Service https-123monsite.com permitted by libwrap from 212.162.10.34:3244 - 2012.04.03 21:10:42 LOG5[24778:139641780209408]: Service https-123monsite.com accepted connection from 212.162.10.34:3244 - 2012.04.03 21:10:42 LOG7[24778:139641780209408]: SSL state (accept): before/accept initialization - 2012.04.03 21:10:42 LOG3[24778:139641780209408]: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number - 2012.04.03 21:10:42 LOG5[24778:139641780209408]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket - 2012.04.03 21:10:42 LOG7[24778:139641780209408]: Service https-123monsite.com finished (0 left) - 2012.04.04 06:25:04 LOG7[24778:139641780213536]: Dispatching signals from the signal pipe - and at the same time (2012.04.04 06:25:04) all logs file stops : - root@ns0:/var/log/stunnel4# ll - total 128 - drwxr-xr-x 2 stunnel4 stunnel4 4096 2012-04-04 12:10 . - drwxr-xr-x 14 root root 4096 2012-04-04 06:25 .. - -rw-r----- 1 stunnel4 stunnel4 98084 2012-04-04 *06:25*extranet.serviceplus-hse.com_stunnel.log - -rw-r----- 1 stunnel4 stunnel4 4491 2012-04-04 06:25 mansonthomas.com_stunnel.log - -rw-r----- 1 stunnel4 stunnel4 0 2012-04-04 06:25 stunnel.log - -rw-r----- 1 stunnel4 stunnel4 11058 2012-04-04 06:25 stunnel.log.1 - I've seen some message about the same behavior but after an upgrade on freebsd and didn't find any solution... - Restarting stunnel restore the service immediately. below some information about my configuration... ask for more if needed. Thanks for any helps, Regards, Thomas. Distribution & Pachage info (x64 system) ###################################################################### root@ns0:/var/log/stunnel4# cat /etc/lsb-release DISTRIB_ID=Ubuntu DISTRIB_RELEASE=11.10 DISTRIB_CODENAME=oneiric DISTRIB_DESCRIPTION="Ubuntu 11.10" root@ns0:/var/log/stunnel4# aptitude show stunnel4 Package: stunnel4 New: yes State: installed Automatically installed: no Version: 3:*4.35-2build1* ###################################################################### lynx try : ###################################################################### root@ns0:/var/log/stunnel4# lynx https://extranet.serviceplus-hse.com Looking up extranet.serviceplus-hse.com Making HTTPS connection to extranet.serviceplus-hse.com Retrying connection without TLS. Looking up extranet.serviceplus-hse.com Making HTTPS connection to extranet.serviceplus-hse.com Alert!: Unable to make secure connection to remote host. lynx: Can't access startfile https://extranet.serviceplus-hse.com/ ###################################################################### ps -edf : ###################################################################### 1 24773 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/base.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ 1 24774 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/base.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ 1 24775 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/base.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ 1 24776 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/base.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ 1 24777 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/base.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ 1 24778 24778 24778 ? -1 Ss 109 0:00 /usr/bin/stunnel4 /etc/stunnel/base.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ 1 24787 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/extranet.serviceplus-hse.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 P 1 24788 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/extranet.serviceplus-hse.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 P 1 24789 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/extranet.serviceplus-hse.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 P 1 24790 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/extranet.serviceplus-hse.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 P 1 24791 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/extranet.serviceplus-hse.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 P 1 24792 24792 24792 ? -1 Ss 109 0:00 /usr/bin/stunnel4 /etc/stunnel/extranet.serviceplus-hse.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 P 1 24801 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/mansonthomas.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ 1 24802 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/mansonthomas.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ 1 24803 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/mansonthomas.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ 1 24804 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/mansonthomas.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ 1 24805 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/mansonthomas.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ 1 24806 24806 24806 ? -1 Ss 109 0:00 /usr/bin/stunnel4 /etc/stunnel/mansonthomas.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ ###################################################################### /etc/stunnel/base.conf ###################################################################### debug = 7 sslVersion = SSLv3 cert=/etc/stunnel/sites/123monsite.com/123monsite.com.crt key=/etc/stunnel/sites/123monsite.com/123monsite.com.key ; security enhancements for UNIX systems ; for chroot a copy of some devices and files is needed within the jail ;chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside the chroot jail pid = /var/run/stunnel4/stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 output = /var/log/stunnel4/stunnel.log [https-123monsite.com] accept=88.190.17.222:443 connect=127.0.0.1:82 ###################################################################### /etc/stunnel/extranet.serviceplus-hse.com.conf ###################################################################### debug = 7 output = /var/log/stunnel4/extranet.serviceplus-hse.com_stunnel.log setuid = stunnel4 setgid = stunnel4 pid = /var/run/stunnel4/extranet.serviceplus-hse.com.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [extranet.serviceplus-hse.com] key = /etc/stunnel/sites/ extranet.serviceplus-hse.com/extranet.serviceplus-hse.com.key cert = /etc/stunnel/sites/ extranet.serviceplus-hse.com/extranet.serviceplus-hse.com.crt accept = 88.190.217.54:443 connect = 127.0.0.1:82 sslVersion = SSLv3 TIMEOUTclose = 0 ###################################################################### Last logs : /var/log/stunnel4/extranet.serviceplus-hse.com_stunnel.log ###################################################################### 2012.04.03 23:02:47 LOG6[24792:140152610346752]: SSL accepted: previous session reused 2012.04.03 23:02:47 LOG7[24792:140152610346752]: remote socket: FD=1 allocated (non-blocking mode) 2012.04.03 23:02:47 LOG6[24792:140152610346752]: connect_blocking: connecting 127.0.0.1:82 2012.04.03 23:02:47 LOG7[24792:140152610346752]: connect_blocking: s_poll_wait 127.0.0.1:82: waiting 10 seconds 2012.04.03 23:02:47 LOG5[24792:140152610346752]: connect_blocking: connected 127.0.0.1:82 2012.04.03 23:02:47 LOG5[24792:140152610346752]: Service extranet.serviceplus-hse.com connected remote server from 127.0.0.1:60624 2012.04.03 23:02:47 LOG7[24792:140152610346752]: Remote FD=1 initialized 2012.04.03 23:02:47 LOG7[24792:140152610346752]: Option TCP_NODELAY set on remote socket 2012.04.03 23:02:58 LOG7[24792:140152610346752]: Socket closed on read 2012.04.03 23:02:58 LOG7[24792:140152610346752]: Sending SSL write shutdown 2012.04.03 23:02:58 LOG7[24792:140152610346752]: SSL alert (write): warning: close notify 2012.04.03 23:02:58 LOG6[24792:140152610346752]: SSL_shutdown successfully sent close_notify 2012.04.03 23:02:58 LOG3[24792:140152610346752]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2012.04.03 23:02:58 LOG5[24792:140152610346752]: Connection closed: 167313 bytes sent to SSL, 1871 bytes sent to socket 2012.04.03 23:02:58 LOG7[24792:140152610346752]: Service extranet.serviceplus-hse.com finished (0 left) 2012.04.03 23:33:20 LOG7[24792:140152610629408]: local socket: FD=0 allocated (non-blocking mode) 2012.04.03 23:33:20 LOG7[24792:140152610629408]: Service extranet.serviceplus-hse.com accepted FD=0 from 82.224.128.241:52114 2012.04.03 23:33:20 LOG7[24792:140152610346752]: Service extranet.serviceplus-hse.com started 2012.04.03 23:33:20 LOG7[24792:140152610346752]: Option TCP_NODELAY set on local socket 2012.04.03 23:33:20 LOG7[24792:140152610346752]: Waiting for a libwrap process 2012.04.03 23:33:20 LOG7[24792:140152610346752]: Acquired libwrap process #0 2012.04.03 23:33:20 LOG7[24792:140152610346752]: Releasing libwrap process #0 2012.04.03 23:33:20 LOG7[24792:140152610346752]: Released libwrap process #0 2012.04.03 23:33:20 LOG7[24792:140152610346752]: Service extranet.serviceplus-hse.com permitted by libwrap from 82.224.128.241:52114 2012.04.03 23:33:20 LOG5[24792:140152610346752]: Service extranet.serviceplus-hse.com accepted connection from 82.224.128.241:52114 2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): before/accept initialization 2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 read client hello B 2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 write server hello A 2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 write certificate A 2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 write key exchange A 2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 write server done A 2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 flush data 2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 read client key exchange A 2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 read finished A 2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 write change cipher spec A 2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 write finished A 2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 flush data 2012.04.03 23:33:20 LOG7[24792:140152610346752]: 7 items in the session cache 2012.04.03 23:33:20 LOG7[24792:140152610346752]: 0 client connects (SSL_connect()) 2012.04.03 23:33:20 LOG7[24792:140152610346752]: 0 client connects that finished 2012.04.03 23:33:20 LOG7[24792:140152610346752]: 0 client renegotiations requested 2012.04.03 23:33:20 LOG7[24792:140152610346752]: 21 server connects (SSL_accept()) 2012.04.03 23:33:20 LOG7[24792:140152610346752]: 20 server connects that finished 2012.04.03 23:33:20 LOG7[24792:140152610346752]: 0 server renegotiations requested 2012.04.03 23:33:20 LOG7[24792:140152610346752]: 9 session cache hits 2012.04.03 23:33:20 LOG7[24792:140152610346752]: 0 external session cache hits 2012.04.03 23:33:20 LOG7[24792:140152610346752]: 7 session cache misses 2012.04.03 23:33:20 LOG7[24792:140152610346752]: 4 session cache timeouts 2012.04.03 23:33:20 LOG6[24792:140152610346752]: SSL accepted: new session negotiated 2012.04.03 23:33:20 LOG6[24792:140152610346752]: Negotiated ciphers: DHE-RSA-CAMELLIA256-SHA SSLv3 Kx=DH Au=RSA Enc=Camellia(256) Mac=SHA1 2012.04.03 23:33:20 LOG7[24792:140152610346752]: remote socket: FD=1 allocated (non-blocking mode) 2012.04.03 23:33:20 LOG6[24792:140152610346752]: connect_blocking: connecting 127.0.0.1:82 2012.04.03 23:33:20 LOG7[24792:140152610346752]: connect_blocking: s_poll_wait 127.0.0.1:82: waiting 10 seconds 2012.04.03 23:33:20 LOG5[24792:140152610346752]: connect_blocking: connected 127.0.0.1:82 2012.04.03 23:33:20 LOG5[24792:140152610346752]: Service extranet.serviceplus-hse.com connected remote server from 127.0.0.1:36240 2012.04.03 23:33:20 LOG7[24792:140152610346752]: Remote FD=1 initialized 2012.04.03 23:33:20 LOG7[24792:140152610346752]: Option TCP_NODELAY set on remote socket 2012.04.03 23:33:27 LOG7[24792:140152610346752]: Socket closed on read 2012.04.03 23:33:27 LOG7[24792:140152610346752]: Sending SSL write shutdown 2012.04.03 23:33:27 LOG7[24792:140152610346752]: SSL alert (write): warning: close notify 2012.04.03 23:33:27 LOG6[24792:140152610346752]: SSL_shutdown successfully sent close_notify 2012.04.03 23:33:27 LOG3[24792:140152610346752]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2012.04.03 23:33:27 LOG5[24792:140152610346752]: Connection closed: 537 bytes sent to SSL, 620 bytes sent to socket 2012.04.03 23:33:27 LOG7[24792:140152610346752]: Service extranet.serviceplus-hse.com finished (0 left) 2012.04.03 23:33:27 LOG7[24792:140152610629408]: local socket: FD=0 allocated (non-blocking mode) 2012.04.03 23:33:27 LOG7[24792:140152610629408]: Service extranet.serviceplus-hse.com accepted FD=0 from 82.224.128.241:52123 2012.04.03 23:33:27 LOG7[24792:140152610346752]: Service extranet.serviceplus-hse.com started 2012.04.03 23:33:27 LOG7[24792:140152610346752]: Option TCP_NODELAY set on local socket 2012.04.03 23:33:27 LOG7[24792:140152610346752]: Waiting for a libwrap process 2012.04.03 23:33:27 LOG7[24792:140152610346752]: Acquired libwrap process #0 2012.04.03 23:33:27 LOG7[24792:140152610346752]: Releasing libwrap process #0 2012.04.03 23:33:27 LOG7[24792:140152610346752]: Released libwrap process #0 2012.04.03 23:33:27 LOG7[24792:140152610346752]: Service extranet.serviceplus-hse.com permitted by libwrap from 82.224.128.241:52123 2012.04.03 23:33:27 LOG5[24792:140152610346752]: Service extranet.serviceplus-hse.com accepted connection from 82.224.128.241:52123 2012.04.03 23:33:27 LOG7[24792:140152610346752]: SSL state (accept): before/accept initialization 2012.04.03 23:33:27 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 read client hello B 2012.04.03 23:33:27 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 write server hello A 2012.04.03 23:33:27 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 write change cipher spec A 2012.04.03 23:33:27 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 write finished A 2012.04.03 23:33:27 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 flush data 2012.04.03 23:33:28 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 read finished A 2012.04.03 23:33:28 LOG7[24792:140152610346752]: 7 items in the session cache 2012.04.03 23:33:28 LOG7[24792:140152610346752]: 0 client connects (SSL_connect()) 2012.04.03 23:33:28 LOG7[24792:140152610346752]: 0 client connects that finished 2012.04.03 23:33:28 LOG7[24792:140152610346752]: 0 client renegotiations requested 2012.04.03 23:33:28 LOG7[24792:140152610346752]: 22 server connects (SSL_accept()) 2012.04.03 23:33:28 LOG7[24792:140152610346752]: 21 server connects that finished 2012.04.03 23:33:28 LOG7[24792:140152610346752]: 0 server renegotiations requested 2012.04.03 23:33:28 LOG7[24792:140152610346752]: 10 session cache hits 2012.04.03 23:33:28 LOG7[24792:140152610346752]: 0 external session cache hits 2012.04.03 23:33:28 LOG7[24792:140152610346752]: 7 session cache misses 2012.04.03 23:33:28 LOG7[24792:140152610346752]: 4 session cache timeouts 2012.04.03 23:33:28 LOG6[24792:140152610346752]: SSL accepted: previous session reused 2012.04.03 23:33:28 LOG7[24792:140152610346752]: remote socket: FD=1 allocated (non-blocking mode) 2012.04.03 23:33:28 LOG6[24792:140152610346752]: connect_blocking: connecting 127.0.0.1:82 2012.04.03 23:33:28 LOG7[24792:140152610346752]: connect_blocking: s_poll_wait 127.0.0.1:82: waiting 10 seconds 2012.04.03 23:33:28 LOG5[24792:140152610346752]: connect_blocking: connected 127.0.0.1:82 2012.04.03 23:33:28 LOG5[24792:140152610346752]: Service extranet.serviceplus-hse.com connected remote server from 127.0.0.1:36256 2012.04.03 23:33:28 LOG7[24792:140152610346752]: Remote FD=1 initialized 2012.04.03 23:33:28 LOG7[24792:140152610346752]: Option TCP_NODELAY set on remote socket 2012.04.03 23:33:41 LOG7[24792:140152610346752]: Socket closed on read 2012.04.03 23:33:41 LOG7[24792:140152610346752]: Sending SSL write shutdown 2012.04.03 23:33:41 LOG7[24792:140152610346752]: SSL alert (write): warning: close notify 2012.04.03 23:33:41 LOG6[24792:140152610346752]: SSL_shutdown successfully sent close_notify 2012.04.03 23:33:41 LOG3[24792:140152610346752]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2012.04.03 23:33:41 LOG5[24792:140152610346752]: Connection closed: 186584 bytes sent to SSL, 3275 bytes sent to socket 2012.04.03 23:33:41 LOG7[24792:140152610346752]: Service extranet.serviceplus-hse.com finished (0 left) 2012.04.04 06:25:04 LOG7[24792:140152610629408]: Dispatching signals from the signal pipe ######################################################################

2 6

Ubuntu version of stunnel : multiple process shown by a ps -edf, compiled from sources : one process
by Thomas Manson 08 Apr '12

08 Apr '12

Hi, To get around a bug of stunnel present in the package of Ubuntu 11.10 (that has been corrected in v4.38), I've compiled from sources (v4.53). It went well, but I did notice a change in the processes : from compiled sources, I can see only on process per conf file ###################################################################### 1 21402 21402 21402 ? -1 Ss 109 0:00 /usr/local/bin/stunnel4 /etc/stunnel/base.conf 1 21411 21411 21411 ? -1 Ss 109 0:00 /usr/local/bin/stunnel4 /etc/stunnel/extranet.serviceplus-hse.com.conf 1 21420 21420 21420 ? -1 Ss 109 0:00 /usr/local/bin/stunnel4 /etc/stunnel/mansonthomas.com.conf ###################################################################### while on the ubuntu version, I've multiple process per conf file. ps -edf from ubuntu distrib ###################################################################### 1 24773 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/base.conf 1 24774 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/base.conf 1 24775 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/base.conf 1 24776 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/base.conf 1 24777 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/base.conf 1 24778 24778 24778 ? -1 Ss 109 0:00 /usr/bin/stunnel4 /etc/stunnel/base.conf 1 24787 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/extranet.serviceplus-hse.com.conf 1 24788 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/extranet.serviceplus-hse.com.conf 1 24789 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/extranet.serviceplus-hse.com.conf 1 24790 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/extranet.serviceplus-hse.com.conf 1 24791 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/extranet.serviceplus-hse.com.conf 1 24792 24792 24792 ? -1 Ss 109 0:00 /usr/bin/stunnel4 /etc/stunnel/extranet.serviceplus-hse.com.conf 1 24801 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/mansonthomas.com.conf 1 24802 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/mansonthomas.com.conf 1 24803 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/mansonthomas.com.conf 1 24804 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/mansonthomas.com.conf 1 24805 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/mansonthomas.com.conf 1 24806 24806 24806 ? -1 Ss 109 0:00 /usr/bin/stunnel4 /etc/stunnel/mansonthomas.com.conf ###################################################################### I'm using the exact same version of conf file for both setup... any idea why this change ? is one better than another ? Regards, Thomas.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users