- stunnel-users - stunnel.org

Re: [stunnel-users] Wrapping a CherryPy server?
by Lucas Burdick 19 Dec '08

19 Dec '08

Hmm, I guess I didn't send my previous followup to the list. After setting the log to output properly, I was able to troubleshoot my problem. The chroot directory was non-existent and therefore didn't allow my .pid to be created. I have created the directory and everything now works as it should. Thanks for the help. Sorry for the trouble. Lucas -----Original Message----- From: Michael Renner [mailto:[email protected]] Sent: December-19-08 11:07 AM To: stunnel-users(a)mirt.net; Lucas Burdick Subject: Re: [stunnel-users] Wrapping a CherryPy server? On Friday 19 December 2008, Lucas Burdick wrote: > Hi There, Moin, > I?m trying to encrypt a cherrypy web page that I?m serving up. The page > itself works just fine on port 80, but I can?t seem to get stunnel to wrap > it. I?m using 4.26 on CentOS 5.2. I?ve put in my stunnel.conf: [...] > I?ve also tried commenting out the above mentioned .conf entry. I get the > error that inetd mode needs a remote host or executable. I?m trying to run > in daemon mode but I don?t think I?m doing it right. > > Please help, or ask me questions, or tell me to elaborate or something. can you call stunnel using the forground option and check the logfile? start stunnel like this ... $ stunnel -D debug -f -o /var/log/stunnel.log ........ CU -- |Michael Renner E-mail: michael.renner(a)gmx.de | |D-81541 Munich Germany ICQ: #112280325 | |Germany Don't drink as root! ESC:wq

1 0

Log rotation patch
by Christophe Nanteuil 17 Dec '08

17 Dec '08

Hello, NB : I propose this patch in alpha version. It has been tested only on a Linux Mandriva. (in the alpha version, it's recommended to use it on logs you might loose). Why to use this patch ? One reason I have to restart periodically stunnel is to do log rotation. This patch allows log rotation while running stunnel by implementing it directly inside. Therefore, the established connections are not closed by log rotation. Patch to version : 4.26 (should work on earlier versions). Type : new feature Description : Log rotation inside stunnel How to use this patch ? 3 new options are added in config file (see manual) maxLogSize : maximum size of log file (output option in config file). If logs have to be added, a log rotation is initiated. maxLogFiles : how many log files you want to keep. Default 7. useLogCompression : specify if rotated log files kept must be compressed or not. (requires zlib to be set). Just recompile stunnel after applying patch in stunnel directory: patch -p1 < /path/to/stunnel-logrot-0.10a.patch Test results are welcomed. Regards -- Christophe Nanteuil

1 0

Re: [stunnel-users] Stunnel 4 failing to connect to gmail
by Alex Limberis 15 Dec '08

15 Dec '08

HI Asif, Unfortunately that is the way gmail works. It changes the from to the gmail address rather than the computer domain. Unfortunately, this mostly makes it useless if you are trying to use it as a smarthost. -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Asif Iqbal Sent: Monday, December 15, 2008 2:06 PM To: Scott Gifford Cc: stunnel-users(a)mirt.net; nullmailer(a)lists.untroubled.org Subject: Re: [stunnel-users] Stunnel 4 failing to connect to gmail On Mon, Dec 15, 2008 at 4:49 PM, Scott Gifford <sgifford(a)suspectclass.com> wrote: > "Asif Iqbal" <vadud3(a)gmail.com> writes: > > [...] > >> I said it too soon. It passed that bind error but it still failing in ssl. >> I am seeing `SSL alert (write): fatal: handshake failure' > > Hello again Asif, glad you decided to try out stunnel! Yep, as you suggested :-) > > Try using port 465 instead of 587. That worked! I were able to send an email and I did receive it. It says the email came from `vadud3(a)gmail.com' instead of the sender, which is me(a)myhomecomputer.domain I am using this in /etc/nullmailer/remotes file localhost smtp --port=25 --user=vadud3 --pass=s3cr3t > > It looks like Google's STARTTLS command requires an EHLO to be sent > first, which is a someqhat unusual requirement. I don't think stunnel > does that. Port 465 will start talking SSL directly, without > requiring SMTP commands first. > > Good luck! > > ----Scott. > -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] Cannot connect to SBC/yahoo to send (or telnet)
by Leandro Avila 12 Dec '08

12 Dec '08

Not sure if ranting will get you the kind of answer that you look for but it was certainly entertaining for me. Anyway... I agree, some times things can be a little frustraiting but I guess that depends on how much time on how much work you want to put into it. Sorry to hear you feel stupid. Everyone has to start from 0 at shome point and it takes time to get a good handle to how things work. The question is... do you really want to know how things work or just want them to work without having to do much? A google search of "SSL Explained" http://wildbill.nulldevice.net/presentations/sslpreso/ I liked slide 11/35 nice little diagram of SSL handshake wich helps to visualize in very general terms how an SSL connection works. The rest of the slides are good too check them out! In your particular case that forced you to change from plain-text to SSL connections to your mail server. You had a couple of options. - First and most obvious is to use SSL support build into your mail client (Thunderbird, Outlook,etc) most if not all modern mail clients support SSL natively. No need for stunnel there. - If your mail client does not support SSL then stunnel is the way to go. But your issue is on how stunnel is being used. As client. When you are a client... you always want to verify your server. You want to make sure you are connected to the right server. You want to use verify=2 in stunnel.conf How do we verify that the server I just connected is in fact the right server? That is the Certificate Authority's job. We ultimately have to trust the CA they issued the certificate for the server owner. They signed the certificate with their key. and we use the CA's certificate to verify that signature. Here is the catch... operating systems, and some programs are shipped with a prebuild collection of CA certificates. Unfortunatelly stunnel does not. However, most CAs let you download their certificates for your own use. In your particular case, looks like the server you are connecting to uses a certificate issued by Equifax Secure Certificate Authority Here they have the download page for the CA Certificates. http://www.geotrust.com/resources/root-certificates/ You pointed out that they refuse connections if the client presents a certificate. Yes, that is somehow a common practice. Mutual authentication (both server and client send certificates to each other and verify them) is impractical in some cases. Thanks ----------------- Leandro Avila

1 0

Cannot connect to SBC/yahoo to send (or telnet)
by James Moe 05 Dec '08

05 Dec '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, (I sent this yesterday but that one seems to have gotten lost....) Stunnel v4.20. When connecting to SBC/Yahoo, the session is terminated with a "bad certificate" message. See the log below. The tech folks claim all is well at their end. Is there something I am missing here? Here is the conf file: ....[ conf ].... socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 client = yes output = G:/c/voice/pmmdev/testcase/bin/stunnel.log verify = 0 debug = 7 cert = g:/c/voice/pmmdev/testcase/bin/sma-test.pem [sbc] accept = localhost:6325 connect = smtp.att.yahoo.com:465 ....[ end conf ].... ....[ connection log ].... 2008.11.11 00:14:17 LOG7[223:1737]: sbc accepted FD=15 from 127.0.0.1:61053 2008.11.11 00:14:17 LOG7[223:1737]: Creating a new thread 2008.11.11 00:14:17 LOG7[223:1737]: New thread created 2008.11.11 00:14:17 LOG7[251:1737]: sbc started 2008.11.11 00:14:17 LOG7[251:1737]: FD 15 in non-blocking mode 2008.11.11 00:14:17 LOG7[251:1737]: TCP_NODELAY option set on local socket 2008.11.11 00:14:17 LOG5[251:1737]: sbc accepted connection from 127.0.0.1:61053 2008.11.11 00:14:17 LOG7[251:1737]: FD 16 in non-blocking mode 2008.11.11 00:14:17 LOG7[251:1737]: sbc connecting 69.147.64.31:465 2008.11.11 00:14:17 LOG7[251:1737]: connect_wait: waiting 10 seconds 2008.11.11 00:14:17 LOG7[251:1737]: connect_wait: connected 2008.11.11 00:14:17 LOG5[251:1737]: sbc connected remote server from 192.168.69.14:61054 2008.11.11 00:14:17 LOG7[251:1737]: Remote FD=16 initialized 2008.11.11 00:14:17 LOG7[251:1737]: TCP_NODELAY option set on remote socket 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): before/connect initialization 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 write client hello A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 read server hello A 2008.11.11 00:14:17 LOG5[251:1737]: VERIFY IGNORE: depth=0, /C=US/ST=California/L=Santa Clara/O=Yahoo! Inc./OU=Yahoo/CN=smtp.att.yahoo.com 2008.11.11 00:14:17 LOG5[251:1737]: VERIFY OK: depth=0, /C=US/ST=California/L=Santa Clara/O=Yahoo! Inc./OU=Yahoo/CN=smtp.att.yahoo.com 2008.11.11 00:14:17 LOG5[251:1737]: VERIFY IGNORE: depth=0, /C=US/ST=California/L=Santa Clara/O=Yahoo! Inc./OU=Yahoo/CN=smtp.att.yahoo.com 2008.11.11 00:14:17 LOG5[251:1737]: VERIFY OK: depth=0, /C=US/ST=California/L=Santa Clara/O=Yahoo! Inc./OU=Yahoo/CN=smtp.att.yahoo.com 2008.11.11 00:14:17 LOG5[251:1737]: VERIFY IGNORE: depth=0, /C=US/ST=California/L=Santa Clara/O=Yahoo! Inc./OU=Yahoo/CN=smtp.att.yahoo.com 2008.11.11 00:14:17 LOG5[251:1737]: VERIFY OK: depth=0, /C=US/ST=California/L=Santa Clara/O=Yahoo! Inc./OU=Yahoo/CN=smtp.att.yahoo.com 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 read server certificate A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 read server certificate request A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 read server done A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 write client certificate A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 write client key exchange A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 write certificate verify A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 write change cipher spec A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 write finished A 2008.11.11 00:14:17 LOG7[251:1737]: SSL state (connect): SSLv3 flush data 2008.11.11 00:14:18 LOG7[251:1737]: SSL alert (read): fatal: bad certificate 2008.11.11 00:14:18 LOG3[251:1737]: SSL_connect: 14094412: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate 2008.11.11 00:14:18 LOG5[251:1737]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.11.11 00:14:18 LOG7[251:1737]: sbc finished (0 left) ....[ end log ].... - -- jimoe (at) sohnen-moe (dot) com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (OS/2) iD8DBQFJGe4zzTcr8Prq0ZMRAhSPAJ4h6YHyR+/W5brb7FK1tbbW1zYZ+wCglxpC 9k2qqpP2hN99BL0TnsNhlnw= =P74g -----END PGP SIGNATURE-----

6 7

Test, test. Hello?
by James Moe 05 Dec '08

05 Dec '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, I have not received a posting for several days. Has the list really gone that quiet? - -- jimoe (at) sohnen-moe (dot) com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (OS/2) iD4DBQFJOXHezTcr8Prq0ZMRAqqQAJ0aUC0ZyZC+85WF4WZN3nntQjfrxgCY/zjt 3Jlthcur9UTtXOnNkVcPFg== =scXZ -----END PGP SIGNATURE-----

1 0

Extending stunnels connect functionality
by bernhard.czech＠nobiscum.de 24 Nov '08

24 Nov '08

Hi all, we are looking for somebody to extend stunnel's multiple connect functionality a bit as of: - adding the ability to send a configurable string to each "connect" and compare the answer against an configured expectation string - the expectation should also be able to be interpreted as an regular expression. - the testing interval should be configurable - an alternative port should be configurable - it should be possible to call a script instead of doing a connection with the connect string provided as a parameter. - a way of monitoring might all paths might be good (i.e. writing a status file on regular basis) These things are pretty much the same things that LVS ( http://www.linuxvirtualserver.org/) provides. But we would like to reduce the complexity in our environment a bit. If somebody is interested to implement this feel free to contact me. If possible with an amount of expected reward. Kind regards, Bernhard Czech -- Bernhard Czech nobisCum Individual GmbH [T] +49 (0) 931 / 79 66 7-90 44 [F] +49 (0) 931 / 79 66 7-29 [M] +49 (0)175 / 90 51 45 8 [@] Bernhard.Czech(a)nobiscum.de [URL] www.nobiscum.de [Anschrift] Sedanstraße 23, 97082 Würzburg, Germany [Registergericht] Würzburg, HRB 5159 [Geschäftsführer] Markus Frisch, Hans-Peter Holl

1 0

Tunnel traffic from a network interface
by Kjetil Holien 23 Nov '08

23 Nov '08

Hi! Is it possible to capture traffic from one network interface on one computer, tunnel it to a second computer by stunnel and then send it through a network interface on that computer? This without changing any data on the network traffic (MAC adresses, IP etc). Thanks for any answers! greetings, Kjetil

1 0

Amount of FD's per connection
by Koornstra, Reinoud 21 Nov '08

21 Nov '08

Hi, I am using stunnel compiled to use threads. I read in the faq that a connection may use 1 to 4 fd's per connection. Normally this is only one, how can I influence this, I mean making sure there is one fd per connection? I also wish to limit the amount of max connections at the same time. Perhaps the most easy way is limit the amount of fd's per process with ulimit. However, depending on how many fd's are needed per connection it is difficult to set right now. Kind Regards, Reinoud.

2 2

xforwardedfor patch for 4.26?
by Chris Charman 19 Nov '08

19 Nov '08

Has anyone done such a thing? Alternately, are there good instructions someplace for setting up transparent proxy?

1 0

Re: [stunnel-users] Cannot connect to SBC/yahoo to send (or telnet)
by James Moe 19 Nov '08

19 Nov '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 11/19/08 03:20 am, kith walls wrote: > When connecting to SBC/Yahoo you need to front the session with HTTP. > I am not clear what you mean. Would you give an example? >> Hello, >> Stunnel v4.20. >> When connecting to SBC/Yahoo, the session is > terminated >> with a "bad certificate" message. See the > log below. The tech folks claim >> all is well at their end. >> Is there something I am missing here? >> Here is the conf file: > - -- jimoe (at) sohnen-moe (dot) com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (OS/2) iD8DBQFJJEsmzTcr8Prq0ZMRAjiTAJ9n/nZO2zaZemqvsU2Y1ge30OYdJQCeN3Oc Wj0dFPjjSH7qbV5d5L/F3ck= =ijQ0 -----END PGP SIGNATURE-----

1 0

Proxy support in configuration file?
by Reinier van der Gugten 19 Nov '08

19 Nov '08

Is there proxy support for Stunnel, and if so, how do I specify the proxy server in the configuration file? If it is not supported, can you give me a price estimate on what it would cost to add it? Greetings, Reinier. E.g. I want to connect to an external location at: Myserver.com:443 The proxy is at: CustomerProxy:8080 And my application runs at the customer talking to: localhost:1433 The proxy does not require authentication. Looking at the docuemtation you linked me I found this example: CONNECT server.example.com:80 HTTP/1.1 Host: server.example.com:80 Proxy-Authorization: basic aGVsbG86d29ybGQ= Using my addresses, where goes what? CONNECT CustomerProxy:8080 HTTP/1.1 Host: Myserver.com:443 // Proxy-Authorization: basic aGVsbG86d29ybGQ= Kind regards, Reinier -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Michal Trojnara Sent: vrijdag 14 november 2008 15:04 To: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Proxy support On Fri, 14 Nov 2008 14:53:20 +0100, "Reinier van der Gugten" <info(a)rgit.eu> wrote: > Has someone got a working version of STunnel that can handle a proxy? Do you mean client mode CONNECT protocol support (RFC 2817 section 5.2)? http://www.ietf.org/rfc/rfc2817.txt It's supported in stunnel since version 4.15 (released 2006.03.11). Best regards, Mike _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

stunnel and expiring CRLs
by Jason Haar 19 Nov '08

19 Nov '08

Hi there Is stunnel capable of re-reading updated CRLs on the fly? Without needing to be restarted? I have tried both CRLfile and CRLpath (with the hashes) with no luck. It appear stunnel only reads them on startup and never refers to them again? There also seems to be no option to send a HUP or the like to force a re-read - only a full restart will make stunnel re-read the CRLs. i.e. our system works after a fresh restart until the original CRL expires, and then stunnel starts rejecting new connections with "Found CRL is expired - revoking all certificates until you get updated CRL" - even though there have been several CRL file (and hash) updates in between. Restarting stunnel makes it start working again. I've googled around and see several other people have asked similar questions over the years, and there are references by Michal Trojnara that it should work? This is stunnel-4.14-2 under CentOS5 with openssl-0.9.8b-8.3.el5_0.2. No chroot jail Thanks! -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

4 5

Connection rejected: too many clients (>=500)?
by Chris Charman 18 Nov '08

18 Nov '08

Hey folks -- Can anyone tell me where the max number of clients is configured in 4.21? I'm running okay for a while, but then I end up with repeated messages as below in the logs: 2008.11.18 19:13:33 LOG7[26491:46912520933328]: https accepted FD=512 from xx.xx.xx.xx:xxxxx 2008.11.18 19:13:33 LOG4[26491:46912520933328]: Connection rejected: too many clients (>=500) 2008.11.18 19:13:33 LOG7[26491:46912520933328]: https accepted FD=512 from xx.xx.xx.xx:xxxxx 2008.11.18 19:13:33 LOG4[26491:46912520933328]: Connection rejected: too many clients (>=500) 2008.11.18 19:13:33 LOG7[26491:46912520933328]: https accepted FD=512 from xx.xx.xx.xx:xxxxx 2008.11.18 19:13:33 LOG4[26491:46912520933328]: Connection rejected: too many clients (>=500) [...] I've only seen reports of this problem, but no solution. Anyone out there who can help? Thanks in advance! -Chris ------------- Config below ----------------- ulimit unlimited stunnel -version stunnel 4.21 on x86_64-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none uname -a Linux domU-12-31-39-01-61-B2 2.6.21.7-2.fc8xen #1 SMP Fri Feb 15 12:34:28 EST 2008 x86_64 GNU/Linux stunnel -sockets Socket option defaults: Option Accept Local Remote OS default SO_DEBUG -- -- -- 0 SO_DONTROUTE -- -- -- 0 SO_KEEPALIVE -- -- -- 0 SO_LINGER -- -- -- 0:0 SO_OOBINLINE -- -- -- 0 SO_RCVBUF -- -- -- 87380 SO_SNDBUF -- -- -- 16384 SO_RCVLOWAT -- -- -- 1 SO_SNDLOWAT -- -- -- 1 SO_RCVTIMEO -- -- -- 0:0 SO_SNDTIMEO -- -- -- 0:0 SO_REUSEADDR 1 -- -- 0 SO_BINDTODEVICE -- -- -- -- IP_TOS -- -- -- 0 IP_TTL -- -- -- 64 TCP_NODELAY -- -- -- 0 gcc -v Using built-in specs. Target: x86_64-linux-gnu Configured with: ../src/configure -v --enable-languages=c,c++,fortran,objc,obj-c++,treelang --prefix=/usr --enable-shared --with-system-zlib --libexecdir=/usr/lib --without-included-gettext --enable-threads=posix --enable-nls --with-gxx-include-dir=/usr/include/c++/4.2 --program-suffix=-4.2 --enable-clocale=gnu --enable-libstdcxx-debug --enable-objc-gc --enable-mpfr --enable-checking=release --build=x86_64-linux-gnu --host=x86_64-linux-gnu --target=x86_64-linux-gnu Thread model: posix gcc version 4.2.3 (Ubuntu 4.2.3-2ubuntu7) openssl version OpenSSL 0.9.8g 19 Oct 2007

2 2

Re: [stunnel-users] Cannot connect to SBC/yahoo to send (or telnet)
by James Moe 18 Nov '08

18 Nov '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 11/18/08 10:17 am, James Moe wrote: > Hello, > Stunnel v4.20. > When connecting to SBC/Yahoo, the session is terminated > with a "bad certificate" message. See the log below. The tech folks claim > all is well at their end. > Is there something I am missing here? > Here is the conf file: > My apologies. I lost control of the email program and it sent this message here instead of to a local host. - -- jimoe (at) sohnen-moe (dot) com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (OS/2) iD8DBQFJIvmqzTcr8Prq0ZMRAsb2AJ9ROwt9FH4GpfyNWQ020rpGmC7K/wCdGhdW Bs96qyJjjXSA9d+AwVktAac= =+UNT -----END PGP SIGNATURE-----

1 0

Proxy support
by Reinier van der Gugten 18 Nov '08

18 Nov '08

Oops.. That's exactly what I meant... However What is the correct configuration in that case? E.g. I want to connect to an external location at: Myserver.com:443 The proxy is at: CustomerProxy:8080 And my application runs at the customer talking to: localhost:1433 The proxy does not require authentication. Looking at the docuemtation you linked me I found this example: CONNECT server.example.com:80 HTTP/1.1 Host: server.example.com:80 Proxy-Authorization: basic aGVsbG86d29ybGQ= Using my addresses, where goes what? CONNECT CustomerProxy:8080 HTTP/1.1 Host: Myserver.com:443 // Proxy-Authorization: basic aGVsbG86d29ybGQ= Kind regards, Reinier -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Michal Trojnara Sent: vrijdag 14 november 2008 15:04 To: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Proxy support On Fri, 14 Nov 2008 14:53:20 +0100, "Reinier van der Gugten" <info(a)rgit.eu> wrote: > Has someone got a working version of STunnel that can handle a proxy? Do you mean client mode CONNECT protocol support (RFC 2817 section 5.2)? http://www.ietf.org/rfc/rfc2817.txt It's supported in stunnel since version 4.15 (released 2006.03.11). Best regards, Mike _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 1

Re: [stunnel-users] Help - Getting stunnel compiled on windows and using a patch
by Reinier van der Gugten 14 Nov '08

14 Nov '08

Thanks so mucht for this information! I had to make the folowing changes as well: Set the Compile with common language runtime to: No common language runtime support for each .h file If I do that, the error: Command line error D8045: cannot compile C file 'src\client.c' with the /clr option disappears (Next I got an error in the resouce.rc file with the LTEXT VERSION... So I // that out) Next I get about 121 errors, like: Error LNK2001: unresolved external symbol _main ... symbol _num_clients etc. Any ideas? Kind regards, Reinier ________________________________ From: DMILE525 [mailto:[email protected]] Sent: donderdag 13 november 2008 23:23 To: Reinier van der Gugten Subject: Re: [stunnel-users] Help - Getting stunnel compiled on windows and using a patch on Windows: install Win32 OpenSSL http://www.slproweb.com/products/Win32OpenSSL.html <wlmailhtml:{86BCE398-B6B8-40AD-8A3D-BE759753A203}mid://00000009/!x-usc: http://www.slproweb.com/products/Win32OpenSSL.html> install VS2008 (I'm using free VS2008 C++ Express Edition http://www.microsoft.com/express/download/ <wlmailhtml:{86BCE398-B6B8-40AD-8A3D-BE759753A203}mid://00000009/!x-usc: http://www.microsoft.com/express/download/> ) The first thing to do (assuming a default installation of 'C:\OpenSSL') is to go to 'C:\OpenSSL\lib\VC' and copy all of the files to your Visual C++ 'lib' directory. This directory is sometimes located in a somewhat cryptic location such as 'C:\Program Files (x86)\Microsoft Visual Studio 9.0\VC\lib' or 'C:\Program Files\Microsoft Visual Studio 9.0\VC\lib'. Next, copy everything in the 'C:\OpenSSL\include' directory to your Visual C++ 'include' directory. create new empty project add to project: stunnel.c ssl.c ctx.c verify.c file.c client.c protocol.c sthreads.c log.c options.c network.c resolver.c gui.c common.h prototypes.h resources.h stunnel.ico resources.rc "Configuration properties -> Linker -> input -> additional properties" add wsock32.lib ssleay32.lib libeay32.lib "Configuration properties -> General -> character set" set "Use Multi-Byte Character Set" in common.h after #ifndef COMMON_H #define COMMON_H add #define USE_WIN32 #define _CRT_SECURE_NO_DEPRECATE #define _CRT_NONSTDC_NO_DEPRECATE //#define HAVE_GETADDRINFO //#define HAVE_GETNAMEINFO #ifndef _MBCS #define _MBCS #endif #define VERSION "4.26" #if defined _M_IX86 #pragma comment(linker, "/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*'\"") #elif defined _M_IA64 #pragma comment(linker, "/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='ia64' publicKeyToken='6595b64144ccf1df' language='*'\"") #elif defined _M_X64 #pragma comment(linker, "/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='amd64' publicKeyToken='6595b64144ccf1df' language='*'\"") #else #pragma comment(linker, "/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='*' publicKeyToken='6595b64144ccf1df' language='*'\"") #endif On Wed, Nov 12, 2008 at 6:50 PM, Reinier van der Gugten <info(a)rgit.eu> wrote: Hello, I am trying to compile STunnel. I'd rather not, but the pre-compiled version does not support a proxy server. So I hop you will be able to help me, or point me to a good howto on how to compile stunnel using windows and a patch from the patch-list. Or does someone have a compiled (windows) version with proxy support? If so, please mail it to me. Or tell me where to find more detailed information pls. - Next thing I will try is to install linux on a computer in order to try it that way... Greetings, Reinier. _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 2

Strange CRL verification behaviour
by Christophe Nanteuil 03 Nov '08

03 Nov '08

With stunnel 4.26 (or ealier), in order to verify revocation of clients' certificates, I use this configuration file : -------------------8<------------------ CAfile=/etc/ssl/stunnel/ca_certs.pem CRLfile=/etc/ssl/stunnel/crl.pem cert=/etc/ssl/stunnel/server.pem key=/etc/ssl/stunnel/server.key sslVersion=TLSv1 verify=2 [WEB] accept=8080 connect=127.0.0.1:3128 ------------------->8------------------ 1/ If there is no CRLfile when stunnel starts, stunnel dies and logs show "Failed to load /etc/ssl/stunnel/crl.pem revocation lookup file" -> ok. 2/ If the CRLfile is correct, stunnel starts. When the CRL expires, stunnel rejects any new connection. Logs then show : " Found CRL is expired - revoking all certificates until you get updated CRL" -> ok 3/ If the CRLfile is not a valid CRL, stunnel starts and ignores the CRLfile. Then, for any new connection, logs show "CRL: verification passed". -> NOT ok, IMO. examples of wrong CRLs : a CRL issued by an unknown CA or a certificate in the PEM format. This can happen when the CRL expires (soon) and the administrator puts a "new one" but misfits files. He then restarts stunnel, which works. This behaviour can be annoying because the logs of CRL are now in level 6 (INFO) and not any more in level 5 (NOTICE). My configuration was in debug=5 and logs showed only "CRL: verification passed", I could not determine what CRL was really used. I propose the attached patch to modify behaviour in case 3/, ie if no CRL corresponding to the issuer of each certificate of the chain is found : - reject connection if CRLdir or CRLfile was specified in the config file - accept connection but warn in logs if the use of CRL was not explicitly set in the config file. NB : the source code of function "crl_check" shows "/* based on BSD-style licensed code of mod_ssl */". I looked into the code of "mod_ssl-2.8.31-1.3.41" (file pkg.sslmod/ssl_engine_kernel.c, line 1601-1769) and there is actually the same behaviour. -- Christophe Nanteuil

1 0

Spawning a shell
by Tobias Dussa 29 Oct '08

29 Oct '08

Hi everybody, maybe I'm missing something real obvious here, but I can't figure out what's going wrong. I'm trying to make stunnel spawn a regular shell when it gets a connect. As far as I understand, the pty option should allocate a virtual tty, so I ought to be able to just exec() a shell. However, this won't work; apparently some more magic is required. I do get the basic interactive functionality to work (i. e., I can enter, say, ls and get back a directory listing), but the terminal won't work properly: Unwanted echoes (stty -echo doesn't help). Furthermore, for some reason stderr is not connected to the new pty but sticks to stunnel's original pty. I have tried spawning a shell directly from stunnel (with exec), spawning a script which redirects stdin/-out/-err to the proper pty, then execs a shell, spawning a script which execs login, spawning a script which execs getty. (The latter being closest to what I want, but not good enough.) I'm running out of ideas. Anyone ever did this? Any comments? (Incidentally, if anyone has a better idea how to create the possibility to log in with an X.509 certificate without using stunnel, I'm all ears.) I'm running stunnel4 on Debian etch: --- stunnel 4.18 on i486-pc-linux-gnu with OpenSSL 0.9.8c 05 Sep 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none --- Cheers, Toby. -- The nine most terrifying words in the English language are: I'm from the government and I'm here to help. ---Ronald Reagan

3 2

Thanks for solving my problem!
by editor 20 Oct '08

20 Oct '08

Hi: Thanks! I commented out the "Verify" option within the configuration file and restarted the application. I can use it POP3S & HTTPS with the Nokia & Sony-Ericsson mobiles fine now as well as Thunderbird. I will check with Outlook next. Window's mobile is complaining it can not create a SSL session however. I think it has to do with the public certificate I use in the mail host. Godaddy uses this two part public certificate and the Network Solutions is a single file. I am hoping in a new release of Stunnel, it can support a two part public certificate. Thanks again!!! Kevin > > > > > > ------------------------------ > > > > Message: 2 > > Date: Sun, 19 Oct 2008 21:17:29 -0700 (PDT) > > From: Algol Tradent <tradent(a)yahoo.com> > > Subject: Re: [stunnel-users] Version 4.26 and using to secure IMAPS & > > POP3 > > To: stunnel-users(a)mirt.net > > Message-ID: <710279.38955.qm(a)web62003.mail.re1.yahoo.com> > > Content-Type: text/plain; charset=us-ascii > > > > Hello, > > > > I think your problem is on your config file for the server. On your config file you have the following option > > > > # Authentication stuff > > verify = 3 > > > > You probably don't want this option set. Because you are asking the client and the server to authenticate each other based on certificates... which I don;t think is the case here. > > > > On your log file there is this line which is a good indicator of your problem. > > > > routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate > > > > I hope this helps > >

1 0

Version 4.26 and using to secure IMAPS & POP3
by Editor (Kevin) 20 Oct '08

20 Oct '08

Hi: I upgraded to the current 4.26 as I was having an issue with 4.15. The idea is to secure IMAP traffic as well as inbound SMTP. The email client is the latest Thunderbird and seems to be very stable. The mail Host is a Sun E-250 with current patches for Solaris 9. Note: I am using a public certificate and as it from "godaddy.com", it is this unusual two part certificate. This may be where the problem is as I had to combine the two public certificate files together (maybe the next version of STUNNEL could do this automatically so the risk of errors is reduced!). However, using STUNNEL, I am having an issue connecting as I get a strange error message and the connection dies. Error Log: 2008.10.19 13:10:41 LOG7[2104:1]: imaps accepted FD=0 from 80.38.96.194:4129 2008.10.19 13:10:41 LOG7[2104:3]: imaps started 2008.10.19 13:10:41 LOG7[2104:3]: FD 0 in non-blocking mode 2008.10.19 13:10:41 LOG7[2104:1]: Cleaning up the signal pipe 2008.10.19 13:10:41 LOG7[2104:3]: TCP_NODELAY option set on local socket 2008.10.19 13:10:41 LOG7[2104:3]: Waiting for a libwrap process 2008.10.19 13:10:41 LOG7[2104:3]: Acquired libwrap process #0 2008.10.19 13:10:41 LOG7[2104:1]: Cleaning up the signal pipe 2008.10.19 13:10:41 LOG7[2104:3]: Releasing libwrap process #0 2008.10.19 13:10:41 LOG7[2104:3]: Released libwrap process #0 2008.10.19 13:10:41 LOG7[2104:1]: Cleaning up the signal pipe 2008.10.19 13:10:41 LOG7[2104:3]: imaps permitted by libwrap from 80.38.96.194:4129 2008.10.19 13:10:41 LOG5[2104:3]: imaps accepted connection from 80.38.96.194:4129 2008.10.19 13:10:41 LOG7[2104:3]: SSL state (accept): before/accept initialization 2008.10.19 13:10:41 LOG7[2104:3]: SSL state (accept): SSLv3 read client hello A 2008.10.19 13:10:41 LOG7[2104:3]: SSL state (accept): SSLv3 write server hello A 2008.10.19 13:10:41 LOG7[2104:1]: Cleaning up the signal pipe 2008.10.19 13:10:41 LOG7[2104:3]: SSL state (accept): SSLv3 write certificate A 2008.10.19 13:10:41 LOG7[2104:3]: SSL state (accept): SSLv3 write certificate request A 2008.10.19 13:10:41 LOG7[2104:3]: SSL state (accept): SSLv3 flush data 2008.10.19 13:10:42 LOG7[2104:3]: SSL alert (read): warning: no certificate 2008.10.19 13:10:42 LOG7[2104:1]: Cleaning up the signal pipe 2008.10.19 13:10:42 LOG7[2104:3]: SSL alert (write): fatal: handshake failure 2008.10.19 13:10:42 LOG3[2104:3]: SSL_accept: 140890C7: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate 2008.10.19 13:10:42 LOG7[2104:1]: Cleaning up the signal pipe 2008.10.19 13:10:42 LOG5[2104:3]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.10.19 13:10:42 LOG7[2104:1]: Cleaning up the signal pipe 2008.10.19 13:10:42 LOG7[2104:3]: imaps finished (0 left) See the weird no client peer handshake???? The configuration file: # more /usr/local/etc/stunnel/stunnel.conf # stunnel configuration file # Use to provide ssl protection for https, pop3 and imap # # Setting up the root jail chroot = /usr/local/var/stunnel # # The PID is created inside chroot jail pid = /stunnel.pid setuid = nobody setgid = nogroup ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /usr/local/var/lib/stunnel/ setuid = nobody setgid = nogroup ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 # Authentication stuff verify = 3 # Certicates to use # cert = /usr/local/etc/stunnel/stunnel.pem CAfile = /usr/local/etc/stunnel/_.cellmail.com.crt # SSLCertificateChainFile = /usr/local/etc/stunnel/gd_intermediate_bundle.crt # Some debugging stuff debug = 7 output = /var/log/stunnel.log # Use it for client mode #client = yes # Service-level configuration [pop3s] accept = 199.4.110.39:995 connect = 110 [imaps] accept = 199.4.110.39:993 connect = 143 [ssmtp] accept = 199.4.110.39:465 connect = frog.cellmail.com:25 # TIMEOUTclose = 0 The startup log: 2008.10.19 13:02:50 LOG7[2077:1]: Snagged 64 random bytes from /export/home/kgreene/.rnd 2008.10.19 13:02:50 LOG7[2077:1]: Wrote 1024 new random bytes to /export/home/kgreene/.rnd 2008.10.19 13:02:50 LOG7[2077:1]: RAND_status claims sufficient entropy for the PRNG 2008.10.19 13:02:50 LOG7[2077:1]: PRNG seeded successfully 2008.10.19 13:02:50 LOG7[2077:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2008.10.19 13:02:50 LOG7[2077:1]: Certificate loaded 2008.10.19 13:02:50 LOG7[2077:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2008.10.19 13:02:50 LOG7[2077:1]: Private key loaded 2008.10.19 13:02:50 LOG7[2077:1]: Loaded verify certificates from /usr/local/etc/stunnel/_.cellmail.com.crt 2008.10.19 13:02:50 LOG7[2077:1]: Loaded /usr/local/etc/stunnel/_.cellmail.com.crt revocation lookup file 2008.10.19 13:02:50 LOG7[2077:1]: SSL context initialized for service pop3s 2008.10.19 13:02:50 LOG7[2077:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2008.10.19 13:02:50 LOG7[2077:1]: Certificate loaded 2008.10.19 13:02:50 LOG7[2077:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2008.10.19 13:02:50 LOG7[2077:1]: Private key loaded 2008.10.19 13:02:50 LOG7[2077:1]: Loaded verify certificates from /usr/local/etc/stunnel/_.cellmail.com.crt 2008.10.19 13:02:50 LOG7[2077:1]: Loaded /usr/local/etc/stunnel/_.cellmail.com.crt revocation lookup file 2008.10.19 13:02:50 LOG7[2077:1]: SSL context initialized for service imaps 2008.10.19 13:02:50 LOG7[2077:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2008.10.19 13:02:50 LOG7[2077:1]: Certificate loaded 2008.10.19 13:02:50 LOG7[2077:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2008.10.19 13:02:50 LOG7[2077:1]: Private key loaded 2008.10.19 13:02:50 LOG7[2077:1]: Loaded verify certificates from /usr/local/etc/stunnel/_.cellmail.com.crt 2008.10.19 13:02:50 LOG7[2077:1]: Loaded /usr/local/etc/stunnel/_.cellmail.com.crt revocation lookup file 2008.10.19 13:02:50 LOG7[2077:1]: SSL context initialized for service ssmtp 2008.10.19 13:02:50 LOG5[2077:1]: stunnel 4.26 on sparc-sun-solaris2.9 with OpenSSL 0.9.8h 28 May 2008 2008.10.19 13:02:50 LOG5[2077:1]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.10.19 13:02:50 LOG6[2077:1]: file ulimit = 256 (can be changed with 'ulimit -n') 2008.10.19 13:02:50 LOG6[2077:1]: poll() used - no FD_SETSIZE limit for file descriptors 2008.10.19 13:02:50 LOG5[2077:1]: 125 clients allowed 2008.10.19 13:02:50 LOG7[2077:1]: FD 11 in non-blocking mode 2008.10.19 13:02:50 LOG7[2077:1]: FD 12 in non-blocking mode 2008.10.19 13:02:50 LOG7[2077:1]: FD 13 in non-blocking mode 2008.10.19 13:02:50 LOG7[2077:1]: SO_REUSEADDR option set on accept socket 2008.10.19 13:02:50 LOG7[2077:1]: pop3s bound to 199.4.110.39:995 2008.10.19 13:02:50 LOG7[2077:1]: FD 14 in non-blocking mode 2008.10.19 13:02:50 LOG7[2077:1]: SO_REUSEADDR option set on accept socket 2008.10.19 13:02:50 LOG7[2077:1]: imaps bound to 199.4.110.39:993 2008.10.19 13:02:50 LOG7[2077:1]: FD 15 in non-blocking mode 2008.10.19 13:02:50 LOG7[2077:1]: SO_REUSEADDR option set on accept socket 2008.10.19 13:02:50 LOG7[2077:1]: ssmtp bound to 199.4.110.39:465 2008.10.19 13:02:50 LOG7[2083:1]: Created pid file /stunnel.pid 2008.10.19 13:02:50 LOG7[2083:1]: Cleaning up the signal pipe

2 1

forgeground=no with pppd and pty=yes?
by Sandeep Kumar 15 Oct '08

15 Oct '08

Hi, I want to encrypt pppd, but stunnel should start in background mode. But as soon as I set foreground=no, ppp is unable to connect. Is this not possible ? -- Sandeep Kumar http://students.iiit.ac.in/~sandeep_kr

1 0

Setting up a POP3 connection through stunnel?
by Ben Stover 13 Oct '08

13 Oct '08

Assume currently I retrieve my emails from my mailbox unencrypted with the following info: pop3.mydomain.com port=110 Now I want to switch to an encrypted POP3 mail connection. with the following information pop3.mydomain.com port=777 Can I simply write now in the conf file: [myownsetup] accept = 127.0.0.1:110 connect = pop3.mydomain.com:777 Is this sufficient? Ben

2 1

Question (new user!) how to get it to work? - SQL
by Reinier van der Gugten 10 Oct '08

10 Oct '08

Hi, I read most of the messages and tutorials, but still I do not seem to get it to work. I want to achieve the following: Client side: VB application communicating to a SQL server over port 1433. Server side: Lisning on port 1433 that is lisned to by SQL 2005. However this is not allowed evrywhere, so stunnel comes into play. Client side: VB application communicating to localhost on port 1433 Stunnel installed lisning on port 1433 and passing it on to port 80 (Note for later: I would like to use SSL, so it will pass through routers, But for the test it will suffice to keep it unencrypted. Also the server is still local and could be reached directly. But it should work fine for testing.) Server: Stunnel installed as service lisning on port 80 and transmitting it to port 1433 (later to be moved to 443, as I also run a HTTP server) The config file looks like this: ------------------------------------------------- Client: ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 ;output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [SQLServer] accept = 127.0.0.1:1433 connect = 10.12.18.10:80 ------------------------------------------------- Server: ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 ;output = stunnel.log ; Use it for client mode ;client = yes ; Service-level configuration [SQL] accept = 80 connect = localhost:1433 ------------------------------------------------- As you can see, I tried to keep as close to the example file as I could. Looking forward to getting this to work and then to including ssl... Kind regards, Reinier.

1 0

Stunnel 4.26 Not working
by natalie burdick 30 Sep '08

30 Sep '08

I just upgraded from Sony to IBM laptop, in doing so, I installed latest version of Stunnel for use with my pop email client. I am running Stunnel 4.26 on Windows XP Here is my stunnel log: 2008.09.29 20:48:44 LOG5[2568:4088]: stunnel 4.26 on x86-pc-mingw32-gnu with OpenSSL 0.9.8i 15 Sep 2008 2008.09.29 20:48:44 LOG5[2568:4088]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2008.09.29 20:48:44 LOG5[2568:1628]: No limit detected for the number of clients It was working until I upgraded to this version, now when I use my client to check or send email, it just says that it's connecting to the server but never actually does. I can provide my conf

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users