- stunnel-users - stunnel.org

Difference between verify level 2 and 3
by Sandeep Kumar 15 Jul '08

15 Jul '08

Hi, I searched a lot on google, in the archives, and in the FAQ page, but could not find the differences between verify levels 2 and 3, other than the one line explanation given on the FAQ/man page. Specifically, I want to ask: 1. Is verify level 3 same as 2, but asks for client certificates as well? (Seems unlikely but still..) 2. Since verify level 2 also demands CApath/CAfile to be present, then it also is ultimately verifying against locally installed certs, which is supposed to be level 3's behaviour? Thanks & regards, Sandeep Kumar http://web.iiit.ac.in/~sandeep_kr

2 2

stunnel-portforwarding
by vinod bhasi 15 Jul '08

15 Jul '08

Hi All, I am a newbie as far as stunnel is concerned. I need help urgently on how to do port forwarding with Stunnel. Any help is appreciated. Thanks and Regards, Vinod Bhasi Save all your chat conversations. Find them online at http://in.messenger.yahoo.com/webmessengerpromo.php

1 0

SSL with SMTP problem - sTunnel 4.25 Windows
by dscycler 14 Jul '08

14 Jul '08

I am using sTunnel 4.25 for Windows to send and receive e-mail from a GoldMine client. sTunnel has worked well over the years but am having an issue with a particular mail host, Live Office. They have implemented SMTP SSL on port 25. The debug log is as follows: 2008.07.14 13:45:11 LOG7[2136:5356]: smtp accepted FD=224 from 127.0.0.1:1907 2008.07.14 13:45:11 LOG7[2136:5356]: Creating a new thread 2008.07.14 13:45:11 LOG7[2136:5356]: New thread created 2008.07.14 13:45:11 LOG7[2136:4944]: smtp started 2008.07.14 13:45:11 LOG7[2136:4944]: FD 224 in non-blocking mode 2008.07.14 13:45:11 LOG5[2136:4944]: smtp accepted connection from 127.0.0.1:1907 2008.07.14 13:45:11 LOG7[2136:4944]: FD 232 in non-blocking mode 2008.07.14 13:45:11 LOG7[2136:4944]: smtp connecting 64.70.94.196:25 2008.07.14 13:45:11 LOG7[2136:4944]: connect_wait: waiting 10 seconds 2008.07.14 13:45:11 LOG7[2136:4944]: connect_wait: connected 2008.07.14 13:45:11 LOG5[2136:4944]: smtp connected remote server from 127.0.0.1:1908 2008.07.14 13:45:11 LOG7[2136:4944]: Remote FD=232 initialized 2008.07.14 13:45:11 LOG7[2136:4944]: SSL state (connect): before/connect initialization 2008.07.14 13:45:11 LOG7[2136:4944]: SSL state (connect): SSLv3 write client hello A 2008.07.14 13:45:11 LOG7[2136:4944]: SSL alert (write): fatal: handshake failure 2008.07.14 13:45:11 LOG3[2136:4944]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2008.07.14 13:45:11 LOG5[2136:4944]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.07.14 13:45:11 LOG7[2136:4944]: smtp finished (0 left) I am looking for help to troubleshoot the connection problem. Is this an sTunnel issue or a mail server issue? Are there conf file settings to address the issue? Thanks, DavidS

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 48, Issue 8
by Pietro Di Primo 10 Jul '08

10 Jul '08

Thank you for reply. I tryied it but it doesn't work because my client run some separated subprocesses and are them that contact the server so, if an extern process try to connect to 127.0.0.1:<the_found_port> while one of that subprocess has finished and the next is not yet started, it will be able to do it and also my subprocess will be pending (i tryed it). Hope i was able to explain the situation. Any suggestion? Thanks in advace > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 9 Jul 2008 13:26:03 +0200 (CEST) > From: "Pietro Di Primo" <pietro.diprimo(a)ct.infn.it> > Subject: [stunnel-users] client-server tunnelling > To: stunnel-users(a)mirt.net > Message-ID: > <2553.193.206.208.201.1215602763.squirrel(a)imapfis.ct.infn.it> > Content-Type: text/plain;charset=utf-8 > > Hi, I have a client server application, and want to tunnel it in this way: > a script select a free port in a random way, write the stunnel.conf file. > with "accept=<the_found_port>" and "connect=<my_server>" and run my client > application passing to 127.0.0.1:<the_found_port> as server address. > The problem is that i need to be sure that no other client or user can > access <the_found_port> while the application is running. > I guess that it should be possible to do it, but i wasn't able to. > > Can anybody help me? > > Thanks > > > -- > --- > > Ing. Pietro Di Primo > INFN - Istituto Nazionale di Fisica Nucleare > Grid Computing Research Area > Via S. Sofia 78 95123 CATANIA (Italy) > Voice : +39 095 378-5446/5517 > Fax. : +39 095 378 5518 > Mobile : +39 320 8591527 > E-mail : pietro.diprimo(a)ct.infn.it > Skype : pietrodiprimo > > > > ------------------------------ > > Message: 2 > Date: Wed, 9 Jul 2008 14:08:23 +0200 > From: Micha? Trojnara <Michal.Trojnara(a)mobi-com.net> > Subject: Re: [stunnel-users] client-server tunnelling > To: stunnel-users(a)mirt.net > Message-ID: <6ba9f1b703149916bb1a61fb68a1e377(a)mirt.net> > Content-Type: text/plain; charset="UTF-8" > > > Pietro Di Primo wrote: >> Hi, I have a client server application, and want to tunnel it in this > way: >> a script select a free port in a random way, write the stunnel.conf >> file. >> with "accept=<the_found_port>" and "connect=<my_server>" and run my > client >> application passing to 127.0.0.1:<the_found_port> as server address. >> The problem is that i need to be sure that no other client or user can >> access <the_found_port> while the application is running. >> I guess that it should be possible to do it, but i wasn't able to. > > Simply bind the specific network interface with: > accept=127.0.0.1:<the_found_port> > > Best regards, > Mike > > > > ------------------------------ > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > End of stunnel-users Digest, Vol 48, Issue 8 > ******************************************** > -- --- Ing. Pietro Di Primo INFN - Istituto Nazionale di Fisica Nucleare Grid Computing Research Area Via S. Sofia 78 95123 CATANIA (Italy) Voice : +39 095 378-5446/5517 Fax. : +39 095 378 5518 Mobile : +39 320 8591527 E-mail : pietro.diprimo(a)ct.infn.it Skype : pietrodiprimo

1 0

client-server tunnelling
by Pietro Di Primo 09 Jul '08

09 Jul '08

Hi, I have a client server application, and want to tunnel it in this way: a script select a free port in a random way, write the stunnel.conf file. with "accept=<the_found_port>" and "connect=<my_server>" and run my client application passing to 127.0.0.1:<the_found_port> as server address. The problem is that i need to be sure that no other client or user can access <the_found_port> while the application is running. I guess that it should be possible to do it, but i wasn't able to. Can anybody help me? Thanks -- --- Ing. Pietro Di Primo INFN - Istituto Nazionale di Fisica Nucleare Grid Computing Research Area Via S. Sofia 78 95123 CATANIA (Italy) Voice : +39 095 378-5446/5517 Fax. : +39 095 378 5518 Mobile : +39 320 8591527 E-mail : pietro.diprimo(a)ct.infn.it Skype : pietrodiprimo

1 0

FW: how to start ??
by dominique 07 Jul '08

07 Jul '08

Hello, First time I am using stunnel. 1. The issue I had is with Altiris and Exchange. All our Exchange Servers are SSL now and Altiris is not-SSL. Altiris is reading an exchange mailbox and gives back an error : "Error receiving data from socket". So the infrastructure is composed of two servers one Altiris Server not-SSL which is attempting to communicate to an Exchange Server with SSL. The Altiris Server is trying to read the email in one mailbox hosted by an Exchange SSL Server 2. Stunnel 4.25 x86-pc-mingw32-gnu with openssl 0.9.8h 28 May 2008 3. Windows 2003 Server environment 4. stunnel -d -r 5. 2008.07.07 13:34:41 LOG7[4748:1676]: RAND_status claims sufficient entropy for the PRNG 2008.07.07 13:34:41 LOG7[4748:1676]: PRNG seeded successfully 2008.07.07 13:34:41 LOG7[4748:1676]: Certificate: stunnel.pem 2008.07.07 13:34:41 LOG7[4748:1676]: Certificate loaded 2008.07.07 13:34:41 LOG7[4748:1676]: Key file: stunnel.pem 2008.07.07 13:34:41 LOG7[4748:1676]: Private key loaded 2008.07.07 13:34:41 LOG7[4748:1676]: SSL context initialized for service pop3 2008.07.07 13:34:41 LOG5[4748:1676]: stunnel 4.25 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2008.07.07 13:34:41 LOG5[4748:1676]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2008.07.07 13:34:41 LOG5[4748:3596]: No limit detected for the number of clients 2008.07.07 13:34:41 LOG7[4748:3596]: FD 284 in non-blocking mode 2008.07.07 13:34:41 LOG7[4748:3596]: SO_REUSEADDR option set on accept socket 2008.07.07 13:34:41 LOG3[4748:3596]: Error binding pop3 to 149.142.194.230:995 2008.07.07 13:34:41 LOG3[4748:3596]: bind: Can't assign requested address (WSAEADDRNOTAVAIL) (10049) 2008.07.07 13:34:41 LOG3[4748:3596]: Server is down 6. no file gcc. Thanks, Dominique Dominique_duchemin(a)hotmail.com

1 0

Using externally signed certificate with stunnel 4
by Tim Skirvin 07 Jul '08

07 Jul '08

I've got a comodo signed SSL certificate that I'm trying to use with stunnel4 to allow secure NNTP connections from a wide variety of clients. The certificate at least partially works; if I leave 'verify' off in the stunnel.conf file, then the service runs and users can connect, albeit while still having to verify the cert. But if I turn 'verify' on, then it doesn't work on *either* side. I've tried playing with CAfile and CApath without much luck. I'll attach my configuration files, the relevant pems, and some debugging information; is there something else I'm missing? I've already contacted comodo, and after several rounds of conversation they suggest I contact the list. Errors from the client side (note that I'm using a debug port here): + openssl s_client -connect news:565 -verify -debug verify depth is 0 CONNECTED(00000003) depth=2 /C=US/O=Entrust.net/OU=www.entrust.net/CPS incorp. by ref. (limits liab.)/OU=(c) 1999 Entrust.net Limited/CN=Entrust.net Secure Server Certification Authority verify error:num=19:self signed certificate in certificate chain verify return:0 6976:error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed:s3_clnt.c:951: ...and on the server, I get this: 2008.06.30 14:08:38 LOG7[10039:47679267941088]: nntps accepted FD=7 from 171.64.19.111:56122 2008.06.30 14:08:38 LOG7[10039:1073809760]: nntps started 2008.06.30 14:08:38 LOG7[10039:1073809760]: FD 7 in non-blocking mode 2008.06.30 14:08:38 LOG7[10039:1073809760]: FD 8 in non-blocking mode 2008.06.30 14:08:38 LOG7[10039:1073809760]: FD 9 in non-blocking mode 2008.06.30 14:08:38 LOG7[10039:47679267941088]: Cleaning up the signal pipe 2008.06.30 14:08:38 LOG6[10039:47679267941088]: Child process 10247 finished with code 0 2008.06.30 14:08:38 LOG7[10039:1073809760]: Connection from 171.64.19.111:56122 permitted by libwrap 2008.06.30 14:08:38 LOG5[10039:1073809760]: nntps connected from 171.64.19.111:56122 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): before/accept initialization 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): SSLv3 read client hello A 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): SSLv3 write server hello A 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): SSLv3 write certificate A 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): SSLv3 write certificate request A 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL state (accept): SSLv3 flush data 2008.06.30 14:08:38 LOG7[10039:1073809760]: SSL alert (read): fatal: unknown CA 2008.06.30 14:08:38 LOG3[10039:1073809760]: SSL_accept: 14094418: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca 2008.06.30 14:08:38 LOG5[10039:1073809760]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.06.30 14:08:38 LOG7[10039:1073809760]: nntps finished (0 left) Basic Requested Information that wasn't supplied above: * stunnel 4.18-2 on Debian etch (2.6.18-6-686 #1 SMP) * Running standalone with '/usr/bin/stunnel4 /etc/news/stunnel.conf' * libc6, no gcc, OpenSSL 0.9.8c-4etch3 * The log on startup: 2008.06.30 14:00:15 LOG7[26276:3083523776]: Snagged 64 random bytes from /root/.rnd 2008.06.30 14:00:15 LOG7[26276:3083523776]: Wrote 1024 new random bytes to /root/.rnd 2008.06.30 14:00:15 LOG7[26276:3083523776]: RAND_status claims sufficient entropy for the PRNG 2008.06.30 14:00:15 LOG7[26276:3083523776]: PRNG seeded successfully 2008.06.30 14:00:15 LOG7[26276:3083523776]: Configuration SSL options: 0x01000000 2008.06.30 14:00:15 LOG7[26276:3083523776]: SSL options set: 0x01000000 2008.06.30 14:00:15 LOG7[26276:3083523776]: Certificate: /etc/ssl/certs/news-stunnel.pem 2008.06.30 14:00:15 LOG7[26276:3083523776]: Certificate loaded 2008.06.30 14:00:15 LOG7[26276:3083523776]: Key file: /etc/ssl/private/news-stunnel.key 2008.06.30 14:00:15 LOG7[26276:3083523776]: Private key loaded 2008.06.30 14:00:15 LOG7[26276:3083523776]: Loaded verify certificates from /etc/ssl/certs/comodo.cert 2008.06.30 14:00:15 LOG7[26276:3083523776]: SSL context initialized for service nntps - Tim Skirvin (tskirvin(a)stanford.edu) -- Information Technology Services http://www.stanford.edu/~tskirvin/ System Software Developer, Unix Team Stanford University

1 1

Windows setup
by Koenraad Lelong 04 Jul '08

04 Jul '08

Hello, I would like to know if it is possible to run a silent setup of the Windows-setup of stunnel. I'm including it in my own setup of my own application so I would like to avoid the interaction of the stunnel-setup. Second question is if it is bad to "install" stunnel more than once on a computer. Until now I had a setup for new installations and an update for updates of my application. This seems not to work because some users use the setup to update an existing installation and with this they run the install of stunnel for the second time. If it is bad, how do I detect the existance of stunnel, and what version it is, so I could update stunnel if it's outdated. Regards, Koenraad Lelong. P.S. If this is the wrong list for such questions I apologize. I would like to know the right list.

1 0

Re: [stunnel-users] Stunnel 4.21 99% cpu ultilization
by Fat Wallet 03 Jul '08

03 Jul '08

Hi, If anyone have a clue on what I should do to fix this issue, I would really appreciated: One of the stunnel process is running at 99% and in R state and the time just keep incrementing. [root@root]# ps auxw|grep stunnel root 781 0.0 0.0 6520 2684 ? T 11:01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 2853 0.0 0.0 3940 604 ttyp2 S+ 11:37 0:00 grep stunnel root 16554 0.0 0.0 3992 788 ? S Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 16555 0.0 0.0 3992 788 ? S Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 16556 0.0 0.0 3992 788 ? S Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 16557 0.0 0.0 3992 788 ? S Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 16558 0.0 0.0 3992 788 ? S Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 16561 0.0 0.0 6520 2684 ? Ts Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 16656 0.0 0.0 6520 2684 ? S Jul01 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 23954 0.0 0.0 6520 2684 ? S 08:00 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 23955 99.0 0.0 6520 2684 ? R 08:00 189:52 /usr/sbin/stunnel /etc/stunnel/stunnel.conf root 31521 0.0 0.0 6520 2684 ? S 10:30 0:00 /usr/sbin/stunnel /etc/stunnel/stunnel.conf Thanks, Mike ----- Original Message ---- From: Aron Griffis <agriffis(a)n01se.net> To: Fat Wallet <fat8wallet(a)yahoo.com> Cc: stunnel-users(a)mirt.net Sent: Monday, June 30, 2008 11:04:44 AM Subject: Re: [stunnel-users] Stunnel 4.21 99% cpu ultilization Fat Wallet wrote: [Mon Jun 30 2008, 01:28:11PM EDT] > Can someone please help with this issue? This 100% cpu > utilization issue happens randomly on multiprocess cpu. strace, ltrace, build stunnel with debugging symbols and attach gdb to the spinning process, etc. Is your name really Fat Wallet?

2 1

protect the private key, while running stunnel in server mode as a windows service
by sandeep siroya 03 Jul '08

03 Jul '08

Hi, I have stunnel in server mode running as a windows service on a Win2003 Server system. I need to give this system to a different company for testing their client against our server. How do I protect my private key on stunnel, while letting the 3rd company being able to login as administrator on stunnel's win2003 system and start/stop stunnel service? I know one can protect the private key with a passphrase in stunnel, but that does not serve my purpose as stunnel in this case should be able to start/stop without any user-intervention and I cannot store the passphrase in cleartext. thanks , ss

1 0