- stunnel-users - stunnel.org

Re: [stunnel-users] Problem compiling win32 stunnel.exe v 4.21
by butterspoon＠gmail.com 10 Dec '07

10 Dec '07

On 09/12/2007, Luis Rodrigo Gallardo Cruz <rodrigo(a)nul-unu.com> wrote: > On Sun, Dec 09, 2007 at 11:30:01PM +0000, Hidden wrote: > > Okay, so I'm trying to build stunnel.exe (ver 4.21) under Debian Linux > > 2.6.22.1 as a prelude to applying some patches and I'm getting > > stuck. > > Just to make sure I understand: You are trying to build *for* windows > *in* Debian. Yup, just like the documentation (INSTALL.W32) says: 1) install mingw32 cross-compiler o a Unix/Linux machine (native compilation on a Windows machine is possible, but not supported) [...] 5) type "make stunnel.exe" > You seem to be mixing up (the names of) unix libs with windows ones. Well, something is. I'm just doing it by the book! > Anyways, would it not be easier to compile in windows? Anyone else here build stunnel.exe? What did you use? T

1 0

Problem compiling win32 stunnel.exe v 4.21
by Hidden 09 Dec '07

09 Dec '07

Okay, so I'm trying to build stunnel.exe (ver 4.21) under Debian Linux 2.6.22.1 as a prelude to applying some patches and I'm getting stuck. I've followed the instructions in the makefile – Install mingw32; compile and install openssl; unpack and make stunnel.exe. mingw makes a bunch of object files for a while, but then at the link stage it bombs with i586-mingw32msvc/bin/ld: cannot find -lzdll make was when trying to execute the command: i586-mingw32msvc-gcc -s -o stunnel.exe file.obj client.obj log.obj options.obj protocol.obj network.obj resolver.obj ssl.obj ctx.obj verify.obj sthreads.obj stunnel.obj gui.obj resources.obj -L/usr/src/openssl-0.9.8g -lzdll -leay32 -lssl32 -lws2_32 -lgdi32 -mwindows eay32 is nowhere to be found either. It and ssl32 are clearly related to openssl, but I can't see any suitable files in either the openssl build directory (/usr/src/openssl-0.9.8g as advertised). zdll could be something to do with zlib (which I have, ver 1.2.3) and eay32 and ssl32 are obviously related to openssl, but the only libraries under openssl are libssl.a and libcrypto.a (although optimistically trying to bolt in libssl in place of ssl32 doesn't work). ws2_32 and gdi32 are windows sockets and GDI, for what it's worth. I can't find the required libs on the internet anywhere, and maybe it's all down to me being a novice with mingw. I do notice the tantalizingly named files zlib1.dll, libeay32.dll, and libssl32.dll in the precompiled Windows binary distribution of stunnel, but surely I can't use them in any way? I'd love some help from anyone who knows this system better! Thanks, Tony

2 1

SSL session caching with multiple clients through stunnel to an https server
by Paul McGarry 06 Dec '07

06 Dec '07

Hi there, I have an application where apache/php processes make SOAP requests over https to a single remote server (which is IIS I think). I am trying to cut down the time each request takes. In it's current configuration I think some time will be wasted as the php client and IIS server handshake to set up a new SSL connection for each request, thereby adding (at least) twice the network latency between the two servers to each request. (As far as I can tell there is no way to make php SOAP use some kind of persistant connection or SSL cache when talking to the server) I am wondering if I pushed the soap requests as http through stunnel whether stunnel would be more efficient with SSL connections or whether it will just create a new tunnel with a new ssl session for each request it receives? Does anyone have any advice? Paul

1 0

MS Outlook verify = 2 using problem
by FFT` 05 Dec '07

05 Dec '07

Good Day! I'm using Stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 with OpenSSL 0.9.8g 19 Oct 2007 on Fedora-like Linux server. stunnel.conf consists: _______________________________________________________________________________ cert = /usr/local/etc/stunnel/server.crt key = /usr/local/etc/stunnel/server.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) ;sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /usr/local/var/stunnel/ setuid = nobody setgid = nobody ; PID is created inside chroot jail pid = /stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath =/usr/local/etc/stunnel/certs ; It's often easier to use CAfile CAfile = /usr/local/etc/stunnel/ca.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/etc/stunnel/crl.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Service-level configuration [pop3s] accept = 995 connect = 110 ________________________________________________________________________ PKI consists: ROOT_CA CA MAIL_CON_CA SERVER CLIENT server.crt - Server certificate in PEM Format; server.pem - Server key in PEM Format with nopassword ca.pem - ROOT_CA, CA, MAIL_CON_CA certificates in PEM format. When I am using MS Outlook mail Client , there are some PROBLEM with connections to SERVER:995 stunnel.log consists: ______________________________________________ 2007.12.05 14:57:39 LOG5[16668:1074107776]: stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2007.12.05 14:57:39 LOG5[16668:1074107776]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 2007.12.05 14:57:39 LOG6[16668:1074107776]: file ulimit = 1024 (can be changed with 'ulimit -n') 2007.12.05 14:57:39 LOG6[16668:1074107776]: poll() used - no FD_SETSIZE limit for file descriptors 2007.12.05 14:57:39 LOG5[16668:1074107776]: 500 clients allowed 2007.12.05 14:57:39 LOG7[16668:1074107776]: FD 6 in non-blocking mode 2007.12.05 14:57:39 LOG7[16668:1074107776]: FD 8 in non-blocking mode 2007.12.05 14:57:39 LOG7[16668:1074107776]: FD 9 in non-blocking mode 2007.12.05 14:57:39 LOG7[16668:1074107776]: SO_REUSEADDR option set on accept socket 2007.12.05 14:57:39 LOG7[16668:1074107776]: pop3s bound to 0.0.0.0:995 2007.12.05 14:57:39 LOG7[16669:1074107776]: Created pid file /stunnel.pid 2007.12.05 14:57:48 LOG7[16669:1074107776]: pop3s accepted FD=10 from 192.168.1.205:2129 2007.12.05 14:57:48 LOG7[16669:1074228016]: pop3s started 2007.12.05 14:57:48 LOG7[16669:1074228016]: FD 10 in non-blocking mode 2007.12.05 14:57:48 LOG7[16669:1074228016]: TCP_NODELAY option set on local socket 2007.12.05 14:57:48 LOG5[16669:1074228016]: pop3s accepted connection from 192.168.1.205:2129 2007.12.05 14:57:48 LOG7[16669:1074228016]: SSL state (accept): before/accept initialization 2007.12.05 14:57:48 LOG7[16669:1074228016]: SSL state (accept): SSLv3 read client hello A 2007.12.05 14:57:48 LOG7[16669:1074228016]: SSL state (accept): SSLv3 write server hello A 2007.12.05 14:57:48 LOG7[16669:1074228016]: SSL state (accept): SSLv3 write certificate A 2007.12.05 14:57:48 LOG7[16669:1074228016]: SSL state (accept): SSLv3 write certificate request A 2007.12.05 14:57:48 LOG7[16669:1074228016]: SSL state (accept): SSLv3 flush data 2007.12.05 14:57:48 LOG7[16669:1074228016]: SSL alert (write): fatal: handshake failure 2007.12.05 14:57:48 LOG3[16669:1074228016]: SSL_accept: 140890C7: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate 2007.12.05 14:57:48 LOG5[16669:1074228016]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.12.05 14:57:48 LOG7[16669:1074228016]: pop3s finished (0 left) ______________________________________________ I load all Server, CA , and client certificate in SYSTEM, but there is NO Connection. Please help Me with Stunnel and Outlook using.

1 0

(no subject)
by Harmon, Paul 02 Dec '07

02 Dec '07

Ok Guys, I hate to be a nuisance. But I encountered an error coming out o the Stunnel configuration in LINUX. First what does it mean when Stunnel is in INETD mode? Does this imply certain configuration restrictions and why? Thanks, Paul Harmon

2 1

Help using Stunnel-4.XX
by Harmon, Paul 30 Nov '07

30 Nov '07

Hi Folks, Well I know a little more now than before. The version of Stunnel I'm using is Stunnel 4.05 running under Fedora 7.0. I am trying to setup a test scenario at the moment where I am running a stream socket between a client and a server, both mine since this is a test scenario. I need thisese programs to connect over a secure socket and the exchange of data is a custom application. I've read through Barry O'donovan's article and that seems to give me the information on how to configure and use Stunnel on the server side. It is not clear to me yet, what I need to do to the client side. Is there anyone out there who has done this type of thing and could give me some help? Thanks in advance, Paul Harmon

2 1

Problem with stunnel 4.20 on Fedora 7
by Andrew M Dunn 30 Nov '07

30 Nov '07

[Oh wise list folks... I haven't seen any responses to this. Does anybody have any experience either with using stunnel on Fedora 7, or with the particular error? I cannot find any other hints or reasons as to why the resolution is failing... Andy] ----original message------ I can't get stunnel to run on a freshly-installed Fedora 7 system. It fails with "Error resolving '0.0.0.0': servname is not supported for ai_socktype" but the usual other causes of that error (ie. ports not defined in /etc/services, bad settings in /etc/nsswitch.conf) are not the culprit this time. COMMAND LINE: /usr/sbin/stunnel /home/amdunn/security/stunnel.conf COMMAND OUTPUT: 2007.08.29 11:44:12 LOG3[13614:3086243520]: Error resolving '0.0.0.0': servname is not supported for ai_socktype (EAI_SERVICE) file /home/amdunn/security/stunnel.conf line 10: Failed to resolve accepting address STUNNEL.CONF FILE: ; ; stunnel file for testing 443 access to local http server ; cert=/home/amdunn/security/xxxxxxx key=/home/amdunn/security/yyyyyyy foreground=yes ; ; [sweb] accept=443 ; https port connect=80 ; standard httpd listening port TIMEOUTclose=0 ; must set this or IE waits 60sec on page end client=no STUNNEL -VERSION OUTPUT: stunnel 4.20 on i686-redhat-linux-gnu with OpenSSL 0.9.8b 04 May 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none

2 1

zlib compression not working
by webmaster＠escoltesiguies.cat 29 Nov '07

29 Nov '07

I have configured both windows client and linux server (samba) with zlib compression: compression = zlib But I have transferred a txt file of 100Mb in 40 minutes and the same file compressed with gzip (22Mb) in 14 minutes. So I thing compression is not working. Client log tells: Compression enabled using zlib method and server log: Compression enabled using zlib method How can I verify comression is working? maybe compression is working but it is poor?

1 0

About stunnel 4.21 daemon mode
by wei hu 28 Nov '07

28 Nov '07

Dear I had successfully installed stunnel 4.21 on my server, but after I edited the file stunnel.conf and startup the stunnel, I can't find the stunnel via the "ps -ef" command.Then I have found such error message in the log file: 2007.11.27 07:42:28 LOG5[28550:3085354688]: stunnel 4.21 on i686-pc-linux-gnu wi th OpenSSL 0.9.7f 22 Mar 2005 2007.11.27 07:42:28 LOG5[28550:3085354688]: Threading:PTHREAD SSL:ENGINE Sockets :POLL,IPv6 Auth:LIBWRAP 2007.11.27 07:42:28 LOG6[28550:3085354688]: file ulimit = 1024 (can be changed w ith 'ulimit -n') 2007.11.27 07:42:28 LOG6[28550:3085354688]: poll() used - no FD_SETSIZE limit fo r file descriptors 2007.11.27 07:42:28 LOG5[28550:3085354688]: 500 clients allowed 2007.11.27 07:42:28 LOG7[28550:3085354688]: FD 9 in non-blocking mode 2007.11.27 07:42:28 LOG7[28550:3085354688]: FD 10 in non-blocking mode 2007.11.27 07:42:28 LOG7[28550:3085354688]: FD 11 in non-blocking mode 2007.11.27 07:42:28 LOG7[28550:3085354688]: SO_REUSEADDR option set on accept so cket 2007.11.27 07:42:28 LOG7[28550:3085354688]: sproxy bound to 0.0.0.0:83 2007.11.27 07:42:28 LOG3[28556:3085354688]: Failed to get GID for group nobody Do somebody knows how to get GID for group nobody? My nobody group is sured to work correctly with Squid. The config file about group: ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /usr/local/var/lib/stunnel/ setuid = nobody setgid = nobody ; PID is created inside chroot jail pid = /stunnel.pid The command "stunnel -version" response: [root@vps stunnel]# /usr/local/bin/stunnel -version stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.7f 22 Mar 2005 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none The command "/usr/local/bin/stunnel" response: [root@vps stunnel]# /usr/local/bin/stunnel 2007.11.27 07:27:27 LOG7[13697:3085354688]: Snagged 64 random bytes from /root/.rnd 2007.11.27 07:27:27 LOG7[13697:3085354688]: Wrote 1024 new random bytes to /root/.rnd 2007.11.27 07:27:27 LOG7[13697:3085354688]: RAND_status claims sufficient entropy for the PRNG 2007.11.27 07:27:27 LOG7[13697:3085354688]: PRNG seeded successfully 2007.11.27 07:27:27 LOG7[13697:3085354688]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2007.11.27 07:27:27 LOG7[13697:3085354688]: Certificate loaded 2007.11.27 07:27:27 LOG7[13697:3085354688]: Key file: /usr/local/etc/stunnel/stunnel.pem 2007.11.27 07:27:27 LOG7[13697:3085354688]: Private key loaded 2007.11.27 07:27:27 LOG7[13697:3085354688]: SSL context initialized for service sproxy Best Regards, HuWei

2 2

Re: [stunnel-users] More questions on RDP and port forwarding
by richard.woodman＠cox.net 28 Nov '07

28 Nov '07

Carter, Thanks. With the exception of the client's loopback address in the hosts file, I have a very similar configuration. I have created an inbound rule (Custom service with an inbound rule declaration but no outbound rule) that looks just like my inbound RDP rules - I even reviewed the configuration file and the stunnel rule had the same commands as the RDP rule. However, RDP works through the firewall but stunnel does not. My Windows firewall has an exception for stunnel with a scope of "Internet" and the stunnel server works from within the corporate network. Meaning, I think, that the Windows firewall is not denying the connection (at least from within the same subnet). I am not a Windows AD guy, but is there a way to prevent network connections without using the Windows firewall? I mean, can a GPO be created that prevents connections from IP addresses not on the same subnet but that does not use the OS's firewall? If so, this could be the issue because from what I can see, neither the Watchguard nor the Windows firewalls are blocking the connection; yet I still cannot connect. Richard Carter Browne wrote: I use stunnel to protect RDP for a couple of sites using a mix of Watchguard Edge and V series firewalls. For computer ABC that I want to connect to, I create an entry in the hosts file: 127.0.0.n ABCs (where n is greater than 1) On the client side I have an entry: [ABC-RDP] accept = ADCs:12345 connect = ABC:54321 client = yes On the server sid I have an entry: [RDP-IN] accept = 54321 connect = 3389 client = no Port 54321 is enabled in both the Watchguard and the Windows firewalls. Using the 127.n.n.n ports are not processed by the firewalls. You can use 127.0.0.1 for everything, but I needed to connect to more that one host and wanted a standard setup. I have had a number of users confused by this setup whereby the program references a local port to connect to a remote computer. For stunnel, it is the connect string that determines the destination, so any local port works fine for the accept string. Carter

2 1

Problems accessing samba
by webmaster＠escoltesiguies.cat 27 Nov '07

27 Nov '07

I have a winXP machine which should connect to a linux samba. Everything installed following http://wiki.netbsd.se/index.php/How_to_secure_samba_with_stunnel but it don't connect. I have both loglevels set to 7, and as serverlog don't change I thing the error is at clientside. stunnel.conf is: client=yes debug = 7 [smb] accept=222.222.222.222:139 connect=85.48.253.144:8888 And the client log is: 2007.11.27 12:46:58 LOG7[3716:720]: RAND_status claims sufficient entropy for the PRNG 2007.11.27 12:46:58 LOG7[3716:720]: PRNG seeded successfully 2007.11.27 12:46:58 LOG7[3716:720]: Certificate: stunnel.pem 2007.11.27 12:46:58 LOG7[3716:720]: Certificate loaded 2007.11.27 12:46:58 LOG7[3716:720]: Key file: stunnel.pem 2007.11.27 12:46:58 LOG7[3716:720]: Private key loaded 2007.11.27 12:46:58 LOG7[3716:720]: SSL context initialized for service smb 2007.11.27 12:46:58 LOG5[3716:720]: stunnel 4.21 on x86-pc-mingw32-gnu with OpenSSL 0.9.8g 19 Oct 2007 2007.11.27 12:46:58 LOG5[3716:720]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2007.11.27 12:46:58 LOG5[3716:3292]: No limit detected for the number of clients 2007.11.27 12:46:59 LOG7[3716:3292]: FD 216 in non-blocking mode 2007.11.27 12:46:59 LOG7[3716:3292]: SO_REUSEADDR option set on accept socket 2007.11.27 12:46:59 LOG7[3716:3292]: smb bound to 222.222.222.222:139 2007.11.27 12:47:15 LOG7[3716:3292]: smb accepted FD=248 from 88.31.107.217:1625 2007.11.27 12:47:15 LOG7[3716:3292]: Creating a new thread 2007.11.27 12:47:15 LOG7[3716:3292]: New thread created 2007.11.27 12:47:15 LOG7[3716:4028]: smb started 2007.11.27 12:47:15 LOG7[3716:4028]: FD 248 in non-blocking mode 2007.11.27 12:47:15 LOG7[3716:4028]: TCP_NODELAY option set on local socket 2007.11.27 12:47:15 LOG5[3716:4028]: smb accepted connection from 88.31.107.217:1625 2007.11.27 12:47:15 LOG7[3716:4028]: FD 272 in non-blocking mode 2007.11.27 12:47:15 LOG7[3716:4028]: smb connecting 85.48.253.144:8888 2007.11.27 12:47:15 LOG7[3716:4028]: connect_wait: waiting 10 seconds 2007.11.27 12:47:25 LOG7[3716:3292]: smb accepted FD=308 from 88.31.107.217:1628 2007.11.27 12:47:25 LOG7[3716:3292]: Creating a new thread 2007.11.27 12:47:25 LOG7[3716:3292]: New thread created 2007.11.27 12:47:25 LOG7[3716:3012]: smb started 2007.11.27 12:47:25 LOG7[3716:3012]: FD 308 in non-blocking mode 2007.11.27 12:47:25 LOG7[3716:3012]: TCP_NODELAY option set on local socket 2007.11.27 12:47:25 LOG5[3716:3012]: smb accepted connection from 88.31.107.217:1628 2007.11.27 12:47:25 LOG7[3716:3012]: FD 340 in non-blocking mode 2007.11.27 12:47:25 LOG7[3716:3012]: smb connecting 85.48.253.144:8888 2007.11.27 12:47:25 LOG7[3716:3012]: connect_wait: waiting 10 seconds 2007.11.27 12:47:25 LOG6[3716:4028]: connect_wait: s_poll_wait timeout 2007.11.27 12:47:25 LOG5[3716:4028]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.11.27 12:47:25 LOG7[3716:4028]: smb finished (1 left) 2007.11.27 12:47:35 LOG6[3716:3012]: connect_wait: s_poll_wait timeout 2007.11.27 12:47:35 LOG5[3716:3012]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.11.27 12:47:35 LOG7[3716:3012]: smb finished (0 left) Where is the problem? Thanks

1 1

VeriSign Intermediate CA Certificate issue.
by Unai Rodriguez 27 Nov '07

27 Nov '07

Dear All, I am trying to set an https layer using stunnel. I am having problems with the intermediary certificate since it appears broken to the user. You may find a screenshot here: http://u-journal.org/stunnel/Root_Cert_Err.jpg My stunnel version is: 3.26 running on Debian 3.1 I run stunnel as standalone with this parameters: stunnel -d 10.123.16.103:443 -D 7 -R /etc/ssl/certs/stunnel.rnd \ -p /etc/ssl/certs/stunnel.pem -o /var/log/stunnel/stunnel.log \ -r 10.123.16.103:80 -N https You may find the output of my stunnel -V here: http://pastebin.ca/793495 uname -a: Linux lb2-dp-vm 2.6.8-3-686 #1 Tue Dec 5 21:26:38 UTC 2006 i686 GNU/Linux openssl version: OpenSSL 0.9.7e 25 Oct 2004 So, if I create my /etc/ssl/certs/stunnel.pem file like this: -----BEGIN RSA PRIVATE KEY----- rsa_priv_key -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- secured.behringer.com_certificate -----END CERTIFICATE----- -- OR -- -----BEGIN RSA PRIVATE KEY----- rsa_priv_key -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- secured.behringer.com_certificate -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- VeriSign Intermediate CA Certificate (https://www.verisign.com.sg/support/ssl/install/intermediate/secure.shtml) -----END CERTIFICATE----- I get the mentioned error. If I create the /etc/ssl/certs/stunnel.pem like this: -----BEGIN RSA PRIVATE KEY----- rsa_priv_key -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- VeriSign Intermediate CA Certificate (https://www.verisign.com.sg/support/ssl/install/intermediate/secure.shtml) -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- secured.behringer.com_certificate -----END CERTIFICATE----- I get the error: "[...] X509_check_private_key:key values mismatch" You may see the log here: http://pastebin.ca/793500 Any clues on what am I doing wrong? Thank you so much! unai

1 1

Re: [stunnel-users] More questions on RDP and port forwarding
by richard.woodman＠cox.net 26 Nov '07

26 Nov '07

OK, I took my configs, my certs, etc. and put them on two boxes in the lab - then I ensured I could use stunnel to connect using VNC. I then put a NAT box (Linksys BEFSR81) between the two and configured the Linksys to provide port forwarding. I then reconnected and everything worked first time. Therefore, I can only assume that either port-forwarding is misconfigured on my Watchguard SOHO 6tc -or- that the Windows firewall is causing problems (neither lab box has a firewall running). I'll keep you posted on what I find. Thanks. Richard My original post: I did read through the archives but I cannot determine how to get Stunnel working through the firewall. Here is what I wish to do: 1. Tunnel Windows Remote Desktop through stunnel. 2. I wish to connect from home to work; I have access to the firewall at work. Here's what I've done: 1. Installed stunnel on Windows XP at home and at work. I have self-signed certificates and am using verify = 3 (on both computers). Cacert.pem has the CA cert, the work cert, and the home cert in a single file. The server-cert.pem has the work computer's key and cert while the client-1-cert.pem (home computer) has it's own key and cert. 2. Stunnel at home has client = yes, stunnel at work has this commented out. Stunnel at work will become a "server" where multiple clients connect via stunnel and that single computer makes multiple RDP connections. Client (home) computer has [rdp1] accept = 4391 connect = <work outside interface IP>:44391 Server (work) computer has [rdp2] accept = 44391 connect = <work computer name>:3392 If I try this at work from within the corporate network (change the client connect string to the stunnel server's IP or hostname), then everything works fine. However, once I try from outside the work network, nothing works. Firewall is a Watchguard SOHO 6tc and I have a inbound rule permitting 44391 and directing it to X.X.X.52 (the stunnel server). I also have other rules allowing RDP (on port 3392 for instance) directly to the computer I wish to control and those rules work. Essentially, RDP directly through the firewall works but stunnel through the firewall does not. I assume there is no traffic destined for .52 on 44391 because the log file on the server (with debug = 7) only shows the startup sequence and port binding (netstat -a shows I am listening on 44391). I also tried this at home on my Juniper 5XT and was unsuccessful. Please help. Richard

1 0

Re: [stunnel-users] More questions on RDP and port forwarding
by richard.woodman＠cox.net 26 Nov '07

26 Nov '07

Craig, Thanks. Are you advising that I put "client = yes" in the service declaration rather than the main configuration? I already have "client = yes" on the client side (in the main configuration) and that line commented out of the server's configuration (I assume the default is client = no). When I review the log on the client computer, I can see where it times out waiting on a response from the work firewall's outside IP address. I do not see any connection attempts on the server side and both stunnel instances (client and server) have debug = 7 and logging to stunnel.log. Richard > -----Original Message----- > From: stunnel-users-bounces(a)mirt.net [mailto:stunnel-users- > bounces(a)mirt.net] On Behalf Of Richard Woodman > Sent: 26 November 2007 07:44 AM > To: stunnel-users(a)mirt.net > Subject: [stunnel-users] More questions on RDP and port forwarding > > I did read through the archives but I cannot determine how to get > Stunnel > working through the firewall. Here is what I wish to do: > > 1. Tunnel Windows Remote Desktop through stunnel. > 2. I wish to connect from home to work; I have access to the firewall > at > work. > > Here's what I've done: > > 1. Installed stunnel on Windows XP at home and at work. I have self- > signed > certificates and am using verify = 3 (on both computers). Cacert.pem > has > the CA cert, the work cert, and the home cert in a single file. The > server-cert.pem has the work computer's key and cert while the > client-1-cert.pem (home computer) has it's own key and cert. > 2. Stunnel at home has client = yes, stunnel at work has this > commented > out. Stunnel at work will become a "server" where multiple clients > connect > via stunnel and that single computer makes multiple RDP connections. > > Client (home) computer has > Try changing the client config to the following: [rdp1] client = yes accept = 4391 connect = <work outside interface IP>:44391 > > Server (work) computer has > > [rdp2] > accept = 44391 > connect = <work computer name>:3392 > > If I try this at work from within the corporate network (change the > client > connect string to the stunnel server's IP or hostname), then everything > works fine. However, once I try from outside the work network, nothing > works. Firewall is a Watchguard SOHO 6tc and I have a inbound rule > permitting 44391 and directing it to X.X.X.52 (the stunnel server). I > also > have other rules allowing RDP (on port 3392 for instance) directly to > the > computer I wish to control and those rules work. Essentially, RDP > directly > through the firewall works but stunnel through the firewall does not. > I > assume there is no traffic destined for .52 on 44391 because the log > file on > the server (with debug = 7) only shows the startup sequence and port > binding > (netstat -a shows I am listening on 44391). I also tried this at home > on my > Juniper 5XT and was unsuccessful. Please help. > > Richard > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users Cheers, Craig

1 0

More questions on RDP and port forwarding
by Richard Woodman 26 Nov '07

26 Nov '07

I did read through the archives but I cannot determine how to get Stunnel working through the firewall. Here is what I wish to do: 1. Tunnel Windows Remote Desktop through stunnel. 2. I wish to connect from home to work; I have access to the firewall at work. Here's what I've done: 1. Installed stunnel on Windows XP at home and at work. I have self-signed certificates and am using verify = 3 (on both computers). Cacert.pem has the CA cert, the work cert, and the home cert in a single file. The server-cert.pem has the work computer's key and cert while the client-1-cert.pem (home computer) has it's own key and cert. 2. Stunnel at home has client = yes, stunnel at work has this commented out. Stunnel at work will become a "server" where multiple clients connect via stunnel and that single computer makes multiple RDP connections. Client (home) computer has [rdp1] accept = 4391 connect = <work outside interface IP>:44391 Server (work) computer has [rdp2] accept = 44391 connect = <work computer name>:3392 If I try this at work from within the corporate network (change the client connect string to the stunnel server's IP or hostname), then everything works fine. However, once I try from outside the work network, nothing works. Firewall is a Watchguard SOHO 6tc and I have a inbound rule permitting 44391 and directing it to X.X.X.52 (the stunnel server). I also have other rules allowing RDP (on port 3392 for instance) directly to the computer I wish to control and those rules work. Essentially, RDP directly through the firewall works but stunnel through the firewall does not. I assume there is no traffic destined for .52 on 44391 because the log file on the server (with debug = 7) only shows the startup sequence and port binding (netstat -a shows I am listening on 44391). I also tried this at home on my Juniper 5XT and was unsuccessful. Please help. Richard

3 2

I'm very much a newbie to stunnel
by Harmon, Paul 26 Nov '07

26 Nov '07

Hi Guys, I'm very new to Stunnel. In fact I have no experience with it what so ever. My situation is this: I have server program and a client at the moment which know nothing about SSL. Yet the powers that be insist that my two machines, if they must use sockets, do so using SSL. After reading through the distribution, I found this very interesting program called Stunnel which sounds like it might solve my problem quite well. From what I've read so far, I gather this program can be used as an SSL wrapper for my server and my client. Would some kind soul please help me with the configuration process (the configuration file) so that my client and server can be safe and secure? My server uses a port which I have chosen (really quite arbitrarily). Basically I need the server to listen on that port and wait for incoming data which it will processs and in most cases not even reply. With normal sockets this is a no-brainer since Steven's book outlines it very well. If I understand the documentation I've read so far, Stunnel adds the encryption layer on top of that which I need. So how do I configure and invokestunnel in this environment? Sorry for stupid questions at the moment I just lack examples like this and confidence in using the program. Thanks, Paul

2 1

Certificate management
by Koenraad Lelong 23 Nov '07

23 Nov '07

Hi, Since a few months I'm playing with stunnel. Last month I installed a stunnel at a customer. This week he reported he could not connect any more. After testing here I discovered the CA cert had expired. I made this myself and I didn't see that it's only valid for one month. I made new certificates making sure they are valid for longer than one month, so this is solved for now. My question : are there good documents about management of certificates ? I'm specially interested in renewing the certificates. Regards, Koenraad Lelong.

2 1

some newbie questions
by Lluís Forns 23 Nov '07

23 Nov '07

Let me first explain what I want to do in order to see if stunnel is what I need: I have some laptops around the world and I want to let them login in my intranet. The login is versus a Samba server. So more or less the connection would be: Laptop (running winXP) --- router --- internet --- router --- linux ssh server(port 22 open) --- linux samba server Could stunnel help me achivieng this? any hint of how? I have read the documentation, but I am a little lost. thanks -- <http://www.escoltesiguies.cat>*Lluís Forns - Tècnic Informàtic * *Servei d'Informàtica* *Minyons Escoltes i Guies de Catalunya (MEG)* *Telèfon:* 93 590 27 00 *Fax:* 93 590 04 92 *www.escoltesiguies.cat* No m'imprimeixis si no és necessari. Protegim el medi ambient.

2 1

Re: [stunnel-users] Stunnel and Outlook Web Access Problems
by Craig Retief 20 Nov '07

20 Nov '07

I see that you have client = yes in the config file. When client = yes is set outside the service block, it becomes a global setting that tells all the services that it should tunnel that they are clients and not servers. If you specify the client = yes within a service eg. [pop3s] client = yes accept = 995 connect = 110 then stunnel knows that the specified service alone is a client. What I recommend is that you disable the client = yes in the global area and change you config file to something like this: I have removed the comments to shorten the config for explanation: socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 CRLpath = crls CRLfile = certnew.pem debug = 7 output = stunnel.log ;client = yes [https] accept = 443 connect = 192.168.0.5:443 TIMEOUTclose = 0 Try using this as your config and see if it works or not. Cheers Craig From: Dan Vespa [mailto:[email protected]] Sent: 19 November 2007 05:07 PM To: Craig Retief Subject: RE: [stunnel-users] Stunnel and Outlook Web Access Problems Craig, Here it is.... ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment ;cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = crls ; It's often easier to use CAfile ;CAfile = certnew.pem ; Don't forget to c_rehash CRLpath CRLpath = crls ; Alternatively you can use CRLfile CRLfile = certnew.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 [https] accept = 443 connect = 192.168.0.5:443 TIMEOUTclose = 0 ; vim:ft=dosini _____ From: Craig Retief Sent: Mon 19/11/2007 9:54 AM To: 'Dan Vespa' Cc: stunnel-users(a)mirt.net Subject: RE: [stunnel-users] Stunnel and Outlook Web Access Problems Please Post your stunnel configs. Makes life easier. Cheers Craig From: Dan Vespa [mailto:[email protected]] Sent: 19 November 2007 03:35 PM To: Craig Subject: RE: [stunnel-users] Stunnel and Outlook Web Access Problems Craig, I set the debug level higher and this is what my log outputs.... 2007.11.19 08:25:54 LOG7[1596:2656]: RAND_status claims sufficient entropy for the PRNG 2007.11.19 08:25:54 LOG7[1596:2656]: PRNG seeded successfully 2007.11.19 08:25:54 LOG7[1596:2656]: SSL context initialized for service https 2007.11.19 08:25:54 LOG5[1596:2656]: stunnel 4.21 on x86-pc-mingw32-gnu with OpenSSL 0.9.8g 19 Oct 2007 2007.11.19 08:25:54 LOG5[1596:2656]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2007.11.19 08:25:54 LOG5[1596:3012]: No limit detected for the number of clients 2007.11.19 08:25:54 LOG7[1596:3012]: FD 188 in non-blocking mode 2007.11.19 08:25:54 LOG7[1596:3012]: SO_REUSEADDR option set on accept socket 2007.11.19 08:25:54 LOG7[1596:3012]: https bound to 0.0.0.0:443 2007.11.19 08:26:32 LOG7[1596:3012]: https accepted FD=236 from 127.0.0.1:1409 2007.11.19 08:26:32 LOG7[1596:3012]: Creating a new thread 2007.11.19 08:26:32 LOG7[1596:3012]: New thread created 2007.11.19 08:26:32 LOG7[1596:2576]: https started 2007.11.19 08:26:32 LOG7[1596:2576]: FD 236 in non-blocking mode 2007.11.19 08:26:32 LOG7[1596:2576]: TCP_NODELAY option set on local socket 2007.11.19 08:26:32 LOG5[1596:2576]: https accepted connection from 127.0.0.1:1409 2007.11.19 08:26:32 LOG7[1596:2576]: FD 260 in non-blocking mode 2007.11.19 08:26:32 LOG7[1596:2576]: https connecting 192.168.0.5:443 2007.11.19 08:26:32 LOG7[1596:2576]: connect_wait: waiting 10 seconds 2007.11.19 08:26:32 LOG7[1596:2576]: connect_wait: connected 2007.11.19 08:26:32 LOG5[1596:2576]: https connected remote server from 192.168.0.24:1410 2007.11.19 08:26:32 LOG7[1596:2576]: Remote FD=260 initialized 2007.11.19 08:26:32 LOG7[1596:2576]: TCP_NODELAY option set on remote socket 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): before/connect initialization 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 write client hello A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 read server hello A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 read server certificate A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 read server done A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 write client key exchange A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 write change cipher spec A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 write finished A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 flush data 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 read finished A 2007.11.19 08:26:32 LOG7[1596:2576]: 1 items in the session cache 2007.11.19 08:26:32 LOG7[1596:2576]: 1 client connects (SSL_connect()) 2007.11.19 08:26:32 LOG7[1596:2576]: 1 client connects that finished 2007.11.19 08:26:32 LOG7[1596:2576]: 0 client renegotiations requested 2007.11.19 08:26:32 LOG7[1596:2576]: 0 server connects (SSL_accept()) 2007.11.19 08:26:32 LOG7[1596:2576]: 0 server connects that finished 2007.11.19 08:26:32 LOG7[1596:2576]: 0 server renegotiations requested 2007.11.19 08:26:32 LOG7[1596:2576]: 0 session cache hits 2007.11.19 08:26:32 LOG7[1596:2576]: 0 session cache misses 2007.11.19 08:26:32 LOG7[1596:2576]: 0 session cache timeouts 2007.11.19 08:26:32 LOG6[1596:2576]: SSL connected: new session negotiated 2007.11.19 08:26:32 LOG6[1596:2576]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2007.11.19 08:26:53 LOG7[1596:3012]: https accepted FD=288 from 127.0.0.1:1411 2007.11.19 08:26:53 LOG7[1596:3012]: Creating a new thread 2007.11.19 08:26:53 LOG7[1596:3012]: New thread created 2007.11.19 08:26:53 LOG7[1596:1060]: https started 2007.11.19 08:26:53 LOG7[1596:1060]: FD 288 in non-blocking mode 2007.11.19 08:26:53 LOG7[1596:1060]: TCP_NODELAY option set on local socket 2007.11.19 08:26:53 LOG5[1596:1060]: https accepted connection from 127.0.0.1:1411 2007.11.19 08:26:53 LOG7[1596:1060]: FD 312 in non-blocking mode 2007.11.19 08:26:53 LOG7[1596:1060]: https connecting 192.168.0.5:443 2007.11.19 08:26:53 LOG7[1596:1060]: connect_wait: waiting 10 seconds 2007.11.19 08:26:53 LOG7[1596:1060]: connect_wait: connected 2007.11.19 08:26:53 LOG5[1596:1060]: https connected remote server from 192.168.0.24:1412 2007.11.19 08:26:53 LOG7[1596:1060]: Remote FD=312 initialized 2007.11.19 08:26:53 LOG7[1596:1060]: TCP_NODELAY option set on remote socket 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): before/connect initialization 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 write client hello A 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 read server hello A 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 read finished A 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 write change cipher spec A 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 write finished A 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 flush data 2007.11.19 08:26:53 LOG7[1596:1060]: 1 items in the session cache 2007.11.19 08:26:53 LOG7[1596:1060]: 2 client connects (SSL_connect()) 2007.11.19 08:26:53 LOG7[1596:1060]: 2 client connects that finished 2007.11.19 08:26:53 LOG7[1596:1060]: 0 client renegotiations requested 2007.11.19 08:26:53 LOG7[1596:1060]: 0 server connects (SSL_accept()) 2007.11.19 08:26:53 LOG7[1596:1060]: 0 server connects that finished 2007.11.19 08:26:53 LOG7[1596:1060]: 0 server renegotiations requested 2007.11.19 08:26:53 LOG7[1596:1060]: 1 session cache hits 2007.11.19 08:26:53 LOG7[1596:1060]: 0 session cache misses 2007.11.19 08:26:53 LOG7[1596:1060]: 0 session cache timeouts 2007.11.19 08:26:53 LOG6[1596:1060]: SSL connected: previous session reused 2007.11.19 08:26:53 LOG7[1596:1060]: SSL socket closed on SSL_read 2007.11.19 08:26:53 LOG7[1596:1060]: Socket write shutdown 2007.11.19 08:26:53 LOG5[1596:1060]: Connection closed: 70 bytes sent to SSL, 164 bytes sent to socket 2007.11.19 08:26:53 LOG7[1596:1060]: https finished (1 left) 2007.11.19 08:27:53 LOG3[1596:2576]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2007.11.19 08:27:53 LOG5[1596:2576]: Connection reset: 1102 bytes sent to SSL, 1241 bytes sent to socket 2007.11.19 08:27:53 LOG7[1596:2576]: https finished (0 left) Does this make any sense to you???? Dan _____ From: Craig Sent: Mon 19/11/2007 1:34 AM To: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Stunnel and Outlook Web Access Problems OWA rewrites the URL when you log in and I have found that it causes problems when doing that with a Stunnel connection. What I think might be happening is that your initial connection says http://server.tld/ then when you log in OWA rewrites the URL to https://server.tld/ What I think is happening is that your stunnel is listening on port 80 and when you log in, OWA changes the listening port in the browser to port 443. Try running the listening server (stunnel server) to listen on port 443 instead of port 80 and see if that fixes the problem. Cheers Craig From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Dan Vespa Sent: 17 November 2007 07:21 PM To: stunnel-users(a)mirt.net Subject: [stunnel-users] Stunnel and Outlook Web Access Problems I am trying to use the latest version of stunnel to connect to OWA. I set stunnel to listen on port 80 (localhost) and then connect to myserverip on port 443. I get the login screen but can go no further after I Enter my credentials and Click OK. Checking the stunnel log screen it shows that a connect has been made? I don't understand why It won't connect any further?? OWA is on Exchange Server 2003 and I am using Windows XP SP2. I have also updated to Open SSL latest version. Thanks in Advance. Dan

1 0

Re: [stunnel-users] Stunnel and Outlook Web Access Problems
by Craig Retief 19 Nov '07

19 Nov '07

Please Post your stunnel configs. Makes life easier. Cheers Craig From: Dan Vespa [mailto:[email protected]] Sent: 19 November 2007 03:35 PM To: Craig Subject: RE: [stunnel-users] Stunnel and Outlook Web Access Problems Craig, I set the debug level higher and this is what my log outputs.... 2007.11.19 08:25:54 LOG7[1596:2656]: RAND_status claims sufficient entropy for the PRNG 2007.11.19 08:25:54 LOG7[1596:2656]: PRNG seeded successfully 2007.11.19 08:25:54 LOG7[1596:2656]: SSL context initialized for service https 2007.11.19 08:25:54 LOG5[1596:2656]: stunnel 4.21 on x86-pc-mingw32-gnu with OpenSSL 0.9.8g 19 Oct 2007 2007.11.19 08:25:54 LOG5[1596:2656]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2007.11.19 08:25:54 LOG5[1596:3012]: No limit detected for the number of clients 2007.11.19 08:25:54 LOG7[1596:3012]: FD 188 in non-blocking mode 2007.11.19 08:25:54 LOG7[1596:3012]: SO_REUSEADDR option set on accept socket 2007.11.19 08:25:54 LOG7[1596:3012]: https bound to 0.0.0.0:443 2007.11.19 08:26:32 LOG7[1596:3012]: https accepted FD=236 from 127.0.0.1:1409 2007.11.19 08:26:32 LOG7[1596:3012]: Creating a new thread 2007.11.19 08:26:32 LOG7[1596:3012]: New thread created 2007.11.19 08:26:32 LOG7[1596:2576]: https started 2007.11.19 08:26:32 LOG7[1596:2576]: FD 236 in non-blocking mode 2007.11.19 08:26:32 LOG7[1596:2576]: TCP_NODELAY option set on local socket 2007.11.19 08:26:32 LOG5[1596:2576]: https accepted connection from 127.0.0.1:1409 2007.11.19 08:26:32 LOG7[1596:2576]: FD 260 in non-blocking mode 2007.11.19 08:26:32 LOG7[1596:2576]: https connecting 192.168.0.5:443 2007.11.19 08:26:32 LOG7[1596:2576]: connect_wait: waiting 10 seconds 2007.11.19 08:26:32 LOG7[1596:2576]: connect_wait: connected 2007.11.19 08:26:32 LOG5[1596:2576]: https connected remote server from 192.168.0.24:1410 2007.11.19 08:26:32 LOG7[1596:2576]: Remote FD=260 initialized 2007.11.19 08:26:32 LOG7[1596:2576]: TCP_NODELAY option set on remote socket 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): before/connect initialization 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 write client hello A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 read server hello A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 read server certificate A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 read server done A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 write client key exchange A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 write change cipher spec A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 write finished A 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 flush data 2007.11.19 08:26:32 LOG7[1596:2576]: SSL state (connect): SSLv3 read finished A 2007.11.19 08:26:32 LOG7[1596:2576]: 1 items in the session cache 2007.11.19 08:26:32 LOG7[1596:2576]: 1 client connects (SSL_connect()) 2007.11.19 08:26:32 LOG7[1596:2576]: 1 client connects that finished 2007.11.19 08:26:32 LOG7[1596:2576]: 0 client renegotiations requested 2007.11.19 08:26:32 LOG7[1596:2576]: 0 server connects (SSL_accept()) 2007.11.19 08:26:32 LOG7[1596:2576]: 0 server connects that finished 2007.11.19 08:26:32 LOG7[1596:2576]: 0 server renegotiations requested 2007.11.19 08:26:32 LOG7[1596:2576]: 0 session cache hits 2007.11.19 08:26:32 LOG7[1596:2576]: 0 session cache misses 2007.11.19 08:26:32 LOG7[1596:2576]: 0 session cache timeouts 2007.11.19 08:26:32 LOG6[1596:2576]: SSL connected: new session negotiated 2007.11.19 08:26:32 LOG6[1596:2576]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2007.11.19 08:26:53 LOG7[1596:3012]: https accepted FD=288 from 127.0.0.1:1411 2007.11.19 08:26:53 LOG7[1596:3012]: Creating a new thread 2007.11.19 08:26:53 LOG7[1596:3012]: New thread created 2007.11.19 08:26:53 LOG7[1596:1060]: https started 2007.11.19 08:26:53 LOG7[1596:1060]: FD 288 in non-blocking mode 2007.11.19 08:26:53 LOG7[1596:1060]: TCP_NODELAY option set on local socket 2007.11.19 08:26:53 LOG5[1596:1060]: https accepted connection from 127.0.0.1:1411 2007.11.19 08:26:53 LOG7[1596:1060]: FD 312 in non-blocking mode 2007.11.19 08:26:53 LOG7[1596:1060]: https connecting 192.168.0.5:443 2007.11.19 08:26:53 LOG7[1596:1060]: connect_wait: waiting 10 seconds 2007.11.19 08:26:53 LOG7[1596:1060]: connect_wait: connected 2007.11.19 08:26:53 LOG5[1596:1060]: https connected remote server from 192.168.0.24:1412 2007.11.19 08:26:53 LOG7[1596:1060]: Remote FD=312 initialized 2007.11.19 08:26:53 LOG7[1596:1060]: TCP_NODELAY option set on remote socket 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): before/connect initialization 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 write client hello A 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 read server hello A 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 read finished A 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 write change cipher spec A 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 write finished A 2007.11.19 08:26:53 LOG7[1596:1060]: SSL state (connect): SSLv3 flush data 2007.11.19 08:26:53 LOG7[1596:1060]: 1 items in the session cache 2007.11.19 08:26:53 LOG7[1596:1060]: 2 client connects (SSL_connect()) 2007.11.19 08:26:53 LOG7[1596:1060]: 2 client connects that finished 2007.11.19 08:26:53 LOG7[1596:1060]: 0 client renegotiations requested 2007.11.19 08:26:53 LOG7[1596:1060]: 0 server connects (SSL_accept()) 2007.11.19 08:26:53 LOG7[1596:1060]: 0 server connects that finished 2007.11.19 08:26:53 LOG7[1596:1060]: 0 server renegotiations requested 2007.11.19 08:26:53 LOG7[1596:1060]: 1 session cache hits 2007.11.19 08:26:53 LOG7[1596:1060]: 0 session cache misses 2007.11.19 08:26:53 LOG7[1596:1060]: 0 session cache timeouts 2007.11.19 08:26:53 LOG6[1596:1060]: SSL connected: previous session reused 2007.11.19 08:26:53 LOG7[1596:1060]: SSL socket closed on SSL_read 2007.11.19 08:26:53 LOG7[1596:1060]: Socket write shutdown 2007.11.19 08:26:53 LOG5[1596:1060]: Connection closed: 70 bytes sent to SSL, 164 bytes sent to socket 2007.11.19 08:26:53 LOG7[1596:1060]: https finished (1 left) 2007.11.19 08:27:53 LOG3[1596:2576]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2007.11.19 08:27:53 LOG5[1596:2576]: Connection reset: 1102 bytes sent to SSL, 1241 bytes sent to socket 2007.11.19 08:27:53 LOG7[1596:2576]: https finished (0 left) Does this make any sense to you???? Dan _____ From: Craig Sent: Mon 19/11/2007 1:34 AM To: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Stunnel and Outlook Web Access Problems OWA rewrites the URL when you log in and I have found that it causes problems when doing that with a Stunnel connection. What I think might be happening is that your initial connection says http://server.tld/ then when you log in OWA rewrites the URL to https://server.tld/ What I think is happening is that your stunnel is listening on port 80 and when you log in, OWA changes the listening port in the browser to port 443. Try running the listening server (stunnel server) to listen on port 443 instead of port 80 and see if that fixes the problem. Cheers Craig From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Dan Vespa Sent: 17 November 2007 07:21 PM To: stunnel-users(a)mirt.net Subject: [stunnel-users] Stunnel and Outlook Web Access Problems I am trying to use the latest version of stunnel to connect to OWA. I set stunnel to listen on port 80 (localhost) and then connect to myserverip on port 443. I get the login screen but can go no further after I Enter my credentials and Click OK. Checking the stunnel log screen it shows that a connect has been made? I don't understand why It won't connect any further?? OWA is on Exchange Server 2003 and I am using Windows XP SP2. I have also updated to Open SSL latest version. Thanks in Advance. Dan

1 0

Stunnel and Outlook Web Access Problems
by Dan Vespa 19 Nov '07

19 Nov '07

I am trying to use the latest version of stunnel to connect to OWA. I set stunnel to listen on port 80 (localhost) and then connect to myserverip on port 443. I get the login screen but can go no further after I Enter my credentials and Click OK. Checking the stunnel log screen it shows that a connect has been made? I don't understand why It won't connect any further?? OWA is on Exchange Server 2003 and I am using Windows XP SP2. I have also updated to Open SSL latest version. Thanks in Advance. Dan

2 1

NFS over stunnel
by Andy Wettstein 19 Nov '07

19 Nov '07

Hi, I wrote a document about how I am running NFS over stunnel. Using some firewall rules I was able to eliminate most of the complications for using secure NFS. It could probably use more detailed explanations, but the scripts I am using are all there. It still kind of in test phase, but I am currently mounting my home directory using stunnel. I haven't really noticed much of a speed problem in day to day activities. https://w3.physics.uiuc.edu/physwiki/doku.php?id=pcs:unix:nfs_over_stunnel Please send any questions you might have. -- andy wettstein unix administrator department of physics university of illinois at urbana-champaign

2 2

receive error
by Protect Girl 14 Nov '07

14 Nov '07

Hi When run stunnel.exe, I was receive "the procedure entry point SSL_CTX_xet_info_callback could not be located in the dynamic library libssl32.dll" error.

2 1

can't get client address
by Draeath Spamtrap 14 Nov '07

14 Nov '07

Stunnel appears to be working fine, but when started it spams my syslog about 5 times with the following message: "stunnel: warning: can't get client address: Bad file descriptor" There are no other messages from stunnel. I'm not sure where it's coming from... It looks like it is running without command line arguments. My init script has the following snippets that make me think that: > PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin > PREFIX=/usr/local > DAEMON=/usr/local/bin/stunnel > PIDFILE=/var/lib/stunnel/stunnel.pid > > test -f $DAEMON || exit 0 > > case "$1" in > start) > echo -n "Starting universal SSL tunnel: stunnel" > $DAEMON || echo -n " failed" > echo "." > ;; > {TRIMMED REST OF FILE} My stunnel version info: > stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.8e 23 Feb 2007 > Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP > > Global options > debug = 5 > pid = /usr/local/var/run/stunnel/stunnel.pid > RNDbytes = 64 > RNDfile = /dev/urandom > RNDoverwrite = yes > Service-level options > cert = /usr/local/etc/stunnel/stunnel.pem > ciphers = ALL:!ADH:+RC4:@STRENGTH > key = /usr/local/etc/stunnel/stunnel.pem > session = 300 seconds > sslVersion = SSLv3 for client, all for server > TIMEOUTbusy = 300 seconds > TIMEOUTclose = 60 seconds > TIMEOUTconnect = 10 seconds > TIMEOUTidle = 43200 seconds > verify = none My stunnel config file: > cert = /usr/local/etc/stunnel/stunnel.pem > key = /usr/local/etc/stunnel/stunnel.pem > sslVersion = SSLv3 > chroot = /var/lib/stunnel/ > setuid = 99 > setgid = 99 > pid = /stunnel.pid > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > client = yes > [nntps] > accept = 127.0.0.1:119 > connect = secure.news.easynews.com:563 Again, it is all working, and aside from my TCP_NODELAY flags, everything in my conf would be a show-stopper if it was invalid or not working... *of note: I had to set the uid/gid number. for some reason it couldn't resolve the gid/uid on it's own. My /etc/passwd is world-readable (with hashes in shadow) as is standard. I'm not sure I should even be worried about this...

2 2

Reporting bugs in stunnel 4.21
by Michal Trojnara 10 Nov '07

10 Nov '07

Dear Users, Please test the new stunnel 4.21 and report your issues on the Bug Tracking System (http://stunnel.mirt.net/bts.html) or email the information to the stunnel-users mailing list. This is the easiest way to help stunnel working fine on your various systems. I was developing it for quite a long time and I likely failed to fix all the bugs. I'm especially interested in all compilation or runtime issues with the new FIPS and libwrap code. By the time you can find a patch for setuid/setgid+chroot problem here: ftp://stunnel.mirt.net/stunnel/setuid.patch Best regards, Mike

2 2