- stunnel-users - stunnel.org

Re: [stunnel-users] Dynamic hosts
by Ludolf Holzheid 23 Jun '09

23 Jun '09

On Tue, 2009-06-23 08:13:08 -0400, Terry Riegel wrote: > Take a look at mail2web.com > > You type in your server, it dynamically connects secure or otherwise. Ah, o.k. you want to use stunnel from inside a CGI. You could have the CGI dynamically write the stunnel configuration file then. Maybe you should specify 'foreground = yes' in order to avoid detaching to the background and to get stunnel's log messages written to the web server log. This depends on the CGI, of course. Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Dynamic hosts
by Terry Riegel 23 Jun '09

23 Jun '09

Hello, I have just set up stunnel to allow unsecured client pop3 connections to my secured pop3 server chroot = /stunnel/ pid = /stunnel.pid setuid = www setgid = www client = yes foreground=yes [995] accept = localhost:10110 connect = mail.clearimageonline.com:995 And it works as expected. Is there a way to set it up so it can dynamically connect to any server. Something like... connect = *:995 I was able to start a new instance of stunnel with a separate config file but this seems inefficient as it starts up 6 processes each time. What I would like to do is dynamically add/subtract servers that it can connect to. My goal here is to build a webmail client that can use stunnel to do the secure connections to either POP or IMAP servers. My client software uses unsecured sockets. Any help would be greatly appreciated. Terry Riegel

2 1

Install, Starting & Using Stunnel on OS X (more)
by m i l e s 20 Jun '09

20 Jun '09

Hi, I forgot a few things in my last msg, that were implied but not explicitly stated. 1.) I downloaded and installed stunnel-4.27. 2.) Im not running darwin ports. 3.) When I installed I entered the commands on the command line without ever touching xCode. 4.) I am running MAC OS 10.5.7. I will have to do a later install on MAC OS 10.4.11. 5.) I need to connect my laptop (test machine) to an ldap server. The ldap server is NOT running stunnel, and I have no control over the ldap server. I am wanting to create a secure connection from my machine to the target server. +++++++++++++++++++++ Previous Msg Below. +++++++++++++++++++++ Hi I'm a newbie to stunnel. I have a couple of questions....ok, a zillion. However I'll stick to the basics. I found this in the archives that apply to my situation: http://marc.info/?l=stunnel-users&m=121848237124000&w=2 I followed those instructions that Tom Shaw gave, and I can't tell whether or not this thing is installed at all. http://marc.info/?l=stunnel-users&m=121848703131936&w=2 I think that the files are in the right places. And now when I type in stunnel on the command line, I get this as a response: 2009.06.20 12:27:37 LOG7[582:2691602208]: Snagged 64 random bytes from /Users/miles/.rnd 2009.06.20 12:27:37 LOG7[582:2691602208]: Wrote 1024 new random bytes to /Users/miles/.rnd 2009.06.20 12:27:37 LOG7[582:2691602208]: RAND_status claims sufficient entropy for the PRNG 2009.06.20 12:27:37 LOG7[582:2691602208]: PRNG seeded successfully 2009.06.20 12:27:37 LOG3[582:2691602208]: stunnel.pem: No such file or directory (2) I suppose that's an improvement over the command line returning no response for stunnel. So I guess it installed. I have a feeling that the config file (the sample that came with) is what's causing it to respond the way that it is... However, I also see that its throwing an error about the PEM file, that it thinks that its not there. Is there any way to check to see if its pointing at the right file for the pem ? Or to use another crt file ? Now the question becomes how the hell do I start this thing ? (I'm running leopard [10.5.7] for test purposes, but I'll have to do this all over again for a tiger install [10.4.11]...) Then once I get it started, how the hell do I initiate what needs doing ? I tried this ->> stunnel -o /Users/Miles/config.lgo -c -d 80 -r 134.84.119.230:636 Which returns -> 2009.06.20 13:34:32 LOG3[738:2691602208]: -o: No such file or directory (2) Obviously its yapping about a file, in this case I'm assuming the log file where its being referenced. Here's what I'm trying to do: I'm trying to set up a secure tunnel to an ldap server at umn.edu. I got this to work a while back but now I have to set this up from scratch....it was set up for me the last time. I wasn't paying attention and now Im kicking myself. The example I post is running in client mode and not server mode ? I was looking at THIS page: http://radio.weblogs.com/0100683/stories/2002/03/23/settingUpStunnelUnderMa… I'm not entirely certain that what I want to do is run in client mode given what I'm wanting to do... Any help would be a great relief. Thanks ahead of time... Sincerely, Miles.

2 4

Install, Starting & Using Stunnel on OS X.
by m i l e s 20 Jun '09

20 Jun '09

Hi I'm a newbie to stunnel. I have a couple of questions....ok, a zillion. However I'll stick to the basics. I found this in the archives that apply to my situation: http://marc.info/?l=stunnel-users&m=121848237124000&w=2 I followed those instructions that Tom Shaw gave, and I can't tell whether or not this thing is installed at all. http://marc.info/?l=stunnel-users&m=121848703131936&w=2 I think that the files are in the right places. And now when I type in stunnel on the command line, I get this as a response: 2009.06.20 12:27:37 LOG7[582:2691602208]: Snagged 64 random bytes from /Users/miles/.rnd 2009.06.20 12:27:37 LOG7[582:2691602208]: Wrote 1024 new random bytes to /Users/miles/.rnd 2009.06.20 12:27:37 LOG7[582:2691602208]: RAND_status claims sufficient entropy for the PRNG 2009.06.20 12:27:37 LOG7[582:2691602208]: PRNG seeded successfully 2009.06.20 12:27:37 LOG3[582:2691602208]: stunnel.pem: No such file or directory (2) I suppose that's an improvement over the command line returning no response for stunnel. So I guess it installed. I have a feeling that the config file (the sample that came with) is what's causing it to respond the way that it is... However, I also see that its throwing an error about the PEM file, that it thinks that its not there. Is there any way to check to see if its pointing at the right file for the pem ? Or to use another crt file ? Now the question becomes how the hell do I start this thing ? (I'm running leopard [10.5.7] for test purposes, but I'll have to do this all over again for a tiger install [10.4.11]...) Then once I get it started, how the hell do I initiate what needs doing ? I tried this ->> stunnel -o /Users/Miles/config.lgo -c -d 80 -r 134.84.119.230:636 Which returns -> 2009.06.20 13:34:32 LOG3[738:2691602208]: -o: No such file or directory (2) Obviously its yapping about a file, in this case I'm assuming the log file where its being referenced. Here's what I'm trying to do: I'm trying to set up a secure tunnel to an ldap server at umn.edu. I got this to work a while back but now I have to set this up from scratch....it was set up for me the last time. I wasn't paying attention and now Im kicking myself. The example I post is running in client mode and not server mode ? I was looking at THIS page: http://radio.weblogs.com/0100683/stories/2002/03/23/settingUpStunnelUnderMa… I'm not entirely certain that what I want to do is run in client mode given what I'm wanting to do... Any help would be a great relief. Thanks ahead of time... Sincerely, Miles.

1 0

Re: [stunnel-users] 4.26 works OK, 4.27 will not POP email
by Jeff Salisbury 17 Jun '09

17 Jun '09

Guy, Your suggestion fixed the problem. Thank you! Regards, Jeff Guy wrote: > Jeff Salisbury wrote: > > >> Greetings, We have been using Stunnel 4.26 to facilitate the >> sending and receiving of email with an email client that is not >> SSL enabled. Version 4.26 has been working great. However, when >> we upgrade to 4.27, we are unable to POP email (we can send >> email). We did not change our Stunnel.conf file. >> >> Can anyone advise us what we need to do to get 4.27 working? >> I've included our Stunnel.conf file contents, and the Stunnel log >> output below. >> >> > > > > Try: sslVersion = TLSv1 > > > See below. > > > > Your Modified Configuration File: > > ##### > # GLOBAL OPTIONS > > client = yes > #output = C:\Documents and Settings\All Users\Application Data\stunnel-log.txt > debug = 7 > taskbar = yes > > sslVersion = TLSv1 > > # SERVICE-LEVEL OPTIONS > > [pop3] > accept=995 > connect=mail.OurPOP.com:995 > > [smtp] > accept=465 > connect=mail.OurSMTP.com:465 > # > ##### > > > > Configuration File Used: > > ##### > # > client = yes > debug = debug > output = _test.log > rndbytes = 256 > rndfile = t:\tmp\randseed.bin > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > > sslVersion = TLSv1 > > [YOUR-POP3S] > accept=TUNNEL-01:110 > connect=216.97.239.60:995 > > [YOUR-SMTPS] > accept=TUNNEL-01:25 > connect=216.97.239.60:465 > # > ##### > > > > Stunnel Debug Output Log: > > Snagged 256 random bytes from t:\tmp\randseed.bin > Wrote 1024 new random bytes to t:\tmp\randseed.bin > RAND_status claims sufficient entropy for the PRNG > PRNG seeded successfully > SSL context initialized for service YOUR-POP3S > SSL context initialized for service YOUR-SMTPS > stunnel 4.27 on x86-pc-mingw32-gnu with OpenSSL 0.9.8k 25 Mar 2009 > Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 > No limit detected for the number of clients > FD 1884 in non-blocking mode > SO_REUSEADDR option set on accept socket > YOUR-POP3S bound to 127.0.10.1:110 > FD 1876 in non-blocking mode > SO_REUSEADDR option set on accept socket > YOUR-SMTPS bound to 127.0.10.1:25 > YOUR-POP3S accepted FD=1860 from 127.0.10.1:1599 > Creating a new thread > New thread created > YOUR-POP3S started > FD 1860 in non-blocking mode > TCP_NODELAY option set on local socket > YOUR-POP3S accepted connection from 127.0.10.1:1599 > FD 1836 in non-blocking mode > connect_blocking: connecting 216.97.239.60:995 > connect_blocking: s_poll_wait 216.97.239.60:995: waiting 10 seconds > connect_blocking: connected 216.97.239.60:995 > YOUR-POP3S connected remote server from 10.10.10.10:1600 > Remote FD=1836 initialized > TCP_NODELAY option set on remote socket > SSL state (connect): before/connect initialization > SSL state (connect): SSLv3 write client hello A > SSL state (connect): SSLv3 read server hello A > SSL state (connect): SSLv3 read server certificate A > SSL state (connect): SSLv3 read server done A > SSL state (connect): SSLv3 write client key exchange A > SSL state (connect): SSLv3 write change cipher spec A > SSL state (connect): SSLv3 write finished A > SSL state (connect): SSLv3 flush data > SSL state (connect): SSLv3 read finished A > 1 items in the session cache > 1 client connects (SSL_connect()) > 1 client connects that finished > 0 client renegotiations requested > 0 server connects (SSL_accept()) > 0 server connects that finished > 0 server renegotiations requested > 0 session cache hits > 0 session cache misses > 0 session cache timeouts > SSL connected: new session negotiated > Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 > Socket closed on read > SSL write shutdown > SSL alert (write): warning: close notify > SSL socket closed on SSL_shutdown > Socket write shutdown > Connection closed: 49 bytes sent to SSL, 90 bytes sent to socket > YOUR-POP3S finished (0 left) > YOUR-SMTPS accepted FD=1844 from 127.0.10.1:1601 > Creating a new thread > New thread created > YOUR-SMTPS started > FD 1844 in non-blocking mode > TCP_NODELAY option set on local socket > YOUR-SMTPS accepted connection from 127.0.10.1:1601 > FD 1836 in non-blocking mode > connect_blocking: connecting 216.97.239.60:465 > connect_blocking: s_poll_wait 216.97.239.60:465: waiting 10 seconds > connect_blocking: connected 216.97.239.60:465 > YOUR-SMTPS connected remote server from 10.10.10.10:1602 > Remote FD=1836 initialized > TCP_NODELAY option set on remote socket > SSL state (connect): before/connect initialization > SSL state (connect): SSLv3 write client hello A > SSL state (connect): SSLv3 read server hello A > SSL state (connect): SSLv3 read server certificate A > SSL state (connect): SSLv3 read server done A > SSL state (connect): SSLv3 write client key exchange A > SSL state (connect): SSLv3 write change cipher spec A > SSL state (connect): SSLv3 write finished A > SSL state (connect): SSLv3 flush data > SSL state (connect): SSLv3 read finished A > 1 items in the session cache > 1 client connects (SSL_connect()) > 1 client connects that finished > 0 client renegotiations requested > 0 server connects (SSL_accept()) > 0 server connects that finished > 0 server renegotiations requested > 0 session cache hits > 0 session cache misses > 0 session cache timeouts > SSL connected: new session negotiated > Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 > Socket closed on read > SSL write shutdown > SSL alert (write): warning: close notify > SSL socket closed on SSL_shutdown > Socket write shutdown > Connection closed: 78 bytes sent to SSL, 423 bytes sent to socket > YOUR-SMTPS finished (0 left) > > > > POP3 Transaction Log: > > CONNECT : Looking up host name TUNNEL-01... > CONNECT : Host name TUNNEL-01 found > CONNECT : Connecting to host TUNNEL-01 [127.0.10.1:110]... > CONNECT : Connected to host TUNNEL-01 [127.0.10.1:110] > POP REPLY : +OK Hello there. > POP SEND : USER username > POP REPLY : +OK Password required. > POP SEND : PASS ********** > POP REPLY : -ERR Login failed. > POP SEND : QUIT > POP REPLY : +OK Better luck next time. > DISCONNECT: Disconnected from server > > > > SMTP Transaction Log: > > CONNECT : Looking up host name TUNNEL-01... > CONNECT : Host name TUNNEL-01 found > CONNECT : Connecting to host TUNNEL-01 [127.0.10.1:25]... > CONNECT : Connected to host TUNNEL-01 [127.0.10.1:25] > SMTP REPLY: 220-crimson.lunarbreeze.com ESMTP Exim 4.69 #1 Tue, 16 Jun 2009 14:45:25 -0700 > SMTP SEND : EHLO computername > SMTP REPLY: 250-crimson.lunarbreeze.com Hello 123,123.123.123 [123,123.123.123] > SMTP REPLY: 250-SIZE 52428800 > SMTP REPLY: 250-PIPELINING > SMTP REPLY: 250-AUTH PLAIN LOGIN > SMTP REPLY: 250 HELP > SMTP SEND : AUTH PLAIN xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx== > SMTP REPLY: 535 Incorrect authentication data > SMTP SEND : QUIT > SMTP REPLY: 221 crimson.lunarbreeze.com closing connection > DISCONNECT: Disconnected from server > >

1 0

4.26 works OK, 4.27 will not POP email
by Jeff Salisbury 14 Jun '09

14 Jun '09

Greetings, We have been using Stunnel 4.26 to facilitate the sending and receiving of email with an email client that is not SSL enabled. Version 4.26 has been working great. However, when we upgrade to 4.27, we are unable to POP email (we can send email). We did not change our Stunnel.conf file. Can anyone advise us what we need to do to get 4.27 working? I've included our Stunnel.conf file contents, and the Stunnel log output below. Regards, Jeff ===================================================== # GLOBAL OPTIONS client = yes #output = C:\Documents and Settings\All Users\Application Data\stunnel-log.txt debug = 7 taskbar = yes # SERVICE-LEVEL OPTIONS [pop3] accept=995 connect=mail.OurPOP.com:995 [smtp] accept=465 connect=mail.OurSMTP.com:465 ===================================================== 2009.06.14 14:03:03 LOG7[3348:540]: RAND_status claims sufficient entropy for the PRNG 2009.06.14 14:03:03 LOG7[3348:540]: PRNG seeded successfully 2009.06.14 14:03:03 LOG7[3348:540]: SSL context initialized for service pop3 2009.06.14 14:03:03 LOG7[3348:540]: SSL context initialized for service smtp 2009.06.14 14:03:03 LOG5[3348:540]: stunnel 4.27 on x86-pc-mingw32-gnu with OpenSSL 0.9.8k 25 Mar 2009 2009.06.14 14:03:03 LOG5[3348:540]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2009.06.14 14:03:03 LOG5[3348:3668]: No limit detected for the number of clients 2009.06.14 14:03:03 LOG7[3348:3668]: FD 204 in non-blocking mode 2009.06.14 14:03:03 LOG7[3348:3668]: SO_REUSEADDR option set on accept socket 2009.06.14 14:03:03 LOG7[3348:3668]: pop3 bound to 0.0.0.0:995 2009.06.14 14:03:03 LOG7[3348:3668]: FD 212 in non-blocking mode 2009.06.14 14:03:03 LOG7[3348:3668]: SO_REUSEADDR option set on accept socket 2009.06.14 14:03:03 LOG7[3348:3668]: smtp bound to 0.0.0.0:465 2009.06.14 14:03:11 LOG7[3348:3668]: pop3 accepted FD=228 from 127.0.0.1:2027 2009.06.14 14:03:11 LOG7[3348:3668]: Creating a new thread 2009.06.14 14:03:11 LOG7[3348:3668]: New thread created 2009.06.14 14:03:11 LOG7[3348:3668]: pop3 accepted FD=244 from 127.0.0.1:2026 2009.06.14 14:03:11 LOG7[3348:3668]: Creating a new thread 2009.06.14 14:03:11 LOG7[3348:3668]: New thread created 2009.06.14 14:03:11 LOG7[3348:1144]: pop3 started 2009.06.14 14:03:11 LOG7[3348:1144]: FD 228 in non-blocking mode 2009.06.14 14:03:11 LOG5[3348:1144]: pop3 accepted connection from 127.0.0.1:2027 2009.06.14 14:03:11 LOG7[3348:1144]: FD 268 in non-blocking mode 2009.06.14 14:03:11 LOG6[3348:1144]: connect_blocking: connecting 216.97.239.60:995 2009.06.14 14:03:11 LOG7[3348:4060]: pop3 started 2009.06.14 14:03:11 LOG7[3348:4060]: FD 244 in non-blocking mode 2009.06.14 14:03:11 LOG5[3348:4060]: pop3 accepted connection from 127.0.0.1:2026 2009.06.14 14:03:11 LOG7[3348:4060]: FD 280 in non-blocking mode 2009.06.14 14:03:11 LOG6[3348:4060]: connect_blocking: connecting 216.97.239.60:995 2009.06.14 14:03:11 LOG7[3348:1144]: connect_blocking: s_poll_wait 216.97.239.60:995: waiting 10 seconds 2009.06.14 14:03:11 LOG7[3348:4060]: connect_blocking: s_poll_wait 216.97.239.60:995: waiting 10 seconds 2009.06.14 14:03:11 LOG5[3348:1144]: connect_blocking: connected 216.97.239.60:995 2009.06.14 14:03:11 LOG5[3348:1144]: pop3 connected remote server from 192.168.0.55:2028 2009.06.14 14:03:11 LOG7[3348:1144]: Remote FD=268 initialized 2009.06.14 14:03:11 LOG7[3348:1144]: SSL state (connect): before/connect initialization 2009.06.14 14:03:11 LOG7[3348:1144]: SSL state (connect): SSLv3 write client hello A 2009.06.14 14:03:11 LOG5[3348:4060]: connect_blocking: connected 216.97.239.60:995 2009.06.14 14:03:11 LOG5[3348:4060]: pop3 connected remote server from 192.168.0.55:2029 2009.06.14 14:03:11 LOG7[3348:4060]: Remote FD=280 initialized 2009.06.14 14:03:11 LOG7[3348:4060]: SSL state (connect): before/connect initialization 2009.06.14 14:03:11 LOG7[3348:4060]: SSL state (connect): SSLv3 write client hello A 2009.06.14 14:03:11 LOG7[3348:1144]: SSL alert (read): fatal: handshake failure 2009.06.14 14:03:11 LOG3[3348:1144]: SSL_connect: 14094410: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure 2009.06.14 14:03:11 LOG5[3348:1144]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.06.14 14:03:11 LOG7[3348:1144]: pop3 finished (1 left) 2009.06.14 14:03:11 LOG7[3348:4060]: SSL alert (read): fatal: handshake failure 2009.06.14 14:03:11 LOG3[3348:4060]: SSL_connect: 14094410: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure 2009.06.14 14:03:11 LOG5[3348:4060]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.06.14 14:03:11 LOG7[3348:4060]: pop3 finished (0 left)

1 0

Silence after "Acquired libwrap process"
by James Brown 11 Jun '09

11 Jun '09

I'm trying to use stunnel to send email with SSL authentication. Sending the email with Apple's Mail.app with 'use default ports' selected. stunnel.log output: 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Snagged 64 random bytes from /Users/jlbrown/.rnd 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Wrote 1024 new random bytes to /Users/jlbrown/.rnd 2009.06.12 09:58:17 LOG7[41897:140735078037248]: RAND_status claims sufficient entropy for the PRNG 2009.06.12 09:58:17 LOG7[41897:140735078037248]: PRNG seeded successfully 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Certificate: /etc/ postfix/smtpd.cert 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Certificate loaded 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Key file: /etc/ postfix/smtpd.key 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Private key loaded 2009.06.12 09:58:17 LOG7[41897:140735078037248]: SSL context initialized for service ssmtp 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Certificate: /etc/ postfix/smtpd.cert 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Certificate loaded 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Key file: /etc/ postfix/smtpd.key 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Private key loaded 2009.06.12 09:58:17 LOG7[41897:140735078037248]: SSL context initialized for service ssmtp2 2009.06.12 09:58:17 LOG5[41897:140735078037248]: stunnel 4.27 on i686- apple-darwin9.7.0 with OpenSSL 0.9.7l 28 Sep 2006 2009.06.12 09:58:17 LOG5[41897:140735078037248]: Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv6 Auth:LIBWRAP 2009.06.12 09:58:17 LOG6[41897:140735078037248]: file ulimit = 256 (can be changed with 'ulimit -n') 2009.06.12 09:58:17 LOG6[41897:140735078037248]: FD_SETSIZE = 1024 (some systems allow to increase this value) 2009.06.12 09:58:17 LOG5[41897:140735078037248]: 125 clients allowed 2009.06.12 09:58:17 LOG7[41897:140735078037248]: FD 10 in non-blocking mode 2009.06.12 09:58:17 LOG7[41897:140735078037248]: FD 11 in non-blocking mode 2009.06.12 09:58:17 LOG7[41897:140735078037248]: FD 12 in non-blocking mode 2009.06.12 09:58:17 LOG7[41897:140735078037248]: SO_REUSEADDR option set on accept socket 2009.06.12 09:58:17 LOG7[41897:140735078037248]: ssmtp bound to 0.0.0.0:465 2009.06.12 09:58:17 LOG7[41897:140735078037248]: FD 13 in non-blocking mode 2009.06.12 09:58:17 LOG7[41897:140735078037248]: SO_REUSEADDR option set on accept socket 2009.06.12 09:58:17 LOG7[41897:140735078037248]: ssmtp2 bound to 0.0.0.0:587 2009.06.12 09:58:17 LOG7[41903:140735078037248]: Created pid file /usr/ local/var/run/stunnel/stunnel.pid 2009.06.12 09:58:56 LOG7[41903:140735078037248]: ssmtp2 accepted FD=14 from 192.168.1.10:64996 2009.06.12 09:58:56 LOG7[41903:4295561216]: ssmtp2 started 2009.06.12 09:58:56 LOG7[41903:4295561216]: FD 14 in non-blocking mode 2009.06.12 09:58:56 LOG7[41903:4295561216]: TCP_NODELAY option set on local socket 2009.06.12 09:58:56 LOG7[41903:4295561216]: Waiting for a libwrap process 2009.06.12 09:58:56 LOG7[41903:4295561216]: Acquired libwrap process #0 2009.06.12 10:00:04 LOG7[41903:140735078037248]: ssmtp2 accepted FD=15 from 192.168.1.10:65006 2009.06.12 10:00:04 LOG7[41903:4295675904]: ssmtp2 started 2009.06.12 10:00:04 LOG7[41903:4295675904]: FD 15 in non-blocking mode 2009.06.12 10:00:04 LOG7[41903:4295675904]: TCP_NODELAY option set on local socket 2009.06.12 10:00:04 LOG7[41903:4295675904]: Waiting for a libwrap process 2009.06.12 10:00:04 LOG7[41903:4295675904]: Acquired libwrap process #1 2009.06.12 10:01:04 LOG7[41903:140735078037248]: ssmtp accepted FD=16 from 192.168.1.10:65013 2009.06.12 10:01:04 LOG7[41903:4295790592]: ssmtp started 2009.06.12 10:01:04 LOG7[41903:4295790592]: FD 16 in non-blocking mode 2009.06.12 10:01:04 LOG7[41903:4295790592]: TCP_NODELAY option set on local socket 2009.06.12 10:01:04 LOG7[41903:4295790592]: Waiting for a libwrap process 2009.06.12 10:01:04 LOG7[41903:4295790592]: Acquired libwrap process #2 2009.06.12 10:03:56 LOG6[41903:4295561216]: read_blocking: s_poll_wait timeout 2009.06.12 10:03:56 LOG5[41903:4295561216]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.06.12 10:03:56 LOG7[41903:4295561216]: ssmtp2 finished (2 left) 2009.06.12 10:03:56 LOG7[41903:140735078037248]: ssmtp accepted FD=14 from 192.168.1.10:65022 2009.06.12 10:03:56 LOG7[41903:4295561216]: ssmtp started 2009.06.12 10:03:56 LOG7[41903:4295561216]: FD 14 in non-blocking mode 2009.06.12 10:03:56 LOG7[41903:4295561216]: TCP_NODELAY option set on local socket 2009.06.12 10:03:56 LOG7[41903:4295561216]: Waiting for a libwrap process 2009.06.12 10:03:56 LOG7[41903:4295561216]: Acquired libwrap process #3 2009.06.12 10:05:04 LOG6[41903:4295675904]: read_blocking: s_poll_wait timeout 2009.06.12 10:05:04 LOG5[41903:4295675904]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.06.12 10:05:04 LOG7[41903:4295675904]: ssmtp2 finished (2 left) 2009.06.12 10:05:04 LOG7[41903:140735078037248]: ssmtp accepted FD=15 from 192.168.1.10:65028 2009.06.12 10:05:04 LOG7[41903:4295675904]: ssmtp started 2009.06.12 10:05:04 LOG7[41903:4295675904]: FD 15 in non-blocking mode 2009.06.12 10:05:04 LOG7[41903:4295675904]: TCP_NODELAY option set on local socket 2009.06.12 10:05:04 LOG7[41903:4295675904]: Waiting for a libwrap process 2009.06.12 10:05:04 LOG7[41903:4295675904]: Acquired libwrap process #4 2009.06.12 10:06:04 LOG6[41903:4295790592]: read_blocking: s_poll_wait timeout 2009.06.12 10:06:04 LOG5[41903:4295790592]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.06.12 10:06:04 LOG7[41903:4295790592]: ssmtp finished (2 left) 2009.06.12 10:06:04 LOG7[41903:140735078037248]: ssmtp accepted FD=16 from 192.168.1.10:65032 2009.06.12 10:06:04 LOG7[41903:4295790592]: ssmtp started 2009.06.12 10:06:04 LOG7[41903:4295790592]: FD 16 in non-blocking mode 2009.06.12 10:06:04 LOG7[41903:4295790592]: TCP_NODELAY option set on local socket 2009.06.12 10:06:04 LOG7[41903:4295790592]: Waiting for a libwrap process 2009.06.12 10:08:56 LOG6[41903:4295561216]: read_blocking: s_poll_wait timeout 2009.06.12 10:08:56 LOG5[41903:4295561216]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.06.12 10:08:56 LOG7[41903:4295561216]: ssmtp finished (2 left) 2009.06.12 10:08:56 LOG7[41903:140735078037248]: ssmtp2 accepted FD=14 from 192.168.1.10:65040 2009.06.12 10:08:56 LOG7[41903:4295561216]: ssmtp2 started 2009.06.12 10:08:56 LOG7[41903:4295561216]: FD 14 in non-blocking mode 2009.06.12 10:08:56 LOG7[41903:4295561216]: TCP_NODELAY option set on local socket 2009.06.12 10:08:56 LOG7[41903:4295561216]: Waiting for a libwrap process 2009.06.12 10:10:04 LOG6[41903:4295675904]: read_blocking: s_poll_wait timeout 2009.06.12 10:10:04 LOG5[41903:4295675904]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.06.12 10:10:04 LOG7[41903:4295675904]: ssmtp finished (2 left) 2009.06.12 10:10:04 LOG7[41903:140735078037248]: ssmtp accepted FD=15 from 192.168.1.10:65044 2009.06.12 10:10:04 LOG7[41903:4295675904]: ssmtp started 2009.06.12 10:10:04 LOG7[41903:4295675904]: FD 15 in non-blocking mode 2009.06.12 10:10:04 LOG7[41903:4295675904]: TCP_NODELAY option set on local socket 2009.06.12 10:10:04 LOG7[41903:4295675904]: Waiting for a libwrap process 2009.06.12 10:11:04 LOG7[41903:140735078037248]: ssmtp accepted FD=17 from 192.168.1.10:65048 2009.06.12 10:11:04 LOG7[41903:4295905280]: ssmtp started 2009.06.12 10:11:04 LOG7[41903:4295905280]: FD 17 in non-blocking mode 2009.06.12 10:11:04 LOG7[41903:4295905280]: TCP_NODELAY option set on local socket 2009.06.12 10:11:04 LOG7[41903:4295905280]: Waiting for a libwrap process 2009.06.12 10:13:56 LOG7[41903:140735078037248]: ssmtp accepted FD=18 from 192.168.1.10:65060 2009.06.12 10:13:56 LOG7[41903:4297134080]: ssmtp started 2009.06.12 10:13:56 LOG7[41903:4297134080]: FD 18 in non-blocking mode 2009.06.12 10:13:56 LOG7[41903:4297134080]: TCP_NODELAY option set on local socket 2009.06.12 10:13:56 LOG7[41903:4297134080]: Waiting for a libwrap process 2009.06.12 10:15:04 LOG7[41903:140735078037248]: ssmtp accepted FD=19 from 192.168.1.10:65063 2009.06.12 10:15:04 LOG7[41903:4297211904]: ssmtp started 2009.06.12 10:15:04 LOG7[41903:4297211904]: FD 19 in non-blocking mode 2009.06.12 10:15:04 LOG7[41903:4297211904]: TCP_NODELAY option set on local socket 2009.06.12 10:15:04 LOG7[41903:4297211904]: Waiting for a libwrap process 2009.06.12 10:18:56 LOG7[41903:140735078037248]: ssmtp2 accepted FD=20 from 192.168.1.10:65090 2009.06.12 10:18:56 LOG7[41903:4297326592]: ssmtp2 started 2009.06.12 10:18:56 LOG7[41903:4297326592]: FD 20 in non-blocking mode 2009.06.12 10:18:56 LOG7[41903:4297326592]: TCP_NODELAY option set on local socket 2009.06.12 10:18:56 LOG7[41903:4297326592]: Waiting for a libwrap process 2009.06.12 10:20:04 LOG7[41903:140735078037248]: ssmtp2 accepted FD=21 from 192.168.1.10:65093 2009.06.12 10:20:04 LOG7[41903:4297441280]: ssmtp2 started 2009.06.12 10:20:04 LOG7[41903:4297441280]: FD 21 in non-blocking mode 2009.06.12 10:20:04 LOG7[41903:4297441280]: TCP_NODELAY option set on local socket 2009.06.12 10:20:04 LOG7[41903:4297441280]: Waiting for a libwrap process 2009.06.12 10:23:56 LOG7[41903:140735078037248]: ssmtp2 accepted FD=22 from 192.168.1.10:65111 2009.06.12 10:23:56 LOG7[41903:4297555968]: ssmtp2 started 2009.06.12 10:23:56 LOG7[41903:4297555968]: FD 22 in non-blocking mode 2009.06.12 10:23:56 LOG7[41903:4297555968]: TCP_NODELAY option set on local socket 2009.06.12 10:23:56 LOG7[41903:4297555968]: Waiting for a libwrap process 2009.06.12 10:25:04 LOG7[41903:140735078037248]: ssmtp accepted FD=23 from 192.168.1.10:65113 2009.06.12 10:25:04 LOG7[41903:4297670656]: ssmtp started 2009.06.12 10:25:04 LOG7[41903:4297670656]: FD 23 in non-blocking mode 2009.06.12 10:25:04 LOG7[41903:4297670656]: TCP_NODELAY option set on local socket 2009.06.12 10:25:04 LOG7[41903:4297670656]: Waiting for a libwrap process 2009.06.12 10:28:56 LOG7[41903:140735078037248]: ssmtp2 accepted FD=24 from 192.168.1.10:65125 2009.06.12 10:28:56 LOG7[41903:4297785344]: ssmtp2 started 2009.06.12 10:28:56 LOG7[41903:4297785344]: FD 24 in non-blocking mode 2009.06.12 10:28:56 LOG7[41903:4297785344]: TCP_NODELAY option set on local socket 2009.06.12 10:28:56 LOG7[41903:4297785344]: Waiting for a libwrap process 2009.06.12 10:30:04 LOG7[41903:140735078037248]: ssmtp2 accepted FD=25 from 192.168.1.10:65128 2009.06.12 10:30:04 LOG7[41903:4297900032]: ssmtp2 started 2009.06.12 10:30:04 LOG7[41903:4297900032]: FD 25 in non-blocking mode 2009.06.12 10:30:04 LOG7[41903:4297900032]: TCP_NODELAY option set on local socket 2009.06.12 10:30:04 LOG7[41903:4297900032]: Waiting for a libwrap process 2009.06.12 10:33:56 LOG7[41903:140735078037248]: ssmtp2 accepted FD=26 from 192.168.1.10:65299 2009.06.12 10:33:56 LOG7[41903:4298014720]: ssmtp2 started 2009.06.12 10:33:56 LOG7[41903:4298014720]: FD 26 in non-blocking mode 2009.06.12 10:33:56 LOG7[41903:4298014720]: TCP_NODELAY option set on local socket 2009.06.12 10:33:56 LOG7[41903:4298014720]: Waiting for a libwrap process 2009.06.12 10:35:04 LOG7[41903:140735078037248]: ssmtp2 accepted FD=27 from 192.168.1.10:65326 2009.06.12 10:35:04 LOG7[41903:4298129408]: ssmtp2 started 2009.06.12 10:35:04 LOG7[41903:4298129408]: FD 27 in non-blocking mode 2009.06.12 10:35:04 LOG7[41903:4298129408]: TCP_NODELAY option set on local socket 2009.06.12 10:35:04 LOG7[41903:4298129408]: Waiting for a libwrap process 2009.06.12 10:40:04 LOG7[41903:140735078037248]: ssmtp accepted FD=28 from 192.168.1.10:65365 2009.06.12 10:40:04 LOG7[41903:4298244096]: ssmtp started 2009.06.12 10:40:04 LOG7[41903:4298244096]: FD 28 in non-blocking mode 2009.06.12 10:40:04 LOG7[41903:4298244096]: TCP_NODELAY option set on local socket 2009.06.12 10:40:04 LOG7[41903:4298244096]: Waiting for a libwrap process 2009.06.12 10:45:04 LOG7[41903:140735078037248]: ssmtp accepted FD=29 from 192.168.1.10:65377 2009.06.12 10:45:04 LOG7[41903:4298358784]: ssmtp started 2009.06.12 10:45:04 LOG7[41903:4298358784]: FD 29 in non-blocking mode 2009.06.12 10:45:04 LOG7[41903:4298358784]: TCP_NODELAY option set on local socket 2009.06.12 10:45:04 LOG7[41903:4298358784]: Waiting for a libwrap process 2009.06.12 10:50:04 LOG7[41903:140735078037248]: ssmtp accepted FD=30 from 192.168.1.10:65406 2009.06.12 10:50:04 LOG7[41903:4298473472]: ssmtp started 2009.06.12 10:50:04 LOG7[41903:4298473472]: FD 30 in non-blocking mode 2009.06.12 10:50:04 LOG7[41903:4298473472]: TCP_NODELAY option set on local socket 2009.06.12 10:50:04 LOG7[41903:4298473472]: Waiting for a libwrap process Stunnel is running on Mac OS X 10.5.7. Any help would be much appreciated. James.

1 0

Re: [stunnel-users] 1 server and more desktops
by aaa aaa 08 Jun '09

08 Jun '09

Hello Carter, thank you very much for your help and nice examples. I will try it in my local network. Have a good day. Mia ---- Pôvodná správa ---- Od koho: Carter Browne <cbrowne(a)cbcs-usa.com> Komu: aaa aaa <miamia(a)inMail.sk> Dátum: 8. 6. 2009 17:52:00 Predmet: Re: [stunnel-users] 1 server and more desktops Mia, I work in both Windows and Linux, so I use a Windows approach - copying files where in Linux a link would be more appropriate. Assume server.pem is the server full server certificate including the private key and client1.pem is a full client certificate including the key. The first step is to make a copy of the server certificate and delete the lines starting with -----BEGIN RSA PRIVATE KEY------ down through the blank line after -----END RSA PRIVATE KEY----- Initial I call this server-pub.pem The command: openssl x509 -in server-pub.pem -subject_hash -noout will print out the hash for the server key (as 8 hexadecimal digits), for example abcef012 Then I rename server-pub.pem to abcdef012.0 I repeat the same process for each client key, so that client1.pem in this example would have a public key named 987654fe.0 (assuming that the hash of 987654fe). In the client1 configuration: cert = client1.pem key = client1.pem verify = 3 cafile = abcdef012.0 In the server configuration cert = server1.pem key = server1.pem verify = 3 capath = capath In the capath directory is 987654fe.0 ... Plus the hashes of the other clients. In Windows, the capath is under the stunnel directory. The client certificates can also be concatenated in a single file. If you use a directory, it is not necessary to restart stunnel if you add a new client. If you use a concatenated file, you do have to restart stunnel if you add a client. There are some notes in the documentation about the structure of a concatenated file. I hope this helps. Carter Carter Browne CBCS cbrowne(a)cbcs-usa.com 781-721-2890 aaa aaa wrote: > Hi Carter, > > thank you. I am trying to use scenario with self-signed certificates > exactly like you are using it. Could you please write me some examples > of config for server and clients? I don't know where to put private > keys and how to set up server for acceptation of certificates from > clients only - server must reject all communication without/or with > other certificates as are stored in his folder. > > thank you in advance > > regards, > mia > > ---- Pôvodná správa ---- > Od koho: Carter Browne <cbrowne(a)cbcs-usa.com> > Komu: aaa aaa <miamia(a)inMail.sk> > Dátum: 8. 6. 2009 15:00:00 > Predmet: Re: [stunnel-users] 1 server and more desktops > > I do this using self-signed certificates and verify=2 or verify=3. The > remote computers would only have the servers public certificate their > CAfile (or CApath). The server must have all the remote computers > public certificates in its CAfile or CApath. See the rules about how to > build those. If you are only using self-signed certificates, you can > use verify=3, otherwise you will have to use verify=2. Each port that > you want to forward must be in you stunnel.conf file - without knowing > what you are trying to do, it is hard to be more specific. > > Carter > > Carter Browne > CBCS > cbrowne(a)cbcs-usa.com > 781-721-2890 > > > > aaa aaa wrote: > > hello Christophe, > > > > thanks for your answer. Sorry for any misunderstanding. Well, I just > > wanted to ask if it is able to set stunnel for working with more > > certificates? So it means that I don't want to have secured tunnel > > between remote and local computer only but also between one remote and > > many local computers with more certificates? Every local computer > > should have own certificate. > > > > Is this possible? > > > > thank you. > > > > ---- Pôvodná správa ---- > > Od koho: Christophe Nanteuil <christophe.nanteuil(a)gmail.com> > > Komu: aaa aaa <miamia(a)inmail.sk> > > Dátum: 7. 6. 2009 16:27:00 > > Predmet: Re: [stunnel-users] 1 server and more desktops > > > > Hello, > > > > Stunnel is an application oriented tunnel, not a machine oriented > > tunnel. Please, be more precise in your requests if you want someone > > to be able to help you. It seems also that the stunnel documentation > > pages are worh reading in your case. > > > > Regards, > > > > -- > > Christophe > > > > > > 2009/6/7 aaa aaa <miamia(a)inmail.sk>: > > > Hello, > > > > > > I have one server and 3 desktops (PC1,PC2,PC3). I need to do this: > > every pc > > > should communicate with server with his own certificate and server > > should > > > sends anwser back to the computer encrypted for this one pc only. > > > > > > Example: PC3 {with server's public key} sends data to server and > server > > > sends answer to PC3 (encrypted wiht unique PC3's public key). > > > then PC2 {with server's public key} sends data to server and server > > sends > > > answer to PC2 (encrypted wiht unique PC2's public key). and so > on... how > > > should I configure stunnel for this? > > > > > > And another question > how should I configure all computers (server, > > > pc1,pc2,pc3) to accept communication over secured stunnel only and > > drop all > > > other unsecured communication? > > > > > > > > > thank you in advance. > > > regards, Mia > > > ---------- > > > Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. > > Domena, > > > webhosting, e-mail a seo od 10 centov/denne. > > > > > > _______________________________________________ > > > stunnel-users mailing list > > > stunnel-users(a)mirt.net > > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > > > > > > ---------- > > Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk > > <http://www.inpage.sk/>. Domena, webhosting, e-mail a seo od 10 > > centov/denne. > > ------------------------------------------------------------------------ > > > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)mirt.net > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > ---------- > Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk > <http://www.inpage.sk/>. Domena, webhosting, e-mail a seo od 10 > centov/denne. ---------- Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. Domena, webhosting, e-mail a seo od 10 centov/denne.

1 0

Re: [stunnel-users] 1 server and more desktops
by aaa aaa 08 Jun '09

08 Jun '09

Hi Carter, thank you. I am trying to use scenario with self-signed certificates exactly like you are using it. Could you please write me some examples of config for server and clients? I don't know where to put private keys and how to set up server for acceptation of certificates from clients only - server must reject all communication without/or with other certificates as are stored in his folder. thank you in advance regards, mia > ---- Pôvodná správa ---- > Od koho: Carter Browne <cbrowne(a)cbcs-usa.com> > Komu: aaa aaa <miamia(a)inMail.sk> > Dátum: 8. 6. 2009 15:00:00 > Predmet: Re: [stunnel-users] 1 server and more desktops > > I do this using self-signed certificates and verify=2 or verify=3. The > remote computers would only have the servers public certificate their > CAfile (or CApath). The server must have all the remote computers > public certificates in its CAfile or CApath. See the rules about how to > build those. If you are only using self-signed certificates, you can > use verify=3, otherwise you will have to use verify=2. Each port that > you want to forward must be in you stunnel.conf file - without knowing > what you are trying to do, it is hard to be more specific. > > Carter > > Carter Browne > CBCS > cbrowne(a)cbcs-usa.com > 781-721-2890 > > > > aaa aaa wrote: > > hello Christophe, > > > > thanks for your answer. Sorry for any misunderstanding. Well, I just > > wanted to ask if it is able to set stunnel for working with more > > certificates? So it means that I don't want to have secured tunnel > > between remote and local computer only but also between one remote and > > many local computers with more certificates? Every local computer > > should have own certificate. > > > > Is this possible? > > > > thank you. > > > > ---- Pôvodná správa ---- > > Od koho: Christophe Nanteuil <christophe.nanteuil(a)gmail.com> > > Komu: aaa aaa <miamia(a)inmail.sk> > > Dátum: 7. 6. 2009 16:27:00 > > Predmet: Re: [stunnel-users] 1 server and more desktops > > > > Hello, > > > > Stunnel is an application oriented tunnel, not a machine oriented > > tunnel. Please, be more precise in your requests if you want someone > > to be able to help you. It seems also that the stunnel documentation > > pages are worh reading in your case. > > > > Regards, > > > > -- > > Christophe > > > > > > 2009/6/7 aaa aaa <miamia(a)inmail.sk>: > > > Hello, > > > > > > I have one server and 3 desktops (PC1,PC2,PC3). I need to do this: > > every pc > > > should communicate with server with his own certificate and server > > should > > > sends anwser back to the computer encrypted for this one pc only. > > > > > > Example: PC3 {with server's public key} sends data to server and > server > > > sends answer to PC3 (encrypted wiht unique PC3's public key). > > > then PC2 {with server's public key} sends data to server and server > > sends > > > answer to PC2 (encrypted wiht unique PC2's public key). and so > on... how > > > should I configure stunnel for this? > > > > > > And another question > how should I configure all computers (server, > > > pc1,pc2,pc3) to accept communication over secured stunnel only and > > drop all > > > other unsecured communication? > > > > > > > > > thank you in advance. > > > regards, Mia > > > ---------- > > > Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. > > Domena, > > > webhosting, e-mail a seo od 10 centov/denne. > > > > > > _______________________________________________ > > > stunnel-users mailing list > > > stunnel-users(a)mirt.net > > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > > > > > > ---------- > > Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk > > <http://www.inpage.sk/>. Domena, webhosting, e-mail a seo od 10 > > centov/denne. > > ------------------------------------------------------------------------ > > > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)mirt.net > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > ---------- > Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk > <http://www.inpage.sk/>. Domena, webhosting, e-mail a seo od 10 > centov/denne. ---------- Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. Domena, webhosting, e-mail a seo od 10 centov/denne.

1 0

Stunnel client hangs in background mode when smartcard is used
by John Abloyer 08 Jun '09

08 Jun '09

Hi! I have a problem when running ssh over stunnel in background mode ('foreground' out-commented in config file). In foreground mode, everything works fine. I'm using a modified OpenSSL, adding an engine that is dedicated to communicate with a smartcard reader. The scenario is: - Starting stunnel on server, extract from config file: [ssh] accept = myserver:122 connect = 22 - Starting stunnel on client, extract from config file: engine = myengine engineNum = 1 client = yes [ssh] accept = 22 connect = myserver:122 I come to here, than it hangs: ... 2009.06.08 15:08:22 LOG7[472:3054680976]: SSL state (connect): SSLv3 read server certificate A 2009.06.08 15:08:22 LOG7[472:3054680976]: SSL state (connect): SSLv3 read server certificate request A 2009.06.08 15:08:22 LOG7[472:3054680976]: SSL state (connect): SSLv3 read server done A 2009.06.08 15:08:22 LOG7[472:3054680976]: SSL state (connect): SSLv3 write client certificate A 2009.06.08 15:08:22 LOG7[472:3054680976]: SSL state (connect): SSLv3 write client key exchange A - - - - - - - But when I run in foreground mode, it all works fine and stunnel continues and I get the ssh login prompt. I'm running RHEL 5.2, OpenSSL 0.9.8*, stunnel 4.27 Any help would be appreciated Rgds JA

1 0

start parameters
by Sebastian Rose-Indorf 07 Jun '09

07 Jun '09

Hello, a short question: Which start parameters are there for Stunnel v4.xx? Thanks, Seb. _ ASCII ribbon campaign against HTML e-mail ( ) & proprietary e-mail formats X / \ www.asciiribbon.org

1 0

Re: [stunnel-users] 1 server and more desktops
by aaa aaa 07 Jun '09

07 Jun '09

hello Christophe, thanks for your answer. Sorry for any misunderstanding. Well, I just wanted to ask if it is able to set stunnel for working with more certificates? So it means that I don't want to have secured tunnel between remote and local computer only but also between one remote and many local computers with more certificates? Every local computer should have own certificate. Is this possible? thank you. ---- Pôvodná správa ---- Od koho: Christophe Nanteuil <christophe.nanteuil(a)gmail.com> Komu: aaa aaa <miamia(a)inmail.sk> Dátum: 7. 6. 2009 16:27:00 Predmet: Re: [stunnel-users] 1 server and more desktops Hello, Stunnel is an application oriented tunnel, not a machine oriented tunnel. Please, be more precise in your requests if you want someone to be able to help you. It seems also that the stunnel documentation pages are worh reading in your case. Regards, -- Christophe 2009/6/7 aaa aaa <miamia(a)inmail.sk>: > Hello, > > I have one server and 3 desktops (PC1,PC2,PC3). I need to do this: every pc > should communicate with server with his own certificate and server should > sends anwser back to the computer encrypted for this one pc only. > > Example: PC3 {with server's public key} sends data to server and server > sends answer to PC3 (encrypted wiht unique PC3's public key). > then PC2 {with server's public key} sends data to server and server sends > answer to PC2 (encrypted wiht unique PC2's public key). and so on... how > should I configure stunnel for this? > > And another question > how should I configure all computers (server, > pc1,pc2,pc3) to accept communication over secured stunnel only and drop all > other unsecured communication? > > > thank you in advance. > regards, Mia > ---------- > Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. Domena, > webhosting, e-mail a seo od 10 centov/denne. > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > ---------- Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. Domena, webhosting, e-mail a seo od 10 centov/denne.

1 0

stunnel through httpd
by Chatty 07 Jun '09

07 Jun '09

Hello, I've got the crazy idea to run stunnel behind an existing, SSL-enabled, basic-auth-using httpd. Configuration would be as follows: 1. put some stunnel.cgi into /usr/www/cgi-bin which would call stunnel binary 2. start stunnel client with -r https://login:[email protected]/cgi-bin/stunnel.cgi Advantages (assumed you're behind a proxy which allows only 443 as outgoing port): a. You can still access other WebIFs on that server. b. You don't have to administer another web server including authentication, certificates and so on. May be stunnel is not the best tool for the above scenario (I reckon stunnel is currently unable to fulfill this)... I hope someone can shed some light on this. Cheers, Chatty.

1 0

1 server and more desktops
by aaa aaa 07 Jun '09

07 Jun '09

Hello, I have one server and 3 desktops (PC1,PC2,PC3). I need to do this: every pc should communicate with server with his own certificate and server should sends anwser back to the computer encrypted for this one pc only. Example: PC3 {with server's public key} sends data to server and server sends answer to PC3 (encrypted wiht unique PC3's public key). then PC2 {with server's public key} sends data to server and server sends answer to PC2 (encrypted wiht unique PC2's public key). and so on... how should I configure stunnel for this? And another question > how should I configure all computers (server, pc1,pc2,pc3) to accept communication over secured stunnel only and drop all other unsecured communication? thank you in advance. regards, Mia ---------- Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. Domena, webhosting, e-mail a seo od 10 centov/denne.

2 1

securing OpenBSD/FreeBSD with stunnel
by aaa aaa 07 Jun '09

07 Jun '09

Hello guys, I would like to secure my OpenBSD/FreeBSD for communication over stunnel only. How should I configure BSD and stunnel when I want allow comminucation with one server only (data from pc encrypted with server's public certificate and allow data from this server to my pc encrypted with pc's public key) and drop all other communication (all other ports and certificates)? thank you, mia ---------- Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. Domena, webhosting, e-mail a seo od 10 centov/denne.

1 0

Newbie question
by STEVEN BLAIR 02 Jun '09

02 Jun '09

I would be really grateful if someone could help me out with this problem. There appears to be a very high time between my client and server in transferring data. The log shows the following: 2009.06.02 12:32:59 LOG5[5824:5516]: TS3_GPRS accepted connection from 193.35.132.231:45050 2009.06.02 12:32:59 LOG7[5824:5516]: SSL state (accept): before/accept initialization 2009.06.02 12:32:59 LOG7[5824:5516]: SSL state (accept): SSLv3 read client hello A 2009.06.02 12:32:59 LOG7[5824:5516]: SSL state (accept): SSLv3 write server hello A 2009.06.02 12:32:59 LOG7[5824:5516]: SSL state (accept): SSLv3 write certificate A 2009.06.02 12:32:59 LOG7[5824:5516]: SSL state (accept): SSLv3 write certificate request A 2009.06.02 12:32:59 LOG7[5824:5516]: SSL state (accept): SSLv3 flush data 2009.06.02 12:33:09 LOG5[5824:5516]: CRL: verification passed 2009.06.02 12:33:09 LOG5[5824:5516]: VERIFY OK: depth=1, /C=UK/ST=Fife/L=Dunfermline/O=TS3 Services Ltd/OU=Infrastructure/CN=TS3 Services Ltd/emailAddress=helpdesk(a)ts3services.co.uk 2009.06.02 12:33:09 LOG5[5824:5516]: CRL: verification passed 2009.06.02 12:33:09 LOG5[5824:5516]: VERIFY OK: depth=0, /C=UK/ST=Fife/O=TS3 Services Ltd/OU=Terminal/CN=TS3 Services Ltd/emailAddress=helpdesk(a)ts3services.co.uk 2009.06.02 12:33:09 LOG7[5824:5516]: SSL state (accept): SSLv3 read client certificate A 2009.06.02 12:33:09 LOG7[5824:5516]: SSL state (accept): SSLv3 read client key exchange A 2009.06.02 12:33:09 LOG7[5824:5516]: SSL state (accept): SSLv3 read certificate verify A 2009.06.02 12:33:10 LOG7[5824:5516]: SSL state (accept): SSLv3 read finished A 2009.06.02 12:33:10 LOG7[5824:5516]: SSL state (accept): SSLv3 write change cipher spec A 2009.06.02 12:33:10 LOG7[5824:5516]: SSL state (accept): SSLv3 write finished A 2009.06.02 12:33:10 LOG7[5824:5516]: SSL state (accept): SSLv3 flush data 2009.06.02 12:33:10 LOG7[5824:5516]: 2 items in the session cache 2009.06.02 12:33:10 LOG7[5824:5516]: 0 client connects (SSL_connect()) 2009.06.02 12:33:10 LOG7[5824:5516]: 0 client connects that finished 2009.06.02 12:33:10 LOG7[5824:5516]: 0 client renegotiations requested 2009.06.02 12:33:10 LOG7[5824:5516]: 2 server connects (SSL_accept()) 2009.06.02 12:33:10 LOG7[5824:5516]: 2 server connects that finished 2009.06.02 12:33:10 LOG7[5824:5516]: 0 server renegotiations requested 2009.06.02 12:33:10 LOG7[5824:5516]: 0 session cache hits 2009.06.02 12:33:10 LOG7[5824:5516]: 0 session cache misses 2009.06.02 12:33:10 LOG7[5824:5516]: 0 session cache timeouts 2009.06.02 12:33:10 LOG6[5824:5516]: SSL accepted: new session negotiated 2009.06.02 12:33:10 LOG6[5824:5516]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2009.06.02 12:33:10 LOG7[5824:5516]: FD 292 in non-blocking mode 2009.06.02 12:33:10 LOG7[5824:5516]: TS3_GPRS connecting 127.0.0.1:8139 2009.06.02 12:33:10 LOG7[5824:5516]: connect_wait: waiting 10 seconds 2009.06.02 12:33:10 LOG7[5824:5516]: connect_wait: connected 2009.06.02 12:33:10 LOG5[5824:5516]: TS3_GPRS connected remote server from 127.0.0.1:2273 2009.06.02 12:33:10 LOG7[5824:5516]: Remote FD=292 initialized 2009.06.02 12:33:31 LOG7[5824:5516]: Socket closed on read 2009.06.02 12:33:31 LOG7[5824:5516]: SSL write shutdown 2009.06.02 12:33:31 LOG7[5824:5516]: SSL alert (write): warning: close notify 2009.06.02 12:33:31 LOG6[5824:5516]: SSL socket closed on SSL_shutdown 2009.06.02 12:33:31 LOG7[5824:5516]: Socket write shutdown 2009.06.02 12:33:31 LOG5[5824:5516]: Connection closed: 65 bytes sent to SSL, 185 bytes sent to socket 2009.06.02 12:33:31 LOG7[5824:5516]: TS3_GPRS finished (0 left) The main issue for me is the time between the two lines: 2009.06.02 12:32:59 LOG7[5824:5516]: SSL state (accept): SSLv3 flush data 2009.06.02 12:33:09 LOG5[5824:5516]: CRL: verification passed The handshaking and certificate exchange appears to be pretty quick, but I need to understand why there is 10 second delay between these two lines. It seems horrendous amount of time for transferring data. It might be my lack of understanding on the SSL process, so any information on this would be greatly appreciated. Thanks in advance, Steven

1 0

Re: [stunnel-users] Stunnel for secure email connections
by Lee 25 May '09

25 May '09

Thanks again, Guy, I appreciate your efforts there. So I don't have to do anything regarding certificates or digital signatures, or anything along those lines? I just install OpenSSL and Stunnel, configure stunnel.conf, tweak Thunderbird's accounts settings and Avast's ports, and go with it? Guy wrote: > So what you have to do to proxy the connections through Avast! I don't > know, you'll need to show. > Do you *really* need to scan your outbound connections? > This whole thing is more of a challenge / experiment than anything else. Certainly, scanning my SMTP connection(s) is far from important. Off this specific Stunnel issue but related:- For the last day or so, I've gone back to my 'old' setup of TB + Popfile + Avast, and I've noticed that emails from my 'secure' POP connections are actually being scanned by Avast. They probably have been for some time and I didn't notice, but only recently have I turned on the 'adding of notes' in Avast's email scanner which adds an email footer along the lines of 'Avast found this message to be clean'. I assume this scanning of 'secure' emails is a convenient byproduct somehow or other of routing the secure connections through Popfile. For reference, Popfile is listening on its default port of 110, and the Avast email scanner currently also only has port 110 in its POP redirected ports settings. Thunderbird has the host for those accounts as 127.0.0.1, also on port 110, and the username is in the form of: pop_server:username:ssl which Popfile requires. The :ssl is required by Popfile to handle secure connections. I do notice that non-secure connections' emails end up with the scanning footer being added twice, suggesting Avast is double scanning them. Secure connections' emails only get the one footer added. So all told, all incoming email seems to be scanned by Avast, albeit some of it twice. > Your stunnel configuration file has 2 [popmail] service names, that > will be confusing. And why do you have a [popmail] and [pop3_sky] > connecting to the same MTA? > That is because I don't know what I'm doing :) I originally built stunnel.conf without catering for Popfile, then I wanted to introduce Popfile into the equation, so I found the below advice page regarding Popfile and Stunnel :- http://getpopfile.org/docs/howtos:stunnel It appears I wrongly guessed how to interpret that advice on what to add to stunnel.conf I have since had some clarification on this from a query I raised on this at the Popfile forums:- http://getpopfile.org/discussion/1/188 > Did you enable debugging within stunnel? > > Global options: > > debug = debug > output = stunnel.log > Yes, I did try that, and dabbled a little with the packet sniffers. However I didn't find it any easier to pinpoint what was actually going on regarding the prescence or otherwise of a secure connection. ie I don't know what I'm looking at/for. At the moment, my only method of 'testing' what is 'probably' going on, is to open or close parts of my local chain, and thereby build an apparent picture of what is happening. My original doubts of 'am I actually achieving a secure connection using Stunnel and my local chain' are not grounded in anything; I am/was just wanting to somehow avoid just assuming I had set everything up properly. Lee

1 0

Re: [stunnel-users] Stunnel for secure email connections
by Lee 24 May '09

24 May '09

Hello Guy and thanks for your reply. Guy wrote: > So you have... > Client (MUA) <=> Avast and/or Popfile <=> Stunnel <=> Server (MTA) > > > Yes, that's right. I've looked at the mail headers more, and tried some of the packet sniffing/log methods, but I'm not really having any more success in understanding / pinpointing a secure connection. I think I'm not going to be able to grasp the issues here, so maybe it is simpler if I could simply state what I have done, to check that it should be correct; I installed both OpenSLL and Stunnel. I haven't changed anything from the OpenSLL install. In stunnel.conf, I currently have the file shown at the bottom of this email. I have changed settings in Thunderbird's mail accounts (hosts and ports) and in Avast Anti-Virus email scanner. (its redirected ports settings) Adding Popfile (a local mail 'tagging' proxy) back into the equation has required some further tweaks to Thunderbird's ports and server usernames syntax. As I said earlier, all seems to be working, in that my 'chain' appears to be having an effect. However should I be considering anything else to make this process meaningful, such as certificates or security issues? My only motive for using Stunnel and OpenSSL is to allow Avast email scanner to scan _all_ emails, including those it normally cannot scan due to their servers requiring me to use a secure connection. So, if I am doing this 'new' process wrongly or opening up security issues due to not understanding it, I would be better off reverting to how it was previously, seeing as the mail servers I use state they do virus scanning anyway. Thanks again, Lee UK my current stunnel.conf :- client=yes service=popmail [popmail] accept = 127.0.0.1:210 connect = pop.mail.yahoo.co.uk:995 [popmail] accept = 127.0.0.1:310 connect = pop.tools.sky.com:995 [pop3_sky] accept = 127.0.0.1:1109 connect = pop.tools.sky.com:995 [pop3_yahoo] accept = 127.0.0.1:1108 connect = pop.mail.yahoo.co.uk:995 [smtp_sky] accept=127.0.0.1:259 connect=smtp.tools.sky.com:465 [smtp_yahoo] accept=127.0.0.1:258 connect=smtp.mail.yahoo.co.uk:465 [imap_sky] accept=127.0.0.1:1439 connect=imap.tools.sky.com:993 -------------------------------------------------------------------------- --- avast! Antivirus: Outbound message clean. Virus Database (VPS): 090524-0, 24/05/2009 Tested on: 5/24/2009 15:38:38 avast! - copyright (c) 1988-2009 ALWIL Software. http://www.avast.com

1 0

Stunnel for secure email connections; email headers ?
by Lee 23 May '09

23 May '09

Hello, I have been dabbling with Stunnel in order to do the following: Connect with remote POP3, IMAP and SMTP servers using a secure connection; Path those connections on my Windows XP desktop pc through Avast Anti-Virus and/or Popfile to Mozilla Thunderbird. After much fiddling and grinding of my rusty mental muscles, I appear to have everything working and pathing properly. However I am not confident and some amount of luck has been involved in settling on the apparently correct pathing, ports settings and stunnel.conf So, my question here is; Can I look for anything in the email headers to verify that I am actually achieving a locally made secure connection using Stunnel? Or, if necessary, can I force something into the headers to show this? As I imply, results/clues suggest all is in place correctly, but part of me doesn't really believe I have actually done it. :) Thanks very much, Lee UK --- avast! Antivirus: Outbound message clean. Virus Database (VPS): 090523-0, 23/05/2009 Tested on: 5/23/2009 23:25:18 avast! - copyright (c) 1988-2009 ALWIL Software. http://www.avast.com

1 0

Multiple SSL Versions
by Jeremy 22 May '09

22 May '09

Hi, Is there any way to make the sslVersion version take multiple options? I would like to restrict things to TLSv1 or SSLv3 but it seems only one option can be specified. I tried specifying this in the cipher section instead of ALL but couldn't seem to get it to work. Also here is something a little weird I've noticed, if anyone else has ran into it before and knows what's going on. With sites set to use TLSv1, sometimes while testing a HTTPS site using Firefox SSL (when both SSLv3 and TLSv1 is enabled in Firefox) sometimes the site won't come up. It feels like Firefox is using a weird SSL version to do the SSL certificate verification but once you trust the certificate it uses the right settings. I've set sslVersion = all, and trusted the SSL certificate in Firefox, then set sslVersion = TLSv1 again and I can get to the site ok at that point. Kind of weird. I'm probably just going to have to leave sslVersion = all, but Nessus and other security scans really like things locked down to just TLSv1 or SSLv3. stunnel: LOG5[17972:3086609296]: https-site01 accepted connection from 1.2.3.4:50878 stunnel: LOG3[17972:3086609296]: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number stunnel: LOG5[17972:3086609296]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket

2 1

Can't connect to Yahoo POP3
by Gary Kuznitz 18 May '09

18 May '09

Hi, I wonder if you could possibly help me get Stunnel ver. 4.26 working with Yahoo.com email? I have been trying to get it working and can't see what the problem is. I do have it working with Gmail just fine. My email client is setup with: Email server 127.0.0.1 Email user: 127.0.0.1/11011/MuUserName(a)yahoo.com Email password: <InsertPassword> Port 9999 My email client is connecting to K9 K9 connects to Stunnel on port 11011 I'm running this in Win '98se I'm following the instructions to use Yahoo POP3 Free at: http://sajeevnairs.blogspot.com/2009/03/pop3-access-in-yahoo-mail-free.html I think it's saying: SSL alert (read): fatal: bad certificate How can I get a god certificate for Stunnel to use? How would I set that up in Stunnel? Conf: cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [pop3_DslextremeGmail] accept = 127.0.0.1:11010 connect = pop.gmail.com:995 delay = yes [pop3_Yahoo] accept = 127.0.0.1:11011 connect = pop.mail.yahoo.com:995 delay = yes Log: 2009.05.14 15:48:12 LOG7[16278859:16041803]: RAND_status claims sufficient entropy for the PRNG 2009.05.14 15:48:12 LOG7[16278859:16041803]: PRNG seeded successfully 2009.05.14 15:48:12 LOG7[16278859:16041803]: Certificate: stunnel.pem 2009.05.14 15:48:12 LOG7[16278859:16041803]: Certificate loaded 2009.05.14 15:48:12 LOG7[16278859:16041803]: Key file: stunnel.pem 2009.05.14 15:48:12 LOG7[16278859:16041803]: Private key loaded 2009.05.14 15:48:12 LOG7[16278859:16041803]: SSL context initialized for service pop3_DslextremeDocfxitGmail 2009.05.14 15:48:12 LOG7[16278859:16041803]: Certificate: stunnel.pem 2009.05.14 15:48:12 LOG7[16278859:16041803]: Certificate loaded 2009.05.14 15:48:12 LOG7[16278859:16041803]: Key file: stunnel.pem 2009.05.14 15:48:12 LOG7[16278859:16041803]: Private key loaded 2009.05.14 15:48:12 LOG7[16278859:16041803]: SSL context initialized for service pop3_Docfxit_Yahoo 2009.05.14 15:48:12 LOG5[16278859:16041803]: stunnel 4.26 on x86-pc-mingw32-gnu with OpenSSL 0.9.8i 15 Sep 2008 2009.05.14 15:48:12 LOG5[16278859:16041803]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv4 2009.05.14 15:48:12 LOG5[16278859:16039767]: No limit detected for the number of clients 2009.05.14 15:48:12 LOG7[16278859:16039767]: FD 56 in non-blocking mode 2009.05.14 15:48:12 LOG7[16278859:16039767]: SO_REUSEADDR option set on accept socket 2009.05.14 15:48:12 LOG7[16278859:16039767]: pop3_DslextremeDocfxitGmail bound to 127.0.0.1:11010 2009.05.14 15:48:12 LOG7[16278859:16039767]: FD 60 in non-blocking mode 2009.05.14 15:48:12 LOG7[16278859:16039767]: SO_REUSEADDR option set on accept socket 2009.05.14 15:48:12 LOG7[16278859:16039767]: pop3_Docfxit_Yahoo bound to 127.0.0.1:11011 2009.05.14 15:48:30 LOG7[16278859:16039767]: pop3_Docfxit_Yahoo accepted FD=64 from 127.0.0.1:1105 2009.05.14 15:48:30 LOG7[16278859:16039767]: Creating a new thread 2009.05.14 15:48:30 LOG7[16278859:16039767]: New thread created 2009.05.14 15:48:30 LOG7[16278859:16038719]: pop3_Docfxit_Yahoo started 2009.05.14 15:48:30 LOG7[16278859:16038719]: FD 64 in non-blocking mode 2009.05.14 15:48:30 LOG7[16278859:16038719]: TCP_NODELAY option set on local socket 2009.05.14 15:48:30 LOG5[16278859:16038719]: pop3_Docfxit_Yahoo accepted connection from 127.0.0.1:1105 2009.05.14 15:48:30 LOG7[16278859:16038719]: FD 76 in non-blocking mode 2009.05.14 15:48:30 LOG7[16278859:16038719]: pop3_Docfxit_Yahoo connecting 68.142.206.14:995 2009.05.14 15:48:30 LOG7[16278859:16038719]: connect_wait: waiting 10 seconds 2009.05.14 15:48:30 LOG7[16278859:16038719]: connect_wait: connected 2009.05.14 15:48:30 LOG5[16278859:16038719]: pop3_Docfxit_Yahoo connected remote server from 192.168.1.3:1106 2009.05.14 15:48:30 LOG7[16278859:16038719]: Remote FD=76 initialized 2009.05.14 15:48:30 LOG7[16278859:16038719]: TCP_NODELAY option set on remote socket 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): before/connect initialization 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 write client hello A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 read server hello A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 read server certificate A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 read server certificate request A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 read server done A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 write client certificate A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 write client key exchange A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 write certificate verify A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 write change cipher spec A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 write finished A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 flush data 2009.05.14 15:48:30 LOG3[16278859:16038719]: SSL_connect: Peer suddenly disconnected 2009.05.14 15:48:30 LOG5[16278859:16038719]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.05.14 15:48:30 LOG7[16278859:16038719]: pop3_Docfxit_Yahoo finished (0 left) Thank you for looking at it... Gary

4 8

Re: [stunnel-users] Can't connect to Yahoo POP3
by Gary Kuznitz 15 May '09

15 May '09

I made some changes... On 15 May 2009 at 12:40, stunnel-users(a)mirt.net (Gary Kuznitz <docfxit(a)theoffice.la>) commented about Re: [stunnel-users] Can't connect t: > Thank you for the reply... > > On 15 May 2009 at 20:55, Michal (Michal Trojnara <Michal.Trojnara(a)mobi-com.net>) commented about Re: [stunnel-users] Can't connect to Yahoo POP3: > > > Gary Kuznitz wrote: > > > How can I get a god certificate for Stunnel to use? > > > How would I set that up in Stunnel? > > > > You don't really need a certificate for an SSL client. Just disable it. > > How can I disable it? > > > You rather want to setup server certificate verification with "CAfile" > > and "verify". > > I have un-commented: > CAfile = certs.pem I commented out the above line. Now I'm getting a new error. Here is the log: 2009.05.15 16:32:30 LOG7[16267607:16279139]: RAND_status claims sufficient entropy for the PRNG 2009.05.15 16:32:30 LOG7[16267607:16279139]: PRNG seeded successfully 2009.05.15 16:32:31 LOG7[16267607:16279139]: Certificate: stunnel.pem 2009.05.15 16:32:31 LOG7[16267607:16279139]: Certificate loaded 2009.05.15 16:32:31 LOG7[16267607:16279139]: Key file: stunnel.pem 2009.05.15 16:32:31 LOG7[16267607:16279139]: Private key loaded 2009.05.15 16:32:31 LOG3[16267607:16279139]: Either CApath or CAfile has to be used for authentication 2009.05.15 16:32:31 LOG3[16267607:16279139]: Server is down > verify = 2 > > That gave me an error: > 2009.05.15 12:38:13 LOG3[16278859:16279139]: Error loading verify certificates > from certs.pem > 2009.05.15 12:38:13 LOG3[16278859:16279139]: error stack: B084002 : > error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib > 2009.05.15 12:38:13 LOG3[16278859:16279139]: error stack: 2006D080 : > error:2006D080:BIO routines:BIO_new_file:no such file > 2009.05.15 12:38:13 LOG3[16278859:16279139]: SSL_CTX_load_verify_locations: > 2001002: error:02001002:system library:fopen:No such file or directory > > > > ; Some performance tunings > > > socket = l:TCP_NODELAY=1 > > > socket = r:TCP_NODELAY=1 > > > > IMHO it's not a good idea for non-interactive connections, e.g. pop3. > > I will comment out both of the above. > > > > [pop3_DslextremeGmail] > > > accept = 127.0.0.1:11010 > > > connect = pop.gmail.com:995 > > > delay = yes > > > > > > [pop3_Yahoo] > > > accept = 127.0.0.1:11011 > > > connect = pop.mail.yahoo.com:995 > > > delay = yes > > [cut] > > > 2009.05.14 15:48:12 LOG7[16278859:16041803]: SSL context initialized > > > for service pop3_Docfxit_Yahoo > > > > I guess you use a different configuration file, as pop3_Docfxit_Yahoo > > is not defined in the one you sent. > > I'm sorry. I'm really using [pop3_Yahoo] > > After I make a change to the conf. file Do I have to re-boot the PC or is it > enough to exit out of Stunnel and launch it again? > > Thank you, > > Gary Kuznitz > > > Best regards, > > Mike > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)mirt.net > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > >

1 0

Preventing "choose a digital certificate" pop-up in IE
by Wallace Winfrey 08 May '09

08 May '09

Hello I have browsed the archives but have not found the answer to this question... I have stunnel set up to handle https connections. It sits on a CentOS server alongside HAProxy and works fine with every browser except for Internet Explorer. When I connect with Internet Explorer, I get a blank "Please choose a digital certificate" pop-up. I am pretty sure I have a configuration issue. Here's what I have: socket=l:TCP_NODELAY=1 socket=r:TCP_NODELAY=1 options = NO_SSLv2 ciphers=ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM output = /var/log/stunnel.log [my.host.name] accept=my.external.IP:443 connect=127.0.0.1:8101 xforwardedfor=yes CAfile=/etc/stunnel/GlobalSign.pem cert=/etc/stunnel/my.host.name.pem verify=1 How do we turn off the request for the client certificate in IE? Here are my details....thanks in advance. w * stunnel-4.15-2.el5.1 * I am running it standalone: /usr/sbin/stunnel /etc/stunnel/stunnel.conf * /usr/sbin/stunnel -version stunnel 4.15 on i686-pc-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Auth:LIBWRAP Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none * uname -a: Linux my.host.name 2.6.18-128.1.6.el5 #1 SMP Wed Apr 1 09:19:18 EDT 2009 i686 i686 i386 GNU/Linux * glibc version is 2.5-34 * gcc is not installed, using CentOS RPM * OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008

1 1

patch: TCP keep-alive socket options
by Ludolf Holzheid 08 May '09

08 May '09

Dear list, the attached patch allows for tweaking the TCP keep-alive socket options on Linux 2.4 and later. Thanks to the groundwork laid by Michal, this got fairly trivial. We use this to keep NAT table entries alive for connections that are expected to have idle periods longer than the NAT time-outs of the routers in involved. Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Odd termination of stunnel process...
by Robert Nickel 07 May '09

07 May '09

We've been happily using stunnel for quite some time now and have run into a strange problem. At seemingly random intervals, stunnel just freaks out an dies. I don't know if it's getting overwhelmed or what but I'm not seeing anything in the logs for stunnel or any other process. Any help is appreciated. Stunnel is being used to wrap a service that was written without use of the ssl libraries directly and connects to two remote web servers (that happen to be running on the same host, separate ports). Config information: OS: CentOS 5.1 OpenSSL: 0.9.8b stunnel -version: stunnel 4.15 on i686-redhat-linux-gnu with OpenSSL 0.9.8b 04 May 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Config file contents: client=yes foreground=no pid=/var/run/pid chroot=/path/to/chroot setuid=non-priv-user setgid=non-priv-group [webservice1] accept=127.0.0.1:11000 connect=172.16.0.1:11000 [webservice2] accept=127.0.0.1:11001 connect=172.16.0.1:11001 Below are the log lines just before the process disappears: May 4 19:49:18 host stunnel: LOG7[28683:3085368208]: Remote FD=15 initialized May 4 19:49:18 host stunnel: LOG7[28683:3085298576]: SSL state (connect): SSLv3 write client key exchange A May 4 19:49:18 host stunnel: LOG7[28683:3085298576]: SSL state (connect): SSLv3 write change cipher spec A May 4 19:49:18 host stunnel: LOG7[28683:3085298576]: SSL state (connect): SSLv3 write finished A May 4 19:49:18 host stunnel: LOG7[28683:3085716368]: SSL state (connect): SSLv3 read server hello A May 4 19:49:18 host stunnel: LOG7[28683:3085716368]: SSL state (connect): SSLv3 read server certificate A May 4 19:49:18 host stunnel: LOG7[28683:3085298576]: SSL state (connect): SSLv3 flush data May 4 19:49:18 host stunnel: LOG7[28683:3085368208]: SSL state (connect): before/connect initialization May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: SSL alert (write): fatal: handshake failure May 4 19:49:18 host stunnel: LOG3[28683:3085786000]: SSL_connect: 1408C095: error:1408C095:SSL routines:SSL3_GET_FINISHED:digest check failed May 4 19:49:18 host stunnel: LOG5[28683:3085786000]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: replay finished (8 left) May 4 19:49:18 host stunnel: LOG7[28683:3085368208]: SSL state (connect): SSLv3 write client hello A May 4 19:49:18 host stunnel: LOG7[28683:3085716368]: SSL state (connect): SSLv3 read server key exchange A May 4 19:49:18 host stunnel: LOG7[28683:3085716368]: SSL state (connect): SSLv3 read server done A May 4 19:49:18 host stunnel: LOG7[28683:3085928144]: replay accepted FD=18 from 127.0.0.1:40308 May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: replay started May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: FD 18 in non-blocking mode May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: FD 19 in non-blocking mode May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: FD 26 in non-blocking mode May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: Connection from 127.0.0.1:40308 permitted by libwrap May 4 19:49:18 host stunnel: LOG5[28683:3085786000]: replay connected from 127.0.0.1:40308 May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: FD 19 in non-blocking mode May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: replay connecting 160.33.167.33:11026 May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: connect_wait: waiting 10 seconds May 4 19:49:18 host stunnel: LOG7[28683:3085928144]: Cleaning up the signal pipe May 4 19:49:18 host stunnel: LOG6[28683:3085928144]: Child process 13775 finished with code 0 May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: SSL alert (write): fatal: handshake failure May 4 19:49:18 host stunnel: LOG3[28683:3085646736]: SSL_connect: 1408C095: error:1408C095:SSL routines:SSL3_GET_FINISHED:digest check failed May 4 19:49:18 host stunnel: LOG5[28683:3085646736]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket May 4 19:49:18 host stunnel: LOG7[28683:3085716368]: SSL state (connect): SSLv3 write client key exchange A May 4 19:49:18 host stunnel: LOG7[28683:3085716368]: SSL state (connect): SSLv3 write change cipher spec A May 4 19:49:18 host stunnel: LOG7[28683:3085716368]: SSL state (connect): SSLv3 write finished A May 4 19:49:18 host stunnel: LOG7[28683:3085716368]: SSL state (connect): SSLv3 flush data May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: replay finished (8 left) May 4 19:49:18 host stunnel: LOG7[28683:3085855632]: connect_wait: connected May 4 19:49:18 host stunnel: LOG7[28683:3085855632]: Remote FD=17 initialized May 4 19:49:18 host stunnel: LOG7[28683:3085855632]: SSL state (connect): before/connect initialization May 4 19:49:18 host stunnel: LOG7[28683:3085855632]: SSL state (connect): SSLv3 write client hello A May 4 19:49:18 host stunnel: LOG7[28683:3085928144]: replay accepted FD=22 from 127.0.0.1:40310 May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: replay started May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: FD 22 in non-blocking mode May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: FD 23 in non-blocking mode May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: FD 26 in non-blocking mode May 4 19:49:18 host stunnel: LOG7[28683:3085928144]: Cleaning up the signal pipe May 4 19:49:18 host stunnel: LOG6[28683:3085928144]: Child process 13777 finished with code 0 May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: Connection from 127.0.0.1:40310 permitted by libwrap May 4 19:49:18 host stunnel: LOG5[28683:3085646736]: replay connected from 127.0.0.1:40310 May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: FD 23 in non-blocking mode May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: replay connecting 160.33.167.33:11026 May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: connect_wait: waiting 10 seconds May 4 19:49:18 host stunnel: LOG7[28683:3085507472]: SSL state (connect): SSLv3 read server hello A May 4 19:49:18 host stunnel: LOG7[28683:3085507472]: SSL state (connect): SSLv3 read server certificate A May 4 19:49:18 host stunnel: LOG7[28683:3085507472]: SSL state (connect): SSLv3 read server key exchange A May 4 19:49:18 host stunnel: LOG7[28683:3085507472]: SSL state (connect): SSLv3 read server done A May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: connect_wait: connected May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: Remote FD=19 initialized May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: SSL state (connect): before/connect initialization May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: SSL state (connect): SSLv3 write client hello A May 4 19:49:18 host stunnel: LOG7[28683:3085298576]: SSL alert (write): fatal: handshake failure May 4 19:49:18 host stunnel: LOG3[28683:3085298576]: SSL_connect: 1408C095: error:1408C095:SSL routines:SSL3_GET_FINISHED:digest check failed May 4 19:49:18 host stunnel: LOG5[28683:3085298576]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket May 4 19:49:18 host stunnel: LOG7[28683:3085298576]: replay finished (8 left) May 4 19:49:18 host stunnel: LOG7[28683:3085507472]: SSL state (connect): SSLv3 write client key exchange A May 4 19:49:18 host stunnel: LOG7[28683:3085507472]: SSL state (connect): SSLv3 write change cipher spec A May 4 19:49:18 host stunnel: LOG7[28683:3085507472]: SSL state (connect): SSLv3 write finished A May 4 19:49:18 host stunnel: LOG7[28683:3085507472]: SSL state (connect): SSLv3 flush data May 4 19:49:18 host stunnel: LOG7[28683:3085925264]: SSL alert (write): fatal: handshake failure May 4 19:49:18 host stunnel: LOG3[28683:3085925264]: SSL_connect: 1408C095: error:1408C095:SSL routines:SSL3_GET_FINISHED:digest check failed May 4 19:49:18 host stunnel: LOG5[28683:3085925264]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket May 4 19:49:18 host stunnel: LOG7[28683:3085925264]: replay finished (7 left) May 4 19:49:18 host stunnel: LOG7[28683:3085368208]: SSL state (connect): SSLv3 read server hello A May 4 19:49:18 host stunnel: LOG7[28683:3085368208]: SSL state (connect): SSLv3 read server certificate A May 4 19:49:18 host stunnel: LOG7[28683:3085368208]: SSL state (connect): SSLv3 read server key exchange A May 4 19:49:18 host stunnel: LOG7[28683:3085368208]: SSL state (connect): SSLv3 read server done A May 4 19:49:18 host stunnel: LOG7[28683:3085577104]: SSL state (connect): SSLv3 read server hello A May 4 19:49:18 host stunnel: LOG7[28683:3085577104]: SSL state (connect): SSLv3 read server certificate A May 4 19:49:18 host stunnel: LOG7[28683:3085577104]: SSL state (connect): SSLv3 read server key exchange A May 4 19:49:18 host stunnel: LOG7[28683:3085577104]: SSL state (connect): SSLv3 read server done A [stunnel vanishes at this point. No core, no logs. POOF!] The lines that stand out to me are the SSL_connect digest errors, the finished lines (showing the number of queued requests in parenthesis?) and the fatal handshake failure. Another odd log entry that I'm seeing often is this transfer() loop error: May 4 21:12:53 host stunnel: LOG3[14341:3085822864]: transfer() loop executes not transferring any data May 4 21:12:53 host stunnel: LOG3[14341:3085822864]: please report the problem to Michal.Trojnara(a)mirt.net May 4 21:12:53 host stunnel: LOG3[14341:3085822864]: socket open: rd=no wr=yes, ssl open: rd=no wr=no May 4 21:12:53 host stunnel: LOG3[14341:3085822864]: socket ready: rd=yes wr=no, ssl ready: rd=no wr=no May 4 21:12:53 host stunnel: LOG3[14341:3085822864]: ssl want: rd=no wr=no May 4 21:12:53 host stunnel: LOG3[14341:3085822864]: socket input buffer: 0 byte(s), ssl input buffer: 29 byte(s) May 4 21:12:53 host stunnel: LOG3[14341:3085822864]: check_SSL_pending=0, ssl_closing=3 May 4 21:12:53 host stunnel: LOG5[14341:3085822864]: Connection reset: 238 bytes sent to SSL, 225 bytes sent to socket Don't know if it's related but might as well post it along as a possible symptom. Thanks, --Robert

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users