- stunnel-users - stunnel.org

Re: [stunnel-users] exclusively TLS
by Jesse Small 24 Jan '06

24 Jan '06

I've been working through the same problem as John, but I tried using Jan's solution by setting the options and still haven't been able to get it to work. On server1 I am running openssl s_server with tls-only specified: openssl s_server -accept 8443 -cert XDS_REG_HXTI.cer -key hxti1.key -tls1 On the client side (server2), I have stunnel set up as a client listening on localhost port 8100, and forwarding over to server1, port 8443. Then to test I run 'telnet localhost 8100' and see the error message from s_server: ACCEPT ERROR 16656:error:1408A10B:SSL routines:SSL3_GET_CLIENT_HELLO:wrong version number:s3_srvr.c:683: shutting down SSL CONNECTION CLOSED In my stunnel.log file I can see this error message: SSL_connect: 14094410: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure So to me it still seems to be sending out a client hello in sslv3, despite my efforts to the contrary. Below are the pertinent parts of my stunnel_client.conf file. Any help you could give would be greatly appreciated. Thanks, Jesse ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS options = NO_SSLv2 options = NO_SSLv3 [toOtherServer] accept = 8100 connect = devapp:8443 -----Original Message----- From: Jan Meijer [mailto:[email protected]] Sent: Friday, January 20, 2006 5:20 PM To: Moehrke, John (GE Healthcare) Cc: stunnel-users(a)mirt.net Subject: RE: [stunnel-users] exclusively TLS On Fri, 20 Jan 2006, Moehrke, John (GE Healthcare) wrote: > It is not the list of ciphers that I want to choose from. We are indeed > using a select set of ciphers and that seems to be working fine. My > problem is that when stunnel connects to the server it is trying sslv3, > and this causes an error as the server is only supporting TLS. I could > easily be wrong... Ah, that way. options = SSL_options OpenSSL library options The parameter is the OpenSSL option name as described in the SSL_CTX_set_options(3ssl) manual, but without SSL_OP_ prefix. Several options can be used to specify multiple options. For example for compatibility with erroneous Eudora SSL implementation the following option can be used: options = DONT_INSERT_EMPTY_FRAGMENTS Check the SSL_CTX_set_options manpage, it says -amongst other things-: SSL_OP_NO_SSLv2 Do not use the SSLv2 protocol. SSL_OP_NO_SSLv3 Do not use the SSLv3 protocol. SSL_OP_NO_TLSv1 Do not use the TLSv1 protocol. That ought to do the trick I'd say. Let us know if it did :) Jan -- http://www.surfnet.nl/organisatie/jame

1 0

ad tdions
by Malcolm William Mason 23 Jan '06

23 Jan '06

I am, apparently on this But how do I post to it as others seen to. Pro Posterioribus

1 0

Looking for a job in UK or Ireland
by Michal Trojnara 23 Jan '06

23 Jan '06

Hi, I hope you don't mind this time I'll use stunnel mailing lists for something personal. I've just updated my Resume: http://mike.mirt.net/cv-en.pdf Do you know of interesting job openings? Possibly as an architect or in a similar position. Best regards, Mike

1 0

https to http proxy is buggy with IE
by Glen 22 Jan '06

22 Jan '06

Hi Everyone, I am trying to use stunnel to do the ssl portion for the web server. Mainly because the certificate I have is easy to setup in stunnel (was originally created for an openssl based serer) and the web server supports it's own propriatery cert format which I would like to avoid having to convert to. I have it working fine with all browsers except for the buggy Internet Explorer. With internet explorer anything requiring a page redirect fails (from viewing the logs it appears the socket gets closed before the redirect is finished resulting in a blank page being sent to the browser. I have tried the TIMEOUTclose = 0 but that hasn't helped. Any suggestions? thanks, Glen

2 1

stunnel 4.14 errors and dropped connection
by stunnelusers＠tinfoil.cotse.net 21 Jan '06

21 Jan '06

Hello, If I leave my computer downloading via stunnel and come back to it later, I find the download has stopped halfway and in the stunnel log it says: SSL_read: Connection reset by peer (WSAECONNRESET) (10054) and then a number of lines like: Error resolving 'xxx.xxx.xxx': Neither nodename nor servname known (EAI_NONAME) where xxx.xxx.xxx is the url I was downloading from. I am using stunnel 4.14 on win xp. If I try to load a web page like google I get told it cannot be found. I have to switch off the router and switch it back on. When Windows finds the "new" connection it resets itself and everything works perfectly again, for a while, and then it happens all over again. This did not happen before I upgraded to 4.14. What is happening? Why is it happening? How do i stop it? Thanks.

1 0

RE: [stunnel-users] exclusively TLS
by Moehrke, John (GE Healthcare) 20 Jan '06

20 Jan '06

It is not the list of ciphers that I want to choose from. We are indeed using a select set of ciphers and that seems to be working fine. My problem is that when stunnel connects to the server it is trying sslv3, and this causes an error as the server is only supporting TLS. I could easily be wrong... John > > I need to talk to a server that is requiring pure TLS. It seems that > > STUNNEL always starts with SSL. How do I get STUNNEL to > start the client > > side conversation with TLS? > > http://www.stunnel.org/faq/stunnel.html#global_options > > ciphers = cipherlist > > Select permitted SSL ciphers > > A colon delimited list of the ciphers to allow in the SSL > connection. > For example DES-CBC3-SHA:IDEA-CBC-MD5 > > > For an exhaustive table of allowed ciphersuite values, if > it's not in the > stunnel manual check > http://www.modssl.org/docs/2.8/ssl_reference.html#ToC9 > > Jan > > -- > http://www.surfnet.nl/organisatie/jame > >

2 1

exclusively TLS
by Moehrke, John (GE Healthcare) 20 Jan '06

20 Jan '06

I need to talk to a server that is requiring pure TLS. It seems that STUNNEL always starts with SSL. How do I get STUNNEL to start the client side conversation with TLS? John Moehrke Enterprise Security Architect GE Healthcare T 262 293 1667 W126 N7449 Flint Road, Suite 200, Menomonee Falls, WI 53051 John.Moehrke(a)med.ge.com <mailto:[email protected]> www.gehealthcare.com <http://www.gehealthcare.com/> What I may see or hear in the course of the treatment or even outside of the treatment in regard to the life of men, which on no account one must spread abroad, I will keep to myself, holding such things shameful to be spoken about. (One Portion of the Hippocratic Oath - Hippocrates, circa 400 B.C.)

2 1

Stunnel in a three tier setup
by Louis Young 19 Jan '06

19 Jan '06

Hi Guys I would like to set up stunnel in a three tier environment, i.e. instead of just having a client and a server, I have a client, midware and server. I tried doing this: On the client: [VNC on TestMachine] accept = 9000 connect = 192.168.100.12:9000 192.168.100.12 is the "mid-ware" machine: On this "mid-ware" machine: [VNC on TestMachine] accept = 9000 connect = 192.168.100.16:9000 192.168.100.16 is the destination: Then on the destination: [VNC] accept = 9000 connect = 192.168.100.16:5900 The only machine with client=yes is the client and they all use the same key. If I change the settings on the client to point directly to the destination (i.e. using only two machines), it works, but with three machines there seems to be a problem Any ideas? Regards, Louis Young Systems Administrator Kwikpay SA (Pty) Ltd

2 1

verify server certification is missing
by Olivier twist 17 Jan '06

17 Jan '06

I think a functionnality is missing in stunnel. I compare the behaviour of stunnel and apache mod-ssl. If you have a certificate signed by third party, apache checks the root certificate like stunnel do this with -v 1 option but apache don't ask for a client certificate, stunnel do this :-( I think that stunnel should control server certificate chain defined in CA file even if option -v 1 is not set !!! Could you give your opinion? If I use stunnel and not apache it's because I have some protocols to handle with ssl and stunnel is a very easy to use solution. Thanks Oliver

1 0

Delay option
by Stefaan Van Dooren 16 Jan '06

16 Jan '06

Hi, I'm setting up stunnel and I'm facing a problem with dynamic IP-adresses. Searching google and the man pages I tought that the "delay = yes" option would solve my problem, but it doesn't seems to. If I had "delay = yes" to my config file, none of my services seems to work anymore. If I remove it, everything is working fine, until the the remote-IP changes, and I have to restart stunnel. What am I doing wrong ? Or isn't this the right option for this job ? Stunnel -version : stunnel 4.14 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 Global options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /usr/local/etc/stunnel/stunnel.pem pid = /usr/local/var/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds Stefaan

2 1

Connection Refused by libwrap
by Eddie Atherton 16 Jan '06

16 Jan '06

Hi, With Version 4.14, I've now started seeing the following messages occaisionally when I fire up 4 concurrent connections from my Windows box, via stunnel on Linux, to my NewsServer: Jan 3 17:55:13 The-Tardis stunnel: LOG3[17760:399]: Unexpected socket close (read_blocking) Jan 3 17:55:13 The-Tardis stunnel: LOG4[17760:399]: Connection from 192.168.0.2:2073 REFUSED by libwrap Jan 3 17:55:13 The-Tardis stunnel: LOG3[17761:399]: Unexpected socket close (read_blocking) Jan 3 17:55:13 The-Tardis stunnel: LOG4[17761:399]: Connection from 192.168.0.2:2073 REFUSED by libwrap Jan 3 17:55:13 The-Tardis stunnel: LOG3[17761:400]: Unexpected socket close (read_blocking) Jan 3 17:55:13 The-Tardis stunnel: LOG4[17761:400]: Connection from 192.168.0.2:2074 REFUSED by libwrap Jan 3 17:55:13 The-Tardis stunnel: LOG3[3824:399]: Unexpected socket close (read_blocking) Jan 3 17:55:13 The-Tardis stunnel: LOG4[3824:399]: Connection from 192.168.0.2:2073 REFUSED by libwrap Jan 3 17:55:13 The-Tardis stunnel: LOG3[3824:400]: Unexpected socket close (read_blocking) Jan 3 17:55:13 The-Tardis stunnel: LOG4[3824:400]: Connection from 192.168.0.2:2074 REFUSED by libwrap Jan 3 17:55:13 The-Tardis stunnel: LOG3[3824:401]: Unexpected socket close (read_blocking) Jan 3 17:55:13 The-Tardis stunnel: LOG4[3824:401]: Connection from 192.168.0.2:2075 REFUSED by libwrap Following this, the connections continues as normal. Now, ASAIK, I'm not using the wrappers. I'm starting stunnel as a daemon, in rc.local. There are no entries in inetd.conf for the port that the windows machine connects from. Here's the relevent parts of the config file: ; Use it for client mode client = yes [nntps] accept = 563 connect = newsgroups.comcast.net:563 Cheers, Eddie

2 2

need help with verify 1 option
by Olivier twist 13 Jan '06

13 Jan '06

2 2

Some newbie question for stunnel
by Thomas Stein 13 Jan '06

13 Jan '06

Hello, After reading some doc pages about stunnel I have still some questions: 1.) I read that the client part of a pop3 connection (e.g. for GoogleMail) is like stunnel -c -d pop3 -r bar:pop3s However I did not found any explations of the flags -d, -d and -r When I type stunnel -help none of these flags are explained. 2.) Can I replace pop3 and pop3s in the command above by real port numbers? 3.) Is stunnel compatible with SSH servers ? In other words: can stunnel on the local machine communicate with a SSH server on the remote computer and vice versa? 4.) Is there a timeout function? Read: When I start stunnel I would like to exit the service after lets say 5 minutes automatically. Is there such a feature/option? 5.) Has someone experiences with googlemail pop3 retrieval of emails? Is the following stunnel command recommendable for googlemail.com? stunnel -c -d pop3 -r pop.googlemail.com:pop3 Thank you in advance for the answer Thomas -- ___________________________________________________ Play 100s of games for FREE! http://games.mail.com/

2 1

Sniffing the network --how to disable SSL?
by david-e.hansen＠ubs.com 12 Jan '06

12 Jan '06

Hi, I know this sort of defeats the whole purpose of stunnel, but I have an LDAP server which listens for non-SSL on one port, and SSL on another. We decided to use stunnel and the SSL port on our LDAP server for security purposes. However, now we need to see the communication between clients and the LDAP server, in order to debug a production problem. Sniffing won't be terribly useful unless we can turn off the SSL encryption of the communication. I can't just re-point the application to the non-SSL port because this is stored in a central database and would affect everyone (it's a 3rd pty app), so I just want to change the stunnel.conf file on my PC so that it does port-forwarding but no encryption. Is this possible to do? Regards, David E. Hansen Stunnel version 4, LDAP version 3 Visit our website at http://www.ubs.com This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message which arise as a result of e-mail transmission. If verification is required please request a hard-copy version. This message is provided for informational purposes and should not be construed as a solicitation or offer to buy or sell any securities or related financial instruments.

2 1

running on one machine stunnel server AND client
by Dan Beldiman 11 Jan '06

11 Jan '06

Hi, I am using stunnel4 (stunnel 4.09 on i386-pc-linux-gnu PTHREAD+POLL+IPv6+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004) on debian linux. I want to run on one machine an stunnel server and an stunnel client, so it can recive a connection and also open a new connection to a different server (in the ascii graphic below server b) SERVER A SERVER B SERVER C | | | | ------>------ ----->---- The configuration file only allows me to specify client=yes or no, but I can not specify this for each connection. How can I set up a client and server on the same machine? Thanks Dan

2 3

Stunnel 4.14 & 4.15 don't compile on Tru64 (5.1A)!
by Alberto D'Ambrosio 11 Jan '06

11 Jan '06

Hi! I'd like to upgrade Stunnel from 4.04 to 4.14/4.15 on my Tru64 box, but it no longer compiles: ========================================= cc: Error: client.c, line 173: In this declaration, "socklen_t" must specify a type. (badparsedecl) socklen_t addrlen; ----^ cc: Error: client.c, line 893: In this declaration, "socklen_t" must specify a type. (badparsedecl) socklen_t addrlen; ----^ cc: Error: client.c, line 1003: In this declaration, "socklen_t" must specify a type. (badparsedecl) socklen_t optlen; ----^ cc: Error: client.c, line 175: In this statement, "addrlen" is not declared. (undeclared) addrlen=sizeof(SOCKADDR_UNION); ----^ cc: Warning: client.c, line 259: In this statement, the referenced type of the pointer value "sid_ctx" is "unsigned char", which is not compatible with "const char" because they differ by signed/unsigned attribute. (ptrmismatch1) SSL_set_session_id_context(c->ssl, sid_ctx, strlen(sid_ctx)); -------------------------------------------------------^ cc: Error: client.c, line 904: In this statement, "addrlen" is not declared. (undeclared) addrlen=sizeof(SOCKADDR_UNION); ----^ cc: Error: client.c, line 1019: In this statement, "optlen" is not declared. (undeclared) optlen=sizeof(error); ------------^ *** Exit 1 Stop. *** Exit 1 Stop. ========================================= For your information: - Version 4.04 compiles and works fine. - Version 4.06 compiles but doesn't work: Jan 11 10:36:14 scilla stunnel[701061]: daemon_loop: s_poll_wait: Invalid argument (22) Jan 11 10:38:37 scilla last message repeated 77888 times Jan 11 10:36:44 scilla last message repeated 24118 times - any version >= 4.07 no longer compiles. - OpenSSL 0.9.8a compiles and works fine. Any help is appreciated. Ciao, Alberto

2 1

Private key storage on usb token or CD
by Siddhartha Jain 10 Jan '06

10 Jan '06

Hi, What would I need to do to store private keys generated on a Windows client on a USB Token or a CD? Thanks, - Siddhartha

2 1

Re: Connection reset by peer on same local network?
by Gabe Martin-Dempesy 04 Jan '06

04 Jan '06

On Jan 4, 2006, at 5:00 AM, stunnel-users-request(a)mirt.net wrote: > Please try the latest stunnel and OpenSSL first. > Also send detailed logs (debug=7). Same behavior occurs after upgrade. on debug 7: Server log: 2006.01.04 09:01:35 LOG7[14085:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2006.01.04 09:01:35 LOG7[14085:0]: CONTEXT 1, FD=4, (IN)->() 2006.01.04 09:01:35 LOG7[14085:0]: CONTEXT 1, FD=6, (IN)->() 2006.01.04 09:01:35 LOG7[14085:0]: CONTEXT 2, FD=8, (OUT)->() 2006.01.04 09:01:35 LOG7[14085:0]: CONTEXT 2, FD=7, (OUT)->(ERRHUP) 2006.01.04 09:01:35 LOG7[14085:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2006.01.04 09:01:35 LOG7[14085:0]: CONTEXT 1, FD=4, (IN)->() 2006.01.04 09:01:35 LOG7[14085:0]: CONTEXT 1, FD=6, (IN)->() 2006.01.04 09:01:35 LOG7[14085:0]: CONTEXT 2, FD=8, (OUT)->() 2006.01.04 09:01:35 LOG7[14085:0]: CONTEXT 2, FD=7, (OUT)->(ERRHUP) 2006.01.04 09:01:35 LOG3[14085:2]: transfer() loop executes not transferring any data 2006.01.04 09:01:35 LOG3[14085:2]: please report the problem to Michal.Trojnara(a)mirt.net 2006.01.04 09:01:35 LOG3[14085:2]: socket open: rd=yes wr=yes, ssl open: rd=yes wr=yes 2006.01.04 09:01:35 LOG3[14085:2]: socket ready: rd=no wr=no, ssl ready: rd=yes wr=no 2006.01.04 09:01:35 LOG3[14085:2]: ssl want: rd=no wr=no 2006.01.04 09:01:35 LOG3[14085:2]: socket input buffer: 16384 byte (s), ssl input buffer: 16384 byte(s) 2006.01.04 09:01:35 LOG3[14085:2]: check_SSL_pending=0, ssl_closing=0 2006.01.04 09:01:35 LOG5[14085:2]: Connection reset: 1345269015 bytes sent to SSL, 213024 bytes sent to socket 2006.01.04 09:01:35 LOG7[14085:2]: 973 finished (0 left) 2006.01.04 09:01:35 LOG5[14085:2]: stack_info: size=65536, current=4620 (7%), maximum=4620 (7%) 2006.01.04 09:01:35 LOG7[14085:2]: Context 2 closed 2006.01.04 09:01:35 LOG7[14085:0]: Waiting -1 second(s) for 2 file descriptor(s) Client log: 2006.01.04 09:00:39 LOG7[9605:0]: Waiting 43200 second(s) for 5 file descriptor(s) 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 1, FD=4, (IN)->() 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 1, FD=6, (IN)->() 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 1, FD=7, (IN)->() 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 2, FD=8, (OUT)->() 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 2, FD=9, (OUT)->(OUT) 2006.01.04 09:00:39 LOG7[9605:2]: SSL_write returned WANT_WRITE: retrying 2006.01.04 09:00:39 LOG3[9605:2]: SSL socket closed with 16384 byte (s) in buffer 2006.01.04 09:00:39 LOG5[9605:2]: Connection reset: 348124 bytes sent to SSL, 1345102011 bytes sent to socket 2006.01.04 09:00:39 LOG7[9605:2]: 8001 finished (0 left) 2006.01.04 09:00:39 LOG7[9605:2]: Context 2 closed 2006.01.04 09:00:39 LOG7[9605:0]: Waiting -1 second(s) for 3 file descriptor(s) This part of the logs: 2006.01.04 09:00:39 LOG7[9605:0]: Waiting 43200 second(s) for 5 file descriptor(s) 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 1, FD=4, (IN)->() 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 1, FD=6, (IN)->() 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 1, FD=7, (IN)->() 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 2, FD=8, (OUT)->() 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 2, FD=9, (OUT)->(OUT) loops continuously in both server and client lots the entire time, repeating several times each second. One rsync session over stunnel generates stunnel logs over 50MB. I have no idea if this is typical LOG7 behavior or not, but I'm mentioning it just in case.

1 0

stunnel 4.14 and zlib compression problem
by David Cheung 03 Jan '06

03 Jan '06

I'm hoping that someone can shed some light on the following problem: when I run stunnel: [root@test stunnel]# stunnel /etc/stunnel/stunnel.conf 2006.01.03 10:49:27 LOG5[4619:1]: stunnel 4.14 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7h 11 Oct 2005 2006.01.03 10:49:27 LOG3[4619:1]: Failed to initialize zlib compression method content of stunnel.conf: foreground = yes debug = 7 cert = /etc/stunnel/stunnel.pem output = /dev/stdout chroot = /var/run/stunnel/ setuid = nobody setgid = nobody pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 compression = zlib [demo] accept = 1443 connect = www:80 TIMEOUTclose = 0 It also appears that the libraries are properly linked in: [root@test tmp]# ldd /usr/sbin/stunnel linux-gate.so.1 => (0xffffe000) libz.so.1 => /usr/lib/libz.so.1 (0xb7fc9000) libdl.so.2 => /lib/libdl.so.2 (0xb7fc5000) libutil.so.1 => /lib/libutil.so.1 (0xb7fc1000) libnsl.so.1 => /lib/libnsl.so.1 (0xb7fab000) libssl.so.0.9.7 => /usr/lib/libssl.so.0.9.7 (0xb7f78000) libcrypto.so.0.9.7 => /usr/lib/libcrypto.so.0.9.7 (0xb7e66000) libwrap.so.0 => /usr/lib/libwrap.so.0 (0xb7e5f000) libc.so.6 => /lib/tls/libc.so.6 (0xb7d40000) /lib/ld-linux.so.2 (0xb7fdf000) I'm running this on Arch Linux with a stock 2.6.15 kernel. Any help would be appreciated.

2 1

Connection reset by peer on same local network?
by Gabe Martin-Dempesy 03 Jan '06

03 Jan '06

I'm attempting to setup an encrypted rsync to pull backups off of a file server onto a safe backup machine. To do this I'm using a combination of stunnel and rsyncd (It needs to pull root-owned files, so -e ssh wouldn't work unless I want to have a backup script remotely logging in as root!!) For now the machines are both on the same local network, 10.10.10.0/24, but I'm have weird problems with stunnel getting a 'connection reset by peer' after a couple minutes of the rsync, halting the transfer prematurely. Here's what I see in the logs: Client: Dec 29 10:19:21 backup stunnel[2568]: 8001 connected from 127.0.0.1:39215 Dec 29 10:21:09 backup stunnel[2568]: SSL_write: Connection reset by peer (104) Dec 29 10:21:09 backup stunnel[2568]: Connection reset: 192532 bytes sent to SSL, 5920666 bytes sent to socket Server: Dec 29 10:20:00 proto stunnel[30434]: 973 connected from 10.10.10.20:54054 Dec 29 10:20:00 proto rsyncd[1776]: rsync on xserve from localhost (127.0.0.1) Dec 29 10:21:49 proto stunnel[30434]: SSL socket closed with 16384 byte(s) in buffer Dec 29 10:21:49 proto stunnel[30434]: Connection reset: 5953434 bytes sent to SSL, 98416 bytes sent to socket Dec 29 16:21:49 proto rsyncd[1776]: rsync: writefd_unbuffered failed to write 4096 bytes: phase "unknown": Connection reset by peer Dec 29 16:21:49 proto rsyncd[1776]: rsync error: error in rsync protocol data stream (code 12) at io.c(666) Note that the client gets the 'connection reset by peer' a good 40 seconds before the server notices the disconnect. Here are the associated stunnel.conf's, which are pretty basic Client: cert = /etc/stunnel/backup.crt key = /etc/stunnel/backup.key setuid = stunnel setgid = stunnel pid = /var/run/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 client = yes [8001] accept = 8001 connect = 10.10.10.15:973 Server: cert = /etc/stunnel/proto.crt key = /etc/stunnel/proto.key setuid = stunnel setgid = stunnel pid = /var/run/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [973] accept = 973 connect = 127.0.0.1:rsync Both are using: stunnel 4.09 on i686-pc-linux-gnu PTHREAD+POLL+IPv6+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 Global options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /etc/stunnel/stunnel.pem pid = /var/lib/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds Both of these machines are Gentoo 2005.1, updated to current, using the hardened 2.6 profile. Neither of them use non-standard make flags. Does anyone have some insight? There shouldn't be any "peer" (besides themselves) in the way between these two boxes to disconnect them.

2 1

RE: [stunnel-users] Connection reset by peer on same local networ k?
by Jeremy Simons 03 Jan '06

03 Jan '06

The problem is not with stunnel, but with rsyncd. I assume you are running rsyncd on the source machine in conjunction with the /etc/rsyncd.conf file. The cool thing about running rsyncd through stunnel is the rsync client appears to the rsyncd as a local machine (obviously) so permissions are a problem. The best way I could recommend since you need to access root owned files would be to setup your rsyncd entry something like: ## Example of full access to /home directory [home] uid = root gid = root path = /home comment = home directory. hosts allow = 127.0.0.1 read only = no ignore nonreadable = no refuse options = checksum dont compress = * If you notice the "hosts allow" directive only allows access from localhost(127.0.0.1). The problem is *anyone* can connect to your stunnel server unless you require security I would recommend using your firewall to allow access to your stunnel instance and also to use non-standard ports (I.E. 50000-50010). Using a firewall in lieu of authentication is obviously NOT secure or even recommended for a production environment but is simply added security that certainly doesn't hurt. The workaround would be to secure stunnel and leave rsyncd wide-open to localhost. As for the "connection reset" errors I was getting the same thing until I upgraded to the latest version of stunnel. I read a post on stunnel.mirt.net about it. Are you sure you're using the latest version of stunnel? Jeremy -----Original Message----- From: Gabe Martin-Dempesy [mailto:[email protected]] Sent: Tuesday, January 03, 2006 1:49 PM To: stunnel-users(a)mirt.net Subject: [stunnel-users] Connection reset by peer on same local network? I'm attempting to setup an encrypted rsync to pull backups off of a file server onto a safe backup machine. To do this I'm using a combination of stunnel and rsyncd (It needs to pull root-owned files, so -e ssh wouldn't work unless I want to have a backup script remotely logging in as root!!) For now the machines are both on the same local network, 10.10.10.0/24, but I'm have weird problems with stunnel getting a 'connection reset by peer' after a couple minutes of the rsync, halting the transfer prematurely. Here's what I see in the logs: Client: Dec 29 10:19:21 backup stunnel[2568]: 8001 connected from 127.0.0.1:39215 Dec 29 10:21:09 backup stunnel[2568]: SSL_write: Connection reset by peer (104) Dec 29 10:21:09 backup stunnel[2568]: Connection reset: 192532 bytes sent to SSL, 5920666 bytes sent to socket Server: Dec 29 10:20:00 proto stunnel[30434]: 973 connected from 10.10.10.20:54054 Dec 29 10:20:00 proto rsyncd[1776]: rsync on xserve from localhost (127.0.0.1) Dec 29 10:21:49 proto stunnel[30434]: SSL socket closed with 16384 byte(s) in buffer Dec 29 10:21:49 proto stunnel[30434]: Connection reset: 5953434 bytes sent to SSL, 98416 bytes sent to socket Dec 29 16:21:49 proto rsyncd[1776]: rsync: writefd_unbuffered failed to write 4096 bytes: phase "unknown": Connection reset by peer Dec 29 16:21:49 proto rsyncd[1776]: rsync error: error in rsync protocol data stream (code 12) at io.c(666) Note that the client gets the 'connection reset by peer' a good 40 seconds before the server notices the disconnect. Here are the associated stunnel.conf's, which are pretty basic Client: cert = /etc/stunnel/backup.crt key = /etc/stunnel/backup.key setuid = stunnel setgid = stunnel pid = /var/run/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 client = yes [8001] accept = 8001 connect = 10.10.10.15:973 Server: cert = /etc/stunnel/proto.crt key = /etc/stunnel/proto.key setuid = stunnel setgid = stunnel pid = /var/run/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [973] accept = 973 connect = 127.0.0.1:rsync Both are using: stunnel 4.09 on i686-pc-linux-gnu PTHREAD+POLL+IPv6+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 Global options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /etc/stunnel/stunnel.pem pid = /var/lib/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds Both of these machines are Gentoo 2005.1, updated to current, using the hardened 2.6 profile. Neither of them use non-standard make flags. Does anyone have some insight? There shouldn't be any "peer" (besides themselves) in the way between these two boxes to disconnect them. _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

stunnel library inconsistencies
by Brian T 29 Dec '05

29 Dec '05

Hi, I've been using stunnel 4.08 on an embedded Linux platform for a while now, and am attempting to move to the 2.6 kernel from the 2.4.20, which has changed my building platform. I am cross-compiling with libs and tools targeted for the embedded system, which is an i486 type AMD Elan chip. I have tried 4.08, 4.14 and 4.15b, all with the same result. Everything looks to compile properly, but when running stunnel I get the following: Inconsistency detected by ld.so: dl-minimal.c: 134: realloc: Assertion `ptr == alloc_last_block' failed! strace doesn't supply any helpful information. I have tried building with and without tcpwrappers, and have tried libssl 0.9.7g and 0.9.7i. Libssl v0.9.8a doesn't seem to play very nice. Anyone able to look at my config.log? It's 140k uncompressed, but will zip it up if needed. Thanks, -Brian

2 2

./configure issues
by Campbell Vertesi 29 Dec '05

29 Dec '05

I'm running a fresh install of Solaris 10-sparc, and am having a helluvatime getting stunnel to configure. I come from a Gentoo background, where compiling apps is second nature, and I'm not used to this kind of problem! I originally installed gcc3.3.2 using the sunfreeware package, and as an afterthought went back again using pkg-get to make sure I had all the dependencies I needed. When I run ./configure, it errors out: # ./configure configure: **************************************** initialization checking for a BSD-compatible install... /opt/sfw/bin/ginstall -c checking whether build environment is sane... yes checking for gawk... gawk checking whether make sets $(MAKE)... yes checking build system type... sparc-sun-solaris2.10 checking host system type... sparc-sun-solaris2.10 checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ANSI C... none needed checking for style of include used by make... GNU checking dependency style of gcc... gcc3 checking for a BSD-compatible install... /opt/sfw/bin/ginstall -c checking whether make sets $(MAKE)... (cached) yes configure: **************************************** libtool checking for a sed that does not truncate output... /opt/sfw/bin/gsed checking for egrep... egrep checking for ld used by gcc... /usr/ccs/bin/ld checking if the linker (/usr/ccs/bin/ld) is GNU ld... no checking for /usr/ccs/bin/ld option to reload object files... -r checking for BSD-compatible nm... /opt/sfw/lib/bin//nm -B checking whether ln -s works... yes checking how to recognise dependent libraries... pass_all checking how to run the C preprocessor... /lib/cpp configure: error: C preprocessor "/lib/cpp" fails sanity check See `config.log' for more details. relevant chunk of config.log: configure:2615: checking whether gcc accepts -g configure:2636: gcc -c -g conftest.c >&5 configure:2642: $? = 0 configure:2645: test -z || test ! -s conftest.err configure:2648: $? = 0 configure:2651: test -s conftest.o configure:2654: $? = 0 configure:2665: result: yes configure:2682: checking for gcc option to accept ANSI C configure:2752: gcc -c -g -O2 conftest.c >&5 In file included from conftest.c:13: /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/stdio.h:36:27: iso/stdio_iso.h: No such file or directory /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/stdio.h:105:27: iso/stdio_c99.h: No such file or directory In file included from conftest.c:13: /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/stdio.h:210: error: parse error before '*' token /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/stdio.h:246: error: parse error before '*' token /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/stdio.h:247: error: parse error before '*' token /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/stdio.h:256: error: parse error before '*' token /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/stdio.h:258: error: parse error before '*' token /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/stdio.h:282: error: parse error before '*' token /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/stdio.h:284: error: parse error before '*' token /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/stdio.h:295: error: parse error before '*' token /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/stdio.h:296: error: parse error before "FILE" In file included from conftest.c:14: /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:27:31: sys/feature_tests.h: No such file or directory /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:28 :26: sys/isa_defs.h: No such file or directory /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:33:27: sys/machtypes.h: No such file or directory /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:45:27: sys/int_types.h: No such file or directory In file included from conftest.c:14: /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:68: error: parse error before "int32_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:72: error: parse error before "uint32_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:214: error: parse error before "int32_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:219: error: parse error before "uint32_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:225: error: parse error before "int32_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:230: error: parse error before "uint32_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:233: error: parse error before "offset_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:234: error: parse error before "u_offset_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:235: error: parse error before "len_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:236: error: parse error before "diskaddr_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:395: error: parse error before "uint16_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:397: error: parse error before "__pthread_mutex_ceiling" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:398: error: parse error before "__pthread_mutex_type" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:399: error: parse error before "__pthread_mutex_magic" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:403: error: parse error before "uint8_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:406: error: parse error before "uint32_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:409: error: parse error before "__pthread_mutex_owner64" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:411: error: parse error before "__pthread_mutex_data" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:416: error: parse error before "uint8_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:418: error: parse error before "__pthread_cond_magic" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:420: error: parse error before "__pthread_cond_data" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:427: error: parse error before "int32_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:429: error: parse error before "__pthread_rwlock_magic" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:430: error: parse error before "__pthread_rwlock_mutex" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:431: error: parse error before "__pthread_rwlock_readercv" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:432: error: parse error before "__pthread_rwlock_writercv" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:439: error: parse error before "uint32_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:441: error: parse error before "__pthread_barrier_cycle" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:442: error: parse error before "__pthread_barrier_reserved" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:443: error: parse error before "__pthread_barrier_lock" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:444: error: parse error before "__pthread_barrier_cond" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:447: error: parse error before "pthread_spinlock_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:474: error: parse error before "upad64_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:618:24: sys/select.h: No such file or directory conftest.c:15:22: sys/stat.h: No such file or directory conftest.c:18: error: parse error before '*' token conftest.c:18: warning: `struct stat' declared inside parameter list conftest.c:18: warning: its scope is only this definition or declaration, which is probably not what you want conftest.c:18: warning: data definition has no type or storage class conftest.c:47: error: parse error before "FILE" conftest.c:47: warning: `struct stat' declared inside parameter list conftest.c:47: error: `pairnames' declared as function returning a function conftest.c:47: error: parse error before "int" configure:2758: $? = 1 configure: failed program was: | /* confdefs.h. */ | | #define PACKAGE_NAME "stunnel" | #define PACKAGE_TARNAME "stunnel" | #define PACKAGE_VERSION "4.14" | #define PACKAGE_STRING "stunnel 4.14" | #define PACKAGE_BUGREPORT "" | #define PACKAGE "stunnel" | #define VERSION "4.14" | #define HOST "sparc-sun-solaris2.10" | /* end confdefs.h. */ | #include <stdarg.h> | #include <stdio.h> | #include <sys/types.h> | #include <sys/stat.h> | /* Most of the following tests are stolen from RCS 5.7's src/conf.sh. */ | struct buf { int x; }; | FILE * (*rcsopen) (struct buf *, struct stat *, int); | static char *e (p, i) | char **p; | int i; | { | return p[i]; | } | static char *f (char * (*g) (char **, int), char **p, ...) | { | char *s; | va_list v; | va_start (v,p); | s = g (p, va_arg (v,int)); | va_end (v); | return s; | } | | /* OSF 4.0 Compaq cc is some sort of almost-ANSI by default. It has | function prototypes and stuff, but not '\xHH' hex character constants. | These don't provoke an error unfortunately, instead are silently treated | as 'x'. The following induces an error, until -std1 is added to get | proper ANSI mode. Curiously '\x00'!='x' always comes out true, for an | array size at least. It's necessary to write '\x00'==0 to get something | that's true only with -std1. */ | int osf4_cc_array ['\x00' == 0 ? 1 : -1]; | | int test (int i, double x); | struct s1 {int (*f) (int a);}; | struct s2 {int (*f) (double a);}; | int pairnames (int, char **, FILE *(*)(struct buf *, struct stat *, int), int, int); | int argc; | char **argv; | int | main () | { | return f (e, argv, 0) != argv[0] || f (e, argv, 1) != argv[1]; | ; | return 0; | } I'm at my wits end at this point. Any help would be greatly appreciated! # uname -a SunOS foobar 5.10 Generic sun4u sparc SUNW,Sun-Blade-100 # gcc -v Reading specs from /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/specs Configured with: ../configure --with-as=/usr/ccs/bin/as --with-ld=/usr/ccs/bin/ld --disable-nls Thread model: posix gcc version 3.3.2 # make -v GNU Make 3.80 Copyright (C) 2002 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. Thanks Cam

1 0

how do i configure stunnel to work with TLS_RSA_WITH_RC4_128_SHA
by Nadav, Erez 29 Dec '05

29 Dec '05

hi, I had installed stunnel to work as client. I do i configure the stunnel to encrypt send data in TLS_RSA_WITH_RC4_128_SHA Regards Erez __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

1 0

how do i configure SSL or stunnel for the following encription
by Nadav, Erez 28 Dec '05

28 Dec '05

1. TLS_RSA_WITH_RC4_128_SHA 2. TLS_RSA_WITH_AES_256_CBC_SHA Regards Nadav Erez R&D Verint Systems Inc Phone: +972+9-9624753 Cellular: +972-54-7784753 Email: Erez.Nadav(a)verint.com Web: www.verint.com <http://www.verint.com/> __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users