- stunnel-users - stunnel.org

VNC, STUNNEL & HTTPTUNNEL ----- (((VNC)SSL)HTTP)
by sean bhola 25 Feb '08

25 Feb '08

I need to connect to my PC at work from home. The firewall at work has only ports 80 (http) and 443 (https) open, I also think there is a proxy. I was wondering which scenario would work. 1: To encapsulate vnc traffic within ssl using stunnel and pass it though port 443, OR 2: To encapsulate vnc traffic within ssl using stunnel, then encapsulate that within http using httptunnel and pass through port 80 OR 3: To encapsulate vnc traffic within http, then encapsulate that within ssl using stunnel and pass through port 443 I read this article http://www.securityfocus.com/infocus/1677 but still had the concerns above. Help would be much appreciated. Thanks. Sean

2 1

running SWAT through stunnel and uid/gid question
by Wayne Sherman 24 Feb '08

24 Feb '08

(using STunnel 4.21 on gentoo) I can successfully run the samba SWAT tool through stunnel with these settings: [swat] exec = /usr/sbin/swat execargs = swat accept = 901 But, I have discovered that in order to successfully log-in to swat, I have to comment these lines in the global section of stunnel.conf: #setuid = stunnel #setgid = stunnel Is there a way to specify the UID/GID per service (like the xinetd service level option "user") instead of globally? Thanks, Wayne

1 0

Re: [stunnel-users] Stunnel Configuration
by paque_alexandre＠yahoo.fr 19 Feb '08

19 Feb '08

1 0

Web based CRL file
by Edouard Dessioux 18 Feb '08

18 Feb '08

Hi, I have several questions about the CRL file : - is the file reloaded before each connection or is it first loaded at the stunnel startup ? - do you have any idea of how to use a web-based CRL file ? Regards, Edouard DESSIOUX Directeur de Projets Tibco Mobile 3, rue Danton - 92240 Malakoff Tél : +33 (0)1 55 58 04 59 - Fax : +33 (0)1 55 58 03 89 - Mob. +33 (0)6 34 02 61 54 E-mail : edessioux(a)tibco.fr - www.tibcomobile.fr Faites un geste pour la planète, n'imprimez ce message que si nécessaire.

1 0

Installing Stunnel 4.21 on Shared Hosting Server with OpenSSL 0.9.6g
by Norbert Hoeller 17 Feb '08

17 Feb '08

I am trying to install Stunnel 4.21 on a 1&1 shared Linux server. PHP Settings claims that OpenSSL 0.9.6g is installed. I unpacked the tar file and ran "./configure" using --prefix to override the /usr/local/ install directory. I had one warning: "configure: WARNING: Openssl engine header not found". In terms of threading model, I got "configure: PTHREAD thread model detected". When I tried to run "make", I got "common.h:318: #error OpenSSL library compiled without thread support". Is there a way around this? I tried running "./configure" with --with-threads=ucontext/fork, but that gave a bunch of "OCSP_" undeclared variables and "Error 1". Thanks, Norbert

2 2

Validation of certificate
by Edouard Dessioux 12 Feb '08

12 Feb '08

Hi everyone, I'm new to this mailing list, but before my asking question, i checked the archive but did not find anything related, so, it may be out of topic. Well, for the moment, I can't provide all the informations asked like « output of ... command », but I'm not sure this is relevant for my question. The informations I can provide are : * I use stunnel to terminate a tls connection between a mobile phone and a web application server. * I use stunnel to validate my clients certificates. * The stunnel will be running on a windows 2003 server * I guess I would be using the last available version of stunnel * The certificates would be generated by a PKI different from openssl What I would like to do is : I have a PKI already deployed with many certificates, and I want only a small subset of them to be validated by the stunnel. I thought of using multiples OU fields to « tags » some users, but can this fields be checked by stunnel ? Do you guys have any feedback on this or any alternative way to do something equivalent ? Regards, Edouard DESSIOUX Directeur de Projets Tibco Mobile 3, rue Danton - 92240 Malakoff Tél : +33 (0)1 55 58 04 59 - Fax : +33 (0)1 55 58 03 89 - Mob. +33 (0)6 34 02 61 54 E-mail : edessioux(a)tibco.fr - www.tibcomobile.fr Faites un geste pour la planète, n'imprimez ce message que si nécessaire.

1 0

signal 15 terminating stunnel on start in Ubuntu
by Rick Barry 11 Feb '08

11 Feb '08

I am trying to use Stunnel 4.2 on Ubuntu 7.1. When I use this command to start Stunnel: /etc/init.d/stunnel4 start I get this output: Starting SSL tunnels: 2008.02.11 09:00:05 LOG7[6780:3082872496]: RAND_status claims sufficient entropy for the PRNG 2008.02.11 09:00:05 LOG7[6780:3082872496]: PRNG seeded successfully 2008.02.11 09:00:05 LOG7[6780:3082872496]: SSL context initialized for service nntp [Failed: /etc/stunnel/stunnel.conf] You should check that you have specified the pid= in you configuration file In the log entry @ /var/log/stunnel4/stunnel.log: 2008.02.11 08:33:54 LOG5[5468:3082974896]: stunnel 4.20 on i486-pc-linux- gnu with OpenSSL 0.9.8e 23 Feb 2007 2008.02.11 08:33:54 LOG5[5468:3082974896]: ThreadingTHREAD SSL:ENGINE SocketsOLL,IPv6 Auth:LIBWRAP 2008.02.11 08:33:54 LOG6[5468:3082974896]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.02.11 08:33:54 LOG6[5468:3082974896]: poll() used - no FD_SETSIZE limit for file descriptors 2008.02.11 08:33:54 LOG5[5468:3082974896]: 500 clients allowed 2008.02.11 08:33:54 LOG7[5468:3082974896]: FD 4 in non-blocking mode 2008.02.11 08:33:54 LOG7[5468:3082974896]: FD 5 in non-blocking mode 2008.02.11 08:33:54 LOG7[5468:3082974896]: FD 6 in non-blocking mode 2008.02.11 08:33:54 LOG7[5468:3082974896]: SO_REUSEADDR option set on accept socket 2008.02.11 08:33:54 LOG7[5468:3082974896]: nntp bound to 127.0.0.1:119 2008.02.11 08:33:54 LOG7[5517:3082974896]: Created pid file /stunnel4.pid 2008.02.11 08:39:10 LOG5[5517:3082974896]: Received signal 15; terminating 2008.02.11 08:39:10 LOG7[5517:3082974896]: removing pid file /stunnel4.pid Signal 15 seems to be the linchpin here, but my research hasn't brought up anything conclusive. Any pointers? Thank you. Rick Barry ____________________________________________________________________________________ Looking for last minute shopping deals? Find them fast with Yahoo! Search. http://tools.search.yahoo.com/newsearch/category.php?category=shopping

1 0

Stunnel Problem - 935 Maximum connections on Windows
by Iain ＠ Mobile777 11 Feb '08

11 Feb '08

We are having some difficulties when using Stunnel under load. The maximum sessions running on a Windows servers seems to be set at 935 concurrent connections. Our system uses Stunnel to route incoming SSL traffic on port 443 through Openssl to a Java application on port 26789. Both Stunnel and the Java server run on a Windows 2003 server, with between 4GB and 8GB of ram, both running Dual Intel Zeon 2Ghz processors. The problem is that when the Stunnel server is under load, the maximum connections that we can achieve is 935 concurrent connections (Windows threads between 936 and 938), before Stunnel throws errors and starts closing the connections. Here is some additional information about our system: Stunnel version 4.21 (latest Windows binaries) OpenSSL 0.9.8g Stunnel Config: ----------------------------------------------------------------------- debug = 7 output = stunnel.log # Use it for client mode #client = yes #TIMEOUTidle = 60 socket = a:TCP_NODELAY=1 socket = a:SO_LINGER=a:0 socket = r:TCP_NODELAY=1 socket = r:SO_LINGER=r:0 socket = l:TCP_NODELAY=1 socket = l:SO_LINGER=l:0 # Service-level configuration [JAVASERVER] #session = 5000 accept = 443 connect = localhost: 26789 # delay = yes #transparent = yes ----------------------------------------------------------------------- We have tried various options, such as the TIMEOUTidle and session parameters for Stunnel, but with no luck. We have even tried running Stunnel separately on a Linux distro (FC4), with even less positive results. The pertinent errors in the log files are as follows: Connection closed: 178664 bytes sent to SSL, 44646 bytes sent to socket SSL alert (write): warning: close notify _beginthread: Exec format error (8) Connection rejected: create_client failed I can mail full logs of our load tests as well. Our server will be expected to handle upwards of 10000 connections at a time, we've been researching for about a week now how to get the performance we need, but so far nothing. Iain

3 3

Stunnel + Hybrid-ircd issues
by Strykar 09 Feb '08

09 Feb '08

Hi, I'm running Hybrid-7.2 on two PCs, one of which has a dynamic IP, as Hybrid wants a static IP and not hostname in its connect section, we are trying to use stunnel to encrypt server<->server communication. Server 1 specs (To which I'm connecting) running FreeBSD 6.3: *********************************************** #stunnel -version stunnel 4.05 on amd64-unknown-freebsd5.3 PTHREAD+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 Global options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /usr/local/etc/stunnel/stunnel.pem pid = /var/tmp/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes #gcc -v Using built-in specs. Configured with: FreeBSD/amd64 system compiler Thread model: posix gcc version 3.4.6 [FreeBSD] 20060305 #uname FreeBSD 6.3-STABLE FreeBSD 6.3-STABLE #6: Tue Jan 22 13:23:51 GMT 2008 root@:/usr/obj/usr/src/sys/SVR1 amd64 Server 2 specs (From which I'm connecting via stunnel as a client) running OpenBSD 4.2: ****************************************************************** #stunnel -version stunnel 4.20 on i386-unknown-openbsd4.2 with OpenSSL 0.9.7j 04 May 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/arandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none # gcc -v Reading specs from /usr/lib/gcc-lib/i386-unknown-openbsd4.2/3.3.5/specs Configured with: Thread model: single gcc version 3.3.5 (propolice) # cat stunnel.conf: cert = /etc/ssl/private/stunnel.pem key = /etc/ssl/private/rsa.key setuid = _stunnel setgid = _stunnel pid = /var/run/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 foreground = yes [irc] client = yes accept = localhost:994 connect = xxx.xxx.xxx.xxx:994 Here's the debug logged to stderr: # stunnel 2008.02.08 19:34:54 LOG7[11904:2237644800]: Snagged 64 random bytes from /dev/arandom 2008.02.08 19:34:54 LOG7[11904:2237644800]: RAND_status claims sufficient entropy for the PRNG 2008.02.08 19:34:54 LOG7[11904:2237644800]: PRNG seeded successfully 2008.02.08 19:34:54 LOG7[11904:2237644800]: Certificate: /etc/ssl/private/stunnel.pem 2008.02.08 19:34:54 LOG7[11904:2237644800]: Certificate loaded 2008.02.08 19:34:54 LOG7[11904:2237644800]: Key file: /etc/ssl/private/rsa.key 2008.02.08 19:34:54 LOG7[11904:2237644800]: Private key loaded 2008.02.08 19:34:54 LOG7[11904:2237644800]: SSL context initialized for service irc 2008.02.08 19:34:54 LOG5[11904:2237644800]: stunnel 4.20 on i386-unknown-openbsd4.2 with OpenSSL 0.9.7j 04 May 2006 2008.02.08 19:34:54 LOG5[11904:2237644800]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.02.08 19:34:54 LOG6[11904:2237644800]: file ulimit = 128 (can be changed with 'ulimit -n') 2008.02.08 19:34:54 LOG6[11904:2237644800]: poll() used - no FD_SETSIZE limit for file descriptors 2008.02.08 19:34:54 LOG5[11904:2237644800]: 61 clients allowed 2008.02.08 19:34:54 LOG7[11904:2237644800]: FD 6 in non-blocking mode 2008.02.08 19:34:54 LOG7[11904:2237644800]: FD 7 in non-blocking mode 2008.02.08 19:34:54 LOG7[11904:2237644800]: FD 8 in non-blocking mode 2008.02.08 19:34:54 LOG7[11904:2237644800]: SO_REUSEADDR option set on accept socket 2008.02.08 19:34:54 LOG7[11904:2237644800]: irc bound to 127.0.0.1:994 2008.02.08 19:34:54 LOG7[11904:2237644800]: Created pid file /var/run/stunnel.pid 2008.02.08 19:35:15 LOG7[11904:2237644800]: irc accepted FD=9 from 127.0.0.1:8579 2008.02.08 19:35:15 LOG7[11904:2336256000]: irc started 2008.02.08 19:35:15 LOG7[11904:2336256000]: FD 9 in non-blocking mode 2008.02.08 19:35:15 LOG7[11904:2336256000]: TCP_NODELAY option set on local socket 2008.02.08 19:35:15 LOG7[11904:2336256000]: FD 10 in non-blocking mode 2008.02.08 19:35:15 LOG7[11904:2336256000]: FD 11 in non-blocking mode 2008.02.08 19:35:15 LOG7[11904:2336256000]: Connection from 127.0.0.1:8579 permitted by libwrap 2008.02.08 19:35:15 LOG5[11904:2336256000]: irc accepted connection from 127.0.0.1:8579 2008.02.08 19:35:15 LOG7[11904:2336256000]: FD 10 in non-blocking mode 2008.02.08 19:35:15 LOG7[11904:2336256000]: irc connecting 69.50.175.50:994 2008.02.08 19:35:15 LOG7[11904:2336256000]: connect_wait: waiting 10 seconds 2008.02.08 19:35:15 LOG7[11904:2237644800]: Cleaning up the signal pipe 2008.02.08 19:35:15 LOG6[11904:2237644800]: Child process 26562 finished with code 0 2008.02.08 19:35:15 LOG7[11904:2336256000]: connect_wait: connected 2008.02.08 19:35:15 LOG5[11904:2336256000]: irc connected remote server from 192.168.1.101:42954 2008.02.08 19:35:15 LOG7[11904:2336256000]: Remote FD=10 initialized 2008.02.08 19:35:15 LOG7[11904:2336256000]: TCP_NODELAY option set on remote socket 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): before/connect initialization 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 write client hello A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 read server hello A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 read server certificate A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 read server done A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 write client key exchange A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 write change cipher spec A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 write finished A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 flush data 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 read finished A 2008.02.08 19:35:15 LOG7[11904:2336256000]: 1 items in the session cache 2008.02.08 19:35:15 LOG7[11904:2336256000]: 1 client connects (SSL_connect()) 2008.02.08 19:35:15 LOG7[11904:2336256000]: 1 client connects that finished 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 client renegotiations requested 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 server connects (SSL_accept()) 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 server connects that finished 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 server renegotiations requested 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 session cache hits 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 session cache misses 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 session cache timeouts 2008.02.08 19:35:15 LOG6[11904:2336256000]: SSL connected: new session negotiated 2008.02.08 19:35:15 LOG6[11904:2336256000]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2008.02.08 19:35:15 LOG3[11904:2336256000]: SSL_read: Connection reset by peer (54) 2008.02.08 19:35:15 LOG5[11904:2336256000]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.02.08 19:35:15 LOG7[11904:2336256000]: irc finished (0 left) What is going on here with "SSL_read: Connection reset by peer (54)"? This process keeps repeating itself without the ircd's linking. - S

1 0

Verify Question
by Vlad 08 Feb '08

08 Feb '08

I'm sure that people have asked this question before, but i cannot find a way to search the archives. What is the difference between verify = 2 and verify = 3, The docs indicate that with verify = 3it will check against locally installed certs, but what does that mean, if I use =2 then what does it verify the cert against? Also a second question: I'm pretty sure that the answer is no but is it possible to do the following, have a cert A that is signed by CA cert B which itself is singed by a self-signed cert C. If the clients has C installed as a trusted cert, and it received A, is there anyway for it to validate A. I realize that these are probably pretty novice questions so I really appreciate your patience, thanks!

1 0