- stunnel-users - stunnel.org

4.26 works OK, 4.27 will not POP email
by Jeff Salisbury 14 Jun '09

14 Jun '09

Greetings, We have been using Stunnel 4.26 to facilitate the sending and receiving of email with an email client that is not SSL enabled. Version 4.26 has been working great. However, when we upgrade to 4.27, we are unable to POP email (we can send email). We did not change our Stunnel.conf file. Can anyone advise us what we need to do to get 4.27 working? I've included our Stunnel.conf file contents, and the Stunnel log output below. Regards, Jeff ===================================================== # GLOBAL OPTIONS client = yes #output = C:\Documents and Settings\All Users\Application Data\stunnel-log.txt debug = 7 taskbar = yes # SERVICE-LEVEL OPTIONS [pop3] accept=995 connect=mail.OurPOP.com:995 [smtp] accept=465 connect=mail.OurSMTP.com:465 ===================================================== 2009.06.14 14:03:03 LOG7[3348:540]: RAND_status claims sufficient entropy for the PRNG 2009.06.14 14:03:03 LOG7[3348:540]: PRNG seeded successfully 2009.06.14 14:03:03 LOG7[3348:540]: SSL context initialized for service pop3 2009.06.14 14:03:03 LOG7[3348:540]: SSL context initialized for service smtp 2009.06.14 14:03:03 LOG5[3348:540]: stunnel 4.27 on x86-pc-mingw32-gnu with OpenSSL 0.9.8k 25 Mar 2009 2009.06.14 14:03:03 LOG5[3348:540]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2009.06.14 14:03:03 LOG5[3348:3668]: No limit detected for the number of clients 2009.06.14 14:03:03 LOG7[3348:3668]: FD 204 in non-blocking mode 2009.06.14 14:03:03 LOG7[3348:3668]: SO_REUSEADDR option set on accept socket 2009.06.14 14:03:03 LOG7[3348:3668]: pop3 bound to 0.0.0.0:995 2009.06.14 14:03:03 LOG7[3348:3668]: FD 212 in non-blocking mode 2009.06.14 14:03:03 LOG7[3348:3668]: SO_REUSEADDR option set on accept socket 2009.06.14 14:03:03 LOG7[3348:3668]: smtp bound to 0.0.0.0:465 2009.06.14 14:03:11 LOG7[3348:3668]: pop3 accepted FD=228 from 127.0.0.1:2027 2009.06.14 14:03:11 LOG7[3348:3668]: Creating a new thread 2009.06.14 14:03:11 LOG7[3348:3668]: New thread created 2009.06.14 14:03:11 LOG7[3348:3668]: pop3 accepted FD=244 from 127.0.0.1:2026 2009.06.14 14:03:11 LOG7[3348:3668]: Creating a new thread 2009.06.14 14:03:11 LOG7[3348:3668]: New thread created 2009.06.14 14:03:11 LOG7[3348:1144]: pop3 started 2009.06.14 14:03:11 LOG7[3348:1144]: FD 228 in non-blocking mode 2009.06.14 14:03:11 LOG5[3348:1144]: pop3 accepted connection from 127.0.0.1:2027 2009.06.14 14:03:11 LOG7[3348:1144]: FD 268 in non-blocking mode 2009.06.14 14:03:11 LOG6[3348:1144]: connect_blocking: connecting 216.97.239.60:995 2009.06.14 14:03:11 LOG7[3348:4060]: pop3 started 2009.06.14 14:03:11 LOG7[3348:4060]: FD 244 in non-blocking mode 2009.06.14 14:03:11 LOG5[3348:4060]: pop3 accepted connection from 127.0.0.1:2026 2009.06.14 14:03:11 LOG7[3348:4060]: FD 280 in non-blocking mode 2009.06.14 14:03:11 LOG6[3348:4060]: connect_blocking: connecting 216.97.239.60:995 2009.06.14 14:03:11 LOG7[3348:1144]: connect_blocking: s_poll_wait 216.97.239.60:995: waiting 10 seconds 2009.06.14 14:03:11 LOG7[3348:4060]: connect_blocking: s_poll_wait 216.97.239.60:995: waiting 10 seconds 2009.06.14 14:03:11 LOG5[3348:1144]: connect_blocking: connected 216.97.239.60:995 2009.06.14 14:03:11 LOG5[3348:1144]: pop3 connected remote server from 192.168.0.55:2028 2009.06.14 14:03:11 LOG7[3348:1144]: Remote FD=268 initialized 2009.06.14 14:03:11 LOG7[3348:1144]: SSL state (connect): before/connect initialization 2009.06.14 14:03:11 LOG7[3348:1144]: SSL state (connect): SSLv3 write client hello A 2009.06.14 14:03:11 LOG5[3348:4060]: connect_blocking: connected 216.97.239.60:995 2009.06.14 14:03:11 LOG5[3348:4060]: pop3 connected remote server from 192.168.0.55:2029 2009.06.14 14:03:11 LOG7[3348:4060]: Remote FD=280 initialized 2009.06.14 14:03:11 LOG7[3348:4060]: SSL state (connect): before/connect initialization 2009.06.14 14:03:11 LOG7[3348:4060]: SSL state (connect): SSLv3 write client hello A 2009.06.14 14:03:11 LOG7[3348:1144]: SSL alert (read): fatal: handshake failure 2009.06.14 14:03:11 LOG3[3348:1144]: SSL_connect: 14094410: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure 2009.06.14 14:03:11 LOG5[3348:1144]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.06.14 14:03:11 LOG7[3348:1144]: pop3 finished (1 left) 2009.06.14 14:03:11 LOG7[3348:4060]: SSL alert (read): fatal: handshake failure 2009.06.14 14:03:11 LOG3[3348:4060]: SSL_connect: 14094410: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure 2009.06.14 14:03:11 LOG5[3348:4060]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.06.14 14:03:11 LOG7[3348:4060]: pop3 finished (0 left)

1 0

Silence after "Acquired libwrap process"
by James Brown 12 Jun '09

12 Jun '09

I'm trying to use stunnel to send email with SSL authentication. Sending the email with Apple's Mail.app with 'use default ports' selected. stunnel.log output: 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Snagged 64 random bytes from /Users/jlbrown/.rnd 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Wrote 1024 new random bytes to /Users/jlbrown/.rnd 2009.06.12 09:58:17 LOG7[41897:140735078037248]: RAND_status claims sufficient entropy for the PRNG 2009.06.12 09:58:17 LOG7[41897:140735078037248]: PRNG seeded successfully 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Certificate: /etc/ postfix/smtpd.cert 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Certificate loaded 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Key file: /etc/ postfix/smtpd.key 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Private key loaded 2009.06.12 09:58:17 LOG7[41897:140735078037248]: SSL context initialized for service ssmtp 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Certificate: /etc/ postfix/smtpd.cert 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Certificate loaded 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Key file: /etc/ postfix/smtpd.key 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Private key loaded 2009.06.12 09:58:17 LOG7[41897:140735078037248]: SSL context initialized for service ssmtp2 2009.06.12 09:58:17 LOG5[41897:140735078037248]: stunnel 4.27 on i686- apple-darwin9.7.0 with OpenSSL 0.9.7l 28 Sep 2006 2009.06.12 09:58:17 LOG5[41897:140735078037248]: Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv6 Auth:LIBWRAP 2009.06.12 09:58:17 LOG6[41897:140735078037248]: file ulimit = 256 (can be changed with 'ulimit -n') 2009.06.12 09:58:17 LOG6[41897:140735078037248]: FD_SETSIZE = 1024 (some systems allow to increase this value) 2009.06.12 09:58:17 LOG5[41897:140735078037248]: 125 clients allowed 2009.06.12 09:58:17 LOG7[41897:140735078037248]: FD 10 in non-blocking mode 2009.06.12 09:58:17 LOG7[41897:140735078037248]: FD 11 in non-blocking mode 2009.06.12 09:58:17 LOG7[41897:140735078037248]: FD 12 in non-blocking mode 2009.06.12 09:58:17 LOG7[41897:140735078037248]: SO_REUSEADDR option set on accept socket 2009.06.12 09:58:17 LOG7[41897:140735078037248]: ssmtp bound to 0.0.0.0:465 2009.06.12 09:58:17 LOG7[41897:140735078037248]: FD 13 in non-blocking mode 2009.06.12 09:58:17 LOG7[41897:140735078037248]: SO_REUSEADDR option set on accept socket 2009.06.12 09:58:17 LOG7[41897:140735078037248]: ssmtp2 bound to 0.0.0.0:587 2009.06.12 09:58:17 LOG7[41903:140735078037248]: Created pid file /usr/ local/var/run/stunnel/stunnel.pid 2009.06.12 09:58:56 LOG7[41903:140735078037248]: ssmtp2 accepted FD=14 from 192.168.1.10:64996 2009.06.12 09:58:56 LOG7[41903:4295561216]: ssmtp2 started 2009.06.12 09:58:56 LOG7[41903:4295561216]: FD 14 in non-blocking mode 2009.06.12 09:58:56 LOG7[41903:4295561216]: TCP_NODELAY option set on local socket 2009.06.12 09:58:56 LOG7[41903:4295561216]: Waiting for a libwrap process 2009.06.12 09:58:56 LOG7[41903:4295561216]: Acquired libwrap process #0 2009.06.12 10:00:04 LOG7[41903:140735078037248]: ssmtp2 accepted FD=15 from 192.168.1.10:65006 2009.06.12 10:00:04 LOG7[41903:4295675904]: ssmtp2 started 2009.06.12 10:00:04 LOG7[41903:4295675904]: FD 15 in non-blocking mode 2009.06.12 10:00:04 LOG7[41903:4295675904]: TCP_NODELAY option set on local socket 2009.06.12 10:00:04 LOG7[41903:4295675904]: Waiting for a libwrap process 2009.06.12 10:00:04 LOG7[41903:4295675904]: Acquired libwrap process #1 2009.06.12 10:01:04 LOG7[41903:140735078037248]: ssmtp accepted FD=16 from 192.168.1.10:65013 2009.06.12 10:01:04 LOG7[41903:4295790592]: ssmtp started 2009.06.12 10:01:04 LOG7[41903:4295790592]: FD 16 in non-blocking mode 2009.06.12 10:01:04 LOG7[41903:4295790592]: TCP_NODELAY option set on local socket 2009.06.12 10:01:04 LOG7[41903:4295790592]: Waiting for a libwrap process 2009.06.12 10:01:04 LOG7[41903:4295790592]: Acquired libwrap process #2 2009.06.12 10:03:56 LOG6[41903:4295561216]: read_blocking: s_poll_wait timeout 2009.06.12 10:03:56 LOG5[41903:4295561216]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.06.12 10:03:56 LOG7[41903:4295561216]: ssmtp2 finished (2 left) 2009.06.12 10:03:56 LOG7[41903:140735078037248]: ssmtp accepted FD=14 from 192.168.1.10:65022 2009.06.12 10:03:56 LOG7[41903:4295561216]: ssmtp started 2009.06.12 10:03:56 LOG7[41903:4295561216]: FD 14 in non-blocking mode 2009.06.12 10:03:56 LOG7[41903:4295561216]: TCP_NODELAY option set on local socket 2009.06.12 10:03:56 LOG7[41903:4295561216]: Waiting for a libwrap process 2009.06.12 10:03:56 LOG7[41903:4295561216]: Acquired libwrap process #3 2009.06.12 10:05:04 LOG6[41903:4295675904]: read_blocking: s_poll_wait timeout 2009.06.12 10:05:04 LOG5[41903:4295675904]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.06.12 10:05:04 LOG7[41903:4295675904]: ssmtp2 finished (2 left) 2009.06.12 10:05:04 LOG7[41903:140735078037248]: ssmtp accepted FD=15 from 192.168.1.10:65028 2009.06.12 10:05:04 LOG7[41903:4295675904]: ssmtp started 2009.06.12 10:05:04 LOG7[41903:4295675904]: FD 15 in non-blocking mode 2009.06.12 10:05:04 LOG7[41903:4295675904]: TCP_NODELAY option set on local socket 2009.06.12 10:05:04 LOG7[41903:4295675904]: Waiting for a libwrap process 2009.06.12 10:05:04 LOG7[41903:4295675904]: Acquired libwrap process #4 2009.06.12 10:06:04 LOG6[41903:4295790592]: read_blocking: s_poll_wait timeout 2009.06.12 10:06:04 LOG5[41903:4295790592]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.06.12 10:06:04 LOG7[41903:4295790592]: ssmtp finished (2 left) 2009.06.12 10:06:04 LOG7[41903:140735078037248]: ssmtp accepted FD=16 from 192.168.1.10:65032 2009.06.12 10:06:04 LOG7[41903:4295790592]: ssmtp started 2009.06.12 10:06:04 LOG7[41903:4295790592]: FD 16 in non-blocking mode 2009.06.12 10:06:04 LOG7[41903:4295790592]: TCP_NODELAY option set on local socket 2009.06.12 10:06:04 LOG7[41903:4295790592]: Waiting for a libwrap process 2009.06.12 10:08:56 LOG6[41903:4295561216]: read_blocking: s_poll_wait timeout 2009.06.12 10:08:56 LOG5[41903:4295561216]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.06.12 10:08:56 LOG7[41903:4295561216]: ssmtp finished (2 left) 2009.06.12 10:08:56 LOG7[41903:140735078037248]: ssmtp2 accepted FD=14 from 192.168.1.10:65040 2009.06.12 10:08:56 LOG7[41903:4295561216]: ssmtp2 started 2009.06.12 10:08:56 LOG7[41903:4295561216]: FD 14 in non-blocking mode 2009.06.12 10:08:56 LOG7[41903:4295561216]: TCP_NODELAY option set on local socket 2009.06.12 10:08:56 LOG7[41903:4295561216]: Waiting for a libwrap process 2009.06.12 10:10:04 LOG6[41903:4295675904]: read_blocking: s_poll_wait timeout 2009.06.12 10:10:04 LOG5[41903:4295675904]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.06.12 10:10:04 LOG7[41903:4295675904]: ssmtp finished (2 left) 2009.06.12 10:10:04 LOG7[41903:140735078037248]: ssmtp accepted FD=15 from 192.168.1.10:65044 2009.06.12 10:10:04 LOG7[41903:4295675904]: ssmtp started 2009.06.12 10:10:04 LOG7[41903:4295675904]: FD 15 in non-blocking mode 2009.06.12 10:10:04 LOG7[41903:4295675904]: TCP_NODELAY option set on local socket 2009.06.12 10:10:04 LOG7[41903:4295675904]: Waiting for a libwrap process 2009.06.12 10:11:04 LOG7[41903:140735078037248]: ssmtp accepted FD=17 from 192.168.1.10:65048 2009.06.12 10:11:04 LOG7[41903:4295905280]: ssmtp started 2009.06.12 10:11:04 LOG7[41903:4295905280]: FD 17 in non-blocking mode 2009.06.12 10:11:04 LOG7[41903:4295905280]: TCP_NODELAY option set on local socket 2009.06.12 10:11:04 LOG7[41903:4295905280]: Waiting for a libwrap process 2009.06.12 10:13:56 LOG7[41903:140735078037248]: ssmtp accepted FD=18 from 192.168.1.10:65060 2009.06.12 10:13:56 LOG7[41903:4297134080]: ssmtp started 2009.06.12 10:13:56 LOG7[41903:4297134080]: FD 18 in non-blocking mode 2009.06.12 10:13:56 LOG7[41903:4297134080]: TCP_NODELAY option set on local socket 2009.06.12 10:13:56 LOG7[41903:4297134080]: Waiting for a libwrap process 2009.06.12 10:15:04 LOG7[41903:140735078037248]: ssmtp accepted FD=19 from 192.168.1.10:65063 2009.06.12 10:15:04 LOG7[41903:4297211904]: ssmtp started 2009.06.12 10:15:04 LOG7[41903:4297211904]: FD 19 in non-blocking mode 2009.06.12 10:15:04 LOG7[41903:4297211904]: TCP_NODELAY option set on local socket 2009.06.12 10:15:04 LOG7[41903:4297211904]: Waiting for a libwrap process 2009.06.12 10:18:56 LOG7[41903:140735078037248]: ssmtp2 accepted FD=20 from 192.168.1.10:65090 2009.06.12 10:18:56 LOG7[41903:4297326592]: ssmtp2 started 2009.06.12 10:18:56 LOG7[41903:4297326592]: FD 20 in non-blocking mode 2009.06.12 10:18:56 LOG7[41903:4297326592]: TCP_NODELAY option set on local socket 2009.06.12 10:18:56 LOG7[41903:4297326592]: Waiting for a libwrap process 2009.06.12 10:20:04 LOG7[41903:140735078037248]: ssmtp2 accepted FD=21 from 192.168.1.10:65093 2009.06.12 10:20:04 LOG7[41903:4297441280]: ssmtp2 started 2009.06.12 10:20:04 LOG7[41903:4297441280]: FD 21 in non-blocking mode 2009.06.12 10:20:04 LOG7[41903:4297441280]: TCP_NODELAY option set on local socket 2009.06.12 10:20:04 LOG7[41903:4297441280]: Waiting for a libwrap process 2009.06.12 10:23:56 LOG7[41903:140735078037248]: ssmtp2 accepted FD=22 from 192.168.1.10:65111 2009.06.12 10:23:56 LOG7[41903:4297555968]: ssmtp2 started 2009.06.12 10:23:56 LOG7[41903:4297555968]: FD 22 in non-blocking mode 2009.06.12 10:23:56 LOG7[41903:4297555968]: TCP_NODELAY option set on local socket 2009.06.12 10:23:56 LOG7[41903:4297555968]: Waiting for a libwrap process 2009.06.12 10:25:04 LOG7[41903:140735078037248]: ssmtp accepted FD=23 from 192.168.1.10:65113 2009.06.12 10:25:04 LOG7[41903:4297670656]: ssmtp started 2009.06.12 10:25:04 LOG7[41903:4297670656]: FD 23 in non-blocking mode 2009.06.12 10:25:04 LOG7[41903:4297670656]: TCP_NODELAY option set on local socket 2009.06.12 10:25:04 LOG7[41903:4297670656]: Waiting for a libwrap process 2009.06.12 10:28:56 LOG7[41903:140735078037248]: ssmtp2 accepted FD=24 from 192.168.1.10:65125 2009.06.12 10:28:56 LOG7[41903:4297785344]: ssmtp2 started 2009.06.12 10:28:56 LOG7[41903:4297785344]: FD 24 in non-blocking mode 2009.06.12 10:28:56 LOG7[41903:4297785344]: TCP_NODELAY option set on local socket 2009.06.12 10:28:56 LOG7[41903:4297785344]: Waiting for a libwrap process 2009.06.12 10:30:04 LOG7[41903:140735078037248]: ssmtp2 accepted FD=25 from 192.168.1.10:65128 2009.06.12 10:30:04 LOG7[41903:4297900032]: ssmtp2 started 2009.06.12 10:30:04 LOG7[41903:4297900032]: FD 25 in non-blocking mode 2009.06.12 10:30:04 LOG7[41903:4297900032]: TCP_NODELAY option set on local socket 2009.06.12 10:30:04 LOG7[41903:4297900032]: Waiting for a libwrap process 2009.06.12 10:33:56 LOG7[41903:140735078037248]: ssmtp2 accepted FD=26 from 192.168.1.10:65299 2009.06.12 10:33:56 LOG7[41903:4298014720]: ssmtp2 started 2009.06.12 10:33:56 LOG7[41903:4298014720]: FD 26 in non-blocking mode 2009.06.12 10:33:56 LOG7[41903:4298014720]: TCP_NODELAY option set on local socket 2009.06.12 10:33:56 LOG7[41903:4298014720]: Waiting for a libwrap process 2009.06.12 10:35:04 LOG7[41903:140735078037248]: ssmtp2 accepted FD=27 from 192.168.1.10:65326 2009.06.12 10:35:04 LOG7[41903:4298129408]: ssmtp2 started 2009.06.12 10:35:04 LOG7[41903:4298129408]: FD 27 in non-blocking mode 2009.06.12 10:35:04 LOG7[41903:4298129408]: TCP_NODELAY option set on local socket 2009.06.12 10:35:04 LOG7[41903:4298129408]: Waiting for a libwrap process 2009.06.12 10:40:04 LOG7[41903:140735078037248]: ssmtp accepted FD=28 from 192.168.1.10:65365 2009.06.12 10:40:04 LOG7[41903:4298244096]: ssmtp started 2009.06.12 10:40:04 LOG7[41903:4298244096]: FD 28 in non-blocking mode 2009.06.12 10:40:04 LOG7[41903:4298244096]: TCP_NODELAY option set on local socket 2009.06.12 10:40:04 LOG7[41903:4298244096]: Waiting for a libwrap process 2009.06.12 10:45:04 LOG7[41903:140735078037248]: ssmtp accepted FD=29 from 192.168.1.10:65377 2009.06.12 10:45:04 LOG7[41903:4298358784]: ssmtp started 2009.06.12 10:45:04 LOG7[41903:4298358784]: FD 29 in non-blocking mode 2009.06.12 10:45:04 LOG7[41903:4298358784]: TCP_NODELAY option set on local socket 2009.06.12 10:45:04 LOG7[41903:4298358784]: Waiting for a libwrap process 2009.06.12 10:50:04 LOG7[41903:140735078037248]: ssmtp accepted FD=30 from 192.168.1.10:65406 2009.06.12 10:50:04 LOG7[41903:4298473472]: ssmtp started 2009.06.12 10:50:04 LOG7[41903:4298473472]: FD 30 in non-blocking mode 2009.06.12 10:50:04 LOG7[41903:4298473472]: TCP_NODELAY option set on local socket 2009.06.12 10:50:04 LOG7[41903:4298473472]: Waiting for a libwrap process Stunnel is running on Mac OS X 10.5.7. Any help would be much appreciated. James.

1 0

Re: [stunnel-users] 1 server and more desktops
by aaa aaa 08 Jun '09

08 Jun '09

Hello Carter, thank you very much for your help and nice examples. I will try it in my local network. Have a good day. Mia ---- Pôvodná správa ---- Od koho: Carter Browne <cbrowne(a)cbcs-usa.com> Komu: aaa aaa <miamia(a)inMail.sk> Dátum: 8. 6. 2009 17:52:00 Predmet: Re: [stunnel-users] 1 server and more desktops Mia, I work in both Windows and Linux, so I use a Windows approach - copying files where in Linux a link would be more appropriate. Assume server.pem is the server full server certificate including the private key and client1.pem is a full client certificate including the key. The first step is to make a copy of the server certificate and delete the lines starting with -----BEGIN RSA PRIVATE KEY------ down through the blank line after -----END RSA PRIVATE KEY----- Initial I call this server-pub.pem The command: openssl x509 -in server-pub.pem -subject_hash -noout will print out the hash for the server key (as 8 hexadecimal digits), for example abcef012 Then I rename server-pub.pem to abcdef012.0 I repeat the same process for each client key, so that client1.pem in this example would have a public key named 987654fe.0 (assuming that the hash of 987654fe). In the client1 configuration: cert = client1.pem key = client1.pem verify = 3 cafile = abcdef012.0 In the server configuration cert = server1.pem key = server1.pem verify = 3 capath = capath In the capath directory is 987654fe.0 ... Plus the hashes of the other clients. In Windows, the capath is under the stunnel directory. The client certificates can also be concatenated in a single file. If you use a directory, it is not necessary to restart stunnel if you add a new client. If you use a concatenated file, you do have to restart stunnel if you add a client. There are some notes in the documentation about the structure of a concatenated file. I hope this helps. Carter Carter Browne CBCS cbrowne(a)cbcs-usa.com 781-721-2890 aaa aaa wrote: > Hi Carter, > > thank you. I am trying to use scenario with self-signed certificates > exactly like you are using it. Could you please write me some examples > of config for server and clients? I don't know where to put private > keys and how to set up server for acceptation of certificates from > clients only - server must reject all communication without/or with > other certificates as are stored in his folder. > > thank you in advance > > regards, > mia > > ---- Pôvodná správa ---- > Od koho: Carter Browne <cbrowne(a)cbcs-usa.com> > Komu: aaa aaa <miamia(a)inMail.sk> > Dátum: 8. 6. 2009 15:00:00 > Predmet: Re: [stunnel-users] 1 server and more desktops > > I do this using self-signed certificates and verify=2 or verify=3. The > remote computers would only have the servers public certificate their > CAfile (or CApath). The server must have all the remote computers > public certificates in its CAfile or CApath. See the rules about how to > build those. If you are only using self-signed certificates, you can > use verify=3, otherwise you will have to use verify=2. Each port that > you want to forward must be in you stunnel.conf file - without knowing > what you are trying to do, it is hard to be more specific. > > Carter > > Carter Browne > CBCS > cbrowne(a)cbcs-usa.com > 781-721-2890 > > > > aaa aaa wrote: > > hello Christophe, > > > > thanks for your answer. Sorry for any misunderstanding. Well, I just > > wanted to ask if it is able to set stunnel for working with more > > certificates? So it means that I don't want to have secured tunnel > > between remote and local computer only but also between one remote and > > many local computers with more certificates? Every local computer > > should have own certificate. > > > > Is this possible? > > > > thank you. > > > > ---- Pôvodná správa ---- > > Od koho: Christophe Nanteuil <christophe.nanteuil(a)gmail.com> > > Komu: aaa aaa <miamia(a)inmail.sk> > > Dátum: 7. 6. 2009 16:27:00 > > Predmet: Re: [stunnel-users] 1 server and more desktops > > > > Hello, > > > > Stunnel is an application oriented tunnel, not a machine oriented > > tunnel. Please, be more precise in your requests if you want someone > > to be able to help you. It seems also that the stunnel documentation > > pages are worh reading in your case. > > > > Regards, > > > > -- > > Christophe > > > > > > 2009/6/7 aaa aaa <miamia(a)inmail.sk>: > > > Hello, > > > > > > I have one server and 3 desktops (PC1,PC2,PC3). I need to do this: > > every pc > > > should communicate with server with his own certificate and server > > should > > > sends anwser back to the computer encrypted for this one pc only. > > > > > > Example: PC3 {with server's public key} sends data to server and > server > > > sends answer to PC3 (encrypted wiht unique PC3's public key). > > > then PC2 {with server's public key} sends data to server and server > > sends > > > answer to PC2 (encrypted wiht unique PC2's public key). and so > on... how > > > should I configure stunnel for this? > > > > > > And another question > how should I configure all computers (server, > > > pc1,pc2,pc3) to accept communication over secured stunnel only and > > drop all > > > other unsecured communication? > > > > > > > > > thank you in advance. > > > regards, Mia > > > ---------- > > > Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. > > Domena, > > > webhosting, e-mail a seo od 10 centov/denne. > > > > > > _______________________________________________ > > > stunnel-users mailing list > > > stunnel-users(a)mirt.net > > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > > > > > > ---------- > > Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk > > <http://www.inpage.sk/>. Domena, webhosting, e-mail a seo od 10 > > centov/denne. > > ------------------------------------------------------------------------ > > > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)mirt.net > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > ---------- > Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk > <http://www.inpage.sk/>. Domena, webhosting, e-mail a seo od 10 > centov/denne. ---------- Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. Domena, webhosting, e-mail a seo od 10 centov/denne.

1 0

Re: [stunnel-users] 1 server and more desktops
by aaa aaa 08 Jun '09

08 Jun '09

Hi Carter, thank you. I am trying to use scenario with self-signed certificates exactly like you are using it. Could you please write me some examples of config for server and clients? I don't know where to put private keys and how to set up server for acceptation of certificates from clients only - server must reject all communication without/or with other certificates as are stored in his folder. thank you in advance regards, mia > ---- Pôvodná správa ---- > Od koho: Carter Browne <cbrowne(a)cbcs-usa.com> > Komu: aaa aaa <miamia(a)inMail.sk> > Dátum: 8. 6. 2009 15:00:00 > Predmet: Re: [stunnel-users] 1 server and more desktops > > I do this using self-signed certificates and verify=2 or verify=3. The > remote computers would only have the servers public certificate their > CAfile (or CApath). The server must have all the remote computers > public certificates in its CAfile or CApath. See the rules about how to > build those. If you are only using self-signed certificates, you can > use verify=3, otherwise you will have to use verify=2. Each port that > you want to forward must be in you stunnel.conf file - without knowing > what you are trying to do, it is hard to be more specific. > > Carter > > Carter Browne > CBCS > cbrowne(a)cbcs-usa.com > 781-721-2890 > > > > aaa aaa wrote: > > hello Christophe, > > > > thanks for your answer. Sorry for any misunderstanding. Well, I just > > wanted to ask if it is able to set stunnel for working with more > > certificates? So it means that I don't want to have secured tunnel > > between remote and local computer only but also between one remote and > > many local computers with more certificates? Every local computer > > should have own certificate. > > > > Is this possible? > > > > thank you. > > > > ---- Pôvodná správa ---- > > Od koho: Christophe Nanteuil <christophe.nanteuil(a)gmail.com> > > Komu: aaa aaa <miamia(a)inmail.sk> > > Dátum: 7. 6. 2009 16:27:00 > > Predmet: Re: [stunnel-users] 1 server and more desktops > > > > Hello, > > > > Stunnel is an application oriented tunnel, not a machine oriented > > tunnel. Please, be more precise in your requests if you want someone > > to be able to help you. It seems also that the stunnel documentation > > pages are worh reading in your case. > > > > Regards, > > > > -- > > Christophe > > > > > > 2009/6/7 aaa aaa <miamia(a)inmail.sk>: > > > Hello, > > > > > > I have one server and 3 desktops (PC1,PC2,PC3). I need to do this: > > every pc > > > should communicate with server with his own certificate and server > > should > > > sends anwser back to the computer encrypted for this one pc only. > > > > > > Example: PC3 {with server's public key} sends data to server and > server > > > sends answer to PC3 (encrypted wiht unique PC3's public key). > > > then PC2 {with server's public key} sends data to server and server > > sends > > > answer to PC2 (encrypted wiht unique PC2's public key). and so > on... how > > > should I configure stunnel for this? > > > > > > And another question > how should I configure all computers (server, > > > pc1,pc2,pc3) to accept communication over secured stunnel only and > > drop all > > > other unsecured communication? > > > > > > > > > thank you in advance. > > > regards, Mia > > > ---------- > > > Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. > > Domena, > > > webhosting, e-mail a seo od 10 centov/denne. > > > > > > _______________________________________________ > > > stunnel-users mailing list > > > stunnel-users(a)mirt.net > > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > > > > > > ---------- > > Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk > > <http://www.inpage.sk/>. Domena, webhosting, e-mail a seo od 10 > > centov/denne. > > ------------------------------------------------------------------------ > > > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)mirt.net > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > ---------- > Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk > <http://www.inpage.sk/>. Domena, webhosting, e-mail a seo od 10 > centov/denne. ---------- Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. Domena, webhosting, e-mail a seo od 10 centov/denne.

1 0

Stunnel client hangs in background mode when smartcard is used
by John Abloyer 08 Jun '09

08 Jun '09

Hi! I have a problem when running ssh over stunnel in background mode ('foreground' out-commented in config file). In foreground mode, everything works fine. I'm using a modified OpenSSL, adding an engine that is dedicated to communicate with a smartcard reader. The scenario is: - Starting stunnel on server, extract from config file: [ssh] accept = myserver:122 connect = 22 - Starting stunnel on client, extract from config file: engine = myengine engineNum = 1 client = yes [ssh] accept = 22 connect = myserver:122 I come to here, than it hangs: ... 2009.06.08 15:08:22 LOG7[472:3054680976]: SSL state (connect): SSLv3 read server certificate A 2009.06.08 15:08:22 LOG7[472:3054680976]: SSL state (connect): SSLv3 read server certificate request A 2009.06.08 15:08:22 LOG7[472:3054680976]: SSL state (connect): SSLv3 read server done A 2009.06.08 15:08:22 LOG7[472:3054680976]: SSL state (connect): SSLv3 write client certificate A 2009.06.08 15:08:22 LOG7[472:3054680976]: SSL state (connect): SSLv3 write client key exchange A - - - - - - - But when I run in foreground mode, it all works fine and stunnel continues and I get the ssh login prompt. I'm running RHEL 5.2, OpenSSL 0.9.8*, stunnel 4.27 Any help would be appreciated Rgds JA

1 0

start parameters
by Sebastian Rose-Indorf 07 Jun '09

07 Jun '09

Hello, a short question: Which start parameters are there for Stunnel v4.xx? Thanks, Seb. _ ASCII ribbon campaign against HTML e-mail ( ) & proprietary e-mail formats X / \ www.asciiribbon.org

1 0

Re: [stunnel-users] 1 server and more desktops
by aaa aaa 07 Jun '09

07 Jun '09

hello Christophe, thanks for your answer. Sorry for any misunderstanding. Well, I just wanted to ask if it is able to set stunnel for working with more certificates? So it means that I don't want to have secured tunnel between remote and local computer only but also between one remote and many local computers with more certificates? Every local computer should have own certificate. Is this possible? thank you. ---- Pôvodná správa ---- Od koho: Christophe Nanteuil <christophe.nanteuil(a)gmail.com> Komu: aaa aaa <miamia(a)inmail.sk> Dátum: 7. 6. 2009 16:27:00 Predmet: Re: [stunnel-users] 1 server and more desktops Hello, Stunnel is an application oriented tunnel, not a machine oriented tunnel. Please, be more precise in your requests if you want someone to be able to help you. It seems also that the stunnel documentation pages are worh reading in your case. Regards, -- Christophe 2009/6/7 aaa aaa <miamia(a)inmail.sk>: > Hello, > > I have one server and 3 desktops (PC1,PC2,PC3). I need to do this: every pc > should communicate with server with his own certificate and server should > sends anwser back to the computer encrypted for this one pc only. > > Example: PC3 {with server's public key} sends data to server and server > sends answer to PC3 (encrypted wiht unique PC3's public key). > then PC2 {with server's public key} sends data to server and server sends > answer to PC2 (encrypted wiht unique PC2's public key). and so on... how > should I configure stunnel for this? > > And another question > how should I configure all computers (server, > pc1,pc2,pc3) to accept communication over secured stunnel only and drop all > other unsecured communication? > > > thank you in advance. > regards, Mia > ---------- > Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. Domena, > webhosting, e-mail a seo od 10 centov/denne. > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > ---------- Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. Domena, webhosting, e-mail a seo od 10 centov/denne.

1 0

stunnel through httpd
by Chatty 07 Jun '09

07 Jun '09

Hello, I've got the crazy idea to run stunnel behind an existing, SSL-enabled, basic-auth-using httpd. Configuration would be as follows: 1. put some stunnel.cgi into /usr/www/cgi-bin which would call stunnel binary 2. start stunnel client with -r https://login:[email protected]/cgi-bin/stunnel.cgi Advantages (assumed you're behind a proxy which allows only 443 as outgoing port): a. You can still access other WebIFs on that server. b. You don't have to administer another web server including authentication, certificates and so on. May be stunnel is not the best tool for the above scenario (I reckon stunnel is currently unable to fulfill this)... I hope someone can shed some light on this. Cheers, Chatty.

1 0

1 server and more desktops
by aaa aaa 07 Jun '09

07 Jun '09

Hello, I have one server and 3 desktops (PC1,PC2,PC3). I need to do this: every pc should communicate with server with his own certificate and server should sends anwser back to the computer encrypted for this one pc only. Example: PC3 {with server's public key} sends data to server and server sends answer to PC3 (encrypted wiht unique PC3's public key). then PC2 {with server's public key} sends data to server and server sends answer to PC2 (encrypted wiht unique PC2's public key). and so on... how should I configure stunnel for this? And another question > how should I configure all computers (server, pc1,pc2,pc3) to accept communication over secured stunnel only and drop all other unsecured communication? thank you in advance. regards, Mia ---------- Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. Domena, webhosting, e-mail a seo od 10 centov/denne.

2 1

securing OpenBSD/FreeBSD with stunnel
by aaa aaa 07 Jun '09

07 Jun '09

Hello guys, I would like to secure my OpenBSD/FreeBSD for communication over stunnel only. How should I configure BSD and stunnel when I want allow comminucation with one server only (data from pc encrypted with server's public certificate and allow data from this server to my pc encrypted with pc's public key) and drop all other communication (all other ports and certificates)? thank you, mia ---------- Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. Domena, webhosting, e-mail a seo od 10 centov/denne.

1 0

Newbie question
by STEVEN BLAIR 02 Jun '09

02 Jun '09

I would be really grateful if someone could help me out with this problem. There appears to be a very high time between my client and server in transferring data. The log shows the following: 2009.06.02 12:32:59 LOG5[5824:5516]: TS3_GPRS accepted connection from 193.35.132.231:45050 2009.06.02 12:32:59 LOG7[5824:5516]: SSL state (accept): before/accept initialization 2009.06.02 12:32:59 LOG7[5824:5516]: SSL state (accept): SSLv3 read client hello A 2009.06.02 12:32:59 LOG7[5824:5516]: SSL state (accept): SSLv3 write server hello A 2009.06.02 12:32:59 LOG7[5824:5516]: SSL state (accept): SSLv3 write certificate A 2009.06.02 12:32:59 LOG7[5824:5516]: SSL state (accept): SSLv3 write certificate request A 2009.06.02 12:32:59 LOG7[5824:5516]: SSL state (accept): SSLv3 flush data 2009.06.02 12:33:09 LOG5[5824:5516]: CRL: verification passed 2009.06.02 12:33:09 LOG5[5824:5516]: VERIFY OK: depth=1, /C=UK/ST=Fife/L=Dunfermline/O=TS3 Services Ltd/OU=Infrastructure/CN=TS3 Services Ltd/emailAddress=helpdesk(a)ts3services.co.uk 2009.06.02 12:33:09 LOG5[5824:5516]: CRL: verification passed 2009.06.02 12:33:09 LOG5[5824:5516]: VERIFY OK: depth=0, /C=UK/ST=Fife/O=TS3 Services Ltd/OU=Terminal/CN=TS3 Services Ltd/emailAddress=helpdesk(a)ts3services.co.uk 2009.06.02 12:33:09 LOG7[5824:5516]: SSL state (accept): SSLv3 read client certificate A 2009.06.02 12:33:09 LOG7[5824:5516]: SSL state (accept): SSLv3 read client key exchange A 2009.06.02 12:33:09 LOG7[5824:5516]: SSL state (accept): SSLv3 read certificate verify A 2009.06.02 12:33:10 LOG7[5824:5516]: SSL state (accept): SSLv3 read finished A 2009.06.02 12:33:10 LOG7[5824:5516]: SSL state (accept): SSLv3 write change cipher spec A 2009.06.02 12:33:10 LOG7[5824:5516]: SSL state (accept): SSLv3 write finished A 2009.06.02 12:33:10 LOG7[5824:5516]: SSL state (accept): SSLv3 flush data 2009.06.02 12:33:10 LOG7[5824:5516]: 2 items in the session cache 2009.06.02 12:33:10 LOG7[5824:5516]: 0 client connects (SSL_connect()) 2009.06.02 12:33:10 LOG7[5824:5516]: 0 client connects that finished 2009.06.02 12:33:10 LOG7[5824:5516]: 0 client renegotiations requested 2009.06.02 12:33:10 LOG7[5824:5516]: 2 server connects (SSL_accept()) 2009.06.02 12:33:10 LOG7[5824:5516]: 2 server connects that finished 2009.06.02 12:33:10 LOG7[5824:5516]: 0 server renegotiations requested 2009.06.02 12:33:10 LOG7[5824:5516]: 0 session cache hits 2009.06.02 12:33:10 LOG7[5824:5516]: 0 session cache misses 2009.06.02 12:33:10 LOG7[5824:5516]: 0 session cache timeouts 2009.06.02 12:33:10 LOG6[5824:5516]: SSL accepted: new session negotiated 2009.06.02 12:33:10 LOG6[5824:5516]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2009.06.02 12:33:10 LOG7[5824:5516]: FD 292 in non-blocking mode 2009.06.02 12:33:10 LOG7[5824:5516]: TS3_GPRS connecting 127.0.0.1:8139 2009.06.02 12:33:10 LOG7[5824:5516]: connect_wait: waiting 10 seconds 2009.06.02 12:33:10 LOG7[5824:5516]: connect_wait: connected 2009.06.02 12:33:10 LOG5[5824:5516]: TS3_GPRS connected remote server from 127.0.0.1:2273 2009.06.02 12:33:10 LOG7[5824:5516]: Remote FD=292 initialized 2009.06.02 12:33:31 LOG7[5824:5516]: Socket closed on read 2009.06.02 12:33:31 LOG7[5824:5516]: SSL write shutdown 2009.06.02 12:33:31 LOG7[5824:5516]: SSL alert (write): warning: close notify 2009.06.02 12:33:31 LOG6[5824:5516]: SSL socket closed on SSL_shutdown 2009.06.02 12:33:31 LOG7[5824:5516]: Socket write shutdown 2009.06.02 12:33:31 LOG5[5824:5516]: Connection closed: 65 bytes sent to SSL, 185 bytes sent to socket 2009.06.02 12:33:31 LOG7[5824:5516]: TS3_GPRS finished (0 left) The main issue for me is the time between the two lines: 2009.06.02 12:32:59 LOG7[5824:5516]: SSL state (accept): SSLv3 flush data 2009.06.02 12:33:09 LOG5[5824:5516]: CRL: verification passed The handshaking and certificate exchange appears to be pretty quick, but I need to understand why there is 10 second delay between these two lines. It seems horrendous amount of time for transferring data. It might be my lack of understanding on the SSL process, so any information on this would be greatly appreciated. Thanks in advance, Steven

1 0

Re: [stunnel-users] Stunnel for secure email connections
by Lee 25 May '09

25 May '09

Thanks again, Guy, I appreciate your efforts there. So I don't have to do anything regarding certificates or digital signatures, or anything along those lines? I just install OpenSSL and Stunnel, configure stunnel.conf, tweak Thunderbird's accounts settings and Avast's ports, and go with it? Guy wrote: > So what you have to do to proxy the connections through Avast! I don't > know, you'll need to show. > Do you *really* need to scan your outbound connections? > This whole thing is more of a challenge / experiment than anything else. Certainly, scanning my SMTP connection(s) is far from important. Off this specific Stunnel issue but related:- For the last day or so, I've gone back to my 'old' setup of TB + Popfile + Avast, and I've noticed that emails from my 'secure' POP connections are actually being scanned by Avast. They probably have been for some time and I didn't notice, but only recently have I turned on the 'adding of notes' in Avast's email scanner which adds an email footer along the lines of 'Avast found this message to be clean'. I assume this scanning of 'secure' emails is a convenient byproduct somehow or other of routing the secure connections through Popfile. For reference, Popfile is listening on its default port of 110, and the Avast email scanner currently also only has port 110 in its POP redirected ports settings. Thunderbird has the host for those accounts as 127.0.0.1, also on port 110, and the username is in the form of: pop_server:username:ssl which Popfile requires. The :ssl is required by Popfile to handle secure connections. I do notice that non-secure connections' emails end up with the scanning footer being added twice, suggesting Avast is double scanning them. Secure connections' emails only get the one footer added. So all told, all incoming email seems to be scanned by Avast, albeit some of it twice. > Your stunnel configuration file has 2 [popmail] service names, that > will be confusing. And why do you have a [popmail] and [pop3_sky] > connecting to the same MTA? > That is because I don't know what I'm doing :) I originally built stunnel.conf without catering for Popfile, then I wanted to introduce Popfile into the equation, so I found the below advice page regarding Popfile and Stunnel :- http://getpopfile.org/docs/howtos:stunnel It appears I wrongly guessed how to interpret that advice on what to add to stunnel.conf I have since had some clarification on this from a query I raised on this at the Popfile forums:- http://getpopfile.org/discussion/1/188 > Did you enable debugging within stunnel? > > Global options: > > debug = debug > output = stunnel.log > Yes, I did try that, and dabbled a little with the packet sniffers. However I didn't find it any easier to pinpoint what was actually going on regarding the prescence or otherwise of a secure connection. ie I don't know what I'm looking at/for. At the moment, my only method of 'testing' what is 'probably' going on, is to open or close parts of my local chain, and thereby build an apparent picture of what is happening. My original doubts of 'am I actually achieving a secure connection using Stunnel and my local chain' are not grounded in anything; I am/was just wanting to somehow avoid just assuming I had set everything up properly. Lee

1 0

Re: [stunnel-users] Stunnel for secure email connections
by Lee 24 May '09

24 May '09

Hello Guy and thanks for your reply. Guy wrote: > So you have... > Client (MUA) <=> Avast and/or Popfile <=> Stunnel <=> Server (MTA) > > > Yes, that's right. I've looked at the mail headers more, and tried some of the packet sniffing/log methods, but I'm not really having any more success in understanding / pinpointing a secure connection. I think I'm not going to be able to grasp the issues here, so maybe it is simpler if I could simply state what I have done, to check that it should be correct; I installed both OpenSLL and Stunnel. I haven't changed anything from the OpenSLL install. In stunnel.conf, I currently have the file shown at the bottom of this email. I have changed settings in Thunderbird's mail accounts (hosts and ports) and in Avast Anti-Virus email scanner. (its redirected ports settings) Adding Popfile (a local mail 'tagging' proxy) back into the equation has required some further tweaks to Thunderbird's ports and server usernames syntax. As I said earlier, all seems to be working, in that my 'chain' appears to be having an effect. However should I be considering anything else to make this process meaningful, such as certificates or security issues? My only motive for using Stunnel and OpenSSL is to allow Avast email scanner to scan _all_ emails, including those it normally cannot scan due to their servers requiring me to use a secure connection. So, if I am doing this 'new' process wrongly or opening up security issues due to not understanding it, I would be better off reverting to how it was previously, seeing as the mail servers I use state they do virus scanning anyway. Thanks again, Lee UK my current stunnel.conf :- client=yes service=popmail [popmail] accept = 127.0.0.1:210 connect = pop.mail.yahoo.co.uk:995 [popmail] accept = 127.0.0.1:310 connect = pop.tools.sky.com:995 [pop3_sky] accept = 127.0.0.1:1109 connect = pop.tools.sky.com:995 [pop3_yahoo] accept = 127.0.0.1:1108 connect = pop.mail.yahoo.co.uk:995 [smtp_sky] accept=127.0.0.1:259 connect=smtp.tools.sky.com:465 [smtp_yahoo] accept=127.0.0.1:258 connect=smtp.mail.yahoo.co.uk:465 [imap_sky] accept=127.0.0.1:1439 connect=imap.tools.sky.com:993 -------------------------------------------------------------------------- --- avast! Antivirus: Outbound message clean. Virus Database (VPS): 090524-0, 24/05/2009 Tested on: 5/24/2009 15:38:38 avast! - copyright (c) 1988-2009 ALWIL Software. http://www.avast.com

1 0

Stunnel for secure email connections; email headers ?
by Lee 23 May '09

23 May '09

Hello, I have been dabbling with Stunnel in order to do the following: Connect with remote POP3, IMAP and SMTP servers using a secure connection; Path those connections on my Windows XP desktop pc through Avast Anti-Virus and/or Popfile to Mozilla Thunderbird. After much fiddling and grinding of my rusty mental muscles, I appear to have everything working and pathing properly. However I am not confident and some amount of luck has been involved in settling on the apparently correct pathing, ports settings and stunnel.conf So, my question here is; Can I look for anything in the email headers to verify that I am actually achieving a locally made secure connection using Stunnel? Or, if necessary, can I force something into the headers to show this? As I imply, results/clues suggest all is in place correctly, but part of me doesn't really believe I have actually done it. :) Thanks very much, Lee UK --- avast! Antivirus: Outbound message clean. Virus Database (VPS): 090523-0, 23/05/2009 Tested on: 5/23/2009 23:25:18 avast! - copyright (c) 1988-2009 ALWIL Software. http://www.avast.com

1 0

Multiple SSL Versions
by Jeremy 22 May '09

22 May '09

Hi, Is there any way to make the sslVersion version take multiple options? I would like to restrict things to TLSv1 or SSLv3 but it seems only one option can be specified. I tried specifying this in the cipher section instead of ALL but couldn't seem to get it to work. Also here is something a little weird I've noticed, if anyone else has ran into it before and knows what's going on. With sites set to use TLSv1, sometimes while testing a HTTPS site using Firefox SSL (when both SSLv3 and TLSv1 is enabled in Firefox) sometimes the site won't come up. It feels like Firefox is using a weird SSL version to do the SSL certificate verification but once you trust the certificate it uses the right settings. I've set sslVersion = all, and trusted the SSL certificate in Firefox, then set sslVersion = TLSv1 again and I can get to the site ok at that point. Kind of weird. I'm probably just going to have to leave sslVersion = all, but Nessus and other security scans really like things locked down to just TLSv1 or SSLv3. stunnel: LOG5[17972:3086609296]: https-site01 accepted connection from 1.2.3.4:50878 stunnel: LOG3[17972:3086609296]: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number stunnel: LOG5[17972:3086609296]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket

2 1

Can't connect to Yahoo POP3
by Gary Kuznitz 18 May '09

18 May '09

Hi, I wonder if you could possibly help me get Stunnel ver. 4.26 working with Yahoo.com email? I have been trying to get it working and can't see what the problem is. I do have it working with Gmail just fine. My email client is setup with: Email server 127.0.0.1 Email user: 127.0.0.1/11011/MuUserName(a)yahoo.com Email password: <InsertPassword> Port 9999 My email client is connecting to K9 K9 connects to Stunnel on port 11011 I'm running this in Win '98se I'm following the instructions to use Yahoo POP3 Free at: http://sajeevnairs.blogspot.com/2009/03/pop3-access-in-yahoo-mail-free.html I think it's saying: SSL alert (read): fatal: bad certificate How can I get a god certificate for Stunnel to use? How would I set that up in Stunnel? Conf: cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [pop3_DslextremeGmail] accept = 127.0.0.1:11010 connect = pop.gmail.com:995 delay = yes [pop3_Yahoo] accept = 127.0.0.1:11011 connect = pop.mail.yahoo.com:995 delay = yes Log: 2009.05.14 15:48:12 LOG7[16278859:16041803]: RAND_status claims sufficient entropy for the PRNG 2009.05.14 15:48:12 LOG7[16278859:16041803]: PRNG seeded successfully 2009.05.14 15:48:12 LOG7[16278859:16041803]: Certificate: stunnel.pem 2009.05.14 15:48:12 LOG7[16278859:16041803]: Certificate loaded 2009.05.14 15:48:12 LOG7[16278859:16041803]: Key file: stunnel.pem 2009.05.14 15:48:12 LOG7[16278859:16041803]: Private key loaded 2009.05.14 15:48:12 LOG7[16278859:16041803]: SSL context initialized for service pop3_DslextremeDocfxitGmail 2009.05.14 15:48:12 LOG7[16278859:16041803]: Certificate: stunnel.pem 2009.05.14 15:48:12 LOG7[16278859:16041803]: Certificate loaded 2009.05.14 15:48:12 LOG7[16278859:16041803]: Key file: stunnel.pem 2009.05.14 15:48:12 LOG7[16278859:16041803]: Private key loaded 2009.05.14 15:48:12 LOG7[16278859:16041803]: SSL context initialized for service pop3_Docfxit_Yahoo 2009.05.14 15:48:12 LOG5[16278859:16041803]: stunnel 4.26 on x86-pc-mingw32-gnu with OpenSSL 0.9.8i 15 Sep 2008 2009.05.14 15:48:12 LOG5[16278859:16041803]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv4 2009.05.14 15:48:12 LOG5[16278859:16039767]: No limit detected for the number of clients 2009.05.14 15:48:12 LOG7[16278859:16039767]: FD 56 in non-blocking mode 2009.05.14 15:48:12 LOG7[16278859:16039767]: SO_REUSEADDR option set on accept socket 2009.05.14 15:48:12 LOG7[16278859:16039767]: pop3_DslextremeDocfxitGmail bound to 127.0.0.1:11010 2009.05.14 15:48:12 LOG7[16278859:16039767]: FD 60 in non-blocking mode 2009.05.14 15:48:12 LOG7[16278859:16039767]: SO_REUSEADDR option set on accept socket 2009.05.14 15:48:12 LOG7[16278859:16039767]: pop3_Docfxit_Yahoo bound to 127.0.0.1:11011 2009.05.14 15:48:30 LOG7[16278859:16039767]: pop3_Docfxit_Yahoo accepted FD=64 from 127.0.0.1:1105 2009.05.14 15:48:30 LOG7[16278859:16039767]: Creating a new thread 2009.05.14 15:48:30 LOG7[16278859:16039767]: New thread created 2009.05.14 15:48:30 LOG7[16278859:16038719]: pop3_Docfxit_Yahoo started 2009.05.14 15:48:30 LOG7[16278859:16038719]: FD 64 in non-blocking mode 2009.05.14 15:48:30 LOG7[16278859:16038719]: TCP_NODELAY option set on local socket 2009.05.14 15:48:30 LOG5[16278859:16038719]: pop3_Docfxit_Yahoo accepted connection from 127.0.0.1:1105 2009.05.14 15:48:30 LOG7[16278859:16038719]: FD 76 in non-blocking mode 2009.05.14 15:48:30 LOG7[16278859:16038719]: pop3_Docfxit_Yahoo connecting 68.142.206.14:995 2009.05.14 15:48:30 LOG7[16278859:16038719]: connect_wait: waiting 10 seconds 2009.05.14 15:48:30 LOG7[16278859:16038719]: connect_wait: connected 2009.05.14 15:48:30 LOG5[16278859:16038719]: pop3_Docfxit_Yahoo connected remote server from 192.168.1.3:1106 2009.05.14 15:48:30 LOG7[16278859:16038719]: Remote FD=76 initialized 2009.05.14 15:48:30 LOG7[16278859:16038719]: TCP_NODELAY option set on remote socket 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): before/connect initialization 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 write client hello A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 read server hello A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 read server certificate A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 read server certificate request A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 read server done A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 write client certificate A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 write client key exchange A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 write certificate verify A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 write change cipher spec A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 write finished A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 flush data 2009.05.14 15:48:30 LOG3[16278859:16038719]: SSL_connect: Peer suddenly disconnected 2009.05.14 15:48:30 LOG5[16278859:16038719]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.05.14 15:48:30 LOG7[16278859:16038719]: pop3_Docfxit_Yahoo finished (0 left) Thank you for looking at it... Gary

4 8

Re: [stunnel-users] Can't connect to Yahoo POP3
by Gary Kuznitz 15 May '09

15 May '09

I made some changes... On 15 May 2009 at 12:40, stunnel-users(a)mirt.net (Gary Kuznitz <docfxit(a)theoffice.la>) commented about Re: [stunnel-users] Can't connect t: > Thank you for the reply... > > On 15 May 2009 at 20:55, Michal (Michal Trojnara <Michal.Trojnara(a)mobi-com.net>) commented about Re: [stunnel-users] Can't connect to Yahoo POP3: > > > Gary Kuznitz wrote: > > > How can I get a god certificate for Stunnel to use? > > > How would I set that up in Stunnel? > > > > You don't really need a certificate for an SSL client. Just disable it. > > How can I disable it? > > > You rather want to setup server certificate verification with "CAfile" > > and "verify". > > I have un-commented: > CAfile = certs.pem I commented out the above line. Now I'm getting a new error. Here is the log: 2009.05.15 16:32:30 LOG7[16267607:16279139]: RAND_status claims sufficient entropy for the PRNG 2009.05.15 16:32:30 LOG7[16267607:16279139]: PRNG seeded successfully 2009.05.15 16:32:31 LOG7[16267607:16279139]: Certificate: stunnel.pem 2009.05.15 16:32:31 LOG7[16267607:16279139]: Certificate loaded 2009.05.15 16:32:31 LOG7[16267607:16279139]: Key file: stunnel.pem 2009.05.15 16:32:31 LOG7[16267607:16279139]: Private key loaded 2009.05.15 16:32:31 LOG3[16267607:16279139]: Either CApath or CAfile has to be used for authentication 2009.05.15 16:32:31 LOG3[16267607:16279139]: Server is down > verify = 2 > > That gave me an error: > 2009.05.15 12:38:13 LOG3[16278859:16279139]: Error loading verify certificates > from certs.pem > 2009.05.15 12:38:13 LOG3[16278859:16279139]: error stack: B084002 : > error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib > 2009.05.15 12:38:13 LOG3[16278859:16279139]: error stack: 2006D080 : > error:2006D080:BIO routines:BIO_new_file:no such file > 2009.05.15 12:38:13 LOG3[16278859:16279139]: SSL_CTX_load_verify_locations: > 2001002: error:02001002:system library:fopen:No such file or directory > > > > ; Some performance tunings > > > socket = l:TCP_NODELAY=1 > > > socket = r:TCP_NODELAY=1 > > > > IMHO it's not a good idea for non-interactive connections, e.g. pop3. > > I will comment out both of the above. > > > > [pop3_DslextremeGmail] > > > accept = 127.0.0.1:11010 > > > connect = pop.gmail.com:995 > > > delay = yes > > > > > > [pop3_Yahoo] > > > accept = 127.0.0.1:11011 > > > connect = pop.mail.yahoo.com:995 > > > delay = yes > > [cut] > > > 2009.05.14 15:48:12 LOG7[16278859:16041803]: SSL context initialized > > > for service pop3_Docfxit_Yahoo > > > > I guess you use a different configuration file, as pop3_Docfxit_Yahoo > > is not defined in the one you sent. > > I'm sorry. I'm really using [pop3_Yahoo] > > After I make a change to the conf. file Do I have to re-boot the PC or is it > enough to exit out of Stunnel and launch it again? > > Thank you, > > Gary Kuznitz > > > Best regards, > > Mike > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)mirt.net > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > >

1 0

Preventing "choose a digital certificate" pop-up in IE
by Wallace Winfrey 08 May '09

08 May '09

Hello I have browsed the archives but have not found the answer to this question... I have stunnel set up to handle https connections. It sits on a CentOS server alongside HAProxy and works fine with every browser except for Internet Explorer. When I connect with Internet Explorer, I get a blank "Please choose a digital certificate" pop-up. I am pretty sure I have a configuration issue. Here's what I have: socket=l:TCP_NODELAY=1 socket=r:TCP_NODELAY=1 options = NO_SSLv2 ciphers=ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM output = /var/log/stunnel.log [my.host.name] accept=my.external.IP:443 connect=127.0.0.1:8101 xforwardedfor=yes CAfile=/etc/stunnel/GlobalSign.pem cert=/etc/stunnel/my.host.name.pem verify=1 How do we turn off the request for the client certificate in IE? Here are my details....thanks in advance. w * stunnel-4.15-2.el5.1 * I am running it standalone: /usr/sbin/stunnel /etc/stunnel/stunnel.conf * /usr/sbin/stunnel -version stunnel 4.15 on i686-pc-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Auth:LIBWRAP Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none * uname -a: Linux my.host.name 2.6.18-128.1.6.el5 #1 SMP Wed Apr 1 09:19:18 EDT 2009 i686 i686 i386 GNU/Linux * glibc version is 2.5-34 * gcc is not installed, using CentOS RPM * OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008

1 1

patch: TCP keep-alive socket options
by Ludolf Holzheid 08 May '09

08 May '09

Dear list, the attached patch allows for tweaking the TCP keep-alive socket options on Linux 2.4 and later. Thanks to the groundwork laid by Michal, this got fairly trivial. We use this to keep NAT table entries alive for connections that are expected to have idle periods longer than the NAT time-outs of the routers in involved. Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Odd termination of stunnel process...
by Robert Nickel 08 May '09

08 May '09

We've been happily using stunnel for quite some time now and have run into a strange problem. At seemingly random intervals, stunnel just freaks out an dies. I don't know if it's getting overwhelmed or what but I'm not seeing anything in the logs for stunnel or any other process. Any help is appreciated. Stunnel is being used to wrap a service that was written without use of the ssl libraries directly and connects to two remote web servers (that happen to be running on the same host, separate ports). Config information: OS: CentOS 5.1 OpenSSL: 0.9.8b stunnel -version: stunnel 4.15 on i686-redhat-linux-gnu with OpenSSL 0.9.8b 04 May 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Config file contents: client=yes foreground=no pid=/var/run/pid chroot=/path/to/chroot setuid=non-priv-user setgid=non-priv-group [webservice1] accept=127.0.0.1:11000 connect=172.16.0.1:11000 [webservice2] accept=127.0.0.1:11001 connect=172.16.0.1:11001 Below are the log lines just before the process disappears: May 4 19:49:18 host stunnel: LOG7[28683:3085368208]: Remote FD=15 initialized May 4 19:49:18 host stunnel: LOG7[28683:3085298576]: SSL state (connect): SSLv3 write client key exchange A May 4 19:49:18 host stunnel: LOG7[28683:3085298576]: SSL state (connect): SSLv3 write change cipher spec A May 4 19:49:18 host stunnel: LOG7[28683:3085298576]: SSL state (connect): SSLv3 write finished A May 4 19:49:18 host stunnel: LOG7[28683:3085716368]: SSL state (connect): SSLv3 read server hello A May 4 19:49:18 host stunnel: LOG7[28683:3085716368]: SSL state (connect): SSLv3 read server certificate A May 4 19:49:18 host stunnel: LOG7[28683:3085298576]: SSL state (connect): SSLv3 flush data May 4 19:49:18 host stunnel: LOG7[28683:3085368208]: SSL state (connect): before/connect initialization May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: SSL alert (write): fatal: handshake failure May 4 19:49:18 host stunnel: LOG3[28683:3085786000]: SSL_connect: 1408C095: error:1408C095:SSL routines:SSL3_GET_FINISHED:digest check failed May 4 19:49:18 host stunnel: LOG5[28683:3085786000]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: replay finished (8 left) May 4 19:49:18 host stunnel: LOG7[28683:3085368208]: SSL state (connect): SSLv3 write client hello A May 4 19:49:18 host stunnel: LOG7[28683:3085716368]: SSL state (connect): SSLv3 read server key exchange A May 4 19:49:18 host stunnel: LOG7[28683:3085716368]: SSL state (connect): SSLv3 read server done A May 4 19:49:18 host stunnel: LOG7[28683:3085928144]: replay accepted FD=18 from 127.0.0.1:40308 May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: replay started May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: FD 18 in non-blocking mode May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: FD 19 in non-blocking mode May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: FD 26 in non-blocking mode May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: Connection from 127.0.0.1:40308 permitted by libwrap May 4 19:49:18 host stunnel: LOG5[28683:3085786000]: replay connected from 127.0.0.1:40308 May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: FD 19 in non-blocking mode May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: replay connecting 160.33.167.33:11026 May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: connect_wait: waiting 10 seconds May 4 19:49:18 host stunnel: LOG7[28683:3085928144]: Cleaning up the signal pipe May 4 19:49:18 host stunnel: LOG6[28683:3085928144]: Child process 13775 finished with code 0 May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: SSL alert (write): fatal: handshake failure May 4 19:49:18 host stunnel: LOG3[28683:3085646736]: SSL_connect: 1408C095: error:1408C095:SSL routines:SSL3_GET_FINISHED:digest check failed May 4 19:49:18 host stunnel: LOG5[28683:3085646736]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket May 4 19:49:18 host stunnel: LOG7[28683:3085716368]: SSL state (connect): SSLv3 write client key exchange A May 4 19:49:18 host stunnel: LOG7[28683:3085716368]: SSL state (connect): SSLv3 write change cipher spec A May 4 19:49:18 host stunnel: LOG7[28683:3085716368]: SSL state (connect): SSLv3 write finished A May 4 19:49:18 host stunnel: LOG7[28683:3085716368]: SSL state (connect): SSLv3 flush data May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: replay finished (8 left) May 4 19:49:18 host stunnel: LOG7[28683:3085855632]: connect_wait: connected May 4 19:49:18 host stunnel: LOG7[28683:3085855632]: Remote FD=17 initialized May 4 19:49:18 host stunnel: LOG7[28683:3085855632]: SSL state (connect): before/connect initialization May 4 19:49:18 host stunnel: LOG7[28683:3085855632]: SSL state (connect): SSLv3 write client hello A May 4 19:49:18 host stunnel: LOG7[28683:3085928144]: replay accepted FD=22 from 127.0.0.1:40310 May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: replay started May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: FD 22 in non-blocking mode May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: FD 23 in non-blocking mode May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: FD 26 in non-blocking mode May 4 19:49:18 host stunnel: LOG7[28683:3085928144]: Cleaning up the signal pipe May 4 19:49:18 host stunnel: LOG6[28683:3085928144]: Child process 13777 finished with code 0 May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: Connection from 127.0.0.1:40310 permitted by libwrap May 4 19:49:18 host stunnel: LOG5[28683:3085646736]: replay connected from 127.0.0.1:40310 May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: FD 23 in non-blocking mode May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: replay connecting 160.33.167.33:11026 May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: connect_wait: waiting 10 seconds May 4 19:49:18 host stunnel: LOG7[28683:3085507472]: SSL state (connect): SSLv3 read server hello A May 4 19:49:18 host stunnel: LOG7[28683:3085507472]: SSL state (connect): SSLv3 read server certificate A May 4 19:49:18 host stunnel: LOG7[28683:3085507472]: SSL state (connect): SSLv3 read server key exchange A May 4 19:49:18 host stunnel: LOG7[28683:3085507472]: SSL state (connect): SSLv3 read server done A May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: connect_wait: connected May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: Remote FD=19 initialized May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: SSL state (connect): before/connect initialization May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: SSL state (connect): SSLv3 write client hello A May 4 19:49:18 host stunnel: LOG7[28683:3085298576]: SSL alert (write): fatal: handshake failure May 4 19:49:18 host stunnel: LOG3[28683:3085298576]: SSL_connect: 1408C095: error:1408C095:SSL routines:SSL3_GET_FINISHED:digest check failed May 4 19:49:18 host stunnel: LOG5[28683:3085298576]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket May 4 19:49:18 host stunnel: LOG7[28683:3085298576]: replay finished (8 left) May 4 19:49:18 host stunnel: LOG7[28683:3085507472]: SSL state (connect): SSLv3 write client key exchange A May 4 19:49:18 host stunnel: LOG7[28683:3085507472]: SSL state (connect): SSLv3 write change cipher spec A May 4 19:49:18 host stunnel: LOG7[28683:3085507472]: SSL state (connect): SSLv3 write finished A May 4 19:49:18 host stunnel: LOG7[28683:3085507472]: SSL state (connect): SSLv3 flush data May 4 19:49:18 host stunnel: LOG7[28683:3085925264]: SSL alert (write): fatal: handshake failure May 4 19:49:18 host stunnel: LOG3[28683:3085925264]: SSL_connect: 1408C095: error:1408C095:SSL routines:SSL3_GET_FINISHED:digest check failed May 4 19:49:18 host stunnel: LOG5[28683:3085925264]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket May 4 19:49:18 host stunnel: LOG7[28683:3085925264]: replay finished (7 left) May 4 19:49:18 host stunnel: LOG7[28683:3085368208]: SSL state (connect): SSLv3 read server hello A May 4 19:49:18 host stunnel: LOG7[28683:3085368208]: SSL state (connect): SSLv3 read server certificate A May 4 19:49:18 host stunnel: LOG7[28683:3085368208]: SSL state (connect): SSLv3 read server key exchange A May 4 19:49:18 host stunnel: LOG7[28683:3085368208]: SSL state (connect): SSLv3 read server done A May 4 19:49:18 host stunnel: LOG7[28683:3085577104]: SSL state (connect): SSLv3 read server hello A May 4 19:49:18 host stunnel: LOG7[28683:3085577104]: SSL state (connect): SSLv3 read server certificate A May 4 19:49:18 host stunnel: LOG7[28683:3085577104]: SSL state (connect): SSLv3 read server key exchange A May 4 19:49:18 host stunnel: LOG7[28683:3085577104]: SSL state (connect): SSLv3 read server done A [stunnel vanishes at this point. No core, no logs. POOF!] The lines that stand out to me are the SSL_connect digest errors, the finished lines (showing the number of queued requests in parenthesis?) and the fatal handshake failure. Another odd log entry that I'm seeing often is this transfer() loop error: May 4 21:12:53 host stunnel: LOG3[14341:3085822864]: transfer() loop executes not transferring any data May 4 21:12:53 host stunnel: LOG3[14341:3085822864]: please report the problem to Michal.Trojnara(a)mirt.net May 4 21:12:53 host stunnel: LOG3[14341:3085822864]: socket open: rd=no wr=yes, ssl open: rd=no wr=no May 4 21:12:53 host stunnel: LOG3[14341:3085822864]: socket ready: rd=yes wr=no, ssl ready: rd=no wr=no May 4 21:12:53 host stunnel: LOG3[14341:3085822864]: ssl want: rd=no wr=no May 4 21:12:53 host stunnel: LOG3[14341:3085822864]: socket input buffer: 0 byte(s), ssl input buffer: 29 byte(s) May 4 21:12:53 host stunnel: LOG3[14341:3085822864]: check_SSL_pending=0, ssl_closing=3 May 4 21:12:53 host stunnel: LOG5[14341:3085822864]: Connection reset: 238 bytes sent to SSL, 225 bytes sent to socket Don't know if it's related but might as well post it along as a possible symptom. Thanks, --Robert

2 1

[PATCH] Fix undefined aliasing in libwrap.c
by Miloslav Trmac 02 May '09

02 May '09

Hello, The attached patch changes the code not to access a part of a char[...] array using an int *, which is undefined in ISO C. Using memcpy() is safe. I would have posted it on in the BTS, but it doesn't allow me even to log in... Thank you, Mirek

3 4

Re: [stunnel-users] stunnel-users Digest, Vol 57, Issue 10
by Brian P Hinz 22 Apr '09

22 Apr '09

>> Does stunnel support the use of the aNULL cipher suites? I can't >> seem to make it work, stunnel just fails with a "no shared >> ciphers" message. I don't think that the problem is with openssl >> or the client, since when I test it with s_server the handshake >> completes. >> > > >Review the default cipher list. > >Do... > >stunnel -version > > >Then edit configuration file ciphers options to suit requirements. I was trying to get stunnel working with anonymous ciphers (SSL_DH_anon_WITH_RC4_MD5_128, etc.) from a java based client and found that s_server succeeded while stunnel failed with the "no shared ciphers" message because it has routines to initialize a temporary DH key in the absence of a certificate. Here's a sloppy patch that just borrows those routines from the s_server source code. This is against an older version of stunnel (RHEL4u7 based system), but the latest version also fails without similar patching. Cheers, -brian # cat /usr/src/redhat/SOURCES/stunnel-4.05-dhe.patch --- stunnel-4.05/src/ssl.c.dhe 2004-01-25 14:26:03.000000000 -0500 +++ stunnel-4.05/src/ssl.c 2009-04-22 00:11:10.000000000 -0400 @@ -236,6 +236,32 @@ return -1; /* FAILED */ } +static unsigned char dh512_p[]={ + 0xDA,0x58,0x3C,0x16,0xD9,0x85,0x22,0x89,0xD0,0xE4,0xAF,0x75, + 0x6F,0x4C,0xCA,0x92,0xDD,0x4B,0xE5,0x33,0xB8,0x04,0xFB,0x0F, + 0xED,0x94,0xEF,0x9C,0x8A,0x44,0x03,0xED,0x57,0x46,0x50,0xD3, + 0x69,0x99,0xDB,0x29,0xD7,0x76,0x27,0x6B,0xA2,0xD3,0xD4,0x12, + 0xE2,0x18,0xF4,0xDD,0x1E,0x08,0x4C,0xF6,0xD8,0x00,0x3E,0x7C, + 0x47,0x74,0xE8,0x33, +}; + +static unsigned char dh512_g[]={ + 0x02, +}; + +static DH *get_dh512(void); + +static DH *get_dh512(void) { + DH *dh=NULL; + + if ((dh=DH_new()) == NULL) return(NULL); + dh->p=BN_bin2bn(dh512_p,sizeof(dh512_p),NULL); + dh->g=BN_bin2bn(dh512_g,sizeof(dh512_g),NULL); + if ((dh->p == NULL) || (dh->g == NULL)) + return(NULL); + return(dh); +} + static int init_dh(void) { #ifdef USE_DH FILE *fp; @@ -274,6 +300,12 @@ log(LOG_INFO, "Diffie-Hellman initialized with %d bit key", 8*DH_size(dh)); DH_free(dh); +#else + DH *dh=NULL; + log(LOG_INFO,"Using default temp DH parameters\n"); + dh=get_dh512(); + SSL_CTX_set_tmp_dh(ctx,dh); + DH_free(dh); #endif /* USE_DH */ return 0; /* OK */ }

1 0

aNULL ciphers
by Brian P Hinz 20 Apr '09

20 Apr '09

Hi, Does stunnel support the use of the aNULL cipher suites? I can't seem to make it work, stunnel just fails with a "no shared ciphers" message. I don't think that the problem is with openssl or the client, since when I test it with s_server the handshake completes. Thanks, -brian

1 0

Issue resolving path to .conf using DFS and changing from "by name" to "by IP address"
by Peterson, Stephen 17 Apr '09

17 Apr '09

We use stunnel 4.20 and encountered a problem today and hope someone may be able to provide some insight to a solution. Our client machines are all Windows XP machines with stunnel started as a service. Those installs of stunnel have the path to the .conf as part of the path to the executable. The path to the .conf uses a DFS share. Our network administrator changed our DFS share from "by name" to "by IP address" and then the client services could not resolve the location of the .conf file when the services started on the next start up of client machines. Has anyone encountered this before and what did you do to fix it? Thanks for any assistance. Stephen

1 0

error during multithreaded operation
by Dale Kingsbury 13 Apr '09

13 Apr '09

OS: Windows 2003 SP2 SDK: 2003 R2 SDK We have a multithreaded application that uses a REST-style interface to an SSL-enabled UNIX box that only uses AES. I tried using WinHTTP, but unfortunately, AES is broken in the 2003 version of WinHTTP (confirmed by M$). SO, I hook up stunnel, which works fine when I only start one thread, but if I use more than 1 thread, I get the following error in the stunnel.log. Note that the error is on thread 7140, and the connection is immediately closed. I have retry logic that re-starts failed threads, and the restarted thread works the second time. (of course, the first has finished, so it is essentially running by itself.) The other item of interest is that each thread is sending about 500,000 bytes of data in chunks of 16,000 bytes, and my trace shows that it usually fails after having written more than 100,000 bytes successfully. Any suggestions or help would be greatly appreciated... 2009.04.10 13:17:01 LOG7[3016:7040]: SSL state (connect): SSLv3 flush data 2009.04.10 13:17:01 LOG7[3016:7140]: SSL alert (write): fatal: decrypt error <<<<< ----- NOTE FAILS HERE ON thread 7140 2009.04.10 13:17:01 LOG7[3016:7040]: SSL state (connect): SSLv3 read finished A 2009.04.10 13:17:01 LOG7[3016:7040]: 0 items in the session cache 2009.04.10 13:17:01 LOG7[3016:7040]: 20 client connects (SSL_connect()) 2009.04.10 13:17:01 LOG7[3016:7040]: 19 client connects that finished 2009.04.10 13:17:01 LOG7[3016:7040]: 0 client renegotiations requested 2009.04.10 13:17:01 LOG7[3016:7040]: 0 server connects (SSL_accept()) 2009.04.10 13:17:01 LOG7[3016:7040]: 0 server connects that finished 2009.04.10 13:17:01 LOG7[3016:7040]: 0 server renegotiations requested 2009.04.10 13:17:01 LOG7[3016:7040]: 0 session cache hits 2009.04.10 13:17:01 LOG7[3016:7040]: 0 session cache misses 2009.04.10 13:17:01 LOG7[3016:7040]: 0 session cache timeouts 2009.04.10 13:17:01 LOG6[3016:7040]: SSL connected: new session negotiated 2009.04.10 13:17:01 LOG6[3016:7040]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2009.04.10 13:17:01 LOG3[3016:7140]: SSL_connect: 1408C095: error:1408C095:SSL routines:SSL3_GET_FINISHED:digest check failed 2009.04.10 13:17:01 LOG5[3016:7140]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.04.10 13:17:01 LOG7[3016:7140]: bycast-write-1 finished (1 left) Configuratation file: ;Stunnel configuration for Acuo. ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client=yes verify=0 ; Service-level configuration [bycast-read-1] accept = 18080 connect = 10.220.8.100:8080 ;ciphers=AES128-SHA:AES256-SHA TIMEOUTclose = 0 sslVersion = TLSv1 Dale Kingsbury Founder - Lead Software Engineer Phone: 651-744-9225 << NOTE new number Fax: 651-730-4231 Cel: 651-592-5204 email: dale(a)acuotech.com <mailto:[email protected]> RSNA Booth #4980

2 1