- stunnel-users - stunnel.org

Faulting application stunnel-4.05.exe
by Paulo Cesar Soares da Silva 25 Dec '04

25 Dec '04

stunnel-4.05.exe executed as a service presents the following problems: Faulting application stunnel-4.05.exe, version 0.0.0.0, faulting module libssl32.dll, version 0.0.0.0, fault address 0x00006cd8. Faulting application stunnel-4.05.exe, version 0.0.0.0, faulting module libeay32.dll, version 0.0.0.0, fault address 0x000564ec. The application, C:\Program Files\Crivo\tn3270\stunnel-4.05.exe, generated an application error The error occurred on 11/10/2004 @ 15:37:13.875 The exception generated was c0000005 at address 6B086CD8 (libssl32!SSL_set_session) Faulting application stunnel-4.05.exe, version 0.0.0.0, faulting module ntdll.dll, version 5.2.3790.0, fault address 0x000086f7. Environment: Hardware IBM 86496BX Dual processor 3 GHz Software OS Name Microsoft(R) Windows(R) Server 2003, Standard Edition , Version 5.2.3790 Build 3790 The following files are in same folder (..\Program Files\Teste\Stunnel) stunnel-4.05.exe, 4.05 libeay32.dll, openssl-0.9.7d-zlib libssl32.dll, openssl-0.9.7d-zlib Comntents of stunnel.conf: client = yes verify = 0 service = stunnel 4.05 options = DONT_INSERT_EMPTY_FRAGMENTS [data] accept = localhost:3500 connect = www.teste.com.br:443 delay = yes I would appreciate if anyone can help me on this? many thanks in advance! Paulo Cesar Soares da Silva (11) 3231-5396 pcesar(a)crivo.com.br --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com) Version: 6.0.794 / Virus Database: 538 - Release Date: 10/11/2004 --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com) Version: 6.0.794 / Virus Database: 538 - Release Date: 10/11/2004 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com) Version: 6.0.799 / Virus Database: 543 - Release Date: 19/11/2004

2 1

Gmail / Eudora / SpamPal and Stunnel
by John Bullas 22 Dec '04

22 Dec '04

Good Morning I hope there is someone on this group who can assist? I am running Eudora 6.2.0.14, Stunnel-4.04, SpamPal 1,583 win 2k on D drive / Stunnel on e (partitions not physical) startup line E:\stunnel\stunnel-4.04.exe Stunnel log after running it (systray icon appears to suggest it is started and Services app allowed me to start it) 2004.12.22 08:15:32 LOG5[3216:208]: stunnel 4.04 on x86-pc-mingw32-gnu WIN32 with OpenSSL 0.9.7c 30 Sep 2003 2004.12.22 08:15:32 LOG7[3216:1504]: Snagged 64 random bytes from C:/.rnd 2004.12.22 08:15:32 LOG7[3216:1504]: Wrote 1024 new random bytes to C:/.rnd 2004.12.22 08:15:32 LOG7[3216:1504]: RAND_status claims sufficient entropy for the PRNG 2004.12.22 08:15:32 LOG6[3216:1504]: PRNG seeded successfully 2004.12.22 08:15:32 LOG5[3216:1504]: WIN32 platform: 30000 clients allowed 2004.12.22 08:15:32 LOG7[3216:1504]: FD 324 in non-blocking mode 2004.12.22 08:15:32 LOG7[3216:1504]: SO_REUSEADDR option set on accept socket 2004.12.22 08:15:32 LOG7[3216:1504]: pop bound to 127.0.0.1:1109 2004.12.22 08:15:32 LOG7[3216:1504]: FD 332 in non-blocking mode 2004.12.22 08:15:32 LOG7[3216:1504]: SO_REUSEADDR option set on accept socket 2004.12.22 08:15:32 LOG7[3216:1504]: imap bound to 127.0.0.1:1439 2004.12.22 08:15:32 LOG7[3216:1504]: FD 340 in non-blocking mode 2004.12.22 08:15:32 LOG7[3216:1504]: SO_REUSEADDR option set on accept socket 2004.12.22 08:15:32 LOG7[3216:1504]: smtp bound to 127.0.0.1:259 Eudora settings: username: [email protected]@127.0.0.1:1109 smtp server:127.0.0.1 incoming server as POP and local ohst or 127.0.0.1 see below I can RECEIVE Gmail ok but SENDING prompts a "Could not connect to "127.0.0.1" Cause: connection refused (10061) ditto if "localhost" is used as the pop server in steadof 127.0.0.1 I have Hotmail Popper on 127.0.0.2 for hotmail and Spampal/Eudora is fine with that Hotmail Popper? A method to send/receive Hotmail via POP http://www.boolean.ca/hotpop/ Spampal? http://www.spampal.org a free spam tagging proxy(?) I am now in the realms of "playing about" to try and fix this outgoing mail issue HOWEVER I am sure someone in this forum has Gmail happily sending and receiving!!!! Gmail REQUIRES SSL A connection to my university email will not SEND over IMAP and needs to go out via SMTP as it requires a verified internal IP address to work (relay denied) I am uncertain of how the SSL settings in Eudora need to be set to allow Gmail to both send/receive using Required Alternate Post as given in the online help for Gmail via spampal and Stunnel http://gmail.google.com/support/bin/answer.py?answer=13279&query=eudora&top… ( aka: http://tinyurl.com/5vp6u ) Your learned wisdom would be welcome!!!! Regards John "Fatbloke" Bullas Southampton UK Yes I know Spampal and Gmail is "belt and braces" but I have a challenge here!!!! Justified "give up you can't" would be equally appreciated ** Eudora Mail 6.2 / McAfee Virus Scan 4.5.1 / Sp*mPal **

1 0

Fwd: [stunnel-users] stunnel 'options' section of config file
by Justin Miller 21 Dec '04

21 Dec '04

I understand the security concerns... I was just trying different protocols because I was receiving weird error messages with some https proxies (using the mathias wald patch) about wrong version numbers, etc. Googling it seemed to indicate that enabling/disabling ssl2/ssl3/tls1 could do the trick. However, I can't even get 'openssl s_client...' to yield a successful connection with some of these proxies. Can stunnel handle incoming http or socks proxy requests/connections? If not, will you ever support that? For instance I want stunnel listening on a local port 8080 and connect to a remote https proxy, and I set the HTTP proxy server in gaim to localhost:8080. -Justin On Tue, 21 Dec 2004 15:20:19 +0100, Michal Trojnara <Michal.Trojnara(a)mobi-com.net> wrote: > Justin Miller wrote: > > So all looks well ang good... But then when it sends the client hello > > message, one would expect an ssl2 message, but we get the following > > Stunnel is not supposed to act as SSLv2 client. It uses > SSLv3_client_method() in src/ssl.c file. If you really need SSLv2 - change > it to SSLv2_client_method() and recompile stunnel. It's not recommended for > security, anyway. > > See SSL_CTX_new(3) manual for details. > > Best regards, > Mike > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users >

2 2

stunnel 'options' section of config file
by Justin Miller 21 Dec '04

21 Dec '04

Is it just me, or does stunnel not seem to obey the ssl 'options' setting in the config file? I have the lines: options = TLS_ROLLBACK_BUG options = NO_TLSv1 options = NO_SSLv3 And when I start stunnel, the output is: 2004.12.20 07:47:46 LOG7[9981:1024]: Configuration SSL options: 0x06800000 2004.12.20 07:47:46 LOG7[9981:1024]: SSL options set: 0x06800000 So all looks well ang good... But then when it sends the client hello message, one would expect an ssl2 message, but we get the following output: 2004.12.20 07:47:51 LOG7[9984:1026]: SSL state (connect): SSLv3 write client hello A 2004.12.20 07:47:51 LOG7[9984:1026]: waitforsocket: FD=10, DIR=read 2004.12.20 07:47:51 LOG7[9984:1026]: waitforsocket: ok 2004.12.20 07:47:51 LOG7[9984:1026]: SSL alert (write): fatal: handshake failure 2004.12.20 07:47:51 LOG3[9984:1026]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number That first line seems to indicate that it's still sending a v3 message. Is this actually what's happening?

2 1

Re: [stunnel-users] UDP applications
by Colin McKinnon 21 Dec '04

21 Dec '04

On Tuesday 21 December 2004 03:58, you wrote: > > This encapsulation of udp packets was what i was referring to... Could > you plz give me some pointers where this is "well" documented. > Google suggested: http://www.stunnel.org/examples/pppvpn.html http://www.buildinglinuxvpns.net/sourcecode/r/4/vpn-server.html http://mia.ece.uic.edu/~papers/bin/ppp_over_ssl_vpn_client http://irb.cs.tu-berlin.de/dienste/dialup/inhouse/irbvpnclient (although note that a cursory glance trhough suggests sme of these use stunnel v3 config syntax) C.

1 0

stunnel 4.06 and compression
by saruman 20 Dec '04

20 Dec '04

Hello. Is there any way to get the beta version of stunnel 4.06 (I've seen in this list that it must support compression)? Or if I can't get new version - can I somehow enable compression in stunnel 4.05? Oleg Ivanov

1 0

Problem with huge stunnel.conf
by CIM Massy 20 Dec '04

20 Dec '04

Hi everyone ! I have 900 (W2K) machines that I have to securely log onto. I chose to use both of Ultr@VNC and RealVNC 4.0 (running on ports 5900 & 5901). And I chose to use STunnel 4.05 on W2K to secure the sockets. On my admin PC, Stunnel.conf looks like /*******************************/ #cert stuff [ultravnc0101] accept = 127.0.1.1:5900 connect = PC0101:5700 [realvnc0101] accept = 127.0.1.1:5901 connect = PC0101:5701 ... [ultravnc1000] accept = 127.0.10.0:5900 connect = PC1000:5700 [realvnc1000] accept = 127.0.10.0:5901 connect = PC1000:5701 /*******************************/ And it does only work for the first 31 pairs of "services". (No Authentification issues.) When I move the "PC0101" services to the end of the file it will not work anymore, whereas it does when it's first in the .conf file. I guess having 1800 services is not necessarily the way Stunnel is meant to work... Is it a known issue ? I haven't been able to find any infos on it in newsgroups or with Google. It does not seem to be a W2K problem since it works with the 64 first services. If anyone knows a workaround... Thanks for your help, Reagrds Philippe HAMEAU

3 3

UDP applications
by Paul 20 Dec '04

20 Dec '04

Hi all, Is there any roadmap for Stunnel to support UDP applications? Cant a simple UDP forwarder (with proper buffering to ensure a tcp-like stream of data) do the job? May be this topic is discussed and brainstormed before. I couldnot find any relevant details about this in the archives. Thanks and Regards, Paul

2 1

Need help: verification of client and server certificates
by Mike_Stunnel 20 Dec '04

20 Dec '04

For my Stunnel server, I'm using Windows ME, OpenSSL 0.9.7e and Stunnel 4.05. I've create my own Certificate Authority on my server and created and signed a server and multiple client certificates for Stunnel. I plan to use Stunnel to secure my VNC connections to my PC - to encrypt the traffic and to validate the clients. On the server side: ------------------- I want to limit connections to my Stunnel server to only those Stunnel clients that present a client certificate that I already have a copy of on my server. And I want Stunnel server to only recognize my own Certificate Authority as a valid CA for the clients' certificates. Is this possible? What options do I need to specify in the Stunnel server configuration file to make this work? The documentation is confusing to me - for example, do I use CAfile or CApath to point Stunnel to the the CA certificate? Will Stunnel recognize other CAs as trusted, if their certificates have been loaded by other programs like a browsers or mail reader? Etcetera .. On the client side: ------------------- As with the server, I want my Stunnel client to only recognize my own CA as trusted. And I want it to validate the server certificate as thoroughly as possible. Is that verify level 3? I need the CA certificate on my client, but do I use CAfile or CAcert in the config file to point to it? Do I need a copy of the server certificate on my client so that the client can verify the server's certificate? I'm so confused! I've read the FAQ and Related links on stunnel.org and also the past 4 months' mailing list digests but I'm still not clear on the certificate verification process. or all the options in the configuration file.

1 0

Socks Support
by Paul 15 Dec '04

15 Dec '04

I have been working/using stunnel for quite sometime... I am using it along with SOcks. So was wondering is there anyone who is already working on providing socks (v4 or v5) support to existing stunnel? Also is there any1 else who is also requires socks functionality in stunnel? Thanks and Regards, Paul.

2 1

Stunnel Keeps Closing Connections with an Error
by Jerry Baker 09 Dec '04

09 Dec '04

I am using Stunnel 4.05 on Windows 98/XP to connect VNC clients to a Windows XP server. I am continually getting disconnected by Stunnel with the following error: SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac I have tried using the OpenSSL 0.9.7d binaries from stunnel.org AND compiling OpenSSL 0.9.7e myself. Either way, the same result. Thanks in advance.

1 0

SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate
by Ron Kindermann 09 Dec '04

09 Dec '04

Hello, I use stunnel on WinXP to connect to my ISP's pops server and get the following error message in my log: 2004.12.09 12:47:09 LOG5[4888:6096]: stunnel 4.05 on x86-pc-mingw32-gnu WIN32 with OpenSSL 0.9.7e 25 Oct 2004 2004.12.09 12:47:11 LOG5[4888:4612]: WIN32 platform: 30000 clients allowed 2004.12.09 12:47:46 LOG5[4888:5432]: pops.xs4all.nl:995 connected from 127.0.0.1:61950 2004.12.09 12:47:46 LOG5[4888:5432]: VERIFY IGNORE: depth=0, /C=NL/ST=Noord Holland/L=Diemen/O=XS4ALL Internet B.V./CN=pops.xs4all.nl 2004.12.09 12:47:46 LOG5[4888:5432]: VERIFY IGNORE: depth=0, /C=NL/ST=Noord Holland/L=Diemen/O=XS4ALL Internet B.V./CN=pops.xs4all.nl 2004.12.09 12:47:46 LOG5[4888:5432]: VERIFY IGNORE: depth=0, /C=NL/ST=Noord Holland/L=Diemen/O=XS4ALL Internet B.V./CN=pops.xs4all.nl 2004.12.09 12:47:46 LOG3[4888:5432]: SSL_connect: 14094412: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate This is my config: CAfile = xxxxx cert = xxxxx CRLpath = xxxxx client = yes # debug = 4 key = xxxxx options = DONT_INSERT_EMPTY_FRAGMENTS output = stunnel.log RNDbytes = 64 RNDfile = .rnd RNDoverwrite = yes service = Stunnel client session = 300 taskbar = no verify = 0 [pops.xs4all.nl:995] accept = 127.0.0.1:5000 connect = pops.xs4all.nl:995 delay = yes [pop.gmail.com:995] accept = 127.0.0.1:5003 connect = pop.gmail.com:995 delay = yes The "xxxxx" are good filepaths because I can connect to pop.gmail.com:465 just fine. Anyone got a clue where to look? Thanks, Ron

1 1

cannot connect to gmail (STARTTLS trouble ?)
by Sebastien WILLEMIJNS 05 Dec '04

05 Dec '04

hello, i'm trying to test gmail SMTP server with postie (a commandline poster) and stunnel.... POP access to port 995 is OK SMTP access with gmail is bad (authentification failed) SMTP access with gmx.net and vfemail.net is OK In eudora software , it speak about 3 methods to use SSL, how to try in stunnel these method ? ********************* STUNNEL.CNF client = yes [X]>> stunnel.cnf accept = 1664 connect = smtp.gmail.com:465 ******************** WIN32 COMMANDLINE IS "stunne~1.exe stunnel.cnf" ********************* EUDORA DOC The Generic Properties tab is used to set the SSL options for sending mail (SMTP). The available options are: * Never -- tells Eudora not to use SSL * If Available, STARTTLS -- tells Eudora to use SSL if it is available * Required, Alternate Port -- tells Eudora that the use of SSL is required, on the alternate port (more on this in a minute) * Required, STARTTLS -- tells Eudora that the use of SSL is required *********************** MY GMAIL LOG here's the log i have +OK Gpop ready. USER willemijns(a)gmail.com +OK send PASS PASS xxxxxxxx +OK Welcome. STAT +OK 0 0 There are 0 messages waiting (0 bytes) QUIT +OK Farewell. %%%%%%%%%%% 220 smtp.gmail.com ESMTP 79sm7704rna EHLO 80-125-222-144.dti.cegetel.net 250-smtp.gmail.com at your service 250-SIZE 20971520 250-8BITMIME 250-AUTH PLAIN LOGIN 250 ENHANCEDSTATUSCODES AUTH PLAIN 334 = AHXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX2 235 2.7.0 Accepted EHLO 80-125-222-144.dti.cegetel.net 250-smtp.gmail.com at your service 250-SIZE 20971520 250-8BITMIME 250-AUTH PLAIN LOGIN 250 ENHANCEDSTATUSCODES Connected to 'smtp.gmail.com:465' MAIL FROM:<willemijns(a)gmail.com> 530 5.7.0 Authentication Required Could not send: error= -1 Status: 530 5.7.0 Authentication Required **********i've noticied when it works well (with GMX.NET) i can see "250 STARTTLS" as: Query for (NS) 'runbox.com' [127.0.0.1] MX/A server (0) = '' 220 {mp009} GMX Mailservices ESMTP EHLO localhost 250-{mp009} GMX Mailservices 250-8BITMIME 250-ENHANCEDSTATUSCODES 250-AUTH=LOGIN CRAM-MD5 PLAIN 250-AUTH CRAM-MD5 LOGIN PLAIN 250 STARTTLS AUTH PLAIN 334 Go on AHXXXXXXXXXXXXXXXXXXXXXXXXXXX== 235 2.7.0 {mp009} Go ahead EHLO localhost 250-{mp009} GMX Mailservices 250-8BITMIME 250-ENHANCEDSTATUSCODES 250-AUTH=LOGIN CRAM-MD5 PLAIN 250-AUTH CRAM-MD5 LOGIN PLAIN 250 STARTTLS Connected to '127.0.0.1:1664' MAIL FROM:<willemijns(a)gmx.net> 250 2.1.0 {mp009} ok RCPT TO:<vivil(a)runbox.com> 250 2.1.5 {mp009} ok DATA 354 {mp009} Go ahead To: vivil(a)runbox.com (...) thanks of your help :-) ----- End Forwarded Message ----- ----- End Forwarded Message -----

1 0

Using Stunnel for ICMP traffic
by Montoya_Paul＠emc.com 03 Dec '04

03 Dec '04

Dear group, Would anyone know how I can go about setting up Stunnel to tunnel all ICMP traffic between two systems? I'm just looking for the basic steps required in the process. Any useful documentation links would be great. Thank you much in advance. Regards, > Paul Montoya > Associate Implementation Specialist > Scottsdale, AZ > EMC² > where information lives > http://www.emc.com <http://www.emc.com>

2 1

same questions about problems with stunnel-4.05 and the old 3.2x command line
by 86493293＠gmx.net 02 Dec '04

02 Dec '04

Hi Michal, i'm using stunnel since version 3.2x and now i'm trying to switch to version 4.05. but there still some problems left so i searched the "net" and found only one article about this problems (http://stunnel.mirt.net/pipermail/stunnel-users/2004-August/000013.html) but this solution seems not to work for me or i'm a little bit to stupid to understand it. i used 3.2x with the following command line: $ stunnel -P ~/ -v2 -A ./publickey.pem -p privatekey.pem -r target_host.net:666 -c -d 127.0.0.1:7777 Then i tried to write me my own config-file for stunnel-4.05. $ cat /etc/stunnel/stunnel.conf # pid is created in an jail pid = /home/user/.stunnel/stunnel.pid # Some debugging stuff debug = 7 output = /home/user/.stunnel/stunnel.log # use it for client mode client = yes foreground = yes # Authentification verify = 3 cert = /home/user/privatekey.pem CAfile = /home/user/publickey.pem # Service-Level Configuration [application] accept = 127.0.0.1:666 connect = targethost.net:7777 But this one does not work. The stunnel.log told me this: $ cat /home/user/stunnel.log 2004.12.01 22:20:12 LOG5[15233:1006686208]: stunnel 4.05 on i386-unknown-openbsd3.6 PTHREAD+LIBWRAP with OpenSSL 0.9.7d 17 Mar 2004 2004.12.01 22:20:12 LOG7[15233:1006686208]: Snagged 64 random bytes from /dev/arandom 2004.12.01 22:20:12 LOG7[15233:1006686208]: RAND_status claims sufficient entropy for the PRNG 2004.12.01 22:20:12 LOG6[15233:1006686208]: PRNG seeded successfully 2004.12.01 22:20:12 LOG7[15233:1006686208]: Certificate: /home/privatekey.pem 2004.12.01 22:20:12 LOG7[15233:1006686208]: Key file: /home/user/privatekey.pem 2004.12.01 22:20:12 LOG7[15233:1006686208]: Loaded verify certificates from /home/user/publickey.pem 2004.12.01 22:20:12 LOG5[15233:1006686208]: FD_SETSIZE=1024, file ulimit=128 -> 61 clients allowed 2004.12.01 22:20:12 LOG7[15233:1006686208]: FD 7 in non-blocking mode 2004.12.01 22:20:12 LOG7[15233:1006686208]: SO_REUSEADDR option set on accept socket 2004.12.01 22:20:12 LOG7[15233:1006686208]: application bound to 127.0.0.1:666 2004.12.01 22:20:12 LOG7[15233:1006686208]: FD 8 in non-blocking mode 2004.12.01 22:20:12 LOG7[15233:1006686208]: FD 9 in non-blocking mode 2004.12.01 22:20:12 LOG7[15233:1006686208]: Created pid file /var/run/stunnel.pid It looks for me normal but i can not connect to this local port and i can not seen the "stunnel" as an process in my "ps -al |grep stunnel". And there is no error message or something like that. But when i try to connect to this local adress 127.0.0.1:666 i get always an "lost connection". Please tell me if my config-file is right?! So i know that the mistake must be at the "application" and not in my stunnel.conf. Thx for your help! With Regards Mario -- GMX ProMail mit bestem Virenschutz http://www.gmx.net/de/go/mail +++ Empfehlung der Redaktion +++ Internet Professionell 10/04 +++

1 0

Q: stunnel checking of certs?
by Heiko Nardmann 02 Dec '04

02 Dec '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi together! Two questions: 1) does stunnel read the cert files/directories only once at startup or every time it has to check a certificate? 2) does stunnel support CRLs? e.g. getting the CRL via LDAP? - -- Heiko Nardmann (Dipl.-Ing. Technische Informatik) secunet Security Networks AG - Sicherheit in Netzwerken (www.secunet.de) Weidenauer Str. 223-225, D-57076 Siegen Tel. : +49 271 48950-13, Fax : +49 271 48950-50 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (GNU/Linux) iD8DBQFBrIIEpm53PRScYygRAtQ6AKC9JSTTK7mAL+51JSWkTI5U52HtJQCeMvCR gEiUxqi43/pFMD/3dR6hVeE= =MFLP -----END PGP SIGNATURE-----

2 2

Compiling on Solaris
by Didier Gehéniau 01 Dec '04

01 Dec '04

Hi all, The problem i have, i found a lot on the internet. Unfortunatly non of the solutions (if there was one) did nog help. When doing ./configure i get the folowing output: [snip] checking for a BSD-compatible install... auto/install-sh -c checking whether build environment is sane... yes checking whether make sets $(MAKE)... yes checking for working aclocal... found checking for working autoconf... found checking for working automake... found checking for working autoheader... found checking for working makeinfo... found checking build system type... sparc-sun-solaris2.8 checking host system type... sparc-sun-solaris2.8 checking for gcc... gcc checking for C compiler default output... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ANSI C... none needed checking for a BSD-compatible install... auto/install-sh -c checking whether make sets $(MAKE)... (cached) yes checking for ld used by GCC... /usr/ccs/bin/ld checking if the linker (/usr/ccs/bin/ld) is GNU ld... no checking for /usr/ccs/bin/ld option to reload object files... -r checking for BSD-compatible nm... /usr/local/bin/nm -B checking for a sed that does not truncate output... /usr/bin/sed checking whether ln -s works... yes checking how to recognise dependent libraries... pass_all checking command to parse /usr/local/bin/nm -B output... ok checking how to run the C preprocessor... gcc -E checking for egrep... egrep checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking dlfcn.h usability... yes checking dlfcn.h presence... yes checking for dlfcn.h... yes checking for ranlib... ranlib checking for strip... strip checking for objdir... .libs checking for gcc option to produce PIC... -fPIC checking if gcc PIC flag -fPIC works... yes checking if gcc static flag -static works... yes checking if gcc supports -c -o file.o... yes checking if gcc supports -c -o file.lo... yes checking if gcc supports -fno-rtti -fno-exceptions... yes checking whether the linker (/usr/ccs/bin/ld) supports shared libraries... yes checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... yes checking dynamic linker characteristics... solaris2.8 ld.so checking if libtool supports shared libraries... yes checking whether to build shared libraries... yes checking whether to build static libraries... no creating libtool checking for SSL directory... /usr/local/ssl checking for "/dev/urandom"... yes checking whether to disable RSA support... no checking whether to enable DH support... no checking for dlopen in -ldl... yes checking for shl_load in -ldld... no checking for gethostbyname in -lnsl... yes checking for socket in -lsocket... yes checking for pthread_create in -lpthread... yes checking for pthread_create in -lc_r... no checking for openpty in -lutil... no checking whether to use the libwrap (TCP wrappers) library... (default) checking for hosts_access in -lwrap... no checking for RSAref library... no checking for "/dev/ptmx"... yes checking for "/dev/ptc"... no checking grp.h usability... yes checking grp.h presence... yes checking for grp.h... yes checking for unistd.h... (cached) yes checking sys/select.h usability... yes checking sys/select.h presence... yes checking for sys/select.h... yes checking tcpd.h usability... no checking tcpd.h presence... no checking for tcpd.h... no checking pthread.h usability... yes checking pthread.h presence... yes checking for pthread.h... yes checking sys/ioctl.h usability... yes checking sys/ioctl.h presence... yes checking for sys/ioctl.h... yes checking util.h usability... no checking util.h presence... no checking for util.h... no checking pty.h usability... no checking pty.h presence... no checking for pty.h... no checking stropts.h usability... yes checking stropts.h presence... yes checking for stropts.h... yes checking sys/filio.h usability... yes checking sys/filio.h presence... yes checking for sys/filio.h... yes checking sys/resource.h usability... yes checking sys/resource.h presence... yes checking for sys/resource.h... yes checking for snprintf... yes checking for vsnprintf... yes checking for openpty... no checking for _getpty... no checking for daemon... no checking for waitpid... yes checking for wait4... yes checking for sysconf... yes checking for getrlimit... yes checking for pthread_sigmask... yes checking for setgroups... yes checking for localtime_r... yes checking for chroot... yes checking for endhostent... yes checking for setsid... yes checking for unsigned char... yes checking size of unsigned char... configure: error: cannot compute sizeof (unsigned char), 77 See `config.log' for more details. [/snip] I installed gstdint.h and linked stdint.h to it. (should be a solution for some persons) gcc -v gives: [snip] Reading specs from /usr/local/lib/gcc/sparc-sun-solaris2.8/3.4.2/specs Configured with: ../configure --with-as=/usr/ccs/bin/as --with-ld=/usr/ccs/bin/ld --disable-nls Thread model: posix gcc version 3.4.2 [/snip] Anyone an Idee? Regards, Didier

2 1

Re: [stunnel-users] How use certificates with stunnel -- Newbie question
by mtrojnar＠mirt 28 Nov '04

28 Nov '04

Shatadal wrote: I guess there's a client=yes here. > # IMAP service, listens on localhost:1200 > [myisp-imaps] > accept=localhost:1200 > connect=myisp.com:993 Ok. IMAPS port is 993. > # SMTP service, listens on localhost:260 > [myisp-smtps] > accept=localhost:260 > connect=myisp.com:25 You either need to switch from SMTP to SSMTP: [myisp-ssmtp] accept=localhost:260 connect=myisp.com:465 or enable SMTP SSL protocol negotiation: [myisp-smtp-ssl] accept=localhost:260 connect=myisp.com:25 protocol=smtp (whatever is supported by your ISP) Best regards, Mike

2 3

How use certificates with stunnel -- Newbie question
by Shatadal 25 Nov '04

25 Nov '04

Hi, I am a new user of stunnel and I am using it to connect to some SSL enabled e-mail accounts. Instead of directly connecting to the mail server I am connecting to it via stunnel so that my e-mail scanner scan the messages before sending it to the mail server (it does not natively support SSL connections) My setup: OS: Win XP Home edition. All updates are installed except for service pack 2. E-mail client: Mozilla Thunderbird 0.9 E-mail scanner : Alwil Avast 4.5 I have an e-mail account at myisp.com. To connect to myisp I need to enable SSL. On connecting via SSL I get a certificate which I can choose to accept permanently, temporarily for the current session or reject it. Alwil Avast mail scanner does not support scanning of e-mail sent and received over SSL. So to enable it to scan such e-mail, my client connects to localhost where stunnel is listening and stunnel forwards the connection to my isp. This is my stunnel.conf file # IMAP service, listens on localhost:1200 [myisp-imaps] accept=localhost:1200 connect=myisp.com:993 # SMTP service, listens on localhost:260 [myisp-smtps] accept=localhost:260 connect=myisp.com:25 Unfortunately while the IMAP connection works perfectly the SMTP does not. Thunderbird keeps sending the message until I cancel it. This is the log file 2004.11.25 03:10:03 LOG5[2508:3848]: myisp-smtps connected from 127.0.0.1:2751 2004.11.25 03:10:08 LOG3[2508:3848]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2004.11.25 03:11:03 LOG5[2508:192]: myisp-smtps connected from 127.0.0.1:2755 2004.11.25 03:11:08 LOG3[2508:192]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2004.11.25 13:36:40 LOG5[2508:2112]: myisp-smtps connected from 127.0.0.1:4818 2004.11.25 13:36:45 LOG3[2508:2112]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2004.11.25 14:01:44 LOG5[2508:3208]: myisp-smtps connected from 127.0.0.1:1188 2004.11.25 14:01:50 LOG3[2508:3208]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number I am guessing the problem is something to do with the handling of the certificate I get when I use my client to connect directly to the SMTP server via SSL. Can someone explain to me how to make stunnel accept the certificate and continue the SSL transaction? I tried to read through the faq for certificates but I couldn't understand how it was to be done. Thanks, Shatadal. --- avast! Antivirus: Outbound message clean. Virus Database (VPS): 0448-0, 11/23/2004 Tested on: 11/25/2004 3:46:33 PM avast! - copyright (c) 2000-2004 ALWIL Software. http://www.avast.com

1 0

Sercure POP from Outlook Express using Stunnel on a linux server to talk to an exchance server.
by CONN, Aurelia 25 Nov '04

25 Nov '04

Hi I'm just about to investigate setting up a secure pop connection to an exchange server - can anyone point to helpfull resources or say if it can/cannot be done. Using Outlook (Express) as mail client SSL and Stunnel installed on Redhat 9 Mailserver is Exchange 5.5 on Windows NT 4.0 For example, will I have to configure/install on all three boxes? All my initial testing will be done internally so no firewall issues at this stage. Thanks in advance. Oz. ________________________________________________________________________ airwide solutions has changed its email address format to firstname.lastname(a)airwidesolutions.com. Any slb.com email addresses are no longer valid. If you experience difficulty contacting our staff, please email info(a)airwidesolutions.com. ________________________________________________________________________

1 0

SSL Engine patch on Windows?
by Kartik Subbarao 22 Nov '04

22 Nov '04

I'm trying to use stunnel with the SSL Hardware Engine patch (posted by Neil Dunbar to this mailing list in March) on Windows. I apply the patch to the 4.05 codebase and build stunnel with MinGW. I'm able to use stunnel normally without exercising any hardware engine functionality. This tells me that the basics are working. I then run stunnel with the config file containing the following kinds of hardware engine parameters: SSLEngine=c:\windows\system32\engine_pkcs11.dll SSLEngineOpt=MODULE_PATH=c:\windows\system32\acpkcs201.dll But when I run stunnel, I get errors with dynamic library loading like: error stack: 260B6084 : error:260B6084:engine routines:DYNAMIC_LOAD:dso not found And similar errors like that. This gives me the impression that I haven't linked stunnel properly on windows to be able to use OpenSSL dynamic libraries. Or perhaps some other explanation that I don't understand :-) Is it possible to compile stunnel on Windows (either with MinGW or with Visual C++) to be able to use the hardware engine patch? Any pointers/assistance would be greatly appreciated. Thanks, -Kartik

1 3

Faulting application stunnel-4.05.exe
by Paulo Cesar Soares da Silva 18 Nov '04

18 Nov '04

stunnel-4.05.exe executed as a service presents the following problems: Faulting application stunnel-4.05.exe, version 0.0.0.0, faulting module libssl32.dll, version 0.0.0.0, fault address 0x00006cd8. Faulting application stunnel-4.05.exe, version 0.0.0.0, faulting module libeay32.dll, version 0.0.0.0, fault address 0x000564ec. The application, C:\Program Files\Crivo\tn3270\stunnel-4.05.exe, generated an application error The error occurred on 11/10/2004 @ 15:37:13.875 The exception generated was c0000005 at address 6B086CD8 (libssl32!SSL_set_session) Faulting application stunnel-4.05.exe, version 0.0.0.0, faulting module ntdll.dll, version 5.2.3790.0, fault address 0x000086f7. Environment: Hardware IBM 86496BX Dual processor 3 GHz Software OS Name Microsoft(R) Windows(R) Server 2003, Standard Edition , Version 5.2.3790 Build 3790 The following files are in same folder (..\Program Files\Teste\Stunnel) stunnel-4.05.exe, 4.05 libeay32.dll, openssl-0.9.7d-zlib libssl32.dll, openssl-0.9.7d-zlib Comntents of stunnel.conf: client = yes verify = 0 service = stunnel 4.05 options = DONT_INSERT_EMPTY_FRAGMENTS [data] accept = localhost:3500 connect = www.teste.com.br:443 delay = yes I would appreciate if anyone can help me on this? many thanks in advance! Paulo Cesar Soares da Silva (11) 3231-5396 pcesar(a)crivo.com.br --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com) Version: 6.0.794 / Virus Database: 538 - Release Date: 10/11/2004

1 0

List of Distinguished names in Certificate Request message
by Diarmuid O'Neill 17 Nov '04

17 Nov '04

Hi, At the moment, stunnel's client certificate verification implementation does not include any Distinguished Names (of the trusted CA certificates configured) in the Request Certificate message. Strictly speaking this violates RFC2246 (see below, apologies for formatting), but to date I've only seen one client that has a problem with it. Explorer deals with this by displaying all available user certificates. If the Distinguished Names are included in the cert req it only displays client certs signed by the appropriate CAs. The patch below does the necessary openssl bits and pieces to make up the lists of DNs so they're sent with the certificate requests. This has been tested under linux only. 7.4.4. Certificate request When this message will be sent: A non-anonymous server can optionally request a certificate from the client, if appropriate for the selected cipher suite. This message, if sent, will immediately follow the Server Key Exchange message (if it is sent; otherwise, the Server Certificate message). Structure of this message: enum { rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4), (255) } ClientCertificateType; opaque DistinguishedName<1..2^16-1>; struct { ClientCertificateType certificate_types<1..2^8-1>; DistinguishedName certificate_authorities<3..2^16-1>; } CertificateRequest; certificate_types This field is a list of the types of certificates requested, sorted in order of the server's preference. certificate_authorities A list of the distinguished names of acceptable certificate authorities. These distinguished names may specify a desired distinguished name for a root CA or for a subordinate CA; thus, this message can be used both to describe known roots and a desired authorization space. Note: DistinguishedName is derived from [X509]. Note: It is a fatal handshake_failure alert for an anonymous server to request client identification. Thanks, Diarmuid. <<stunnel-4.05_ca_list.patch>> ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the postmaster at the address below. ITS-Support(a)aepsystems.com Unless the contrary is specifically indicated above nothing in this message is intended to constitute an electronic signature within the meaning of the Electronic Commerce Act 2000 or similar legislation enacted elsewhere in the world. This footnote also confirms that this email message has been swept for the presence of computer viruses. *****************************************************************************

2 1

How to run stunnel in client and server mode on the same machine?
by Àëåêñåé Êàìåíåâ Íèêî ëàåâè÷ 17 Nov '04

17 Nov '04

I have a task: ecript traffic for my db server(m1) and www/smtp server(m2) I install stunnel on both machines (m1 and m2) then wrote config files m1: ... client = no ... [mssql] accept=1434 connect=1433 m2: ... client=no ... [smtp] accept=465 connect=25 and m3: some client machine ... client=yes ... [mssql] accept=1433 connect=m1:1434 [smtp] accept=25 connect=m2:465 when I connect to db m3->m1 - ok when I send mail m3->m2 - ok but when I connect to db m2->m1 - failed how configure m2 stunnel to let him work in client and server mode ?

1 0

Log file rotation
by Jalasutram, Srivatsava 16 Nov '04

16 Nov '04

Is there a way in the latest version of stunnel for rotating the log files? Thanks, Sri

1 0

always open VPN channel
by Andrisi 15 Nov '04

15 Nov '04

I'd like to access a PC behind a firewall with VNC. I initiate a link from the PC behind the firewall. This tunnel should always be enabled. Then I use VNCClient on my home PC and connect to localhost:6000 which is linked to the firewalled PC-s VNC server port. Is it possible and if so, how? The server and client roles are a bit mixed up here....

2 1

inetd Solaris Stunnel 4.05
by Kenneth Simpson 12 Nov '04

12 Nov '04

Hi - I'm trying to get stunnel 4.05 to work under inetd on a Solaris x86 platform (and Solaris 8 on a SPARC platform.) The IMAP and POP daemons are verison 2004 from UW (or UW 2001 on a SPARC.) The IMAP client is Thunderbird 0.8. I can connect to IMAP inetd service on port 143 with Thunderbird. When I attempt to connect to IMAP on port 993, I'm presented a self signed certificate, I click OK to accept it, then Thunderbird just hangs. There's no indication in IMAP log file that I've connected - and there doesn't appear to be any indication in the stunnel log file that I've been connected to the IMAP server either. stunnel and the IMAP servers work in the standalone mode. When stunnel is running under inetd, I can telnet to port 143 and port 993. Any help would be greatly appreciated. -- Ken ; stunnel -version stunnel 4.05 on i386-pc-solaris2.8 FORK with OpenSSL 0.9.7d 17 Mar 2004 Global options cert = /usr/stunnel/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /usr/stunnel/etc/stunnel/stunnel.pem pid = /usr/stunnel/var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTidle = 43200 seconds; stunnel -sockets Socket option defaults: Option Accept Local Remote OS default SO_DEBUG -- -- -- 0 SO_DONTROUTE -- -- -- 0 SO_KEEPALIVE -- -- -- 0 SO_LINGER -- -- -- 0:0 SO_OOBINLINE -- -- -- 0 SO_RCVBUF -- -- -- 32768 SO_SNDBUF -- -- -- 32768 SO_RCVLOWAT -- -- -- -- SO_SNDLOWAT -- -- -- -- SO_RCVTIMEO -- -- -- -- SO_SNDTIMEO -- -- -- -- SO_REUSEADDR 1 -- -- 0 IP_TOS -- -- -- 0 IP_TTL -- -- -- 64 TCP_NODELAY -- -- -- 0 ; inetd.conf # imap stream tcp nowait root /usr/imap/sbin/in.imapd /usr/imap/sbin/in.imapd pop3 stream tcp nowait root /usr/imap/sbin/in.pop3d /usr/imap/sbin/in.pop3d # imaps stream tcp nowait root /usr/stunnel/sbin/stunnel /usr/stunnel/sbin/stunnel /usr/stunnel/etc/stunnel.conf pop3s stream tcp nowait root /usr/stunnel/sbin/stunnel /usr/stunnel/sbin/stunnel /usr/stunnel/etc/stunnel.conf ssmtp stream tcp nowait root /usr/stunnel/sbin/stunnel /usr/stunnel/sbin/stunnel /usr/stunnel/etc/stunnel.conf ; stunnel.conf # cert = /usr/openssl/certs/stunnel.pem #chroot = /usr/stunnel/var/run/ #pid=/stunnel.pid pid= setuid = nobody setgid = nogroup debug = local2.7 output = /var/adm/log/stunnel exec = /usr/imap/sbin/in.pop3d execargs = /usr/imap/sbin/in.pop3d exec = /usr/imap/sbin/in.imapd execargs = /usr/imap/sbin/in.imapd exec = /usr/lib/sendmail execargs = /usr/lib/sendmail # # end stunnel.conf # ; log file 2004.11.11 14:52:25 LOG5[7844:0]: stunnel 4.05 on i386-pc-solaris2.8 FORK with OpenSSL 0.9.7d 17 Mar 2004 2004.11.11 14:52:25 LOG7[7844:0]: Snagged 64 random bytes from /dev/urandom 2004.11.11 14:52:25 LOG7[7844:0]: RAND_status claims sufficient entropy for the PRNG 2004.11.11 14:52:25 LOG6[7844:0]: PRNG seeded successfully 2004.11.11 14:52:25 LOG7[7844:0]: Certificate: /usr/openssl/certs/stunnel.pem 2004.11.11 14:52:25 LOG7[7844:0]: Key file: /usr/openssl/certs/stunnel.pem 2004.11.11 14:52:25 LOG7[7844:0]: stunnel started 2004.11.11 14:52:25 LOG5[7844:0]: stunnel connected from 10.0.0.15:58715 2004.11.11 14:52:25 LOG7[7844:0]: SSL state (accept): before/accept initialization 2004.11.11 14:52:25 LOG7[7844:0]: SSL state (accept): SSLv3 read client hello A 2004.11.11 14:52:25 LOG7[7844:0]: SSL state (accept): SSLv3 write server hello A 2004.11.11 14:52:25 LOG7[7844:0]: SSL state (accept): SSLv3 write certificate A 2004.11.11 14:52:25 LOG7[7844:0]: SSL state (accept): SSLv3 write server done A 2004.11.11 14:52:25 LOG7[7844:0]: SSL state (accept): SSLv3 flush data 2004.11.11 14:52:26 LOG7[7844:0]: SSL state (accept): SSLv3 read client key exchange A 2004.11.11 14:52:26 LOG7[7844:0]: SSL state (accept): SSLv3 read finished A 2004.11.11 14:52:26 LOG7[7844:0]: SSL state (accept): SSLv3 write change cipher spec A 2004.11.11 14:52:26 LOG7[7844:0]: SSL state (accept): SSLv3 write finished A 2004.11.11 14:52:26 LOG7[7844:0]: SSL state (accept): SSLv3 flush data 2004.11.11 14:52:26 LOG7[7844:0]: 1 items in the session cache 2004.11.11 14:52:26 LOG7[7844:0]: 0 client connects (SSL_connect()) 2004.11.11 14:52:26 LOG7[7844:0]: 0 client connects that finished 2004.11.11 14:52:26 LOG7[7844:0]: 0 client renegotiatations requested 2004.11.11 14:52:26 LOG7[7844:0]: 1 server connects (SSL_accept()) 2004.11.11 14:52:26 LOG7[7844:0]: 1 server connects that finished 2004.11.11 14:52:26 LOG7[7844:0]: 0 server renegotiatiations requested 2004.11.11 14:52:26 LOG7[7844:0]: 0 session cache hits 2004.11.11 14:52:26 LOG7[7844:0]: 0 session cache misses 2004.11.11 14:52:26 LOG7[7844:0]: 0 session cache timeouts 2004.11.11 14:52:26 LOG6[7844:0]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(2 56) Mac=SHA1 2004.11.11 14:52:26 LOG6[7844:0]: Local mode child started (PID=7845) 2004.11.11 14:52:26 LOG7[7844:0]: Remote FD=7 initialized ; netstat -nr | grep 143 *.143 *.* 0 0 32768 0 LISTEN ; netstat -nr | grep 993 *.993 *.* 0 0 32768 0 LISTEN

2 1

RE: [stunnel-users] SSL Engine patch on Windows?
by Diarmuid O'Neill 11 Nov '04

11 Nov '04

Sorry Kartik, I'm not familiar with Neil Dunbar's patch, and I haven't used stunnel on Windows. Not much use...am I? ;-) Diarmuid. -----Original Message----- From: Kartik Subbarao [mailto:[email protected]] Sent: 11 November 2004 00:33 To: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] SSL Engine patch on Windows? Hi Diarmuid, I saw your response to my message, but I'm not sure what to make of it :-) The problem is not that I don't have the patch -- I do have the patch and have been able to apply it to the code. (BTW the patch that you posted seems to be missing the SSLEngineOpt parameter in Neil Dunbar's patch, which is required for opensc's engine_pkcs11.dll for specifying the vendor-specific PKCS11 library). My problem is that stunnel doesn't seem to be able to have OpenSSL dynamically load the engine DLL. If someone can tell me how to compile stunnel to do this on Windows, or if someone has been able to compile stunnel with the hardware engine patch successfully on Windows and is willing to share, that'd be great. Thanks, -Kartik _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the postmaster at the address below. ITS-Support(a)aepsystems.com Unless the contrary is specifically indicated above nothing in this message is intended to constitute an electronic signature within the meaning of the Electronic Commerce Act 2000 or similar legislation enacted elsewhere in the world. This footnote also confirms that this email message has been swept for the presence of computer viruses. *****************************************************************************

1 0

When the Port is in the URL
by George, Bijoy 10 Nov '04

10 Nov '04

Hello Everyone, I am using stunnel-3.19 and am trying to forward port 12345 on my local machine to a URL that has the following syntax: http://TestBox1:7201/sourceApp/Calculate.do?type=sf I am not sure how to set the stunnel up in this instance, but have failed with the following command: stunnel -c -d localhost:12345 -r TestBox:7201 Can someone please shed some light on my plight! Thanks!

1 0

Stunnel 4.05 engine patch
by Diarmuid O'Neill 10 Nov '04

10 Nov '04

Hi, A couple of people have asked, so here's a patch that should work with stunnel-4.05. Untar the source archive. Copy the patch to the stunnel-4.05 directory. Run patch -p1<stunnel-4.05-engine.diff. Run autoconf (Beware, i have seen make funnies which i think relate to the version of automake 1.4-p2 worked for me, 1.6 did not). Now build as normal. When running ./configure, be sure to include the --enable-ssl-engine option (see ./configure --help). To enable a particular engine, include a line in your conf file "SSLEngine = myengine". Thanks, Diarmuid. <<stunnel-4.05_engine-patch.diff>> ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the postmaster at the address below. ITS-Support(a)aepsystems.com Unless the contrary is specifically indicated above nothing in this message is intended to constitute an electronic signature within the meaning of the Electronic Commerce Act 2000 or similar legislation enacted elsewhere in the world. This footnote also confirms that this email message has been swept for the presence of computer viruses. *****************************************************************************

1 0

Re: [stunnel-users] How to configure Stunnel for ICMP packets?
by Rutger Thomschitz 09 Nov '04

09 Nov '04

> > I have just started using Stunnel 4.04 with OpenSSL. This > > may seem a bit strange, but, I would like to configure > > Stunnel such that it will encrypt all my Ping packets. > > The reason in a nut shell is that I would like to use > > Ping to determine the network overhead added by SSL, as > > part of my research. How can I set up stunnel (i.e. > > stunnel.conf) to tunnel all ICMP (i.e. Ping) packets? > > If you compare ICMP ECHO REQUEST/REPLY to Stunnel in any > way then your research is useless. It's an apples to oranges > comparison. You're comparing ICMP to TCP. > > Better is to compare TCP to TCP. For example, create a client/server > protocol as follows: > > * The TCP connection is established. > * The client sends one integer that is the length of the data, > followed by the data itself. Call this a 'packet' if you will. > * The server reads the integer, followed by the rest of the data, > and sends that data back. > * The client verifies the data was received correctly, and then > procedes to send a new 'packet'. > > > Then you can implement this connection on its own, and then via > Stunnel on both ends, and compare the results. Now you've got > apples-to-apples comparison. > > (Suggest you implement the server as an inetd-started application, > and start it from Stunnel via the 'exec' option, to keep the extra > cleartext TCP connection out of the mix.) > > Side possibilities: > > * Try alternate 'packet sizes' for comparison. > * Try different crypto protocols for comparison. > > > -- > Brian Hatch $it = $it || $another; > Systems and > Security Engineer > http://www.ifokr.org/bri/ Brian, Thank you for the advice and replying so quickly. Since my end goal was to see how additional network overhead due to security affects voice over IP (UDP), are there any other SSL enabled applications similar to Stunnel that supports UDP? (I am looking into Zebedee; however, it of course does not implement SSL.) Thanks again, Rutger Thomschutz -- ___________________________________________________________ Sign-up for Ads Free at Mail.com http://promo.mail.com/adsfreejump.htm

2 1

poll() rather than select() eta (4.0.6?)
by rocco.s 09 Nov '04

09 Nov '04

is stunnel 4.0.6 going to use poll() rather than select() (for more than 500/1024 clients et al) ala http://marc.theaimsgroup.com/?l=stunnel-users&m=108238799929981&w=2 and http://marc.theaimsgroup.com/?l=stunnel-users&m=108081347531925&w=2

2 1

(no subject)
by Edgar Hodge 08 Nov '04

08 Nov '04

un-subscribe stunnel-users(a)mirt.net

1 0

jailed stunnel can't find DNS
by conover＠rahul.net 08 Nov '04

08 Nov '04

My stunnel.conf file looks like: debug = 7 cert = /usr/local/stunnel/etc/stunnel/stunnel.pem chroot = /usr/local/stunnel/var/run/ pid = /stunnel.pid output = stunnel.log CAfile = /usr/local/stunnel/etc/stunnel/certs.pem verify = 3 delay = yes client = yes setuid = stunnel setgid = stunnel . . . and the stunnel.log file: . . . 2004.11.07 16:49:10 LOG7[3794:1025]: smtps started 2004.11.07 16:49:10 LOG5[3794:1025]: smtps connected from 127.0.0.1:1143 2004.11.07 16:49:10 LOG3[3794:1025]: Failed to resolve hostname 'abc.wxyz.net' 2004.11.07 16:49:10 LOG3[3794:1025]: Failed to initialize remote connection 2004.11.07 16:49:10 LOG7[3794:1025]: smtps finished (0 left) Removing chroot in stunnel.conf fixes the problem, but its no longer jailed. Hints? Thanks, John -- John Conover, conover(a)rahul.net, http://www.johncon.com/

3 3

Using qmail with stunnel
by conover＠rahul.net 08 Nov '04

08 Nov '04

Someone ask about using qmail with stunnel. In /var/qmail/control/smtproutes, put: :localhost:12325 Which routes all undeliverable/default email traffic to localhost, port 12325. And in /usr/local/stunnel/etc/stunnel/stunnel.conf, put: [smtps] accept=12325 connect=myremote.com:32125 (man(1) qmail-control(5) for particulars,) so the local stunnel will know what to do with it-route it to myremote.com, port 32125. And in myremote.com's stunnel.conf, put: [smtps] accept=32125 connect=localhost:25 so myremote.com will route it to localhost, port 25, smtp. Works fine on TCP/A?DSL, or a demand dial PPP connection, bringing the telco line up for the email transaction, and then disconnecting, (kind of like UUCP.) If a multi-user dial connection, it is advisable to put the number '1' in /var/qmail/control/concurrencyremote, (without the single quotes,) to throttle the number of concurrent transactions going down the line, else if there are a bunch of messages in qmail's queue when the connection is made, qmail will choke the line with 20, (the default,) concurrent transactions to empty the queue-and no one will be able to get a packet in edgewise down the PPP link. John -- John Conover, conover(a)rahul.net, http://www.johncon.com/

1 0

How to configure Stunnel for ICMP packets?
by Rutger Thomschitz 08 Nov '04

08 Nov '04

Dear group, I have just started using Stunnel 4.04 with OpenSSL. This may seem a bit strange, but, I would like to configure Stunnel such that it will encrypt all my Ping packets. The reason in a nut shell is that I would like to use Ping to determine the network overhead added by SSL, as part of my research. How can I set up stunnel (i.e. stunnel.conf) to tunnel all ICMP (i.e. Ping) packets? Thank you very much in advance. I look forward to any replies. Sincerely, Rutger olds76(a)email.com -- ___________________________________________________________ Sign-up for Ads Free at Mail.com http://promo.mail.com/adsfreejump.htm

2 1

(no subject)
by isidore11 07 Nov '04

07 Nov '04

1 0

RE: [stunnel-users] UDP End-points
by Les Niles 06 Nov '04

06 Nov '04

Pardon my ignorance, but why not run PPP over stunnel and then UDP over that? No new encapsulation to invent. Performance would be lousy, so it would be stupid to use for some streaming media protocol, but for low-bandwidth UDP-based protocols like NTP, DNS, RADIUS, etc. it might well be useful. -les -----Original Message----- From: stunnel-users-bounces(a)mirt.net On Behalf Of Michal Trojnara Subject: Re: [stunnel-users] UDP End-points Leigh, > Perhaps I wasn't quite as clear as I intended.. :) > I'm not suggesting that SSL over UDP should be done.. I'm suggesting > that stunnel could potentially act as a UDP-over-encrypted-TCP > gateway. Okay. Now I understand your idea (I hope). I would have to design a propriatary datagram-over-byte-stream (DOBS) protocol (at least length of UDP packets has to be encoded aside from the content), and then tunnel UDP over DOBS over SSL over TCP. This is why I don't like it: 1. Such tunneling is not very effective. There's a *huge* protocol overhead. 2. It's not standard. One of the main ideas behind stunnel is its interoperability. 3. I think it's much easier to write such encrypting UDP forwarder from scratch using IPSec-style datagram protocol, than to modify stunnel. 4. It breaks my KISS principle. 8-) In fact I would really like to find a time (or a sponsor) to develop such UDP encrypting forwarder. BTW: Maybe it's better to use IPSec or VTUN instead of a proxy? Best regards, Mike

2 1

Stunnel not working with Qmail
by Paul Swainson 06 Nov '04

06 Nov '04

Hi to all list members, I will try to as descriptive as possible about the problem. I have a qmail install and I had used courier for imap, imapssl & pop3dssl. I wanted to implement smtp ssl. I have gone through the stuff at stunnel.org but I don't think its my qmail config that's the problem. This is the first time I have used stunnel, I compiled no probs and before doing so I installed open ssl 0.9.7e I have created a conf for stunnel and here it is: Cat /usr/local/etc/stunnel/smtpsd.conf cert = /usr/local/etc/stunnel/stunnel.pem exec = /var/qmail/bin/qmail-smtpd #******** execargs = /var/qmail/bin/qmail-smtpd mydomain.com /home/vpopmail/bin/vchkpw /usr/bin/true 2>&1 #******** client = yes foreground = yes in the qmail run (smtpsd) script I have amended it to read #!/bin/sh QMAILQUEUE="/var/qmail/bin/qmail-scanner-queue.pl" export QMAILQUEUE QMAILDUID=`id -u vpopmail` NOFILESGID=`id -g vpopmail` MAXSMTPD=`cat /var/qmail/control/concurrencyincoming` LOCAL=`head -1 /var/qmail/control/me` if [ -z "$QMAILDUID" -o -z "$NOFILESGID" -o -z "$MAXSMTPD" -o -z "$LOCAL" ]; then echo QMAILDUID, NOFILESGID, MAXSMTPD, or LOCAL is unset in echo /var/qmail/supervise/qmail-smtpd/run exit 1 fi if [ ! -f /var/qmail/control/rcpthosts ]; then echo "No /var/qmail/control/rcpthosts!" echo "Refusing to start SMTP listener because it'll create an open relay" exit 1 fi exec /usr/local/bin/softlimit -m 40000000 \ /usr/local/bin/tcpserver -v -R -l "$LOCAL" -x /etc/tcp.smtp.cdb -c "$MAXSMTPD" \ -u "$QMAILDUID" -g "$NOFILESGID" 0 465 \ #********* /usr/local/sbin/stunnel /usr/local/etc/stunnel/smtpsd.conf #********* Execargs has in the stunnel conf is the line from smtpd run script, when it runs I don't have any output to the log so I can only assume stunnel is dying before it starts the session. Has anyone got this working? I know that it can but a lot of examples are for pop3ds. If I type stunnel /usr/local/etc/stunnel/smtpsd.conf I get the following error: Unable to open "/dev/cryptonet" Any help on this would be much appreciated, Thanks Regards Paul Swainson

2 1

compressed stunnel?
by jonathan.wilson 06 Nov '04

06 Nov '04

Hi all, I found some references to compression options in openssl.org - specifically to the SSL_COMP_add_compression_method() routine. Is there any way to invoke/use this from stunnel? Thanks, Jonathan Wilson

2 1

Re: stunnel consumes 99% cpu at HPUX
by Gavin Ho 06 Nov '04

06 Nov '04

Mike, thanks for your information. Each of our HPUX machines has 2 CPUs. Actually, before post my problem on this mailing list, I tried to search on Google but can't find any hints to solve the problem. Then I tried to browse the stunnel 4.0.5 source code and can't find any hints too. But I noticed that someone said on some historical newsgroup postings the problem may be related to openssl. Do you think thats true? I will wait for the version 4.0.6 and hope it can solve my problem. Cheers, Gavin -- ___________________________________________________________ Sign-up for Ads Free at Mail.com http://promo.mail.com/adsfreejump.htm

2 1

stunnel consumes 99% cpu at HPUX
by gykho＠ogcio.gov.hk 04 Nov '04

04 Nov '04

Hi All, We set up stunnel from two linux machines located at DMZ to a HPUX cluster located at Private Zone. There is firewall in between. We use stunnel to encrypt Tomcat AJP traffic from apache web servers on linux machines to JBoss app server a HPUX cluster. The stunnel run at HPUX cluster was started as deamon mode and listened on a cluster failover IP instead of host IP. We found that the stunnel process at HPUX cluster consumed 99% CPU after run for a few days (started at Oct 26 10:26 and it was reported 99% CPU at Oct 29 23:00, under a very low traffic. Can anyone help? The debug log at HPUX is also attached, as shown in the log there was no requeset on Oct29 but the CPU still shot up to 99%. Cheers, Gavin Output of "stunnel -version" from Linux side ================================== stunnel 4.04 on i386-redhat-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 Global options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /etc/stunnel/stunnel.pem pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTidle = 43200 seconds Output of "uanme -a" from Linux side =========================== Linux www12-id.spica.hksarg 2.4.21-15.ELsmp #1 SMP Thu Apr 22 00:18:24 EDT 2004 i686 i686 i386 GNU/Linux Output of "gcc -v" from Linux side ======================== Reading specs from /usr/lib/gcc-lib/i386-redhat-linux/3.2.3/specs Configured with: ../configure --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --enable-shared --enable-threads=posix --disable-checking --with-system-zlib --enable-__cxa_atexit --host=i386-redhat-linux Thread model: posix gcc version 3.2.3 20030502 (Red Hat Linux 3.2.3-39) Output of "openssl version" from Linux side =============================== OpenSSL 0.9.7a Feb 19 2003 "stunnel conf" at Linux side ================== chroot = /u01/var/run/stunnel # PID is created inside chroot jail pid = /deptstunnel.pid setuid = nobody setgid = nobody socket=r:SO_KEEPALIVE=1 # Some debugging stuff debug = 7 output = /u01/var/stunnel/deptstunnel.log foreground = no # Use it for client mode client = yes # Service-level configuration [App] accept = localhost:8111 connect = hpux-service-ip:8111 Output of "stunnel -version" from HPUX side ================================ stunnel 4.05 on hppa2.0w-hp-hpux11.11 PTHREAD+LIBWRAP with OpenSSL 0.9.7d 17 Mar 2004 Global options cert = /opt/iexpress/stunnel/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 EGD = /var/run/egd-pool key = /opt/iexpress/stunnel/etc/stunnel/stunnel.pem pid = /opt/iexpress/stunnel/var/run/stunnel.pid RNDbytes = 64 RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTidle = 43200 seconds Output of "uname -a" from HPUX side =========================== HP-UX dptshr1 B.11.11 U 9000/800 2640250230 unlimited-user license Output of "openssl version" from HPUX side =============================== OpenSSL 0.9.7d 17 Mar 2004 "stunnel conf" at HPUX side ================== cert = /u01/etc/stunnel/deptstunnel.cer key = /u01/etc/stunnel/deptstunnel.key chroot = /u01/var/run/stunnel/ # PID is created inside chroot jail pid = /deptstunnel.pid setuid = stunnel setgid = stunnel # Some debugging stuff debug = 7 output = /u01/var/stunnel/deptstunnel.log foreground = no # Use it for client mode #client = yes # Service-level configuration [App] accept = hpux-service-ip:8111 connect = localhost:9111 === ENDS ===

2 1

UDP End-points
by Red Phoenix 03 Nov '04

03 Nov '04

Michal Trojnara mentioned: > On 2004-11-02, at 02:02, Red Phoenix wrote: > > Establishing a SSL connection over UDP would be pretty tough, but has > > anyone thought about the possibility of allowing the 'listen' and > > 'destination' points to be UDP ports, with the main comms routed over > > TCP? This would effectively accomplish what most UDP requestors need. > It's not as easy as you think. SSL requires a stream of data as a > transport. It's much more than a simple UDP forwarder. Perhaps I wasn't quite as clear as I intended.. :) I'm not suggesting that SSL over UDP should be done.. I'm suggesting that stunnel could potentially act as a UDP-over-encrypted-TCP gateway. For example: (For the moment, lets focus on syslog data): Pre-stunnel: Server 1 Sends syslog messages to UDP port 514 on Server 2. Server1 and Server2 both then install stunnel: Server1: Syslog messages are redirected to localhost UDP port 514 (rather than Server2 UDP port 514). Server1: Stunnel listens on UDP port 514, and sends encrypted data to Server2 on TCP port 12345 Server2: Stunnel listens on TCP port 12345, decrypts the data, and sends to localhost UDP port 514. This way, stunnel acts as the UDP to TCP (encrypted) to UDP gateway - in a similar way that it can currently act as a pure TCP -> TCP (encrypted) -> TCP gateway. Regards, Leigh.

3 3

Remove Me
by Lauren Hillquist 03 Nov '04

03 Nov '04

How do I get off this mailing list? Lauren

2 1

OpenSSL 0.9.7e WIN32 binaries
by Michal Trojnara 02 Nov '04

02 Nov '04

Dear Users, I've built WIN32 binaries of the latest OpenSSL library. They're available for download on my ftp site: ftp://stunnel.mirt.net/openssl/binary-0.9.7e-zlib/ Best regards, Mike

1 0

Compilation problem of stunnel-4.05 on solaris 9
by Susan Shao 02 Nov '04

02 Nov '04

hello, I am trying to configure Stunnel-4.05 on Solaris9 and got the some error you posted on the Stunnel list group. But I didn't find any solution to solve this problem on the web. I just wonder if you have solved this and got Stunned installed? I would really appreciate if you can let me know. Thank you!

1 0

UDP end-points
by Red Phoenix 02 Nov '04

02 Nov '04

Establishing a SSL connection over UDP would be pretty tough, but has anyone thought about the possibility of allowing the 'listen' and 'destination' points to be UDP ports, with the main comms routed over TCP? This would effectively accomplish what most UDP requestors need. I was thinking along the lines of: Server1 (source): client = yes [syslogcrypt] # listen on udp port 514 for syslog messages uaccept = 514 # connect to remote stunnel TCP port 5140 connect = 5140 - - - - - Server2 (destination): client = no [syslogcrypt] # listen on 5140 accept = 5140 # connect to local udp port 514 uconnect = 514 Logic would be along the lines of: if client = yes and uconnect is used, then die (or assume they meant tcp). if client = no and uaccept is used, then die (or assume tcp). it should be reasonably easy to add a flag into LOCAL_OPTIONS somewhere, so that it opens a UDP server/client - along the lines of (mangled out of a simple udp server app I wrote): int sockfd,rbind; struct sockaddr_in serv_addr, client_addr; int port,sockopt=1; char buffer[1234]; if((sockfd=socket(AF_INET, SOCK_DGRAM,0))<0) { fprintf(stderr,"UDP Server: errno = %d\n", errno); fprintf(stderr,"Cannot open datagram socket\n"); exit(1); } setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR, &sockopt, sizeof(sockopt)); // check that ports are available, and files exist? bzero((char *) &serv_addr, sizeof(serv_addr)); serv_addr.sin_family = AF_INET; serv_addr.sin_addr.s_addr = htonl(INADDR_ANY); serv_addr.sin_port = htons(portnumber); if((rbind = bind(sockfd, (struct sockaddr *) &serv_addr, sizeof(serv_addr))) < 0) { fprintf(stderr,"Port is not available. Exiting.\n"); exit(2); } while(1) { length=recvfrom(sockfd,buffer,sizeof(buffer)-1,0,(struct sockaddr *) &client_addr,&addrlen); } Any thoughts? Regards, Leigh.

2 1

Re: [stunnel-users] permanent tunnel
by Michal Trojnara 01 Nov '04

01 Nov '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Saturday 30 of October 2004 01:16, Ramin Ali Dousti wrote: > You're right in that I don't have persistent TCP connection. I just > want to make sure that the SSL handshake > does not take place with every short-lived connection. You don't want to negotiate new keys for every connection, right? In SSL there's a mechanism for it called "session cache". In stunnel you can increase the timeout for session cache with "session" option (on both client and sever). Just set it to a very high value (a month? a year?). The default is 300 seconds (5 minutes). Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFBg0Kf/NU+nXTHMtERAl0mAKDODCg+9LwUVoBfx+i6ou7iYmjgcQCfYprS Mv3KKdhQTUcs81yIw/KNT70= =NWHN -----END PGP SIGNATURE-----

2 2

VPN with windows
by Angelo Raspanti 30 Oct '04

30 Oct '04

I have experimented with succes to use stunnel for make a VPN between two PC with linux.It work with start pppd on both sides when the SSL negotiation is termined with success. At this time server and client sides launch the pppd daemon and the connecction with IP address read from pppd command line (written in config file of stunnel) is made. To make a VPN with two linux BOX is easily ! But if one of the two sides is a Windows plattaform ? I think that the use of this tecnique is noot possible. How to make un VPN between a Linux Plattaform and a Windows plattaform ? Is possible ? Thanks in advance and sorry for my bad english

1 0

RE: [stunnel-users] Stunnel & Java SSL
by richard＠oversight.co.nz 30 Oct '04

30 Oct '04

Managed to sort this issue out by upgrading my JVM to 1.5.0 and adding the certificated in under the Java control panel. Ran into another problem afterwards with my application generating an UNKNOWN PROTOCOL error on the 3rd TCP session after successfully accepting the first two... very strange. I think I'm going to have to give up on the idea of using Java's or IE's SSL system and use Stunnel as a client too. Found a great GUI for Stunnel on Mac OS X called SSL Enabler, shame theres not one as nice for Windows! Richard Watson > Upgrade your OpenSSL package for a start... it's up to .9.7d, tho I use > .9.7a. Re-compile OpenSSL on your machine... try then. > > Did you download a binary of STunnel? > > -----Original Message----- > From: stunnel-users-bounces(a)mirt.net > [mailto:[email protected]] On Behalf Of > richard(a)oversight.co.nz > Sent: Friday, 29 October 2004 11:47 a.m. > To: stunnel-users(a)mirt.net > Subject: [stunnel-users] Stunnel & Java SSL > > I'm developing a website where a java applet is downloaded over an > https session provided by Stunnel (stunnel 4.04 on i586-pc-linux-gnu > PTHREAD with OpenSSL 0.9.6c 21 dec 2001) running on port 1080. > The applet codebase in the html code is set to > https://x.x.x.x:1080/xxxx.jar > > To complicate this issue, Stunnel is set to verify=3 i.e. it requires a > valid client certificate. > It seems that the java implementation of SSL (JVM 1.4.1_03) won't > respond to prompts for client certificates?? > Stunnel simply times out with the following error.... > > 2004.10.29 11:45:34 LOG7[6881:1024]: service accepted FD=10 from > 192.168.1.2:19302004.10.29 11:45:34 LOG7[6881:1024]: FD 10 in > non-blocking mode > 2004.10.29 11:45:34 LOG7[6897:6146]: service finished (0 left) > 2004.10.29 11:45:34 LOG7[6898:7171]: service started > 2004.10.29 11:45:34 LOG5[6898:7171]: service connected from > 192.168.1.2:1930 2004.10.29 11:45:34 LOG7[6898:7171]: SSL state > (accept): before/accept initialization2004.10.29 11:45:34 > LOG7[6898:7171]: waitforsocket: FD=10, DIR=read > 2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: ok > 2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): SSLv3 read > client hello A2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): > SSLv3 write server hello A2004.10.29 11:45:39 LOG7[6898:7171]: SSL > state (accept): SSLv3 write > certificate A2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): > SSLv3 write > certificate request A2004.10.29 11:45:39 LOG7[6898:7171]: SSL state > (accept): SSLv3 flush data > 2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: FD=10, DIR=read > 2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: ok > 2004.10.29 11:45:39 LOG7[6898:7171]: SSL alert (read): warning: no > certificate2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: FD=10, > DIR=read > 2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: ok > 2004.10.29 11:45:39 LOG7[6898:7171]: SSL alert (write): fatal: > handshake failure2004.10.29 11:45:39 LOG3[6898:7171]: SSL_accept: > 140890C7: > error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not > return a certificate2004.10.29 11:45:39 LOG7[6898:7171]: service > finished (0 left) > > Does anyone know a way around this? > > Thank you, > > Richard Watson > > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

permanent tunnel
by Ramin Dousti 29 Oct '04

29 Oct '04

Hello, I'd like to set up an stunnel between two hosts which currently talk to each other unencrypted. The communication between these two hosts is HTTP and sporadic. What I'd like to achieve is a permanent stunnel between the hosts regardless of their communiucation pattern. Is this possible? And if yes, how? The current setup utilizes stunnel in server mode on the server side and stunnel in client mode on the client side. When a client issues a request, I see that an SSL tunnel is set up between the hosts and after the reception of the reply, the SSL tunnel is torn down. So, the question is, how can I nail down the SSL tunnel to be permanent? Thank you in advance, Ramin

2 1

SSL read returned WANT_: retrying
by Hacker, Dietmar 29 Oct '04

29 Oct '04

Has anybody a solution to this problem ? There was a thread about this msg in June. I am using a central Source staging server for my windows applications accessed via stunnel from remote over a Linux stunnel on the Internet gateway. Centrally I use SuSE Linux 8.2 with stunnel 4.04 and on the clients the current 4.05 windows binary version (also does not work with the older 4.04 windows binary version). The "SourceSave" Software does a directory comparision and then a download of all changed components. Without stunnel no problem. With stunnel after some traffic I always get "SSL returned WANT_: retrying" in the stunnel window and then the software stops downloading. Mit freundlichen Gruessen / With regards Dipl. Ing. Dietmar Hacker Grazer Wechselseitige Versicherung AG A-8010 Graz, Herrengasse 18-20 Tel.: +43 (316) 8037-256 Fax.: +43 (316) 8037-1256 mailto:[email protected]

2 1

Stunnel & Java SSL
by richard＠oversight.co.nz 28 Oct '04

28 Oct '04

I'm developing a website where a java applet is downloaded over an https session provided by Stunnel (stunnel 4.04 on i586-pc-linux-gnu PTHREAD with OpenSSL 0.9.6c 21 dec 2001) running on port 1080. The applet codebase in the html code is set to https://x.x.x.x:1080/xxxx.jar To complicate this issue, Stunnel is set to verify=3 i.e. it requires a valid client certificate. It seems that the java implementation of SSL (JVM 1.4.1_03) won't respond to prompts for client certificates?? Stunnel simply times out with the following error.... 2004.10.29 11:45:34 LOG7[6881:1024]: service accepted FD=10 from 192.168.1.2:19302004.10.29 11:45:34 LOG7[6881:1024]: FD 10 in non-blocking mode 2004.10.29 11:45:34 LOG7[6897:6146]: service finished (0 left) 2004.10.29 11:45:34 LOG7[6898:7171]: service started 2004.10.29 11:45:34 LOG5[6898:7171]: service connected from 192.168.1.2:1930 2004.10.29 11:45:34 LOG7[6898:7171]: SSL state (accept): before/accept initialization2004.10.29 11:45:34 LOG7[6898:7171]: waitforsocket: FD=10, DIR=read 2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: ok 2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): SSLv3 read client hello A2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): SSLv3 write server hello A2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): SSLv3 write certificate A2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): SSLv3 write certificate request A2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): SSLv3 flush data 2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: FD=10, DIR=read 2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: ok 2004.10.29 11:45:39 LOG7[6898:7171]: SSL alert (read): warning: no certificate2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: FD=10, DIR=read 2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: ok 2004.10.29 11:45:39 LOG7[6898:7171]: SSL alert (write): fatal: handshake failure2004.10.29 11:45:39 LOG3[6898:7171]: SSL_accept: 140890C7: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate2004.10.29 11:45:39 LOG7[6898:7171]: service finished (0 left) Does anyone know a way around this? Thank you, Richard Watson

1 0

Session resumption
by Rick Cone, Secure Payment Systems 27 Oct '04

27 Oct '04

I use Stunnel 4.03 I have been working on a project with some slow POS equipment trying to do SSL connections. Because of the slow processors on these devices, we are trying to speed up the connection and transaction. The concept of "session resumption" came up. What is the best way to setup Stunnel to make subsequent connections faster with session resumption. Thanks, Rick Cone Secure Payment Systems 801 8th St. #150-D Greeley, CO 80631 970-352-9434 (office) 970-352-0122 (fax, call office first) rcone(a)securepaymentsystems.com Note: This electronic message and attachments, if any, contain information which is intended solely for the designated recipients. Unauthorized disclosure, copying, distribution, or other use of the contents of this message or attachments, in whole or in part, is prohibited without express authorization of the author of this message.

2 1

Connection crypted with pppd
by angelo.raspanti 27 Oct '04

27 Oct '04

Mike wrote >Using chroot with exec is not trivial. Please make sure you know what >your're trying to do. 8-) OK, i have skip this argument, now i study better it and retry with a new configuration. Thanks

1 0

Outlook has problems with sending email
by Kenneth Simpson 27 Oct '04

27 Oct '04

Hi - I'm having problems with Stunnel 4.05 and Outlook - but not with Mozilla/Thunderbird. Unfortantely, most of our users use Outlook from Office 2000 and Office XP. The problem is Outlook can't send email when using SIMAP/SSMTP. If the remote users set their SMTP server to be their ISP, then Outlook doesn't have a problem. It suggests a sendmail issue except Mozilla/Thunderbird work fine. How do most people configure stunnel for Outlook? We're behind a screening router and port 587 - the so-called sendmail "submission" port - is currently closed. All ICMP is administratively disabled for this host at the router. But sendmail on this particular host is configured for port 587 behind the firewall. Is there a need to configure stunnel for port 587 too? We're using OpenSSL 0.9.7d Sendmail 8.12.10 Stunnel 4.0.5 SPARC Solaris 5.8 Enclosed is the stunnel.conf file. Under version 3.x roughly year ago things appeared to be working correctly - but we've upgraded both sendmail and SSL since then - and our users where migrating from Outlook Express to Outlook. Any ideas? I've added the options options = DONT_INSERT_EMPTY_FRAGMENTS TIMEOUTbusy = 300 TIMEOUTclose = 60 TIMEOUTidle = 43200 but no help. Any help would greatly appreciated! -- Ken

2 1

Stunnel process die-off halfway
by PinLee_Su＠azuretech.com.sg 27 Oct '04

27 Oct '04

I have downloaded and installed the stunnel-4.05.exe together with the libssl32.dll and libeay32.dll from stunnel.org. I am able to start the stunnel without problem. however after the a while the process die-off automatically. check the event log in the windows (using Windows XP), it gives error msg as "Faulting application stunnel-4-05.exe, version 0.0.0.0, faulting module libssl32.dll, version 0.0.0.0, fault address 0x00006cd8." I would appreciate if anyone can help me on this? many thanks in advance!

1 0

(no subject)
by PinLee_Su＠azuretech.com.sg 27 Oct '04

27 Oct '04

I have downloaded and installed the stunnel-4.05.exe together with the libssl32.dll and libeay32.dll from stunnel.org. I am able to start the stunnel without problem. however after the a while the process die-off automatically. check the event log in the windows (using Windows XP), it gives error msg as "Faulting application stunnel-4-05.exe, version 0.0.0.0, faulting module libssl32.dll, version 0.0.0.0, fault address 0x00006cd8." I would appreciate if anyone can help me on this? many thanks in advance!

1 0

Connection crypted with pppd
by angelo.raspanti 27 Oct '04

27 Oct '04

I have a problem using stunnel v 4.05 under Linux with kernel 2.4.27. My target is using two PC connected via serial port with trafic crypted. I have achieved this schema: +-------+ +-------+ | | | | | PC1 |------------rs232---------| PC2 | | |10.0.0.1 10.0.0.2| | | | | | +-------+ +-------+ I have started pppd in raw mode in PC1 and PC2 and i have verified (with ping)that the link is OK for trafic without criptyng. Below i have tried to "mount" a tunnel cripted between PC1 and PC2 but stunnel server side return an error in openpty function. The stunnel.conf server side (PC1) is: -------------------------------------- cert = /usr/local/etc/stunnel/stunnel.pem chroot = /var/run/stunnel/ pid = setuid = nobody setgid = nobody # Some debugging stuff debug = 7 output = /var/log/stunnel.log foreground=no # Service-level configuration [ppp] accept = 2020 exec = /usr/sbin/pppd execargs = pppd local pty = yes The stunnel.conf client side (PC2) is: -------------------------------------- cert = /usr/local/etc/stunnel/stunnel.pem chroot = /var/run/stunnel/ pid = setuid = nobody setgid = nobody # Some debugging stuff debug = 7 output = /var/log/stunnel.log # Use it for client mode client = yes connect = 10.0.0.1:2020 exec = /usr/sbin/pppd execargs = pppd local The log file server side (PC1) is: ---------------------------------- 2004.10.27 07:25:19 LOG5[5246:16384]: stunnel 4.05 on i686-pc-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 2004.10.27 07:25:19 LOG7[5246:16384]: RAND_status claims sufficient entropy for the PRNG 2004.10.27 07:25:19 LOG6[5246:16384]: PRNG seeded successfully 2004.10.27 07:25:19 LOG7[5246:16384]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2004.10.27 07:25:19 LOG7[5246:16384]: Key file: /usr/local/etc/stunnel/stunnel.pem 2004.10.27 07:25:19 LOG5[5246:16384]: FD_SETSIZE=1024, file ulimit=1024 -> 500 clients allowed 2004.10.27 07:25:19 LOG7[5246:16384]: FD 4 in non-blocking mode 2004.10.27 07:25:19 LOG7[5246:16384]: SO_REUSEADDR option set on accept socket 2004.10.27 07:25:19 LOG7[5246:16384]: ppp bound to 0.0.0.0:2020 2004.10.27 07:25:19 LOG7[5246:16384]: FD 5 in non-blocking mode 2004.10.27 07:25:19 LOG7[5246:16384]: FD 6 in non-blocking mode 2004.10.27 07:25:19 LOG7[5247:16384]: No pid file being created 2004.10.27 07:25:59 LOG7[5247:16384]: ppp accepted FD=7 from 10.0.0.2:39791 2004.10.27 07:25:59 LOG7[5247:16384]: FD 7 in non-blocking mode 2004.10.27 07:25:59 LOG7[5251:16386]: ppp started 2004.10.27 07:25:59 LOG5[5251:16386]: ppp connected from 10.0.0.2:39791 2004.10.27 07:25:59 LOG7[5251:16386]: SSL state (accept): before/accept initialization 2004.10.27 07:25:59 LOG7[5251:16386]: waitforsocket: FD=7, DIR=read 2004.10.27 07:25:59 LOG7[5251:16386]: waitforsocket: ok 2004.10.27 07:25:59 LOG7[5251:16386]: SSL state (accept): SSLv3 read client hello A 2004.10.27 07:25:59 LOG7[5251:16386]: SSL state (accept): SSLv3 write server hello A 2004.10.27 07:25:59 LOG7[5251:16386]: SSL state (accept): SSLv3 write certificate A 2004.10.27 07:25:59 LOG7[5251:16386]: SSL state (accept): SSLv3 write server done A 2004.10.27 07:25:59 LOG7[5251:16386]: SSL state (accept): SSLv3 flush data 2004.10.27 07:25:59 LOG7[5251:16386]: waitforsocket: FD=7, DIR=read 2004.10.27 07:26:00 LOG7[5251:16386]: waitforsocket: ok 2004.10.27 07:26:00 LOG7[5251:16386]: SSL state (accept): SSLv3 read client key exchange A 2004.10.27 07:26:00 LOG7[5251:16386]: SSL state (accept): SSLv3 read finished A 2004.10.27 07:26:00 LOG7[5251:16386]: SSL state (accept): SSLv3 write change cipher spec A 2004.10.27 07:26:00 LOG7[5251:16386]: SSL state (accept): SSLv3 write finished A 2004.10.27 07:26:00 LOG7[5251:16386]: SSL state (accept): SSLv3 flush data 2004.10.27 07:26:00 LOG7[5251:16386]: 1 items in the session cache 2004.10.27 07:26:00 LOG7[5251:16386]: 0 client connects (SSL_connect()) 2004.10.27 07:26:00 LOG7[5251:16386]: 0 client connects that finished 2004.10.27 07:26:00 LOG7[5251:16386]: 0 client renegotiatations requested 2004.10.27 07:26:00 LOG7[5251:16386]: 1 server connects (SSL_accept()) 2004.10.27 07:26:00 LOG7[5251:16386]: 1 server connects that finished 2004.10.27 07:26:00 LOG7[5251:16386]: 0 server renegotiatiations requested 2004.10.27 07:26:00 LOG7[5251:16386]: 0 session cache hits 2004.10.27 07:26:00 LOG7[5251:16386]: 0 session cache misses 2004.10.27 07:26:00 LOG7[5251:16386]: 0 session cache timeouts 2004.10.27 07:26:00 LOG6[5251:16386]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2004.10.27 07:26:00 LOG7[5251:16386]: pty_allocate:namebuf=, namebuflen=1024 : Success (0) 2004.10.27 07:26:00 LOG3[5251:16386]: openpty: No such file or directory (2) 2004.10.27 07:26:00 LOG3[5251:16386]: Failed to initialize remote connection 2004.10.27 07:26:00 LOG7[5251:16386]: ppp finished (0 left) The log file client side (PC2) is: ---------------------------------- 2004.10.27 07:20:16 LOG5[4460:16384]: stunnel 4.05 on i686-pc-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 2004.10.27 07:20:16 LOG7[4460:16384]: RAND_status claims sufficient entropy for the PRNG 2004.10.27 07:20:16 LOG6[4460:16384]: PRNG seeded successfully 2004.10.27 07:20:16 LOG7[4460:16384]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2004.10.27 07:20:16 LOG7[4460:16384]: Key file: /usr/local/etc/stunnel/stunnel.pem 2004.10.27 07:20:16 LOG7[4460:16384]: stunnel started 2004.10.27 07:20:16 LOG6[4460:16384]: Local mode child started (PID=4461) 2004.10.27 07:20:16 LOG5[4460:16384]: stunnel connected from 127.0.0.1:39790 2004.10.27 07:20:16 LOG7[4460:16384]: FD 4 in non-blocking mode 2004.10.27 07:20:16 LOG7[4460:16384]: stunnel connecting 10.0.0.1:2020 2004.10.27 07:20:16 LOG7[4460:16384]: remote connect #1: EINPROGRESS: retrying 2004.10.27 07:20:16 LOG7[4460:16384]: waitforsocket: FD=4, DIR=write 2004.10.27 07:20:16 LOG3[4461:16384]: /usr/sbin/pppd: No such file or directory (2) 2004.10.27 07:20:16 LOG7[4460:16384]: waitforsocket: ok 2004.10.27 07:20:16 LOG7[4460:16384]: Remote FD=4 initialized 2004.10.27 07:20:16 LOG7[4460:16384]: SSL state (connect): before/connect initialization 2004.10.27 07:20:16 LOG7[4460:16384]: SSL state (connect): SSLv3 write client hello A 2004.10.27 07:20:16 LOG7[4460:16384]: waitforsocket: FD=4, DIR=read 2004.10.27 07:20:17 LOG7[4460:16384]: waitforsocket: ok 2004.10.27 07:20:17 LOG7[4460:16384]: SSL state (connect): SSLv3 read server hello A 2004.10.27 07:20:17 LOG7[4460:16384]: SSL state (connect): SSLv3 read server certificate A 2004.10.27 07:20:17 LOG7[4460:16384]: SSL state (connect): SSLv3 read server done A 2004.10.27 07:20:17 LOG7[4460:16384]: SSL state (connect): SSLv3 write client key exchange A 2004.10.27 07:20:17 LOG7[4460:16384]: SSL state (connect): SSLv3 write change cipher spec A 2004.10.27 07:20:17 LOG7[4460:16384]: SSL state (connect): SSLv3 write finished A 2004.10.27 07:20:17 LOG7[4460:16384]: SSL state (connect): SSLv3 flush data 2004.10.27 07:20:17 LOG7[4460:16384]: waitforsocket: FD=4, DIR=read 2004.10.27 07:20:17 LOG7[4460:16384]: waitforsocket: ok 2004.10.27 07:20:17 LOG7[4460:16384]: SSL state (connect): SSLv3 read finished A 2004.10.27 07:20:17 LOG7[4460:16384]: 1 items in the session cache 2004.10.27 07:20:17 LOG7[4460:16384]: 1 client connects (SSL_connect()) 2004.10.27 07:20:17 LOG7[4460:16384]: 1 client connects that finished 2004.10.27 07:20:17 LOG7[4460:16384]: 0 client renegotiatations requested 2004.10.27 07:20:17 LOG7[4460:16384]: 0 server connects (SSL_accept()) 2004.10.27 07:20:17 LOG7[4460:16384]: 0 server connects that finished 2004.10.27 07:20:17 LOG7[4460:16384]: 0 server renegotiatiations requested 2004.10.27 07:20:17 LOG7[4460:16384]: 0 session cache hits 2004.10.27 07:20:17 LOG7[4460:16384]: 0 session cache misses 2004.10.27 07:20:17 LOG7[4460:16384]: 0 session cache timeouts 2004.10.27 07:20:17 LOG6[4460:16384]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2004.10.27 07:20:17 LOG7[4460:16384]: Socket closed on read 2004.10.27 07:20:17 LOG7[4460:16384]: SSL write shutdown (output buffer empty) 2004.10.27 07:20:17 LOG7[4460:16384]: SSL alert (write): warning: close notify 2004.10.27 07:20:17 LOG7[4460:16384]: SSL_shutdown retrying 2004.10.27 07:20:17 LOG3[4460:16384]: SSL_read (ERROR_SYSCALL): Connection reset by peer (104) 2004.10.27 07:20:17 LOG5[4460:16384]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2004.10.27 07:20:17 LOG7[4460:16384]: stunnel finished (0 left) Any suggestion ? Thanks in advance.. Angelo Raspanti

2 1

Stunnel process die-off halfway
by PinLee_Su＠azuretech.com.sg 25 Oct '04

25 Oct '04

I have downloaded and installed the stunnel-4.05.exe together with the libssl32.dll and libeay32.dll from stunnel.org. I am able to start the stunnel without problem. however after the a while the process die-off automatically. check the event log in the windows (using Windows XP), it gives error msg as "Faulting application stunnel-4-05.exe, version 0.0.0.0, faulting module libssl32.dll, version 0.0.0.0, fault address 0x00006cd8." I would appreciate if anyone can help me on this? many thanks in advance! "Azure Technologies is the IT solutions provider of Hutchison Whampoa Limited and a member of Hutchison Global Communications Holdings Limited." The message is for information purposes only and is not intended to create legally binding relations. The shareholders, directors and management of Azure Technologies and any of its group companies accept no responsibility and accordingly shall have no liability to any party whatsoever with respect to the contents of this message. This message (including any attachments) is intended only for the use of the addressee(s) named above. It may contain information that is PRIVILEGED and CONFIDENTIAL and should not be read, copied or otherwise used by any other person. If you are not the intended recipient, please erase all copies of the message (including attachments) and notify us immediately.

1 0

Compiling v4.05 from source
by Ed Vazquez 23 Oct '04

23 Oct '04

On an up-to-date version of Linux, I get this error following a successful config: $ make Making all in src make[1]: Entering directory `/g/vs-build/stunnel-4.05/src' Makefile:404: warning: overriding commands for target `stunnel.exe' Makefile:265: warning: ignoring old commands for target `stunnel.exe' cd .. && automake --gnu --include-deps src/Makefile configure.ac:5: your implementation of AM_INIT_AUTOMAKE comes from an configure.ac:5: old Automake version. You should recreate aclocal.m4 configure.ac:5: with aclocal and run automake again. src/Makefile.am: required file `auto/depcomp' not found /usr/share/automake-1.9/am/depend2.am: am__fastdepCC does not appear in AM_CONDITIONAL /usr/share/automake-1.9/am/depend2.am: AMDEP does not appear in AM_CONDITIONAL make[1]: *** [Makefile.in] Error 63 make[1]: Leaving directory `/g/vs-build/stunnel-4.05/src' make: *** [all-recursive] Error 1 After running aclocal (completes with no errors), I re-run configure and try to make again: $ make Making all in src make[1]: Entering directory `/g/vs-build/stunnel-4.05/src' Makefile:404: warning: overriding commands for target `stunnel' Makefile:265: warning: ignoring old commands for target `stunnel' cd .. && automake-1.9 --gnu --include-deps src/Makefile src/Makefile.am: required file `auto/depcomp' not found make[1]: *** [Makefile.in] Error 1 make[1]: Leaving directory `/g/vs-build/stunnel-4.05/src' make: *** [all-recursive] Error 1 Ideas? Suggestions? Did I screw something up? Ed Vazquez To speak ill of others is a dishonest way of praising ourselves. . . let us be above such transparent egotism. - Will Durant

2 1

stunnel with SHOUTcast
by grimholtz＠mailbolt.com 20 Oct '04

20 Oct '04

Anyone gotten stunel to work with SHOUTcast or another streaming audio server? Regards, Eric Jung

3 2

stunnel with netcat.
by Graeme Stewart 19 Oct '04

19 Oct '04

I'm hoping someone on this list will take the time to help me. I apologize for the newbie nature of this question. I'm trying to create an SSL stunnel connection to an https URL then utilize netcat to send requests through that previously established link. I believe this should be possible. My configuration file includes: verify=0 client=yes [https] accept=localhost:8080 connect=www.remotesite.com:443 TIMEOUTEclose=0 transparent=yes Whenever I run: # stunnel stunnel.config # nc -vv localhost 8080 I receive a connection refused error from netcat. Could someone point me in the right direction? I did review the examples on stunnel.org but they all seem to reference an earlier version of stunnel. Thanks, Graeme

2 5

any way to search the archives?
by grimholtz＠mailbolt.com 19 Oct '04

19 Oct '04

Hi, Is there any way to search the archives at http://mirt.net/pipermail/stunnel-users/ or do I just have to go through them manually? Thank you for any reply, Eric Jung

2 1

Stunnel and streaming audio
by grimholtz＠mailbolt.com 19 Oct '04

19 Oct '04

Hi, I'm using stunnel 4.05 on Windows 2000 for both client and server. I have VNC working just fine over port 443. Now I want to stream audio from the server to the client over port 21 with stunnel and any streaming audio server. I can't get this to work. I'm currently using Windows Media Encoder for streaming because it is simple and free, but I don't mind switching to SHOUTcast or something else. This is the stunnel server configuration: CAfile = CAcert.pem CApath = certificates cert = server.pem client = no verify = 3 [vnc] accept = 443 connect = 127.0.0.1:15351 [audiostream] accept = 21 connect = 127.0.0.1:80 On the client-side, I have this configuration: CAfile = CAcert.pem CApath = certificates cert = client.pem client = yes verify = 3 [vnc] accept = 127.0.0.1:15351 connect = someurl.com:443 [audiostream] accept = 127.0.0.1:80 connect = someurl.com:21 VNC works fine but streaming audio does not. It doesn't matter if I change port 21 to something else; I get the same error. The output on the server-side stunnel console is: 2004.10.18 13:16:02 LOG5[2036:1732]: audiostream connected from xxx.xxx.xxx.xxx:59090 The output on the client-side stunnel console is: 2004.10.18 13:21:07 LOG5[1088:1300]: audiostream connected from 127.0.0.1:1467 2004.10.18 13:21:07 LOG3[1088:1300]: SSL_connect: Peer suddenly disconnected stunnel -version on the server-side displays this info: stunnel 4.05 on x86-pc-mingw32-gnu WIN32 with OpenSSL 0.9.7d 17 Mar 2004 Global options cert = stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = stunnel.pem RNDbytes = 64 RNDoverwrite = yes service = stunnel session = 300 seconds taskbar = yes verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTidle = 43200 seconds 2004.10.18 20:47:05 LOG3[1316:2092]: Server is down openssl version on the server-side displays this info: OpenSSL 0.9.7d 17 Mar 2004 Anyone have ideas? Thank you in advance for any advice, Eric Jung

1 0

Client certificates still valid after removal with verify = 3
by Michael Brown 18 Oct '04

18 Oct '04

I'm having a problem with my stunnel 4.05 setup: We are using a setup where each client that connects has to have a valid certificate present on the filesystem (verify = 3). After the client connects once, it seems that the certificate is cached by either the SSL libraries or stunnel: stunnel.conf: <<< cert = /etc/stunnel/servercert.pem CAfile = /usr/share/ssl/CA/cacert.pem CApath = /etc/stunnel/clientdb verify = 3 [https] accept = 443 connect = remote.server.name:443 local = 192.168.0.6 >>> Some output: Oct 15 19:36:34 machine stunnel[14139]: VERIFY OK: depth=1, /C=CA/ST=Ontario/L=Here/O=Us/OU=Bigwigs/CN=CA Cert/emailAddress=certainly(a)here.com Oct 15 19:36:34 fruitfly stunnel[14139]: VERIFY OK: depth=0, /C=CA/ST=Ontario/O=Us/OU=slackers anonymous/CN=Daniel Unceman/emailAddress=dunce(a)here.com ... and the same thing after I remove the hash link in /etc/stunnel/clientdb. But only after I restart does it to the right thing: Oct 15 19:40:24 fruitfly stunnel[15247]: VERIFY OK: depth=1, /C=CA/ST=Ontario/L=Here/O=Us/OU=Bigwigs/CN=CA Cert/emailAddress=certainly(a)here.com Oct 15 19:40:24 fruitfly stunnel[15247]: VERIFY ERROR ONLY MY: no cert for /C=CA/ST=Ontario/O=Us/OU=slackers anonymous/CN=Daniel Unceman/emailAddress=dunce(a)here.com Help! We don't want to have to restart stunnel every time we remove a user. Thanks, Michael Brown -- Michael Brown {0x527670C0} | `One of the main causes of the fall of Systems Administrator | the Roman Empire was that, lacking zero, +1 519 888 7111 x2339 | they had no way to indicate successful michaelb(a)opentext.com | termination of their C programs.' - Firth

2 1

New feature
by Michal Trojnara 18 Oct '04

18 Oct '04

Dear Users, New line in stunnel 4.06 ChangeLog: - Multiple connect=host:port options are allowed in a single service section. Remote hosts are connected using round-robin algorithm. What do you think? Best regards, Mike

7 9

Using stunnel with HTTP as server and client
by Wayne A Collins 14 Oct '04

14 Oct '04

I am new to the product and encryption as well, but am looking for some unix examples using with an HTTP client and a server to communicate with HTTP/S applications. I have looked through the archives, but they only go back 3 months. I know this has had to have been done many times but am missing something. Thanks, Wayne A. Collins IBM Global Services IT Architect, eBI - Communications & Public Sectors wacollin(a)us.ibm.com 941-792-0448 Office 800-759-8888 Pin # 1019403 Pager

3 2

Re: Problem running Stunnel
by Olivier Kaloudoff 13 Oct '04

13 Oct '04

Hi Robert, > When I run stunnel nothing seems to be happening. The terminal > accepts the command but does nothing. The log file doesn't produce any > output either nor does running stunnel in the foreground. (...) > What is meant to happen when I run stunnel, is there a way that I > can test if it is working. I previously tested imapd using telnet 0 143. > I'm using this > http://www.stepwise.com/Articles/Workbench/eart.4.0.html > article but its out of date, uses 3.x command line inputs, so I've tried > to convert those to the config file. put the following in your stunnel.conf to have useful debugging informations for 4.x: # Some debugging stuff debug = 7 output = /tmp/stunnel.log # comment out pid = line, that causes problems. # (to be re-enabled later if you need) # pid = /tmp/stunnel.pid launch your stunnel process with the following: stunnel stunnel.conf and watch your logfile at the same time: tail -f /tmp/stunnel.log Regards, Olivier

1 0

Stunnel V4.05 error with rsync
by craig hobbs 12 Oct '04

12 Oct '04

Hello, I am using stunnel v4.05 with rsync v2.6.0 and solaris9 as both my client and server machine. I am running rsync in daemon mode on the server and starting an rsync transfer on the client. I am getting a frequent error where my rsync client process just appears to hang. On the client side I will receive several 'SSL_read returned WANT_: retrying/SSL_write returned WANT_: retrying' messages back-to-back and then finally the message is always 'Socket closed on read'. Some data does get transferred but it appears from the messages that the socket looses its connection, and the the rsync process just hangs until time-out. Currently in no-blocking mode with the following limits: FD_SETSIZE=1024, file ulimit=2147483647 -> 500 clients allowed Is there any stunnel bug or system resource limit that could be the problem ?? Thanks for the help. ~Craig stunnel.conf file example from client: # Sample stunnel configuration file # Copyright by Michal Trojnara 2002 # Comment it out on Win32 cert = /usr/local/etc/stunnel/stunnel.pem #chroot = /usr/local/var/run/stunnel/ # PID is created inside chroot jail pid = /var/tmp/stunnel.pid #setuid = nobody #setgid = nogroup # Some debugging stuff debug = 7 output = /var/tmp/stunnel.log foreground = yes # Use it for client mode client = yes # Service-level configuration [rsync] accept = 8000 connect = some_host.com:20000 stunnel log file example from client: 2004.10.11 14:44:32 LOG7[26651:7]: rsync started 2004.10.11 14:44:32 LOG5[26651:7]: rsync connected local_host_ip:43586 2004.10.11 14:44:32 LOG7[26651:7]: FD 9 in non-blocking mode 2004.10.11 14:44:32 LOG7[26651:7]: rsync connecting remote_host_ip:20000 2004.10.11 14:44:32 LOG7[26651:7]: remote connect #1: EINPROGRESS: retrying 2004.10.11 14:44:32 LOG7[26651:7]: waitforsocket: FD=9, DIR=write 2004.10.11 14:44:32 LOG7[26651:7]: waitforsocket: ok 2004.10.11 14:44:32 LOG7[26651:7]: Remote FD=9 initialized 2004.10.11 14:44:32 LOG7[26651:7]: SSL state (connect): before/connect initialization 2004.10.11 14:44:32 LOG7[26651:7]: SSL state (connect): SSLv3 write client hello A 2004.10.11 14:44:32 LOG7[26651:7]: waitforsocket: FD=9, DIR=read 2004.10.11 14:44:32 LOG7[26651:7]: waitforsocket: ok 2004.10.11 14:44:32 LOG7[26651:7]: SSL state (connect): SSLv3 read server hello A 2004.10.11 14:44:32 LOG7[26651:7]: SSL state (connect): SSLv3 read finished A 2004.10.11 14:44:32 LOG7[26651:7]: SSL state (connect): SSLv3 write change cipher spec A 2004.10.11 14:44:32 LOG7[26651:7]: SSL state (connect): SSLv3 write finished A 2004.10.11 14:44:32 LOG7[26651:7]: SSL state (connect): SSLv3 flush data 2004.10.11 14:44:32 LOG7[26651:7]: 3 items in the session cache 2004.10.11 14:44:32 LOG7[26651:7]: 6 client connects (SSL_connect()) 2004.10.11 14:44:32 LOG7[26651:7]: 6 client connects that finished 2004.10.11 14:44:32 LOG7[26651:7]: 0 client renegotiatations requested 2004.10.11 14:44:32 LOG7[26651:7]: 0 server connects (SSL_accept()) 2004.10.11 14:44:32 LOG7[26651:7]: 0 server connects that finished 2004.10.11 14:44:32 LOG7[26651:7]: 0 server renegotiatiations requested 2004.10.11 14:44:32 LOG7[26651:7]: 3 session cache hits 2004.10.11 14:44:32 LOG7[26651:7]: 0 session cache misses 2004.10.11 14:44:32 LOG7[26651:7]: 0 session cache timeouts 2004.10.11 14:44:32 LOG6[26651:7]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc =AES(256) Mac=SHA1 2004.10.11 14:44:59 LOG7[26651:7]: SSL_write returned WANT_: retrying 2004.10.11 14:44:59 LOG7[26651:7]: SSL_read returned WANT_: retrying 2004.10.11 14:45:06 LOG7[26651:7]: SSL_write returned WANT_: retrying 2004.10.11 14:45:06 LOG7[26651:7]: SSL_read returned WANT_: retrying 2004.10.11 14:45:10 LOG7[26651:7]: SSL_write returned WANT_: retrying 2004.10.11 14:45:10 LOG7[26651:7]: SSL_read returned WANT_: retrying 2004.10.11 14:46:32 LOG7[26651:7]: SSL_write returned WANT_: retrying 2004.10.11 14:46:32 LOG7[26651:7]: SSL socket closed on SSL_read

2 1

connection timeout
by SqM 10 Oct '04

10 Oct '04

Hi! I have an application that itself has the possibility to use a backup server. I.e config of primary and secondary server. I have set up the application to connect to localhost on 2 different ports ( 1000 and 1001 ) and each of the ports are forwarded to a primary and secondary server. When testing this setup i find that if i route packets to the primary server to /dev/null in order for the application to select the secondary server the application seems to be happy since stunnel answers. After aproxx 300 seconds i can see in the log that stunnel gives up and that the application sees this. The appliation then happily selects the secondary server. The question then is if it is possible to make stunnel a little bit faster in giving up.. I.e. perhaps 30 sec instead of 300 sec. I found one setting in the client config that seems to do this but the question is.. Is this the correct way to do it.. I.e. setting "TIMEOUTbusy = 30 seconds" seems to fix my problem but is this the rigth way or is there a better way? /Sqm

2 2

RE: [stunnel-users] RE: stunnel on Solaris 2.6 or 7?
by Garg, Jai V (Jai) 10 Oct '04

10 Oct '04

I have more information. I commented out chroot in the config file and it works. #chroot = /usr/local/var/run/stunnel/ -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]]On Behalf Of Garg, Jai V (Jai) Sent: Friday, October 08, 2004 6:04 PM To: stunnel-users(a)mirt.net Subject: [stunnel-users] RE: stunnel on Solaris 2.6 or 7? I have more informaton on the problem. It is giving the following error when doing pthread_create() in create_client() open(/dev/zero): No such file or directory libthread panic: alloc_chunk (PID: 8605 LWP 1) stacktrace: ef3c9938 ef3c83e8 ef3c8184 ef3cebf0 ef3cbdf8 ef3cfe80 1ad24 1ba28 1bbb8 13e68 0 -----Original Message----- From: Garg, Jai V (Jai) Sent: Friday, October 08, 2004 3:42 PM To: stunnel-users(a)mirt.net Subject: stunnel on Solaris 2.6 or 7? Hello, Has anyone successfully used stunnel on Solaris 2.6 or Solaris 7? I would appreciate if you can provide the binary. I am using gcc (tried both 3.3.2 and 3.4.2) on 2.6. It compiles, but it seems to hang somewhere after accepting a connection. Here's the log: 2004.10.08 13:05:20 LOG5[21833:1]: stunnel 4.05 on sparc-sun-solaris2.6 PTHREAD with OpenSSL 0.9.7d 17 Mar 20 04 2004.10.08 13:05:20 LOG7[21833:1]: RAND_status claims sufficient entropy for the PRNG 2004.10.08 13:05:20 LOG6[21833:1]: PRNG seeded successfully 2004.10.08 13:05:20 LOG5[21833:1]: FD_SETSIZE=1024, file ulimit=64 -> 29 clients allowed 2004.10.08 13:05:20 LOG7[21833:1]: FD 4 in non-blocking mode 2004.10.08 13:05:20 LOG7[21833:1]: SO_REUSEADDR option set on accept socket 2004.10.08 13:05:20 LOG7[21833:1]: SeS_SOCKS_NJ bound to 0.0.0.0:1373 2004.10.08 13:05:20 LOG7[21833:1]: FD 5 in non-blocking mode 2004.10.08 13:05:20 LOG7[21833:1]: FD 6 in non-blocking mode 2004.10.08 13:05:20 LOG7[21834:1]: Created pid file /stunnel-client.pid 2004.10.08 13:05:25 LOG7[21834:1]: SeS_SOCKS_NJ accepted FD=0 from 155.184.22.17:62844 2004.10.08 13:05:25 LOG7[21834:1]: FD 0 in non-blocking mode I appreciate all help with this. Jai

2 2

NFS over Stunnel
by E SA 09 Oct '04

09 Oct '04

Hi, Is there anbody running NFS over Srunnel? I need to do so for Solaris. Can this be done? Has anybody done it? Any pointers? Beforehand, thank you for your help. Best regards, Erick Sanz _______________________________ Do you Yahoo!? Declare Yourself - Register online to vote today! http://vote.yahoo.com

3 2

RE: stunnel on Solaris 2.6 or 7?
by Garg, Jai V (Jai) 08 Oct '04

08 Oct '04

I have more informaton on the problem. It is giving the following error when doing pthread_create() in create_client() open(/dev/zero): No such file or directory libthread panic: alloc_chunk (PID: 8605 LWP 1) stacktrace: ef3c9938 ef3c83e8 ef3c8184 ef3cebf0 ef3cbdf8 ef3cfe80 1ad24 1ba28 1bbb8 13e68 0 > -----Original Message----- > From: Garg, Jai V (Jai) > Sent: Friday, October 08, 2004 3:42 PM > To: stunnel-users(a)mirt.net > Subject: stunnel on Solaris 2.6 or 7? > > Hello, > Has anyone successfully used stunnel on Solaris 2.6 or Solaris 7? I would appreciate if you can provide the binary. > I am using gcc (tried both 3.3.2 and 3.4.2) on 2.6. It compiles, but it seems to hang somewhere after accepting a connection. Here's the log: > > 2004.10.08 13:05:20 LOG5[21833:1]: stunnel 4.05 on sparc-sun-solaris2.6 PTHREAD with OpenSSL 0.9.7d 17 Mar 20 > 04 > 2004.10.08 13:05:20 LOG7[21833:1]: RAND_status claims sufficient entropy for the PRNG > 2004.10.08 13:05:20 LOG6[21833:1]: PRNG seeded successfully > 2004.10.08 13:05:20 LOG5[21833:1]: FD_SETSIZE=1024, file ulimit=64 -> 29 clients allowed > 2004.10.08 13:05:20 LOG7[21833:1]: FD 4 in non-blocking mode > 2004.10.08 13:05:20 LOG7[21833:1]: SO_REUSEADDR option set on accept socket > 2004.10.08 13:05:20 LOG7[21833:1]: SeS_SOCKS_NJ bound to 0.0.0.0:1373 > 2004.10.08 13:05:20 LOG7[21833:1]: FD 5 in non-blocking mode > 2004.10.08 13:05:20 LOG7[21833:1]: FD 6 in non-blocking mode > 2004.10.08 13:05:20 LOG7[21834:1]: Created pid file /stunnel-client.pid > 2004.10.08 13:05:25 LOG7[21834:1]: SeS_SOCKS_NJ accepted FD=0 from 155.184.22.17:62844 > 2004.10.08 13:05:25 LOG7[21834:1]: FD 0 in non-blocking mode > > I appreciate all help with this. > > Jai

1 0

stunnel on Solaris 2.6 or 7?
by Garg, Jai V (Jai) 08 Oct '04

08 Oct '04

Hello, Has anyone successfully used stunnel on Solaris 2.6 or Solaris 7? I would appreciate if you can provide the binary. I am using gcc (tried both 3.3.2 and 3.4.2) on 2.6. It compiles, but it seems to hang somewhere after accepting a connection. Here's the log: 2004.10.08 13:05:20 LOG5[21833:1]: stunnel 4.05 on sparc-sun-solaris2.6 PTHREAD with OpenSSL 0.9.7d 17 Mar 20 04 2004.10.08 13:05:20 LOG7[21833:1]: RAND_status claims sufficient entropy for the PRNG 2004.10.08 13:05:20 LOG6[21833:1]: PRNG seeded successfully 2004.10.08 13:05:20 LOG5[21833:1]: FD_SETSIZE=1024, file ulimit=64 -> 29 clients allowed 2004.10.08 13:05:20 LOG7[21833:1]: FD 4 in non-blocking mode 2004.10.08 13:05:20 LOG7[21833:1]: SO_REUSEADDR option set on accept socket 2004.10.08 13:05:20 LOG7[21833:1]: SeS_SOCKS_NJ bound to 0.0.0.0:1373 2004.10.08 13:05:20 LOG7[21833:1]: FD 5 in non-blocking mode 2004.10.08 13:05:20 LOG7[21833:1]: FD 6 in non-blocking mode 2004.10.08 13:05:20 LOG7[21834:1]: Created pid file /stunnel-client.pid 2004.10.08 13:05:25 LOG7[21834:1]: SeS_SOCKS_NJ accepted FD=0 from 155.184.22.17:62844 2004.10.08 13:05:25 LOG7[21834:1]: FD 0 in non-blocking mode I appreciate all help with this. Jai

1 0

Compilation problem of stunnel-4.05 on solaris 9
by Nada Machkova CEI-OI Banska Bystrica 08 Oct '04

08 Oct '04

Hi Didier try to find and set direct path to the ssl/lib before ./configure setenv LD_LIBRARY_PATH /usr/openwin/lib:/usr/dt/lib:/usr/local/lib:/usr/local/ssl/lib ./configure ... Nada

1 0

Stunnel question
by Rick Cone, Secure Payment Systems 06 Oct '04

06 Oct '04

I use Stunnel as a server that connects locally to a port with an application running (called Mlink). The software on that port will only allow 1 connection on the port at a time, not achieving a (true) socket server environment. Does anyone know of a piece of software (like a load balancer) that would accept connections on a specific port (from Stunnel in this case...), and then round-robin connections (or something thereof) to a set of ports? Thanks, Rick Cone Secure Payment Systems 801 8th St. #150-D Greeley, CO 80631 970-352-9434 (office) 970-352-0122 (fax, call office first) rcone(a)securepaymentsystems.com Note: This electronic message and attachments, if any, contain information which is intended solely for the designated recipients. Unauthorized disclosure, copying, distribution, or other use of the contents of this message or attachments, in whole or in part, is prohibited without express authorization of the author of this message.

2 1

Problem running Stunnel
by Robin Martin 06 Oct '04

06 Oct '04

When I run stunnel nothing seems to be happening. The terminal accepts = the command but does nothing. The log file doesn't produce any output = either nor does running stunnel in the foreground. As I understand it, I am trying to wrap my imapd server using stunnel. = Obviously installed imapd, and openssl.=20 In my config file I've got [imaps] accept =3D 993 exec =3D /usr/local/libexec/imapd execargs =3D imapd What is meant to happen when I run stunnel, is there a way that I can = test if it is working. I previously tested imapd using telnet 0 143. I'm = using this=20 http://www.stepwise.com/Articles/Workbench/eart.4.0.html article but its out of date, uses 3.x command line inputs, so I've tried = to convert those to the config file. Thanks, your help is greatly appreciated. Regards, ---- Robin Martin Email: robmar(a)gmail.com

1 0

stunnel dies on win32 - Try again with out HTML
by Richard Whiffen 05 Oct '04

05 Oct '04

We have a problem where stunnel dies on our Win32 boxes when we attempt load tests: stunnel 4.05 on x86-pc-mingw32-gnu WIN32 with OpenSSL 0.9.7d 17 Mar 2004 Global options cert = stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = stunnel.pem RNDbytes = 64 RNDoverwrite = yes service = stunnel session = 300 seconds taskbar = yes verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTidle = 43200 seconds When we had one stunnel.cnf for all services it would crash almost imediately (less than a minute after starting the load). When we created separate processes for each target server it lasts longer, 5 to 10 minutes, but still dies. The frustrating part is we get no indications in the log files of what's going on. It dies in seemingly random spots. The last log entry is never the same and there's nothing in the cmd window that launched it to indicate what happened. The conf is fairly simple: #script test conf cert = \stunnel\ohetestisg1.pem Cafile = \stunnel\css-ca-cert.pem CApath = \stunnel\certs output = \stunnel\stunnel-media.log #verify = 3 client = yes debug = 7 [**mediaserver] accept = 127.0.0.3:80 connect = 10.162.130.26:444 TIMEOUTclose = 0 We're connecting to a Cisco Content Server Switch if that helps. So I'm wondering where to go next. Any ideas on how to troubleshoot this? Rich Whiffen _________________________________________________________________ Check out Election 2004 for up-to-date election news, plus voter tools and more! http://special.msn.com/msn/election2004.armx

1 0

stunnel dies on win32
by Richard Whiffen 05 Oct '04

05 Oct '04

1 0

Stunnel.org
by ramesh k 05 Oct '04

05 Oct '04

Hi I have one little problem with stunnel .I saw your source and document very instresting .But I cant able to compile your souce code [Stunnel.org] in windows xp @ vc++ envirnment.and I have downloaded supportive compiler mingw ,openssl & libssl32.dll and libeay32.dll . In that source syslog.h is not supporting for vc++ . So kindly reply with Clear details to compile that source Regds Ramesh.k

1 0

Re: [stunnel-users] Bug or bad configuration ?
by Michal Trojnara 04 Oct '04

04 Oct '04

Dear fwd, > stunnel: md_rand.c:312: ssleay_rand_add: Assertion `md_c[1] == > md_count[1]' > failed. > 2004.10.03 10:14:44 LOG5[30267:1024]: Received signal 15; terminating Your OpenSSL library is not properly compiled: http://lists.freebsd.org/pipermail/freebsd-bugs/2003-April/000362.html > # stunnel -version > stunnel 4.05 on i686-pc-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7c 30 > Sep > 2003 You use an obsolete version of OpenSSL library. You should upgrade it. http://www.openssl.org/news/secadv_20040317.txt Best regards, Mike

2 1

Stunnel help
by Mohammed Riyaz 30 Sep '04

30 Sep '04

Hi, I have installed stunnel-4.05 along with openssl-0.9.7d. I am not able to run it in either daemon or client mode. I read through the stunnel.org webpage but could find any help. when i run /usr/local/sbin/stunnel -d 7898 -r 631 i get the following output. 2004.09.24 15:10:47 LOG3[4752:1073866848]: -d: No such file or directory (2) Syntax: stunnel [filename] | -fd [n] | -help | -version | -sockets filename - use specified config file instead of /usr/local/etc/stunnel/stunnel.conf -fd n - read the config file from specified file descriptor -help - get config file help -version - display version and defaults -sockets - display default socket options I have copied the sampel config file as /usr/local/etc/stunnel/stunnel.conf. what should i do to avoid this? Is there any good document avalibel explaing step by step installation and configuration of stunnel? Thank you, -Riyaz

2 1

stunnel: command not found
by Robin Martin 24 Sep '04

24 Sep '04

Hi Guys, I am trying to install stunnel-4.05 on Mac 10.2.8. I am following this http://www.stepwise.com/Articles/Workbench/eart.4.0.html article. I am up to Step 8: Testing your setup. The article is old, but I am aware that stunnel 4.* requires a configuration file rather than command line inputs. My config file is [imapd] accept = 993 exec = /usr/local/libexec/imapd execargs = imaps My problem is, when I run (taken from the article) sudo stunnel -c -f -r localhost:993 I get the following, stunnel: command not found Can I use command line arguments here? It seems to be a very non-specific error. While hunting around for an answer I read somewhere else that stunnel likes to die silently? So perhaps I am doing something wrong but getting a vague error message? Is there a log file that I can look at? Thank you for any help, it is appreciated and I hope I've provided sufficient information. Best Regards, Robin _________________________________________________________________ Find love today with ninemsn personals. Click here: http://ninemsn.match.com?referrer=hotmailtagline

2 1

stunnel: command not found
by Robin Martin 24 Sep '04

24 Sep '04

Hi Guys, I am trying to install stunnel-4.05 on Mac 10.2.8. I am following this http://www.stepwise.com/Articles/Workbench/eart.4.0.html article. I am up to Step 8: Testing your setup. The article is old, but I am aware that stunnel 4.* requires a configuration file rather than command line inputs. My config file is [imapd] accept = 993 exec = /usr/local/libexec/imapd execargs = imaps My problem is, when I run (taken from the article) sudo stunnel -c -f -r localhost:993 I get the following, stunnel: command not found Can I use command line arguments here? It seems to be a very non-specific error. While hunting around for an answer I read somewhere else that stunnel likes to die silently? So perhaps I am doing something wrong but getting a vague error message? Is there a log file that I can look at? Thank you for any help, it is appreciated and I hope I've provided sufficient information. Best Regards, Robin

1 0

rsync over stunnel 4
by Steven Timm 23 Sep '04

23 Sep '04

There's an example of rsync over stunnel at http://www.stunnel.org/examples/rsync_mike.html but it appears to be using stunnel 3 syntax. Has anyone successfully made this work using stunnel 4? right now /etc/stunnel.conf is same on client and server, has [rsync] accept = 2222 connect = 873 Steve Timm ------------------------------------------------------------------ Steven C. Timm, Ph.D (630) 840-8525 timm(a)fnal.gov http://home.fnal.gov/~timm/ Fermilab Computing Div/Core Support Services Dept./Scientific Computing Section Assistant Group Leader, Farms and Clustered Systems Group Lead of Computing Farms Team

1 0

performance data
by Michal Trojnara 21 Sep '04

21 Sep '04

Dear Users, I've prepared a table that summarizes my benchmarks. I hope you'll find it useful. http://stunnel.mirt.net/perf.html Best regards, Mike

1 0

Pass phrase dialog
by John Bradley 18 Sep '04

18 Sep '04

When I start stunnel 4.05, I am presented with a dialog that requests that I enter a pass phrase in order to access our private key. Is there anyway to bypass this dialog. I would like to add the pass phrase to the config file, so that the dialog isn't presented. Security isn't an issue. Our config file will be in a secure location. Otherwise, our operations people are going the have to know the pass phrase to start stunnel. Thanks for your help. John ---------------------------------------------- John Bradley Software Development Lava Trading Inc. 95 Morton Street, 4th Floor New York, NY 10014 Tel: 212.609.0162 Fax: 212.609.0101 www.lavatrading.com <http://www.lavatrading.com/> This communication (including attachments) contains information that may be confidential. It is for the exclusive use of the intended recipient(s). If you are not the intended recipient(s), please note that any distribution, copying or use of this communication or the information in it (including, in any attachments) is strictly prohibited. If you have received this communication in error please notify us by e-mail or by telephone 212-609-0162 and then delete the e-mail and all attachments and any copies thereof.

2 1

unclosed connection issue
by Ken G 15 Sep '04

15 Sep '04

I'm running stunnel 3.xx with thttpd (an embedded http server) on a small embedded machine on a pci card running linux. Establishing ssh, ftp, and http connections and using OpenSSL has all worked fine since they've been installed. I've been experiencing a strange issue. It seems that stunnel fails (somehow) to inform https clients that the connection has been closed. The sequence of events that I'm observing goes like this: T+0.0s: https client initiates request on port 443 (https). T+0.1s: stunnel establishes connection with thttpd on port 80. T+0.4s: thttpd finishes and dies, closing connection with stunnel. T+0.5s: stunnel finishes sending thttpd's output to its client, and then stops, believing that it has finished that connection. If forked, this copy of stunnel dies. The client (internet explorer, firefox, mozilla... doesn't matter) still believes that the connection is active, and waits for additional data. T+10.5s: Roughly 10 seconds later the client decides that the server timed out and displays what has been sent so far, which is the entire page. The only visible symptom is that small webpages seem to take 10 seconds to load. The visible symptom, then, is that webpages below a certain size (where that size is determined by the browser's willingness to refresh its view as data is being sent) take about 10 seconds to load. Is it possible that this behavior is due to stunnel? _______________________________ Do you Yahoo!? Express yourself with Y! Messenger! Free. Download now. http://messenger.yahoo.com

1 0

verify option question
by Alaadin 13 Sep '04

13 Sep '04

hello, i am using stunnel4.x under linux in my server i set verify option level 3 and in my clinet i added stunnel.pem so verify can happen now can my isp knows my key of encrytion and decrypt ? so it is safe to set verify level 3 ? or it shouldnot ? can my isp decrpt my traffic or knows what sites i visted? thanks

1 0

Wish: Option verify service-dependent
by Hans Werner Strube 13 Sep '04

13 Sep '04

With stunnel-4.x, it would be greatly desirable to make the option "verify" (and possibly the related certs) in stunnel.conf service-dependent rather than global. I have not looked at the code sufficiently to determine whether and how this could be possible.

2 1

Re: [stunnel-users] Stunnel-3.26 / OpenSSL 0.9.6m / Solaris / SSL _accept: Peer sudden ly disconnected
by Martin Kneissl 13 Sep '04

13 Sep '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Michal Trojnara wrote: | | What about using my stunnel3 script instead? | | BTW: I really would like to know your comments on this script. | Does anyone need stunnel 3.x, now? | Unfortunately we will have to keep stunnel 3.x for some time (probably at least until next summer), due to a large distributed installation. I appreciate to have the wrapper script to migrate the current installations. If this was available when stunnel 4 was released we probably would have it in our installations right now... Anyone to verify my patch for stunnel-3.26? Best regards, Martin. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3-nr1 (Windows XP) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBRU5SnNbgBz1XxU4RAspgAJ9akmjZNTOig+YW69nRUCDX/hfTFwCfSwqL TKb3reUiIdYwVntSZSgQVgg= =wb9x -----END PGP SIGNATURE-----

1 0

Stunnel-3.26 / OpenSSL 0.9.6m / Solaris / SSL_accept: Peer sudden ly disconnected
by "Kneißl, Martin" 10 Sep '04

10 Sep '04

Hello everybody, I recompiled the newest "traditional" versions of OpenSSL and stunnel on Solaris, Linux, and HPUX. None of the defaults were changed except for --prefix and --openssldir/--with-ssl and --install_prefix Simple tests went through without problems on Linux and HPUX. For Solaris I have a big problem. Any help is appreciated, for example a trustworthy Stunnel-3.26 binary statically linked with OpenSSL 0.9.6m for Solaris 2.6 could also help. Summary ======= Stunnel listens on host medusa 12480 for SSL and forwards plain HTTP to apache on another host (sirius). When I try a HTTPS request to medusa:12480 using a browser or wget, the connection is broken immediately. When stunnel runs under the system call tracer truss the same commands succeed most of the time. In the truss output one can see an EAGAIN on the -r socket of stunnel. That might indicate that there is a problem when TCP buffers do not fill quickly receiving on the -r side. Details ======= Client side: (IP is 192.168.50.153) C:\>wget --spider https://medusa:12480 --12:59:18-- https://medusa:12480/ => `index.html' Resolving medusa... 192.168.41.13 Connecting to medusa[192.168.41.13]:12480... connected. Unable to establish SSL connection. Unable to establish SSL connection. Stunnel side: [mkn@medusa] stunnel-3.26 721$ ./stunnel -p ./stunnel.pem -D 7 -d 12480 -r sirius:80 -f -Pnone 2004.09.08 13:06:52 LOG5[29399:1]: Using 'sirius.80' as tcpwrapper service name 2004.09.08 13:06:52 LOG4[29399:1]: Wrong permissions on ./stunnel.pem 2004.09.08 13:06:52 LOG7[29399:1]: Snagged 64 random bytes from /nfss/home/mkn/.rnd 2004.09.08 13:06:53 LOG7[29399:1]: Wrote 1024 new random bytes to /nfss/home/mkn/.rnd 2004.09.08 13:06:53 LOG7[29399:1]: RAND_status claims sufficient entropy for the PRNG 2004.09.08 13:06:53 LOG6[29399:1]: PRNG seeded successfully 2004.09.08 13:06:53 LOG7[29399:1]: Certificate: ./stunnel.pem 2004.09.08 13:06:53 LOG5[29399:1]: stunnel 3.26 on sparc-sun-solaris2.6 PTHREAD+LIBWRAP with OpenSSL 0.9.6m 17 Mar 2004 2004.09.08 13:06:53 LOG7[29399:1]: No pid file being created 2004.09.08 13:06:53 LOG5[29399:1]: FD_SETSIZE=1024, file ulimit=64 -> 28 clients allowed 2004.09.08 13:06:53 LOG7[29399:1]: SO_REUSEADDR option set on accept socket 2004.09.08 13:06:53 LOG7[29399:1]: sirius.80 bound to 0.0.0.0:12480 2004.09.08 13:06:56 LOG7[29399:1]: sirius.80 accepted FD=7 from 192.168.50.153:1937 2004.09.08 13:06:56 LOG7[29399:4]: sirius.80 started 2004.09.08 13:06:56 LOG5[29399:4]: sirius.80 connected from 192.168.50.153:1937 2004.09.08 13:06:56 LOG7[29399:4]: sirius.80 connecting 192.168.41.223:80 2004.09.08 13:06:56 LOG7[29399:4]: Remote FD=9 initialized 2004.09.08 13:06:56 LOG7[29399:4]: Stunnel manual RSA blinding enabled 2004.09.08 13:06:56 LOG7[29399:4]: SSL state (accept): before/accept initialization 2004.09.08 13:06:56 LOG7[29399:4]: SSL state (accept): SSLv3 read client hello A 2004.09.08 13:06:56 LOG7[29399:4]: SSL state (accept): SSLv3 write server hello A 2004.09.08 13:06:56 LOG7[29399:4]: SSL state (accept): SSLv3 write certificate A 2004.09.08 13:06:56 LOG7[29399:4]: SSL state (accept): SSLv3 write server done A 2004.09.08 13:06:56 LOG7[29399:4]: SSL state (accept): SSLv3 flush data 2004.09.08 13:06:56 LOG3[29399:4]: SSL_accept: Peer suddenly disconnected 2004.09.08 13:06:56 LOG7[29399:4]: sirius.80 finished (0 left) [mkn@medusa] stunnel-3.26 722$ ./stunnel -V stunnel 3.26 on sparc-sun-solaris2.6 PTHREAD+LIBWRAP with OpenSSL 0.9.6m 17 Mar 2004 Default behaviour: run in inetd mode (unless -d used) run in background (unless -f used) run in ssl server mode (unless -c used) Compile time defaults: -v level no verify -a directory (none) -A file (none) -S sources 2 -t timeout 300 seconds -B bytes 64 -D level 5 -P pid dir /opt/stunnel/var/stunnel/ -p pemfile in server mode: stunnel.pem in client mode: none Socket option defaults: Option Accept Local Remote OS default SO_DEBUG -- -- -- 0 SO_DONTROUTE -- -- -- 0 SO_KEEPALIVE -- -- -- 0 SO_LINGER -- -- -- 0:0 SO_OOBINLINE -- -- -- 0 SO_RCVBUF -- -- -- 8192 SO_SNDBUF -- -- -- 8192 SO_RCVLOWAT -- -- -- -- SO_SNDLOWAT -- -- -- -- SO_RCVTIMEO -- -- -- -- SO_SNDTIMEO -- -- -- -- SO_REUSEADDR 1 -- -- 0 IP_TOS -- -- -- 0 IP_TTL -- -- -- 255 TCP_NODELAY -- -- -- 0 [mkn@medusa] stunnel-3.26 724$ uname -a SunOS medusa 5.6 Generic_105181-39 sun4u sparc SUNW,Ultra-Enterprise [mkn@medusa] stunnel-3.26 726$ gcc -v Reading specs from /usr/local/lib/gcc-lib/sparc-sun-solaris2.6/2.95.2/specs gcc version 2.95.2 19991024 (release) When running the same stunnel under truss, I sometimes have success in retrieving the document, but sometimes I get: (...initialisation omitted...) poll(0xEFFFD4E0, 2, -1) = 1 fcntl(7, F_GETFL, 0x00000000) = 2 fstat64(7, 0xEFFFF3D8) = 0 getsockopt(7, 65535, 8192, 0xEFFFF4DC, 0xEFFFF4D4) = 0 fstat64(7, 0xEFFFF3D8) = 0 getsockopt(7, 65535, 8192, 0xEFFFF4DC, 0xEFFFF4D8) = 0 setsockopt(7, 65535, 8192, 0xEFFFF4DC, 4) = 0 fcntl(7, F_SETFL, 0x00000082) = 0 accept(7, 0xEFFFF5D0, 0xEFFFF548) = 8 fstat64(7, 0xEFFFF3D8) = 0 getsockopt(7, 65535, 8192, 0xEFFFF4DC, 0xEFFFF4D8) = 0 setsockopt(7, 65535, 8192, 0xEFFFF4DC, 4) = 0 fcntl(7, F_SETFL, 0x00000002) = 0 time() = 1094642471 getpid() = 2339 [2337] write(4, 0x000E763C, 83) = 83 2 0 0 4 . 0 9 . 0 8 1 3 : 2 1 : 1 1 L O G 7 [ 2 3 3 9 : 1 ] : s i r i u s . 8 0 a c c e p t e d F D = 8 f r o m 1 9 2 . 1 6 8 . 5 0 . 1 5 3 : 2 7 6 3\n fcntl(8, F_SETFD, 0x00000001) = 0 lwp_cond_signal(0xEF66B278) = 0 lwp_cond_wait(0xEF66B278, 0xEF66B288, 0xEF565C48) = 0 lwp_self() = 3 time() = 1094642471 getpid() = 2339 [2337] write(4, 0x000E763C, 52) = 52 2 0 0 4 . 0 9 . 0 8 1 3 : 2 1 : 1 1 L O G 7 [ 2 3 3 9 : 4 ] : s i r i u s . 8 0 s t a r t e d\n brk(0x000F73A8) = 0 brk(0x000FF3A8) = 0 getpeername(8, 0x000F56C4, 0xEF20BC78) = 0 getpid() = 2339 [2337] getpeername(8, 0x000DF2E0, 0xEF20B44C) = 0 getsockname(8, 0x000DF2F0, 0xEF20B44C) = 0 open("/etc/hosts.allow", O_RDONLY) Err#2 ENOENT getpid() = 2339 [2337] open("/proc/2339/psinfo", O_RDONLY) = 9 read(9, "\f\0 F H\0\0\005\0\0\t #".., 336) = 336 close(9) = 0 fstat(-1, 0xEF209E40) Err#9 EBADF open("/dev/conslog", O_WRONLY) = 9 fcntl(9, F_SETFD, 0x00000001) = 0 fstat(9, 0xEF209E40) = 0 fstat(9, 0xEF20A8A0) = 0 time() = 1094642471 getpid() = 2339 [2337] putmsg(9, 0xEF209F58, 0xEF209F4C, 0) = 0 open("/etc/.syslog_door", O_RDONLY) = 10 door_info(10, 0xEF209E90) = 0 getpid() = 2339 [2337] door_call(10, 0xEF209E78) = 0 close(10) = 0 open("/etc/hosts.deny", O_RDONLY) Err#2 ENOENT fstat(9, 0xEF20A8A0) = 0 time() = 1094642471 getpid() = 2339 [2337] putmsg(9, 0xEF209F58, 0xEF209F4C, 0) = 0 open("/etc/.syslog_door", O_RDONLY) = 10 door_info(10, 0xEF209E90) = 0 getpid() = 2339 [2337] door_call(10, 0xEF209E78) = 0 close(10) = 0 time() = 1094642471 getpid() = 2339 [2337] write(4, 0x000E763C, 79) = 79 2 0 0 4 . 0 9 . 0 8 1 3 : 2 1 : 1 1 L O G 5 [ 2 3 3 9 : 4 ] : s i r i u s . 8 0 c o n n e c t e d f r o m 1 9 2 . 1 6 8 . 5 0 . 1 5 3 : 2 7 6 3\n so_socket(2, 2, 0, "", 1) = 10 time() = 1094642471 getpid() = 2339 [2337] write(4, 0x000E763C, 73) = 73 2 0 0 4 . 0 9 . 0 8 1 3 : 2 1 : 1 1 L O G 7 [ 2 3 3 9 : 4 ] : s i r i u s . 8 0 c o n n e c t i n g 1 9 2 . 1 6 8 . 4 1 . 2 2 3 : 8 0\n connect(10, 0xEF20BC00, 16) = 0 time() = 1094642471 getpid() = 2339 [2337] write(4, 0x000E763C, 59) = 59 2 0 0 4 . 0 9 . 0 8 1 3 : 2 1 : 1 1 L O G 7 [ 2 3 3 9 : 4 ] : R e m o t e F D = 1 0 i n i t i a l i z e d\n time() = 1094642471 getpid() = 2339 [2337] time() = 1094642471 getpid() = 2339 [2337] write(4, 0x000E763C, 70) = 70 2 0 0 4 . 0 9 . 0 8 1 3 : 2 1 : 1 1 L O G 7 [ 2 3 3 9 : 4 ] : S t u n n e l m a n u a l R S A b l i n d i n g e n a b l e d\n time() = 1094642471 brk(0x000FF3A8) = 0 brk(0x001033A8) = 0 time() = 1094642471 getpid() = 2339 [2337] write(4, 0x000E763C, 83) = 83 2 0 0 4 . 0 9 . 0 8 1 3 : 2 1 : 1 1 L O G 7 [ 2 3 3 9 : 4 ] : S S L s t a t e ( a c c e p t ) : b e f o r e / a c c e p t i n i t i a l i z a t i o n\n brk(0x001033A8) = 0 brk(0x001093A8) = 0 brk(0x001093A8) = 0 brk(0x0010D3A8) = 0 read(8, 0x00102C78, 11) Err#11 EAGAIN time() = 1094642471 getpid() = 2339 [2337] write(4, 0x000E763C, 73) = 73 2 0 0 4 . 0 9 . 0 8 1 3 : 2 1 : 1 1 L O G 3 [ 2 3 3 9 : 4 ] : S S L _ a c c e p t : P e e r s u d d e n l y d i s c o n n e c t e d\n setsockopt(10, 65535, 128, 0xEF20BC78, 8) = 0 close(10) = 0 setsockopt(8, 65535, 128, 0xEF20BC78, 8) = 0 close(8) = 0 time() = 1094642471 getpid() = 2339 [2337] write(4, 0x000E763C, 62) = 62 2 0 0 4 . 0 9 . 0 8 1 3 : 2 1 : 1 1 L O G 7 [ 2 3 3 9 : 4 ] : s i r i u s . 8 0 f i n i s h e d ( 0 l e f t )\n lwp_cond_signal(0xEF66B278) = 0 lwp_cond_wait(0xEF66B278, 0xEF66B288, 0xEF543CA0) = 0 lwp_mutex_unlock(0xEF66B288) = 0 lwp_mutex_lock(0xEF66B288) = 0 time() = 1094642471 lwp_mutex_lock(0xEF66B288) = 0 lwp_cond_broadcast(0xEF670F50) = 0 poll(0xEFFFD4E0, 2, -1) (sleeping...) With kind regards, Martin Kneissl _________________________ Atos Worldline GmbH CRM and Telco Pascalstrasse 19 52076 Aachen Germany Phone: +49 (0) 2408 148 173 Fax: +49 (0) 2408 148 204 mailto:[email protected] www.atosworldline.de

2 1

Unable to open "/dev/cryptonet"
by alaadin＠alaadin.org 09 Sep '04

09 Sep '04

hello, when i run stunnel4.x under linux it gaves statment Unable to open "/dev/cryptonet" but it run normal .. what this error mean ? does it means stunnel is running but not encrypting ? and is there any problem running stunnel without "/dev/cryptonet ? secand question i have stunnel4.x running with verify 3 option can my isp read data between me and the other host .. if i am transmiting data through stunnel ? thanks.

2 1

Stunnel-3.26 / OpenSSL 0.9.6m / Solaris / SSL_accept: Peer sudden ly disconnected
by "Kneißl, Martin" 08 Sep '04

08 Sep '04

Correcting my previous post, > ... one can see an EAGAIN on the -r socket of stunnel. That's not true, the EAGAIN is on the accepted file descriptor. The problem is not solved, though ... Martin.

2 1

ssl - excessive message size
by Olivier Rademakers 06 Sep '04

06 Sep '04

Hi All, I am having trouble with a secure connection that used to work until now. I am using an stunnel connection to transfer data from an ldap server(127.0.0.1) to Win Active Directory server (machineB.domain.com) in order to update AD with updated ldap data. I have run stunnel in high verbosity manually so I could extract a log of a connection attempt. Here it is below: # stunnel -c -f -D 7 -P /var/ldapad/ -d 127.0.0.1:6360 -r machineB.domain.com:636 LOG5[9318:1]: Using 'machineB.domain.com.636' as tcpwrapper service name LOG7[9318:1]: RAND_status claims sufficient entropy for the PRNG LOG6[9318:1]: PRNG seeded successfully LOG5[9318:1]: stunnel 3.14 on sparc-sun-solaris2.7 PTHREAD LOG7[9318:1]: Created pid file /var/ldapad/stunnel.machineB.domain.com.636.pid LOG7[9318:1]: machineB.domain.com.636 bound to 127.0.0.1:6360 LOG7[9318:4]: machineB.domain.com.636 started LOG5[9318:4]: machineB.domain.com.636 connected from 127.0.0.1:55001 LOG7[9318:4]: machineB.domain.com.636 connecting 172.27.24.4:636 LOG7[9318:4]: Remote host connected LOG7[9318:4]: before/connect initialization LOG7[9318:4]: before/connect initialization LOG7[9318:4]: SSLv3 write client hello A LOG7[9318:4]: SSLv3 read server hello A LOG7[9318:4]: SSLv3 read server certificate A LOG7[9318:4]: SSLv3 read server key exchange A LOG7[9318:4]: SSLv3 read server key exchange A LOG3[9318:4]: SSL_connect: error:1408E098:SSL routines:SSL3_GET_MESSAGE:excessive message size LOG7[9318:4]: machineB.domain.com.636 finished (0 left) I have searched for this error but to no avail and am wondering if any of you have already come across such, and if so would have the beginning of a solution, and why not The Solution ;-) NB: When running stunnel with the "-c" operand (client mode), it is said the certificates are optional. I have captured the dialogue between the two machines, and apparently, the problem would be coming from the AD server as the DN (Distinguished Name) in the cert is ~8000 bytes long. The capture reveals other errors, checksum and more, so if needed I could append those to the problem stated here. Again, unix-ldap side has not changed to my knowledge. The script has always been the same, and it worked until now. The ldap server is SUN Solaris 2.8 with ssl 0.9.7b Version of stunnel: stunnel 3.21 on sparc-sun-solaris2.8 PTHREAD The AD server is a Windows 2000 machine. Please enlighten me, Olivier

1 1

win32 stunnel - quiet service install
by Michael Brown 03 Sep '04

03 Sep '04

Greetings, It would be great if while installing as a service on win32, there was an option to install quietly - i.e. only pop up a dialog box to the user if there's a problem. Any chance of somebody nice compiling me a binary that does this? :) M. -- Michael Brown {0x527670C0} | `One of the main causes of the fall of Systems Administrator | the Roman Empire was that, lacking zero, +1 519 888 7111 x2339 | they had no way to indicate successful michaelb(a)opentext.com | termination of their C programs.' - Firth

1 0

stunnel.conf
by Bob Williams 02 Sep '04

02 Sep '04

I'm totally new to Stunnel, which I'm running on a Windows XP platform. Where can I find a newbie's tutorial, e.g. to tell me what stunnel expects to find in stunnel.conf? Many thanks for your help. -- Bob

1 0

FTP site
by Michal Trojnara 02 Sep '04

02 Sep '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, My ftp site is back online. Thanks to Brian Hatch for reporting the problem. Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFBN0vB/NU+nXTHMtERAqQ4AJ95KWL5PUpLZOMqQ4xOJYKqeVwgxgCfVIcc yMYncLDroE5wwHxJj5QtjGI= =Tryt -----END PGP SIGNATURE-----

1 0

stunnel3
by Michal Trojnara 01 Sep '04

01 Sep '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I've written a perl script to emulate stunnel 3.x command line with stunnel versions 4.05 and later. I hope you'll like it. It's ready for download here: ftp://stunnel.mirt.net/stunnel/stunnel3 Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFBNkEq/NU+nXTHMtERAvVGAJ4yuDLNrCOFTLfuuFRIzwShDkd/lwCfcVLa bLhgSAs2gXuzca8ZkJmCb9Q= =SInU -----END PGP SIGNATURE-----

1 0

Samba and stunnel
by Charles A. Monteiro 01 Sep '04

01 Sep '04

just wondering if anybody has had any difficulties with wrapping samba with stunnel, Sambo 3.0 apparently has dropped the support for ssl and therefore we are now also considering using stunnel to wrap Samba. thanks -Charles -- Using Opera's revolutionary e-mail client: http://www.opera.com/m2/

1 0

Marketing Stunnel
by Charles A. Monteiro 01 Sep '04

01 Sep '04

So I now need to sell stunnel to those that make decisions. It would be helpful to get an understanding of how widely deployed it is. It also would be useful to have a number of company names that I could drop, especially if said companies were major corporations and especially if they were players in the finance/banking industry. thanks in advance, -Charles -- Using Opera's revolutionary e-mail client: http://www.opera.com/m2/

4 4

re: [stunnel-users] client auth saga
by markzero＠logik.ath.cx 30 Aug '04

30 Aug '04

On Monday 30 of August 2004 20:38, markzero at logik.ath.cx wrote: > To be honest, I'm just generally paranoid. I'd rather have a prospective > attacker have to crack two passwords (the root and one wheel group) than > one. I thought I'd write the above just so I didn't get a big lecture, > hehe. :) > You're not paranoid enough. You still use passwords! 8-) I'm currently in the process of moving everything over to keypairs. I'm not blessed with security conscious users, and it's hard to get them to understand that a keypair is actually more convenient (especially if you use an agent). :) > > I recommend to use CAfile instead of CApath for simple configurations. > > It doesn't need a hashed directory and is not relative to chroot jail. > > So something like: > > CApath = /var/stunnel/certs > No! > CAfile = /var/stunnel/certs/your_cert.pem Oops, yeah I see what you mean. > I'm paranoid that someone has been at my testing configs now. :) I > previously had a working setup, which worries me even further as I *did* > use a symlink. Yes, you can use symlinks, but instead of: ln -s /a/b/c/x /a/b/c/y use: cd /a/b/c ln -s x y Please notice (ls -l) the results are not the same! That must have been it. > Best regards, > Mike > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.2.4 (GNU/Linux) > > iD8DBQFBM3dd/NU+nXTHMtERApCuAKDe+RWT1S0MQJ4Fr+FSyk8qyqwgpwCg4XED > zBBeDZ6AU+LPU+iejancYGI= > =8uvI > -----END PGP SIGNATURE-----

1 0

client auth saga
by markzero＠logik.ath.cx 30 Aug '04

30 Aug '04

Frustration doesn't begin to express it! SEC Productions presents: * THE CLIENT AND SERVER AUTH SAGA * lets get on with it: complete walkthrough of ssl cert creation ----------------------------------------- By the way, please don't lecture me on ssh'ing into machines as root, they are located on an isolated network and of course, all logging in as root is disabled when they are put into production. :) There now follows a step by step account of everything so far... command prompt key: ca# = certificate authority machine (or my isolated desktop, whichever you prefer). records# = log server dns# = my dns server (the logging client) (obvious output of scripts snipped) ----------------------------------------- ca# cd /etc/ssl/misc ca# ./CA.sh -newca <snip> ca# ./CA.sh -newreq <snip> Request (and private key) is in newreq.pem ca# ./CA.sh -sign Signed certificate is in newcert.pem ca# cat newreq.pem newcert.pem > log_server.pem Then I realised that I needed it to be passwordless. ca# openssl rsa -in newreq.pem -out decryptedcert.pem ca# cat decryptedcert.pem newcert.pem > log_server_np.pem (log_server_np.pem is now passwordless) ca# scp log_server_np.pem records:/etc/ssl/stunnel_cert/ ca# scp demoCA/cacert.pem dns:/var/stunnel/cert/cacert.pem we'll just try with server side auth at the moment, on the loghost: records# cat /etc/stunnel/stunnel.conf cert = /etc/ssl/stunnel_cert/log_server_np.pem chroot = /var/stunnel pid = /var/run/stunnel.pid CApath = /certs CRLpath = /crls #verify = 2 debug = 7 output = stunnel.log setuid = _stunnel setgid = _stunnel [syslogngs] accept = 192.168.1.9:5514 connect = 127.0.0.1:5515 on the client: dns# cat /etc/stunnel/stunnel.conf #cert = /etc/stunnel/cert/clientkeycert.pem chroot = /var/stunnel pid = /var/run/stunnel.pid CAfile = /certs/cacert.pem CRLpath = /crls debug = 7 output = stunnel.log client = yes setuid = _stunnel setgid = _stunnel [syslogngs] accept = 127.0.0.1:5515 connect = 192.168.1.9:5514 looks good... dns# telnet localhost 5515 (in the interests of patience and readability, the output of stunnel.log isn't posted here, suffice to say the connection is successful and works) now to step up to client and server authentication. ca# openssl req -x509 -newkey rsa:2048 -keyout clientkey.pem -out \ clientcert -days 365 (forgot to use -nodes) ca# openssl rsa -in clientkey.pem -out client_decrypted_key.pem ca# cat clientkey.pem clientcert.pem > clientkeycert.pem ca# ./c_hash clientkeycert.pem 4410a4d9.0 => clientkeycert.pem ca# scp clientkeycert.pem dns:/etc/stunnel/cert ca# scp clientcert.pem records:/var/stunnel/certs on the server: records# ln -s /var/stunnel/certs/clientcert.pem \ /var/stunnel/certs/4410a4d9.0 adjust the stunnel.conf on both hosts accordingly: records# cat /etc/stunnel/stunnel.conf cert = /etc/ssl/stunnel_cert/log_server_np.pem chroot = /var/stunnel pid = /var/run/stunnel.pid CApath = /certs CRLpath = /crls verify = 3 debug = 7 output = stunnel.log setuid = _stunnel setgid = _stunnel [syslogngs] accept = 192.168.1.9:5514 connect = 127.0.0.1:5515 dns# cat /etc/stunnel/stunnel.conf cert = /etc/stunnel/cert/clientkeycert.pem chroot = /var/stunnel pid = /var/run/stunnel.pid CAfile = /certs/cacert.pem CRLpath = /crls debug = 7 output = stunnel.log client = yes setuid = _stunnel setgid = _stunnel [syslogngs] accept = 127.0.0.1:5515 connect = 192.168.1.9:5514 and just to show the permissions: records# ls -al /etc/ssl/ drwx------ 2 _stunnel _stunnel 512 Aug 30 12:19 stunnel_cert records# ls -al /etc/ssl/stunnel_cert -rw------- 1 _stunnel _stunnel 4320 Aug 30 12:19 log_server_np.pem records# ls -al /var/stunnel/certs/ lrwxr-xr-x 1 root _stunnel 33 Aug 30 14:33 4410a4d9.0 -> /var/stunnel/certs/clientcert.pem -rw------- 1 _stunnel _stunnel 1489 Aug 30 14:32 clientcert.pem dns# ls -al /etc/stunnel/dns# ls -al /etc/stunnel/ drwx------ 3 _stunnel _stunnel 512 Aug 29 21:50 . drwx------ 2 _stunnel _stunnel 512 Aug 30 14:18 cert -rw------- 1 _stunnel _stunnel 301 Aug 30 14:22 stunnel.conf -rw------- 1 _stunnel _stunnel 13401 Aug 29 22:21 stunnel.log dns# ls -al /etc/stunnel/cert/ -rw------- 1 _stunnel _stunnel 3168 Aug 30 14:18 clientkeycert.pem dns# ls -al /var/stunnel/ drwx------ 5 _stunnel _stunnel 512 Aug 29 21:28 . drwx------ 2 _stunnel _stunnel 512 Aug 30 13:59 cert drwx------ 2 _stunnel _stunnel 512 Aug 29 21:16 crl drwx------ 3 _stunnel _stunnel 512 Aug 29 21:28 var dns# ls -al /var/stunnel/cert/ drwx------ 2 _stunnel _stunnel 512 Aug 30 13:59 . -rw------- 1 _stunnel _stunnel 1115 Aug 30 13:59 cacert.pem now, to test. records# /usr/local/sbin/stunnel /etc/stunnel/stunnel.conf dns# /usr/local/sbin/stunnel /etc/stunnel/stunnel.conf the log files on both show no errors, lets try a connection from dns to records... dns# telnet localhost 5515 Trying ::1... telnet: connect to address ::1: Connection refused Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Connection closed by foreign host. urgh! what went wrong? records# cat stunnel.log 2004.08.30 14:46:43 LOG5[27205:1006690304]: stunnel 4.05 on i386-unknown-openbsd3.5 PTHREAD with OpenSSL 0.9.7c 30 Sep 2003 2004.08.30 14:46:43 LOG7[27205:1006690304]: Snagged 64 random bytes from /dev/arandom 2004.08.30 14:46:43 LOG7[27205:1006690304]: RAND_status claims sufficient entropy for the PRNG 2004.08.30 14:46:43 LOG6[27205:1006690304]: PRNG seeded successfully 2004.08.30 14:46:43 LOG7[27205:1006690304]: Certificate: /etc/ssl/stunnel_cert/log_server_np.pem 2004.08.30 14:46:43 LOG7[27205:1006690304]: Key file: /etc/ssl/stunnel_cert/log_server_np.pem 2004.08.30 14:46:43 LOG7[27205:1006690304]: Verify directory set to /certs 2004.08.30 14:46:43 LOG7[27205:1006690304]: CRL directory set to /crls 2004.08.30 14:46:43 LOG5[27205:1006690304]: Peer certificate location /certs 2004.08.30 14:46:43 LOG5[27205:1006690304]: FD_SETSIZE=1024, file ulimit=128 -> 61 clients allowed 2004.08.30 14:46:43 LOG7[27205:1006690304]: FD 10 in non-blocking mode 2004.08.30 14:46:43 LOG7[27205:1006690304]: SO_REUSEADDR option set on accept socket 2004.08.30 14:46:43 LOG7[27205:1006690304]: syslogngs bound to 192.168.1.9:5514 2004.08.30 14:46:43 LOG7[27205:1006690304]: FD 11 in non-blocking mode 2004.08.30 14:46:43 LOG7[27205:1006690304]: FD 12 in non-blocking mode 2004.08.30 14:46:43 LOG7[20297:1006690304]: Created pid file /var/run/stunnel.pid 2004.08.30 14:46:51 LOG7[20297:1006690304]: syslogngs accepted FD=13 from 192.168.1.6:7109 2004.08.30 14:46:51 LOG7[20297:1006690304]: FD 13 in non-blocking mode 2004.08.30 14:46:51 LOG7[20297:1006693376]: syslogngs started 2004.08.30 14:46:51 LOG5[20297:1006693376]: syslogngs connected from 192.168.1.6:7109 2004.08.30 14:46:51 LOG7[20297:1006693376]: SSL state (accept): before/accept initialization 2004.08.30 14:46:51 LOG7[20297:1006693376]: SSL state (accept): SSLv3 read client hello A 2004.08.30 14:46:51 LOG7[20297:1006693376]: SSL state (accept): SSLv3 write server hello A 2004.08.30 14:46:51 LOG7[20297:1006693376]: SSL state (accept): SSLv3 write certificate A 2004.08.30 14:46:51 LOG7[20297:1006693376]: SSL state (accept): SSLv3 write certificate request A 2004.08.30 14:46:51 LOG7[20297:1006693376]: SSL state (accept): SSLv3 flush data 2004.08.30 14:46:51 LOG7[20297:1006693376]: waitforsocket: FD=13, DIR=read 2004.08.30 14:46:52 LOG7[20297:1006693376]: waitforsocket: ok 2004.08.30 14:46:52 LOG4[20297:1006693376]: VERIFY ERROR: depth=0, error=self signed certificate: /C=UK/L=London/O=SI/OU=SEC/CN=LogClient/emailAddress=root@localhost 2004.08.30 14:46:52 LOG7[20297:1006693376]: SSL alert (write): fatal: bad certificate 2004.08.30 14:46:52 LOG3[20297:1006693376]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2004.08.30 14:46:52 LOG7[20297:1006693376]: syslogngs finished (0 left) --- dns# cat stunnel.log 2004.08.30 14:33:24 LOG5[10920:1006690304]: stunnel 4.05 on i386-unknown-openbsd3.5 PTHREAD with OpenSSL 0.9.7c 30 Sep 2003 2004.08.30 14:33:24 LOG7[10920:1006690304]: Snagged 64 random bytes from /dev/arandom 2004.08.30 14:33:24 LOG7[10920:1006690304]: RAND_status claims sufficient entropy for the PRNG 2004.08.30 14:33:24 LOG6[10920:1006690304]: PRNG seeded successfully 2004.08.30 14:33:24 LOG7[10920:1006690304]: Certificate: /etc/stunnel/cert/clientkeycert.pem 2004.08.30 14:33:24 LOG7[10920:1006690304]: Key file: /etc/stunnel/cert/clientkeycert.pem 2004.08.30 14:33:24 LOG5[10920:1006690304]: FD_SETSIZE=1024, file ulimit=128 -> 61 clients allowed 2004.08.30 14:33:24 LOG7[10920:1006690304]: FD 10 in non-blocking mode 2004.08.30 14:33:24 LOG7[10920:1006690304]: SO_REUSEADDR option set on accept socket 2004.08.30 14:33:24 LOG7[10920:1006690304]: syslogngs bound to 127.0.0.1:5515 2004.08.30 14:33:24 LOG7[10920:1006690304]: FD 11 in non-blocking mode 2004.08.30 14:33:24 LOG7[10920:1006690304]: FD 12 in non-blocking mode 2004.08.30 14:33:24 LOG7[11717:1006690304]: Created pid file /var/run/stunnel.pid 2004.08.30 14:33:30 LOG7[11717:1006690304]: syslogngs accepted FD=13 from 127.0.0.1:20109 2004.08.30 14:33:30 LOG7[11717:1006690304]: FD 13 in non-blocking mode 2004.08.30 14:33:30 LOG7[11717:1006693376]: syslogngs started 2004.08.30 14:33:30 LOG5[11717:1006693376]: syslogngs connected from 127.0.0.1:20109 2004.08.30 14:33:30 LOG7[11717:1006693376]: FD 14 in non-blocking mode 2004.08.30 14:33:30 LOG7[11717:1006693376]: syslogngs connecting 192.168.1.9:5514 2004.08.30 14:33:30 LOG7[11717:1006693376]: remote connect #1: EINPROGRESS: retrying 2004.08.30 14:33:30 LOG7[11717:1006693376]: waitforsocket: FD=14, DIR=write 2004.08.30 14:33:30 LOG7[11717:1006693376]: waitforsocket: ok 2004.08.30 14:33:30 LOG7[11717:1006693376]: Remote FD=14 initialized 2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): before/connect initialization 2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): SSLv3 write client hello A 2004.08.30 14:33:30 LOG7[11717:1006693376]: waitforsocket: FD=14, DIR=read 2004.08.30 14:33:30 LOG7[11717:1006693376]: waitforsocket: ok 2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): SSLv3 read server hello A 2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): SSLv3 read server certificate A 2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): SSLv3 read server certificate request A 2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): SSLv3 read server done A 2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): SSLv3 write client certificate A 2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): SSLv3 write client key exchange A 2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): SSLv3 write certificate verify A 2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): SSLv3 write change cipher spec A 2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): SSLv3 write finished A 2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL state (connect): SSLv3 flush data 2004.08.30 14:33:30 LOG7[11717:1006693376]: waitforsocket: FD=14, DIR=read 2004.08.30 14:33:30 LOG7[11717:1006693376]: waitforsocket: ok 2004.08.30 14:33:30 LOG7[11717:1006693376]: SSL alert (read): fatal: bad certificate 2004.08.30 14:33:30 LOG3[11717:1006693376]: SSL_connect: 14094412: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate 2004.08.30 14:33:30 LOG7[11717:1006693376]: syslogngs finished (0 left) (sorry about the unwrapped lines) I've also tried using ktrace, but the ktrace.out drops off before the connection (making it useless). I don't understand what can be wrong, I've retraced my steps over and over. I did actually have it working before, but due to testing, reinstalled the OS and now it doesn't work. I'm loathe to install the developement tools, as there are so many it would be a nightmare to remove them after (prompting a reinstall, and look what happened last time). Any ideas? Anything I've done blindingly obviously wrong? Why did it work before and not now? ARGH! cheers mark

2 3

Stunnel 4.05 on AIX
by Baker Nelson 27 Aug '04

27 Aug '04

Hello all, Still having trouble getting stunnel 4.05 to run on my AIX 5.2 box. Wanted to pass along the following warning that showed up running the configure script. Could a problem with PTHEADS be causing the failure? Thanks baker checking for sys/select.h... yes checking tcpd.h usability... no checking tcpd.h presence... no checking for tcpd.h... no checking pthread.h usability... no checking pthread.h presence... yes configure: WARNING: pthread.h: present but cannot be compiled configure: WARNING: pthread.h: check for missing prerequisite headers? configure: WARNING: pthread.h: proceeding with the preprocessor's result configure: WARNING: ## ------------------------------------ ## configure: WARNING: ## Report this to bug-autoconf(a)gnu.org. ## configure: WARNING: ## ------------------------------------ ## checking for pthread.h... yes

1 0

Compilation problem of stunnel-4.05 on solaris 9
by PEYROL Didier 27 Aug '04

27 Aug '04

hi , I get this error when i try to do ./configure on stunnel-4.05 on solaris9 config.log in attachement. Some people could help me??? ./configure checking for a BSD-compatible install... auto/install-sh -c checking whether build environment is sane... yes checking whether make sets $(MAKE)... no checking for working aclocal... missing checking for working autoconf... missing checking for working automake... missing checking for working autoheader... missing checking for working makeinfo... missing checking build system type... sparc-sun-solaris2.9 checking host system type... sparc-sun-solaris2.9 checking for gcc... gcc checking for C compiler default output... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ANSI C... none needed checking for a BSD-compatible install... auto/install-sh -c checking whether make sets $(MAKE)... (cached) no checking for ld used by GCC... /usr/ccs/bin/ld checking if the linker (/usr/ccs/bin/ld) is GNU ld... no checking for /usr/ccs/bin/ld option to reload object files... -r checking for BSD-compatible nm... /usr/ccs/bin/nm -p checking for a sed that does not truncate output... /usr/bin/sed checking whether ln -s works... yes checking how to recognise dependent libraries... pass_all checking command to parse /usr/ccs/bin/nm -p output... ok checking how to run the C preprocessor... gcc -E checking for egrep... egrep checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... no checking for unistd.h... yes checking dlfcn.h usability... yes checking dlfcn.h presence... yes checking for dlfcn.h... yes checking for ranlib... : checking for strip... : checking for objdir... .libs checking for gcc option to produce PIC... -fPIC checking if gcc PIC flag -fPIC works... yes checking if gcc static flag -static works... yes checking if gcc supports -c -o file.o... yes checking if gcc supports -c -o file.lo... yes checking if gcc supports -fno-rtti -fno-exceptions... yes checking whether the linker (/usr/ccs/bin/ld) supports shared libraries... yes checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... no checking dynamic linker characteristics... solaris2.9 ld.so checking if libtool supports shared libraries... yes checking whether to build shared libraries... yes checking whether to build static libraries... no creating libtool checking for SSL directory... /usr/local/ssl checking for "/dev/urandom"... yes checking whether to disable RSA support... no checking whether to enable DH support... no checking for dlopen in -ldl... yes checking for shl_load in -ldld... no checking for gethostbyname in -lnsl... yes checking for socket in -lsocket... yes checking for pthread_create in -lpthread... yes checking for pthread_create in -lc_r... no checking for openpty in -lutil... no checking whether to use the libwrap (TCP wrappers) library... (default) checking for hosts_access in -lwrap... no checking for RSAref library... no checking for "/dev/ptmx"... yes checking for "/dev/ptc"... no checking grp.h usability... yes checking grp.h presence... yes checking for grp.h... yes checking for unistd.h... (cached) yes checking sys/select.h usability... yes checking sys/select.h presence... yes checking for sys/select.h... yes checking tcpd.h usability... no checking tcpd.h presence... no checking for tcpd.h... no checking pthread.h usability... yes checking pthread.h presence... yes checking for pthread.h... yes checking sys/ioctl.h usability... yes checking sys/ioctl.h presence... yes checking for sys/ioctl.h... yes checking util.h usability... no checking util.h presence... no checking for util.h... no checking pty.h usability... no checking pty.h presence... no checking for pty.h... no checking stropts.h usability... yes checking stropts.h presence... yes checking for stropts.h... yes checking sys/filio.h usability... yes checking sys/filio.h presence... yes checking for sys/filio.h... yes checking sys/resource.h usability... yes checking sys/resource.h presence... yes checking for sys/resource.h... yes checking for snprintf... yes checking for vsnprintf... yes checking for openpty... no checking for _getpty... no checking for daemon... no checking for waitpid... yes checking for wait4... yes checking for sysconf... yes checking for getrlimit... yes checking for pthread_sigmask... yes checking for setgroups... yes checking for localtime_r... yes checking for chroot... yes checking for endhostent... yes checking for setsid... yes checking for unsigned char... yes checking size of unsigned char... configure: error: cannot compute sizeof (unsigned char), 77 See `config.log' for more details. BR Didier

1 0

MySQL client through stunnel on win32
by Rumi Szabolcs 26 Aug '04

26 Aug '04

Hello! I have tried the following setup: server: MySQL 4.0.20 with native OpenSSL 0.9.7d support on Linux client: MySQL 4.0.20 without SSL support, through stunnel 4.0.5 on WinXP As it can be suspected from the above, I was trying to use the mysqld with ssl support directly as the server side of the connection, without stunnel. I saw a pseudo-https client solution in the stunnel docs where this approach seemed to work. The client stunnel.conf: cert = client-test.crt key = client-test.key client = yes debug = debug [mysqlclient] accept = 3306 connect = server.host.fqdn:3306 The mysql client reported the following error, right after asking for the password: ERROR 2013: Lost connection to MySQL server during query Here is the log from the client stunnel: 2004.08.26 17:19:43 LOG5[2396:1256]: stunnel 4.05 on x86-pc-mingw32-gnu WIN32 with OpenSSL 0.9.7d 17 Mar 2004 2004.08.26 17:19:43 LOG7[2396:1908]: RAND_status claims sufficient entropy for the PRNG 2004.08.26 17:19:43 LOG6[2396:1908]: PRNG seeded successfully 2004.08.26 17:19:43 LOG7[2396:1908]: Certificate: client-test.crt 2004.08.26 17:19:43 LOG7[2396:1908]: Key file: client-test.key 2004.08.26 17:19:43 LOG5[2396:1908]: WIN32 platform: 30000 clients allowed 2004.08.26 17:19:43 LOG7[2396:1908]: FD 1828 in non-blocking mode 2004.08.26 17:19:43 LOG7[2396:1908]: SO_REUSEADDR option set on accept socket 2004.08.26 17:19:43 LOG7[2396:1908]: mysqlclient bound to 0.0.0.0:3306 2004.08.26 17:19:52 LOG7[2396:1908]: mysqlclient accepted FD=1836 from 127.0.0.1:3269 2004.08.26 17:19:52 LOG7[2396:1908]: FD 1836 in non-blocking mode 2004.08.26 17:19:52 LOG7[2396:1908]: Creating a new thread 2004.08.26 17:19:52 LOG7[2396:1908]: New thread created 2004.08.26 17:19:52 LOG7[2396:1816]: mysqlclient started 2004.08.26 17:19:52 LOG5[2396:1816]: mysqlclient connected from 127.0.0.1:3269 2004.08.26 17:19:52 LOG7[2396:1816]: FD 1816 in non-blocking mode 2004.08.26 17:19:52 LOG7[2396:1816]: mysqlclient connecting xx.xx.xx.xx:3306 2004.08.26 17:19:52 LOG7[2396:1816]: remote connect #1: EWOULDBLOCK: retrying 2004.08.26 17:19:52 LOG7[2396:1816]: waitforsocket: FD=1816, DIR=write 2004.08.26 17:19:52 LOG7[2396:1816]: waitforsocket: ok 2004.08.26 17:19:52 LOG7[2396:1816]: remote connect #2: EINVAL: ok 2004.08.26 17:19:52 LOG7[2396:1816]: Remote FD=1816 initialized 2004.08.26 17:19:52 LOG7[2396:1816]: SSL state (connect): before/connect initialization 2004.08.26 17:19:52 LOG7[2396:1816]: SSL state (connect): SSLv3 write client hello A 2004.08.26 17:19:52 LOG7[2396:1816]: SSL alert (write): fatal: handshake failure 2004.08.26 17:19:52 LOG3[2396:1816]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2004.08.26 17:19:52 LOG7[2396:1816]: mysqlclient finished (0 left) What is wrong here? Thank you! Regards, Szabolcs Rumi

1 0

RE: [stunnel-users] Problem running Stunnel 4.05 on AIX 5.2
by Baker Nelson 25 Aug '04

25 Aug '04

HAH! Got it. Thanks for the help getting my debug info set up. Here is the backtrace from gdb: adev>#gdb /usr/local/sbin/stunnel /usr/local/ssl/core GNU gdb 5.0-aix51-020209 Copyright 2000 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "powerpc-ibm-aix5.2.0.0"... Core was generated by `stunnel'. Program terminated with signal 11, Segmentation fault. #0 0xd01199e8 in _sigsetmask () (gdb) backtrace #0 0xd01199e8 in _sigsetmask () #1 0xffffffff in ?? () from (unknown load module) (some reminders: I was trying to run stunnel 4.05 on AIX 5.2 with Openssl and keep get segmentation fault. Config sent previously) Thanks. Baker -----Original Message----- From: Michal Trojnara [mailto:[email protected]] Sent: Monday, August 23, 2004 5:05 PM To: Baker Nelson Subject: Re: [stunnel-users] Problem running Stunnel 4.05 on AIX 5.2 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Monday 23 of August 2004 17:57, Baker Nelson wrote: > Finally got a new core dump to come out, was fooling with the client.c code > last week and wanted to start all from scratch. But, I can not get gdb to > work, does not find it. Is it an optional install for the gcc compiler? Just another useful GNU programming tool. Just like binutils, make or gcc. What about: http://www-1.ibm.com/servers/aix/products/aixos/linux/download.html ? Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFBKlwX/NU+nXTHMtERAveDAJ0XYkD35Iq7n9rjBzp+1IDu9nFQRwCgjjpG CmXLUwMJT9aygtsuQPWl5aY= =4qkl -----END PGP SIGNATURE-----

2 1

waitforsocket takes over 1 minute :-((
by Hartmut Gehrke-Tschudi 25 Aug '04

25 Aug '04

hi, I run stunnel 4.04 on i586-suse-linux-gnu PTHREAD with OpenSSL 0.9.6i [engine]. When I open up connection to my Mailserver for fetchmail to get mails I regularily have to wait for 1 1/2 minutes before it starts fetching here is part of stunnel.log (mark: 11:27:22 and 11:28:43) 2004.08.25 11:27:22 LOG7[16627:49154]: SSL state (connect): before/connect initialization 2004.08.25 11:27:22 LOG7[16627:49154]: SSL state (connect): SSLv3 write client hello A 2004.08.25 11:27:22 LOG7[16627:49154]: waitforsocket: FD=11, DIR=read 2004.08.25 11:28:43 LOG7[16627:49154]: waitforsocket: ok 2004.08.25 11:28:43 LOG7[16627:49154]: SSL state (connect): SSLv3 read server hello A 2004.08.25 11:28:43 LOG7[16627:49154]: waitforsocket: FD=11, DIR=read 2004.08.25 11:28:44 LOG7[16627:49154]: waitforsocket: ok What is the reason and can I change that. Thanks for any advice Hartmut -- Hartmut Gehrke-Tschudi * +++++++++++++++++++++++++++++++++++++++++ hgtschudi(a)free.de > * ++++ on croit mourir pour la patrie++++++ Bochum * ++++ on meurt pour des industriels ++++++ BRD * +++++++ Anatol France +++++++++ * +++++++++++++++++++++++++++++++++++++++++

1 0

Going from 3.x command line to 4.x .conf file
by Thomas Gagné 25 Aug '04

25 Aug '04

I'm having a problem connecting with sourcehost using stunnel w/ configuration files. The command line version from 3.x works. Here's the command line for 3.x ./stunnel -c -p client.pem -d localhost:2401 -r repository.sourcehosting.net:2402 -P none -f -v 3 -A cacert.pem and the conf file from 4.x # Some debugging stuff debug = 7 output = stunnel.log # Use it for client mode client = yes foreground = yes verify = 3 key = client.pem cert = cacert.pem # Service-level configuration [cvs] accept = 2401 connect = repository.sourcehosting.net:2402 When I run the older version it starts: ./stunnel -c -p client.pem -d localhost:2401 -r repository.sourcehosting.net:2402 -P none -f -v 3 -A cacert.pem 2004.08.24 21:30:18 LOG5[2221:16384]: Using 'repository.sourcehosting.net.2402' as tcpwrapper service name Enter PEM pass phrase: 2004.08.24 21:30:24 LOG5[2221:16384]: Peer certificate location 2004.08.24 21:30:24 LOG5[2221:16384]: stunnel 3.26 on i686-pc-linux-gnu PTHREAD with OpenSSL 0.9.7d 17 Mar 20042004.08.24 21:30:24 LOG5[2221:16384]: FD_SETSIZE=1024, file ulimit=1024 -> 500 clients allowed But when I run the newer version (with .conf) I get: 2004.08.24 21:31:43 LOG5[2236:4144017536]: stunnel 4.05 on i386-redhat-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 2004.08.24 21:31:43 LOG7[2236:4144017536]: Snagged 64 random bytes from /home/tgagne/.rnd 2004.08.24 21:31:43 LOG7[2236:4144017536]: Wrote 1024 new random bytes to /home/tgagne/.rnd 2004.08.24 21:31:43 LOG7[2236:4144017536]: RAND_status claims sufficient entropy for the PRNG 2004.08.24 21:31:43 LOG6[2236:4144017536]: PRNG seeded successfully 2004.08.24 21:31:43 LOG7[2236:4144017536]: Certificate: cacert.pem 2004.08.24 21:31:43 LOG7[2236:4144017536]: Key file: client.pem 2004.08.24 21:31:47 LOG3[2236:4144017536]: SSL_CTX_use_RSAPrivateKey_file: B080074: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch I'm using the same cacert.pem and client.pem for both, as well as the same passphrase.

2 1

Problem running Stunnel 4.05 on AIX 5.2
by Baker Nelson 23 Aug '04

23 Aug '04

Hi all, I am trying to run Stunnel 4.05 on AIX 5.2 to secure our homegrown webserver. I have been searching archives all over the place, and have yet to find the answer, but have found many comments here and there that seem to indicate a problem with Stunnel on AIX. The problem, in a nutshell, is that I get an error on SSL_read in the stunnel log and it shuts down with a segmentation fault after the first connection, no matter what I do. Configuration info attached below. Any help anyone can give would be greatly appreciatted. Thanks Baker stunnel 4.05 on powerpc-ibm-aix5.2.0.0 FORK with OpenSSL 0.9.7d 17 Mar 2004 Global options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /usr/local/etc/stunnel/stunnel.pem pid = /usr/local/var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTidle = 43200 seconds OpenSSL 0.9.7d 17 Mar 2004 conf-file: cert = /usr/local/ssl/stunnel.pem #chroot = /usr/local/var/run/stunnel/ pid = /usr/local/etc/stunnel/stunnel.pid setuid = HTTPD setgid = rrms #options = DONT_INSERT_EMPTY_FRAGMENTS # Some debugging stuff debug = 7 output = stunnel.log # Use it for client mode #client = yes foreground = yes # Service-level configuration [https] accept = 443 connect = 80 TIMEOUTclose = 0 stunnel - log (from running openssl s_client command to test setup): 2004.08.19 15:22:29 LOG5[16718:0]: stunnel 4.05 on powerpc-ibm-aix5.2.0.0 FORK w ith OpenSSL 0.9.7d 17 Mar 2004 2004.08.19 15:22:29 LOG4[16718:0]: Wrong permissions on /usr/local/ssl/stunnel.p em 2004.08.19 15:22:29 LOG7[16718:0]: Snagged 64 random bytes from //.rnd 2004.08.19 15:22:29 LOG7[16718:0]: Wrote 1024 new random bytes to //.rnd 2004.08.19 15:22:29 LOG7[16718:0]: RAND_status claims sufficient entropy for the PRNG 2004.08.19 15:22:29 LOG6[16718:0]: PRNG seeded successfully 2004.08.19 15:22:29 LOG7[16718:0]: Certificate: /usr/local/ssl/stunnel.pem 2004.08.19 15:22:29 LOG7[16718:0]: Key file: /usr/local/ssl/stunnel.pem 2004.08.19 15:22:29 LOG5[16718:0]: FD_SETSIZE=65534, file ulimit=65534 -> 31999 clients allowed 2004.08.19 15:22:29 LOG7[16718:0]: FD 4 in non-blocking mode 2004.08.19 15:22:29 LOG7[16718:0]: SO_REUSEADDR option set on accept socket 2004.08.19 15:22:29 LOG7[16718:0]: https bound to 0.0.0.0:443 2004.08.19 15:22:29 LOG7[16718:0]: FD 5 in non-blocking mode 2004.08.19 15:22:29 LOG7[16718:0]: FD 6 in non-blocking mode 2004.08.19 15:22:29 LOG7[16718:0]: Created pid file /usr/local/etc/stunnel/stunn el.pid 2004.08.19 15:22:30 LOG7[16718:0]: https accepted FD=7 from **ip**:33519 2004.08.19 15:22:30 LOG7[16718:0]: FD 7 in non-blocking mode 2004.08.19 15:22:30 LOG7[21344:0]: https started 2004.08.19 15:22:30 LOG5[21344:0]: https connected from **ip**:33519 2004.08.19 15:22:30 LOG7[21344:0]: SSL state (accept): before/accept initializat ion 2004.08.19 15:22:30 LOG7[21344:0]: SSL state (accept): SSLv3 read client hello A 2004.08.19 15:22:30 LOG7[21344:0]: SSL state (accept): SSLv3 write server hello A 2004.08.19 15:22:30 LOG7[21344:0]: SSL state (accept): SSLv3 write certificate A 2004.08.19 15:22:30 LOG7[21344:0]: SSL state (accept): SSLv3 write server done A 2004.08.19 15:22:30 LOG7[21344:0]: SSL state (accept): SSLv3 flush data 2004.08.19 15:22:30 LOG7[21344:0]: waitforsocket: FD=7, DIR=read 2004.08.19 15:22:30 LOG7[21344:0]: waitforsocket: ok 2004.08.19 15:22:30 LOG7[21344:0]: SSL state (accept): SSLv3 read client key exc hange A 2004.08.19 15:22:30 LOG7[21344:0]: SSL state (accept): SSLv3 read finished A 2004.08.19 15:22:30 LOG7[21344:0]: SSL state (accept): SSLv3 write change cipher spec A 2004.08.19 15:22:30 LOG7[21344:0]: SSL state (accept): SSLv3 write finished A 2004.08.19 15:22:30 LOG7[21344:0]: SSL state (accept): SSLv3 flush data 2004.08.19 15:22:30 LOG7[21344:0]: 1 items in the session cache 2004.08.19 15:22:30 LOG7[21344:0]: 0 client connects (SSL_connect()) 2004.08.19 15:22:30 LOG7[21344:0]: 0 client connects that finished 2004.08.19 15:22:30 LOG7[21344:0]: 0 client renegotiatations requested 2004.08.19 15:22:30 LOG7[21344:0]: 1 server connects (SSL_accept()) 2004.08.19 15:22:30 LOG7[21344:0]: 1 server connects that finished 2004.08.19 15:22:30 LOG7[21344:0]: 0 server renegotiatiations requested 2004.08.19 15:22:30 LOG7[21344:0]: 0 session cache hits 2004.08.19 15:22:30 LOG7[21344:0]: 0 session cache misses 2004.08.19 15:22:30 LOG7[21344:0]: 0 session cache timeouts 2004.08.19 15:22:30 LOG6[21344:0]: Negotiated ciphers: AES256-SHA S SLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2004.08.19 15:22:30 LOG7[21344:0]: FD 4 in non-blocking mode 2004.08.19 15:22:30 LOG7[21344:0]: https connecting 127.0.0.1:80 2004.08.19 15:22:30 LOG7[21344:0]: Remote FD=4 initialized 2004.08.19 15:22:32 LOG7[21344:0]: Socket closed on read 2004.08.19 15:22:32 LOG7[21344:0]: SSL write shutdown (output buffer empty) 2004.08.19 15:22:32 LOG7[21344:0]: SSL alert (write): warning: close notify 2004.08.19 15:22:32 LOG7[21344:0]: SSL_shutdown retrying 2004.08.19 15:22:32 LOG7[21344:0]: select timeout waiting for SSL close_notify 2004.08.19 15:22:32 LOG5[21344:0]: Connection closed: 311 bytes sent to SSL, 9 b ytes sent to socket 2004.08.19 15:22:32 LOG7[21344:0]: removing pid file /usr/local/etc/stunnel/stun nel.pid

2 3

Stunnel to the rescue
by Steven Sporen 23 Aug '04

23 Aug '04

Hi, Is it possible to configure STUNNEL to provide support for STARTTLS with IMAP (Microsoft Exchange Server doesn't support this) Have a look at RFC2595 http://www.faqs.org/rfcs/rfc2595.html The reason is - Symbian cell phones only allow secure IMAP via this method they can't connect to SIMAP. Please help Thanks

2 1

RE: [stunnel-users] Newbie: Keep getting connection closed
by david-e.hansen＠ubs.com 17 Aug '04

17 Aug '04

Charles, Check to see if you are being bitten by the "Eudora" problem -- add the following line to the top of your stunnel.conf file, and see if it magically starts working: options = DONT_INSERT_EMPTY_FRAGMENTS You can also see a related set of mails from myself, describing the problem we had. Regards, David Hansen -----Original Message----- From: stunnel-users-admin(a)mirt.net [mailto:[email protected]]On Behalf Of Charles A. Monteiro Sent: Dienstag, 17. August 2004 18:31 To: stunnel-users(a)mirt.net Subject: [stunnel-users] Newbie: Keep getting connection closed We are using a proprietary protocol over tcp/ip which works fine and has for a number of years. I have tested it without stunnel and it checks fine as well. I keep getting the connection closed when I run through stunnel. I don't understand if something bad has actually happened i.e. from the error warnings. Is an "alert" a bad thing i.e. does it indicate that something is broken? Does stunnel normally close the connection after every message exchange? I have included the logs for both the stunnel client and server as well as the respective conf files. thanks in advance, -Charles --------------------------------------- client log: 2004.08.17 11:13:27 LOG7[1824:1544]: 55555 accepted FD=536 from 127.0.0.1:1085 2004.08.17 11:13:27 LOG7[1824:1544]: FD 536 in non-blocking mode 2004.08.17 11:13:27 LOG7[1824:1544]: Creating a new thread 2004.08.17 11:13:27 LOG7[1824:1544]: New thread created 2004.08.17 11:13:27 LOG7[1824:1040]: 55555 started 2004.08.17 11:13:27 LOG5[1824:1040]: 55555 connected from 127.0.0.1:1085 2004.08.17 11:13:27 LOG7[1824:1040]: FD 564 in non-blocking mode 2004.08.17 11:13:27 LOG7[1824:1040]: 55555 connecting 192.168.20.76:55555 2004.08.17 11:13:27 LOG7[1824:1040]: remote connect #1: EWOULDBLOCK: retrying 2004.08.17 11:13:27 LOG7[1824:1040]: waitforsocket: FD=564, DIR=write 2004.08.17 11:13:27 LOG7[1824:1040]: waitforsocket: ok 2004.08.17 11:13:27 LOG7[1824:1040]: Remote FD=564 initialized 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): before/connect initialization 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 write client hello A 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 read server hello A 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 read server certificate A 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 read server done A 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 write client key exchange A 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 write change cipher spec A 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 write finished A 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 flush data 2004.08.17 11:13:27 LOG7[1824:1040]: waitforsocket: FD=564, DIR=read 2004.08.17 11:13:27 LOG7[1824:1040]: waitforsocket: ok 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 read finished A 2004.08.17 11:13:27 LOG7[1824:1040]: 6 items in the session cache 2004.08.17 11:13:27 LOG7[1824:1040]: 7 client connects (SSL_connect()) 2004.08.17 11:13:27 LOG7[1824:1040]: 7 client connects that finished 2004.08.17 11:13:27 LOG7[1824:1040]: 0 client renegotiatations requested 2004.08.17 11:13:27 LOG7[1824:1040]: 0 server connects (SSL_accept()) 2004.08.17 11:13:27 LOG7[1824:1040]: 0 server connects that finished 2004.08.17 11:13:27 LOG7[1824:1040]: 0 server renegotiatiations requested 2004.08.17 11:13:27 LOG7[1824:1040]: 1 session cache hits 2004.08.17 11:13:27 LOG7[1824:1040]: 0 session cache misses 2004.08.17 11:13:27 LOG7[1824:1040]: 0 session cache timeouts 2004.08.17 11:13:27 LOG6[1824:1040]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2004.08.17 11:13:27 LOG7[1824:1040]: Socket closed on read 2004.08.17 11:13:27 LOG7[1824:1040]: SSL write shutdown (output buffer empty) 2004.08.17 11:13:27 LOG7[1824:1040]: SSL alert (write): warning: close notify 2004.08.17 11:13:27 LOG7[1824:1040]: SSL_shutdown retrying 2004.08.17 11:13:27 LOG7[1824:1040]: SSL alert (read): warning: close notify 2004.08.17 11:13:27 LOG7[1824:1040]: SSL closed on SSL_read 2004.08.17 11:13:27 LOG7[1824:1040]: Socket write shutdown (output buffer empty) 2004.08.17 11:13:27 LOG5[1824:1040]: Connection closed: 110 bytes sent to SSL, 13 bytes sent to socket 2004.08.17 11:13:27 LOG7[1824:1040]: 55555 finished (0 left) ------------------------------------------------------------- server log: 2004.08.17 11:03:12 LOG7[28177:3073021920]: 55555 accepted FD=7 from 192.168.20.77:1086 2004.08.17 11:03:12 LOG7[28177:3073021920]: FD 7 in non-blocking mode 2004.08.17 11:03:12 LOG7[28177:3062528944]: 55555 started 2004.08.17 11:03:12 LOG5[28177:3062528944]: 55555 connected from 192.168.20.77:1086 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): before/accept initialization 2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: FD=7, DIR=read 2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: ok 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 read client hello A 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 write server hello A 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 write certificate A 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 write server done A 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 flush data 2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: FD=7, DIR=read 2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: ok 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 read client key exchange A 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 read finished A 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 write change cipher spec A 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 write finished A 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 flush data 2004.08.17 11:03:12 LOG7[28177:3062528944]: 2 items in the session cache 2004.08.17 11:03:12 LOG7[28177:3062528944]: 0 client connects (SSL_connect()) 2004.08.17 11:03:12 LOG7[28177:3062528944]: 0 client connects that finished 2004.08.17 11:03:12 LOG7[28177:3062528944]: 0 client renegotiatations requested 2004.08.17 11:03:12 LOG7[28177:3062528944]: 18 server connects (SSL_accept()) 2004.08.17 11:03:12 LOG7[28177:3062528944]: 10 server connects that finished 2004.08.17 11:03:12 LOG7[28177:3062528944]: 0 server renegotiatiations requested 2004.08.17 11:03:12 LOG7[28177:3062528944]: 2 session cache hits 2004.08.17 11:03:12 LOG7[28177:3062528944]: 0 session cache misses 2004.08.17 11:03:12 LOG7[28177:3062528944]: 6 session cache timeouts 2004.08.17 11:03:12 LOG6[28177:3062528944]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2004.08.17 11:03:12 LOG7[28177:3062528944]: FD 8 in non-blocking mode 2004.08.17 11:03:12 LOG7[28177:3062528944]: 55555 connecting 192.168.20.76:4242 2004.08.17 11:03:12 LOG7[28177:3062528944]: remote connect #1: EINPROGRESS: retrying 2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: FD=8, DIR=write 2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: ok 2004.08.17 11:03:12 LOG7[28177:3062528944]: Remote FD=8 initialized 2004.08.17 11:03:12 LOG7[28177:3062528944]: Socket closed on read 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL alert (write): warning: close notify 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL write shutdown (output buffer empty) 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL alert (read): warning: close notify 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL closed on SSL_read 2004.08.17 11:03:12 LOG7[28177:3062528944]: Socket write shutdown (output buffer empty) 2004.08.17 11:03:12 LOG5[28177:3062528944]: Connection closed: 13 bytes sent to SSL, 110 bytes sent to socket 2004.08.17 11:03:12 LOG7[28177:3062528944]: 55555 finished (0 left) ------------------------------------------------------------------------------------------------------------------- My client stunnel.conf: cert=stunnel.pem client=yes debug=7 [55555] accept=localhost:55555 connect=192.168.20.76:55555 - eof - My server stunnel.conf: cert=stunnel.pem debug=7 output=stunnel.err [55555] accept=192.168.20.76:55555 connect=192.168.20.76:4242 - eof - -- Using Opera's revolutionary e-mail client: http://www.opera.com/m2/ _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users Visit our website at http://www.ubs.com This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message which arise as a result of e-mail transmission. If verification is required please request a hard-copy version. This message is provided for informational purposes and should not be construed as a solicitation or offer to buy or sell any securities or related financial instruments.

2 1

Re: chrooting 4.05 - can't get UID for user _stunnel
by Brian Hatch 17 Aug '04

17 Aug '04

> Amazing how none of the OpenBSD packages ever actually seem to work. :) Whoa - them's fighting words. ;-) (Happily a Debian Linux user. My packages may be two years old, but they work, dammit.) -- Brian Hatch Anarchy: it's not the law, Systems and it's just a good idea. Security Engineer http://www.ifokr.org/bri/ Every message PGP signed

1 0

Newbie: Keep getting connection closed
by Charles A. Monteiro 17 Aug '04

17 Aug '04

We are using a proprietary protocol over tcp/ip which works fine and has for a number of years. I have tested it without stunnel and it checks fine as well. I keep getting the connection closed when I run through stunnel. I don't understand if something bad has actually happened i.e. from the error warnings. Is an "alert" a bad thing i.e. does it indicate that something is broken? Does stunnel normally close the connection after every message exchange? I have included the logs for both the stunnel client and server as well as the respective conf files. thanks in advance, -Charles --------------------------------------- client log: 2004.08.17 11:13:27 LOG7[1824:1544]: 55555 accepted FD=536 from 127.0.0.1:1085 2004.08.17 11:13:27 LOG7[1824:1544]: FD 536 in non-blocking mode 2004.08.17 11:13:27 LOG7[1824:1544]: Creating a new thread 2004.08.17 11:13:27 LOG7[1824:1544]: New thread created 2004.08.17 11:13:27 LOG7[1824:1040]: 55555 started 2004.08.17 11:13:27 LOG5[1824:1040]: 55555 connected from 127.0.0.1:1085 2004.08.17 11:13:27 LOG7[1824:1040]: FD 564 in non-blocking mode 2004.08.17 11:13:27 LOG7[1824:1040]: 55555 connecting 192.168.20.76:55555 2004.08.17 11:13:27 LOG7[1824:1040]: remote connect #1: EWOULDBLOCK: retrying 2004.08.17 11:13:27 LOG7[1824:1040]: waitforsocket: FD=564, DIR=write 2004.08.17 11:13:27 LOG7[1824:1040]: waitforsocket: ok 2004.08.17 11:13:27 LOG7[1824:1040]: Remote FD=564 initialized 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): before/connect initialization 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 write client hello A 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 read server hello A 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 read server certificate A 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 read server done A 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 write client key exchange A 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 write change cipher spec A 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 write finished A 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 flush data 2004.08.17 11:13:27 LOG7[1824:1040]: waitforsocket: FD=564, DIR=read 2004.08.17 11:13:27 LOG7[1824:1040]: waitforsocket: ok 2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 read finished A 2004.08.17 11:13:27 LOG7[1824:1040]: 6 items in the session cache 2004.08.17 11:13:27 LOG7[1824:1040]: 7 client connects (SSL_connect()) 2004.08.17 11:13:27 LOG7[1824:1040]: 7 client connects that finished 2004.08.17 11:13:27 LOG7[1824:1040]: 0 client renegotiatations requested 2004.08.17 11:13:27 LOG7[1824:1040]: 0 server connects (SSL_accept()) 2004.08.17 11:13:27 LOG7[1824:1040]: 0 server connects that finished 2004.08.17 11:13:27 LOG7[1824:1040]: 0 server renegotiatiations requested 2004.08.17 11:13:27 LOG7[1824:1040]: 1 session cache hits 2004.08.17 11:13:27 LOG7[1824:1040]: 0 session cache misses 2004.08.17 11:13:27 LOG7[1824:1040]: 0 session cache timeouts 2004.08.17 11:13:27 LOG6[1824:1040]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2004.08.17 11:13:27 LOG7[1824:1040]: Socket closed on read 2004.08.17 11:13:27 LOG7[1824:1040]: SSL write shutdown (output buffer empty) 2004.08.17 11:13:27 LOG7[1824:1040]: SSL alert (write): warning: close notify 2004.08.17 11:13:27 LOG7[1824:1040]: SSL_shutdown retrying 2004.08.17 11:13:27 LOG7[1824:1040]: SSL alert (read): warning: close notify 2004.08.17 11:13:27 LOG7[1824:1040]: SSL closed on SSL_read 2004.08.17 11:13:27 LOG7[1824:1040]: Socket write shutdown (output buffer empty) 2004.08.17 11:13:27 LOG5[1824:1040]: Connection closed: 110 bytes sent to SSL, 13 bytes sent to socket 2004.08.17 11:13:27 LOG7[1824:1040]: 55555 finished (0 left) ------------------------------------------------------------- server log: 2004.08.17 11:03:12 LOG7[28177:3073021920]: 55555 accepted FD=7 from 192.168.20.77:1086 2004.08.17 11:03:12 LOG7[28177:3073021920]: FD 7 in non-blocking mode 2004.08.17 11:03:12 LOG7[28177:3062528944]: 55555 started 2004.08.17 11:03:12 LOG5[28177:3062528944]: 55555 connected from 192.168.20.77:1086 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): before/accept initialization 2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: FD=7, DIR=read 2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: ok 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 read client hello A 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 write server hello A 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 write certificate A 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 write server done A 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 flush data 2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: FD=7, DIR=read 2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: ok 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 read client key exchange A 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 read finished A 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 write change cipher spec A 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 write finished A 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 flush data 2004.08.17 11:03:12 LOG7[28177:3062528944]: 2 items in the session cache 2004.08.17 11:03:12 LOG7[28177:3062528944]: 0 client connects (SSL_connect()) 2004.08.17 11:03:12 LOG7[28177:3062528944]: 0 client connects that finished 2004.08.17 11:03:12 LOG7[28177:3062528944]: 0 client renegotiatations requested 2004.08.17 11:03:12 LOG7[28177:3062528944]: 18 server connects (SSL_accept()) 2004.08.17 11:03:12 LOG7[28177:3062528944]: 10 server connects that finished 2004.08.17 11:03:12 LOG7[28177:3062528944]: 0 server renegotiatiations requested 2004.08.17 11:03:12 LOG7[28177:3062528944]: 2 session cache hits 2004.08.17 11:03:12 LOG7[28177:3062528944]: 0 session cache misses 2004.08.17 11:03:12 LOG7[28177:3062528944]: 6 session cache timeouts 2004.08.17 11:03:12 LOG6[28177:3062528944]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2004.08.17 11:03:12 LOG7[28177:3062528944]: FD 8 in non-blocking mode 2004.08.17 11:03:12 LOG7[28177:3062528944]: 55555 connecting 192.168.20.76:4242 2004.08.17 11:03:12 LOG7[28177:3062528944]: remote connect #1: EINPROGRESS: retrying 2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: FD=8, DIR=write 2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: ok 2004.08.17 11:03:12 LOG7[28177:3062528944]: Remote FD=8 initialized 2004.08.17 11:03:12 LOG7[28177:3062528944]: Socket closed on read 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL alert (write): warning: close notify 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL write shutdown (output buffer empty) 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL alert (read): warning: close notify 2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL closed on SSL_read 2004.08.17 11:03:12 LOG7[28177:3062528944]: Socket write shutdown (output buffer empty) 2004.08.17 11:03:12 LOG5[28177:3062528944]: Connection closed: 13 bytes sent to SSL, 110 bytes sent to socket 2004.08.17 11:03:12 LOG7[28177:3062528944]: 55555 finished (0 left) ------------------------------------------------------------------------------------------------------------------- My client stunnel.conf: cert=stunnel.pem client=yes debug=7 [55555] accept=localhost:55555 connect=192.168.20.76:55555 - eof - My server stunnel.conf: cert=stunnel.pem debug=7 output=stunnel.err [55555] accept=192.168.20.76:55555 connect=192.168.20.76:4242 - eof - -- Using Opera's revolutionary e-mail client: http://www.opera.com/m2/

1 0

SSL Handshake problems
by markzero＠logik.ath.cx 16 Aug '04

16 Aug '04

I have a tunnel that forwards connections from syslog-ng on localhost to my loghost. Or rather, I don't. In the stunnel logs, I repeatedly get: 2004.08.16 21:28:30 LOG5[23452:1006768128]: syslogngs connected from 127.0.0.1:32479 2004.08.16 21:28:30 LOG7[23452:1006768128]: SSL state (accept): before/accept initialization 2004.08.16 21:28:30 LOG3[23452:1006768128]: SSL_accept: 140760FC: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol 2004.08.16 21:28:30 LOG7[23452:1006768128]: syslogngs finished (2 left) 2004.08.16 21:28:31 LOG7[23452:1006693376]: SSL socket closed on SSL_read 2004.08.16 21:28:31 LOG5[23452:1006693376]: Connection closed: 0 bytes sent to SSL, 0 bytes sent to socket 2004.08.16 21:28:31 LOG7[23452:1006693376]: syslogngs finished (1 left) 2004.08.16 21:30:01 LOG7[23452:1006763008]: waitforsocket: ok 2004.08.16 21:30:01 LOG3[23452:1006763008]: SSL_accept: 140760FC: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol 2004.08.16 21:30:01 LOG7[23452:1006763008]: syslogngs finished (0 left) ..yet connecting using: $ openssl s_client -connect localhost:5515 successfully connects to my loghost and prints the certificate details. Why on earth will s_client connect and not syslog-ng? Specific details: 192.168.1.6 syslog-ng -> localhost:5515 | stunnel <----------| | stunnel ----------> loghost:5514 loghost: 192.168.1.7 (hosts) ---> stunnel (192.168.1.7:5514) | syslog-ng (localhost:5515) I have now been trying to implement encrypted logging for a record time of three months now and so far every attempt has failed in some way or another. Can somebody please put an end to this adminstrative misery? (more verbose program output on request) mark

1 1

_GET_CLIENT_HELLO:unknown protocol
by markzero＠logik.ath.cx 16 Aug '04

16 Aug '04

Hi. I'm so close to having a working loghost, with stunnel encrypted connections. Not close enough however. I have syslog-ng setup to log to 127.0.0.1:5515 on all clients. The client config: [syslogngs] accept = 127.0.0.1:5515 connect = 192.168.1.7:5514 On the loghost, stunnel listens on *.5514 and forwards to connection to 127.0.0.1:5515 (which syslog-ng is listening on). (server config): [syslogngs] accept = 192.168.1.7:5514 connect = 127.0.0.1:5515 I'm making an assumption that the certificates are working, as I'm using (or attempting to use) both client and server authentication. Watching the stream with a packet sniffer shows absolutely no connections between the client and the loghost. Strings such as this appear in the stunnel.log repeatedly: 2004.08.16 20:42:26 LOG7[7690:1006693376]: syslogngs started 2004.08.16 20:42:26 LOG5[7690:1006693376]: syslogngs connected from 127.0.0.1:2956 2004.08.16 20:42:26 LOG7[7690:1006693376]: SSL state (accept): before/accept initialization 2004.08.16 20:42:26 LOG7[7690:1006693376]: waitforsocket: FD=13, DIR=read 2004.08.16 20:42:26 LOG7[7690:1006690304]: syslogngs accepted FD=14 from 127.0.0.1:24856 2004.08.16 20:42:26 LOG7[7690:1006690304]: FD 14 in non-blocking mode 2004.08.16 20:42:26 LOG7[7690:1006763008]: syslogngs started 2004.08.16 20:42:26 LOG5[7690:1006763008]: syslogngs connected from 127.0.0.1:24856 2004.08.16 20:42:26 LOG7[7690:1006763008]: SSL state (accept): before/accept initialization 2004.08.16 20:42:26 LOG7[7690:1006763008]: waitforsocket: FD=14, DIR=read 2004.08.16 20:42:26 LOG7[7690:1006763008]: waitforsocket: ok 2004.08.16 20:42:26 LOG3[7690:1006763008]: SSL_accept: 140760FC: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol 2004.08.16 20:42:26 LOG7[7690:1006763008]: syslogngs finished (1 left) 2004.08.16 20:47:26 LOG7[7690:1006693376]: waitforsocket: timeout 2004.08.16 20:47:26 LOG7[7690:1006693376]: syslogngs finished (0 left) Have I made some glaring error that I'm not aware of? thanks mark

1 0