- stunnel-users - stunnel.org

stunnel + openbsd + popa3d
by Pedro [bodymind] 28 Dec '05

28 Dec '05

hi! I'm getting nuts with this... i hope someone can help me... i'm trying to use popa3d trough stunnel, with inetd... stunnel.log: 2005.12.28 14:03:45 LOG5[6298:2102628352]: stunnel 4.11 on i386-unknown-openbsd3.8 PTHREAD+POLL+IPv6+LIBWRAP with OpenSSL 0.9.7g 11 Apr 2005 2005.12.28 14:03:45 LOG7[6298:2102628352]: Snagged 64 random bytes from /dev/arandom 2005.12.28 14:03:45 LOG7[6298:2102628352]: RAND_status claims sufficient entropy for the PRNG 2005.12.28 14:03:45 LOG6[6298:2102628352]: PRNG seeded successfully 2005.12.28 14:03:45 LOG7[6298:2102628352]: Certificate: /etc/stunnel/teste.pem 2005.12.28 14:03:45 LOG7[6298:2102628352]: Key file: /etc/stunnel/teste.pem 2005.12.28 14:03:45 LOG7[6298:2102628352]: stunnel started 2005.12.28 14:03:45 LOG7[6298:2102628352]: FD 0 in non-blocking mode 2005.12.28 14:03:45 LOG7[6298:2102628352]: FD 1 in non-blocking mode 2005.12.28 14:03:45 LOG5[6298:2102628352]: stunnel connected from 2x.x.x.x :37594 2005.12.28 14:03:45 LOG7[6298:2102628352]: SSL state (accept): before/accept initialization 2005.12.28 14:03:45 LOG7[6298:2102628352]: SSL state (accept): SSLv3 read client hello A 2005.12.28 14:03:45 LOG7[6298:2102628352]: SSL state (accept): SSLv3 write server hello A 2005.12.28 14:03:45 LOG7[6298:2102628352]: SSL state (accept): SSLv3 write certificate A 2005.12.28 14:03:45 LOG7[6298:2102628352]: SSL state (accept): SSLv3 write server done A 2005.12.28 14:03:45 LOG7[6298:2102628352]: SSL state (accept): SSLv3 flush data 2005.12.28 14:03:45 LOG7[6298:2102628352]: SSL state (accept): SSLv3 read client key exchange A 2005.12.28 14:03:45 LOG7[6298:2102628352]: SSL state (accept): SSLv3 read finished A 2005.12.28 14:03:45 LOG7[6298:2102628352]: SSL state (accept): SSLv3 write change cipher spec A 2005.12.28 14:03:45 LOG7[6298:2102628352]: SSL state (accept): SSLv3 write finished A 2005.12.28 14:03:45 LOG7[6298:2102628352]: SSL state (accept): SSLv3 flush data 2005.12.28 14:03:45 LOG7[6298:2102628352]: 1 items in the session cache 2005.12.28 14:03:45 LOG7[6298:2102628352]: 0 client connects (SSL_connect()) 2005.12.28 14:03:45 LOG7[6298:2102628352]: 0 client connects that finished 2005.12.28 14:03:45 LOG7[6298:2102628352]: 0 client renegotiatations requested 2005.12.28 14:03:45 LOG7[6298:2102628352]: 1 server connects (SSL_accept()) 2005.12.28 14:03:45 LOG7[6298:2102628352]: 1 server connects that finished 2005.12.28 14:03:45 LOG7[6298:2102628352]: 0 server renegotiatiations requested 2005.12.28 14:03:45 LOG7[6298:2102628352]: 0 session cache hits 2005.12.28 14:03:45 LOG7[6298:2102628352]: 0 session cache misses 2005.12.28 14:03:45 LOG7[6298:2102628352]: 0 session cache timeouts 2005.12.28 14:03:45 LOG6[6298:2102628352]: SSL accepted: new session negotiated 2005.12.28 14:03:45 LOG6[6298:2102628352]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.12.28 14:03:45 LOG7[6298:2102628352]: bind#1: Invalid argument (22) 2005.12.28 14:03:45 LOG7[6298:2102628352]: bind#2: Invalid argument (22) 2005.12.28 14:03:45 LOG3[6298:2102628352]: connect: Invalid argument (22) 2005.12.28 14:03:45 LOG3[6298:2102628352]: Failed to initialize remote connection 2005.12.28 14:03:45 LOG7[6298:2102628352]: stunnel finished (0 left) openssl error when i connect: $ openssl s_client -connect xxx.xxx.xxx.xxx:995 -state -debug CONNECTED(00000003) SSL_connect:before/connect initialization write to 080A6E20 [080A6E68] (148 bytes => 148 (0x94)) 0000 - 80 92 01 03 01 00 69 00-00 00 20 00 00 39 00 00 ......i... ..9.. 0010 - 38 00 00 35 00 00 16 00-00 13 00 00 0a 07 00 c0 8..5............ 0020 - 00 00 33 00 00 32 00 00-2f 00 00 07 05 00 80 03 ..3..2../....... 0030 - 00 80 00 00 66 00 00 05-00 00 04 01 00 80 08 00 ....f........... 0040 - 80 00 00 63 00 00 62 00-00 61 00 00 15 00 00 12 ...c..b..a...... 0050 - 00 00 09 06 00 40 00 00-65 00 00 64 00 00 60 00 [email protected]..`. 0060 - 00 14 00 00 11 00 00 08-00 00 06 04 00 80 00 00 ................ 0070 - 03 02 00 80 1f e8 cf 61-77 e3 92 52 b4 e8 c6 04 .......aw..R.... 0080 - c9 67 e7 93 20 4e 20 36-28 fa 98 6f b6 e5 29 c3 .g.. N 6(..o..). 0090 - 53 b0 ce 69 S..i SSL_connect:SSLv2/v3 write client hello A read from 080A6E20 [080AC3C8] (7 bytes => 7 (0x7)) 0000 - 16 03 01 00 4a 02 ....J. 0007 - <SPACES/NULS> read from 080A6E20 [080AC3CF] (72 bytes => 72 (0x48)) 0000 - 00 46 03 01 43 b2 9f 7f-42 8f 27 c4 ec 25 62 81 .F..C...B.'..%b. 0010 - 93 e3 33 1b f5 4f 12 ab-41 50 97 69 29 ba a2 b4 ..3..O..AP.i)... 0020 - 56 5c d6 10 20 c3 77 7b-35 5b 05 da 22 0f 14 47 V\.. .w{5[.."..G 0030 - 00 21 e3 96 d8 5b 57 04-5d b1 75 60 fa 72 62 49 .!...[W.].u`.rbI 0040 - 19 2a 0d 12 af 00 35 .*....5 0048 - <SPACES/NULS> SSL_connect:SSLv3 read server hello A read from 080A6E20 [080AC3C8] (5 bytes => 5 (0x5)) 0000 - 16 03 01 02 39 ....9 read from 080A6E20 [080AC3CD] (569 bytes => 569 (0x239)) 0000 - 0b 00 02 35 00 02 32 00-02 2f 30 82 02 2b 30 82 ...5..2../0..+0. 0010 - 01 94 02 09 00 eb 73 d0-24 42 f1 a3 36 30 0d 06 ......s.$B..60.. 0020 - 09 2a 86 48 86 f7 0d 01-01 04 05 00 30 5a 31 0b .*.H........0Z1. 0030 - 30 09 06 03 55 04 06 13-02 70 74 31 0e 30 0c 06 0...U....pt1.0.. 0040 - 03 55 04 08 13 05 45 76-6f 72 61 31 0e 30 0c 06 .U....Xxxxx1.0.. 0050 - 03 55 04 07 13 05 45 76-6f 72 61 31 0d 30 0b 06 .U....Xxxxx1.0.. 0060 - 03 55 04 0a 13 04 4e 65-65 69 31 0d 30 0b 06 03 .U....Xxxx1.0... 0070 - 55 04 0b 13 04 4e 65 65-69 31 0d 30 0b 06 03 55 U....Xxxx1.0...U 0080 - 04 03 13 04 4e 65 65 69-30 1e 17 0d 30 35 31 32 ....Xxxx0...0512 0090 - 32 36 30 31 30 31 33 31-5a 17 0d 30 36 30 31 32 26010131Z..06012 00a0 - 35 30 31 30 31 33 31 5a-30 5a 31 0b 30 09 06 03 5010131Z0Z1.0... 00b0 - 55 04 06 13 02 70 74 31-0e 30 0c 06 03 55 04 08 U....pt1.0...U.. 00c0 - 13 05 45 76 6f 72 61 31-0e 30 0c 06 03 55 04 07 ..Xxxxx1.0...U.. 00d0 - 13 05 45 76 6f 72 61 31-0d 30 0b 06 03 55 04 0a ..Xxxxx1.0...U.. 00e0 - 13 04 4e 65 65 69 31 0d-30 0b 06 03 55 04 0b 13 ..Xxxx1.0...U... 00f0 - 04 4e 65 65 69 31 0d 30-0b 06 03 55 04 03 13 04 .Xxxx1.0...U.... 0100 - 4e 65 65 69 30 81 9f 30-0d 06 09 2a 86 48 86 f7 Xxxx0..0...*.H.. 0110 - 0d 01 01 01 05 00 03 81-8d 00 30 81 89 02 81 81 ..........0..... 0120 - 00 9e e7 9f f2 de 73 9e-79 d5 76 4c d9 83 63 94 ......s.y.vL..c. 0130 - 53 12 e8 8d 73 43 9d 09-b1 48 d6 69 05 5d 31 1d S...sC...H.i.]1. 0140 - 24 a7 bd d6 8f a0 79 4a-1c 73 dc 78 75 9b 66 0b $.....yJ.s.xu.f. 0150 - dc 0b 27 a2 fe 4f 4a 0b-67 77 d4 96 34 c8 81 3f ..'..OJ.gw..4..? 0160 - 4a 6d a6 50 f5 6a f0 fa-53 f8 ed ba f7 51 c5 27 Jm.P.j..S....Q.' 0170 - 71 77 cf cb 95 85 83 f8-a2 c0 2b 0a c2 56 b9 6e qw........+..V.n 0180 - d1 fa e4 1a 72 a0 58 6a-41 99 ba 5e 3c 75 0c 97 ....r.XjA..^<u.. 0190 - 0f 67 e2 93 a5 48 b1 1a-18 9c 22 cf 41 2b 75 ec .g...H....".A+u. 01a0 - 05 02 03 01 00 01 30 0d-06 09 2a 86 48 86 f7 0d ......0...*.H... 01b0 - 01 01 04 05 00 03 81 81-00 8c ef 64 ef d0 62 8d ...........d..b. 01c0 - c5 77 68 00 28 d5 c6 18-d0 c8 17 d2 c4 9a 65 40 .wh.(.........e@ 01d0 - 4c 7b c8 bb 5d 5b 03 af-db e6 00 c7 3f 5a a0 a2 L{..][......?Z.. 01e0 - d5 90 bc eb 77 c2 87 88-e2 6a 25 09 c9 f6 3c 47 ....w....j%...<G 01f0 - 25 b2 85 90 d3 a2 a2 51-52 26 7a 50 b3 f4 e3 a2 %......QR&zP.... 0200 - 97 b9 ea bd 31 19 5b c8-70 bc c3 01 8e ea 0b a2 ....1.[.p....... 0210 - d5 5b 60 64 cd 65 37 60-63 94 8d 8f 72 4a d3 4f .[`d.e7`c...rJ.O 0220 - 0a a3 be c8 b4 f0 fa 60-83 b2 30 f5 59 47 45 2e .......`..0.YGE. 0230 - 50 a2 2f 17 52 0c d9 23-d1 P./.R..#. depth=0 /C=pt/ST=Xxxxx/L=Xxxxx/O=Xxxx/OU=Xxxx/CN=Xxxx verify error:num=18:self signed certificate verify return:1 depth=0 /C=pt/ST=Xxxxx/L=Xxxxx/O=Xxxx/OU=Xxxx/CN=Xxxx verify return:1 SSL_connect:SSLv3 read server certificate A read from 080A6E20 [080AC3C8] (5 bytes => 5 (0x5)) 0000 - 16 03 01 00 04 ..... read from 080A6E20 [080AC3CD] (4 bytes => 4 (0x4)) 0000 - 0e . 0004 - <SPACES/NULS> SSL_connect:SSLv3 read server done A write to 080A6E20 [080B6640] (139 bytes => 139 (0x8B)) 0000 - 16 03 01 00 86 10 00 00-82 00 80 65 51 68 44 44 ...........eQhDD 0010 - 2e 50 99 2d 01 7b 10 39-93 94 8e 9d 0d 80 bf b8 .P.-.{.9........ 0020 - fd 55 11 35 a2 3c 9d 66-cd bb 0e 91 32 fe c6 b9 .U.5.<.f....2... 0030 - 86 2c 21 6c af ba c5 ac-08 2a 17 4a a8 97 5c b5 .,!l.....*.J..\. 0040 - e4 36 ed a0 a3 0b ab c4-19 61 c3 fc 17 cf b3 7f .6.......a...... 0050 - 5b f3 8b bc 8f e5 e4 fd-88 5c 83 da 61 1f a3 4b [........\..a..K 0060 - df 00 37 61 31 8f 50 fe-72 8b 72 8d 48 bf 2f 3b ..7a1.P.r.r.H./; 0070 - 10 fc 3b cf 5a 61 4a 51-ab e4 76 54 57 5e d6 4d ..;.ZaJQ..vTW^.M 0080 - 9a c2 a7 9f fc 5c f8 0d-55 40 bb .....\..U@. SSL_connect:SSLv3 write client key exchange A write to 080A6E20 [080B6640] (6 bytes => 6 (0x6)) 0000 - 14 03 01 00 01 01 ...... SSL_connect:SSLv3 write change cipher spec A write to 080A6E20 [080B6640] (53 bytes => 53 (0x35)) 0000 - 16 03 01 00 30 fe 84 71-85 05 57 bf bc 74 1f 55 ....0..q..W..t.U 0010 - db 54 8f eb 38 a8 d4 fe-1d 24 a9 4e d1 65 6b 6a .T..8....$.N.ekj 0020 - e1 c8 47 57 1f 64 80 1e-7a af a0 9b fd 6e 1c 0b ..GW.d..z....n.. 0030 - 0c a7 a6 3e 30 ...>0 SSL_connect:SSLv3 write finished A SSL_connect:SSLv3 flush data read from 080A6E20 [080AC3C8] (5 bytes => 5 (0x5)) 0000 - 14 03 01 00 01 ..... read from 080A6E20 [080AC3CD] (1 bytes => 1 (0x1)) 0000 - 01 . read from 080A6E20 [080AC3C8] (5 bytes => 5 (0x5)) 0000 - 16 03 01 00 30 ....0 read from 080A6E20 [080AC3CD] (48 bytes => 48 (0x30)) 0000 - ef 6b 5b 33 44 bb 18 4a-a4 e5 95 07 cf 17 d2 4c .k[3D..J.......L 0010 - b2 c0 10 59 68 4b aa a4-96 a7 e7 9c 0c bd ae 80 ...YhK.......... 0020 - 38 fb 08 ec 28 2c 51 15-26 fe 44 3f c8 31 f7 99 8...(,Q.&.D?.1.. SSL_connect:SSLv3 read finished A --- Certificate chain 0 s:/C=pt/ST=Xxxxx/L=Xxxxx/O=Xxxx/OU=Xxxx/CN=Xxxx i:/C=pt/ST=Xxxxx/L=Xxxxx/O=Xxxx/OU=Xxxx/CN=Xxxx --- Server certificate -----BEGIN CERTIFICATE----- MIICKzCCAZQCCQDrc9AkQvGjNjANBgkqhkiG9w0BAQQFADBaMQswCQYDVQQGEwJw dDEOMAwGA1UECBMFRXZvcmExDjAMBgNVBAcTBUV2b3JhMQ0wCwYDVQQKEwROZWVp MQ0wCwYDVQQLEwROZWVpMQ0wCwYDVQQDEwROZWVpMB4XDTA1MTIyNjAxMDEzMVoX DTA2MDEyNTAxMDEzMVowWjELMAkGA1UEBhMCcHQxDjAMBgNVBAgTBUV2b3JhMQ4w DAYDVQQHEwVFdm9yYTENMAsGA1UEChMETmVlaTENMAsGA1UECxMETmVlaTENMAsG A1UEAxMETmVlaTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAnuef8t5znnnV dkzZg2OUUxLojXNDnQmxSNZpBV0xHSSnvdaPoHlKHHPceHWbZgvcCyei/k9KC2d3 1JY0yIE/Sm2mUPVq8PpT+O2691HFJ3F3z8uVhYP4osArCsJWuW7R+uQacqBYakGZ ul48dQyXD2fik6VIsRoYnCLPQSt17AUCAwEAATANBgkqhkiG9w0BAQQFAAOBgQCM 72Tv0GKNxXdoACjVxhjQyBfSxJplQEx7yLtdWwOv2+YAxz9aoKLVkLzrd8KHiOJq JQnJ9jxHJbKFkNOiolFSJnpQs/Tjope56r0xGVvIcLzDAY7qC6LVW2BkzWU3YGOU jY9yStNPCqO+yLTw+mCDsjD1WUdFLlCiLxdSDNkj0Q== -----END CERTIFICATE----- subject=/C=pt/ST=Xxxxx/L=Xxxxx/O=Xxxx/OU=Xxxx/CN=Xxxx issuer=/C=pt/ST=Xxxxx/L=Xxxxx/O=Xxxx/OU=Xxxx/CN=Xxxx --- No client certificate CA names sent --- SSL handshake has read 721 bytes and written 346 bytes --- New, TLSv1/SSLv3, Cipher is AES256-SHA Server public key is 1024 bit SSL-Session: Protocol : TLSv1 Cipher : AES256-SHA Session-ID: C3777B355B05DA220F14470021E396D85B57045DB17560FA726249192A0D12AF Session-ID-ctx: Master-Key: 89A9BC55E2B4700DDA80F799A1B5B958CAF9BFEF8970921A7158CB6EFE3F352693B500BA258CA508B3B2A25517941FD6 Key-Arg : None Start Time: 1135779714 Timeout : 300 (sec) Verify return code: 18 (self signed certificate) --- read from 080A6E20 [080AC3C8] (5 bytes => -1 (0xFFFFFFFF)) read:errno=104 write to 080A6E20 [080B0BD8] (37 bytes => -1 (0xFFFFFFFF)) configs: inetd.conf: pop3s stream tcp nowait root /usr/local/sbin/stunnel stunnel /etc/stunnel/pop3s.conf pop3s.conf: exec = /usr/sbin/popa3d execargs = popa3d output = /var/log/stunnel.log debug = 7 cert = /etc/stunnel/stunnel.pem Versions: OpenSSL 0.9.7g 11 Apr 2005 stunnel: stunnel 4.11 on i386-unknown-openbsd3.8 PTHREAD+POLL+IPv6+LIBWRAP with OpenSSL 0.9.7g 11 Apr 2005 Global options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /etc/stunnel/stunnel.pem pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/arandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds $ uname -a OpenBSD xxx.xxx.xxx.xxx 3.8 GENERIC#138 i386 Thanks in advance for helping me =) Pedro Gouveia

1 0

stunnel connect success even if remote side do not exist
by Nadav, Erez 28 Dec '05

28 Dec '05

i have a question: I conbfigure the stunnel to work as tcp wrapper. I configure stunnel for accept on 2003 and connect to 10.1.1.1:2003 (not exist address). I see that any TCP connect to 2003 always succeed. I expect that the TCP connect will fail if the remote side connection failed. Is there a way to make it happen Nadav Erez R&D Verint Systems Inc Phone: +972+9-9624753 Cellular: +972-54-7784753 Email: Erez.Nadav(a)verint.com Web: www.verint.com <http://www.verint.com/> __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

2 1

online stunnel configuration
by Nadav, Erez 26 Dec '05

26 Dec '05

hi, i have a question: How can i change the stunnel service configuration (add/change accept/connect values) without stop and start the stunnel service ? Nadav Erez R&D Verint Systems Inc Phone: +972+9-9624753 Cellular: +972-54-7784753 Email: Erez.Nadav(a)verint.com Web: www.verint.com <http://www.verint.com/> __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

1 0

(Other) client to stunnel server 4.14
by Jurgen Tessers 24 Dec '05

24 Dec '05

Hi all, I'm in a situation where Biztalk has to communicatie through Stunnel with a broker on a other site (both on Win XP). Now the only way to reach this broker is through a proxy, and that seems the problem with Stunnel, you can't configure a proxy. Is there another way, or another client that have the possibility to configure a proxy and can connect to a Stunnel server. With regards, Jurgen

1 0

Transparency issues
by Alaric Dailey 16 Dec '05

16 Dec '05

I am trying to run stunnel on my linux machine every works fine, until I set transparent = yes then stunnel doesn't work at all, I am running stunnel 4.09 on a debian sarge box, can anyone offer a suggestion?

1 0

Can not estabilish stunnel
by McDouglas 13 Dec '05

13 Dec '05

Hi, I have difficulties setting up a tunnel between two linux box I administrate. Right now its only in test phase, i would like to make an stunnel connection to the smpt server at 195.56.52.140. My final goal is to set up syslog through stunnel, thats why the port name/numbers. Config file for the server: cert = /usr/local/etc/stunnel/stunnel.pem pid = /usr/local/etc/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /usr/local/etc/stunnel/stunnel.log [ssyslog] accept = 195.56.52.140:2514 connect = 10.10.2.1:25 Config file for the client: cert = /usr/local/etc/stunnel/stunnel.pem pid = /usr/local/etc/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /usr/local/etc/stunnel/stunnel.log client = yes [ssyslog] accept = 2514 connect = 195.56.52.140:2514 I get the following messages in the logs after, executing a "telnet 127.0.0.1 2514" command at the client machine (of course, smtp works on the other side, and i set iptables to allow incomming connections on 2514 dport) Server: 2005.12.13 09:09:22 LOG5[11505:1]: stunnel 4.14 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7e 25 Oct 2004 2005.12.13 09:09:22 LOG7[11505:1]: Snagged 64 random bytes from /root/.rnd 2005.12.13 09:09:22 LOG7[11505:1]: Wrote 1024 new random bytes to /root/.rnd 2005.12.13 09:09:22 LOG7[11505:1]: RAND_status claims sufficient entropy for the PRNG 2005.12.13 09:09:22 LOG6[11505:1]: PRNG seeded successfully 2005.12.13 09:09:22 LOG7[11505:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2005.12.13 09:09:22 LOG7[11505:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2005.12.13 09:09:22 LOG6[11505:1]: file ulimit = 1024 (can be changed with 'ulimit -n') 2005.12.13 09:09:22 LOG6[11505:1]: poll() used - no FD_SETSIZE limit for file descriptors 2005.12.13 09:09:22 LOG5[11505:1]: 500 clients allowed 2005.12.13 09:09:22 LOG7[11505:1]: FD 6 in non-blocking mode 2005.12.13 09:09:22 LOG7[11505:1]: FD 8 in non-blocking mode 2005.12.13 09:09:22 LOG7[11505:1]: FD 9 in non-blocking mode 2005.12.13 09:09:22 LOG7[11505:1]: SO_REUSEADDR option set on accept socket 2005.12.13 09:09:22 LOG7[11505:1]: ssyslog bound to 195.56.52.140:2514 2005.12.13 09:09:22 LOG7[11506:1]: Created pid file /usr/local/etc/stunnel/stunnel.pid 2005.12.13 09:09:22 LOG7[11506:0]: Waiting -1 second(s) for 2 file descriptor(s) 2005.12.13 09:11:23 LOG7[11506:0]: CONTEXT 1, FD=6, (IN)->() 2005.12.13 09:11:23 LOG7[11506:0]: CONTEXT 1, FD=9, (IN)->(IN) 2005.12.13 09:11:23 LOG7[11506:1]: ssyslog accepted FD=10 from 81.183.222.1:35225 2005.12.13 09:11:23 LOG7[11506:1]: Creating a new context 2005.12.13 09:11:23 LOG7[11506:1]: Context 2 created 2005.12.13 09:11:23 LOG7[11506:2]: Context swap: 1 -> 2 2005.12.13 09:11:23 LOG7[11506:2]: ssyslog started 2005.12.13 09:11:23 LOG7[11506:2]: FD 10 in non-blocking mode 2005.12.13 09:11:23 LOG7[11506:2]: TCP_NODELAY option set on local socket 2005.12.13 09:11:23 LOG5[11506:2]: ssyslog connected from 81.183.222.1:35225 2005.12.13 09:11:23 LOG7[11506:2]: SSL state (accept): before/accept initialization 2005.12.13 09:11:23 LOG7[11506:0]: Waiting 300 second(s) for 3 file descriptor(s) 2005.12.13 09:11:23 LOG7[11506:0]: CONTEXT 1, FD=6, (IN)->() 2005.12.13 09:11:23 LOG7[11506:0]: CONTEXT 1, FD=9, (IN)->() 2005.12.13 09:11:23 LOG7[11506:0]: CONTEXT 2, FD=10, (IN)->(IN) 2005.12.13 09:11:23 LOG7[11506:2]: SSL state (accept): SSLv3 read client hello A 2005.12.13 09:11:23 LOG7[11506:2]: SSL state (accept): SSLv3 write server hello A 2005.12.13 09:11:23 LOG7[11506:2]: SSL state (accept): SSLv3 write certificate A 2005.12.13 09:11:23 LOG7[11506:2]: SSL state (accept): SSLv3 write server done A 2005.12.13 09:11:23 LOG7[11506:2]: SSL state (accept): SSLv3 flush data 2005.12.13 09:11:23 LOG7[11506:0]: Waiting 300 second(s) for 3 file descriptor(s) 2005.12.13 09:11:25 LOG7[11506:0]: CONTEXT 1, FD=6, (IN)->() 2005.12.13 09:11:25 LOG7[11506:0]: CONTEXT 1, FD=9, (IN)->() 2005.12.13 09:11:25 LOG7[11506:0]: CONTEXT 2, FD=10, (IN)->(IN) 2005.12.13 09:11:25 LOG7[11506:2]: SSL state (accept): SSLv3 read client key exchange A 2005.12.13 09:11:25 LOG7[11506:2]: SSL state (accept): SSLv3 read finished A 2005.12.13 09:11:25 LOG7[11506:2]: SSL state (accept): SSLv3 write change cipher spec A 2005.12.13 09:11:25 LOG7[11506:2]: SSL state (accept): SSLv3 write finished A 2005.12.13 09:11:25 LOG7[11506:2]: SSL state (accept): SSLv3 flush data 2005.12.13 09:11:25 LOG7[11506:2]: 1 items in the session cache 2005.12.13 09:11:25 LOG7[11506:2]: 0 client connects (SSL_connect()) 2005.12.13 09:11:25 LOG7[11506:2]: 0 client connects that finished 2005.12.13 09:11:25 LOG7[11506:2]: 0 client renegotiatations requested 2005.12.13 09:11:25 LOG7[11506:2]: 1 server connects (SSL_accept()) 2005.12.13 09:11:25 LOG7[11506:2]: 1 server connects that finished 2005.12.13 09:11:25 LOG7[11506:2]: 0 server renegotiatiations requested 2005.12.13 09:11:25 LOG7[11506:2]: 0 session cache hits 2005.12.13 09:11:25 LOG7[11506:2]: 0 session cache misses 2005.12.13 09:11:25 LOG7[11506:2]: 0 session cache timeouts 2005.12.13 09:11:25 LOG6[11506:2]: SSL accepted: new session negotiated 2005.12.13 09:11:25 LOG6[11506:2]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.12.13 09:11:25 LOG7[11506:2]: FD 11 in non-blocking mode 2005.12.13 09:11:25 LOG7[11506:2]: ssyslog connecting 10.10.2.1:25 2005.12.13 09:11:25 LOG7[11506:2]: connect_wait: waiting 10 seconds 2005.12.13 09:11:25 LOG7[11506:0]: Waiting 10 second(s) for 3 file descriptor(s) 2005.12.13 09:11:35 LOG7[11506:0]: CONTEXT 1, FD=6, (IN)->() 2005.12.13 09:11:35 LOG7[11506:0]: CONTEXT 1, FD=9, (IN)->() 2005.12.13 09:11:35 LOG7[11506:0]: CONTEXT 2, FD=11, (INOUT)->() 2005.12.13 09:11:35 LOG6[11506:2]: connect_wait: s_poll_wait timeout 2005.12.13 09:11:35 LOG3[11506:2]: Failed to initialize remote connection 2005.12.13 09:11:35 LOG7[11506:2]: ssyslog finished (0 left) 2005.12.13 09:11:35 LOG5[11506:2]: stack_info: size=65536, current=4204 (6%), maximum=4204 (6%) 2005.12.13 09:11:35 LOG7[11506:2]: Context 2 closed 2005.12.13 09:11:35 LOG7[11506:0]: Waiting -1 second(s) for 2 file descriptor(s) Client: 2005.12.13 09:05:26 LOG5[17901:1]: stunnel 4.14 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7 31 Dec 2002 2005.12.13 09:05:26 LOG7[17901:1]: Snagged 64 random bytes from /root/.rnd 2005.12.13 09:05:26 LOG7[17901:1]: Wrote 1024 new random bytes to /root/.rnd 2005.12.13 09:05:26 LOG7[17901:1]: RAND_status claims sufficient entropy for the PRNG 2005.12.13 09:05:26 LOG6[17901:1]: PRNG seeded successfully 2005.12.13 09:05:26 LOG7[17901:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2005.12.13 09:05:26 LOG7[17901:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2005.12.13 09:05:26 LOG6[17901:1]: file ulimit = 1024 (can be changed with 'ulimit -n') 2005.12.13 09:05:26 LOG6[17901:1]: poll() used - no FD_SETSIZE limit for file descriptors 2005.12.13 09:05:26 LOG5[17901:1]: 500 clients allowed 2005.12.13 09:05:26 LOG7[17901:1]: FD 5 in non-blocking mode 2005.12.13 09:05:26 LOG7[17901:1]: FD 7 in non-blocking mode 2005.12.13 09:05:26 LOG7[17901:1]: FD 8 in non-blocking mode 2005.12.13 09:05:26 LOG7[17901:1]: SO_REUSEADDR option set on accept socket 2005.12.13 09:05:26 LOG7[17901:1]: ssyslog bound to 0.0.0.0:2514 2005.12.13 09:05:26 LOG7[17902:1]: Created pid file /usr/local/etc/stunnel/stunnel.pid 2005.12.13 09:05:26 LOG7[17902:0]: Waiting -1 second(s) for 2 file descriptor(s) 2005.12.13 09:07:03 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->() 2005.12.13 09:07:03 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->(IN) 2005.12.13 09:07:03 LOG7[17902:1]: ssyslog accepted FD=9 from 127.0.0.1:40024 2005.12.13 09:07:03 LOG7[17902:1]: Creating a new context 2005.12.13 09:07:03 LOG7[17902:1]: Context 2 created 2005.12.13 09:07:03 LOG7[17902:2]: Context swap: 1 -> 2 2005.12.13 09:07:03 LOG7[17902:2]: ssyslog started 2005.12.13 09:07:03 LOG7[17902:2]: FD 9 in non-blocking mode 2005.12.13 09:07:03 LOG7[17902:2]: TCP_NODELAY option set on local socket 2005.12.13 09:07:03 LOG5[17902:2]: ssyslog connected from 127.0.0.1:40024 2005.12.13 09:07:03 LOG7[17902:2]: FD 10 in non-blocking mode 2005.12.13 09:07:03 LOG7[17902:2]: ssyslog connecting 195.56.52.140:2514 2005.12.13 09:07:03 LOG7[17902:2]: connect_wait: waiting 10 seconds 2005.12.13 09:07:03 LOG7[17902:0]: Waiting 10 second(s) for 3 file descriptor(s) 2005.12.13 09:07:03 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->() 2005.12.13 09:07:03 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->() 2005.12.13 09:07:03 LOG7[17902:0]: CONTEXT 2, FD=10, (INOUT)->(OUT) 2005.12.13 09:07:03 LOG7[17902:2]: connect_wait: connected 2005.12.13 09:07:03 LOG7[17902:2]: Remote FD=10 initialized 2005.12.13 09:07:03 LOG7[17902:2]: TCP_NODELAY option set on remote socket 2005.12.13 09:07:03 LOG7[17902:2]: SSL state (connect): before/connect initialization 2005.12.13 09:07:03 LOG7[17902:2]: SSL state (connect): SSLv3 write client hello A 2005.12.13 09:07:03 LOG7[17902:0]: Waiting 300 second(s) for 3 file descriptor(s) 2005.12.13 09:07:06 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->() 2005.12.13 09:07:06 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->() 2005.12.13 09:07:06 LOG7[17902:0]: CONTEXT 2, FD=10, (IN)->(IN) 2005.12.13 09:07:06 LOG7[17902:2]: SSL state (connect): SSLv3 read server hello A 2005.12.13 09:07:06 LOG7[17902:2]: SSL state (connect): SSLv3 read server certificate A 2005.12.13 09:07:06 LOG7[17902:2]: SSL state (connect): SSLv3 read server done A 2005.12.13 09:07:06 LOG7[17902:2]: SSL state (connect): SSLv3 write client key exchange A 2005.12.13 09:07:06 LOG7[17902:2]: SSL state (connect): SSLv3 write change cipher spec A 2005.12.13 09:07:06 LOG7[17902:2]: SSL state (connect): SSLv3 write finished A 2005.12.13 09:07:06 LOG7[17902:2]: SSL state (connect): SSLv3 flush data 2005.12.13 09:07:06 LOG7[17902:0]: Waiting 300 second(s) for 3 file descriptor(s) 2005.12.13 09:07:08 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->() 2005.12.13 09:07:08 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->() 2005.12.13 09:07:08 LOG7[17902:0]: CONTEXT 2, FD=10, (IN)->(IN) 2005.12.13 09:07:08 LOG7[17902:2]: SSL state (connect): SSLv3 read finished A 2005.12.13 09:07:08 LOG7[17902:2]: 1 items in the session cache 2005.12.13 09:07:08 LOG7[17902:2]: 1 client connects (SSL_connect()) 2005.12.13 09:07:08 LOG7[17902:2]: 1 client connects that finished 2005.12.13 09:07:08 LOG7[17902:2]: 0 client renegotiatations requested 2005.12.13 09:07:08 LOG7[17902:2]: 0 server connects (SSL_accept()) 2005.12.13 09:07:08 LOG7[17902:2]: 0 server connects that finished 2005.12.13 09:07:08 LOG7[17902:2]: 0 server renegotiatiations requested 2005.12.13 09:07:08 LOG7[17902:2]: 0 session cache hits 2005.12.13 09:07:08 LOG7[17902:2]: 0 session cache misses 2005.12.13 09:07:08 LOG7[17902:2]: 0 session cache timeouts 2005.12.13 09:07:08 LOG6[17902:2]: SSL connected: new session negotiated 2005.12.13 09:07:08 LOG6[17902:2]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.12.13 09:07:08 LOG7[17902:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.12.13 09:07:10 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->() 2005.12.13 09:07:10 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->() 2005.12.13 09:07:10 LOG7[17902:0]: CONTEXT 2, FD=9, (IN)->(IN) 2005.12.13 09:07:10 LOG7[17902:0]: CONTEXT 2, FD=10, (IN)->() 2005.12.13 09:07:10 LOG7[17902:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.12.13 09:07:10 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->() 2005.12.13 09:07:10 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->() 2005.12.13 09:07:10 LOG7[17902:0]: CONTEXT 2, FD=9, (IN)->() 2005.12.13 09:07:10 LOG7[17902:0]: CONTEXT 2, FD=10, (INOUT)->(OUT) 2005.12.13 09:07:10 LOG7[17902:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.12.13 09:07:11 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->() 2005.12.13 09:07:11 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->() 2005.12.13 09:07:11 LOG7[17902:0]: CONTEXT 2, FD=9, (IN)->(IN) 2005.12.13 09:07:11 LOG7[17902:0]: CONTEXT 2, FD=10, (IN)->() 2005.12.13 09:07:11 LOG7[17902:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.12.13 09:07:11 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->() 2005.12.13 09:07:11 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->() 2005.12.13 09:07:11 LOG7[17902:0]: CONTEXT 2, FD=9, (IN)->() 2005.12.13 09:07:11 LOG7[17902:0]: CONTEXT 2, FD=10, (INOUT)->(OUT) 2005.12.13 09:07:11 LOG7[17902:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.12.13 09:07:16 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->() 2005.12.13 09:07:16 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->() 2005.12.13 09:07:16 LOG7[17902:0]: CONTEXT 2, FD=9, (IN)->() 2005.12.13 09:07:16 LOG7[17902:0]: CONTEXT 2, FD=10, (IN)->(INERRHUP) 2005.12.13 09:07:16 LOG3[17902:2]: SSL_read: Connection reset by peer (104) 2005.12.13 09:07:16 LOG5[17902:2]: Connection reset: 4 bytes sent to SSL, 0 bytes sent to socket 2005.12.13 09:07:16 LOG7[17902:2]: ssyslog finished (0 left) 2005.12.13 09:07:16 LOG5[17902:2]: stack_info: size=65536, current=4180 (6%), maximum=4180 (6%) 2005.12.13 09:07:16 LOG7[17902:2]: Context 2 closed 2005.12.13 09:07:16 LOG7[17902:0]: Waiting -1 second(s) for 2 file descriptor(s) Strange thing, i did set up a windows box for testing, and i get the exact same error mesages when trying to connect to the server. Any ideas?

1 0

stunnel closing on first packet
by justin alexander 11 Dec '05

11 Dec '05

I have a client application on a windows machine, which tunnels through stunnel v4.14 to launch and inetd through stunnel v4.09 on a Linux box. The Linux side INETD successfully sends a packet of 25B to the client. The client (windows) receives this packet and returns a 12B packet. The packet IS received by the INETD but then stunnel immediately closes the socket. Why is it doing this? I'm including all configs and longs.

1 0

windows stunnel
by Noel Sanchez 09 Dec '05

09 Dec '05

Hello List. What I'd like to do is use stunnel on a Windows server behind the firewall then forward the data that comes in to the Windows server to another machine (another public ip behind the firewall) that's running an app that needs the original data. For example, I have a device out in the field that is using ssl to send data on port 4000 to my server in the office that has stunnel installed and listens on port 4000. Once the data is sent to the Windows server using stunnel, I'd like the Windows server to send the data to another computer that needs it but that doesn't have stunnel on it. The encryption will happen from the field device to the Windows server in the office, then that Windows server will have to forward the data to another computer that needs the data. I am at a lost on how to do this if at all possible. Any help would be great! Device using ssl out in the field sending data on port 4000---------firewall forwarding traffic from port 4000 to Windows server running stunnel behind firewall-----------Windows server receives stunnel data then forwards to another computer-------system that needs data---- Regards

1 0

Re: Windows config with both SSL listen and non-SSL listen
by Han Jun Li 08 Dec '05

08 Dec '05

Paul, This is a temporary solution but it works. What you need to do is run two instances of Stunnel--one instance configured in client mode and the other in server mode. If you want to run both as services, you can install the standard one with the "-install" switch. For the second instance, you need to use some other binary to install it with a different name and change the imagepath to point to the executable. /han >_____ > >From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] >On Behalf Of Paul Hethmon >Sent: Wednesday, December 07, 2005 2:50 PM >To: stunnel-users(a)mirt.net >Subject: [stunnel-users] Windows config with both SSL listen and >non-SSLlisten > > >I'm trying to set up using the Windows service the ability to listen in SSL >mode on one port (5102) and forward to non-SSL port (5010) and then also >listen on one port (5101) in non-SSL mode and forward to a remote port >(5102) in SSL mode. What I have currently in the config is: > >[inbound] >accept = 5102 >connect = 5010 > >[outbound] >accept = 5101 >connect = x.x.x.x:5102 > >The first STunnel example on the website talks about doing this, sort of, >but I don't see any options to specify on a service configuration level >whether the listen port is in SSL or non-SSL mode. The use of a service name >like [pop3] vs [pop3s] seems to imply a difference, but I've got a custom >application I'm trying to tunnel two way, not a standard IETF service. > >A perusal of the last year's mailing list archives didn't yield anything. I >guess the next step is to look at the source and see if it's supported >unless someone here can tell me one way or the other. If it's not supported, >I guess I'll add it in. > >thanks, > >Paul > > >Paul Hethmon >Senior Engineer >ClareityT Security >SAFEMLST Security Education, Consulting and Solutions >http://www.SAFEMLS.com <http://www.safemls.com/> >paul.hethmon(a)callclareity.com >work: 865.671.6630 >cell: 865.250.3517 > >

1 0

RE: [stunnel-users] Windows config with both SSL listen andnon-SSLlisten
by Paul Hethmon 07 Dec '05

07 Dec '05

Michal, Ok, the next obvious questions then: 1. When is 4.15 expected? 2. If not in the next 7 days, what can I do to help? I've done C/C++ and sockets for the last 10 years. I've looked at the code briefly so far, but have not set up a build environment yet. I need it in the next week so if there is any coding I can do which would help you, let me know your thoughts and where to put stuff. Also, just a public thanks for putting the package together. I started coding my own a couple of days ago and then thought there must have been someone else who just needed an SSL tunnel (and not a full blown SSH setup). Thanks, Paul -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Michal Trojnara Sent: Wednesday, December 07, 2005 9:03 AM To: stunnel-users(a)mirt.net Subject: RE: [stunnel-users] Windows config with both SSL listen andnon-SSLlisten Paul, This feature is going to be supported in the next release (4.15). Your config will look like this: [inbound] client = no accept = 5102 connect = 5010 [outbound] client = yes accept = 5101 connect = x.x.x.x:5102 Best regards, Mike ________________________________ From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Paul Hethmon Sent: Wednesday, December 07, 2005 2:50 PM To: stunnel-users(a)mirt.net Subject: [stunnel-users] Windows config with both SSL listen and non-SSLlisten I'm trying to set up using the Windows service the ability to listen in SSL mode on one port (5102) and forward to non-SSL port (5010) and then also listen on one port (5101) in non-SSL mode and forward to a remote port (5102) in SSL mode. What I have currently in the config is: [inbound] accept = 5102 connect = 5010 [outbound] accept = 5101 connect = x.x.x.x:5102 The first STunnel example on the website talks about doing this, sort of, but I don't see any options to specify on a service configuration level whether the listen port is in SSL or non-SSL mode. The use of a service name like [pop3] vs [pop3s] seems to imply a difference, but I've got a custom application I'm trying to tunnel two way, not a standard IETF service. A perusal of the last year's mailing list archives didn't yield anything. I guess the next step is to look at the source and see if it's supported unless someone here can tell me one way or the other. If it's not supported, I guess I'll add it in. thanks, Paul Paul Hethmon Senior Engineer ClareityT Security SAFEMLST Security Education, Consulting and Solutions http://www.SAFEMLS.com <http://www.safemls.com/> paul.hethmon(a)callclareity.com work: 865.671.6630 cell: 865.250.3517 _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

Windows config with both SSL listen and non-SSL listen
by Paul Hethmon 07 Dec '05

07 Dec '05

I'm trying to set up using the Windows service the ability to listen in SSL mode on one port (5102) and forward to non-SSL port (5010) and then also listen on one port (5101) in non-SSL mode and forward to a remote port (5102) in SSL mode. What I have currently in the config is: [inbound] accept = 5102 connect = 5010 [outbound] accept = 5101 connect = x.x.x.x:5102 The first STunnel example on the website talks about doing this, sort of, but I don't see any options to specify on a service configuration level whether the listen port is in SSL or non-SSL mode. The use of a service name like [pop3] vs [pop3s] seems to imply a difference, but I've got a custom application I'm trying to tunnel two way, not a standard IETF service. A perusal of the last year's mailing list archives didn't yield anything. I guess the next step is to look at the source and see if it's supported unless someone here can tell me one way or the other. If it's not supported, I guess I'll add it in. thanks, Paul Paul Hethmon Senior Engineer Clareity(tm) Security SAFEMLS(tm) Security Education, Consulting and Solutions http://www.SAFEMLS.com <http://www.safemls.com/> paul.hethmon(a)callclareity.com work: 865.671.6630 cell: 865.250.3517

2 1

stunnel install failure
by James.Bartkowicz＠bedbath.com 05 Dec '05

05 Dec '05

Pretty new to stunnel and not very familiar with compiling programs at all: 1. Description: Installation of stunnel 4.14 failing on a Solaris 9 box. #>make Making all in src /bin/bash ../libtool --tag=CC --mode=link gcc -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/local/ssl/include -o libstunnel.la -rpath /usr/local/lib -avoid-version env.lo -lz -ldl -lsocket -lnsl -L/usr/local/ssl/lib -lssl -lcrypto -lwrap gcc -shared -Wl,-h -Wl,libstunnel.so -o .libs/libstunnel.so .libs/env.o -lz -ldl -lsocket -lnsl -L/usr/local/ssl/lib -lssl -lcrypto -lwrap -lc ld: fatal: library -lwrap: not found ld: fatal: File processing errors. No output written to .libs/libstunnel.so collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `libstunnel.la' Current working directory /local1/home/stunnel/stunnel-4.14/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' ******************************************* James Bartkowicz Bed Bath & Beyond Server Administration Team - UNIX 908-688-0888 ext.4441 ******************************************* ------------------------------------------------------ CONFIDENTIALITY NOTICE: This e-mail, and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain confidential information. If you are not the intended recipient of this e-mail, you are hereby notified that any dissemination, distribution or copying of this e-mail, and any attachments thereto, is strictly prohibited. If you have received this e-mail in error, please permanently delete the original and any copy of any e-mail and any printout thereof. Thank you for your compliance.

2 1

Server connecting back to client?
by Joshua Kugler 02 Dec '05

02 Dec '05

I've looked through the man pages, FAQ's, examples, and found one post (without a reply: http://stunnel.mirt.net/pipermail/stunnel-users/2005-May/000487.html) about this, but still don't have my question answered. I have a machine outside the firewall (let's call it outThere) that needs to connect back to a machine inside the firewall (let's call in inHere) for backup procedures. Now, because of the firewall, outThere cannot connect to inHere, but inHere can connect to anything on outThere that it wants. Can I initiate an stunnel connection from inHere to outThere, and then have stunnel on outThere listen on a localhost port, which, when connected to, would actually forward the connection (over SSL) back to a configured port on inHere? Is this at all doable? j----- k----- -- Joshua Kugler CDE System Administrator http://distance.uaf.edu/

2 1

Stunnel sending ICMP packet at startup
by Paul Jones 30 Nov '05

30 Nov '05

Hi there, I have set up Stunnel on both the server and the client. There is a firewall on the server side that only allows TCP connections through. When Stunnel is started up on the client side, the firewall is actually receiving an ICMP packet, not a TCP. Is this how Stunnel should be working? I assume it's doing a ping or something at startup. Thanks in advance. Paul _________________________________________________________________ SEEK: Over 80,000 jobs across all industries at Australia's #1 job site. http://ninemsn.seek.com.au?hotmail

2 1

4th Dimension and Stunnel
by Mark 28 Nov '05

28 Nov '05

Does anyone have a sample config file to allow 4th Dimension client and server to use stunnel?

1 0

How to protect private key in Windows XP Home
by Andrus 28 Nov '05

28 Nov '05

My stunnel client must start without user intervention. So I installed stunnel in client mode in a Windows XP Home computer as XP service. In XP Proffesional I can specify that only Administrators group has access to stunnel directory. XP Home does not have security tab in folder properties. Any person working in XP Home compter can copy stunnel private key How to protect private key from copying ? Andrus. My stunnel.conf file: Cafile=server.crt cert=privkey.pem client = yes service=RDPClient verify = 2 [terminal server] accept = 83389 connect = 1.2.3.4:83389

1 0

socklen_t undeclared
by tc 24 Nov '05

24 Nov '05

Hi, I'm getting socklet_t undeclared in client.c making stunnel4.14 in an embedded linux 2.038 system. What can I do? Thanks TC __________________________________ Meet your soulmate! Yahoo! Asia presents Meetic - where millions of singles gather http://asia.yahoo.com/meetic

2 1

Newbie Question
by Mark 23 Nov '05

23 Nov '05

I am completely new to SSL and stunnel. I need to test the differences between 4th Dimension's SSL and doing the same thing without the 4D implementation of SSL using stunnel. Can anyone please tell me where to get started? Mark Zinke

2 1

Call for Beta Testers: Tool similar to Stunnel.
by Wilfred Nilsen 22 Nov '05

22 Nov '05

We have designed a tool that is similar to Stunnel and we would like to know if anyone would be interested in testing the tool. A short introduction: The Barracuda HTTPS tunnel allows you to encrypt arbitrary TCP connections inside SSL. The HTTPS tunnel allows you to secure non-SSL aware services such as TELNET, FTP, VNC, etc., by having the HTTPS tunnel provide the encryption. The HTTPS tunnel can also be used, for example, to tunnel traffic out from behind a restrictive firewall/proxy that only allows outgoing HTTPS web connections. The client is a Java program that can either be downloaded and started from the command prompt or started using Java Web Start. The server is BarracudaDrive. http://barracudaserver.com/examples/BarracudaDrive/ We will make the beta program (the server and client) available if anyone is interested in testing the tool and give us feedback. We are specifically interested in beta testers that are behind a restrictive company proxy. Thanks, Wilfred

7 10

Re: [stunnel-users] Problem with Stunnel Working fine on the firstconnection and not on subsequent connections
by Kevin A. McGrail 19 Nov '05

19 Nov '05

> I'd try to disable chroot and run stunnel under strace with "foreground = yes" option. Mike, When running in foreground, with or without chroot, things work as expected. Without foreground, it did not work. Two key differences on the logs for each: Output of "Cleaning up the signal pipe" prior to checking the libwrap permissions a finish line of "ssmtp finished (0 left)" instead of "ssmtp finished (-1 left)" (Yes, this is a dual processor box.) It looks like the key problem lies in the regerenation of the standalone mode. Is there a way with v4 to just use inetd to answer on port 465, negotiate and connect on port 25 on another host because perhaps that will avoid the issue. Regards, KAM 2005.11.19 13:07:51 LOG7[3893:1024]: Key file: /usr/local/ssl/certs/stunnel.pem 2005.11.19 13:07:51 LOG6[3893:1024]: file ulimit = 1024 (can be changed with 'ulimit -n') 2005.11.19 13:07:51 LOG6[3893:1024]: poll() used - no FD_SETSIZE limit for file descriptors 2005.11.19 13:07:51 LOG5[3893:1024]: 500 clients allowed 2005.11.19 13:07:51 LOG7[3893:1024]: FD 4 in non-blocking mode 2005.11.19 13:07:51 LOG7[3893:1024]: FD 5 in non-blocking mode 2005.11.19 13:07:51 LOG7[3893:1024]: FD 6 in non-blocking mode 2005.11.19 13:07:51 LOG7[3893:1024]: SO_REUSEADDR option set on accept socket 2005.11.19 13:07:51 LOG7[3893:1024]: ssmtp bound to 0.0.0.0:465 2005.11.19 13:07:51 LOG7[3893:1024]: Created pid file /stunnel.pid [ed: 1st email] 2005.11.19 13:08:32 LOG7[3893:1024]: ssmtp accepted FD=7 from 66.149.103.32:3130 2005.11.19 13:08:32 LOG7[3898:1026]: ssmtp started 2005.11.19 13:08:32 LOG7[3898:1026]: FD 7 in non-blocking mode 2005.11.19 13:08:32 LOG7[3898:1026]: TCP_NODELAY option set on local socket 2005.11.19 13:08:32 LOG7[3898:1026]: FD 10 in non-blocking mode 2005.11.19 13:08:32 LOG7[3898:1026]: FD 11 in non-blocking mode 2005.11.19 13:08:32 LOG7[3893:1024]: Cleaning up the signal pipe 2005.11.19 13:08:32 LOG7[3898:1026]: Connection from 66.149.103.32:3130 permitted by libwrap 2005.11.19 13:08:32 LOG5[3898:1026]: ssmtp connected from 66.149.103.32:3130 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): before/accept initialization 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 read client hello A 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 write server hello A 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 write certificate A 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 write server done A 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 flush data 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 read client key exchange A 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 read finished A 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 write change cipher spec A 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 write finished A 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 flush data 2005.11.19 13:08:32 LOG7[3898:1026]: 1 items in the session cache 2005.11.19 13:08:32 LOG7[3898:1026]: 0 client connects (SSL_connect()) 2005.11.19 13:08:32 LOG7[3898:1026]: 0 client connects that finished 2005.11.19 13:08:32 LOG7[3898:1026]: 0 client renegotiatations requested 2005.11.19 13:08:32 LOG7[3898:1026]: 1 server connects (SSL_accept()) 2005.11.19 13:08:32 LOG7[3898:1026]: 1 server connects that finished 2005.11.19 13:08:32 LOG7[3898:1026]: 0 server renegotiatiations requested 2005.11.19 13:08:32 LOG7[3898:1026]: 0 session cache hits 2005.11.19 13:08:32 LOG7[3898:1026]: 1 session cache misses 2005.11.19 13:08:32 LOG7[3898:1026]: 0 session cache timeouts 2005.11.19 13:08:32 LOG6[3898:1026]: SSL accepted: new session negotiated 2005.11.19 13:08:32 LOG6[3898:1026]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2005.11.19 13:08:32 LOG7[3898:1026]: FD 10 in non-blocking mode 2005.11.19 13:08:32 LOG7[3898:1026]: ssmtp connecting 10.10.10.30:25 2005.11.19 13:08:32 LOG7[3898:1026]: connect_wait: waiting 10 seconds 2005.11.19 13:08:32 LOG7[3898:1026]: connect_wait: connected 2005.11.19 13:08:32 LOG7[3898:1026]: Remote FD=10 initialized 2005.11.19 13:08:32 LOG7[3898:1026]: TCP_NODELAY option set on remote socket 2005.11.19 13:08:33 LOG7[3898:1026]: Socket closed on read 2005.11.19 13:08:33 LOG7[3898:1026]: SSL write shutdown 2005.11.19 13:08:33 LOG7[3898:1026]: SSL alert (write): warning: close notify 2005.11.19 13:08:33 LOG7[3898:1026]: SSL_shutdown retrying 2005.11.19 13:08:33 LOG7[3898:1026]: SSL doesn't need to read or write 2005.11.19 13:08:33 LOG7[3898:1026]: SSL socket closed on SSL_read 2005.11.19 13:08:33 LOG7[3898:1026]: Socket write shutdown 2005.11.19 13:08:33 LOG5[3898:1026]: Connection closed: 834 bytes sent to SSL, 1358 bytes sent to socket 2005.11.19 13:08:33 LOG7[3898:1026]: ssmtp finished (0 left) [ed: 2nd email] 2005.11.19 13:08:40 LOG7[3893:1024]: ssmtp accepted FD=7 from 66.149.103.32:3137 2005.11.19 13:08:40 LOG7[3900:2050]: ssmtp started 2005.11.19 13:08:40 LOG7[3900:2050]: FD 7 in non-blocking mode 2005.11.19 13:08:40 LOG7[3900:2050]: TCP_NODELAY option set on local socket 2005.11.19 13:08:40 LOG7[3900:2050]: FD 10 in non-blocking mode 2005.11.19 13:08:40 LOG7[3900:2050]: FD 11 in non-blocking mode 2005.11.19 13:08:40 LOG7[3893:1024]: Cleaning up the signal pipe 2005.11.19 13:08:40 LOG7[3900:2050]: Connection from 66.149.103.32:3137 permitted by libwrap 2005.11.19 13:08:40 LOG5[3900:2050]: ssmtp connected from 66.149.103.32:3137 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): before/accept initialization 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 read client hello A 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 write server hello A 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 write certificate A 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 write server done A 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 flush data 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 read client key exchange A 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 read finished A 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 write change cipher spec A 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 write finished A 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 flush data 2005.11.19 13:08:40 LOG7[3900:2050]: 2 items in the session cache 2005.11.19 13:08:40 LOG7[3900:2050]: 0 client connects (SSL_connect()) 2005.11.19 13:08:40 LOG7[3900:2050]: 0 client connects that finished 2005.11.19 13:08:40 LOG7[3900:2050]: 0 client renegotiatations requested 2005.11.19 13:08:40 LOG7[3900:2050]: 2 server connects (SSL_accept()) 2005.11.19 13:08:40 LOG7[3900:2050]: 2 server connects that finished 2005.11.19 13:08:40 LOG7[3900:2050]: 0 server renegotiatiations requested 2005.11.19 13:08:40 LOG7[3900:2050]: 0 session cache hits 2005.11.19 13:08:40 LOG7[3900:2050]: 2 session cache misses 2005.11.19 13:08:40 LOG7[3900:2050]: 0 session cache timeouts 2005.11.19 13:08:40 LOG6[3900:2050]: SSL accepted: new session negotiated 2005.11.19 13:08:40 LOG6[3900:2050]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2005.11.19 13:08:40 LOG7[3900:2050]: FD 10 in non-blocking mode 2005.11.19 13:08:40 LOG7[3900:2050]: ssmtp connecting 10.10.10.30:25 2005.11.19 13:08:40 LOG7[3900:2050]: connect_wait: waiting 10 seconds 2005.11.19 13:08:40 LOG7[3900:2050]: connect_wait: connected 2005.11.19 13:08:40 LOG7[3900:2050]: Remote FD=10 initialized 2005.11.19 13:08:40 LOG7[3900:2050]: TCP_NODELAY option set on remote socket 2005.11.19 13:08:42 LOG7[3900:2050]: Socket closed on read 2005.11.19 13:08:42 LOG7[3900:2050]: SSL write shutdown 2005.11.19 13:08:42 LOG7[3900:2050]: SSL alert (write): warning: close notify 2005.11.19 13:08:42 LOG7[3900:2050]: SSL_shutdown retrying 2005.11.19 13:08:42 LOG7[3900:2050]: SSL doesn't need to read or write 2005.11.19 13:08:42 LOG7[3900:2050]: SSL socket closed on SSL_read 2005.11.19 13:08:42 LOG7[3900:2050]: Socket write shutdown 2005.11.19 13:08:42 LOG5[3900:2050]: Connection closed: 834 bytes sent to SSL, 1358 bytes sent to socket 2005.11.19 13:08:42 LOG7[3900:2050]: ssmtp finished (0 left) Without foreground, things do not continue past the first connection: 2005.11.19 13:10:32 LOG7[3910:1024]: ssmtp accepted FD=7 from 66.149.103.32:3268 2005.11.19 13:10:32 LOG7[3916:1026]: ssmtp started 2005.11.19 13:10:32 LOG7[3916:1026]: FD 7 in non-blocking mode 2005.11.19 13:10:32 LOG7[3916:1026]: TCP_NODELAY option set on local socket 2005.11.19 13:10:32 LOG7[3916:1026]: FD 10 in non-blocking mode 2005.11.19 13:10:32 LOG7[3916:1026]: FD 11 in non-blocking mode 2005.11.19 13:10:32 LOG7[3916:1026]: Connection from 66.149.103.32:3268 permitted by libwrap 2005.11.19 13:10:32 LOG5[3916:1026]: ssmtp connected from 66.149.103.32:3268 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): before/accept initialization 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 read client hello A 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 write server hello A 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 write certificate A 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 write server done A 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 flush data 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 read client key exchange A 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 read finished A 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 write change cipher spec A 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 write finished A 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 flush data 2005.11.19 13:10:32 LOG7[3916:1026]: 1 items in the session cache 2005.11.19 13:10:32 LOG7[3916:1026]: 0 client connects (SSL_connect()) 2005.11.19 13:10:32 LOG7[3916:1026]: 0 client connects that finished 2005.11.19 13:10:32 LOG7[3916:1026]: 0 client renegotiatations requested 2005.11.19 13:10:32 LOG7[3916:1026]: 1 server connects (SSL_accept()) 2005.11.19 13:10:32 LOG7[3916:1026]: 1 server connects that finished 2005.11.19 13:10:32 LOG7[3916:1026]: 0 server renegotiatiations requested 2005.11.19 13:10:32 LOG7[3916:1026]: 0 session cache hits 2005.11.19 13:10:32 LOG7[3916:1026]: 1 session cache misses 2005.11.19 13:10:32 LOG7[3916:1026]: 0 session cache timeouts 2005.11.19 13:10:32 LOG6[3916:1026]: SSL accepted: new session negotiated 2005.11.19 13:10:32 LOG6[3916:1026]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2005.11.19 13:10:32 LOG7[3916:1026]: FD 10 in non-blocking mode 2005.11.19 13:10:32 LOG7[3916:1026]: ssmtp connecting 10.10.10.30:25 2005.11.19 13:10:32 LOG7[3916:1026]: connect_wait: waiting 10 seconds 2005.11.19 13:10:32 LOG7[3916:1026]: connect_wait: connected 2005.11.19 13:10:32 LOG7[3916:1026]: Remote FD=10 initialized 2005.11.19 13:10:32 LOG7[3916:1026]: TCP_NODELAY option set on remote socket 2005.11.19 13:10:33 LOG7[3916:1026]: Socket closed on read 2005.11.19 13:10:33 LOG7[3916:1026]: SSL write shutdown 2005.11.19 13:10:33 LOG7[3916:1026]: SSL alert (write): warning: close notify 2005.11.19 13:10:33 LOG7[3916:1026]: SSL_shutdown retrying 2005.11.19 13:10:33 LOG7[3916:1026]: SSL doesn't need to read or write 2005.11.19 13:10:34 LOG7[3916:1026]: SSL socket closed on SSL_read 2005.11.19 13:10:34 LOG7[3916:1026]: Socket write shutdown 2005.11.19 13:10:34 LOG5[3916:1026]: Connection closed: 834 bytes sent to SSL, 1353 bytes sent to socket 2005.11.19 13:10:34 LOG7[3916:1026]: ssmtp finished (-1 left)

1 0

Problem with Stunnel Working fine on the first connection and not on subsequent connections
by Kevin A. McGrail 19 Nov '05

19 Nov '05

Have worked on this all day without any glimmer of hope and would appreciate help and feedback! Regards, KAM # Description of your problem. What programs are on which machines, and how are they attempting to communicate. What connections are you attempting to secure in SSL. I am having problems with the regeneration of stunnel on an old but fairly reliable machine. I am switching from v3 to v4 and it works absolutely perfectly ONCE. The second time it just hangs. # What version of Stunnel you're using - remember, Stunnel 4.x doesn't take Stunnel 3.x command line options! 4.x # The list of parameters you are using for stunnel, and if you are running it standalone or from inetd/xinetd. I am running it in standalone. My conf file is: cert = /usr/local/ssl/certs/stunnel.pem key = /usr/local/ssl/certs/stunnel.pem chroot = /usr/local/var/stunnel/ setuid = nobody setgid = nobody pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = stunnel.log [ssmtp] accept = 465 connect = 10.10.10.30:25 # Output of "stunnel -f -D 7 <your-parameters>". Not sure this works on v4.X but here are the logs from the connection: 2005.11.18 19:17:56 LOG7[13166:1024]: ssmtp accepted FD=7 from 66.149.103.32:3542 2005.11.18 19:17:56 LOG7[13171:1026]: ssmtp started 2005.11.18 19:17:56 LOG7[13171:1026]: FD 7 in non-blocking mode 2005.11.18 19:17:56 LOG7[13171:1026]: TCP_NODELAY option set on local socket 2005.11.18 19:17:56 LOG7[13171:1026]: FD 10 in non-blocking mode 2005.11.18 19:17:56 LOG7[13171:1026]: FD 11 in non-blocking mode 2005.11.18 19:17:56 LOG7[13171:1026]: Connection from 66.149.103.32:3542 permitted by libwrap 2005.11.18 19:17:56 LOG5[13171:1026]: ssmtp connected from 66.149.103.32:3542 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): before/accept initialization 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 read client hello A 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 write server hello A 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 write certificate A 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 write server done A 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 flush data 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 read client key exchange A 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 read finished A 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 write change cipher spec A 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 write finished A 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 flush data 2005.11.18 19:17:56 LOG7[13171:1026]: 1 items in the session cache 2005.11.18 19:17:56 LOG7[13171:1026]: 0 client connects (SSL_connect()) 2005.11.18 19:17:56 LOG7[13171:1026]: 0 client connects that finished 2005.11.18 19:17:56 LOG7[13171:1026]: 0 client renegotiatations requested 2005.11.18 19:17:56 LOG7[13171:1026]: 1 server connects (SSL_accept()) 2005.11.18 19:17:56 LOG7[13171:1026]: 1 server connects that finished 2005.11.18 19:17:56 LOG7[13171:1026]: 0 server renegotiatiations requested 2005.11.18 19:17:56 LOG7[13171:1026]: 0 session cache hits 2005.11.18 19:17:56 LOG7[13171:1026]: 1 session cache misses 2005.11.18 19:17:56 LOG7[13171:1026]: 0 session cache timeouts 2005.11.18 19:17:56 LOG6[13171:1026]: SSL accepted: new session negotiated 2005.11.18 19:17:56 LOG6[13171:1026]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2005.11.18 19:17:56 LOG7[13171:1026]: FD 10 in non-blocking mode 2005.11.18 19:17:56 LOG7[13171:1026]: ssmtp connecting 10.10.10.30:25 2005.11.18 19:17:56 LOG7[13171:1026]: connect_wait: waiting 10 seconds 2005.11.18 19:17:56 LOG7[13171:1026]: connect_wait: connected 2005.11.18 19:17:56 LOG7[13171:1026]: Remote FD=10 initialized 2005.11.18 19:17:56 LOG7[13171:1026]: TCP_NODELAY option set on remote socket 2005.11.18 19:17:58 LOG7[13171:1026]: Socket closed on read 2005.11.18 19:17:58 LOG7[13171:1026]: SSL write shutdown 2005.11.18 19:17:58 LOG7[13171:1026]: SSL alert (write): warning: close notify 2005.11.18 19:17:58 LOG7[13171:1026]: SSL_shutdown retrying 2005.11.18 19:17:58 LOG7[13171:1026]: SSL doesn't need to read or write 2005.11.18 19:17:58 LOG7[13171:1026]: SSL socket closed on SSL_read 2005.11.18 19:17:58 LOG7[13171:1026]: Socket write shutdown 2005.11.18 19:17:58 LOG5[13171:1026]: Connection closed: 827 bytes sent to SSL, 1362 bytes sent to socket 2005.11.18 19:17:58 LOG7[13171:1026]: ssmtp finished (-1 left) There is nothing more after this point # Output of "stunnel -V". I think you want -version: /usr/local/sbin/stunnel -version stunnel 4.14 on i686-pc-linux-gnu PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 Global options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /usr/local/etc/stunnel/stunnel.pem pid = /usr/local/var/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds # Output of "uname -a". Linux <removed> 2.2.26 #8 Fri Jul 16 00:42:34 EDT 2004 i686 unknown # Your libc version if you use Linux. 2.2.5 # Output of "gcc -v". Reading specs from /usr/lib/gcc-lib/i386-redhat-linux/egcs-2.91.66/specs gcc version egcs-2.91.66 19990314/Linux (egcs-1.1.2 release) # Output of "openssl version" or "ssleay version" depending on your library. Subscribe to stunnel-users. OpenSSL 0.9.7e 25 Oct 2004

2 1

Stunnel Session Hangs
by Zachariah K Zachariah 17 Nov '05

17 Nov '05

Hi folks, I use stunnel-4.12 with openssl-0.9.7g to tunnel my CVS-pserver protocols. I have set up the local stunnel client to listen to port 22400 and to forward any connections on it to the cvs server that has the server side stunnel listening on port 22401 forwarding connections to the cvs-pserver on port 2401. Having set up thus, I can do a cvs login just fine. I can watch the negotiation happening using tcpdump. However when I try to check out a module from the repository, I see some files coming through but only to eventually hang. If I <Ctrl C> and try again, more files come in but hangs before the transaction is complete. I have to do this several time in order to download all the files to my local workspace. Upon checking the logs, I find that the hang occurs immediately after the message: 2005.10.28 14:21:53 LOG7[15095:67]: SSL_read returned WANT_READ: retrying 2005.10.28 14:21:53 LOG7[15095:67]: SSL_write returned WANT_WRITE: retrying 2005.10.28 14:21:53 LOG7[15095:67]: SSL_read returned WANT_READ: retrying I have included a snippet of the log file for reference. I have also included my stunnel.conf file. Sorry for the voluminous output. Can some one help me here? Thanks in advance. -ZZ ===============================STUNNEL.LOG================================== The full log file reads: 2005.10.28 14:20:44 LOG6[15095:64]: SSL accepted: previous session reused 2005.10.28 14:20:44 LOG7[15095:64]: FD 1 in non-blocking mode 2005.10.28 14:20:44 LOG7[15095:64]: smd-pserver connecting 127.0.0.1:2401 2005.10.28 14:20:44 LOG7[15095:64]: Remote FD=1 initialized 2005.10.28 14:20:44 LOG7[15095:64]: SSL_read returned WANT_READ: retrying 2005.10.28 14:20:44 LOG7[15095:64]: SSL_write returned WANT_WRITE: retrying 2005.10.28 14:20:44 LOG7[15095:64]: SSL_read returned WANT_READ: retrying 2005.10.28 14:20:50 LOG7[15095:64]: SSL alert (read): warning: close notify 2005.10.28 14:20:50 LOG7[15095:64]: SSL closed on SSL_read 2005.10.28 14:20:50 LOG7[15095:64]: Socket write shutdown 2005.10.28 14:20:50 LOG7[15095:64]: SSL write shutdown 2005.10.28 14:20:50 LOG7[15095:64]: SSL alert (write): warning: close notify 2005.10.28 14:20:50 LOG6[15095:64]: SSL_shutdown successfully sent close_notify 2005.10.28 14:20:50 LOG5[15095:64]: Connection closed: 73224 bytes sent to SSL, 4724 bytes sent to socket 2005.10.28 14:20:50 LOG7[15095:64]: smd-pserver finished (0 left) 2005.10.28 14:20:50 LOG5[15095:64]: stack_info: size=65536, current=5004 (7%), maximum=5004 (7%) 2005.10.28 14:20:50 LOG7[15095:64]: Context 64 closed 2005.10.28 14:20:51 LOG7[15095:1]: Context set: 64 (dropped) -> 1 2005.10.28 14:20:51 LOG7[15095:1]: Current context: 1 2005.10.28 14:20:51 LOG7[15095:1]: Releasing context 64 2005.10.28 14:20:51 LOG7[15095:1]: smd-pserver accepted FD=0 from 171.65.79.143:65521 2005.10.28 14:20:51 LOG7[15095:1]: Creating a new context 2005.10.28 14:20:51 LOG7[15095:1]: Context 65 created 2005.10.28 14:20:51 LOG7[15095:65]: Context swap: 1 -> 65 2005.10.28 14:20:51 LOG7[15095:65]: smd-pserver started 2005.10.28 14:20:51 LOG7[15095:65]: FD 0 in non-blocking mode 2005.10.28 14:20:51 LOG5[15095:65]: smd-pserver connected from 171.65.79.143:65521 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): before/accept initialization 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 read client hello A 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 write server hello A 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 write change cipher spec A 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 write finished A 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 flush data 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 read finished A 2005.10.28 14:20:51 LOG7[15095:65]: 6 items in the session cache 2005.10.28 14:20:51 LOG7[15095:65]: 0 client connects (SSL_connect()) 2005.10.28 14:20:51 LOG7[15095:65]: 0 client connects that finished 2005.10.28 14:20:51 LOG7[15095:65]: 0 client renegotiatations requested 2005.10.28 14:20:51 LOG7[15095:65]: 64 server connects (SSL_accept()) 2005.10.28 14:20:51 LOG7[15095:65]: 55 server connects that finished 2005.10.28 14:20:51 LOG7[15095:65]: 0 server renegotiatiations requested 2005.10.28 14:20:51 LOG7[15095:65]: 38 session cache hits 2005.10.28 14:20:51 LOG7[15095:65]: 0 session cache misses 2005.10.28 14:20:51 LOG7[15095:65]: 11 session cache timeouts 2005.10.28 14:20:51 LOG6[15095:65]: SSL accepted: previous session reused 2005.10.28 14:20:51 LOG7[15095:65]: FD 1 in non-blocking mode 2005.10.28 14:20:51 LOG7[15095:65]: smd-pserver connecting 127.0.0.1:2401 2005.10.28 14:20:51 LOG7[15095:65]: Remote FD=1 initialized 2005.10.28 14:20:51 LOG7[15095:65]: SSL_read returned WANT_READ: retrying 2005.10.28 14:20:51 LOG7[15095:65]: SSL_write returned WANT_WRITE: retrying 2005.10.28 14:20:51 LOG7[15095:65]: SSL_read returned WANT_READ: retrying 2005.10.28 14:20:57 LOG7[15095:65]: SSL alert (read): warning: close notify 2005.10.28 14:20:57 LOG7[15095:65]: SSL closed on SSL_read 2005.10.28 14:20:57 LOG7[15095:65]: Socket write shutdown 2005.10.28 14:20:57 LOG7[15095:65]: SSL write shutdown 2005.10.28 14:20:57 LOG7[15095:65]: SSL alert (write): warning: close notify 2005.10.28 14:20:57 LOG6[15095:65]: SSL_shutdown successfully sent close_notify 2005.10.28 14:20:57 LOG5[15095:65]: Connection closed: 73224 bytes sent to SSL, 4724 bytes sent to socket 2005.10.28 14:20:57 LOG7[15095:65]: smd-pserver finished (0 left) 2005.10.28 14:20:57 LOG5[15095:65]: stack_info: size=65536, current=5004 (7%), maximum=5004 (7%) 2005.10.28 14:20:57 LOG7[15095:65]: Context 65 closed 2005.10.28 14:20:58 LOG7[15095:1]: Context set: 65 (dropped) -> 1 2005.10.28 14:20:58 LOG7[15095:1]: Current context: 1 2005.10.28 14:20:58 LOG7[15095:1]: Releasing context 65 2005.10.28 14:20:58 LOG7[15095:1]: smd-pserver accepted FD=0 from 171.65.79.143:65523 2005.10.28 14:20:58 LOG7[15095:1]: Creating a new context 2005.10.28 14:20:58 LOG7[15095:1]: Context 66 created 2005.10.28 14:20:58 LOG7[15095:66]: Context swap: 1 -> 66 2005.10.28 14:20:58 LOG7[15095:66]: smd-pserver started 2005.10.28 14:20:58 LOG7[15095:66]: FD 0 in non-blocking mode 2005.10.28 14:20:58 LOG5[15095:66]: smd-pserver connected from 171.65.79.143:65523 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): before/accept initialization 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 read client hello A 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 write server hello A 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 write change cipher spec A 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 write finished A 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 flush data 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 read finished A 2005.10.28 14:20:58 LOG7[15095:66]: 6 items in the session cache 2005.10.28 14:20:58 LOG7[15095:66]: 0 client connects (SSL_connect()) 2005.10.28 14:20:58 LOG7[15095:66]: 0 client connects that finished 2005.10.28 14:20:58 LOG7[15095:66]: 0 client renegotiatations requested 2005.10.28 14:20:58 LOG7[15095:66]: 65 server connects (SSL_accept()) 2005.10.28 14:20:58 LOG7[15095:66]: 56 server connects that finished 2005.10.28 14:20:58 LOG7[15095:66]: 0 server renegotiatiations requested 2005.10.28 14:20:58 LOG7[15095:66]: 39 session cache hits 2005.10.28 14:20:58 LOG7[15095:66]: 0 session cache misses 2005.10.28 14:20:58 LOG7[15095:66]: 11 session cache timeouts 2005.10.28 14:20:58 LOG6[15095:66]: SSL accepted: previous session reused 2005.10.28 14:20:58 LOG7[15095:66]: FD 1 in non-blocking mode 2005.10.28 14:20:58 LOG7[15095:66]: smd-pserver connecting 127.0.0.1:2401 2005.10.28 14:20:58 LOG7[15095:66]: Remote FD=1 initialized 2005.10.28 14:20:58 LOG7[15095:66]: SSL_read returned WANT_READ: retrying 2005.10.28 14:20:58 LOG7[15095:66]: SSL_write returned WANT_WRITE: retrying 2005.10.28 14:20:58 LOG7[15095:66]: SSL_read returned WANT_READ: retrying 2005.10.28 14:21:50 LOG7[15095:66]: SSL alert (read): warning: close notify 2005.10.28 14:21:50 LOG7[15095:66]: SSL closed on SSL_read 2005.10.28 14:21:50 LOG7[15095:66]: Socket write shutdown 2005.10.28 14:21:50 LOG7[15095:66]: SSL write shutdown 2005.10.28 14:21:50 LOG7[15095:66]: SSL alert (write): warning: close notify 2005.10.28 14:21:50 LOG6[15095:66]: SSL_shutdown successfully sent close_notify 2005.10.28 14:21:50 LOG5[15095:66]: Connection closed: 73224 bytes sent to SSL, 4724 bytes sent to socket 2005.10.28 14:21:50 LOG7[15095:66]: smd-pserver finished (0 left) 2005.10.28 14:21:50 LOG5[15095:66]: stack_info: size=65536, current=5004 (7%), maximum=5004 (7%) 2005.10.28 14:21:50 LOG7[15095:66]: Context 66 closed 2005.10.28 14:21:52 LOG7[15095:1]: Context set: 66 (dropped) -> 1 2005.10.28 14:21:52 LOG7[15095:1]: Current context: 1 2005.10.28 14:21:52 LOG7[15095:1]: Releasing context 66 2005.10.28 14:21:52 LOG7[15095:1]: smd-pserver accepted FD=0 from 171.65.79.143:65525 2005.10.28 14:21:52 LOG7[15095:1]: Creating a new context 2005.10.28 14:21:52 LOG7[15095:1]: Context 67 created 2005.10.28 14:21:52 LOG7[15095:67]: Context swap: 1 -> 67 2005.10.28 14:21:52 LOG7[15095:67]: smd-pserver started 2005.10.28 14:21:52 LOG7[15095:67]: FD 0 in non-blocking mode 2005.10.28 14:21:52 LOG5[15095:67]: smd-pserver connected from 171.65.79.143:65525 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): before/accept initialization 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 read client hello A 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 write server hello A 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 write change cipher spec A 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 write finished A 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 flush data 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 read finished A 2005.10.28 14:21:52 LOG7[15095:67]: 6 items in the session cache 2005.10.28 14:21:52 LOG7[15095:67]: 0 client connects (SSL_connect()) 2005.10.28 14:21:52 LOG7[15095:67]: 0 client connects that finished 2005.10.28 14:21:52 LOG7[15095:67]: 0 client renegotiatations requested 2005.10.28 14:21:52 LOG7[15095:67]: 66 server connects (SSL_accept()) 2005.10.28 14:21:52 LOG7[15095:67]: 57 server connects that finished 2005.10.28 14:21:52 LOG7[15095:67]: 0 server renegotiatiations requested 2005.10.28 14:21:52 LOG7[15095:67]: 40 session cache hits 2005.10.28 14:21:52 LOG7[15095:67]: 0 session cache misses 2005.10.28 14:21:52 LOG7[15095:67]: 11 session cache timeouts 2005.10.28 14:21:52 LOG6[15095:67]: SSL accepted: previous session reused 2005.10.28 14:21:52 LOG7[15095:67]: FD 1 in non-blocking mode 2005.10.28 14:21:52 LOG7[15095:67]: smd-pserver connecting 127.0.0.1:2401 2005.10.28 14:21:52 LOG7[15095:67]: Remote FD=1 initialized 2005.10.28 14:21:53 LOG7[15095:67]: SSL_read returned WANT_READ: retrying 2005.10.28 14:21:53 LOG7[15095:67]: SSL_write returned WANT_WRITE: retrying 2005.10.28 14:21:53 LOG7[15095:67]: SSL_read returned WANT_READ: retrying ========================================================================== =========================STUNNEL.CONF====================================== ; Sample stunnel configuration file by Michal Trojnara 2002-2005 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ;Delay DNS Lookups delay = yes ; Certificate/key is needed in server mode and optional in client mode cert = /tools/stunnel/4.12/etc/stunnel/stunnel.pem ;key = /tools/stunnel/4.12/etc/stunnel/mail.pem ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /tools/stunnel/4.12/var/stunnel/ setuid = cvsadmin setgid = cvs ; PID is created inside chroot jail pid = /stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath; CApath is located inside chroot jail: ;CApath = /certs ; It's often easier to use CAfile: ;CAfile = /tools/stunnel/4.12/etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath; CRLpath is located inside chroot jail: ;CRLpath = /crls ; Alternatively you can use CRLfile: ;CRLfile = /tools/stunnel/4.12/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = /tools/stunnel/current/var/stunnel/stunnel.log ; Use it for client mode ;client = yes ; Service-level configuration ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 [pserver] accept = 22401 connect = 2401 TIMEOUTclose = 30 ; vim:ft=dosini

3 3

Strict.pm
by Jorge Abrines 17 Nov '05

17 Nov '05

Hi all, Once installed stunnel4 debian package, when I execute stunnel stunnel-mysql-client.conf (given sample) get following errors: Can't locate strict.pm in @INC (@INC contains: /etc/perl /usr/local/lib/perl/5.8.7 /usr/local/share/perl/5.8.7 /usr/lib/perl5 /usr/share/perl5 /usr/lib/perl/5.8 /usr/share/perl/5.8 /usr/local/lib/site_perl .) at /usr/share/perl/5.8/AutoLoader.pm line 3. BEGIN failed--compilation aborted at /usr/share/perl/5.8/AutoLoader.pm line 3. Compilation failed in require at /usr/lib/perl/5.8/POSIX.pm line 7. BEGIN failed--compilation aborted at /usr/lib/perl/5.8/POSIX.pm line 7. Compilation failed in require at /usr/sbin/stunnel line 26. BEGIN failed--compilation aborted at /usr/sbin/stunnel line 26. Any ideas? Thanks in advance. Regards, Jorge.

2 2

Filesystem Hierarchy Standard 2.3
by Michal Trojnara 17 Nov '05

17 Nov '05

Dear Users, I tried to make stunnel more compatible with Filesystem Hierarchy Standard 2.3. Here is the current status: - configuration and certificates are in $prefix/etc/stunnel/ - binaries are in $prefix/sbin/ - default pid file is $prefix/var/run/stunnel.pid - manual is $prefix/man/man8/stunnel.8 - other docs are in $prefix/share/doc/stunnel/ - libstunnel is in $prefix/lib - chroot directory is setup in $prefix/var/lib/stunnel/ this directory is chmoded 1770 and group nogroup Your critical comments are welcome. Best regards, Mike

1 0

Visual studio compilation errors
by Jorge Abrines 17 Nov '05

17 Nov '05

Hi, After browsing all previous list messages I havent found information about an error I get compiling stunnel with visual studio. The errors appear in linking step with undefined symbol message: "undefined symbol: LNK2019 undefined symbol _exit_stunnel referenced in function _main_initialize". I also attach the Makefile.w32 changed to work with visual studio. Thanks in advance. Regards, Jorge. Makefile.w32 follows: # Simple Makefile.w32 for stunnel.exe by Michal Trojnara 1998-2000 # # Modified by Brian Hatch (bri(a)stunnel.org) # This makefile is only tested on the mingw compiler. Mingw # can successfully compile both openssl and stunnel. If you want # to use another compiler, give it a shot, and tell us how it went. # Modify this to point to your actual openssl compile directory # (You did already compile openssl, didn't you???) SSLDIR=..\..\openssl-0.9.7g DEFINES=-DUSE_WIN32 -DHAVE_OPENSSL # You may want to add some of the following flags # to the DEFINES definition above. # Location of default certificate file for -v option # -DCERT_FILE=\"/stunnel/certs/certs.pem\" # Location of default certificate directory for -v option # -DCERT_DIR=\"/stunnel/certs\" # Default directory for stunnel.pem file # -DPEM_DIR=\"/stunnel/private\" # Use the default certificate sources from your ssl library? (0==no, 1==yes) # -DSSLLIB_CS=0 CC=cl CFLAGS= $(DEFINES) /I"$(SSLDIR)inc32" LDFLAGS=/LIBPATH:"$(SSLDIR)\out" /LIBPATH:"$(SSLDIR)\out32dll" # LIBS=-L$(SSLDIR)/out -lssl -lcrypto -lwsock32 -lgdi32 # LIBS=-L$(SSLDIR)/out -leay32 -lssl32 -lwsock32 -lgdi32 LIBS="$(SSLDIR)\out32dll\libeay32.lib" "$(SSLDIR)\out32dll\ssleay32.lib" " wsock32.lib" "gdi32.lib" OBJS=stunnel.obj ssl.obj protocol.obj sthreads.obj log.obj stunnel.exe: $(OBJS) $(CC) $(LDFLAGS) -o stunnel.exe $(OBJS) $(LIBS) .c.obj: # {.}.c{_obj\}.obj:: $(CC) /c $(CFLAGS) $(INCPATH) @<< $< << clean: del *.o del stunnel.exe

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users