- stunnel-users - stunnel.org

Multiple Host Certificates
by Sligar, Benjamin 17 Mar '06

17 Mar '06

Is it possible to run one instance of stunnel and have it verify certain ports against different certificates? For instance: [listen1 5003] accept = 5003 connect = 10.61.0.132:7300 [listen2 5008] accept = 5008 connect = 10.61.0.132:7300 Would it be possible to have listen2 validate on a seperate certificate, or, will I need to run a second instance of stunnel on my box and have it point to the different certificate? Basically, I want to know if I can setup a different certificate on a per-port basis. I don't see any options in the definition of the listen port that I can specify a different CERT, only the default CERT option at the top of the config file. Version: stunnel-4.04 Options cert = /usr/local/conf/ssl.pem chroot = /usr/local/stunnel-4.04/var/run/stunnel/ pid = /stunnel.pid setuid = www setgid = webgroup options = NO_SSLv2 ciphers = DES-CBC3-SHA:IDEA-CBC-SHA:RC4-SHA:RC4-MD5:AES256-SHA:AES128-SHA uname -a Linux ssl 2.4.7-10 #1 Thu Sep 6 17:27:27 EDT 2001 i686 unknown gcc -v Reading specs from /usr/lib/gcc-lib/i386-redhat-linux/2.96/specs gcc version 2.96 20000731 (Red Hat Linux 7.1 2.96-98) openssl version OpenSSL 0.9.6b [engine] 9 Jul 2001 This e-mail message is for the sole use of the intended recipient(s) and may contain confidential and privileged information of Transaction Network Services. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

2 1

Help with config of stunnel.
by mike smith 16 Mar '06

16 Mar '06

I am trying to set up a tunnel for telnet. I am doing this just to learn how to get stunnel to work. I thought this would be easy way to learn how to use stunnel for other uses we have. My problem is I don't understand how to start it on the client side. I can telnet to the server without stunnel but I don't know how to start stunnel on the client side. The log file shows ssltelnet bound to 0.0.0.0:23 for the client and ssltelnet bound to 0.0.0.0:992 for the server If you have any ideas what I may need to do I would be greatfull. I'm sure that I'm missing a step configuring it. This is what my stunnel.conf files look like for the server cert = /usr/local/etc/stunnel/stunnel.pem chroot = /usr/local/var/run/stunnel/ pid = /stunnel.pid setuid = nobody setgid = nobody client = no debug = 7 output = /stunnel.log [ssltelnet] accept = 992 connect = 23 For the Client cert = /usr/local/etc/stunnel/stunnel.pem chroot = /usr/local/var/run/stunnel/ pid = /stunnel.pid setuid = nobody setgid = nobody client = yes debug = 7 output = /stunnel.log [ssltelnet] accept = 23 connect = 192.168.1.102:992 --------------------------------- Yahoo! Travel Find great deals to the top 10 hottest destinations! --------------------------------- Yahoo! Travel Find great deals to the top 10 hottest destinations!

1 0

IE tries to verify client certificate?
by Don Werve 15 Mar '06

15 Mar '06

I've got stunnel providing SSL wrapper services for an otherwise SSL-stupid vendor-webserver-thingy that listens on port 80. I'm using a wildcard certificate purchased from $VENDOR, and it seems to work fine in Safari, Firefox, w3m, and basically everything SSL aware known to Man. Except, that is, Internet Explorer, where the user gets a popup window asking them to choose a certificate to verify their connection. This is really throwing me for a loop; I've tried setting 'verify = 0' and 'options = ALL' in the service definition under stunnel, no dice. Any ideas why IE thinks it needs to verify, but nothing else does? -- Don Werve <donw(a)iradeon.net> Chief Systems Administrator / Systems Architect

1 0

GeoTrust QuickSSL cert and stunnel
by Steve Shepherd 15 Mar '06

15 Mar '06

I've got a client that has a GeoTrust "QuickSSL" certificate (we normally deal with Thawte). I installed the cert/key, but it is not functioning (pulling up default certificate), so I figured I would need the CA. I gathered the CA, so in the file I have: Certificate Private Key Certificate GeoTrust CA Where is the default location to install other CA's and/or chained certs? Thanks!

1 0

RE: [stunnel-users] Static Version Built?
by Kevin A. McGrail 15 Mar '06

15 Mar '06

That would be my guess but the last time I wanted static binaries was Redhat 2.1 on a DEC Alpha-based machine, sorry. -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Hal Vaughan Sent: Wednesday, March 15, 2006 1:25 PM To: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Static Version Built? On Wednesday 15 March 2006 13:04, Kevin A. McGrail wrote: > Do you have static libraries in your SSL lib or just shared libraries? > i.e. libssl.a (static) and libssl.so (dynamic) or just one or the > other? > > Have you tested with ldd? > > For example, on my machine, I get this showing me I'm linking > dynamically. > > ldd /usr/sbin/stunnel > libutil.so.1 => /lib/libutil.so.1 (0x40023000) > libpthread.so.0 => /lib/i686/libpthread.so.0 (0x40027000) > libnsl.so.1 => /lib/libnsl.so.1 (0x4003b000) > libdl.so.2 => /lib/libdl.so.2 (0x40050000) > libssl.so.2 => /lib/libssl.so.2 (0x40053000) > libcrypto.so.2 => /lib/libcrypto.so.2 (0x40080000) > libc.so.6 => /lib/i686/libc.so.6 (0x42000000) > /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000) > > Regards, > KAM Yes, I'm getting the same thing, so it's linking to the shared libraries, even though in the cases I've checked, I have the static libraries. Hal _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

RE: [stunnel-users] Static Version Built?
by Kevin A. McGrail 15 Mar '06

15 Mar '06

Do you have static libraries in your SSL lib or just shared libraries? i.e. libssl.a (static) and libssl.so (dynamic) or just one or the other? Have you tested with ldd? For example, on my machine, I get this showing me I'm linking dynamically. ldd /usr/sbin/stunnel libutil.so.1 => /lib/libutil.so.1 (0x40023000) libpthread.so.0 => /lib/i686/libpthread.so.0 (0x40027000) libnsl.so.1 => /lib/libnsl.so.1 (0x4003b000) libdl.so.2 => /lib/libdl.so.2 (0x40050000) libssl.so.2 => /lib/libssl.so.2 (0x40053000) libcrypto.so.2 => /lib/libcrypto.so.2 (0x40080000) libc.so.6 => /lib/i686/libc.so.6 (0x42000000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000) Regards, KAM -----Original Message----- From: Hal Vaughan [mailto:[email protected]] Sent: Wednesday, March 15, 2006 12:55 PM To: Kevin A. McGrail Subject: Re: [stunnel-users] Static Version Built? On Wednesday 15 March 2006 12:24, you wrote: > It's not going to use source. It's going to use headers and compiled > libraries. Specifying it just helps point it to the correct headers > and libraries if you for example, have them installed in an unusual > place or have more than one set on your machine. Does it link to those libs or incorporate them into the binary (if I'm building static with the correct command line options)? Sorry to ask so many questions, but I've had no experience in C or C++. Thanks, Hal

2 1

Static Version Built?
by Hal Vaughan 15 Mar '06

15 Mar '06

Okay, I think I have a static version of Stunnel now. Thanks to help and answers from Jan and Keven! I did this: ./configure --with-ssl=/usr --enable-static --disable-shared --disable-libwrap I'm not sure about the "--with-ssl" option, but it didn't seem to want to work without it. So I have a few questions: 1) How can I be sure it is static? 2) If it isn't static and I run it on a system that does not have all it needs, will it give me errors immediately, or only if a subroutine needs a library that isn't there. 3) Does the "--disable-libwrap" or anything else remove any features? 4) Does using the "--with-ssl" option make it use the libs on my system and make it non-static? 5) My "best guess" is that to install a static version, I just copy over the files src/stunnel and src/libstunnel.la to /usr/bin and /usr/lib, respectively. Is that right? (And, of course, copy man files to the right place.) Thanks -- I hope I'll be done with all these questions soon. Hal

2 4

Logging change in 4.15
by MeeAGhost 15 Mar '06

15 Mar '06

Running 4.15 the messages below being written to STDOUT whenever I start stunnel but not written to the the file defined by output in the .conf file. In prior versions the messages were written to whatever I had defined output to equal. 2006.03.14 19:40:03 LOG7[11513:1]: Snagged 64 random bytes from /export/home/ghost/.rnd 2006.03.14 19:40:03 LOG7[11513:1]: Wrote 1024 new random bytes to /export/home/ghost/.rnd 2006.03.14 19:40:03 LOG7[11513:1]: RAND_status claims sufficient entropy for the PRNG 2006.03.14 19:40:03 LOG6[11513:1]: PRNG seeded successfully 2006.03.14 19:40:03 LOG7[11513:1]: Certificate: /usr/local/etc/stunnel/server.pem 2006.03.14 19:40:03 LOG7[11513:1]: Key file: /usr/local/etc/stunnel/server.pem 2006.03.14 19:40:03 LOG7[11513:1]: Loaded verify certificates from /usr/local/etc/stunnel/cacert.pem 2006.03.14 19:40:03 LOG7[11513:1]: Verify directory set to /usr/local/etc/stunnel/certificates 2006.03.14 19:40:03 LOG5[11513:1]: Peer certificate location /usr/local/etc/stunnel/certificates I looked in ctx.c and ssl.c at the calls to s_log (in log.c) but wasn't able to determine what would cause some messages to be written to the output file and the messages above to be written to STDOUT. I think it has to do with file_putline not being passed the output file name. Anyone else seeing this behavior? -- Chris

2 1

What is "lwrap"? (compiling problem)
by Hal Vaughan 15 Mar '06

15 Mar '06

I keep getting a message: /usr/bin/ld: cannot find -lwrap when I try make. I had to use: ./configure --with-ssl=/usr and it worked, but I keep getting the above error message. I've Googled for it and it seems to reference an SSL library, but it looks like I've got them all installed (unless it needs Python SSL libraries). Thanks! Hal

1 0

SSL Libraries on Debian
by Hal Vaughan 14 Mar '06

14 Mar '06

I tried compiling Stunnel on Debian and get an error -- I need the ssl libraries. I tried ./configure --with-ssl=/usr/lib/ssl, which is where libssl-dev was installed, and it doesn't help. There is a libssl file in /usr/lib, but --with-ssl=/usr/lib/ssl doesn't seem to work either. What package on Debian provides the needed headers (according to aptitude, libssl-dev, the one I installed, does, but experience is telling me otherwise). (This, btw, is why I am trying to make static binaries -- you can never tell what to expect on Linux systems at this point. Often config/make doesn't work and there are many times when packages don't work out for one reason or another.) Thanks for any help on this. Hal

3 4

stunnel 4.14 died silently under traffic stress test
by Zhuang Yuyao 14 Mar '06

14 Mar '06

Hi, While doing apache benchmark test, stunnel 4.14 died silently. Network topo: client(192.168.20.81 debian running ab2) ---(https)---> gateway(192.168.20.1 running stunnel in server mode) ---(http)---> web server(192.168.10.254) Gateway hardware: 80386 compatible cpu (VIA C3 400Mhz); RAM: 64M stunnel.conf: ############################### ..... compression = zlib client = no ciphers = DES-CBC3-SHA:DES-CBC3-MD5 verify = 1 [test] accept = 443 connect = 192.168.10.254:80 TIMEOUTclose = 0 ############################### Web Server hardware: Dell 2850 with 2G RAM. test_100k.html is a html file whose size is 100k bytes. test_4k.html is a html file whose size is 4k bytes. In client, I am using ab2 as the stress test tool: #ab2 -n 200 -c 100 https://192.168.20.1:443/test_4k.html (means 200 request and 100 concurrency) successfully finished. #ab2 -n 200 -c 100 https://192.168.20.1:443/test_100k.html (means 200 request and 100 concurrency) stunnel died after a few seconds, running log shows: 2006.03.09 15:20:39 LOG5[6962:1024]: stunnel 4.14 on i386-pc-linux-gnu PTHREAD+POLL+IPv4 with OpenSSL 0.9.7i 14 Oct 2005 2006.03.09 15:20:39 LOG5[6962:1024]: 500 clients allowed 2006.03.09 15:20:53 LOG5[6964:1026]: test connected from 192.168.20.81:50186 2006.03.09 15:20:53 LOG5[6965:2051]: test connected from 192.168.20.81:50187 2006.03.09 15:20:53 LOG5[6966:3076]: test connected from 192.168.20.81:50188 2006.03.09 15:20:53 LOG5[6967:4101]: test connected from 192.168.20.81:50189 2006.03.09 15:20:53 LOG5[6968:5126]: test connected from 192.168.20.81:50190 2006.03.09 15:20:54 LOG5[6969:6151]: test connected from 192.168.20.81:50191 2006.03.09 15:20:54 LOG5[6970:7176]: test connected from 192.168.20.81:50192 2006.03.09 15:20:54 LOG5[6971:8201]: test connected from 192.168.20.81:50193 2006.03.09 15:20:54 LOG5[6972:9226]: test connected from 192.168.20.81:50194 2006.03.09 15:20:54 LOG5[6973:10251]: test connected from 192.168.20.81:50195 2006.03.09 15:20:54 LOG5[6974:11276]: test connected from 192.168.20.81:50196 2006.03.09 15:20:54 LOG5[6975:12301]: test connected from 192.168.20.81:50197 2006.03.09 15:20:54 LOG5[6976:13326]: test connected from 192.168.20.81:50198 2006.03.09 15:20:54 LOG5[6977:14351]: test connected from 192.168.20.81:50199 2006.03.09 15:20:54 LOG5[6978:15376]: test connected from 192.168.20.81:50200 2006.03.09 15:20:54 LOG5[6979:16401]: test connected from 192.168.20.81:50201 2006.03.09 15:20:54 LOG5[6980:17426]: test connected from 192.168.20.81:50202 2006.03.09 15:20:54 LOG5[6981:18451]: test connected from 192.168.20.81:50203 2006.03.09 15:20:54 LOG5[6982:19476]: test connected from 192.168.20.81:50204 2006.03.09 15:20:54 LOG5[6983:20501]: test connected from 192.168.20.81:50205 2006.03.09 15:20:54 LOG5[6984:21526]: test connected from 192.168.20.81:50206 2006.03.09 15:20:54 LOG5[6985:22551]: test connected from 192.168.20.81:50207 2006.03.09 15:20:54 LOG5[6986:23576]: test connected from 192.168.20.81:50208 2006.03.09 15:20:54 LOG5[6987:24601]: test connected from 192.168.20.81:50209 2006.03.09 15:20:54 LOG5[6988:25626]: test connected from 192.168.20.81:50210 2006.03.09 15:20:54 LOG5[6989:26651]: test connected from 192.168.20.81:50211 2006.03.09 15:20:54 LOG5[6990:27676]: test connected from 192.168.20.81:50212 2006.03.09 15:20:54 LOG5[6991:28701]: test connected from 192.168.20.81:50213 2006.03.09 15:20:54 LOG5[6992:29726]: test connected from 192.168.20.81:50214 2006.03.09 15:20:54 LOG5[6993:30751]: test connected from 192.168.20.81:50215 2006.03.09 15:20:54 LOG5[6994:31776]: test connected from 192.168.20.81:50216 2006.03.09 15:20:54 LOG5[6995:32801]: test connected from 192.168.20.81:50217 2006.03.09 15:20:54 LOG5[6996:33826]: test connected from 192.168.20.81:50218 2006.03.09 15:20:54 LOG5[6997:34851]: test connected from 192.168.20.81:50219 2006.03.09 15:20:54 LOG5[6998:35876]: test connected from 192.168.20.81:50220 2006.03.09 15:20:54 LOG5[6999:36901]: test connected from 192.168.20.81:50221 2006.03.09 15:20:54 LOG5[7000:37926]: test connected from 192.168.20.81:50222 2006.03.09 15:20:54 LOG5[7001:38951]: test connected from 192.168.20.81:50223 2006.03.09 15:20:54 LOG5[7002:39976]: test connected from 192.168.20.81:50224 2006.03.09 15:20:54 LOG5[7003:41001]: test connected from 192.168.20.81:50225 2006.03.09 15:20:54 LOG5[7004:42026]: test connected from 192.168.20.81:50226 2006.03.09 15:20:55 LOG5[7005:43051]: test connected from 192.168.20.81:50227 2006.03.09 15:20:55 LOG5[7006:44076]: test connected from 192.168.20.81:50228 2006.03.09 15:20:55 LOG5[7007:45101]: test connected from 192.168.20.81:50229 2006.03.09 15:20:55 LOG5[7008:46126]: test connected from 192.168.20.81:50230 2006.03.09 15:20:55 LOG5[7009:47151]: test connected from 192.168.20.81:50231 2006.03.09 15:20:55 LOG5[7010:48176]: test connected from 192.168.20.81:50232 2006.03.09 15:20:55 LOG5[7011:49201]: test connected from 192.168.20.81:50233 2006.03.09 15:20:55 LOG5[7012:50226]: test connected from 192.168.20.81:50234 2006.03.09 15:20:55 LOG5[7013:51251]: test connected from 192.168.20.81:50235 2006.03.09 15:20:55 LOG5[7014:52276]: test connected from 192.168.20.81:50236 2006.03.09 15:20:55 LOG5[7015:53301]: test connected from 192.168.20.81:50237 2006.03.09 15:20:55 LOG5[7016:54326]: test connected from 192.168.20.81:50238 2006.03.09 15:20:55 LOG5[7017:55351]: test connected from 192.168.20.81:50239 2006.03.09 15:20:55 LOG5[7018:56376]: test connected from 192.168.20.81:50240 2006.03.09 15:20:55 LOG5[7019:57401]: test connected from 192.168.20.81:50241 2006.03.09 15:20:55 LOG5[7020:58426]: test connected from 192.168.20.81:50242 2006.03.09 15:20:55 LOG5[7021:59451]: test connected from 192.168.20.81:50243 2006.03.09 15:20:55 LOG5[7022:60476]: test connected from 192.168.20.81:50244 2006.03.09 15:20:55 LOG5[7023:61501]: test connected from 192.168.20.81:50245 2006.03.09 15:20:55 LOG5[7024:62526]: test connected from 192.168.20.81:50246 Killed It looks like that is resource on gateway is exhausted under such a traffic, but my question is: why stunnel just died instead of rejecting further connections. Thanks very much. Zhuang Yuyao

2 7

Static Binaries for Linux? (Didn't get answer previously)
by Hal Vaughan 13 Mar '06

13 Mar '06

I've brought this up before and didn't get ANY answer at all, and I'm sure someone involved with Stunnel would at least know if what I'm asking is possible. I know help is given on a volunteer basis, so if someone could help me figure this out, it would be a huge help. So far I've spent over a week on getting Stunnel or another program to do the job and if I can't get this to work, I need to just drop Stunnel and figure out how to do the same thing in Java. So thanks for any help. I may need to include Stunnel with my application so my clients behind restrictive firewalls can still enable me to work on their systems with RealVNC. I'm working with clients on both Windows and Linux. Is there a way to get static binaries for Linux? I don't know C or C++ or much more than running ./configure && make && make install. I'd like to know if it is possible or what is needed to create static binaries of the files so I could easily install stunnel on any Linux system by just copying over the proper files. Also, what archive format does the Windows installer use? I'd like to do something similar for Windows, so if I could pull the files out of the installer and copy them over myself, it would be a huge help. Thanks! Hal

3 4

Compile failure with 4.15
by MeeAGhost 13 Mar '06

13 Mar '06

I ran ./configure --enable-dh --disable-libwrap then when I try to execute make the build fails: [...] if gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.15\" -DPACKAGE_STRING=\"stunnel\ 4.15\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.15\" -DHOST=\"sparc-sun-solaris2.9\" -DCPU_SPARC=1 -DVENDOR_SUN=1 -DOS_SOLARIS2_9=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DHAVE_LIBNSL=1 -DHAVE_LIBSOCKET=1 -DHAVE_LIBDL=1 -DHAVE_LIBZ=1 -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_SYS_FILIO_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_GETCONTEXT=1 -DHAVE___MAKECONTEXT_V2=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETADDRINFO=1 -DHAVE_GETNAMEINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/usr/local\" -DHAVE_OSSL_ENGINE_H=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DUSE_DH=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/local/include -MT ctx.o -MD -MP -MF ".deps/ctx.Tpo" -c -o ctx.o ctx.c; \ then mv -f ".deps/ctx.Tpo" ".deps/ctx.Po"; else rm -f ".deps/ctx.Tpo"; exit 1; fi ctx.c: In function `init_dh': ctx.c:170: error: `section' undeclared (first use in this function) ctx.c:170: error: (Each undeclared identifier is reported only once ctx.c:170: error: for each function it appears in.) ctx.c:198: error: `ctx' undeclared (first use in this function) ctx.c: In function `crl_callback': ctx.c:491: warning: cast increases required alignment of target type make[1]: *** [ctx.o] Error 1 make[1]: Leaving directory `/tmp/stunnel-4.15/src' make: *** [all-recursive] Error 1 I checked ctx.c and couldn't see where section and ctx are being defined inside of the init_dh function nor could I see them defined in the header files. Am I missing something? TIA for any assistance. -- Chris

2 1

Rainbow Technologies CryptoSwift CS200 driver
by Michal Trojnara 11 Mar '06

11 Mar '06

Dear Users, I just bought a second-hand Rainbow Technologies CryptoSwift CS200 card to test engine support for stunnel. Unfortunately I can't find any Linux/Windows driver for this card. Do you have one? Please help. Best regards, Mike

2 1

stunnel 4.15 released
by Michal Trojnara 11 Mar '06

11 Mar '06

Version 4.15, 2006.03.11, urgency: LOW: * Release notes - There are a lot of new features in this version. I recommend to test it well before upgrading your mission-critical systems. * Bugfixes - Fix for pthreads on Solaris 10 (thx to Hans Werner Strube <strube(a)physik3.gwdg.de>). - Attempt to autodetect socklen_t type in configure script. - Default threading model changed to pthread for better portability. - DH parameters are not included in the certificate by default. * New features sponsored by Software House http://www.swhouse.com/ - Most SSL-related options (including client, cert, key) are now available on service level, so it is possible to have an SSL client and an SSL server in a single stunnel process. - Windows CE (version 3.0 and higher) support. * New features - Client mode CONNECT protocol support (RFC 2817 section 5.2). http://www.ietf.org/rfc/rfc2817.txt - Retrying exec+connect services added. * File locations are more compliant to Filesystem Hierarchy Standard 2.3 - configuration and certificates are in $prefix/etc/stunnel/ - binaries are in $prefix/sbin/ - default pid file is $prefix/var/run/stunnel.pid - manual is $prefix/man/man8/stunnel.8 - other docs are in $prefix/share/doc/stunnel/ - libstunnel is in $prefix/lib - chroot directory is setup in $prefix/var/lib/stunnel/ this directory is chmoded 1770 and group nogroup sha1sum for stunnel-4.15.tar.gz: 735406c1ca94904581158a434214e1f6568539d0 Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Mike

1 0

"STACK_RESERVE is too high" after every connect
by Rob Munsch 10 Mar '06

10 Mar '06

Hello. I've recently gone on a self-inflicted crash course on openssl and seem to have gotten a centralized logging system going, logging to MySQL. I'm seeing everything i'd expect to see, but with an extra bit: what is STACK_RESERVE, and why is it too high? Some context, mildly sanitized: |Mar 9 18:33:34 isis stunnel: LOG5[24810:6]: syslog-ng connected from x.x.x.x:44032| |Mar 9 18:33:34 isis stunnel: LOG5[24810:6]: VERIFY OK: depth=1, /C=US/ST=Pennsylvania/L=Philadelphia/O=Solutions for Progress/CN=blah.com/emailAddress=blah@blah| |Mar 9 18:33:34 isis stunnel: LOG5[24810:6]: VERIFY OK: depth=0, /C=US/ST=Pennsylvania/O=Solutions for Progress/OU=IT/CN=IT/emailAddress=blah@blah| |Mar 9 20:39:02 isis stunnel: LOG5[24810:6]: Connection closed: 0 bytes sent to SSL, 2891 bytes sent to socket| |Mar 9 20:39:02 isis stunnel: LOG3[24810:6]: STACK_RESERVE is too high| this is daemon.log on the server machine (isis). Messages from the remote host are going to MySQL successfully. But at the end of every apparently-successful transaction, there's this stack complaint. Can't find anything in the archives or via Google for "stunnel stack_reserve," which i found really odd, which is why i'm here... Version output: stunnel 4.14 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7g 11 Apr 2005 Thanks! -- Rob Munsch Solutions For Progress IT

2 1

RE: How to get tcpwrappers configured/compiled into stunnel 4.04 on Tru64 UNIX 5.1B
by John Lanier 08 Mar '06

08 Mar '06

Hello, I am a newbie to stunnel and tcpwrappers, so please bear with me: I am trying to compile tcpwrapper support into stunnel v4.04 on Tru64 UNIX v5.1B (apparently v4.14 does not compile on 5.1A or higher, per http://stunnel.mirt.net/pipermail/stunnel-users/2006-January/000935.html). I am having what appears to be problems getting tcpwrapper support to compile with 4.04. I have consulted the following resources, but I am still having problems: ------------------------------------------------------------------------------------------------------- 1. http://www.stunnel.org/faq/troubleshooting.html#ToC9 "configure isn't finding my TCP Wrapper installation" Solution: You probably have it in a non-standard place, ie somewhere that gcc can't find it on it's own. Let's say you had your tcp wrappers installed in /opt/tcpd_7.6. To help gcc find your include files and libraries, you'd want to set three environment variables as follows: CFLAGS="$CFLAGS -I/opt/tcpd_7.6/include" CPPFLAGS="$CPPFLAGS -I/opt/tcpd_7.6/include" LDFLAGS="$LDFLAGS -L/opt/tcpd_7.6/lib" export CFLAGS CPPFLAGS LDFLAGS And then re-run configure. This is the generic way to have configure find specific libraries, and is not specific to Stunnel itself. 2. http://www.stunnel.org/faq/run.html#ToC5 "Running stunnel with TCP wrappers" You do not need to use the tcpd binary to wrap stunnel (although you could). You can can compile in support for TCP wrappers when you compile stunnel itself. The configure program should be able to determine if the libwrap library (-lwrap) and headers are available in standard locations. ............. I have openssl 0.9.7h installed on ccpe01 v51b pk#5, with tcp-wrappers7.6. I did the configure, make and make install and things. All stages appeared successful, but then I attempted the ./configure --with-tcp-wrappers and it errored with -lwrap not found. checking for SSL directory... /usr/local/ssl checking for "/dev/urandom"... yes checking whether to disable RSA support... no checking whether to enable DH support... no checking for gethostbyname in -lnsl... no checking for socket in -lsocket... no checking for pthread_create in -lpthread... no checking for pthread_create in -lc_r... no checking for openpty in -lutil... yes checking whether to use the libwrap (TCP wrappers) library... yes checking for hosts_access in -lwrap... not found <-- .............. So then I tried assigning the 3 environment variables and things got worse. The include and lib directories are referenced for tcpd 7.6, but after installing tcp wrappers I do not find include or lib directories for tcpd. Q: Should I expect NOT to see the include or lib directories as defined in #1 above, and, if so, will specifying the absolute path to the tcpwrapper images (EX: /var/tcp_wrappers/tcp_wrappers_7.6) suffice? 3. I followed these instructions when compiling/configuring tcpd v7.6 (downloaded from ftp://ftp.porcupine.org/pub/security/index.html): ............ 7.1 - Easy configuration and installation ----------------------------------------- The "easy" recipe requires no changes to existing software or configuration files. Basically, you move the daemons that you want to protect to a different directory and plug the resulting holes with copies of the wrapper programs. If you don't run Ultrix, you won't need the miscd wrapper program. The miscd daemon implements among others the SYSTAT service, which produces the same output as the WHO command. Type `make' and follow the instructions. The Makefile comes with ready-to-use templates for many common UNIX implementations (sun, ultrix, hp-ux, aix, irix,...). .............. Thanks in advance for any guidance and/or advice that you can offer. --John Lanier

1 0

Special Installs -- Static Binaries and Required Files
by Hal Vaughan 08 Mar '06

08 Mar '06

I may need to include Stunnel with my application so my clients behind restrictive firewalls can still enable me to work on their systems with RealVNC. I'm working with clients on both Windows and Linux. Windows: I know the installer has the files included in it in an archive, but what archive format is it, or what kind or archive program on Linux can I use to read it? Is installing Stunnel on Windows just a matter of copying the files, or are there settings I have to change in the registry? Linux: Is there any way to get static binaries (yes, I know they're bigger) so I can just copy over files to install it as a program (not as a service -- I noticed Debian set it up as a service)? Thanks! Hal

1 0

Stunnel Won't Start on Linux (even with fixed /etc/default/stunnel)
by Hal Vaughan 08 Mar '06

08 Mar '06

I'm trying to start stunnel4 on Linux. I've modified the /etc/stunnel/stunnel.conf file so I can use it with RealVNC. When I run "stunnel4 /etc/stunnel/stunnel.conf" or "/etc/init.d/stunnel4 start", neither command gives me errors or any output, even with -d 7 set. After the shell returns control to me, I do "ps -ax" and have yet to see any instance of stunnel running. There is never a file in /var/run/stunnel to indicate a working daemon if I start it as one. I have edited /etc/default/stunnel4 to look like this (changed ENABLED). I've included it and my /etc/stunnel/stunnel.conf below. No matter what I do, there is never any evidence that stunnel is staring or doing anything. Even error messages would be a big help, so I'd at least know what was wrong. Any help appreciated. I'm sure it's something so obvious I don't see how I could miss it. Thanks for any help. Hal -----------------/etc/default/stunnel4------------------------ # /etc/default/stunnel # Julien LEMOINE <speedblue(a)debian.org> # September 2003 # Change to one to enable stunnel ENABLED=1 FILES="/etc/stunnel/*.conf" OPTIONS="" # Change to one to enable ppp restart scripts PPP_RESTART=0 ------------/etc/stunnel/stunnel.conf-------------------- CAfile = /etc/stunnel/CAcert.pem CApath = /etc/stunnel/ cert = server.pem client = no verify = 3 debug = 7 [vnc] accept = 443 connect = 127.0.0.1:5500

2 2

RE: [stunnel-users] Re: Can stunnel do this?
by Matteo D'Amato 07 Mar '06

07 Mar '06

Here is what I'm getting Insude stunnel.conf file: cert=/usr/local/etc/stunnel/stunnel.pem cafile=/usr/local/etc/stunnel/stunnel.pem output=/var/log/stunnel.log client=yes debug=7 [1440] accept=10.10.10.2:1440 connect=192.168.19.50:1078 Launched using: stunnel /etc/stunnel/stunnel.conf -p /usr/local/etc/stunnel/stunnel.pem Log file: 2006.03.07 08:30:01 LOG5[13209:0]: Received signal 15; terminating 2006.03.07 08:30:01 LOG7[13209:0]: removing pid file /usr/local/var/stunnel/stunnel.pid 2006.03.07 08:30:20 LOG5[13219:1]: stunnel 4.14 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 2006.03.07 08:30:20 LOG7[13219:1]: Snagged 64 random bytes from /root/.rnd 2006.03.07 08:30:20 LOG7[13219:1]: Wrote 1024 new random bytes to /root/.rnd 2006.03.07 08:30:20 LOG7[13219:1]: RAND_status claims sufficient entropy for the PRNG 2006.03.07 08:30:20 LOG6[13219:1]: PRNG seeded successfully 2006.03.07 08:30:20 LOG7[13219:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2006.03.07 08:30:20 LOG7[13219:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2006.03.07 08:30:20 LOG6[13219:1]: file ulimit = 1024 (can be changed with 'ulimit -n') 2006.03.07 08:30:20 LOG6[13219:1]: poll() used - no FD_SETSIZE limit for file descriptors 2006.03.07 08:30:20 LOG5[13219:1]: 500 clients allowed 2006.03.07 08:30:20 LOG7[13219:1]: FD 4 in non-blocking mode 2006.03.07 08:30:20 LOG7[13219:1]: FD 5 in non-blocking mode 2006.03.07 08:30:20 LOG7[13219:1]: FD 6 in non-blocking mode 2006.03.07 08:30:20 LOG7[13219:1]: SO_REUSEADDR option set on accept socket 2006.03.07 08:30:20 LOG7[13219:1]: 1440 bound to 10.10.10.2:1440 2006.03.07 08:30:20 LOG7[13220:1]: Created pid file /usr/local/var/stunnel/stunnel.pid 2006.03.07 08:30:20 LOG7[13220:0]: Waiting -1 second(s) for 2 file descriptor(s) 2006.03.07 08:31:46 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:46 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->(IN) 2006.03.07 08:31:46 LOG7[13220:1]: 1440 accepted FD=7 from 10.10.10.100:1049 2006.03.07 08:31:46 LOG7[13220:1]: Creating a new context 2006.03.07 08:31:46 LOG7[13220:1]: Context 2 created 2006.03.07 08:31:46 LOG7[13220:2]: Context swap: 1 -> 2 2006.03.07 08:31:46 LOG7[13220:2]: 1440 started 2006.03.07 08:31:46 LOG7[13220:2]: FD 7 in non-blocking mode 2006.03.07 08:31:46 LOG7[13220:2]: FD 8 in non-blocking mode 2006.03.07 08:31:46 LOG7[13220:2]: FD 9 in non-blocking mode 2006.03.07 08:31:46 LOG7[13221:0]: Waiting 300 second(s) for 3 file descriptor(s) 2006.03.07 08:31:46 LOG7[13221:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:46 LOG7[13221:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:31:46 LOG7[13221:0]: CONTEXT 2, FD=9, (OUT)->(OUT) 2006.03.07 08:31:46 LOG7[13220:0]: Waiting 300 second(s) for 3 file descriptor(s) 2006.03.07 08:31:46 LOG7[13220:0]: Cleaning up the signal pipe 2006.03.07 08:31:46 LOG6[13220:0]: Child process 13221 finished with code 0 2006.03.07 08:31:46 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:46 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:31:46 LOG7[13220:0]: CONTEXT 2, FD=8, (IN)->(INHUP) 2006.03.07 08:31:46 LOG7[13220:2]: Connection from 10.10.10.100:1049 permitted by libwrap 2006.03.07 08:31:46 LOG5[13220:2]: 1440 connected from 10.10.10.100:1049 2006.03.07 08:31:46 LOG7[13220:2]: FD 8 in non-blocking mode 2006.03.07 08:31:46 LOG7[13220:2]: 1440 connecting 192.168.19.50:1078 2006.03.07 08:31:46 LOG7[13220:2]: connect_wait: waiting 10 seconds 2006.03.07 08:31:46 LOG7[13220:0]: Waiting 10 second(s) for 3 file descriptor(s) 2006.03.07 08:31:46 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:46 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:31:46 LOG7[13220:0]: CONTEXT 2, FD=8, (INOUT)->(OUT) 2006.03.07 08:31:46 LOG7[13220:2]: connect_wait: connected 2006.03.07 08:31:46 LOG7[13220:2]: Remote FD=8 initialized 2006.03.07 08:31:46 LOG7[13220:2]: SSL state (connect): before/connect initialization 2006.03.07 08:31:46 LOG7[13220:2]: SSL state (connect): SSLv3 write client hello A 2006.03.07 08:31:46 LOG7[13220:0]: Waiting 300 second(s) for 3 file descriptor(s) 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->(IN) 2006.03.07 08:31:47 LOG7[13220:1]: CONTEXT 2, FD=8, (IN)->() 2006.03.07 08:31:47 LOG7[13220:1]: Context swap: 2 -> 1 2006.03.07 08:31:47 LOG7[13220:1]: Current context: 1 2006.03.07 08:31:47 LOG7[13220:1]: 1440 accepted FD=9 from 10.10.10.100:1050 2006.03.07 08:31:47 LOG7[13220:1]: Creating a new context 2006.03.07 08:31:47 LOG7[13220:1]: Context 3 created 2006.03.07 08:31:47 LOG7[13220:3]: Context swap: 1 -> 3 2006.03.07 08:31:47 LOG7[13220:3]: 1440 started 2006.03.07 08:31:47 LOG7[13220:3]: FD 9 in non-blocking mode 2006.03.07 08:31:47 LOG7[13220:3]: FD 10 in non-blocking mode 2006.03.07 08:31:47 LOG7[13220:3]: FD 11 in non-blocking mode 2006.03.07 08:31:47 LOG7[13222:0]: Waiting 299 second(s) for 4 file descriptor(s) 2006.03.07 08:31:47 LOG7[13222:0]: CONTEXT 2, FD=8, (IN)->() 2006.03.07 08:31:47 LOG7[13222:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:47 LOG7[13222:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:31:47 LOG7[13222:0]: CONTEXT 3, FD=11, (OUT)->(OUT) 2006.03.07 08:31:47 LOG7[13220:0]: Waiting 299 second(s) for 4 file descriptor(s) 2006.03.07 08:31:47 LOG7[13220:0]: Cleaning up the signal pipe 2006.03.07 08:31:47 LOG6[13220:0]: Child process 13222 finished with code 0 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 2, FD=8, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 3, FD=10, (IN)->(INHUP) 2006.03.07 08:31:47 LOG7[13220:3]: Connection from 10.10.10.100:1050 permitted by libwrap 2006.03.07 08:31:47 LOG5[13220:3]: 1440 connected from 10.10.10.100:1050 2006.03.07 08:31:47 LOG7[13220:3]: FD 10 in non-blocking mode 2006.03.07 08:31:47 LOG7[13220:3]: 1440 connecting 192.168.19.50:1078 2006.03.07 08:31:47 LOG7[13220:3]: connect_wait: waiting 10 seconds 2006.03.07 08:31:47 LOG7[13220:0]: Waiting 10 second(s) for 4 file descriptor(s) 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 2, FD=8, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 3, FD=10, (INOUT)->(OUT) 2006.03.07 08:31:47 LOG7[13220:3]: connect_wait: connected 2006.03.07 08:31:47 LOG7[13220:3]: Remote FD=10 initialized 2006.03.07 08:31:47 LOG7[13220:3]: SSL state (connect): before/connect initialization 2006.03.07 08:31:47 LOG7[13220:3]: SSL state (connect): SSLv3 write client hello A 2006.03.07 08:31:47 LOG7[13220:0]: Waiting 299 second(s) for 4 file descriptor(s) 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 2, FD=8, (IN)->(IN) 2006.03.07 08:31:47 LOG7[13220:2]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:47 LOG7[13220:2]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:31:47 LOG7[13220:2]: CONTEXT 3, FD=10, (IN)->() 2006.03.07 08:31:47 LOG7[13220:2]: Context swap: 3 -> 2 2006.03.07 08:31:47 LOG7[13220:2]: Current context: 2 2006.03.07 08:31:47 LOG7[13220:0]: Waiting 300 second(s) for 4 file descriptor(s) 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 3, FD=10, (IN)->(IN) 2006.03.07 08:31:47 LOG7[13220:3]: CONTEXT 2, FD=8, (IN)->() 2006.03.07 08:31:47 LOG7[13220:3]: Context swap: 2 -> 3 2006.03.07 08:31:47 LOG7[13220:3]: Current context: 3 2006.03.07 08:31:47 LOG7[13220:0]: Waiting 300 second(s) for 4 file descriptor(s) 2006.03.07 08:32:02 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:32:02 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:32:02 LOG7[13220:0]: CONTEXT 2, FD=8, (IN)->(IN) 2006.03.07 08:32:02 LOG7[13220:2]: CONTEXT 3, FD=10, (IN)->() 2006.03.07 08:32:02 LOG7[13220:2]: Context swap: 3 -> 2 2006.03.07 08:32:02 LOG7[13220:2]: Current context: 2 2006.03.07 08:32:02 LOG7[13220:0]: Waiting 285 second(s) for 4 file descriptor(s) 2006.03.07 08:32:02 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:32:02 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:32:02 LOG7[13220:0]: CONTEXT 3, FD=10, (IN)->(IN) 2006.03.07 08:32:02 LOG7[13220:3]: CONTEXT 2, FD=8, (IN)->() 2006.03.07 08:32:02 LOG7[13220:3]: Context swap: 2 -> 3 2006.03.07 08:32:02 LOG7[13220:3]: Current context: 3 2006.03.07 08:32:02 LOG7[13220:0]: Waiting 300 second(s) for 4 file descriptor(s) 2006.03.07 08:32:17 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:32:17 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:32:17 LOG7[13220:0]: CONTEXT 2, FD=8, (IN)->(IN) 2006.03.07 08:32:17 LOG7[13220:2]: CONTEXT 3, FD=10, (IN)->() 2006.03.07 08:32:17 LOG7[13220:2]: Context swap: 3 -> 2 2006.03.07 08:32:17 LOG7[13220:2]: Current context: 2 2006.03.07 08:32:17 LOG7[13220:2]: SSL alert (write): fatal: handshake failure 2006.03.07 08:32:17 LOG3[13220:2]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2006.03.07 08:32:17 LOG7[13220:2]: 1440 finished (1 left) 2006.03.07 08:32:17 LOG5[13220:2]: stack_info: size=65536, current=4208 (6%), maximum=4208 (6%) 2006.03.07 08:32:17 LOG7[13220:2]: Context 2 closed 2006.03.07 08:32:17 LOG7[13220:0]: Waiting 285 second(s) for 3 file descriptor(s) 2006.03.07 08:32:17 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:32:17 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:32:17 LOG7[13220:0]: CONTEXT 3, FD=10, (IN)->(IN) 2006.03.07 08:32:17 LOG7[13220:3]: Context set: 2 (dropped) -> 3 2006.03.07 08:32:17 LOG7[13220:3]: Current context: 3 2006.03.07 08:32:17 LOG7[13220:3]: Releasing context 2 2006.03.07 08:32:17 LOG7[13220:3]: SSL alert (write): fatal: handshake failure 2006.03.07 08:32:17 LOG3[13220:3]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2006.03.07 08:32:17 LOG7[13220:3]: 1440 finished (0 left) 2006.03.07 08:32:17 LOG5[13220:3]: stack_info: size=65536, current=4208 (6%), maximum=4208 (6%) 2006.03.07 08:32:17 LOG7[13220:3]: Context 3 closed 2006.03.07 08:32:17 LOG7[13220:0]: Waiting -1 second(s) for 2 file descriptor(s) --Matteo D'Amato

1 0

RE: [stunnel-users] Re: Can stunnel do this?
by Kevin A. McGrail 07 Mar '06

07 Mar '06

This sounds like exactly what stunnel does. You want to have host A talk to Server A via SSL so you run stunneld on it. Then it will redirect that connection to server B via non-SSL. What protocol are we talking about here? Let's assume it's https: On Server A, setup stunnel with a conf file with these lines (as well as many others surely) [https] accept = 443 connect = serverb.smartbox.ca:80 Then your host connects to server a, negotiates SSL and the information is sent to the other server. I think your biggest issue is going to be the certificate on Server A so that the Host connects to the Server without certificate issues. Sincerely, Kevin A. McGrail aka KAM > -----Original Message----- > From: stunnel-users-bounces(a)mirt.net > [mailto:[email protected]] On Behalf Of Matteo D'Amato > Sent: Monday, March 06, 2006 7:20 PM > To: stunnel-users(a)mirt.net > Subject: RE: [stunnel-users] Re: Can stunnel do this? > > Stunnel can only be installed on Server A > > > > --Matteo D'Amato > > -----Original Message----- > From: stunnel-users-bounces(a)mirt.net > [mailto:[email protected]] On Behalf Of Matteo D'Amato > Sent: Monday, March 06, 2006 5:58 PM > To: stunnel-users(a)mirt.net > Subject: [stunnel-users] Re: Can stunnel do this? > > Hi, > Can stunnel do this > > > Host A ---------> Server A ---------> Server B > SSL unencrypted > > This looks like the opposite of what stunnel does. I have a > host that speaks SSL that needs to talk to a server that does > not and the host must always initiate the connection. Any > ideas if this can be done with stunnel or is there another > way to do this. Thanks

1 0

RE: [stunnel-users] Re: Can stunnel do this?
by Matteo D'Amato 07 Mar '06

07 Mar '06

Stunnel can only be installed on Server A --Matteo D'Amato -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Matteo D'Amato Sent: Monday, March 06, 2006 5:58 PM To: stunnel-users(a)mirt.net Subject: [stunnel-users] Re: Can stunnel do this? Hi, Can stunnel do this Host A ---------> Server A ---------> Server B SSL unencrypted This looks like the opposite of what stunnel does. I have a host that speaks SSL that needs to talk to a server that does not and the host must always initiate the connection. Any ideas if this can be done with stunnel or is there another way to do this. Thanks -- Matteo D'Amato Smartbox Equipment Inc _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

Re: Can stunnel do this?
by Matteo D'Amato 06 Mar '06

06 Mar '06

Hi, Can stunnel do this Host A ---------> Server A ---------> Server B SSL unencrypted This looks like the opposite of what stunnel does. I have a host that speaks SSL that needs to talk to a server that does not and the host must always initiate the connection. Any ideas if this can be done with stunnel or is there another way to do this. Thanks -- Matteo D'Amato Smartbox Equipment Inc

1 0

configure problem in 4.14
by MeeAGhost 06 Mar '06

06 Mar '06

Whether --enable-dh is defined or not the stunnel created certificates created during make-install will include DH support. This is because the USE_DH variable in tools/Makefile is undefined which in turn causes the test portion of the install-data-local section of the tools/Makefile below to fail test $(USE_DH) -eq 0 || $(openssl) gendh $$RND 512 >> stunnel.pem; \ $(openssl) x509 -subject -dates -fingerprint -noout -in stunnel.pem; \ ${INSTALL} -m 600 stunnel.pem $(DESTDIR)$(confdir)/stunnel.pem; \ rm stunnel.pem; \ The test fails with this error message "/bin/bash: test: -eq: unary operator expected" since USE_DH is empty (undefined). I looked at the dh section of the configure script and it appears USE_DH is being set to 1 when --enable-dh is defined. However, USE_DH=1 is only in the DEFS section of tools/Makefile and not actually setting the value of USE_DH variable. I read in the change notes (from several years ago) that dh was disabled by default. I have been running stunnel for the past 3-4 years but have since I initially installed it back then I have been upgrading and therefore the above section of the tools\Makefile was skipped since I already had certificates defined. I went to install on a new box today and found the above 'problem'. So I am not sure how long this has been like this. Before I tried to figure out what is "wrong" I wanted to see if others have noticed this. I have seen this on Solaris 9 and in the cygwin 1.5.19.

2 1

tappipe 1.02 (stable!) released
by Michal Trojnara 03 Mar '06

03 Mar '06

Dear Users, The stable version of my VPN for stunnel/Linux is ready for download here: ftp://ftp.mirt.net/tappipe/ AFAIK it's the shortest (only 356 lines in C language) and probably one of the easiest to setup VPNs ever. Here is the ChangeLog entry: * version 1.02 2006.03.03, status: functional, stable - retransmission rate limiting algoritm improved - some minor bugfixes Could someone contribute a manual page? 8-) Best regards, Mike

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users