- stunnel-users - stunnel.org

Re: [stunnel-users] Stunnel 4.33 last one to work with VM & IMAP
by Michal Trojnara 11 Jan '12

11 Jan '12

Mark Wogahn wrote: > No joy here. The thing that bugs me the most about this problem is > why do stunnel versions after 4.33 work on linux and bsd but not Mac > OS? It looks like Apple has put some serious effort to make its TCP/IP stack incompatible with other operating systems. Here is the the version I successfully tested against Mac OS X 10.5.8 (PowerPC): ftp://ftp.stunnel.org/stunnel/beta/stunnel-4.52b2.tar.gz Mike

1 0

Stunnel 4.33 last one to work with VM & IMAP
by Drew McDermott 11 Jan '12

11 Jan '12

I am running VM 8.1, the Emacs mail reader, connecting via imap to gmail. It can be made to work with stunnel 4.33 providing the encryption, but any version after that causes VM to choke when fetching messages, generating the following error message: vm-imap-protocol-error: IMAP protocol error: "unexpected char (10)" Not being an expert in any of the programs that are chained together to make my e-mail setup work, I was able to trace this no deeper than the point where VM reads the buffer Emacs uses for interprocess communication. Sure enough, there is a linefeed in a place where it isn't expected, but it also happens to be the first character in the sequence: " Process IMAP over SSL finished " which may be there because of problems deeper than the representation of "newline." At the end of this message I give my attempt to represent the complete contents of the buffer with name "trace of IMAP over SSL session to imap.gmail.com." The ^M's were inserted by hand because cutting and pasting didn't seem to reproduce them. I realize that I am providing quite a bit of information from VM, and none from stunnel, which is frustrating in an stunnel forum, but I am a complete newbie regarding stunnel. I would be glad to run further experiments with guidance on how to get stunnel itself to generate more useful information. The only reason I suspect it is that installing version 4.33 fixes the problem; but I realize it may be that VM or some other component is violating the rules somehow. When I say "any version after" 4.33, I mean that I have tried 4.35, the version installed by MacPorts; and 4.49, the latest stable version, recompiled by hand. They behave identically. -- Drew McDermott Professor of Computer Science Yale Computer Science Department The interprocess-communication buffer (everything between the dashes, including the newline after "finished," but not including the newline before "starting"): --------------- starting IMAP over SSL session Tue Nov 29 14:20:01 2011 connecting to imap.gmail.com:993 connected * OK Gimap ready for requests from 128.36.148.241 s17if7011003qao.19 VM CAPABILITY Process IMAP over SSL finished ---------------

2 3

Problem with startup of stunnel
by Villiboy＠web.de 10 Jan '12

10 Jan '12

2 1

stunnel 4.51 released
by Michal Trojnara 09 Jan '12

09 Jan '12

Dear Users, I have released version 4.51 of stunnel. The ChangeLog entry: Version 4.51, 2012.01.09, urgency: MEDIUM: * New features - Updated Win32 binary distribution OpenSSL DLLs to version 0.9.8s-fips. - Updated Android binary OpenSSL to version 1.0.0f. - Zlib support added to Win32 and Android binary builds. - New "compression = deflate" global option to enable RFC 2246 compresion. For compatibility with previous versions "compression = zlib" and "compression = rle" also enable the deflate (RFC 2246) compression. - Separate default ciphers and sslVersion for "fips = yes" and "fips = no". - UAC support for editing configuration file with Windows GUI. * Bugfixes - Fixed exec+connect sections. - Added a workaround for broken Android getaddrinfo(): http://stackoverflow.com/questions/7818246/segmentation-fault-in-getaddrinfo Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.51.tar.gz: dc52b22de48a2d71ab6170adb628dbe05dd406d6c9103fc43fbdbda776c3e90b Best regards, Mike

1 0

Basic initialization failed at gui.cpp, line 842
by K Rasmussen 09 Jan '12

09 Jan '12

Hi I have downloaded and installed: stunnel-4.50-installer.exe stunnel crash with message: Basic initialization failed at gui.cpp, line 842 Adding debug flag in .conf file does not generate any log file. Any suggestions on how to proceed is welcome. Best Regards K Rasmussn

2 1

Stunnel is not working on one computer
by Reuven Sabi 01 Jan '12

01 Jan '12

Hello to all! I have a problem i have installed on my laptop in order to work with one service , i have to say it works like a charm , but it doesn't work on my PC both computers have Windows 7 No firewall in windows No firewall in router I can not understand what is missing , why is it working on what computer and on other is not This is my sunnel.conf client= yes debug= 7 output= stunnel.log [Rates] accept = 127.0.0.1:11009 connect = XXXXXXXXX.com:14009 [Deals] accept = 127.0.0.1:12009 connect = XXXXXXXXX.com:15009 Thanks in advance i appreciate any help.

3 3

Missing bytes?
by Arthur Murray 01 Jan '12

01 Jan '12

Hello, When I telnet to my pop3 server and "QUIT" this is what I see: Escape character is '^]'. +OK InterMail POP3 server ready. QUIT +OK ? InterMail POP3 server signing off. Connection closed by foreign host. When I setup an stunnel 4.5 to the same pop3 server: [pop3s] accept = 995 connect = server:110 and connect with "openssl s_client -connect localhost:995" this is what I see: +OK InterMail POP3 server ready. QUIT DONE And the stunnel log reports: Connection closed: 34 bytes sent to SSL, 0 bytes sent to socket What happened to the last line "+OK ? InterMail POP3 server signing off." and why aren't the counters counting the 5 bytes I sent ("QUIT\n") and the last line of 41 sent over the SSL? Example 2 through stunnel: +OK InterMail POP3 server ready. USER -ERR a user name MUST be entered QUIT DONE Connection closed: 68 bytes sent to SSL, 5 bytes sent to socket (still missing the last bytes)

2 4

Segfault with stunnel
by yassine ayachi 23 Dec '11

23 Dec '11

Hi all, I'am trying to encrypt a connection between two hosts using stunnel. ----- here is my config file ---- cert = /usr/local/etc/stunnel/stunnel.pem chroot = /usr/local/var/lib/stunnel/ setuid = nobody setgid = nogroup pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = debug output = stunnel.log --- [rdps] accept = 1957 connect = remote_machine:3389 Avery think was working fine until I tried to telnet to the port 1957 on the machine running stunnel, the process stunnel was killed alone leaving this in /var/log/messages : Dec 20 16:58:01 alpha kernel: [4930384.164316] stunnel[14540]: segfault at 8 ip b7629b61 sp b758d16c error 6 in libc-2.7.so[b75bd000+138000] Does anybody have an idea about this problem, thanks in advance, Yassine

3 6

Re: [stunnel-users] Configuring VeriSign certificate with STunnel
by Zubair Ali Mansoor 22 Dec '11

22 Dec '11

Hi Guys, Thanks for your replies. I tried following commands on verisign c certificate, for both of these do not work. There is error 'unable to load certificate'. openssl x509 -inform DER -in stunnel.pem -noout -text or openssl x509 -inform PEM -in stunnel.pem -noout -text however if I run same command (openssl x509 -inform PEM -in stunnel.pem -noout -text) on VeriSign root & Intermediate certificate it works. It shows format should be 'pem'. But somehow certificate is not valid. I am using following commands to create csr and private key. Are these correct ? openssl genrsa -des3 -out server.key 2048 openssl req -new -key server.key -out server.csr Thanks, Zubair -----Original Message----- From: stunnel-users-bounces(a)stunnel.org [mailto:[email protected]] On Behalf Of stunnel-users-request(a)stunnel.org Sent: Wednesday, December 21, 2011 9:27 PM To: stunnel-users(a)stunnel.org Subject: stunnel-users Digest, Vol 89, Issue 21 Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit http://stunnel.mirt.net/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. Re: Configuring VeriSign certificate with STunnel (Michal Trojnara) 2. stunnel segfault, please advise (Mehdi Bennani) 3. Re: Configuring VeriSign certificate with STunnel (Ludovic LEVET) 4. Segfault with stunnel (yassine ayachi) 5. Re: Segfault with stunnel (Scott Damron) 6. unsubscribe (Brian McGinity) 7. Re: Missing bytes? (Arthur Murray) 8. Re: Segfault with stunnel (yassine ayachi) ---------------------------------------------------------------------- Message: 1 Date: Wed, 21 Dec 2011 13:30:45 +0100 From: Michal Trojnara <Michal.Trojnara(a)mirt.net> To: <stunnel-users(a)stunnel.org> Subject: Re: [stunnel-users] Configuring VeriSign certificate with STunnel Message-ID: <f039775ca5efe5be73a2858b88f0ebc2(a)mirt.net> Content-Type: text/plain; charset=UTF-8; format=flowed Zubair Ali Mansoor wrote: > 2011.12.21 13:31:30 LOG3[5144:2256]: > SSL_CTX_use_certificate_chain_file: > D0680A8: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong > tag I don't think this problem is specific to stunnel: https://encrypted.google.com/search?q=%22ASN1_CHECK_TLEN%3Awrong+tag%22+veri sign Mike ------------------------------ Message: 2 Date: Wed, 21 Dec 2011 07:34:19 -0500 From: Mehdi Bennani <mehdibennani(a)hotmail.com> To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] stunnel segfault, please advise Message-ID: <SNT134-W33BCBEA69CFD9694C37B7EC3A50(a)phx.gbl> Content-Type: text/plain; charset="iso-8859-1" Hi you guys, I proposed stunnel as a potential solution to our product about 4-5 months ago and I am in the process of testing a prototype I have built around that proposition. I am using stunnel v. 4.41. I am relatively new to stunnel myself. The env. is as follows: We are trying to secure an rdp connection from a java applet running in a web browser into a windows 2008 server machine behind our firewall. Presently, the java applet opens up an RDP connection into a machine (I will call it the SSL machine) where Stunnel is presently installed. Stunnel then forwards properly the incoming traffic (from portA) into its final destination (i.e: the windows Server 2008 machine) on port B. Further, I have configured Stunnel to use an SSL certificate. (Although, I have not been able to test that yet to make sure it works) Anyhow, it is all working as expected and I am pretty happy about the proof of concept. However, while testing it a bit, I noticed that it was relatively easy to bring stunnel down. The way I went about it, was to simply run a "telnet IP_of_MySSLMachine portA" from any DOS command window from any machine with internet access. From the Stunnel logs, I can tell that I get a response from Stunnel and on the DOS window side, I have a cursor waiting for input.... Writing any gibberish into that DOS windows and waiting a little bit makes stunnel stop and die in the SSL machine. I found nothing in the stunnel log, but grepping in the /var/log/, I found the segfault sslmahine:/var/log/# grep stunnel messages kernel: [1996904.624042] stunnel [19696]: segfault at 8 ip b768d361 sp b7601210 error 4 in libc-2.7.so[b7621000+138000] After another telnet execution, few days later: sslmahine:/var/log/# grep stunnel messages kernel: [4930384.164316] stunnel [14540]: segfault at 8 ip b7629b61 error 6 in libc-2.7.so[b75bd000+138000] Basically, if I don't issue that telnet command, stunnel works properly. As soon as I issue that command and start typing few things in that DOS console, stunnel dies. I have to manually restart it. Question: I was wondering if you guys could shed some light into this behavior. Is it a known behavior/bug? Is there a way to solve it by maybe upgrading into a later version of stunnel? Also, I was thinking to block telnet altogether at the firewall level, but then I am not sure what other protocols could people use to hack into the system...so should I block all of them? And, finally is there a more secure way to setup stunnel? Thank you in advance Mehdi/

2 1

building browser like client application based on OpenSSL
by Zubair Ali Mansoor 22 Dec '11

22 Dec '11

Hi, Can I develop an application based on OpenSSL such that it can communicate with all trusted sites ? Like browser can communicates? Actually I have desktop application that uses SSL. Now this application may communicate with any trusted server application. How can I achieve this ? Thanks, Zubair -----Original Message----- From: stunnel-users-bounces(a)stunnel.org [mailto:[email protected]] On Behalf Of stunnel-users-request(a)stunnel.org Sent: Wednesday, December 21, 2011 9:27 PM To: stunnel-users(a)stunnel.org Subject: stunnel-users Digest, Vol 89, Issue 21 Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit http://stunnel.mirt.net/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. Re: Configuring VeriSign certificate with STunnel (Michal Trojnara) 2. stunnel segfault, please advise (Mehdi Bennani) 3. Re: Configuring VeriSign certificate with STunnel (Ludovic LEVET) 4. Segfault with stunnel (yassine ayachi) 5. Re: Segfault with stunnel (Scott Damron) 6. unsubscribe (Brian McGinity) 7. Re: Missing bytes? (Arthur Murray) 8. Re: Segfault with stunnel (yassine ayachi) ---------------------------------------------------------------------- Message: 1 Date: Wed, 21 Dec 2011 13:30:45 +0100 From: Michal Trojnara <Michal.Trojnara(a)mirt.net> To: <stunnel-users(a)stunnel.org> Subject: Re: [stunnel-users] Configuring VeriSign certificate with STunnel Message-ID: <f039775ca5efe5be73a2858b88f0ebc2(a)mirt.net> Content-Type: text/plain; charset=UTF-8; format=flowed Zubair Ali Mansoor wrote: > 2011.12.21 13:31:30 LOG3[5144:2256]: > SSL_CTX_use_certificate_chain_file: > D0680A8: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong > tag I don't think this problem is specific to stunnel: https://encrypted.google.com/search?q=%22ASN1_CHECK_TLEN%3Awrong+tag%22+veri sign Mike ------------------------------ Message: 2 Date: Wed, 21 Dec 2011 07:34:19 -0500 From: Mehdi Bennani <mehdibennani(a)hotmail.com> To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] stunnel segfault, please advise Message-ID: <SNT134-W33BCBEA69CFD9694C37B7EC3A50(a)phx.gbl> Content-Type: text/plain; charset="iso-8859-1" Hi you guys, I proposed stunnel as a potential solution to our product about 4-5 months ago and I am in the process of testing a prototype I have built around that proposition. I am using stunnel v. 4.41. I am relatively new to stunnel myself. The env. is as follows: We are trying to secure an rdp connection from a java applet running in a web browser into a windows 2008 server machine behind our firewall. Presently, the java applet opens up an RDP connection into a machine (I will call it the SSL machine) where Stunnel is presently installed. Stunnel then forwards properly the incoming traffic (from portA) into its final destination (i.e: the windows Server 2008 machine) on port B. Further, I have configured Stunnel to use an SSL certificate. (Although, I have not been able to test that yet to make sure it works) Anyhow, it is all working as expected and I am pretty happy about the proof of concept. However, while testing it a bit, I noticed that it was relatively easy to bring stunnel down. The way I went about it, was to simply run a "telnet IP_of_MySSLMachine portA" from any DOS command window from any machine with internet access. From the Stunnel logs, I can tell that I get a response from Stunnel and on the DOS window side, I have a cursor waiting for input.... Writing any gibberish into that DOS windows and waiting a little bit makes stunnel stop and die in the SSL machine. I found nothing in the stunnel log, but grepping in the /var/log/, I found the segfault sslmahine:/var/log/# grep stunnel messages kernel: [1996904.624042] stunnel [19696]: segfault at 8 ip b768d361 sp b7601210 error 4 in libc-2.7.so[b7621000+138000] After another telnet execution, few days later: sslmahine:/var/log/# grep stunnel messages kernel: [4930384.164316] stunnel [14540]: segfault at 8 ip b7629b61 error 6 in libc-2.7.so[b75bd000+138000] Basically, if I don't issue that telnet command, stunnel works properly. As soon as I issue that command and start typing few things in that DOS console, stunnel dies. I have to manually restart it. Question: I was wondering if you guys could shed some light into this behavior. Is it a known behavior/bug? Is there a way to solve it by maybe upgrading into a later version of stunnel? Also, I was thinking to block telnet altogether at the firewall level, but then I am not sure what other protocols could people use to hack into the system...so should I block all of them? And, finally is there a more secure way to setup stunnel? Thank you in advance Mehdi/

2 2

unsubscribe
by Brian McGinity 21 Dec '11

21 Dec '11

Unsubscribe

1 0

Re: [stunnel-users] Configuring VeriSign certificate with STunnel
by Zubair Ali Mansoor 21 Dec '11

21 Dec '11

Hi, Thanks for your response. Here is log file. 2011.12.21 13:31:30 LOG7[5144:2256]: Snagged 64 random bytes from C:/.rnd 2011.12.21 13:31:30 LOG7[5144:2256]: Wrote 1024 new random bytes to C:/.rnd 2011.12.21 13:31:30 LOG7[5144:2256]: RAND_status claims sufficient entropy for the PRNG 2011.12.21 13:31:30 LOG7[5144:2256]: PRNG seeded successfully 2011.12.21 13:31:30 LOG7[5144:2256]: Certificate: zos.pem 2011.12.21 13:31:30 LOG3[5144:2256]: Error reading certificate file: zos.pem 2011.12.21 13:31:30 LOG3[5144:2256]: error stack: 140DC009 : error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib 2011.12.21 13:31:30 LOG3[5144:2256]: error stack: 906700D : error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1 lib 2011.12.21 13:31:30 LOG3[5144:2256]: error stack: D08303A : error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error 2011.12.21 13:31:30 LOG3[5144:2256]: error stack: D07803A : error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error 2011.12.21 13:31:30 LOG3[5144:2256]: SSL_CTX_use_certificate_chain_file: D0680A8: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag 2011.12.21 13:31:30 LOG3[5144:2256]: Server is down Please let me know if you need further information. Thanks, Zubair -----Original Message----- From: stunnel-users-bounces(a)stunnel.org [mailto:[email protected]] On Behalf Of stunnel-users-request(a)stunnel.org Sent: Wednesday, December 21, 2011 12:56 PM To: stunnel-users(a)stunnel.org Subject: stunnel-users Digest, Vol 89, Issue 18 Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit http://stunnel.mirt.net/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. Unable to make Stunnel on Solaris 10 (ted.pritchard(a)steria.co.uk) 2. Incompatibility between openssl 1.0.0 and 0.9.8 which cause stunnel windows version malfunction. (ayanamist) 3. Configuring VeriSign certificate with STunnel (Zubair Ali Mansoor) 4. Re: Incompatibility between openssl 1.0.0 and 0.9.8 which cause stunnel windows version malfunction. (Ludovic LEVET) 5. Re: Configuring VeriSign certificate with STunnel (Ludovic LEVET) ---------------------------------------------------------------------- Message: 1 Date: Tue, 20 Dec 2011 16:04:08 +0000 From: ted.pritchard(a)steria.co.uk To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Unable to make Stunnel on Solaris 10 Message-ID: <OFBAF4145D.79BD6AD7-ON8025796C.0056E111-8025796C.005844D7(a)xansa.com> Content-Type: text/plain; charset="us-ascii" Hi, I'm trying to compile and install Stunnel 4.47 on a Solaris 10 container. My GCC version is 3.4.3. The problem is that I get the following error during make make gcc:unrecognized option: '-pthread' Should I be able to compile Stunnel using this configuration or is there some option I can use to make it work? For interest, In the past using Stunnel 3.34 I've not had this problem so something in the build process must have changed. Many Thanks Ted This email originates from Steria*. It, and any attachments, may contain confidential information and may be subject to copyright or other intellectual property rights. It is only for the use of the addressee(s). You may not copy, forward, disclose, save or otherwise use it in any way if you are not the addressee(s) or responsible for delivery. If you receive this email by mistake, please advise the sender and cancel it immediately. Steria may monitor the content of emails within its network to ensure compliance with its policies and procedures. Any email is susceptible to alteration and its integrity cannot be assured. Steria shall not be liable if the message is altered, modified, falsified, or edited. _____________________________________________________ * Steria Limited, number 4077975; Steria Recruitment Limited, number 1437998. Registered in England and Wales; registered office Three Cherry Trees Lane, Hemel Hempstead, Hertfordshire HP2 7AH

3 2

stunnel segfault, please advise
by Mehdi Bennani 21 Dec '11

21 Dec '11

Hi you guys, I proposed stunnel as a potential solution to our product about 4-5 months ago and I am in the process of testing a prototype I have built around that proposition. I am using stunnel v. 4.41. I am relatively new to stunnel myself. The env. is as follows: We are trying to secure an rdp connection from a java applet running in a web browser into a windows 2008 server machine behind our firewall. Presently, the java applet opens up an RDP connection into a machine (I will call it the SSL machine) where Stunnel is presently installed. Stunnel then forwards properly the incoming traffic (from portA) into its final destination (i.e: the windows Server 2008 machine) on port B. Further, I have configured Stunnel to use an SSL certificate. (Although, I have not been able to test that yet to make sure it works) Anyhow, it is all working as expected and I am pretty happy about the proof of concept. However, while testing it a bit, I noticed that it was relatively easy to bring stunnel down. The way I went about it, was to simply run a "telnet IP_of_MySSLMachine portA" from any DOS command window from any machine with internet access. From the Stunnel logs, I can tell that I get a response from Stunnel and on the DOS window side, I have a cursor waiting for input.... Writing any gibberish into that DOS windows and waiting a little bit makes stunnel stop and die in the SSL machine. I found nothing in the stunnel log, but grepping in the /var/log/, I found the segfault sslmahine:/var/log/# grep stunnel messages kernel: [1996904.624042] stunnel [19696]: segfault at 8 ip b768d361 sp b7601210 error 4 in libc-2.7.so[b7621000+138000] After another telnet execution, few days later: sslmahine:/var/log/# grep stunnel messages kernel: [4930384.164316] stunnel [14540]: segfault at 8 ip b7629b61 error 6 in libc-2.7.so[b75bd000+138000] Basically, if I don't issue that telnet command, stunnel works properly. As soon as I issue that command and start typing few things in that DOS console, stunnel dies. I have to manually restart it. Question: I was wondering if you guys could shed some light into this behavior. Is it a known behavior/bug? Is there a way to solve it by maybe upgrading into a later version of stunnel? Also, I was thinking to block telnet altogether at the firewall level, but then I am not sure what other protocols could people use to hack into the system...so should I block all of them? And, finally is there a more secure way to setup stunnel? Thank you in advance Mehdi/

1 0

Incompatibility between openssl 1.0.0 and 0.9.8 which cause stunnel windows version malfunction.
by ayanamist 21 Dec '11

21 Dec '11

I generated a pair of key and certificates with openssl 1.0.0d, and use them in stunnel 4.36. Today i upgrade it to stunnel 4.50 and it doesnot work. All configurations remain unmodified. Then i tested many versions and found, stunnel with openssl 1.00 works fine while with openssl 0.98 does not work. I use stunnel with linux server and windows client, stunnel 4.50 windows version is using openssl 0.98, so cause this problem. 4.47 is using 1.00e which i think is newer than 0.98 bundled with 4.50. So why stunnel keep changing openssl version?

3 4

Re: [stunnel-users] Configuring VeriSign certificate with STunnel
by Zubair Ali Mansoor 21 Dec '11

21 Dec '11

Hi, Here are steps how I created certificate request and private key. Generate private key openssl genrsa -des3 -out server.key 2048 Generate certificate request openssl req -new -key server.key -out server.csr I submitted server.csr contents to VeriSign to get test certificate and they provided me three certificates. VeriSign signed certificated Root certificate Intermediate certificate I copied VeriSign signed certificate in stunnel.pem and other two certificates in ca.pem file. As per my observation STunnel is unable to load stunnel.pem file. If you need VeriSign test certificate I can provide you that as well. Please let me know if you need further information. Thanks, Zubair -----Original Message----- From: stunnel-users-bounces(a)stunnel.org [mailto:[email protected]] On Behalf Of stunnel-users-request(a)stunnel.org Sent: Wednesday, December 21, 2011 12:56 PM To: stunnel-users(a)stunnel.org Subject: stunnel-users Digest, Vol 89, Issue 18 Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit http://stunnel.mirt.net/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. Unable to make Stunnel on Solaris 10 (ted.pritchard(a)steria.co.uk) 2. Incompatibility between openssl 1.0.0 and 0.9.8 which cause stunnel windows version malfunction. (ayanamist) 3. Configuring VeriSign certificate with STunnel (Zubair Ali Mansoor) 4. Re: Incompatibility between openssl 1.0.0 and 0.9.8 which cause stunnel windows version malfunction. (Ludovic LEVET) 5. Re: Configuring VeriSign certificate with STunnel (Ludovic LEVET) ---------------------------------------------------------------------- Message: 1 Date: Tue, 20 Dec 2011 16:04:08 +0000 From: ted.pritchard(a)steria.co.uk To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Unable to make Stunnel on Solaris 10 Message-ID: <OFBAF4145D.79BD6AD7-ON8025796C.0056E111-8025796C.005844D7(a)xansa.com> Content-Type: text/plain; charset="us-ascii" Hi, I'm trying to compile and install Stunnel 4.47 on a Solaris 10 container. My GCC version is 3.4.3. The problem is that I get the following error during make make gcc:unrecognized option: '-pthread' Should I be able to compile Stunnel using this configuration or is there some option I can use to make it work? For interest, In the past using Stunnel 3.34 I've not had this problem so something in the build process must have changed. Many Thanks Ted This email originates from Steria*. It, and any attachments, may contain confidential information and may be subject to copyright or other intellectual property rights. It is only for the use of the addressee(s). You may not copy, forward, disclose, save or otherwise use it in any way if you are not the addressee(s) or responsible for delivery. If you receive this email by mistake, please advise the sender and cancel it immediately. Steria may monitor the content of emails within its network to ensure compliance with its policies and procedures. Any email is susceptible to alteration and its integrity cannot be assured. Steria shall not be liable if the message is altered, modified, falsified, or edited. _____________________________________________________ * Steria Limited, number 4077975; Steria Recruitment Limited, number 1437998. Registered in England and Wales; registered office Three Cherry Trees Lane, Hemel Hempstead, Hertfordshire HP2 7AH

1 0

Configuring VeriSign certificate with STunnel
by Zubair Ali Mansoor 21 Dec '11

21 Dec '11

Hi, I got VeriSign Test SSL certificate. I have been trying to configure it with STunnel. But there are errors in STunnel. I have placed private key and CA signed certificate in a separate file named 'stunnel.pem'. Root and Intermediate certificates have been placed in following order in a file named 'ca.pem' stunnel.pem -----BEGIN RSA PRIVATE KEY----- encrypted key -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- VeriSign signed certificate -----END CERTIFICATE----- ca.pem -----BEGIN CERTIFICATE----- VeriSign Intermediate CA Certificate -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- VeriSign Root CA Certificate -----END CERTIFICATE----- Here is stunnel.conf file. ;key = server.key cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile CAfile = ca.pem ;CAfile=zosIntermediate.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 output = stunnel.log ; Use it for client mode client = no I have also tried to change order of certificates but nothing is working. Anyone have idea how it can work. Your cooperation will be highly appreciated. Thanks, Zubair

2 1

Unable to make Stunnel on Solaris 10
by ted.pritchard＠steria.co.uk 20 Dec '11

20 Dec '11

Hi, I'm trying to compile and install Stunnel 4.47 on a Solaris 10 container. My GCC version is 3.4.3. The problem is that I get the following error during make make gcc:unrecognized option: '-pthread' Should I be able to compile Stunnel using this configuration or is there some option I can use to make it work? For interest, In the past using Stunnel 3.34 I've not had this problem so something in the build process must have changed. Many Thanks Ted This email originates from Steria*. It, and any attachments, may contain confidential information and may be subject to copyright or other intellectual property rights. It is only for the use of the addressee(s). You may not copy, forward, disclose, save or otherwise use it in any way if you are not the addressee(s) or responsible for delivery. If you receive this email by mistake, please advise the sender and cancel it immediately. Steria may monitor the content of emails within its network to ensure compliance with its policies and procedures. Any email is susceptible to alteration and its integrity cannot be assured. Steria shall not be liable if the message is altered, modified, falsified, or edited. _____________________________________________________ * Steria Limited, number 4077975; Steria Recruitment Limited, number 1437998. Registered in England and Wales; registered office Three Cherry Trees Lane, Hemel Hempstead, Hertfordshire HP2 7AH

1 0

unsubscribe
by Brian McGinity 16 Dec '11

16 Dec '11

Unsubscribe

1 0

Re: [stunnel-users] Problem with sslv2 clients
by Ludovic LEVET 16 Dec '11

16 Dec '11

Hi, Normal, SSLv2 is disable by default since version 4.40. (http://www.stunnel.org/?page=sdf_ChangeLog) To re-enable it add in your config file : ciphers = ALL:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH (or other) and sslVersion = all Ludovic. > > > > Le 09/12/2011 15:37, Markus Borst a écrit : >> Hi, >> >> we have a strange problem with newer stunnel versions (4.50 on >> windows), compared to older ones (known to work is version 4.35). The >> problem seems to be, that if a client sends a SSLv2 Helo message, the >> stunnel server simply resets the TCP connection, without trying to >> negotioate anything. >> >> Setup: Stunnel is used top provide ssl/tls for imap, Hobbit is used >> to monitor service availability. The Hobbit module to monitor imaps >> seems to try SSLv2 first, but also supports newer versions (SSLv3 and >> TLSv1). The ssl connection never gets established, stunnel sends a >> tcp RST, hobbit never retries. We can force some hobbit modules to >> use TLSv1 exclusively, but not all of them. We fear that some older >> mailclients will also have problems initiating a connection, so we >> keep stunnel 4.35 running for now. >> >> stunnel.conf: >> >> fips = no >> debug = 7 >> output = stunnel.log >> >> [imaps] >> accept = 130.83.174.1:993 >> connect = 127.0.0.1:143 >> cert = imap.xxx.company.yy.pem >> >> >> stunnel.log: >> >> 2011.12.09 14:55:12 LOG5[6820:2144]: Service imaps accepted >> connection from xxx.yyy.zzz.105:45294 >> 2011.12.09 14:55:12 LOG3[6820:2144]: SSL_accept: 1408F10B: >> error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number >> 2011.12.09 14:55:12 LOG5[6820:2144]: Connection reset: 0 bytes sent >> to SSL, 0 bytes sent to socket >> 2011.12.09 14:55:12 LOG7[6820:2144]: Service imaps finished (0 left) >> 2011.12.09 14:55:12 LOG7[6820:2144]: str_stats: 0 block(s), 0 data >> byte(s), 0 control byte(s) >> >> >> >> Wireshark Packet Trace (see attached image). >> >> >> What's wrong here? Shouldn't client and server negotiate the methods >> used? The client seems to offer TLS ("Version: TLS 1.0 ..."), but >> instead of negotiating, the server simply closes the connection. >> >> >> Greetings >> Markus Borst >> >

4 6

Multiple Domains for https
by Brian McGinity 15 Dec '11

15 Dec '11

Will Stunnel work with multiple domains? For example if abc.com and xyz.com both resolve to the same ip address where the web server is running locally on port 4080. Going when to https://abc.com or https://xyz.com stunnel will encrypt the traffic and forward to the local 4080 port in the clear. What if 10 or 20 domains needed to be served by the same web server?

2 3

Reload/change CRL?
by John Abloyer 15 Dec '11

15 Dec '11

Hi, Is there a way to reload CRL, or actually change to a newer, *without* restarting stunnel?

2 1

Is Stunnel Right Tool for....?
by Brian McGinity 14 Dec '11

14 Dec '11

Is Stunnel the right tool for this situation? I am using an Intel disk monitoring tool which has the ability to send out email alerts. In the Email Setup it asks for Host, From and To, there is not a username or pw. Could Stunnel be configured to add the username and pw and send the message to gmail's smtp?

2 1

stunnel-4.50 on Nexus S android
by Jason Haar 14 Dec '11

14 Dec '11

Hi there I'm trying out the stunnel android binary from 4.50 on a rooted 2.3.6 Android, mapping localhost port 80 to a remote client-cert protected ActiveSync server. It crashes after a client makes a connection. Here's the "debug = 7" logs 2011.12.14 07:44:55 LOG7[8738:2949960768]: Private key loaded 2011.12.14 07:44:55 LOG7[8738:2949960768]: SSL options set: 0x00000004 2011.12.14 07:44:55 LOG6[8738:2949960768]: SSL context initialized 2011.12.14 07:44:55 LOG5[8738:2949960768]: Configuration successful 2011.12.14 07:44:55 LOG7[8738:2949960768]: Option SO_REUSEADDR set on accept socket 2011.12.14 07:44:55 LOG7[8738:2949960768]: Service ActiveSync bound to 0.0.0.0:80 2011.12.14 07:44:55 LOG7[8738:2949960768]: Service ActiveSync opened FD=5 2011.12.14 07:44:55 LOG7[8738:2949960768]: Created pid file /data/local/etc/stunnel/pid 2011.12.14 07:44:59 LOG7[8738:2949960768]: Service ActiveSync accepted FD=6 from 127.0.0.1:58088 2011.12.14 07:44:59 LOG7[8738:1525312]: Service ActiveSync started 2011.12.14 07:44:59 LOG7[8738:1525312]: Option TCP_NODELAY set on local socket ...[I do "telnet 127.0.0.1 80" ] 2011.12.14 07:44:59 LOG5[8738:1525312]: Service ActiveSync accepted connection from 127.0.0.1:58088 Segmentation fault Any ideas how to debug this? I basically grabbed a working config off my Linux laptop and moved it over (different paths of course), so I assume the binary is missing something? -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +1 408 481 8171 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

2 1

unsubscribe
by Brian McGinity 13 Dec '11

13 Dec '11

Unsubscribe

1 0

SSL alert (write): fatal: protocol version
by René Legault 13 Dec '11

13 Dec '11

Hi, I have an issue when using Stunnel. Can somebody help me? I have a module on my network that sends non-SSL e-mail but my ISP (Sympatico.ca) is accepting only SSL communication. This is my stunnel.conf file: cert = stunnel.pem protocol = smtp ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [smtp] accept=192.168.1.17:25 connect = smtphm.sympatico.ca:25 And this is my log: 2011.12.13 19:55:06 LOG7[2468:1644]: Service smtp accepted FD=316 from 192.168.1.200:12149 2011.12.13 19:55:06 LOG7[2468:1644]: Creating a new thread 2011.12.13 19:55:06 LOG7[2468:1644]: New thread created 2011.12.13 19:55:06 LOG7[2468:2684]: Service smtp started 2011.12.13 19:55:06 LOG5[2468:2684]: Service smtp accepted connection from 192.168.1.200:12149 2011.12.13 19:55:06 LOG6[2468:2684]: connect_blocking: connecting 65.55.172.251:25 2011.12.13 19:55:06 LOG7[2468:2684]: connect_blocking: s_poll_wait 65.55.172.251:25: waiting 10 seconds 2011.12.13 19:55:06 LOG5[2468:2684]: connect_blocking: connected 65.55.172.251:25 2011.12.13 19:55:06 LOG5[2468:2684]: Service smtp connected remote server from 192.168.1.17:3013 2011.12.13 19:55:06 LOG7[2468:2684]: Remote FD=392 initialized 2011.12.13 19:55:06 LOG6[2468:2684]: Client-mode smtp protocol negotiations started 2011.12.13 19:55:06 LOG7[2468:2684]: <- 220 BLU0-SMTP6.phx.gbl Microsoft ESMTP MAIL Service, Version: 6.0.3790.4675 ready at Tue, 13 Dec 2011 16:55:06 -0800 2011.12.13 19:55:06 LOG7[2468:2684]: -> 220 BLU0-SMTP6.phx.gbl Microsoft ESMTP MAIL Service, Version: 6.0.3790.4675 ready at Tue, 13 Dec 2011 16:55:06 -0800 2011.12.13 19:55:06 LOG7[2468:2684]: -> EHLO localhost 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-BLU0-SMTP6.phx.gbl Hello [65.94.163.170] 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-TURN 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-SIZE 41943040 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-ETRN 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-PIPELINING 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-DSN 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-ENHANCEDSTATUSCODES 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-8bitmime 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-BINARYMIME 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-CHUNKING 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-VRFY 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-TLS 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-STARTTLS 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250 OK 2011.12.13 19:55:06 LOG7[2468:2684]: -> STARTTLS 2011.12.13 19:55:06 LOG7[2468:2684]: <- 220 2.0.0 SMTP server ready 2011.12.13 19:55:06 LOG6[2468:2684]: Client-mode smtp protocol negotiations succeeded 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): before/connect initialization 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): SSLv3 write client hello A 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): SSLv3 read server hello A 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): SSLv3 read server certificate A 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): SSLv3 read server done A 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): SSLv3 write client key exchange A 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): SSLv3 write change cipher spec A 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): SSLv3 write finished A 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): SSLv3 flush data 2011.12.13 19:55:07 LOG7[2468:2684]: SSL state (connect): SSLv3 read finished A 2011.12.13 19:55:07 LOG7[2468:2684]: 1 items in the session cache 2011.12.13 19:55:07 LOG7[2468:2684]: 86477 client connects (SSL_connect()) 2011.12.13 19:55:07 LOG7[2468:2684]: 86477 client connects that finished 2011.12.13 19:55:07 LOG7[2468:2684]: 0 client renegotiations requested 2011.12.13 19:55:07 LOG7[2468:2684]: 0 server connects (SSL_accept()) 2011.12.13 19:55:07 LOG7[2468:2684]: 0 server connects that finished 2011.12.13 19:55:07 LOG7[2468:2684]: 0 server renegotiations requested 2011.12.13 19:55:07 LOG7[2468:2684]: 0 session cache hits 2011.12.13 19:55:07 LOG7[2468:2684]: 0 external session cache hits 2011.12.13 19:55:07 LOG7[2468:2684]: 0 session cache misses 2011.12.13 19:55:07 LOG7[2468:2684]: 0 session cache timeouts 2011.12.13 19:55:07 LOG6[2468:2684]: SSL connected: new session negotiated 2011.12.13 19:55:07 LOG6[2468:2684]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2011.12.13 19:55:07 LOG6[2468:2684]: Compression: null, expansion: null 2011.12.13 19:55:07 LOG7[2468:2684]: SSL alert (write): fatal: protocol version 2011.12.13 19:55:07 LOG3[2468:2684]: SSL_read: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2011.12.13 19:55:07 LOG5[2468:2684]: Connection reset: 19 bytes sent to SSL, 219 bytes sent to socket 2011.12.13 19:55:07 LOG7[2468:2684]: Service smtp finished (0 left) 2011.12.13 19:55:07 LOG7[2468:2684]: str_stats: 16 block(s), 353 data byte(s), 544 control byte(s) What am I doing wrong? Thanks Rene

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users