- stunnel-users - stunnel.org

[PATCH] Fix undefined aliasing in libwrap.c
by Miloslav Trmac 02 May '09

02 May '09

Hello, The attached patch changes the code not to access a part of a char[...] array using an int *, which is undefined in ISO C. Using memcpy() is safe. I would have posted it on in the BTS, but it doesn't allow me even to log in... Thank you, Mirek

3 4

Re: [stunnel-users] stunnel-users Digest, Vol 57, Issue 10
by Brian P Hinz 21 Apr '09

21 Apr '09

>> Does stunnel support the use of the aNULL cipher suites? I can't >> seem to make it work, stunnel just fails with a "no shared >> ciphers" message. I don't think that the problem is with openssl >> or the client, since when I test it with s_server the handshake >> completes. >> > > >Review the default cipher list. > >Do... > >stunnel -version > > >Then edit configuration file ciphers options to suit requirements. I was trying to get stunnel working with anonymous ciphers (SSL_DH_anon_WITH_RC4_MD5_128, etc.) from a java based client and found that s_server succeeded while stunnel failed with the "no shared ciphers" message because it has routines to initialize a temporary DH key in the absence of a certificate. Here's a sloppy patch that just borrows those routines from the s_server source code. This is against an older version of stunnel (RHEL4u7 based system), but the latest version also fails without similar patching. Cheers, -brian # cat /usr/src/redhat/SOURCES/stunnel-4.05-dhe.patch --- stunnel-4.05/src/ssl.c.dhe 2004-01-25 14:26:03.000000000 -0500 +++ stunnel-4.05/src/ssl.c 2009-04-22 00:11:10.000000000 -0400 @@ -236,6 +236,32 @@ return -1; /* FAILED */ } +static unsigned char dh512_p[]={ + 0xDA,0x58,0x3C,0x16,0xD9,0x85,0x22,0x89,0xD0,0xE4,0xAF,0x75, + 0x6F,0x4C,0xCA,0x92,0xDD,0x4B,0xE5,0x33,0xB8,0x04,0xFB,0x0F, + 0xED,0x94,0xEF,0x9C,0x8A,0x44,0x03,0xED,0x57,0x46,0x50,0xD3, + 0x69,0x99,0xDB,0x29,0xD7,0x76,0x27,0x6B,0xA2,0xD3,0xD4,0x12, + 0xE2,0x18,0xF4,0xDD,0x1E,0x08,0x4C,0xF6,0xD8,0x00,0x3E,0x7C, + 0x47,0x74,0xE8,0x33, +}; + +static unsigned char dh512_g[]={ + 0x02, +}; + +static DH *get_dh512(void); + +static DH *get_dh512(void) { + DH *dh=NULL; + + if ((dh=DH_new()) == NULL) return(NULL); + dh->p=BN_bin2bn(dh512_p,sizeof(dh512_p),NULL); + dh->g=BN_bin2bn(dh512_g,sizeof(dh512_g),NULL); + if ((dh->p == NULL) || (dh->g == NULL)) + return(NULL); + return(dh); +} + static int init_dh(void) { #ifdef USE_DH FILE *fp; @@ -274,6 +300,12 @@ log(LOG_INFO, "Diffie-Hellman initialized with %d bit key", 8*DH_size(dh)); DH_free(dh); +#else + DH *dh=NULL; + log(LOG_INFO,"Using default temp DH parameters\n"); + dh=get_dh512(); + SSL_CTX_set_tmp_dh(ctx,dh); + DH_free(dh); #endif /* USE_DH */ return 0; /* OK */ }

1 0

aNULL ciphers
by Brian P Hinz 20 Apr '09

20 Apr '09

Hi, Does stunnel support the use of the aNULL cipher suites? I can't seem to make it work, stunnel just fails with a "no shared ciphers" message. I don't think that the problem is with openssl or the client, since when I test it with s_server the handshake completes. Thanks, -brian

1 0

Issue resolving path to .conf using DFS and changing from "by name" to "by IP address"
by Peterson, Stephen 17 Apr '09

17 Apr '09

We use stunnel 4.20 and encountered a problem today and hope someone may be able to provide some insight to a solution. Our client machines are all Windows XP machines with stunnel started as a service. Those installs of stunnel have the path to the .conf as part of the path to the executable. The path to the .conf uses a DFS share. Our network administrator changed our DFS share from "by name" to "by IP address" and then the client services could not resolve the location of the .conf file when the services started on the next start up of client machines. Has anyone encountered this before and what did you do to fix it? Thanks for any assistance. Stephen

1 0

error during multithreaded operation
by Dale Kingsbury 13 Apr '09

13 Apr '09

OS: Windows 2003 SP2 SDK: 2003 R2 SDK We have a multithreaded application that uses a REST-style interface to an SSL-enabled UNIX box that only uses AES. I tried using WinHTTP, but unfortunately, AES is broken in the 2003 version of WinHTTP (confirmed by M$). SO, I hook up stunnel, which works fine when I only start one thread, but if I use more than 1 thread, I get the following error in the stunnel.log. Note that the error is on thread 7140, and the connection is immediately closed. I have retry logic that re-starts failed threads, and the restarted thread works the second time. (of course, the first has finished, so it is essentially running by itself.) The other item of interest is that each thread is sending about 500,000 bytes of data in chunks of 16,000 bytes, and my trace shows that it usually fails after having written more than 100,000 bytes successfully. Any suggestions or help would be greatly appreciated... 2009.04.10 13:17:01 LOG7[3016:7040]: SSL state (connect): SSLv3 flush data 2009.04.10 13:17:01 LOG7[3016:7140]: SSL alert (write): fatal: decrypt error <<<<< ----- NOTE FAILS HERE ON thread 7140 2009.04.10 13:17:01 LOG7[3016:7040]: SSL state (connect): SSLv3 read finished A 2009.04.10 13:17:01 LOG7[3016:7040]: 0 items in the session cache 2009.04.10 13:17:01 LOG7[3016:7040]: 20 client connects (SSL_connect()) 2009.04.10 13:17:01 LOG7[3016:7040]: 19 client connects that finished 2009.04.10 13:17:01 LOG7[3016:7040]: 0 client renegotiations requested 2009.04.10 13:17:01 LOG7[3016:7040]: 0 server connects (SSL_accept()) 2009.04.10 13:17:01 LOG7[3016:7040]: 0 server connects that finished 2009.04.10 13:17:01 LOG7[3016:7040]: 0 server renegotiations requested 2009.04.10 13:17:01 LOG7[3016:7040]: 0 session cache hits 2009.04.10 13:17:01 LOG7[3016:7040]: 0 session cache misses 2009.04.10 13:17:01 LOG7[3016:7040]: 0 session cache timeouts 2009.04.10 13:17:01 LOG6[3016:7040]: SSL connected: new session negotiated 2009.04.10 13:17:01 LOG6[3016:7040]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2009.04.10 13:17:01 LOG3[3016:7140]: SSL_connect: 1408C095: error:1408C095:SSL routines:SSL3_GET_FINISHED:digest check failed 2009.04.10 13:17:01 LOG5[3016:7140]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.04.10 13:17:01 LOG7[3016:7140]: bycast-write-1 finished (1 left) Configuratation file: ;Stunnel configuration for Acuo. ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client=yes verify=0 ; Service-level configuration [bycast-read-1] accept = 18080 connect = 10.220.8.100:8080 ;ciphers=AES128-SHA:AES256-SHA TIMEOUTclose = 0 sslVersion = TLSv1 Dale Kingsbury Founder - Lead Software Engineer Phone: 651-744-9225 << NOTE new number Fax: 651-730-4231 Cel: 651-592-5204 email: dale(a)acuotech.com <mailto:[email protected]> RSNA Booth #4980

2 1

Re: [stunnel-users] OpenSSL Vulnerabilities
by Cal Webster 09 Apr '09

09 Apr '09

On Thu, 2009-04-09 at 12:08 -0500, Guy wrote: > Cal Webster wrote: > > > > Do these SSL libraries still require "MSVCR90.dll" from the > > "Visual C++ Redistributables"? > > > > I appreciate the swift response. :-) > > > > > No, the only Microsoft C Runtime Library dependency is MSVCRT.DLL > (see below output) Thank you. I see that. I've also confirmed by uninstalling "Visual C++ Redistributables" and the OpenSSL package from "slproweb.com". The stunnel service starts up and runs fine with the latest stunnel version 4.27b2. -----------[From stunnel.log]----------- 2009.04.09 14:56:11 LOG7[1240:1236]: RAND_status claims sufficient entropy for the PRNG 2009.04.09 14:56:11 LOG7[1240:1236]: PRNG seeded successfully 2009.04.09 14:56:11 LOG7[1240:1236]: SSL context initialized for service vnc1 2009.04.09 14:56:11 LOG7[1240:1236]: SSL context initialized for service vnc2 2009.04.09 14:56:11 LOG7[1240:1236]: SSL context initialized for service vnc3 2009.04.09 14:56:11 LOG5[1240:1236]: stunnel 4.27 on x86-pc-mingw32-gnu with OpenSSL 0.9.8k 25 Mar 2009 2009.04.09 14:56:11 LOG5[1240:1236]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv4 2009.04.09 14:56:11 LOG5[1240:1260]: No limit detected for the number of clients 2009.04.09 14:56:11 LOG7[1240:1260]: FD 312 in non-blocking mode 2009.04.09 14:56:11 LOG7[1240:1260]: SO_REUSEADDR option set on accept socket 2009.04.09 14:56:11 LOG7[1240:1260]: vnc1 bound to 127.0.0.1:5973 2009.04.09 14:56:11 LOG7[1240:1260]: FD 320 in non-blocking mode 2009.04.09 14:56:11 LOG7[1240:1260]: SO_REUSEADDR option set on accept socket 2009.04.09 14:56:11 LOG7[1240:1260]: vnc2 bound to 127.0.0.1:5972 2009.04.09 14:56:11 LOG7[1240:1260]: FD 328 in non-blocking mode 2009.04.09 14:56:11 LOG7[1240:1260]: SO_REUSEADDR option set on accept socket 2009.04.09 14:56:11 LOG7[1240:1260]: vnc3 bound to 127.0.0.1:15900 -----------[/From stunnel.log]----------- > > On Tue, 2009-04-07 at 19:34 -0500, Guy wrote: ... > $ listdlls -r stunnel > > ListDLLs v2.25 - DLL lister for Win9x/NT > Copyright (C) 1997-2004 Mark Russinovich > Sysinternals - www.sysinternals.com Thank you for the link. I've downloaded and installed the GUI version, "Process Explorer", on a test machine. I'm pleasantly surprised at its utility and light impact on system resources. One more question please: Will the Win32 binaries at the link you provided <ftp://stunnel.mirt.net/stunnel> keep up fairly closely with the latest OpenSSL releases? With OpenSSL so widely used it is constantly being evaluated for vulnerabilities. When they're found, it is patched quickly but dependent applications are sometimes slow to incorporate patched versions. Thanks again for your excellent help. ./Cal

1 0

Re: [stunnel-users] OpenSSL Vulnerabilities
by Cal Webster 09 Apr '09

09 Apr '09

Thank you Guy! I'll try the Win32 binaries and SSL libraries on a test machine. Do these SSL libraries still require "MSVCR90.dll" from the "Visual C++ Redistributables"? I appreciate the swift response. :-) ./Cal On Tue, 2009-04-07 at 19:34 -0500, Guy wrote: > Cal Webster wrote: > > > To update the OpenSSL libraries you must download and... > > > > > Find OpenSSL v.0.9.8k bins and stunnel-4.27b2-installer > (which includes OpenSSL v.0.9.8k DLLs) at: > > <ftp://stunnel.mirt.net/stunnel> >

1 0

OpenSSL Vulnerabilities
by Cal Webster 07 Apr '09

07 Apr '09

Will there be a security update of stunnel to address vulnerabilities outlined in CVE-2009-0590, CVE-2009-0591, and CVE-2009-0789? Alternatively, will stunnel use updated OpenSSL libraries on the host? It appears that this is true on Fedora RPM packages. For Example: ldd stunnel: ------------ libssl.so.7 => /lib64/libssl.so.7 (0x0000000006a3c000) libcrypto.so.7 => /lib64/libcrypto.so.7 (0x0000000007954000) ------------ rpm -q --requires stunnel ----------------------------------------- ... libcrypto.so.7 ... libssl.so.7 ... ----------------------------------------- rpm -ql openssl | egrep 'libcrypto.so.7|libssl.so.7' ----------------------------------------- /lib/libcrypto.so.7 /lib/libssl.so.7 ----------------------------------------- However, I don't know how to determine whether the same dependency works with Win32 dll's. For example, could we install "Win32 OpenSSL v0.9.8k Light" from the below link to resolve the vulnerabilities? http://www.slproweb.com/download/Win32OpenSSL_Light-0_9_8k.exe The description says that it "Installs the most commonly used essentials of Win32 OpenSSL v0.9.8k" but it doesn't say exactly what. Thanks for any insights or suggestions. Cal Webster

2 2

Re: [stunnel-users] Problem with name resolving when using delay option
by Michal Trojnara 06 Apr '09

06 Apr '09

Maksymilian Kowalik wrote: > So the workaround was as simple as creating etc directory inside chroot > and putting resolv.conf there. But still don't know whose bug it is > glibc's or stunnel's? It's not really a bug. It's rather an inherent property of chrooted environments. They often require some files and/or devices to work properly. Pozdrowienia z Polski, Mike

1 0

Re: [stunnel-users] Problem with name resolving when using delay option
by Aron Griffis 06 Apr '09

06 Apr '09

Maksymilian Kowalik wrote: [Mon Apr 06 2009, 08:56:02AM EDT] > So the workaround was as simple as creating etc directory > inside chroot and putting resolv.conf there. But still don't > know whose bug it is glibc's or stunnel's? Neither, it's your bug. :-) As you discovered, you need resolv.conf in the chroot. Aron

1 0

Updating OpenSSL used by stunnel
by Peter Droop 06 Apr '09

06 Apr '09

Hi, I am running stunnel 4.25 with openssl 0.9.8h on Windows 2003 Server. There are some security updates out for openssl, that are not available on stunnel.org. Can I update openssl by just replacing libeay32.dll and libssl32.dll in the stunnel installation directory? I downloaded the dlls from http://www.slproweb.com/products/Win32OpenSSL.html. Thanks, Peter

1 0

GPL patches
by Michal Trojnara 01 Apr '09

01 Apr '09

Dear Users, I've just uploaded some patches sent to stunnel-users list over the years to ftp://stunnel.mirt.net/stunnel/contrib/. Please remember my policy is *not* to include any GPL code into the official stunnel distribution. If you're brave you're free to apply the patches yourself, or even create a fork of stunnel with some additional functionality. Just be aware there were already some security vulnerabilities (including remote code execution) discovered in the 3rd party stunnel patches. For this reason I also don't recommend stunnel package/port maintainers to include any 3rd party code with stunnel. Best regards, Mike

1 0

Can't get NTLM authentication to work with proxy connect.
by Rudy Ghani 01 Apr '09

01 Apr '09

Hi there, My stunnel client is on an Active Directory-authenticated XP workstation, which needs to connect via a web proxy that authenticates using NTLM. I populated my login details in protocolUsername and protocolPassword, but the connection just dies when it reaches the proxy server. Looking at the log, I get the following:- 2009.04.01 08:20:39 LOG6[2140:2892]: SSL connected: new session negotiated 2009.04.01 08:20:39 LOG6[2140:2892]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2009.04.01 15:34:09 LOG7[2140:2708]: ssh3 accepted FD=356 from 127.0.0.1:1026 2009.04.01 15:34:09 LOG7[2140:2708]: Creating a new thread 2009.04.01 15:34:09 LOG7[2140:2708]: New thread created 2009.04.01 15:34:09 LOG7[2140:3896]: ssh3 started 2009.04.01 15:34:09 LOG7[2140:3896]: FD 356 in non-blocking mode 2009.04.01 15:34:09 LOG7[2140:3896]: TCP_NODELAY option set on local socket 2009.04.01 15:34:09 LOG5[2140:3896]: ssh3 accepted connection from 127.0.0.1:1026 2009.04.01 15:34:09 LOG7[2140:3896]: FD 472 in non-blocking mode 2009.04.01 15:34:09 LOG7[2140:3896]: ssh3 connecting 129.32.20.14:8080 2009.04.01 15:34:09 LOG7[2140:3896]: connect_wait: waiting 10 seconds 2009.04.01 15:34:09 LOG7[2140:3896]: connect_wait: connected 2009.04.01 15:34:09 LOG5[2140:3896]: ssh3 connected remote server from 130.32.82.203:1027 2009.04.01 15:34:09 LOG7[2140:3896]: Remote FD=472 initialized 2009.04.01 15:34:09 LOG7[2140:3896]: TCP_NODELAY option set on remote socket 2009.04.01 15:34:09 LOG5[2140:3896]: Negotiations for connect (client side) started 2009.04.01 15:34:09 LOG7[2140:3896]: -> CONNECT xxxx.ath.cx:443 HTTP/1.1 2009.04.01 15:34:09 LOG7[2140:3896]: -> Host: xxxx.ath.cx:443 2009.04.01 15:34:09 LOG7[2140:3896]: -> Proxy-Connection: keep-alive 2009.04.01 15:34:09 LOG7[2140:3896]: -> Proxy-Authorization: NTLM TlRMTVNTUAABAAAAAgIAAA== 2009.04.01 15:34:09 LOG7[2140:3896]: -> 2009.04.01 15:34:09 LOG3[2140:3896]: Unexpected socket close (fdgetline) 2009.04.01 15:34:09 LOG5[2140:3896]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.04.01 15:34:09 LOG7[2140:3896]: ssh3 finished (1 left) If I decode the NTLM auth string, I only get the NTLMSSP header, which seems to be incomplete. If I recall correctly the domain and workstation info should be passed on as well. So question is, how do I get this to work? Is there any specific format that I need to use when using the protocol* settings for NTLM? Thanks and regards.

1 0

SSL CTX use RSA Private Key error
by G K 27 Mar '09

27 Mar '09

Hello all. I am trying to set up stunnel for use on my machine. I shouldn't have a problem with iptables. But I do run tor/privoxy on a regular basis if that matters. I also have set up my gpg keys too. The following is the error I get. I did do some Googling but I'm not quite understanding what I'm looking for to change or modify. I know the error is the SSL CTX RSA private key. Wed Mar 25, 19:39 # /etc/rc.d/stunnel start :: Starting stunnel [BUSY] 2009.03.25 19:39:21 LOG7[7490:3082353408]: Snagged 64 random bytes from /root/.rnd 2009.03.25 19:39:21 LOG7[7490:3082353408]: Wrote 1024 new random bytes to /root/.rnd 2009.03.25 19:39:21 LOG7[7490:3082353408]: RAND_status claims sufficient entropy for the PRNG 2009.03.25 19:39:21 LOG7[7490:3082353408]: PRNG seeded successfully 2009.03.25 19:39:21 LOG7[7490:3082353408]: Certificate: /etc/stunnel/mail.pem 2009.03.25 19:39:21 LOG7[7490:3082353408]: Certificate loaded 2009.03.25 19:39:21 LOG7[7490:3082353408]: Key file: /etc/stunnel/mail.pem 2009.03.25 19:39:21 LOG3[7490:3082353408]: error stack: 140B3009 : error:140B3009:SSL routines:SSL_CTX_use_RSAPrivateKey_file:PEM lib 2009.03.25 19:39:21 LOG3[7490:3082353408]: SSL_CTX_use_RSAPrivateKey_file: 906D06C: error:0906D06C:PEM routines:PEM_read_bio:no start line stunnel 4.25-1 Linux vampypengy 2.6.28-ARCH #1 SMP PREEMPT Tue Mar 17 06:42:43 UTC 2009 i686 Genuine Intel(R) CPU T2060 @ 1.60GHz GenuineIntel GNU/Linux glibc 2.9-4 Using built-in specs. Target: i686-pc-linux-gnu Configured with: ../configure --prefix=/usr --enable-shared --enable-languages=c,c++,fortran,objc,obj-c++,treelang --enable-threads=posix --mandir=/usr/share/man --infodir=/usr/share/info --enable-__cxa_atexit --disable-multilib --libdir=/usr/lib --libexecdir=/usr/lib --enable-clocale=gnu --disable-libstdcxx-pch --with-tune=generic Thread model: posix gcc version 4.3.3 (GCC) OpenSSL 0.9.8j 07 Jan 2009 perl-net-ssleay 1.30-2

3 4

stunnel 4.26 MS SQL connetion - works on Vista, not on XP
by zervakos 25 Mar '09

25 Mar '09

Greetings, I was wondering if anyone's come across anything like this. I want to encrypt connections for MS SQL Server 2008 Express from a Windows XP client to a Windows 2003 Server. Following these instructions: http://www.securityfocus.com/infocus/1677 I was able to configure encrypted connections by pointing SQL Server Management Studio to 127.0.0.1 on _either_ XP or Vista and then that gets tunneled over to the Windows 2003 Server running SQL Server 2008 Express. I can browse the database tables, etc. Now the problem. I have users that make use of a thin client that connects directly to the SQL Server. It has one config file that I've pointed to 127.0.0.1. When I run this thin client on Vista, it works great, however, when running it on XP, stunnel tries to connect, but then gives up after several attempts. Here's what I see in the server log before connecting: 2009.03.23 12:26:59 LOG7[284564:274684]: RAND_status claims sufficient entropy for the PRNG 2009.03.23 12:26:59 LOG7[284564:274684]: PRNG seeded successfully 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Key file: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Private key loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded verify certificates from CAcert.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded CAcert.pem revocation lookup file 2009.03.23 12:26:59 LOG7[284564:274684]: Verify directory set to certificates 2009.03.23 12:26:59 LOG7[284564:274684]: Added certificates revocation lookup directory 2009.03.23 12:26:59 LOG5[284564:274684]: Peer certificate location certificates 2009.03.23 12:26:59 LOG7[284564:274684]: SSL context initialized for service vnc 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Key file: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Private key loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded verify certificates from CAcert.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded CAcert.pem revocation lookup file 2009.03.23 12:26:59 LOG7[284564:274684]: Verify directory set to certificates 2009.03.23 12:26:59 LOG7[284564:274684]: Added certificates revocation lookup directory 2009.03.23 12:26:59 LOG5[284564:274684]: Peer certificate location certificates 2009.03.23 12:26:59 LOG7[284564:274684]: SSL context initialized for service mssql 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Key file: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Private key loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded verify certificates from CAcert.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded CAcert.pem revocation lookup file 2009.03.23 12:26:59 LOG7[284564:274684]: Verify directory set to certificates 2009.03.23 12:26:59 LOG7[284564:274684]: Added certificates revocation lookup directory 2009.03.23 12:26:59 LOG5[284564:274684]: Peer certificate location certificates 2009.03.23 12:26:59 LOG7[284564:274684]: SSL context initialized for service rdp 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Key file: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Private key loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded verify certificates from CAcert.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded CAcert.pem revocation lookup file 2009.03.23 12:26:59 LOG7[284564:274684]: Verify directory set to certificates 2009.03.23 12:26:59 LOG7[284564:274684]: Added certificates revocation lookup directory 2009.03.23 12:26:59 LOG5[284564:274684]: Peer certificate location certificates 2009.03.23 12:26:59 LOG7[284564:274684]: SSL context initialized for service http 2009.03.23 12:26:59 LOG5[284564:274684]: stunnel 4.26 on x86-pc-mingw32-gnu with OpenSSL 0.9.8i 15 Sep 2008 2009.03.23 12:26:59 LOG5[284564:274684]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2009.03.23 12:26:59 LOG5[284564:289192]: No limit detected for the number of clients 2009.03.23 12:27:00 LOG7[284564:289192]: FD 268 in non-blocking mode 2009.03.23 12:27:00 LOG7[284564:289192]: SO_REUSEADDR option set on accept socket 2009.03.23 12:27:00 LOG7[284564:289192]: mssql bound to WINDOWS_SQL_SERVER:14333 2009.03.23 12:27:00 LOG7[284564:289192]: FD 292 in non-blocking mode 2009.03.23 12:27:00 LOG7[284564:289192]: SO_REUSEADDR option set on accept socket And here's what I see after trying to connect from XP (this appears 16 more times in stunnel.log until stunnel gives up): 2009.03.23 12:29:48 LOG7[284564:289192]: mssql accepted FD=308 from Windows_XP_Client:1252 2009.03.23 12:29:48 LOG7[284564:289192]: Creating a new thread 2009.03.23 12:29:48 LOG7[284564:289192]: New thread created 2009.03.23 12:29:48 LOG7[284564:348604]: mssql started 2009.03.23 12:29:48 LOG7[284564:348604]: FD 308 in non-blocking mode 2009.03.23 12:29:48 LOG5[284564:348604]: mssql accepted connection from Windows_XP_Client:1252 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): before/accept initialization 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 read client hello A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 write server hello A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 write certificate A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 write certificate request A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 flush data 2009.03.23 12:29:48 LOG5[284564:348604]: CRL: verification passed 2009.03.23 12:29:48 LOG5[284564:348604]: VERIFY OK: depth=1, /C=PL/ST=Warsaw/L=Warsaw/O=Secure/OU=Secure Labs/CN=CA/emailAddress=user(a)abc.com 2009.03.23 12:29:48 LOG5[284564:348604]: CRL: verification passed 2009.03.23 12:29:48 LOG5[284564:348604]: VERIFY OK: depth=0, /C=PL/ST=Warsaw/L=Warsaw/O=Secure/OU=Secure Labs/CN=VNC Client/emailAddress=user(a)abc.com 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 read client certificate A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 read client key exchange A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 read certificate verify A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 read finished A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 write change cipher spec A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 write finished A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 flush data 2009.03.23 12:29:48 LOG7[284564:348604]: 1 items in the session cache 2009.03.23 12:29:48 LOG7[284564:348604]: 0 client connects (SSL_connect()) 2009.03.23 12:29:48 LOG7[284564:348604]: 0 client connects that finished 2009.03.23 12:29:48 LOG7[284564:348604]: 0 client renegotiations requested 2009.03.23 12:29:48 LOG7[284564:348604]: 1 server connects (SSL_accept()) 2009.03.23 12:29:48 LOG7[284564:348604]: 1 server connects that finished 2009.03.23 12:29:48 LOG7[284564:348604]: 0 server renegotiations requested 2009.03.23 12:29:48 LOG7[284564:348604]: 0 session cache hits 2009.03.23 12:29:48 LOG7[284564:348604]: 0 session cache misses 2009.03.23 12:29:48 LOG7[284564:348604]: 0 session cache timeouts 2009.03.23 12:29:48 LOG6[284564:348604]: SSL accepted: new session negotiated 2009.03.23 12:29:48 LOG6[284564:348604]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2009.03.23 12:29:48 LOG7[284564:348604]: FD 332 in non-blocking mode 2009.03.23 12:29:48 LOG7[284564:348604]: mssql connecting 127.0.0.1:1433 2009.03.23 12:29:48 LOG7[284564:348604]: connect_wait: waiting 10 seconds 2009.03.23 12:29:48 LOG7[284564:348604]: connect_wait: connected 2009.03.23 12:29:48 LOG5[284564:348604]: mssql connected remote server from 127.0.0.1:2001 2009.03.23 12:29:48 LOG7[284564:348604]: Remote FD=332 initialized 2009.03.23 12:29:48 LOG7[284564:348604]: SSL alert (read): warning: close notify 2009.03.23 12:29:48 LOG7[284564:348604]: SSL closed on SSL_read 2009.03.23 12:29:48 LOG7[284564:348604]: Socket write shutdown 2009.03.23 12:29:48 LOG7[284564:348604]: SSL write shutdown 2009.03.23 12:29:48 LOG7[284564:348604]: SSL alert (write): warning: close notify 2009.03.23 12:29:48 LOG6[284564:348604]: SSL_shutdown successfully sent close_notify 2009.03.23 12:29:48 LOG5[284564:348604]: Connection closed: 37 bytes sent to SSL, 52 bytes sent to socket 2009.03.23 12:29:48 LOG7[284564:348604]: mssql finished (0 left) The server's stunnel.conf: CAfile = CAcert.pem CApath = certificates cert = server.pem client = no verify = 3 debug = 7 output = stunnel.log [mssql] accept = WINDOWS_SQL_SERVER:14333 connect = 127.0.0.1:1433 The client's stunnel.conf: CAfile = CAcert.pem CApath = certificates cert = client.pem client = yes verify = 3 debug = 7 output = stunnel.log [mssql] accept = 127.0.0.1:1433 connect = WINDOWS_SQL_SERVER:14333 Things I've tried: - changed the compatibility settings of the thin client to work under ealier versions of Windows, this didn't help - regenerated certificates, no good - tried connecting without certificates, still no good I still haven't tried earlier versions of stunnel, but I figured I'd just check and see if may anyone's run across something like this before. From what I can tell, the combination of XP, the thin client and stunnel does not work. The thin client does work on XP when I do not use stunnel, but I need to have the connection encrypted. Any help greatly appreciated, thanks -- View this message in context: http://www.nabble.com/stunnel-4.26-MS-SQL-connetion---works-on-Vista%2C-not… Sent from the Stunnel - Users mailing list archive at Nabble.com.

3 2

Re: [stunnel-users] Using stunnel in a box having http client and http server.
by Joe Lau 23 Mar '09

23 Mar '09

So, my understanding is that I will need one stunnel for each remote web server that my http client is going to connnect to. For example if my http client want to connect to 3 remote web servers. I will need to setup the folllowing stunnels: Remote https Web Server #1 <------------- Stunnel #1 <---------- http client (http://localhost:81) (port 81) Remote https Web Server #1 <------------- Stunnel #2 <---------- http client (http://localhost:82) (port 82) Remote https Web Server #1 <------------- Stunnel #3 <---------- http client (http://localhost:83) (port 83) But I will need only one stunnel for my http server as follow: Remote https client #1 ------------+-----> Stunnel --------------- http server | (port 443) (port 80) Remote https client #2 ------------+ | ..... | | Remote https client #N-------------+ Is the following config file correct for my http server stunnel? client=no accept=443 connect=localhost:80 Thank you! -Joe -----Original Message----- From: Christophe Nanteuil [mailto:[email protected]] Sent: Monday, March 23, 2009 3:19 AM To: Joe Lau Cc: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Using stunnel in a box having http client and http server. 2009/3/20 Joe Lau <Jlau(a)extremenetworks.com>: > > Hello, Hello, > I am new to this list. > > I am planning to use stunnel on my box which has a http client and http server running on it. > I will need two stunnel instances, one for the http client and one for the http server respectively. It seems good. > > For my http client, my stunnel config file looks like this: > > client=yes > accept=80 > connect=remote_web_server:443 > > For my http server, my stunnel config file looks like this: > > client=no > accept=443 > > The problem I am facing is now I have two programs (i.e. 1) stunnel for http client and 2) http server) listening to the same port 80. > How do I resolve this conflict? Who is going to connect to your http "client" ? if it is your local browser (which seems the goal of the configuration), then you can configure the client with "accept=81" and then type in your browser's address bar "https://localhost:/81" -- Christophe Nanteuil DISCLAIMER: This e-mail and any attachments to it may contain confidential and proprietary material and is solely for the use of the intended recipient. Any review, use, disclosure, distribution or copying of this transmittal is prohibited except by or on behalf of the intended recipient. If you have received this transmittal in error, please notify the sender and destroy this e-mail and any attachments and all copies, whether electronic or printed.

2 1

Re: [stunnel-users] Using stunnel in a box having http client and http server.
by Joe Lau 20 Mar '09

20 Mar '09

Hello, I am new to this list. I am planning to use stunnel on my box which has a http client and http server running on it. I will need two stunnel instances, one for the http client and one for the http server respectively. For my http client, my stunnel config file looks like this: client=yes accept=80 connect=remote_web_server:443 For my http server, my stunnel config file looks like this: client=no accept=443 The problem I am facing is now I have two programs (i.e. 1) stunnel for http client and 2) http server) listening to the same port 80. How do I resolve this conflict? Thank you very much for the help. Regards, -Joe DISCLAIMER: This e-mail and any attachments to it may contain confidential and proprietary material and is solely for the use of the intended recipient. Any review, use, disclosure, distribution or copying of this transmittal is prohibited except by or on behalf of the intended recipient. If you have received this transmittal in error, please notify the sender and destroy this e-mail and any attachments and all copies, whether electronic or printed.

1 0

Is this possible? Stunnel FIPS mode with rdesktop to secured Microsoft terminal server
by David W Blaine 16 Mar '09

16 Mar '09

Hi list, I was wondering if this solution is possible? Linux Linux Windows Server 2003 rdesktop ----> Stunnel client ------> Terminal Server no enc FIPS mode FIPS mode I know there is doco's about how to setup a Stunnel using client and server setups on either side but Windows admins here are unlikely to install Stunnel on their side. They have enabled FIPS mode on their Windows servers and disconnected all the Linux/UNIX admins from their Terminal Server. So I was wondering if I could get away with a client only solution? Dave

1 1

persistent SSL connection
by Dorai Ashok 16 Mar '09

16 Mar '09

Hi all, I was able to setup stunnel between two hosts successfully but the only problem I am facing is that, the SSL connection between the two hosts is not persistent. For every connection I make to the stunnel client, a new SSL connection is established by the stunnel client to the stunnel server. Is there a configuration variable in stunnel which can make the SSL connection between stunnel client and server persistent ? Thanks, -Dorai.

3 3

Re: [stunnel-users] persistent SSL connection
by Peter Pentchev 16 Mar '09

16 Mar '09

On Mon, Mar 16, 2009 at 12:59:16PM +0100, delaage.pierre(a)free.fr wrote: > Quoting Peter Pentchev <roam(a)ringlet.net>: You might want to fix your mailer's idea of quoting, since I did not write what you yourself wrote :) You wrote: > For persistent connexion, use ssh tunneling instead of stunnel. Unless, of course, you are trying to communicate with a third-party product that speaks SSL - if either the client or the server is not under your control, there's no way to make them use multiplexed SSH connections instead of SSL :) But if it's just stunnel on both sides, then yes, SSH tunneling may be a better choice for multiplexing, although it has its own problems - most often related to connection keepalive, especially if there is some kind of firewalling gateway on the path. G'luck, Peter -- Peter Pentchev roam(a)ringlet.net roam(a)space.bg roam(a)FreeBSD.org PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint FDBA FD79 C26F 3C51 C95E DF9E ED18 B68D 1619 4553 Hey, out there - is it *you* reading me, or is it someone else?

1 0

Re: [stunnel-users] Configuring stunnel to use p12 and p7b in client mode
by Eduard Witteveen 14 Mar '09

14 Mar '09

Pierre and List, Thanks for the answer. Maybe i wasn't clear enough in my question: 1 - I have a p12 and p7b file, which work in firefox and iexplore. 2 - I want to setup a tunnel, so the encryption is done by stunnel and not by the browser(so i can 'talk' normal http for soap) Removing the password sounds like a good idea, so i started with this. However, somehow my openssl doesnt know the command pkey. (as mentioned: http://www.openssl.org/docs/apps/pkey.html) > $ openssl pkey > openssl:Error: 'pkey' is an invalid command. > openssl version > OpenSSL 0.9.8g 19 Oct 2007 And > openssl.exe pkey > openssl:Error: 'pkey' is an invalid command. > openssl version > OpenSSL 0.9.8i 15 Sept 2008 I searched the net for the error message, but i couldnt find a solution (i did find more questions regarding this on mailinglists) On Thu, 2009-03-12 at 08:21 +0100, delaage.pierre(a)free.fr wrote: > Selon Eduard Witteveen <eduard(a)nergens.org>: > Hello, > In such case a definitive solution is to remove password protection of the > private key, although it is not good for your security, so be careful. > See info at openssl.org : > http://www.openssl.org/docs/apps/pkey.html#EXAMPLES > > "... > To remove the pass phrase on an RSA private key: > > openssl pkey -in key.pem -out keyout.pem > ..." > > and then regenerate a p12 file for your browsers. > > I do not know ways to specify the password in stunnel, but I think this should > not be a good idea. > Anyway ie and firefox should be able to cache your password at least for a > session, so... > > Yours sincerely, > Pierre Delaage > > > Hello, > > > > I'm trying to get stunnel running on my local system, so it will connect > > to the remote a host, which requires authentication with this p12 > > file(with password). I also have the chain of trust which is in the p7b > > file. > > > > The reason why i want to do this, is that the remote host exposes a soap > > interface by https, and i think it would be a good idea to tunnel the > > communications with stunnel, so a transparant configuration can be used. > > Also, this would mean there is no configuration needed for the browser > > anymore, since it can connect to the localhost instead of to the > > remoteserver. > > > > I've tested the p12(certificate PKCS12?) and (trust chain PKCS7?) files > > with internet explorer and firefox. They work(i can browse the > > remotehost), but i still have to enter the password. > > > > I've converted the p12 and p7b files into dem files with the following > > commands: > > > > > openssl pkcs12 -in certificate.p12 -out certificate.pem > > > Enter Import Password: > > > MAC verified OKK > > > Enter PEM pass phrase: > > > Verifying - Enter PEM pass phrase > > > > firefox: store as PEM with chain > > chain.p7b --> chain.pem > > > > Config: > > > key=certificate.pem > > > CAfile=chain.pem > > > client=yes > > > debug=7 > > > output=stunnel.log > > > verify=1 > > > [http] > > > accept=80 > > > connect=www.remoteserver.com:443 > > > TIMEOUTclose=0 > > > > Command: > > > sudo /usr/bin/stunnel4 stunnel.conf > > > > Error: > > > 009.03.11 00:58:10 LOG5[30424:3082909360]: Threading:PTHREAD > > > SSL:ENGINE > > > Sockets:POLL,IPv6 Auth:LIBWRAP > > > 2009.03.11 00:58:10 LOG6[30424:3082909360]: file ulimit = 1024 (can be > > > changed with 'ulimit -n') > > > 2009.03.11 00:58:10 LOG6[30424:3082909360]: poll() used - no > > > FD_SETSIZE > > > limit for file descriptors > > > 2009.03.11 00:58:10 LOG5[30424:3082909360]: 500 clients allowed > > > 2009.03.11 00:58:10 LOG7[30424:3082909360]: FD 10 in non-blocking mode > > > 2009.03.11 00:58:10 LOG7[30424:3082909360]: FD 11 in non-blocking mode > > > 2009.03.11 00:58:10 LOG7[30424:3082909360]: FD 12 in non-blocking mode > > > 2009.03.11 00:58:10 LOG7[30424:3082909360]: SO_REUSEADDR option set on > > > accept socket > > > 2009.03.11 00:58:10 LOG7[30424:3082909360]: http bound to 0.0.0.0:80 > > > 2009.03.11 00:58:10 LOG7[30430:3082909360]: Created pid file > > > /var/run/stunnel4.pid > > > > > > 2009.03.11 00:58:20 LOG7[30430:3082909360]: http accepted FD=13 from > > > 127.0.0.1:59793 > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: http started > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: FD 13 in non-blocking mode > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Waiting for a libwrap > > > process > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Acquired libwrap process > > > #0 > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Releasing libwrap process > > > #0 > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Released libwrap process > > > #0 > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: http permitted by libwrap > > > from > > > 127.0.0.1:59793 > > > 2009.03.11 00:58:20 LOG5[30430:3082738576]: http accepted connection > > > from > > > 127.0.0.1:59793 > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: FD 14 in non-blocking mode > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: http connecting > > > ${REMOTESERVER_IP}:443 > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: connect_wait: waiting 10 > > > seconds > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: connect_wait: connected > > > 2009.03.11 00:58:20 LOG5[30430:3082738576]: http connected remote > > > server > > > from 10.0.2.15:38710 > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Remote FD=14 initialized > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: SSL state (connect): > > > before/connect initialization > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: SSL state (connect): SSLv3 > > > write > > > client hello A > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: SSL state (connect): SSLv3 > > > read > > > server hello A > > > 2009.03.11 00:58:20 LOG4[30430:3082738576]: VERIFY ERROR: depth=0, > > > error=unable to get local issuer certificate: ${UNIQUE NAME} > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: SSL alert (write): fatal: > > > bad > > > certificate > > > 2009.03.11 00:58:20 LOG3[30430:3082738576]: SSL_connect: 14090086: > > > error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate > > > verify > > > failed > > > 2009.03.11 00:58:20 LOG5[30430:3082738576]: Connection reset: 0 bytes > > > sent > > > to SSL, 0 bytes sent to socket > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: http finished (0 left) > > (${UNIQUE NAME} / ${REMOTESERVER_IP} were replaced) > > > > Tested by connecting the browser to http://127.0.0.1:80/ > > > > How can i get stunnel to redirect http://127.0.0.1:80/ to > > http://remoteserver:443/ and use the certificate and chain to validate > > the connection? Any pointers would also be welcome, since i searched in > > google but i cannot find the correct information, while one would expect > > that this is not the first time that this is being tried. > > > > Thanks, > > > > Eduard Witteveen > > > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)mirt.net > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > >

1 0

Can stunnel do this?
by Miguel Beccari 13 Mar '09

13 Mar '09

I tried this configuration: client = yes debug = debug cert =/Users/etc/stunnel/stunnel.pem [imaps] accept = localhost:143 delay = yes connect = remote:993 and it worked! But if I change "accept = localhost:143" to "accept = localhost:993" it does not work. I need a imaps proxy. Logs does not say anything interesting (SSL accepted: new session negotiated) Thank you all, Miguel

1 0

Newbie Question - Moving stunnel to another machine
by Dave Nasralla 13 Mar '09

13 Mar '09

Hi, I'm pretty new to the unix command line and stunnel. I am running Mac OS 10.5 with the latest version of stunnel. I was able to get stunnel up and running on my computer and it is working fine ( - I installed X-Cold, used Darwinports, got it compiled and configured, and launching at bootup). My question is: If I have an identical Machine (same hardware and OS), is there an easy way to move stunnel over to it? I copied the stunnel executable and the configuration file over to the new machine. I ran it from the terminal command line. % /Applications/stunnel /Applications/stunnel.conf The original location on my machine was (/opt/local/bin/stunnel /opt/ local/etc/stunnel/stunnel.conf) No errors (got the prompt back). But no services start on the configured ports. Am I missing support files? Or am I being dumb to think you can simply copy the program over. I was hoping to not have to jump through the same hoops to get it up and running. Any direction would be appreciated. Thanks, dave naz PS It is a simple configuration to help non SSL Mail clients connect to GMail - no certs involved.

1 0

Configuring stunnel to use p12 and p7b in client mode
by Eduard Witteveen 10 Mar '09

10 Mar '09

Hello, I'm trying to get stunnel running on my local system, so it will connect to the remote a host, which requires authentication with this p12 file(with password). I also have the chain of trust which is in the p7b file. The reason why i want to do this, is that the remote host exposes a soap interface by https, and i think it would be a good idea to tunnel the communications with stunnel, so a transparant configuration can be used. Also, this would mean there is no configuration needed for the browser anymore, since it can connect to the localhost instead of to the remoteserver. I've tested the p12(certificate PKCS12?) and (trust chain PKCS7?) files with internet explorer and firefox. They work(i can browse the remotehost), but i still have to enter the password. I've converted the p12 and p7b files into dem files with the following commands: > openssl pkcs12 -in certificate.p12 -out certificate.pem > Enter Import Password: > MAC verified OKK > Enter PEM pass phrase: > Verifying - Enter PEM pass phrase firefox: store as PEM with chain chain.p7b --> chain.pem Config: > key=certificate.pem > CAfile=chain.pem > client=yes > debug=7 > output=stunnel.log > verify=1 > [http] > accept=80 > connect=www.remoteserver.com:443 > TIMEOUTclose=0 Command: > sudo /usr/bin/stunnel4 stunnel.conf Error: > 009.03.11 00:58:10 LOG5[30424:3082909360]: Threading:PTHREAD > SSL:ENGINE > Sockets:POLL,IPv6 Auth:LIBWRAP > 2009.03.11 00:58:10 LOG6[30424:3082909360]: file ulimit = 1024 (can be > changed with 'ulimit -n') > 2009.03.11 00:58:10 LOG6[30424:3082909360]: poll() used - no > FD_SETSIZE > limit for file descriptors > 2009.03.11 00:58:10 LOG5[30424:3082909360]: 500 clients allowed > 2009.03.11 00:58:10 LOG7[30424:3082909360]: FD 10 in non-blocking mode > 2009.03.11 00:58:10 LOG7[30424:3082909360]: FD 11 in non-blocking mode > 2009.03.11 00:58:10 LOG7[30424:3082909360]: FD 12 in non-blocking mode > 2009.03.11 00:58:10 LOG7[30424:3082909360]: SO_REUSEADDR option set on > accept socket > 2009.03.11 00:58:10 LOG7[30424:3082909360]: http bound to 0.0.0.0:80 > 2009.03.11 00:58:10 LOG7[30430:3082909360]: Created pid file > /var/run/stunnel4.pid > > 2009.03.11 00:58:20 LOG7[30430:3082909360]: http accepted FD=13 from > 127.0.0.1:59793 > 2009.03.11 00:58:20 LOG7[30430:3082738576]: http started > 2009.03.11 00:58:20 LOG7[30430:3082738576]: FD 13 in non-blocking mode > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Waiting for a libwrap > process > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Acquired libwrap process > #0 > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Releasing libwrap process > #0 > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Released libwrap process > #0 > 2009.03.11 00:58:20 LOG7[30430:3082738576]: http permitted by libwrap > from > 127.0.0.1:59793 > 2009.03.11 00:58:20 LOG5[30430:3082738576]: http accepted connection > from > 127.0.0.1:59793 > 2009.03.11 00:58:20 LOG7[30430:3082738576]: FD 14 in non-blocking mode > 2009.03.11 00:58:20 LOG7[30430:3082738576]: http connecting > ${REMOTESERVER_IP}:443 > 2009.03.11 00:58:20 LOG7[30430:3082738576]: connect_wait: waiting 10 > seconds > 2009.03.11 00:58:20 LOG7[30430:3082738576]: connect_wait: connected > 2009.03.11 00:58:20 LOG5[30430:3082738576]: http connected remote > server > from 10.0.2.15:38710 > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Remote FD=14 initialized > 2009.03.11 00:58:20 LOG7[30430:3082738576]: SSL state (connect): > before/connect initialization > 2009.03.11 00:58:20 LOG7[30430:3082738576]: SSL state (connect): SSLv3 > write > client hello A > 2009.03.11 00:58:20 LOG7[30430:3082738576]: SSL state (connect): SSLv3 > read > server hello A > 2009.03.11 00:58:20 LOG4[30430:3082738576]: VERIFY ERROR: depth=0, > error=unable to get local issuer certificate: ${UNIQUE NAME} > 2009.03.11 00:58:20 LOG7[30430:3082738576]: SSL alert (write): fatal: > bad > certificate > 2009.03.11 00:58:20 LOG3[30430:3082738576]: SSL_connect: 14090086: > error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate > verify > failed > 2009.03.11 00:58:20 LOG5[30430:3082738576]: Connection reset: 0 bytes > sent > to SSL, 0 bytes sent to socket > 2009.03.11 00:58:20 LOG7[30430:3082738576]: http finished (0 left) (${UNIQUE NAME} / ${REMOTESERVER_IP} were replaced) Tested by connecting the browser to http://127.0.0.1:80/ How can i get stunnel to redirect http://127.0.0.1:80/ to http://remoteserver:443/ and use the certificate and chain to validate the connection? Any pointers would also be welcome, since i searched in google but i cannot find the correct information, while one would expect that this is not the first time that this is being tried. Thanks, Eduard Witteveen

1 0

Stunnel 4.26 compile issue against openssl 0.9.8j + openssl-fips-1.2
by David W Blaine 10 Mar '09

10 Mar '09

Hi all, When I compile against OpenSSL 0.9.8j + OpenSSL-FIPS-1.2 module on Centos 4.7, I get an error in client.c: client.o(.text+0x1dd): In function `init_ssl': /tmp/stunnel-4.27/src/client.c:333: undefined reference to `FIPS_set_prng_key' collect2: ld returned 1 exit status make[1]: *** [stunnel] Error 1 make[1]: Leaving directory `/tmp/stunnel-4.27/src' make: *** [all-recursive] Error 1 It seems this call is related to a bug in OpenSSL-FIPS-1.1.1 module according to the comments. Checking the references in the includes for both OpenSSL 0.9.8j and OpenSSL-FIPS-1.2, I found that the call should be "fips_set_prng_key" with 3 arguments (the above requires only 2). So based on the comments, I removed it and I was able to successfully compile and install. Not sure if that is the right thing to do??? Dave

2 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users