- stunnel-users - stunnel.org

Re: [stunnel-users] Stunnel 4.21 99% cpu ultilization
by Fat Wallet 30 Jun '08

30 Jun '08

Hi, Can someone please help with this issue? This 100% cpu utilization issue happens randomly on multiprocess cpu. Thanks! ----- Original Message ---- From: Fat Wallet <fat8wallet(a)yahoo.com> To: stunnel-users(a)mirt.net Sent: Monday, June 23, 2008 10:39:16 AM Subject: Stunnel 4.21 99% cpu ultilization Hi All, I've been googling for this issue but it seems like google is not my friend at the moment. I am running Linux with 4 cpus and top command shows stunnel at 99-100% cpu. Please help. //stunnel configuration file # PID is created inside chroot jail pid = /var/run/stunnel.pid # debug debug = 7 output = /var/log/stunnel.log # Authentication stuff verify = 2 cert = /etc/stunnel/cert.pem CAfile = /etc/stunnel/ca.pem #Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 # Use it for client mode client = yes /////////// stunnel version stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.7a Feb 19 2003 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none //openssl version OpenSSL 0.9.7a Feb 19 2003 //Redhat version Red Hat Linux release 9 (Shrike) root]#cat /proc/cpuinfo | grep processor | wc -l 4 http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

UPNP & Nat-PMP with Stunnel
by Dean Shavit 26 Jun '08

26 Jun '08

Stunnel works great for me, but with dynamic port forwarding, I've not been able to get it working. I suspect it's because stunnel is a bit confusing about which port to reply to... Anyone else found a way to crack this nut?

1 0

How do I kill stunnel?
by Grant Edwards 25 Jun '08

25 Jun '08

I've got an application that starts stunnel using equivalent of a fork/exec. The stunnel process then appears to fork off multiple copies of itself. Before the application exits, it needs to stop stunnel. I send a SIGINT to the PID that was created using the fork, but only the first "master" copy terminates -- the master stunnel process doesn't terminate its children when it exits. So I end up with a bunch of "orphaned" stunnel processes. They're not zombies, they're process that are either in state R or S (runnable or sleeping). How do I tell stunnel to not only terminate, but to terminate whatever child processes it has created? -- Grant Edwards grante Yow! Zippy's brain cells at are straining to bridge visi.com synapses ...

2 4

Stunnel config files incompatible between 4.05 and 4.21 ?
by Brian McKee 25 Jun '08

25 Jun '08

Hi All, I have a stunnel config file that works fine on an older Mandrake machine running stunnel 4.05. If I use that same config file on a new Ubuntu machine running 4.21 it just dies with "/etc/stunnel/stunnel.pem: No such file or directory" IIUC, running in client mode it doesn't need a .pem file, and I didn't create any certifcates on the Mandrake machines. Do I need to generate a cert for some reason? I've attached the config below. Brian =============================== client = yes [telnet] accept = 23 connect = some.ip.number.removed:992 [as-central] accept = 8470 connect = some.ip.number.removed:9470 [as-database] accept = 8471 connect = some.ip.number.removed:9471 [as-rmtcmd] accept = 8475 connect = some.ip.number.removed:9475

1 0

Is the "HTTP Proxy connect" feature implemented?
by alex Wright 24 Jun '08

24 Jun '08

Hey, I'm trying to use stunnel in the following scenerio: ssh-client -> stunnel (to ssl) -> Proxy -> server(ssl to ssh). I downloaded stunnel 4.25, but I hadn't noiticed any support for this. However, in the "patches" page (http://www.stunnel.org/patches/) - three patches seem to be suitable: (connect-proxy_dunbar.patch<http://www.stunnel.org/patches/patches/connect-proxy_dunbar.patch>, connect-proxy.mwald.patch<http://www.stunnel.org/patches/patches/connect-proxy.mwald.patch>) but are for version 4.05 (whichwill probably be a pain to merge with current version). When I stumbled upon the Changelog ( http://www.stunnel.org/download/ChangeLog.txt) I noticed that version 4.15, has support for "Client mode CONNECT protocol" - which is what I need - and altough i had looked hard, I haven't found any documentation to it. So, is the above feature what I want (and if so - how do I use it?) or do I need to update the patches to the current version? Thanks in advance, Alex.

1 0

Stunnel 4.21 99% cpu ultilization
by Fat Wallet 23 Jun '08

23 Jun '08

Hi All, I've been googling for this issue but it seems like google is not my friend at the moment. I am running Linux with 4 cpus and top command shows stunnel at 99-100% cpu. Please help. //stunnel configuration file # PID is created inside chroot jail pid = /var/run/stunnel.pid # debug debug = 7 output = /var/log/stunnel.log # Authentication stuff verify = 2 cert = /etc/stunnel/cert.pem CAfile = /etc/stunnel/ca.pem #Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 # Use it for client mode client = yes /////////// stunnel version stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.7a Feb 19 2003 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none //openssl version OpenSSL 0.9.7a Feb 19 2003 //Redhat version Red Hat Linux release 9 (Shrike) root]#cat /proc/cpuinfo | grep processor | wc -l 4 http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

Using Stunnel on Vista
by John Lallemand 18 Jun '08

18 Jun '08

We have a system that needs a TN3270 client and Stunnel to connect on XP. Currently, OnNet Host/Rumba is the most popular TN3270 client in use. But when we try these programs on Vista, the connection times out. 1) Is Stunnel Vista compatible? 2) If it is, does Stunnel need specific settings to work on Vista? Thank you! ------------------------------ John Lallemand Software Release Manager University of California, Santa Cruz

2 1

Problem with multiple stunnel jobs
by Carter Browne 17 Jun '08

17 Jun '08

A couple of days ago, I upgrade from 4.15 to 4.23 on a Linux system running Redhat 8. At the same time I went from openssl 0.9.8g to 0.9.8h. No changes were made to the configuration file. After the change, rather than starting a single process, it starts 6 processes. The process number of the lowest number process is the one that is put into the /var/run/stunnel.pid file. When I try to stop stunnel, using /etc/init.d/stunnel stop, the lowest number process is kill, and the highest number process seems to be running continuously - although it is not a hard cpu loop, but it keeps on accumulating run time. The number of processes may not be a new phenomenon, but the inability to kill itself is. I normally restart the stunnel on a daily basis to keep the log files manageable, but with this new behavior, the /etc/init.d/strunnel restart command fails because the ports are still in use. Any ideas on how to fix this problem. Thanks, Carter -- Carter Browne CBCS cbrowne(a)cbcs-usa.com 781-721-2890

2 1

Goldmine 8 & Advisormail SSL problems
by Stephen E. Rischall 17 Jun '08

17 Jun '08

1 0

stunnel service problems...
by Jeremy Paje 10 Jun '08

10 Jun '08

Has anyone had any problems with the windows stunnel service not starting automatically? We install stunnel as a service (stunnel.exe -install) We've had it previously installed on 600+ machines with no problems, but recently (noticed on slower machines running XP) the stunnel service does not start...but it happens randomly only on slower machines. The following errors are in the event log... Timeout (30000 milliseconds) waiting for the stunnel service to connect. (Event ID ID 7009) AND The stunnel service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. (Event ID 7000) I've tried setting the service to restart if failed, and to delay 2 minutes before restart, etc with no luck. If you start the stunnel manually all is well, it just doesn't start on bootup. Any suggestions? Thanks JP

1 0

Re: [stunnel-users] stunnel compatibility question
by Brian Hatch 09 Jun '08

09 Jun '08

Roughly around 2008-06-09 11:34 -0400, Patel Dippen-CDP054 kibitzed: > In this scenario, can Stunnel listen on the UDP port on the local No. Stunnel will not listen on UDP ports. Stunnel will not send UDP packets. Stunnel doesn't support UDP. -- Brian Hatch The problem is that you'd Systems and probably make something Security Engineer useful of my life that http://www.ifokr.org/bri/ I would never do. Every message PGP signed

2 1

Fw: Re: stunnel compatibility question
by Jeffrey Buck 06 Jun '08

06 Jun '08

1 0

Re: [stunnel-users] stunnel compatibility question
by Brian Hatch 05 Jun '08

05 Jun '08

At almost 2008-06-05 09:37 -0400, Patel Dippen-CDP054 cajoled: > I guess what I am stating is can Stunnel listen on a UDP port The answer to that question is 'no, it cannot.' -- Brian Hatch "I was looking at bringing Systems and up some new servers on Security Engineer imaginary hardware." http://www.ifokr.org/bri/ --Jason Every message PGP signed

1 0

stunnel compatibility question
by Jeffrey Buck 04 Jun '08

04 Jun '08

2 4

Re: [stunnel-users] stunnel compatibility question
by Brian Hatch 03 Jun '08

03 Jun '08

In the neigborhood of 2008-06-03 07:58 -0400, Patel Dippen-CDP054 argued: > Will Stunnel work for UDP data? Stunnel only accepts TCP connections. > We have traffic going into the Server on UDP and outbound from the Server on TCP. You'll want an actual VPN protocol to handle that then. Or consider using a better protocol - what you describe makes the firewalls cry. > My understanding is that OpenSSL implemented the DTLS protocol (TFC > 4347: to support UDP data) in version 0.9.8 (OpenSSL: a free and popular > implementation of TLS added support for DTLS with version 0.9.8.) Not supported in Stunnel currently. -- Brian Hatch Always yield to temptation, Systems and because it may not pass Security Engineer your way again. http://www.ifokr.org/bri/ Every message PGP signed

1 0

Is anyone using Stunnel for tunnelling Voip?
by Errol Samuels 03 Jun '08

03 Jun '08

Hello All, I am currently researching a solution for tunnelling VoIP traffic since VoIP is blocked in the country concerned. It appears that the ISP is targeting OpenVPN and OpenSwan and blocking them so I want to try something different. My solution based on OpenVPN worked great until it got blocked by the ISP about a week ago. It was using an OpenVPN server hosted in a US Datacenter and the VPN clients were simply routers with third party Linux firmware with the OpenVPN client embedded in the firmware. I am also investigating the possibility of tunnelling OpenVPN through SSH but I have to watch my IP overheads here because the ISP watches the upload bandwidth as well! Has anyone attempted or had any success using stunnel for a similar scenario as I have mentioned? Thanks in Advance Regards, Errol

3 9

Can I put an accept+connect pair anywhere in the conf file?
by Ben Stover 02 Jun '08

02 Jun '08

The *.conf file is divided into several sections: [imaps] .... [pop3s] .... [smtps] ..... Are these "section headers" just comments and can I put my accept+connect pair on an arbitrary place in the *.conf file (as long as they are preceeded by their own section header [foobar] ? Ben

2 1

Connecting to mySQL from Windows
by Alistair Scott 02 Jun '08

02 Jun '08

Hi everyone I have a mySQL database that I need to connect to through SSH. I have successfully setup a connection to it using Plink. However, I'm running this from a batch file and I'd like a more elegant solution - that's where stunnel comes in I think. Rather than running a batch file, I'd like to run the connection as a Windows service - which I think this is achievable with stunnel. Trouble is, I can't work out how to do it. This is what I'm trying to achieve... Windows computer connects to mySQL server through SSH. Forwards a port to the mySQL server port 3306. Application on Windows computer connects to local forwarded port & therefore connects to the mySQL db at the remote end. I was hoping that someone could give me a pointer as to how I can set this up. Thanks in advance. Al

1 0

stunnel 4.25 released
by Michal Trojnara 01 Jun '08

01 Jun '08

Dear Users, Version 4.25, 2008.06.01, urgency: MEDIUM: * New features - Win32 DLLs for OpenSSL 0.9.8h. * Bugfixes - Spawning libwrap processes delayed until privileges are dropped. - Compilation fix for systems without struct msghdr.msg_control. Home page/download: http://stunnel.mirt.net/ sha1sum for stunnel-4.24.tar.gz file: fc6d61fad996f750c76ea627c5dd9f789af0eaf6 Best regards, Mike

1 0

Re: [stunnel-users] stunnel compatibility question
by Brian Hatch 30 May '08

30 May '08

Right around 2008-05-30 13:51 -0400, Patel Dippen-CDP054 suggested: > Is the true? I have a similar issue. I have never implemented SSL or > Stunnel. But, on whatever readup I have done so far, it seems Stunnel is > a tunneling protocol (IPnIP). So, you do have to have Stunnel on the > other end to extract the IP packet. Stunnel puts data inside SSL, inside TCP. Just like HTTPS is HTTP (data) inside SSL, inside TCP. You can think of the cleartext data inside the SSL tunnel for both of those examples. Yes, the data needs to be extracted from the SSL stream in both cases, but the application that gets it doesn't need to know diddly about it. > I mean if you are saying it will work, that's great news for me. It works if Stunnel is on one side and an SSL client or server is on the other side. > Our Server will have OpenSSL implementation but we plan to deploy > Stunnel on the Client machine. That's what Stunnel is for. -- Brian Hatch "Sorry, sorry, Systems and sorry, much apologizings." Security Engineer http://www.ifokr.org/bri/ Every message PGP signed

1 0

Need class name for stunnel
by Bill Murphy 28 May '08

28 May '08

I'm using stunnel to send and receive emails in a Microsoft Access 2007 application. I would like to be able to programmatically close stunnel when the user exits a form in the application which is used for sending and receiving emails. I can close other programs running in Windows with the code in this api: http://www.mvps.org/access/api/api0025.htm This code requires the "class name" of the application while it is running in Windows in order to close it. Stunnel.exe does not appear to have a class name. I've used the following additional api to display the class names of all currently running apps: http://www.mvps.org/access/api/api0013.htm Stunnel.exe does not show up in the list of running apps produced by this code. Is there another way to determine the stunnel class name? Bill

1 0

Re: [stunnel-users] Problem with Stunnel and OpenBSD
by Juan J. Martínez 23 May '08

23 May '08

Hello, I'm debugging with openssl s_client... >From inside the box: $ openssl s_client -connect blackshell.usebox.net:995 CONNECTED(00000004) depth=0 /C=ES/ST=Valencia/L=Valencia/O=usebox.net/OU=blackshell/CN=blackshell.usebox.net verify error:num=18:self signed certificate verify return:1 depth=0 /C=ES/ST=Valencia/L=Valencia/O=usebox.net/OU=blackshell/CN=blackshell.usebox.net verify return:1 ... And works fine. >From outside: $ openssl s_client -connect blackshell.usebox.net:995 CONNECTED(00000003) (and halts for n minutes) I hope this helps, even I don't know the difference between "CONNECTED(00...4)" and "CONNECTED(00...3)". Regards, Juanjo -- desarrollo y sistemas: http://www.usebox.net/ página personal: http://www.usebox.net/jjm/

1 1

STUNNEL: Thunderbird with Exchange and only inbound port 443
by Fatma 23 May '08

23 May '08

Hello All, A quick question regarding the stunnel ability to work with the following scenario. Scenario is: I have an Exchange Server sitting on the external perimeter with Outlook Web Access (OWA) enabled and it is the frontend and backend mail server as well. And I have a remote client which has a Thunderbird Client (for example) that I need it to connect to the Exchange Server to retrieve emails. The only inbound port to the Exchange Server from a network perspective is HTTPS-443 and no other ports are open on the firewall. Now the question is how can a client thunderbird connect to the Exchange Server/OWA with only 443 port open. So what i was thinking is and tell me if this works? If i install two instances of STUNNEL one on the remote client and one on the exchange server and the following happens. on the client the stunnel listens on port 25 SMTP and encrypts and forwards to port 443 then the server recieves and listens on port 443 and decrypts and forwards to port 110 POP3 will that work actually? hmmm i wish i explained that pretty well. if not then how can it work with the given scenario. cheerz.

1 0

Re: [stunnel-users] Wrapping a mail client - multiple servers
by Ludolf Holzheid 21 May '08

21 May '08

On Wed, 2008-05-21 14:39:42 +0100, Daniel James wrote: > [..] > > Can I, for example, put multiple [SSMTP] sections and multiple [POP3S] > sections in one stunnel.conf? I don't know. But if you can, you don't want to. The section headers don't specify a protocol. They simply give the section a name (for log output, e.g.). There is no problem in naming sections [first-POP3S] and [second-POP3S]. HTH, Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Wrapping a mail client - multiple servers
by Daniel James 21 May '08

21 May '08

I use a mail client that does not directly support SSL. I can use stunnel to provide the security layer when I connect to a SSMTP and/or POP3S server (under windows). This works fine, whether I run stunnel as a background application or as a Windows service. I'd like, however, to be able to connect to multiple mail servers over SSL. I'm not sure how I might achieve this? What would be nice would be get stunnel to forward POP3/SMTP communication on different local ports to POP3S/SSMTP on different remote servers. Can I do this? It appears to be possible to run multiple copies of stunnel as applications, and to get each copy to take its configuration from a different stunnel.conf file, so that different copies of stunnel could listen on different local ports and each could proxy the traffic it receives to a different remote server (I haven't tried this -- and it's not an ideal solution -- but it looks as though it should work). It does not appear to be possible, however, to create two instances of the stunnel service running with different configuration files. Is it possible to set up multiple listening ports proxying to different remote servers in a single configuration file? If so, what's the syntax for that? Cheers, Daniel.

1 0