- stunnel-users - stunnel.org

Stunnel 4.09 released
by Michal Trojnara 26 Mar '05

26 Mar '05

New stunnel 4.09 can be found on my FTP site: ftp://stunnel.mirt.net/stunnel/ Here is the ChangeLog entry: * DLLs for OpenSSL 0.9.7f. * Bugfixes - Compilation problem with undeclarated socklen_t fixed. - TIMEOUTclose is not used when there is any data in the buffers. - Stunnel no longer relies on close_notify with SSL 2.0 connections, since SSL 2.0 protocol does not have any alerts defined. - Closing SSL socket when there is some data in SSL output buffer is detected and reported as an error. - Install/chmod race condition when installing default certificate fixed. - Stunnel no longer installs signal_handler on ignored signals. Best regards, Mike

1 0

help
by Maddalena.Pulcini＠seleniacomms.com 25 Mar '05

25 Mar '05

Hi, I downloaded libeay32.dll and linssl32.dll. I started stunnel (4.07) and I did telnet to my router; after handshake I had the same problem. Client Debug ================ 2005.03.24 15:03:28 LOG5[3392:3104]: stunnel 4.07 on x86-pc-mingw32-gnu WIN32+IPv6 with OpenSSL 0.9.7f 22 Mar 2005 2005.03.24 15:03:28 LOG7[3392:2524]: Snagged 64 random bytes from C:/.rnd 2005.03.24 15:03:28 LOG7[3392:2524]: Wrote 1024 new random bytes to C:/.rnd 2005.03.24 15:03:28 LOG7[3392:2524]: RAND_status claims sufficient entropy for the PRNG 2005.03.24 15:03:28 LOG6[3392:2524]: PRNG seeded successfully 2005.03.24 15:03:28 LOG7[3392:2524]: Certificate: clcert.pem 2005.03.24 15:03:28 LOG7[3392:2524]: Key file: clcert.pem 2005.03.24 15:03:28 LOG5[3392:2524]: No limit detected for the number of clients 2005.03.24 15:03:28 LOG7[3392:2524]: FD 144 in non-blocking mode 2005.03.24 15:03:28 LOG7[3392:2524]: SO_REUSEADDR option set on accept socket 2005.03.24 15:03:28 LOG7[3392:2524]: telnet bound to 0.0.0.0:23 2005.03.24 15:03:39 LOG7[3392:2524]: telnet accepted FD=148 from 127.0.0.1:2133 2005.03.24 15:03:39 LOG7[3392:2524]: FD 148 in non-blocking mode 2005.03.24 15:03:39 LOG7[3392:2524]: Creating a new thread 2005.03.24 15:03:39 LOG7[3392:2524]: New thread created 2005.03.24 15:03:39 LOG7[3392:2556]: telnet started 2005.03.24 15:03:39 LOG5[3392:2556]: telnet connected from 127.0.0.1:2133 2005.03.24 15:03:39 LOG7[3392:2556]: FD 224 in non-blocking mode 2005.03.24 15:03:39 LOG7[3392:2556]: telnet connecting 10.36.3.144:4433 2005.03.24 15:03:39 LOG7[3392:2556]: connect_wait: waiting 10 seconds 2005.03.24 15:03:39 LOG7[3392:2556]: connect_wait: connected 2005.03.24 15:03:39 LOG7[3392:2556]: Remote FD=224 initialized 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): before/connect initialization 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 write client hello A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 read server hello A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 read server certificate A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 read server certificate request A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 read server done A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 write client certificate A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 write client key exchange A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 write certificate verify A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 write change cipher spec A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 write finished A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 flush data 2005.03.24 15:04:11 LOG7[3392:2556]: SSL state (connect): SSLv3 read finished A 2005.03.24 15:04:11 LOG7[3392:2556]: 1 items in the session cache 2005.03.24 15:04:11 LOG7[3392:2556]: 1 client connects (SSL_connect()) 2005.03.24 15:04:11 LOG7[3392:2556]: 1 client connects that finished 2005.03.24 15:04:11 LOG7[3392:2556]: 0 client renegotiatations requested 2005.03.24 15:04:11 LOG7[3392:2556]: 0 server connects (SSL_accept()) 2005.03.24 15:04:11 LOG7[3392:2556]: 0 server connects that finished 2005.03.24 15:04:11 LOG7[3392:2556]: 0 server renegotiatiations requested 2005.03.24 15:04:11 LOG7[3392:2556]: 0 session cache hits 2005.03.24 15:04:11 LOG7[3392:2556]: 0 session cache misses 2005.03.24 15:04:11 LOG7[3392:2556]: 0 session cache timeouts 2005.03.24 15:04:11 LOG6[3392:2556]: SSL connected: new session negotiated 2005.03.24 15:04:11 LOG6[3392:2556]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.03.24 15:04:27 LOG7[3392:2556]: SSL alert (write): fatal: bad record mac 2005.03.24 15:04:27 LOG3[3392:2556]: SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2005.03.24 15:04:27 LOG5[3392:2556]: Connection reset: 17 bytes sent to SSL, 191 bytes sent to socket 2005.03.24 15:04:27 LOG7[3392:2556]: telnet finished (0 left) =============================================================================== How can I procede? Thanks&Regards Maddalena

2 1

error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
by Theodore W. Hildebrandt 24 Mar '05

24 Mar '05

I was running stunnel-4.08 under Windows XP-Home, using MS IEX as browser and Netscape 4.6 for e-mail. My ISP is AT&T Worldnet and I am accessing it via DSL and home wireless NW. Here is stunnel.conf: client = yes [pop3] accept = 110 connect = ipostoffice.att.net:995 [smtp] accept = 25 connect = imailhost.att.net:465 As instructed by AT&T, the e-mail servers have been specified as "localhost", both POP-3 and SMTP. The problem is that while I can download messages, I am unable to send e-mail because the "peer disconnects", and the log file carries the following messages: 2005.03.24 10:18:00 LOG5[2960:232]: smtp connected from 127.0.0.1:2194 2005.03.24 10:18:00 LOG5[2960:2428]: smtp connected from 127.0.0.1:2197 2005.03.24 10:18:01 LOG3[2960:232]: SSL_connect: Peer suddenly disconnected 2005.03.24 10:18:01 LOG3[2960:2428]: SSL_connect: Peer suddenly disconnected 2005.03.24 10:18:09 LOG3[2960:2084]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2005.03.24 10:18:09 LOG3[2960:3384]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number I have been able to run "openssl version" with the result: "OpenSSL 0.9.7e 25 Oct 2004" but I am unable to obtain the other outputs specified under the instructions for the "Stunnel-Users Mailing List". I have tried replacing libssl32.dll and libay32.dll with versions more recently downloaded (but with the same origination dates) and no improvement. So I am sending this message from another system running Win98 and stunnel-4.05, also using Netscape 4.6, which seems to work o.k. Please tell me how to get the right version number to work with stunnel-4.08, and WinXP. Additionally, it would be nice to know how to obtain the outputs suggested in the instructions for Stunnel-Users Mailing List.

1 0

help
by Maddalena.Pulcini＠seleniacomms.com 24 Mar '05

24 Mar '05

Hi, I downloaded libeay32.dll and linssl32.dll (ftp://stunnel.mirt.net/openssl/binary-0.9.7f-zlib/) . I started stunnel (4.07) and I did telnet to my router; after handshake I had the same problem. Client Debug ================ 2005.03.24 15:03:28 LOG5[3392:3104]: stunnel 4.07 on x86-pc-mingw32-gnu WIN32+IPv6 with OpenSSL 0.9.7f 22 Mar 2005 2005.03.24 15:03:28 LOG7[3392:2524]: Snagged 64 random bytes from C:/.rnd 2005.03.24 15:03:28 LOG7[3392:2524]: Wrote 1024 new random bytes to C:/.rnd 2005.03.24 15:03:28 LOG7[3392:2524]: RAND_status claims sufficient entropy for the PRNG 2005.03.24 15:03:28 LOG6[3392:2524]: PRNG seeded successfully 2005.03.24 15:03:28 LOG7[3392:2524]: Certificate: clcert.pem 2005.03.24 15:03:28 LOG7[3392:2524]: Key file: clcert.pem 2005.03.24 15:03:28 LOG5[3392:2524]: No limit detected for the number of clients 2005.03.24 15:03:28 LOG7[3392:2524]: FD 144 in non-blocking mode 2005.03.24 15:03:28 LOG7[3392:2524]: SO_REUSEADDR option set on accept socket 2005.03.24 15:03:28 LOG7[3392:2524]: telnet bound to 0.0.0.0:23 2005.03.24 15:03:39 LOG7[3392:2524]: telnet accepted FD=148 from 127.0.0.1:2133 2005.03.24 15:03:39 LOG7[3392:2524]: FD 148 in non-blocking mode 2005.03.24 15:03:39 LOG7[3392:2524]: Creating a new thread 2005.03.24 15:03:39 LOG7[3392:2524]: New thread created 2005.03.24 15:03:39 LOG7[3392:2556]: telnet started 2005.03.24 15:03:39 LOG5[3392:2556]: telnet connected from 127.0.0.1:2133 2005.03.24 15:03:39 LOG7[3392:2556]: FD 224 in non-blocking mode 2005.03.24 15:03:39 LOG7[3392:2556]: telnet connecting 10.36.3.144:4433 2005.03.24 15:03:39 LOG7[3392:2556]: connect_wait: waiting 10 seconds 2005.03.24 15:03:39 LOG7[3392:2556]: connect_wait: connected 2005.03.24 15:03:39 LOG7[3392:2556]: Remote FD=224 initialized 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): before/connect initialization 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 write client hello A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 read server hello A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 read server certificate A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 read server certificate request A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 read server done A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 write client certificate A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 write client key exchange A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 write certificate verify A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 write change cipher spec A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 write finished A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 flush data 2005.03.24 15:04:11 LOG7[3392:2556]: SSL state (connect): SSLv3 read finished A 2005.03.24 15:04:11 LOG7[3392:2556]: 1 items in the session cache 2005.03.24 15:04:11 LOG7[3392:2556]: 1 client connects (SSL_connect()) 2005.03.24 15:04:11 LOG7[3392:2556]: 1 client connects that finished 2005.03.24 15:04:11 LOG7[3392:2556]: 0 client renegotiatations requested 2005.03.24 15:04:11 LOG7[3392:2556]: 0 server connects (SSL_accept()) 2005.03.24 15:04:11 LOG7[3392:2556]: 0 server connects that finished 2005.03.24 15:04:11 LOG7[3392:2556]: 0 server renegotiatiations requested 2005.03.24 15:04:11 LOG7[3392:2556]: 0 session cache hits 2005.03.24 15:04:11 LOG7[3392:2556]: 0 session cache misses 2005.03.24 15:04:11 LOG7[3392:2556]: 0 session cache timeouts 2005.03.24 15:04:11 LOG6[3392:2556]: SSL connected: new session negotiated 2005.03.24 15:04:11 LOG6[3392:2556]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.03.24 15:04:27 LOG7[3392:2556]: SSL alert (write): fatal: bad record mac 2005.03.24 15:04:27 LOG3[3392:2556]: SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2005.03.24 15:04:27 LOG5[3392:2556]: Connection reset: 17 bytes sent to SSL, 191 bytes sent to socket 2005.03.24 15:04:27 LOG7[3392:2556]: telnet finished (0 left) =============================================================================== How can I procede? Thanks&Regards Maddalena

2 1

Proxy support with stunnel
by Andrei Emeltchenko 24 Mar '05

24 Mar '05

Hi! I am new to stunnel and just wanted to check is there possibility to use proxy? Assume I want to connect to secure news with NNTPS. I need something like ProxyCommand in ssh. Regards, Andrei

1 0

help
by Maddalena.Pulcini＠seleniacomms.com 24 Mar '05

24 Mar '05

Hi, someone could help me? I am using stunnel (4.07) as ssl client to do telnet to my router with ssl server (openssl 0.9.7d). After protocol handshake I get this error: SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac problem Stunnel is configured in this way: ========================== client = yes debug=7 cert=clcert.pem [telnet] accept = 23 connect = 10.36.3.144:4433 ========================== My router's configuration is: ========================== -Verify 4 -cert cert.pem ========================== The exchange of packets: ========================== client sends=======> Client Hello server sends======> Server Hello,Certificate, Certificate Request,Server Hello Done client sends======> Certificate, Client Key Exchange, Certificate Verify, Change Cipher Spec, Encrypted Handshake Message server sends=====> Change Cipher Spec, Encrypted Handshake Message and then Application Data. After sending a number of Application Data by the server, client sends Encrypted Alert and closes the connection. Having debug on stunnel client I can see: >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> 2005.03.15 11:13:44 LOG5[2040:3964]: stunnel 4.07 on x86-pc-mingw32-gnu WIN32+IPv6 with OpenSSL 0.9.8-dev XX xxx XXXX 2005.03.15 11:13:44 LOG7[2040:2376]: Snagged 64 random bytes from C:/.rnd 2005.03.15 11:13:44 LOG7[2040:2376]: Wrote 1024 new random bytes to C:/.rnd 2005.03.15 11:13:44 LOG7[2040:2376]: RAND_status claims sufficient entropy for the PRNG 2005.03.15 11:13:44 LOG6[2040:2376]: PRNG seeded successfully 2005.03.15 11:13:44 LOG7[2040:2376]: Certificate: clcert.pem 2005.03.15 11:13:44 LOG7[2040:2376]: Key file: clcert.pem 2005.03.15 11:13:44 LOG5[2040:2376]: No limit detected for the number of clients 2005.03.15 11:13:44 LOG7[2040:2376]: FD 188 in non-blocking mode 2005.03.15 11:13:44 LOG7[2040:2376]: SO_REUSEADDR option set on accept socket 2005.03.15 11:13:44 LOG7[2040:2376]: telnet bound to 0.0.0.0:23 2005.03.15 11:13:54 LOG7[2040:2376]: telnet accepted FD=192 from 127.0.0.1:1589 2005.03.15 11:13:54 LOG7[2040:2376]: FD 192 in non-blocking mode 2005.03.15 11:13:54 LOG7[2040:2376]: Creating a new thread 2005.03.15 11:13:54 LOG7[2040:2376]: New thread created 2005.03.15 11:13:54 LOG7[2040:3588]: telnet started 2005.03.15 11:13:54 LOG5[2040:3588]: telnet connected from 127.0.0.1:1589 2005.03.15 11:13:54 LOG7[2040:3588]: FD 224 in non-blocking mode 2005.03.15 11:13:54 LOG7[2040:3588]: telnet connecting 10.36.3.144:4433 2005.03.15 11:13:54 LOG7[2040:3588]: connect_wait: waiting 10 seconds 2005.03.15 11:13:54 LOG7[2040:3588]: connect_wait: connected 2005.03.15 11:13:54 LOG7[2040:3588]: Remote FD=224 initialized 2005.03.15 11:13:54 LOG7[2040:3588]: SSL state (connect): before/connect initialization 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write client hello A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server hello A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server certificate A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server certificate request A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server done A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write client certificate A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write client key exchange A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write certificate verify A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write change cipher spec A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write finished A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 flush data 2005.03.15 11:14:26 LOG7[2040:3588]: SSL state (connect): SSLv3 read finished A 2005.03.15 11:14:26 LOG7[2040:3588]: 1 items in the session cache 2005.03.15 11:14:26 LOG7[2040:3588]: 1 client connects (SSL_connect()) 2005.03.15 11:14:26 LOG7[2040:3588]: 1 client connects that finished 2005.03.15 11:14:26 LOG7[2040:3588]: 0 client renegotiatations requested 2005.03.15 11:14:26 LOG7[2040:3588]: 0 server connects (SSL_accept()) 2005.03.15 11:14:26 LOG7[2040:3588]: 0 server connects that finished 2005.03.15 11:14:26 LOG7[2040:3588]: 0 server renegotiatiations requested 2005.03.15 11:14:26 LOG7[2040:3588]: 0 session cache hits 2005.03.15 11:14:26 LOG7[2040:3588]: 0 session cache misses 2005.03.15 11:14:26 LOG7[2040:3588]: 0 session cache timeouts 2005.03.15 11:14:26 LOG6[2040:3588]: SSL connected: new session negotiated 2005.03.15 11:14:26 LOG6[2040:3588]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.03.15 11:14:41 LOG7[2040:3588]: SSL alert (write): fatal: bad record mac 2005.03.15 11:14:41 LOG3[2040:3588]: SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2005.03.15 11:14:41 LOG5[2040:3588]: Connection reset: 17 bytes sent to SSL, 190 bytes sent to socket 2005.03.15 11:14:41 LOG7[2040:3588]: telnet finished (0 left) >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> This client is now running using an updated library: libeay32.dll obtained compiling openssl-SNAP-20050304 that seemed to be the solution of the problem (after searching on Internet I deduce that). Not having solution to the problem, I know that my conclusion is not right. This morning I tryed with new library available in your home page (New compiled Windows DLL libraries for 0.9.7d) but I get the same error. So if someone knows how to procede, please help me. Thanks&Regards Maddalena Pulcini

3 2

Problems using STunnel with a non-default port - Please Help
by Chetan Rao 22 Mar '05

22 Mar '05

I have a personal webserver running on Win2K Pro SP4 that listens on port 17875. This server is accessible through my NAT and software firewall (ZoneAlarm Pro). I then installed STunnel with the following conf: [https] accept=4430 connect=17875 TIMEOUTclose=0 Now, when I access https://<server>:4430, I get a HTTP 400 (Bad Request) error message, with both Internet Explorer 6 and FireFox 1.01. However, if I change the accept port from 4430 to 443 (and make the appropriate changes on the NAT for port forwarding), and use https://<server>, it works. I don't want to use the standard port. What am I doing wrong? Here's the log that STunnel generated: 2005.03.16 08:33:26 LOG5[1044:288]: stunnel 4.08 on x86-pc-mingw32-gnu WIN32+IPv4 with OpenSSL 0.9.7e 25 Oct 2004 2005.03.16 08:33:26 LOG7[1044:1096]: RAND_status claims sufficient entropy for the PRNG 2005.03.16 08:33:26 LOG6[1044:1096]: PRNG seeded successfully 2005.03.16 08:33:26 LOG7[1044:1096]: Certificate: stunnel.pem 2005.03.16 08:33:26 LOG7[1044:1096]: Key file: stunnel.pem 2005.03.16 08:33:26 LOG5[1044:1096]: No limit detected for the number of clients 2005.03.16 08:33:26 LOG7[1044:1096]: FD 168 in non-blocking mode 2005.03.16 08:33:26 LOG7[1044:1096]: SO_REUSEADDR option set on accept socket 2005.03.16 08:33:26 LOG7[1044:1096]: https bound to 0.0.0.0:4430 2005.03.16 08:34:08 LOG7[1044:1096]: https accepted FD=180 from 192.168.0.2:4864 2005.03.16 08:34:08 LOG7[1044:1096]: FD 180 in non-blocking mode 2005.03.16 08:34:08 LOG7[1044:1096]: Creating a new thread 2005.03.16 08:34:08 LOG7[1044:1096]: New thread created 2005.03.16 08:34:08 LOG7[1044:896]: https started 2005.03.16 08:34:08 LOG5[1044:896]: https connected from 192.168.0.2:4864 2005.03.16 08:34:08 LOG7[1044:896]: SSL state (accept): before/accept initialization 2005.03.16 08:34:08 LOG7[1044:896]: SSL state (accept): SSLv3 read client hello A 2005.03.16 08:34:08 LOG7[1044:896]: SSL state (accept): SSLv3 write server hello A 2005.03.16 08:34:08 LOG7[1044:896]: SSL state (accept): SSLv3 write certificate A 2005.03.16 08:34:08 LOG7[1044:896]: SSL state (accept): SSLv3 write server done A 2005.03.16 08:34:08 LOG7[1044:896]: SSL state (accept): SSLv3 flush data 2005.03.16 08:34:08 LOG7[1044:896]: SSL state (accept): SSLv3 read client key exchange A 2005.03.16 08:34:08 LOG7[1044:896]: SSL state (accept): SSLv3 read finished A 2005.03.16 08:34:08 LOG7[1044:896]: SSL state (accept): SSLv3 write change cipher spec A 2005.03.16 08:34:08 LOG7[1044:896]: SSL state (accept): SSLv3 write finished A 2005.03.16 08:34:08 LOG7[1044:896]: SSL state (accept): SSLv3 flush data 2005.03.16 08:34:08 LOG7[1044:896]: 1 items in the session cache 2005.03.16 08:34:08 LOG7[1044:896]: 0 client connects (SSL_connect()) 2005.03.16 08:34:08 LOG7[1044:896]: 0 client connects that finished 2005.03.16 08:34:08 LOG7[1044:896]: 0 client renegotiatations requested 2005.03.16 08:34:08 LOG7[1044:896]: 1 server connects (SSL_accept()) 2005.03.16 08:34:08 LOG7[1044:896]: 1 server connects that finished 2005.03.16 08:34:08 LOG7[1044:896]: 0 server renegotiatiations requested 2005.03.16 08:34:08 LOG7[1044:896]: 0 session cache hits 2005.03.16 08:34:08 LOG7[1044:896]: 1 session cache misses 2005.03.16 08:34:08 LOG7[1044:896]: 0 session cache timeouts 2005.03.16 08:34:08 LOG6[1044:896]: SSL accepted: new session negotiated 2005.03.16 08:34:08 LOG6[1044:896]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2005.03.16 08:34:08 LOG7[1044:896]: FD 200 in non-blocking mode 2005.03.16 08:34:08 LOG7[1044:896]: https connecting 127.0.0.1:17875 2005.03.16 08:34:08 LOG7[1044:896]: connect_wait: waiting 10 seconds 2005.03.16 08:34:08 LOG7[1044:896]: connect_wait: connected 2005.03.16 08:34:08 LOG7[1044:896]: Remote FD=200 initialized 2005.03.16 08:34:08 LOG7[1044:896]: Socket closed on read 2005.03.16 08:34:08 LOG7[1044:896]: SSL write shutdown 2005.03.16 08:34:08 LOG7[1044:896]: SSL alert (write): warning: close notify 2005.03.16 08:34:08 LOG7[1044:896]: SSL_shutdown retrying 2005.03.16 08:34:08 LOG7[1044:896]: s_poll_wait timeout waiting for SSL close_notify 2005.03.16 08:34:08 LOG5[1044:896]: Connection closed: 208 bytes sent to SSL, 389 bytes sent to socket 2005.03.16 08:34:08 LOG7[1044:896]: https finished (0 left) Any help much appreciated. Thanks.

2 6

Certificate chain not used for server?
by Ed Kapitein 21 Mar '05

21 Mar '05

Hi all, I have a working setup of stunnel listening on port 443 and connect to the server on the same host on port 80. It is done via xinetd. Alltough everything is working just fine, clients on webbrowsers get the "you have choosen not to trust this CA" error when connecting to this server. In apache the certificate chain (bundle.ca) is used and clients connecting to the apache server wont get this error. Is there a way to make stunnel behave like apache, so the clients don't have to manually install the CA certificates? (the certificate is a vallid certificate obtained from globaslsign.be) i do have the CAfile in my options file, but this does not help. All help is greatly appreciated! Kind regards, @

1 0

Cert errors ....... need help!
by Richard Houston 17 Mar '05

17 Mar '05

Hi all, I have take over a stunnel install and all the clients certs have expired. I have been trying for the past 2 days to get the new step up to work but no such luck. Here is the error I get on the sever side, Linux Fedora Core 3, Stunnel 4.05: 2005.03.17 11:36:15 LOG7[12746:3086949296]: school4 started 2005.03.17 11:36:15 LOG5[12746:3086949296]: school4 connected from XXX.XXX.XXX.XX:1414 2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): before/accept initialization 2005.03.17 11:36:15 LOG7[12746:3086949296]: waitforsocket: FD=7, DIR=read 2005.03.17 11:36:15 LOG7[12746:3086949296]: waitforsocket: ok 2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): SSLv3 read client hello A 2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): SSLv3 write server hello A 2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): SSLv3 write certificate A 2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): SSLv3 write certificate request A 2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): SSLv3 flush data 2005.03.17 11:36:15 LOG7[12746:3086949296]: waitforsocket: FD=7, DIR=read 2005.03.17 11:36:18 LOG7[12746:3086949296]: waitforsocket: ok 2005.03.17 11:36:18 LOG7[12746:3086949296]: SSL alert (read): fatal: certificate unknown 2005.03.17 11:36:18 LOG3[12746:3086949296]: SSL_accept: 14094416: error:14094416:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate unknown 2005.03.17 11:36:18 LOG7[12746:3086949296]: school4 finished (0 left) And here is the output on the client side: 005.03.17 11:21:02 LOG5[952:1264]: stunnel 4.04 on x86-pc-mingw32-gnu WIN32 with OpenSSL 0.9.7 31 Dec2002 2005.03.17 11:21:03 LOG5[952:896]: Peer certificate location (null) 2005.03.17 11:21:03 LOG5[952:896]: WIN32 platform: 30000 clients allowed 2005.03.17 11:21:03 LOG5[952:1152]: schools connected from 127.0.0.1:1413 2005.03.17 11:21:07 LOG5[952:1152]: VERIFY OK: depth=1, /C=CA/ST=XXX/L=XXX/O=XXX/OU=XXX CACERT/CN=sd.traf.mb.ca/emailAddress=sysadmin@XXXX 2005.03.17 11:21:07 LOG4[952:1152]: VERIFY ERROR ONLY MY: no cert for /C=CA/ST=XXX/O=XXXX/OU=STUNNEL SERVER CERT/CN=XXXXX/emailAddress=sysadmin@XXXX 2005.03.17 11:21:07 LOG3[952:1152]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed I have created the certs on both server and client according to the documents at http://www.stunnel.org/faq/openssl_stunnel_ServerClientAuth.txt. I have the cacert.pem file on the cleint side, I have c_hashed the cert file on the server side. Do I need to out the c_hash of the server side cert on the client as well? Is there something I have missed? Any ideas as to what I can check to see where the issue is? I am desperate, any help would be greatly appreciated. Regards, +------------------------------------------+ | Richard Houston .^. | | R.L.H. Consulting /V\ | | E-Mail <rhouston(a)rlhc.net> /( )\ | | WWW <www.rlhc.net> ^^-^^ | +------------------------------------------+

3 8

Cert errors ....... need help!
by Richard Houston 17 Mar '05

17 Mar '05

Hi all, I have take over a stunnel install and all the clients certs have expired. I have been trying for the past 2 days to get the new step up to work but no such luck. Here is the error I get on the sever side, Linux Fedora Core 3, Stunnel 4.05: 2005.03.17 11:36:15 LOG7[12746:3086949296]: school4 started 2005.03.17 11:36:15 LOG5[12746:3086949296]: school4 connected from XXX.XXX.XXX.XX:1414 2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): before/accept initialization 2005.03.17 11:36:15 LOG7[12746:3086949296]: waitforsocket: FD=7, DIR=read 2005.03.17 11:36:15 LOG7[12746:3086949296]: waitforsocket: ok 2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): SSLv3 read client hello A 2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): SSLv3 write server hello A 2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): SSLv3 write certificate A 2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): SSLv3 write certificate request A 2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): SSLv3 flush data 2005.03.17 11:36:15 LOG7[12746:3086949296]: waitforsocket: FD=7, DIR=read 2005.03.17 11:36:18 LOG7[12746:3086949296]: waitforsocket: ok 2005.03.17 11:36:18 LOG7[12746:3086949296]: SSL alert (read): fatal: certificate unknown 2005.03.17 11:36:18 LOG3[12746:3086949296]: SSL_accept: 14094416: error:14094416:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate unknown 2005.03.17 11:36:18 LOG7[12746:3086949296]: school4 finished (0 left) And here is the output on the client side: 005.03.17 11:21:02 LOG5[952:1264]: stunnel 4.04 on x86-pc-mingw32-gnu WIN32 with OpenSSL 0.9.7 31 Dec2002 2005.03.17 11:21:03 LOG5[952:896]: Peer certificate location (null) 2005.03.17 11:21:03 LOG5[952:896]: WIN32 platform: 30000 clients allowed 2005.03.17 11:21:03 LOG5[952:1152]: schools connected from 127.0.0.1:1413 2005.03.17 11:21:07 LOG5[952:1152]: VERIFY OK: depth=1, /C=CA/ST=XXX/L=XXX/O=XXX/OU=XXX CACERT/CN=sd.traf.mb.ca/emailAddress=sysadmin@XXXX 2005.03.17 11:21:07 LOG4[952:1152]: VERIFY ERROR ONLY MY: no cert for /C=CA/ST=XXX/O=XXXX/OU=STUNNEL SERVER CERT/CN=XXXXX/emailAddress=sysadmin@XXXX 2005.03.17 11:21:07 LOG3[952:1152]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed I have created the certs on both server and client according to the documents at http://www.stunnel.org/faq/openssl_stunnel_ServerClientAuth.txt. I have the cacert.pem file on the cleint side, I have c_hashed the cert file on the server side. Do I need to out the c_hash of the server side cert on the client as well? Is there something I have missed? Any ideas as to what I can check to see where the issue is? I am desperate, any help would be greatly appreciated. Regards, +------------------------------------------+ | Richard Houston .^. | | R.L.H. Consulting /V\ | | E-Mail <rhouston(a)rlhc.net> /( )\ | | WWW <www.rlhc.net> ^^-^^ | +------------------------------------------+

1 0

Creating a man in middle attack for legit purposes.
by Todd Troutman 16 Mar '05

16 Mar '05

So I don't normally start off on a list by immediately asking a question but I've got a weird one here that's a critical thing tonight, plus, this might just be entertaining! Problem : MacOS Panther has horrible performance problems with large https web apps. So I setup Stunnel to take port 80 and run it through the web app on 443. Provides http from an https server. On a MacOS client machine I set /etc/hosts to say that system.netsuite.com, the web app, is 192.168.0.4, a handy FreeBSD 5.3 box running stunnel 4.05 It works. Sort of. Problems - the web app keeps rewriting the url from http to https, anytime I click on anything, hmmm.. so I can't make stunnel answer on 443 because then I'm back to square one. Also, I can't login, the web app is giving me a login page as http, but I get a session timeout,please login again, just repeats, unsure if something in the stunnel config should be done to fix that. Other than that, this is working. Config is currently this. client=yes accept=80 connect=system.netsuite.com:443 Anyway, so is this maybe one of the stranger uses of stunnel, possibly a wrong headed and broken way of using it, but oh well. There goes my plea for some ideas on this one, Thanks, Todd

1 0

SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac problem
by Maddalena.Pulcini＠seleniacomms.com 15 Mar '05

15 Mar '05

Hi, someone could help me? I am using stunnel (4.07) as ssl client to do telnet to my router with ssl server (openssl 0.9.7d). Stunnel is configured in this way: ========================== client = yes debug=7 cert=clcert.pem [telnet] accept = 23 connect = 10.36.3.144:4433 ========================== My router's configuration is: ========================== -Verify 4 -cert cert.pem ========================== The exchange of packets: ========================== client sends=======> Client Hello server sends======> Server Hello,Certificate, Certificate Request,Server Hello Done client sends======> Certificate, Client Key Exchange, Certificate Verify, Change Cipher Spec, Encrypted Handshake Message server sends=====> Change Cipher Spec, Encrypted Handshake Message and then Application Data. After sending a number of Application Data by the server, client sends Encrypted Alert and closes the connection. Having debug on stunnel client I can see: >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> 2005.03.15 11:13:44 LOG5[2040:3964]: stunnel 4.07 on x86-pc-mingw32-gnu WIN32+IPv6 with OpenSSL 0.9.8-dev XX xxx XXXX 2005.03.15 11:13:44 LOG7[2040:2376]: Snagged 64 random bytes from C:/.rnd 2005.03.15 11:13:44 LOG7[2040:2376]: Wrote 1024 new random bytes to C:/.rnd 2005.03.15 11:13:44 LOG7[2040:2376]: RAND_status claims sufficient entropy for the PRNG 2005.03.15 11:13:44 LOG6[2040:2376]: PRNG seeded successfully 2005.03.15 11:13:44 LOG7[2040:2376]: Certificate: clcert.pem 2005.03.15 11:13:44 LOG7[2040:2376]: Key file: clcert.pem 2005.03.15 11:13:44 LOG5[2040:2376]: No limit detected for the number of clients 2005.03.15 11:13:44 LOG7[2040:2376]: FD 188 in non-blocking mode 2005.03.15 11:13:44 LOG7[2040:2376]: SO_REUSEADDR option set on accept socket 2005.03.15 11:13:44 LOG7[2040:2376]: telnet bound to 0.0.0.0:23 2005.03.15 11:13:54 LOG7[2040:2376]: telnet accepted FD=192 from 127.0.0.1:1589 2005.03.15 11:13:54 LOG7[2040:2376]: FD 192 in non-blocking mode 2005.03.15 11:13:54 LOG7[2040:2376]: Creating a new thread 2005.03.15 11:13:54 LOG7[2040:2376]: New thread created 2005.03.15 11:13:54 LOG7[2040:3588]: telnet started 2005.03.15 11:13:54 LOG5[2040:3588]: telnet connected from 127.0.0.1:1589 2005.03.15 11:13:54 LOG7[2040:3588]: FD 224 in non-blocking mode 2005.03.15 11:13:54 LOG7[2040:3588]: telnet connecting 10.36.3.144:4433 2005.03.15 11:13:54 LOG7[2040:3588]: connect_wait: waiting 10 seconds 2005.03.15 11:13:54 LOG7[2040:3588]: connect_wait: connected 2005.03.15 11:13:54 LOG7[2040:3588]: Remote FD=224 initialized 2005.03.15 11:13:54 LOG7[2040:3588]: SSL state (connect): before/connect initialization 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write client hello A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server hello A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server certificate A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server certificate request A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server done A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write client certificate A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write client key exchange A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write certificate verify A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write change cipher spec A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write finished A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 flush data 2005.03.15 11:14:26 LOG7[2040:3588]: SSL state (connect): SSLv3 read finished A 2005.03.15 11:14:26 LOG7[2040:3588]: 1 items in the session cache 2005.03.15 11:14:26 LOG7[2040:3588]: 1 client connects (SSL_connect()) 2005.03.15 11:14:26 LOG7[2040:3588]: 1 client connects that finished 2005.03.15 11:14:26 LOG7[2040:3588]: 0 client renegotiatations requested 2005.03.15 11:14:26 LOG7[2040:3588]: 0 server connects (SSL_accept()) 2005.03.15 11:14:26 LOG7[2040:3588]: 0 server connects that finished 2005.03.15 11:14:26 LOG7[2040:3588]: 0 server renegotiatiations requested 2005.03.15 11:14:26 LOG7[2040:3588]: 0 session cache hits 2005.03.15 11:14:26 LOG7[2040:3588]: 0 session cache misses 2005.03.15 11:14:26 LOG7[2040:3588]: 0 session cache timeouts 2005.03.15 11:14:26 LOG6[2040:3588]: SSL connected: new session negotiated 2005.03.15 11:14:26 LOG6[2040:3588]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.03.15 11:14:41 LOG7[2040:3588]: SSL alert (write): fatal: bad record mac 2005.03.15 11:14:41 LOG3[2040:3588]: SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2005.03.15 11:14:41 LOG5[2040:3588]: Connection reset: 17 bytes sent to SSL, 190 bytes sent to socket 2005.03.15 11:14:41 LOG7[2040:3588]: telnet finished (0 left) >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> This client is now running using an updated library: libeay32.dll obtained compiling openssl-SNAP-20050304 that seemed to be the solution of the problem (after searching on Internet I deduce that). Not having solution to the problem, I know that my conclusion is not right. So if someone knows how to procede, please help me. Thanks&Regards Maddalena Pulcini

1 0

SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac problem
by Maddalena.Pulcini＠seleniacomms.com 15 Mar '05

15 Mar '05

Hi, someone could help me? I am using stunnel (4.07) as ssl client to do telnet to my router with ssl server (openssl 0.9.7d). Stunnel is configured in this way: ========================== client = yes debug=7 cert=clcert.pem [telnet] accept = 23 connect = 10.36.3.144:4433 ========================== My router's configuration is: ========================== -Verify 4 -cert cert.pem ========================== The exchange of packets: ========================== client sends=======> Client Hello server sends======> Server Hello,Certificate, Certificate Request,Server Hello Done client sends======> Certificate, Client Key Exchange, Certificate Verify, Change Cipher Spec, Encrypted Handshake Message server sends=====> Change Cipher Spec, Encrypted Handshake Message and then Application Data. After sending a number of Application Data by the server, client sends Encrypted Alert and closes the connection. Having debug on stunnel client I can see: >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> 2005.03.15 11:13:44 LOG5[2040:3964]: stunnel 4.07 on x86-pc-mingw32-gnu WIN32+IPv6 with OpenSSL 0.9.8-dev XX xxx XXXX 2005.03.15 11:13:44 LOG7[2040:2376]: Snagged 64 random bytes from C:/.rnd 2005.03.15 11:13:44 LOG7[2040:2376]: Wrote 1024 new random bytes to C:/.rnd 2005.03.15 11:13:44 LOG7[2040:2376]: RAND_status claims sufficient entropy for the PRNG 2005.03.15 11:13:44 LOG6[2040:2376]: PRNG seeded successfully 2005.03.15 11:13:44 LOG7[2040:2376]: Certificate: clcert.pem 2005.03.15 11:13:44 LOG7[2040:2376]: Key file: clcert.pem 2005.03.15 11:13:44 LOG5[2040:2376]: No limit detected for the number of clients 2005.03.15 11:13:44 LOG7[2040:2376]: FD 188 in non-blocking mode 2005.03.15 11:13:44 LOG7[2040:2376]: SO_REUSEADDR option set on accept socket 2005.03.15 11:13:44 LOG7[2040:2376]: telnet bound to 0.0.0.0:23 2005.03.15 11:13:54 LOG7[2040:2376]: telnet accepted FD=192 from 127.0.0.1:1589 2005.03.15 11:13:54 LOG7[2040:2376]: FD 192 in non-blocking mode 2005.03.15 11:13:54 LOG7[2040:2376]: Creating a new thread 2005.03.15 11:13:54 LOG7[2040:2376]: New thread created 2005.03.15 11:13:54 LOG7[2040:3588]: telnet started 2005.03.15 11:13:54 LOG5[2040:3588]: telnet connected from 127.0.0.1:1589 2005.03.15 11:13:54 LOG7[2040:3588]: FD 224 in non-blocking mode 2005.03.15 11:13:54 LOG7[2040:3588]: telnet connecting 10.36.3.144:4433 2005.03.15 11:13:54 LOG7[2040:3588]: connect_wait: waiting 10 seconds 2005.03.15 11:13:54 LOG7[2040:3588]: connect_wait: connected 2005.03.15 11:13:54 LOG7[2040:3588]: Remote FD=224 initialized 2005.03.15 11:13:54 LOG7[2040:3588]: SSL state (connect): before/connect initialization 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write client hello A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server hello A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server certificate A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server certificate request A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server done A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write client certificate A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write client key exchange A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write certificate verify A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write change cipher spec A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write finished A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 flush data 2005.03.15 11:14:26 LOG7[2040:3588]: SSL state (connect): SSLv3 read finished A 2005.03.15 11:14:26 LOG7[2040:3588]: 1 items in the session cache 2005.03.15 11:14:26 LOG7[2040:3588]: 1 client connects (SSL_connect()) 2005.03.15 11:14:26 LOG7[2040:3588]: 1 client connects that finished 2005.03.15 11:14:26 LOG7[2040:3588]: 0 client renegotiatations requested 2005.03.15 11:14:26 LOG7[2040:3588]: 0 server connects (SSL_accept()) 2005.03.15 11:14:26 LOG7[2040:3588]: 0 server connects that finished 2005.03.15 11:14:26 LOG7[2040:3588]: 0 server renegotiatiations requested 2005.03.15 11:14:26 LOG7[2040:3588]: 0 session cache hits 2005.03.15 11:14:26 LOG7[2040:3588]: 0 session cache misses 2005.03.15 11:14:26 LOG7[2040:3588]: 0 session cache timeouts 2005.03.15 11:14:26 LOG6[2040:3588]: SSL connected: new session negotiated 2005.03.15 11:14:26 LOG6[2040:3588]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.03.15 11:14:41 LOG7[2040:3588]: SSL alert (write): fatal: bad record mac 2005.03.15 11:14:41 LOG3[2040:3588]: SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2005.03.15 11:14:41 LOG5[2040:3588]: Connection reset: 17 bytes sent to SSL, 190 bytes sent to socket 2005.03.15 11:14:41 LOG7[2040:3588]: telnet finished (0 left) >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> This client is now running using an updated library: libeay32.dll obtained compiling openssl-SNAP-20050304 that seemed to be the solution of the problem (after searching on Internet I deduce that). Not having solution to the problem, I know that my conclusion is not right. So if someone knows how to procede, please help me. Thanks&Regards Maddalena Pulcini

1 0

Problem using Stunnell with Macromedia Communication Server MX
by Miguel Nisembaum 14 Mar '05

14 Mar '05

Hi My name is Miguel from Brazil I need to know if anyone has ever configured Stunnel with Macromedia Flash Communication Server. If anyone has can you tell me something about it I’m new to Stunnel so if anyone can please help me it would be great. Thanks Miguel -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.308 / Virus Database: 266.7.2 - Release Date: 11/3/2005

1 0

Radius over Stunnel??
by Frazer, Andrew non Unisys 08 Mar '05

08 Mar '05

Hello all.. I would like to pass radius over stunnel, but I'm not sure if this will work... I have a lot of 'client's that are using RADIUS for authentication, but i want to pass the data over the internet, and radius is relatively insecure. My client machines also run a web server, which stunnel sits in front of, to provide ssl encrypted web services. My radius servers can easily run stunnel, without any issue. Could someone suggest a configuration for this??

3 2

syslog question
by Brian T 04 Mar '05

04 Mar '05

If debug=4 ( or not 0 ) and output= is commented in an stunnel config, it looks like in server mode, messages goto syslog. But in client mode, nothing goes to syslog. Is this the way it's supposed to be? -Brian

1 0

Re: [stunnel-users] long delay to close the ssl session ?
by ikeda＠areabe 04 Mar '05

04 Mar '05

If TIMEOUTclose value is positive, stunnel does not transmit TCP FIN, even though application sends TCP FIN, until timeout time expires I don't know why stunnel designer chose it, maybe because of the performance, or some others. Some of the browsers do not start to display the page until receiving the entire packet. And one of the trigger for the browser to detect to receive the whole is TCP FIN. From that things, such kind of the problem of yours occurs. regards taka On Fri, 4 Mar 2005 10:39:47 -0800 (PST), gary ng <garyng2000(a)yahoo.com> wrote: > Thanks, that did the trick. Just wonder why the > document said this is needed for MSIE while I was > using firefox. Seems to be more like a Window(I > believe even firefox relis on the underlying socket > library) than simply MSIE. > > --- "ikeda@areabe" <ikeda(a)areabe.com> wrote: >> add >> TIMEOUTclose = 0 >> in stunnel.conf >> >> regards >> taka >> >> > > > > > __________________________________ > Celebrate Yahoo!'s 10th Birthday! > Yahoo! Netrospective: 100 Moments of the Web > http://birthday.yahoo.com/netrospective/ >

1 0

long delay to close the ssl session ?
by gary ng 04 Mar '05

04 Mar '05

Hi, I am using stunnel to wrap SSL around SWAT. Everything works fine except that it takes a very long delay for the browser to see that the page has already been transmitted completely(in other words, the other end has closed). I observed this behaviour with both 3.x and 4.x stunnel. Looking through the log, I see that it takes exactly one minute from the start of the session till the session is closed, seems to be some parameter within stunnel to hold the session. I tried both inetd as well as stand alone stunnel mode and both behave the same as well. Is this an issue with SWAT or stunnel ? If I just use plain SWAT through inetd, I don't see this behaviour. thanks for any help in advance. gary __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

compilation errors
by Greg Matthews 03 Mar '05

03 Mar '05

Anyone here managed to build stunnel for Irix? it seems socklen_t is undefined as a type on this OS (and also older versions of solaris). I have found a possible solution here: http://sprg.ssl.berkeley.edu/~fastops/ITOS/portable/socklen$_t.html but I need to know what type this identifier is supposed to be. any help? GREG -- Greg Matthews iTSS Wallingford 01491 692445

2 4

Naive question: will stunnel connect dynamically?
by Duncan Murdoch 02 Mar '05

02 Mar '05

I currently use openssh to open a tunnel between my laptop and my POP3 server, but the tunnel keeps locking up. (I think it's a server problem, or an intermittent line problem, because it happens with both openssh and Putty.) What I'd like is a program that would open the tunnel only as needed, so I can get the mail, and let the tunnel close. Can stunnel do this? More generally, is there a quick summary somewhere on the relative benefits of stunnel's use of SSL versus an SSH approach? Duncan Murdoch

1 0

Windows XP Pro as a client of Remote Dekstop via stunnel
by Jacek Baszkiewicz 02 Mar '05

02 Mar '05

Hi! I'm currently working (without success) on such problem: I have to connect via Stunnel to Windows Server Remote Desktop from workstation with Windows XP Proffesional. When I refer to the local port handled by stunnel, Windows doesn't let me go go further, because it thinks that I'm trying to use local Remote Dekstop and prints: "You are already connected to this machine" (there can be only one connection through RD) . Is there any workaround for this problem, namely, to use secure connection via Stunnel to Remote Dekstop on XP Pro client? This is my config: client=yes cert = stunnel.pem [ts] accept=localhost:3389 connect=remote_ip:443

5 4

PEM routines:PEM_read_bio Problem
by Metal Gear 02 Mar '05

02 Mar '05

Hi all, i was configuring my syslog-ng server with stunnel and it worked fine for somedays but after that i upgraded to new SSL libraries (OpenSSL 0.9.7e) from (OpenSSL 0x0090701f) then i m getting this "stunnel[2480]: SSL_CTX_use_RSAPrivateKey_file: 906D06C: error:0906D06C:PEM routines:PEM_read_bio" error (i have given the link of stunnel binary in rc.local, to start at boot time, at i get this error in logs) i m using stunnel (stunnel 4.07). Can anyone has any idea about it. Thanks

1 0

verify = 3 error with certificate client
by Humberto Morell 01 Mar '05

01 Mar '05

Hello List I have stunnel 4.7 In the messages of the list I have not seen solution to my problem. This is VERIFY ERROR ONLY MY: no cert stunnel.log in Server ################## 2005.02.25 07:55:07 LOG5[2501:1076546480]: VERIFY OK: depth=1, /C=CU/ST=Ciudad Habana/L=Centro Habana/O=Segurmatica/OU=Agencia de Certificacion/CN=Segurmatica/emailAddress=ca(a)segurmatica.cu 2005.02.25 07:55:07 LOG4[2501:1076546480]: VERIFY ERROR ONLY MY: no cert for /C=CU/ST=Ciudad Habana/L=Centro Habana/O=Ministerio Informatica y Comunicaciones/OU=Segurmatica/CN=Humberto Morell/emailAddress=morell(a)seg.inf.cu 2005.02.25 07:55:07 LOG7[2501:1076546480]: SSL alert (write): fatal: certificate unknown ############# stunnel.conf in Server ############## #chroot = /var/lib/stunnel/ verify = 3 CApath = /etc/stunnel/certdb # or simply use CAfile instead: #CAfile = /etc/stunnel/certs.pem CAfile = /etc/stunnel/acsegurmatica.crt #cert = /etc/stunnel/stunnel.pem cert = /etc/stunnel/certstunnel.pem ################# File in /etc/stunnel ############### certdb morell.pem stunnel.prueba.pem certstunnel.pem stunnel.conf acsegurmatica.crt morell.crt stunnel.log certclient morell.key stunnel.pem ############### Link in /etc/stunnel/certdb ############### drwxr-xr-x 2 root root 176 Feb 25 11:06 . drwx------ 4 root root 472 Feb 25 10:52 .. lrwxrwxrwx 1 root root 24 Feb 25 11:00 2307a3fe.0 -> /etc/stunnel/stunnel.pem lrwxrwxrwx 1 root root 30 Feb 25 11:01 3f5b7ca8.0 -> /etc/stunnel/acsegurmatica.crt lrwxrwxrwx 1 root root 23 Feb 25 11:03 3fb3183e.0 -> /etc/stunnel/morell.pem lrwxrwxrwx 1 root root 28 Feb 25 11:06 d14abd18.0 -> /etc/stunnel/certstunnel.pem ################# client in Windows stunnel.conf ############## client = yes cert = d:\morell.pem debug = 7 output = d:\stunnel.log [lsd] accept = 9595 connect = 10.10.1.83:9500 [ssh] accept = 2222 connect = 10.10.1.83:9522 ##################### Note: I don't use chroot I have try, but idem error with. File morell.pem only client certificate and other time file morell.pem Key private crl Certificate With verify = 2 all is ok Please help Best regards Morell

3 3

stunnel woes under HPUX 10.20
by foner-stunnel＠media.mit.edu 28 Feb '05

28 Feb '05

[Please keep me CC'ed on replies! I'm not on any stunnel lists.] Stunnel 4.07 and 4.08 don't build under HPUX 10.20. 4.06 appears to build, but doesn't appear to work---with a config file like this, running on the local host: pid = /usr/local/var/stunnel/stunnel.pid client = yes foreground = yes # debug = debug [pop3s] accept = 110 connect = our-pop-host:995 ...and an attempt like this, using (for instance) Emacs 21.4a's movemail: movemail po:foner:localhost NEWMAIL [the-password] ...I get an infinite hang. Enabling debugging causes stunnel to spit out an infinite stream of a single line at maximum rate, and seems unaffected by whether I'm trying to connect to it or not: # stunnel test-stunnel.conf 1900.01.00 00:00:00 LOG5[9738:0]: stunnel 4.06 on hppa1.1-hp-hpux10.20 FORK+POLL with OpenSSL 0.9.7e 25 Oct 2004 1900.01.00 00:00:00 LOG7[9738:0]: Snagged 64 random bytes from /users/foner/.rnd 1900.01.00 00:00:00 LOG7[9738:0]: Wrote 1024 new random bytes to /users/foner/.rnd 1900.01.00 00:00:00 LOG7[9738:0]: RAND_status claims sufficient entropy for the PRNG 1900.01.00 00:00:00 LOG6[9738:0]: PRNG seeded successfully 1900.01.00 00:00:00 LOG6[9738:0]: file ulimit = 60 (can be changed with 'ulimit -n') 1900.01.00 00:00:00 LOG6[9738:0]: poll() used - no FD_SETSIZE limit for file descriptors 1900.01.00 00:00:00 LOG5[9738:0]: 27 clients allowed 1900.01.00 00:00:00 LOG7[9738:0]: FD 3 in non-blocking mode 1900.01.00 00:00:00 LOG7[9738:0]: FD 4 in non-blocking mode 1900.01.00 00:00:00 LOG7[9738:0]: FD 5 in non-blocking mode 1900.01.00 00:00:00 LOG7[9738:0]: SO_REUSEADDR option set on accept socket 1900.01.00 00:00:00 LOG7[9738:0]: pop3s bound to 0.0.0.0:110 1900.01.00 00:00:00 LOG7[9738:0]: Created pid file /usr/local/var/stunnel/stunnel.pid 1900.01.00 00:00:00 LOG6[9738:0]: daemon_loop: s_poll_wait: Invalid argument (22) 1900.01.00 00:00:00 LOG6[9738:0]: daemon_loop: s_poll_wait: Invalid argument (22) 1900.01.00 00:00:00 LOG6[9738:0]: daemon_loop: s_poll_wait: Invalid argument (22) 1900.01.00 00:00:00 LOG6[9738:0]: daemon_loop: s_poll_wait: Invalid argument (22) [ . . . and forever more . . . ] I can't imagine that this is supposed to be how debug works, since it's totally useless for debugging if it spits out the same line as fast as it can. I'm running the stunnel as root, and netstat seems to show that it's bound to port 110, but doesn't seem to indicate any outbound connection from stunnel to our pop host after I invoke movemail. I have no idea if versions before 4.06 work; I haven't tried. Sure, this is an old OS, but zillions of other things, including the entire GNU toolchain, seem to work on it, so stunnel should, too. Builds for all three versions I've tried may be found in at the following URLs. Note that 4.07 and 4.08 fail on different files, but in essentially the same way. http://foner.www.media.mit.edu/people/foner/Sys/stunnel-4.06.build http://foner.www.media.mit.edu/people/foner/Sys/stunnel-4.07.build http://foner.www.media.mit.edu/people/foner/Sys/stunnel-4.08.build I've done some websearching, and I've searched the stunnel archives at mirt.net, but haven't found anything relevant. Any clues? Thanks...

5 9

stunnel logging problem
by Brian T 28 Feb '05

28 Feb '05

Hi, I work for a company which has a custom embedded Linux platform, and have been working with stunnel for some time but have never seen this problem. I have seen it with stunnel 4.04 and 4.07, which is compiled on a Redhat 7.2ish platform, but newer SSL libraries. (below my sig is the stunnel info). Basically I use a config file, but when debug= and output= is commented out, stunnel seems to cause a problem which resets the embedded unit. If I uncomment them both and use output=/var/log/stunnel.log ( or /dev/null ) everything works fine. Not sure where to look for the problem that is causing this since I can't even get a core dump. I looged in s_log() but nothing stuck out as being wrong. Thanks for any help you can lend, -Brian [root@JBMgateway-v63 /]# stunnel -version stunnel 4.07 on i486-pc-linux-gnu PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7d 17 Mar 2004 Global options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /etc/stunnel/stunnel.pem pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds [root@JBMgateway-v63 /]# uname -a Linux JBMgateway-v63 2.4.20 #1729 Wed Jan 26 17:38:15 CST 2005 i486 unknown [root@JBMgateway-v63 /]# ls -al /lib/libssl.so.* -rwxr-xr-x 1 root root 210452 Jan 26 18:47 /lib/libssl.so.0.9.7 lrwxrwxrwx 1 root root 20 Jan 26 18:47 /lib/libssl.so.2 -> /lib/libssl.so.0.9.7 [root@JBMgateway-v63 /]# cat /etc/stunnel/stunnel.conf # Some debugging stuff debug = 6 output = /var/log/stunnel.log #output = /dev/null foreground = yes # Use it for client mode client = yes [SampleGroup] accept = 443 connect = x.x.x.x:6660

1 0