- stunnel-users - stunnel.org

<Stunnel> multiple connection
by aliquippa1 23 May '06

23 May '06

Hello I have problem with stunnel. I want to use feature which I'm not sure if is available. I want to accept connection from a host and then connect to a few hosts. I want to have something like this: accept = xxx.xxx.xxx.xxx:xxxx connect = yyy.yyy.yyy.yyy:yyyy connect = zzz.zzz.zzz.zzz:zzzz connect = vvv.vvv.vvv.vvv:vvv Now I want to get such situation: 1.accept connection from xxx. 2.try to connect to yyy. 3 if it doesn't work try to connect to zzz. 4 if it doesn't work try to connect to vvv. I wonder if it's possible, because if I use stunnel and connect from xxx it connects me only to the first host and when I connect from xxx again it connects me to the second host and after the third trial from xxx it connects me to vvv. Thanx Agnes

1 0

SSL23_GET_CLIENT_HELLO:unknown protocol
by Srilalitha Muralidhara(HCL Capital Market Services) 22 May '06

22 May '06

Hi I am getting SSL23_GET_CLIENT_HELLO:unknown protocol error stunnel. Any guesses about the cause of the problem? Here is the complete log 2006.05.22 07:01:55 LOG5[734:1]: stunnel 4.15 on sparc-sun-solaris2.6 with OpenSSL 0.9.8b 04 May 2006 2006.05.22 07:01:55 LOG5[734:1]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Auth:LIBWRAP 2006.05.22 07:01:55 LOG6[734:1]: file ulimit = 64 (can be changed with 'ulimit -n') 2006.05.22 07:01:55 LOG6[734:1]: poll() used - no FD_SETSIZE limit for file descriptors 2006.05.22 07:01:55 LOG5[734:1]: 29 clients allowed 2006.05.22 07:01:55 LOG7[734:1]: FD 5 in non-blocking mode 2006.05.22 07:01:55 LOG7[734:1]: FD 6 in non-blocking mode 2006.05.22 07:01:55 LOG7[734:1]: FD 7 in non-blocking mode 2006.05.22 07:01:55 LOG7[734:1]: SO_REUSEADDR option set on accept socket 2006.05.22 07:01:55 LOG7[734:1]: rssvr bound to 10.140.42.11:25433 2006.05.22 07:01:55 LOG7[735:1]: Created pid file /home/sri/stunnel/var/lib/stunnel/stunnel.pid 2006.05.22 07:04:09 LOG7[735:1]: rssvr accepted FD=0 from 10.140.42.11:44360 2006.05.22 07:04:09 LOG7[735:4]: rssvr started 2006.05.22 07:04:09 LOG7[735:4]: FD 0 in non-blocking mode 2006.05.22 07:04:09 LOG7[735:4]: TCP_NODELAY option set on local socket 2006.05.22 07:04:09 LOG7[735:4]: FD 1 in non-blocking mode 2006.05.22 07:04:09 LOG7[735:4]: FD 2 in non-blocking mode 2006.05.22 07:04:09 LOG7[735:4]: Connection from 10.140.42.11:44360 permitted by libwrap 2006.05.22 07:04:09 LOG5[735:4]: rssvr connected from 10.140.42.11:44360 2006.05.22 07:04:09 LOG7[735:1]: Cleaning up the signal pipe 2006.05.22 07:04:09 LOG6[735:1]: Child process 938 finished with code 0 2006.05.22 07:04:09 LOG7[735:4]: SSL state (accept): before/accept initialization 2006.05.22 07:04:09 LOG3[735:4]: SSL_accept: 140760FC: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol 2006.05.22 07:04:09 LOG5[735:4]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.05.22 07:04:09 LOG7[735:4]: rssvr finished (0 left) Thanks, Sri Disclaimer: *********** The contents of this E-mail (including the contents of the enclosure(s) or attachment(s) if any) are privileged and confidential material of HCL Capital Market Services and should not be disclosed to, used by or copied in any manner by anyone other than the intended addressee(s). In case you are not the desired addressee, you should delete this message and/or re-direct it to the sender. The views expressed in this E-mail message (including the enclosure(s) or attachment(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of HCL Capital Market Services. This e-mail message including attachment/(s), if any, is believed to be free of any virus. However, it is the responsibility of the recipient to ensure that it is virus free and HCL Capital Market Services is not responsible for any loss or damage arising in any way from its use.

1 0

stunnel-4.15 segfaulting and looping under FreeBSD-CURRENT
by Michael Weiser 17 May '06

17 May '06

Hi, I've run into the problem mentioned in: > Scott Tuc Ellentuch at T-B-O-H ml at t-b-o-h.net > Fri Apr 21 23:45:11 CEST 2006 > Hi, > I just did a portupgrade in FreeBSD from 4.14 to 4.15, and now it > seems to be looping the command that I asked it, instead of just doing > it once. Has there been an option added I need to tell it to just do > once? > Thanks, Tuc I'm running stunnel in client mode. It execs uucico which receives and sends uucp jobs via stdin/stdout. The first call to uucico actually succeeds. It seems like stunnel is segfaulting and then re-exec-ing when it would normally quit. A core file is created in the current directory. But stunnel never quits and indefinitely continues to re-exec itself. Has there been any progress in solving this problem? -- Thanks, Michael

2 3

FW: [stunnel-users] Re: Re:Need a help in installation (Craig)
by Craig 17 May '06

17 May '06

Oops, mailed it directly to Peng :-0, Sorry for that ;-) Re:Need a help in installation (Craig) >Thanks a lot! Craig. I use your method: > ./configure --prefix=/stunnel2 No Problem ;-) >It seems that installation is successful. It successfully generate a >directory ./stunnel2, in which there are six subdirectories: etc lib man >sbin share var That looks right >But when I run stunnel command in the teminal window. It does not take it as >a command. Is it supposed to run stunnel command after the installation or >not? Is there anything missing in the Mac machine before it can run stunnel? If you go to the directory " /stunnel2/sbin " without quotes, do you see 2 files named stunnel and stunnel3? If you see these files, you can execute the stunnel file with something like ./stunnel --help To display the options available to you for the daemon to run. Let me know if there is something else you require ;) Regards, Craig >Thanks >Peng > From: <stunnel-users-request(a)mirt.net> > Reply-To: <stunnel-users(a)mirt.net> > Date: Mon, 15 May 2006 12:00:06 +0200 (CEST) > To: <stunnel-users(a)mirt.net> > Subject: stunnel-users Digest, Vol 22, Issue 12 > > Send stunnel-users mailing list submissions to > stunnel-users(a)mirt.net > > To subscribe or unsubscribe via the World Wide Web, visit > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)mirt.net > > You can reach the person managing the list at > stunnel-users-owner(a)mirt.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. RE: Need a help in installation (Craig) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 15 May 2006 08:15:36 +0200 > From: "Craig" <stunnel(a)rsw.co.za> > Subject: RE: [stunnel-users] Need a help in installation > To: <stunnel-users(a)mirt.net> > Message-ID: > <!&!AAAAAAAAAAAYAAAAAAAAADayToAwUd9AsHeKl2eRVAnCgAAAEAAAALWLI73av7VKpv9V31ec nQ > wBAAAAAA==(a)rsw.co.za> > > Content-Type: text/plain; charset="us-ascii" > > Don't know Mac, but can't u pass a prefix like in Linux to specify another > directory, for example your home directory? > > > > ./configure --prefix=/your/destination/directory > > > > Hope this helps > > > > Craig > > > > _____ > > From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] > On Behalf Of Peng He > Sent: 12 May 2006 11:45 PM > To: stunnel-users(a)mirt.net > Subject: [stunnel-users] Need a help in installation > > > > Hi, > > I want to install Stunnel 4.15 into MAC OS X machine. Somehow I do not have > the right to make any directory in /usr so I can not install Stunnel in > /usr/local. How do I install Stunnel into different directory? > > Thanks > Peng > >

1 0

Re: Re:Need a help in installation (Craig)
by Peng He 16 May '06

16 May '06

Thanks a lot! Craig. I use your method: ./configure --prefix=/stunnel2 It seems that installation is successful. It successfully generate a directory ./stunnel2, in which there are six subdirectories: etc lib man sbin share var But when I run stunnel command in the teminal window. It does not take it as a command. Is it supposed to run stunnel command after the installation or not? Is there anything missing in the Mac machine before it can run stunnel? Thanks Peng > From: <stunnel-users-request(a)mirt.net> > Reply-To: <stunnel-users(a)mirt.net> > Date: Mon, 15 May 2006 12:00:06 +0200 (CEST) > To: <stunnel-users(a)mirt.net> > Subject: stunnel-users Digest, Vol 22, Issue 12 > > Send stunnel-users mailing list submissions to > stunnel-users(a)mirt.net > > To subscribe or unsubscribe via the World Wide Web, visit > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)mirt.net > > You can reach the person managing the list at > stunnel-users-owner(a)mirt.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. RE: Need a help in installation (Craig) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 15 May 2006 08:15:36 +0200 > From: "Craig" <stunnel(a)rsw.co.za> > Subject: RE: [stunnel-users] Need a help in installation > To: <stunnel-users(a)mirt.net> > Message-ID: > <!&!AAAAAAAAAAAYAAAAAAAAADayToAwUd9AsHeKl2eRVAnCgAAAEAAAALWLI73av7VKpv9V31ecnQ > wBAAAAAA==(a)rsw.co.za> > > Content-Type: text/plain; charset="us-ascii" > > Don't know Mac, but can't u pass a prefix like in Linux to specify another > directory, for example your home directory? > > > > ./configure --prefix=/your/destination/directory > > > > Hope this helps > > > > Craig > > > > _____ > > From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] > On Behalf Of Peng He > Sent: 12 May 2006 11:45 PM > To: stunnel-users(a)mirt.net > Subject: [stunnel-users] Need a help in installation > > > > Hi, > > I want to install Stunnel 4.15 into MAC OS X machine. Somehow I do not have > the right to make any directory in /usr so I can not install Stunnel in > /usr/local. How do I install Stunnel into different directory? > > Thanks > Peng > >

1 0

Need a help in installation
by Peng He 15 May '06

15 May '06

Hi, I want to install Stunnel 4.15 into MAC OS X machine. Somehow I do not have the right to make any directory in /usr so I can not install Stunnel in /usr/local. How do I install Stunnel into different directory? Thanks Peng

2 1

SSL2Proxy
by Steve Cohen 12 May '06

12 May '06

Hello all, I'm tyring to get around content based(notHostBased) int*rn*t cen$0ring. (don't want this page to be indexed with that keyword, so please don't wite it in your response). This is what I need to do: Set Browser on client machine to use <proxyX:port>, but I want content to be encrypted. The proxy is trusted(ownedByMe), everything else in between is not, after the proxy everything is trusted. So this would be the setup: SetupA: ClientBroswer <> STunnelOnRemoteServer <> LocalProxyServerOnSameServer(Squid) <> RestOfTheInternet And NOT this: SetupB: Browser<>LocalSTunnel<>RemoteSTunnel<>Proxy<>RestOfTheInternet Because I don't want any special kind of configuration on the client's local machine except for setting the proxy.(I am currently doing this via ssh tunneling) -I have squid running on remote server listening on 3128 and it works -I have stunnel running on remote server listening on 8686 and forwarding to localhost:3128, -I have Firefox set to use <myServer:8686> as proxy But when trying to use it, Firefox says connection reset.... Please tell me why this is happening and what I need to do. Feel free to make any suggestions you want, I won't be annoyed if you tell me something I already know. Thanks.

2 1

certificate unknown - error:14094416
by Ludovic DUFLOT 12 May '06

12 May '06

Hi, I tried to use stunnel to connect in SSL to a LDAP server. But I can't and I've got this error message: certificate unknown The certificate is self-signed. If I use stunnel for establishing connexion with IMAPS server with a self-signed certificate too, all is right but not for LDAP connexion. I searched on the list's archives and with google but I can't find any solution... Help !!! Ludo ps: these are the stunnel.conf and the log: *************************** cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Some debugging stuff useful for troubleshooting debug = 7 ;output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [ldaps] accept = 389 connect = 10.0.0.1:636 verify = 0 [imaps] accept = 143 connect = 10.0.0.2:993 *************************** 2006.05.03 07:52:50 LOG7[4436:5780]: ldaps connecting 10.0.0.1:636 2006.05.03 07:52:50 LOG7[4436:5780]: connect_wait: waiting 10 seconds 2006.05.03 07:52:50 LOG7[4436:5780]: connect_wait: connected 2006.05.03 07:52:50 LOG7[4436:5780]: Remote FD=244 initialized 2006.05.03 07:52:50 LOG7[4436:5780]: TCP_NODELAY option set on remote socket 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): before/connect initialization 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write client hello A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 read server hello A 2006.05.03 07:52:50 LOG5[4436:5780]: VERIFY IGNORE: depth=1, /C=FR/ST=Savoie/L=Chambery/O=Universite de Savoie/OU=DSI/CN=DSI CA/emailAddress=admin(a)univ-savoie.fr 2006.05.03 07:52:50 LOG5[4436:5780]: VERIFY IGNORE: depth=1, /C=FR/ST=Savoie/L=Chambery/O=Universite de Savoie/OU=DSI/CN=DSI CA/emailAddress=admin(a)univ-savoie.fr 2006.05.03 07:52:50 LOG5[4436:5780]: VERIFY IGNORE: depth=1, /C=FR/ST=Savoie/L=Chambery/O=Universite de Savoie/OU=DSI/CN=DSI CA/emailAddress=admin(a)univ-savoie.fr 2006.05.03 07:52:50 LOG5[4436:5780]: VERIFY IGNORE: depth=0, /C=FR/ST=Savoie/L=Chambery/O=Universite de Savoie/OU=DSI/CN=ldap-bourget.univ-savoie.fr 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 read server certificate A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 read server certificate request A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 read server done A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write client certificate A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write client key exchange A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write certificate verify A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write change cipher spec A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write finished A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 flush data 2006.05.03 07:52:50 LOG7[4436:5780]: SSL alert (read): fatal: certificate unknown 2006.05.03 07:52:50 LOG3[4436:5780]: SSL_connect: 14094416: error:14094416:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate unknown 2006.05.03 07:52:50 LOG5[4436:5780]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.05.03 07:52:50 LOG7[4436:5780]: ldaps finished (0 left)

1 0

need HELP!! HELP!! with stunnel compile
by Nadav, Erez 10 May '06

10 May '06

Hi all, Hi all stunnel users. I want to debug and fix some TLS bugs with stunnel. I loaded stunnel 4.14 sources but i failed to compile it with visual studio 6, under windows 2000 environment. 1. Does anybody has the dsp file to be used under VC6++ for proper stunnel compilation ??? 2. Do I need any other libraries beside openssl to link ? I will appreciate any help Regards Erez __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

1 0

RE: [stunnel-users] stunnel use with TLS
by Nadav, Erez 10 May '06

10 May '06

I am using simple tcp/ip connection, which fail on the first hello message -----Original Message----- From: Scott Gifford [mailto:[email protected]] Sent: Wednesday, May 10, 2006 4:46 AM To: Nadav, Erez Cc: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] stunnel use with TLS "Nadav, Erez" <Erez.Nadav(a)verint.com> writes: > > > Hi all, > > > > 1. Can I use stunnel as a client which connects in TLS protocol ? Assuming you mean over a channel that starts of plaintext and is later converted to encryption, the command to start TLS is usually specific to the application protocol. What protocol are you using? For example, SMTP, IMAP, ?... ---Scott. __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

1 0

problems installing stunnel 4.15
by David Arques Perolada 10 May '06

10 May '06

I get the following message after doing "make" /usr/lib/gcc/i586-suse-linux/4.0.2/../../../../i586-suse-linux/bin/ld: cannot find -lwrap collect2: ld returned 1 exit status make[1]: *** [stunnel] Error 1 make[1]: Leaving directory `/root/Stunnel/stunnel-4.15/src' make: *** [all-recursive] Error 1 All help will be welcome Thanks in advance David Arques i Perolada E-Mail : darques(a)uoc.edu

1 0

stunnel use with TLS
by Nadav, Erez 10 May '06

10 May '06

Hi all, 1. Can I use stunnel as a client which connects in TLS protocol ? 2. I am using Stunnel 4.14 in client mode and trying to connect in TLS protocol to certain server. The connection failed with the following log file: 2006.05.03 10:42:52 LOG7[2388:1756]: connect_wait: waiting 10 seconds 2006.05.03 10:42:52 LOG7[2388:1756]: connect_wait: connected 2006.05.03 10:42:52 LOG7[2388:1756]: Remote FD=244 initialized 2006.05.03 10:42:52 LOG7[2388:1756]: TCP_NODELAY option set on remote socket 2006.05.03 10:42:52 LOG7[2388:1756]: SSL state (connect): before/connect initialization 2006.05.03 10:42:52 LOG7[2388:1756]: SSL state (connect): SSLv3 write client hello A 2006.05.03 10:42:52 LOG7[2388:1756]: SSL alert (write): fatal: handshake failure 2006.05.03 10:42:52 LOG3[2388:1756]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number I had tried to configure stunnel configuration file with options = NO_SSLv3, but nothing changed. Did I miss anything ? Can anybody help ? Thanks Nadav Erez R&D Verint Systems Ltd. Phone: +972-9-962-4753 Cell: +972-54-778-4753 Email: erez.nadav(a)verint.com <mailto:[email protected]@verint.com> Web: www.verint.com <http://www.verint.com/> __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

2 1

Installing Stunnel on AIX5.3
by Shinoy 09 May '06

09 May '06

Hi, I want to install Stunnel on AIX 5.3 and configure it. I was trying to find some documentation and also know if it will work on AIX 5.3. Any help is greatly appreciated. --------------------------------- Yahoo! India Answers: Share what you know. Learn something new. Click here Send instant messages to your online friends - NOW

2 1

RE: [stunnel-users] Stunnel configuration
by Moehrke, John (GE Healthcare) 09 May '06

09 May '06

I would further like to ask: Is it true that the proper way to get to TLSv1 is to start with SSLv3? Is there a reference that someone can point me at? John _____ From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Nadav, Erez Sent: Monday, May 08, 2006 11:55 AM To: stunnel-users(a)mirt.net Subject: [stunnel-users] Stunnel configuration Hi all, How can I configure my stunnel client application (windows) with the following parameter : TLSv1only = yes Nadav Erez R&D Verint Systems Ltd. Phone: +972-9-962-4753 Cell: +972-54-778-4753 Email: erez.nadav(a)verint.com <mailto:[email protected]@verint.com> Web: www.verint.com <http://www.verint.com/> ________________________________________________________________________ __________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

1 0

Trying to load stunnel sources
by Nadav, Erez 09 May '06

09 May '06

Hi all, I am a programmer and I want to compile the stunnel for windows application in order to try to fix some non working TLS issues. I having problem when accessing http://www.stunnel.org/download/source.html address. I have the following questions: 1. Where and How can I load all stunnel sources ? 2. How should I compile it on windows machine ? 3. How should I use the mentioned PGP key Thanks Erez __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

1 0

Stunnel configuration
by Nadav, Erez 08 May '06

08 May '06

Hi all, How can I configure my stunnel client application (windows) with the following parameter : TLSv1only = yes Nadav Erez R&D Verint Systems Ltd. Phone: +972-9-962-4753 Cell: +972-54-778-4753 Email: erez.nadav(a)verint.com <mailto:[email protected]@verint.com> Web: www.verint.com <http://www.verint.com/> __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

1 0

client certificate authentication
by Srilalitha Muralidhara(HCL Capital Market Services) 08 May '06

08 May '06

Hi, I am new to stunnel. My application listens on 6 socket ports. External applications either dump data on these socket ports or send requests on these socket ports to receive data. Thus, my application is a server and external applications are clients. We got to authenticate these external applications before accepting the requests/data. So I am planning to use client certificate authentication of stunnel. In this case, should the server have a certificate as well? Will the server be authenticated? Is it necessary for all the external applications to be using the same certificate? Thanks, Sri Disclaimer: *********** The contents of this E-mail (including the contents of the enclosure(s) or attachment(s) if any) are privileged and confidential material of HCL Capital Market Services and should not be disclosed to, used by or copied in any manner by anyone other than the intended addressee(s). In case you are not the desired addressee, you should delete this message and/or re-direct it to the sender. The views expressed in this E-mail message (including the enclosure(s) or attachment(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of HCL Capital Market Services. This e-mail message including attachment/(s), if any, is believed to be free of any virus. However, it is the responsibility of the recipient to ensure that it is virus free and HCL Capital Market Services is not responsible for any loss or damage arising in any way from its use.

1 0

Performance Problems.
by Don Werve 05 May '06

05 May '06

After a fair bit of poking, prodding, and googling, I have yet to find the solution to my problem. So, here goes: stunnel looks to be running slowly. Very slowly. We're starting to analyze it with gprof to see where it spends all of its time when we're trying to do content negotiation, and I've whipped up a quick-and-dirty Ruby script that grabs data from the server and then spits out the performace results; I'm sitting on my own T1, so our connectivity is pretty good. The results with this script are similar with 'delay=yes', 'session=600', and 'compression=zlib'. So, here's what happens when I nab data from our stunnel-ed server with said script (I can supply the script if anyone is interested): #File Size time thrpht time thrprt multiple ---------------------------------------------------------------------- index.html 7k http 0.1548 ( 46k/s) https 0.7449 ( 9k/s) * 4.8131 test1.jpg 1k http 0.0928 ( 12k/s) https 0.6379 ( 1k/s) * 6.8726 test2.jpg 10k http 0.1812 ( 59k/s) https 0.6743 ( 16k/s) * 3.7208 test3.jpg 19k http 0.2236 ( 85k/s) https 0.7677 ( 24k/s) * 3.4338 test4.jpg 53k http 0.5668 ( 94k/s) https 1.1543 ( 46k/s) * 2.0365 test5.jpg 97k http 0.7861 (123k/s) https 2.1974 ( 44k/s) * 2.7954 test6.jpg 214k http 1.4061 (152k/s) https 2.3735 ( 90k/s) * 1.6880 test7.jpg 140k http 0.9434 (149k/s) https 1.9331 ( 72k/s) * 2.0491 test8.jpg 470k http 2.8590 (164k/s) https 3.7696 (124k/s) * 1.3185 ('multiple' is the number of times 'slower' https is versus http). And, here's my stunnel config: *** cert = /etc/certs/combined.pem setuid = nobody setgid = nobody pid = /var/run/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 0 output = /var/log/stunnel [https] local = 64.40.110.16 accept = 443 connect = 64.40.110.16:80 TIMEOUTclose = 0 *** So, any ideas why stunnel is working so slowly? I mean, I know there's the overhead of the SSL negotiation, and I've heard some things about a stunnel session cache, but nothing about enabling/using it (unless 'session = something bigger than zero' does so?). Any suggestions to improve performance, especially for large batches of small transfers? Thanks-in-advance! -- Don Werve <donw(a)iradeon.net> Chief Systems Administrator / Systems Architect

1 0

Using stunnel to add https support to ONE virtual host
by Gonzalo Diethelm 05 May '06

05 May '06

Hello, I have Apache serving plain http pages for several domains running as virtual hosts on one machine (debian). I know SSL will not work with this setup, and I understand the reasons why (at least I think I do). Let's say the virtual hosts are www.server1.com www.server2.com www.server3.com I would like to use stunnel to add https capabilities to ONE of the virtual hosts (say, www.server3.com) In other words, I would like to configure stunnel in server mode with a certificate file, listening on www.server3.com:443, so that if I use a browser to visit https://www.server3.com/ then stunnel will accept the connection and forward all traffic to www.server3.com:80, letting Apache handle it; in particular, this would have to allow Apache to recognize which of the virtual hosts is being visited; I wouldn't like to have www.server1.com respond to my requests instead of www.server3.com. Is this possible? Any caveats, hints, recommendations? Thanks in advance, and best regards, -- Gonzalo Diethelm gonzalo.diethelm(a)aditiva.com

2 1

Using stunnel to add https support to ONE virtual host
by Gonzalo Diethelm 04 May '06

04 May '06

Hello, I have Apache serving plain http pages for several domains running as virtual hosts on one machine (debian). I know SSL will not work with this setup, and I understand the reasons why (at least I think I do). Let's say the virtual hosts are www.server1.com www.server2.com www.server3.com I would like to use stunnel to add https capabilities to ONE of the virtual hosts (say, www.server3.com) In other words, I would like to configure stunnel in server mode with a certificate file, listening on www.server3.com:443, so that if I use a browser to visit https://www.server3.com/ then stunnel will accept the connection and forward all traffic to www.server3.com:80, letting Apache handle it; in particular, this would have to allow Apache to recognize which of the virtual hosts is being visited; I wouldn't like to have www.server1.com respond to my requests instead of www.server3.com. Is this possible? Any caveats, hints, recommendations? Thanks in advance, and best regards, -- Gonzalo Diethelm gonzalo.diethelm(a)aditiva.com

1 0

Re: stunnel 4.15 crashes with vnc server 4.1.1
by Harry Boeck 04 May '06

04 May '06

Hallo stunnel-users, @Michal Trojnara: Thanks for your help, Mike! The solution came overnight when i remembered my own message: > and the screen on the server side should remove the background image > and visual effects). Well: I disabled the desktop modifications in vnc and it runs. Something is incompatible in the stunnel GUI with the removal of global windows GUI behaviour (despite the fact, that i have not a single one of them in use - to the best of my knowledge), what has nothing to do with the dedication of stunnel. Maybe there's a simple GUI message not handled correctly? As this seems to be something common to all windows versions, could this possibly happen in windows xp, too? (I don't use one, so somone would have to investigate this.) It's another motivation to start compiling in cygnus. But unfortunally at this very moment i'm occupied with other tasks. May be some other guy has the fancy to look at this matter... Mit freundlichem Gruß Harry Boeck

1 0

stunnel install issues with mknod command
by Trishul Shah 04 May '06

04 May '06

Hi, I was wondering if you could help me, I am trying to install stunnel on a machine running solaris 10, but the catch is that I am trying to install it within a zone in solaris 10, unfortunately during the installation process after the source is compiled I see the following error: Making install in src test -z "/usr/local/lib" || /bin/bash ../auto/mkinstalldirs "/usr/local/lib" /bin/bash ../libtool --mode=install ../auto/install-sh -c 'libstunnel.la' '/usr/local/lib/libstunnel.la' ../auto/install-sh -c .libs/libstunnel.so /usr/local/lib/libstunnel.so chmod +x /usr/local/lib/libstunnel.so ../auto/install-sh -c .libs/libstunnel.lai /usr/local/lib/libstunnel.la ---------------------------------------------------------------------- Libraries have been installed in: /usr/local/lib If you ever happen to want to link against installed libraries in a given directory, LIBDIR, you must either use libtool, and specify the full pathname of the library, or use the `-LLIBDIR' flag during linking and do at least one of the following: - add LIBDIR to the `LD_LIBRARY_PATH' environment variable during execution - use the `-RLIBDIR' linker flag See any operating system documentation about shared libraries for more information, such as the ld(1) and ld.so(8) manual pages. ---------------------------------------------------------------------- test -z "/usr/local/sbin" || /bin/bash ../auto/mkinstalldirs "/usr/local/sbin" /bin/bash ../libtool --mode=install ../auto/install-sh -c 'stunnel' '/usr/local/sbin/stunnel' ../auto/install-sh -c stunnel /usr/local/sbin/stunnel test -z "/usr/local/sbin" || /bin/bash ../auto/mkinstalldirs "/usr/local/sbin" ../auto/install-sh -c 'stunnel3' '/usr/local/sbin/stunnel3' Making install in doc test -z "/usr/local/share/doc/stunnel" || /bin/bash ../auto/mkinstalldirs "/usr/local/share/doc/stunnel" ../auto/install-sh -c -m 644 'stunnel.html' '/usr/local/share/doc/stunnel/stunnel.html' ../auto/install-sh -c -m 644 'stunnel.pl.html' '/usr/local/share/doc/stunnel/stunnel.pl.html' ../auto/install-sh -c -m 644 'stunnel.fr.html' '/usr/local/share/doc/stunnel/stunnel.fr.html' test -z "/usr/local/man/man8" || /bin/bash ../auto/mkinstalldirs "/usr/local/man/man8" ../auto/install-sh -c -m 644 './stunnel.8' '/usr/local/man/man8/stunnel.8' ../auto/install-sh -c -m 644 './stunnel.pl.8' '/usr/local/man/man8/stunnel.pl.8' ../auto/install-sh -c -m 644 './stunnel.fr.8' '/usr/local/man/man8/stunnel.fr.8' Making install in tools test -z "/usr/local/etc/stunnel" || /bin/bash ../auto/mkinstalldirs "/usr/local/etc/stunnel" ../auto/install-sh -c -m 644 'stunnel.conf-sample' '/usr/local/etc/stunnel/stunnel.conf-sample' if test ! -r /usr/local/etc/stunnel/stunnel.pem; then \ if test -r "/dev/urandom"; then \ dd if="/dev/urandom" of=stunnel.rnd bs=256 count=1; \ RND="-rand stunnel.rnd"; \ else \ RND=""; \ fi; \ /usr/local/bin/openssl req -new -x509 -days 365 -nodes $RND \ -config ./stunnel.cnf \ -out stunnel.pem -keyout stunnel.pem; \ test -eq 0 || /usr/local/bin/openssl gendh $RND 512 >> stunnel.pem; \ /usr/local/bin/openssl x509 -subject -dates -fingerprint -noout -in stunnel.pem; \ ../auto/install-sh -c -m 600 stunnel.pem /usr/local/etc/stunnel/stunnel.pem; \ rm stunnel.pem; \ fi mkdir -p /usr/local/var/stunnel chmod a=rwx,+t /usr/local/var/stunnel if uname | grep SunOS; then \ mkdir -p /usr/local/var/stunnel/dev; \ chmod u=rwx,go=rx /usr/local/var/stunnel/dev; \ mknod /usr/local/var/stunnel/dev/zero c 13 12; \ chmod a=rw /usr/local/var/stunnel/dev/zero; \ fi SunOS mknod: Not owner *** Error code 2 make: Fatal error: Command failed for target `install-data-local' Current working directory /export/home/playtech/stunnel-4.14/tools *** Error code 1 The following command caused the error: make install-exec-am install-data-am make: Fatal error: Command failed for target `install-am' Current working directory /export/home/playtech/stunnel-4.14/tools *** Error code 1 The following command caused the error: failcom='exit 1'; \ for f in x $MAKEFLAGS; do \ case $f in \ *=* | --[!k]*);; \ *k*) failcom='fail=yes';; \ esac; \ done; \ dot_seen=no; \ target=`echo install-recursive | sed s/-recursive//`; \ list='src doc tools'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || eval $failcom; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `install-recursive' After much digging around I have discovered that the mknod command cannot be used within a solaris 10 zone, I have gotten round this previously by installing stunnel from the global zone but that intertwines the parent zone with the child zone and ideally we would like to keep these as independent of each other as possible as we use these zones for 3rs party applications and hence we have a lot of other user traffic on these zones. Thanks in advance for your help. Kind Regards, Trishul Shah Blue Square Tel: 020 7288 7920 Mob: 07789 982 688 Fax: 020 7288 7955

1 0

stunnel 4.15 crashes with vnc server 4.1.1
by Harry Boeck 04 May '06

04 May '06

Hallo stunnel users, i'm learning to use ssl and ssh tools to get secured access to my home server from work and other places. I already have a working ssh installation but stumbled over stunnel ba accident. I would like to use it, because i still have computers in use with win98 (both for myself and among my clients) and this little program is exactly all what i would need to use vnc over a secured connection. SSH to the contrary needs a little bit more setup (over a cygwin that serves the only purpose of aquiring such tools like SSH), needs its own crypto library compilation and so on. Now, there is the problem that stunnel 4.15 crashes at the moment, when the vnc server 4.1.1 tries to deliver its first screen to the client. Stunnel was downloaded from http://www.stunnel.org/download/binaries.html, vnc was downloaded from http://www.realvnc.com (already some times ago). Both where downloaded as binaries, for the typical help hints on forums for the question "i have a compile problem on windows" being "how dare you"... Both machines i'm using for testing use win98 as operating system. The crash happens both when testing a configuration on one machine with stunnel running both as server and as client, as well as when using it to connect two machines with stunnel running as server on the machine with vnc server and as client on the machine with vnc client. VNC runs correct for itself as well as via an ssh secured connection. Stunnel is startet with only the server versus the client configuration file as command line parameter. The configuration files are: http://harryboeck.dyndns.org/Sicherheit/stunnel-server.ini http://harryboeck.dyndns.org/Sicherheit/stunnel-client.ini Stunnel delivers correctly the data between vnc server and client (including connection establishment and authentication) until the point of first screen transfer (when the screen on the client side turns black and the screen on the server side should remove the background image and visual effects). The output of stunnel server and client is: http://harryboeck.dyndns.org/Sicherheit/stunnel-server.log http://harryboeck.dyndns.org/Sicherheit/stunnel-client.log The output of "stunnel -version" is: http://harryboeck.dyndns.org/Sicherheit/stunnel-version.txt I have no clue what '6. Output of "uname -a"' should mean, if that is somehow important for hints, please let me know. openssl version is: OpenSSL 0.9.8a 11 Oct 2005 I would appreciate any suggestions or hints on the interaction of vnc and stunnel. with best regards Harry Boeck

2 1

certificate unknown
by Ludovic DUFLOT 03 May '06

03 May '06

Hi, I tried to use stunnel to connect in SSL to a LDAP server. But I can't and I've got this error message: certificate unknown I use stunnel for establishing connexion with IMAPS server and all is right but not for LDAP connexion. The certificate is self-signate. I searched on the list's archives and with google but I can't find any solution... Help !!! Ludo ps: these are the stunnel.conf and the log: *************************** cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Some debugging stuff useful for troubleshooting debug = 7 ;output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [ldaps] accept = 389 connect = 10.0.0.1:636 verify = 0 [imaps] accept = 143 connect = 10.0.0.2:993 *************************** 2006.05.03 07:52:40 LOG7[4436:2436]: RAND_status claims sufficient entropy for the PRNG 2006.05.03 07:52:40 LOG6[4436:2436]: PRNG seeded successfully 2006.05.03 07:52:40 LOG7[4436:2436]: Certificate: stunnel.pem 2006.05.03 07:52:40 LOG7[4436:2436]: Key file: stunnel.pem 2006.05.03 07:52:40 LOG7[4436:2436]: SSL context initialized for service ldaps 2006.05.03 07:52:40 LOG7[4436:2436]: Certificate: stunnel.pem 2006.05.03 07:52:40 LOG7[4436:2436]: Key file: stunnel.pem 2006.05.03 07:52:40 LOG7[4436:2436]: SSL context initialized for service imaps 2006.05.03 07:52:40 LOG7[4436:2436]: Certificate: stunnel.pem 2006.05.03 07:52:40 LOG7[4436:2436]: Key file: stunnel.pem 2006.05.03 07:52:40 LOG7[4436:2436]: SSL context initialized for service https 2006.05.03 07:52:40 LOG5[4436:2436]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7f 22 Mar 2005 2006.05.03 07:52:40 LOG5[4436:2436]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.05.03 07:52:40 LOG5[4436:4612]: No limit detected for the number of clients 2006.05.03 07:52:40 LOG7[4436:4612]: FD 192 in non-blocking mode 2006.05.03 07:52:40 LOG7[4436:4612]: SO_REUSEADDR option set on accept socket 2006.05.03 07:52:40 LOG7[4436:4612]: ldaps bound to 0.0.0.0:389 2006.05.03 07:52:40 LOG7[4436:4612]: FD 196 in non-blocking mode 2006.05.03 07:52:40 LOG7[4436:4612]: SO_REUSEADDR option set on accept socket 2006.05.03 07:52:40 LOG7[4436:4612]: imaps bound to 0.0.0.0:143 2006.05.03 07:52:40 LOG7[4436:4612]: FD 212 in non-blocking mode 2006.05.03 07:52:40 LOG7[4436:4612]: SO_REUSEADDR option set on accept socket 2006.05.03 07:52:40 LOG7[4436:4612]: https bound to 0.0.0.0:443 2006.05.03 07:52:50 LOG7[4436:4612]: ldaps accepted FD=220 from 127.0.0.1:2893 2006.05.03 07:52:50 LOG7[4436:4612]: Creating a new thread 2006.05.03 07:52:50 LOG7[4436:4612]: New thread created 2006.05.03 07:52:50 LOG7[4436:5780]: ldaps started 2006.05.03 07:52:50 LOG7[4436:5780]: FD 220 in non-blocking mode 2006.05.03 07:52:50 LOG7[4436:5780]: TCP_NODELAY option set on local socket 2006.05.03 07:52:50 LOG5[4436:5780]: ldaps connected from 127.0.0.1:2893 2006.05.03 07:52:50 LOG7[4436:5780]: FD 244 in non-blocking mode 2006.05.03 07:52:50 LOG7[4436:5780]: ldaps connecting 10.0.0.1:636 2006.05.03 07:52:50 LOG7[4436:5780]: connect_wait: waiting 10 seconds 2006.05.03 07:52:50 LOG7[4436:5780]: connect_wait: connected 2006.05.03 07:52:50 LOG7[4436:5780]: Remote FD=244 initialized 2006.05.03 07:52:50 LOG7[4436:5780]: TCP_NODELAY option set on remote socket 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): before/connect initialization 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write client hello A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 read server hello A 2006.05.03 07:52:50 LOG5[4436:5780]: VERIFY IGNORE: depth=1, /C=FR/ST=Savoie/L=Chambery/O=Universite de Savoie/OU=DSI/CN=DSI CA/emailAddress=admin(a)univ-savoie.fr 2006.05.03 07:52:50 LOG5[4436:5780]: VERIFY IGNORE: depth=1, /C=FR/ST=Savoie/L=Chambery/O=Universite de Savoie/OU=DSI/CN=DSI CA/emailAddress=admin(a)univ-savoie.fr 2006.05.03 07:52:50 LOG5[4436:5780]: VERIFY IGNORE: depth=1, /C=FR/ST=Savoie/L=Chambery/O=Universite de Savoie/OU=DSI/CN=DSI CA/emailAddress=admin(a)univ-savoie.fr 2006.05.03 07:52:50 LOG5[4436:5780]: VERIFY IGNORE: depth=0, /C=FR/ST=Savoie/L=Chambery/O=Universite de Savoie/OU=DSI/CN=ldap-bourget.univ-savoie.fr 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 read server certificate A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 read server certificate request A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 read server done A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write client certificate A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write client key exchange A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write certificate verify A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write change cipher spec A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write finished A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 flush data 2006.05.03 07:52:50 LOG7[4436:5780]: SSL alert (read): fatal: certificate unknown 2006.05.03 07:52:50 LOG3[4436:5780]: SSL_connect: 14094416: error:14094416:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate unknown 2006.05.03 07:52:50 LOG5[4436:5780]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.05.03 07:52:50 LOG7[4436:5780]: ldaps finished (0 left)

1 0

Wrapping interclient connections outbound to many servers
by Matthew Case 02 May '06

02 May '06

Hello all, I have searched high and low for a solution to this problem, but I haven't found anything so I am coming here in hopes someone will be able to help me. I have to wrap the interclient protocol (>1024 to 3060) in some manner of encryption to appease one of my clients. I have already wrapped the ajp13 protocol between the apache server and the tomcat server, but now the tomcat server (which acts as an stunnel server in the ajp13 setup) must also act as a client and wrap all outbound and return traffic to 10 servers to and from port 3060. Making large modifications to the source code is not going to be feasible given my current time crunch (it must be implemented in two weeks). Has anyone run into anything like this and does anyone have any tips? Thanks in advance! - Matt

1 0