- stunnel-users - stunnel.org

Stunnel <=> p2p
by mluft 05 May '08

05 May '08

Hi, i just started working with stunnel, and i'm really impressed! But i've got 2 questions: * How is it realized, that a setup like this: accept = 15000 connect = 16000 also encrypts the reply of the app which listens on port 16000? Is there a kind of masquerading? * I think of a tool like tsocks or socksify: "tsocks application" redirects all traffic from application over an socks proxy. Is it possible to realize such a redirection with stunnel? So that all outgoing traffic of an application gets encrypted? I know that i can build point-to-point tunnels, but that's not possible for my scenario... Thanks & Cheers, Matthias

1 0

Stunnel 4.23 xforwardfor patch
by Rene Plattner 05 May '08

05 May '08

Dear stunnel users! I noticed that the xforwardfor patch does not work any more on version > 4.20! This is due an function renaming in stunnel! After adding xforwardfor patch for version 4.20 see options.c: Simply replace log_raw(...); to s_log(LOG_RAW,...); chears, -- Dipl.-Ing. Rene' Plattner Zentraler Informatikdienst (ZID) Universität Innsbruck, Österreich Technikerstr. 13 A-6020 Innsbruck Tel: ++43512/507-2360 Fax: ++43512/507-2944

1 0

Can stunnel be configured to listen for multiple IP addresses and access different email hosts?
by F Boyd Crow 03 May '08

03 May '08

I have attempted to use stunnel to retrieve POP3 SSL mail from two different ISPs: pop.att.yahoo.com and pop.gmail.com. I have tried putting in separate Access/Connect line pairs under [pop3s] either point to the different ports on 127.0.0.1 whch is an Exchange Server 2003 machine. I have tried pointing both to the same port. In either case, the first POP3 host is accessed but not the second. I have also tried one Access line and two separate connects. It works fine with one Access line and one Connect line but a previous post on this subject indicated I should be able to do retrievals from two separate sites and I do not see how. I am using the POP3 Connection Manager on Small Business Server 2003. I set the email server to 127.0.0.1 and use port 9995. The corresponding section of the stunnel.conf file is client = yes debug = 7 ; Service-level configuration [pop3s] accept = 9995 connect = pop.gmail.com:995 ;does not work with two separate pop3s, either with two separate accept ports or one common final comment is my own. Has anyone successfully accessed mail from two POP3 servers through stunnel or have any suggestions? Boyd

1 0

stunnel 4.23 released
by Michal Trojnara 03 May '08

03 May '08

Dear Users, I have just released a new version of stunnel. Please find below the ChangeLog entry: Version 4.23, 2008.05.03, urgency: HIGH: * Bugfixes - Local privilege escalation bug on Windows NT based systems fixed. A local user could exploit stunnel running as a service to gain localsystem privileges. Home page/download: http://stunnel.mirt.net/ sha1sum for stunnel-4.23.tar.gz file: d0fef8b518a44b9623692381a53680e0b4b01686 Best regards, Mike

1 0

Re: [stunnel-users] launch stunnel server daemon from php?
by Wesley Kenzie 02 May '08

02 May '08

No, that does not work either. I can get stunnel to start fine outside of php, but not as an exec or shell_exec from within a running script, or even from within php -a interactively. I can get other programs to work fine this way, so it is specific to the stunnel executable as best I can tell. I have tried running various forms of bash scripts too, but none do any better. Ideas? . . . . . Wesley On Fri, May 2, 2008 at 12:52 PM, Ludolf Holzheid < lholzheid(a)bihl-wiedemann.de> wrote: > On Fri, 2008-05-02 12:32:19 -0700, Wesley Kenzie wrote: > > Yes. Without this stunnel would not launch. With foreground = no and > with > > the trailing & on the command line I got it to launch, but still control > > will not return to my php script ... > > > > . . . . . > > Wesley > > > > On Fri, May 2, 2008 at 12:29 PM, Ludolf Holzheid < > > lholzheid(a)bihl-wiedemann.de> wrote: > > > > > On Fri, 2008-05-02 12:19:38 -0700, Wesley Kenzie wrote: > > > > I am having problems launching stunnel from a php "exec" command. I > > > would > > > > like to have it launch as a server daemon and then have the exec > command > > > > return control to the php script. > > > > > > Did you try to specify ``foreground = no'' in the configuration file? > > Wesley, > > I must confess that I don't know php and its `exec' command. There > must be something special about it. > > I would try to start a shell, which starts stunnel, which, in turn, > detaches itself to the background (i.e. something like "/bin/sh -c > '/usr/local/bin/stunnel /etc/stunnel/test.conf'"). So that the process > started by `exec' finishes and hopefully control returns to php. > > hth, > > Ludolf > > -- > > A: Because it messes up the order in which people normally read text. > Q: Why is top-posting such a bad thing? > A: Top-posting. > Q: What is the most annoying thing in e-mail? >

1 0

Re: [stunnel-users] launch stunnel server daemon from php?
by Wesley Kenzie 02 May '08

02 May '08

Yes. Without this stunnel would not launch. With foreground = no and with the trailing & on the command line I got it to launch, but still control will not return to my php script ... . . . . . Wesley On Fri, May 2, 2008 at 12:29 PM, Ludolf Holzheid < lholzheid(a)bihl-wiedemann.de> wrote: > On Fri, 2008-05-02 12:19:38 -0700, Wesley Kenzie wrote: > > I am having problems launching stunnel from a php "exec" command. I > would > > like to have it launch as a server daemon and then have the exec command > > return control to the php script. > > Did you try to specify ``foreground = no'' in the configuration file? > > Ludolf > > -- > > --------------------------------------------------------------- > Ludolf Holzheid Tel: +49 621 339960 > Bihl+Wiedemann GmbH Fax: +49 621 3392239 > Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de > D-68199 Mannheim, Germany > --------------------------------------------------------------- >

1 0

Verify=3 restart needed ?
by Edouard Dessioux 30 Apr '08

30 Apr '08

Hi everyone, Sorry for the repost, but in the web mailing list, my previous message appears weird, so I thought I could re-post it. I'm using stunnel v4.16 on a Windows 2003 Server, and I'm working with stunnel in verify=3 mode. I wanted to know if the stunnel needs to be restarted after a certificates has been removed ? If not, how long is the certificate considered valid after the file has been removed ? Regards, Edouard DESSIOUX Directeur de Projets Tibco Mobile 3, rue Danton - 92240 Malakoff Tél : +33 (0)1 55 58 04 59 - Fax : +33 (0)1 55 58 03 89 - Mob. +33 (0)6 34 02 61 54 E-mail : edessioux(a)tibco.fr - www.tibcomobile.fr Faites un geste pour la planète, n'imprimez ce message que si nécessaire.

3 3

to use certificate and key file in another machine
by Xiaoming Dong 29 Apr '08

29 Apr '08

Stunnel Version 4.2.1 Run in windows 2k3 When I configured stunnel to use cert from another windows machine (I already mapped the drive to this machine). Restarting stunnel got following error: 2008.04.29 10:01:32 LOG7[3568:1792]: Snagged 64 random bytes from C:/.rnd 2008.04.29 10:01:32 LOG7[3568:1792]: Wrote 1024 new random bytes to C:/.rnd 2008.04.29 10:01:32 LOG7[3568:1792]: RAND_status claims sufficient entropy for the PRNG 2008.04.29 10:01:32 LOG7[3568:1792]: PRNG seeded successfully 2008.04.29 10:01:32 LOG3[3568:1792]: V:\Program Files\client_cert\private\client_key.pem: No such process (3) 2008.04.29 10:01:32 LOG3[3568:1792]: Server is down Does anybody have any clue? Thanks, -Xiaoming ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

1 0

Will fwknop work?
by richard.woodman＠cox.net 29 Apr '08

29 Apr '08

If I understand the question correctly, isn't this what "port knocking" or single packet authorization (e.g. fwknop) is supposed to do? I have used fwknop and SSH in our lab, but only with Linux and iptables. However, I think fwknop is supposed to interface with more than just iptables on the local box (meaning you would not have to use a Linux box to replace your current firewall). I think you can use fwknop to monitor syslog and parse for specific events and then open the port. In other words, your current firewall reports to your syslog server and fwknop parses the log file for the security event associated with the reception of a SPA packet on your outside interface. Fwknop then sends your firewall (through a script?) whatever command is required to open the port you want and redirect it to the appropriate inside machine (or you could simply enable / disable a preconfigured rule). I am not a scripting guru so I may be WAY off base here and if I am, I apologize for leading you astray. Anyway, you might want to check out the following: http://cipherdyne.org/fwknop/ --> FireWall KNock Operator home page http://fwknop.darwinports.com/ --> OS X fwknop client There is also a Windows UI version that is supposed to create SPA packets without using fwknop / PERL or running under Cygwin but I have not used that. Richard On 4/29/08 7:50 PM, "jz(a)ellingtongeologic.com" <jz(a)ellingtongeologic.com> wrote: > > Good Morning Mike: > > I had a question and sent to the list (it might have not gone thru) The > question was that: is it possible for stunnel to go to the router, for > example, 10.10.1.1, to scan for a port of interest and see whether there is a > request thru that port? so the nat router would not have to forward the port > to the stunnel of my local machine, e.g. 10.10.1.188, on which stunnel is > listening for port 8888 and will relay it to 5631 of the local program. > > Thanks

1 0

how to enable TLS?
by Zhang Weiwu 26 Apr '08

26 Apr '08

Dear all I just configured stunnel for pop+ssl which works fine. What I want is actually smtp+tls. Is there a way to do so? I tried to configure thunderbird to access the port stunnel is listening to, with TLS. Then I got "Connectioin to xxx.xxx.xxx timed out". Best regards -- Real Softservice Huateng Tower, Unit 1788 Jia 302 3rd area of Jinsong, Chao Yang Tel: +86 (10) 8773 0650 ext 603 Mobile: 135 9950 2413 http://www.realss.com

1 0