- stunnel-users - stunnel.org

stunnel hanging during negotation with an smtp server
by Jason J. Corso 31 Jul '07

31 Jul '07

Please help: I'm trying to use stunnel to connect to a secure SMTP server -- I'm using MS Entourage 2004 on an Intel 10.4 Mac. Entourage cannot connect directly to the SMTP server over SSL because it no longer supports NTLM version 1 authentication, which the SMTP server uses. I believe stunnel can be used to workaround this problem (if I'm wrong, please say so), i.e., Entourage can connect locally to stunnel which will then connect to the remote server over SSL properly. I built and installed stunnel version 4.04-12 via Fink (compiled from source via Fink) and OpenSSL 0.9.7i-4 also via Fink. I have the following configuration file: ------ # Comment it out on Win32 cert = /sw/etc/stunnel/stunnel.pem chroot = /sw/var/run/stunnel/ # PID is created inside chroot jail pid = /stunnel.pid setuid = nobody setgid = nogroup # Some debugging stuff debug = 7 output = /dev/stdout foreground = yes [ssmtp] accept = 127.0.0.1:25 connect = xxxxxx:465 protocol = smtp ------- However, when I try to send a mail, it appears to hang while negotiating with the remote server. Here is the output: 2007.07.31 15:41:19 LOG5[5511:2684407808]: stunnel 4.04 on i386-apple-darwin8.10.1 PTHREAD+LIBWRAP with OpenSSL 0.9.7i 14 Oct 2005 2007.07.31 15:41:19 LOG7[5511:2684407808]: Snagged 64 random bytes from xxx/.rnd 2007.07.31 15:41:19 LOG7[5511:2684407808]: Wrote 1024 new random bytes to xxx/.rnd 2007.07.31 15:41:19 LOG7[5511:2684407808]: RAND_status claims sufficient entropy for the PRNG 2007.07.31 15:41:19 LOG6[5511:2684407808]: PRNG seeded successfully 2007.07.31 15:41:19 LOG7[5511:2684407808]: Certificate: /sw/etc/stunnel/stunnel.pem 2007.07.31 15:41:19 LOG7[5511:2684407808]: Key file: /sw/etc/stunnel/stunnel.pem 2007.07.31 15:41:19 LOG5[5511:2684407808]: FD_SETSIZE=1024, file ulimit=256 -> 125 clients allowed 2007.07.31 15:41:19 LOG7[5511:2684407808]: FD 6 in non-blocking mode 2007.07.31 15:41:19 LOG7[5511:2684407808]: SO_REUSEADDR option set on accept socket 2007.07.31 15:41:19 LOG7[5511:2684407808]: ssmtp bound to 127.0.0.1:25 2007.07.31 15:41:19 LOG7[5511:2684407808]: FD 7 in non-blocking mode 2007.07.31 15:41:19 LOG7[5511:2684407808]: FD 8 in non-blocking mode 2007.07.31 15:41:19 LOG7[5511:2684407808]: Created pid file /stunnel.pid 2007.07.31 15:41:25 LOG7[5511:2684407808]: ssmtp accepted FD=9 from 127.0.0.1:50091 2007.07.31 15:41:25 LOG7[5511:2684407808]: FD 9 in non-blocking mode 2007.07.31 15:41:25 LOG7[5511:25183744]: ssmtp started 2007.07.31 15:41:25 LOG5[5511:25183744]: ssmtp connected from 127.0.0.1:50091 2007.07.31 15:41:25 LOG7[5511:25183744]: FD 10 in non-blocking mode 2007.07.31 15:41:25 LOG7[5511:25183744]: ssmtp connecting xxx.xxx.xxx.xxx:465 2007.07.31 15:41:25 LOG7[5511:25183744]: remote connect #1: EINPROGRESS: retrying 2007.07.31 15:41:25 LOG7[5511:25183744]: waitforsocket: FD=10, DIR=write 2007.07.31 15:41:25 LOG7[5511:25183744]: waitforsocket: ok 2007.07.31 15:41:25 LOG7[5511:25183744]: Remote FD=10 initialized 2007.07.31 15:41:25 LOG7[5511:25183744]: Negotiations for smtp(server side) started 2007.07.31 15:41:25 LOG7[5511:25183744]: RFC 2487 detected 2007.07.31 15:41:25 LOG7[5511:25183744]: waitforsocket: FD=10, DIR=read ********* HANGS HERE *********** ...and I have to kill it. I am very new to stunnel and openssl. So, I may be making a simple mistake. But, I could not find the solution on the mailing list or the web. What am I doing wrong? To be clear, the server is using SSL for SMTP. I am able to send mail directly via the smtp server from other mail clients like Thunderbird. Thanks. Any help is much appreciated. Jason

1 0

Re: [stunnel-users] Stunnel Scalability Question
by Ankur Upadhyaya 30 Jul '07

30 Jul '07

Hi Michal, Thank you for your help with this. My stunnel -version output can be found below. Ankur stunnel 4.20 on i686-pc-linux-gnu with OpenSSL 0.9.8b 04 May 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none

2 1

Stunnel on Freebsd not running
by The Volo 30 Jul '07

30 Jul '07

i recently installed the latest stable version 4.20 on a shell running freebsd, i dont have root i had to install it on my account. Compile was successfull, i renamed the default stunnel.conf.. and edited it, i am running stunnel as a client and added this line at the end of stunnel.conf: [eggdrop] accept = 127.0.0.1:12345 connect = irc.efnet.net:6667 when i run stunnel it doesnt do nothing besides sending me to a new bash command line.. [volo@partyline (~/)]$ /home/volo/stunnel/sbin/stunnel /home/volo/stunnel/etc/stunnel/stunnel.conf [volo@partyline (~/)]$ I type ps -x to see if stunnel is running but i dont see it on the list and no pid file exist either. Any ideas on how i can fix this ? i dont see what i am doing wrong trying to run stunnel.. Trying to run stunnel to connect to irc and my eggdrop to connect to stunnel access ip:port thanks

2 1

Automatically Stopping Stunnel
by Brian Mander 19 Jul '07

19 Jul '07

We have stunnel configured to accept connections on a port from an outside company and forward it to a port where we have a tcplistener set up. The problem is that if our tcplistener goes down the company sending us info does not have their software configured to know if we get their info or not. Is there a way to stop allowing connections or shut stunnel down if it can not connect to the port. I hope this is enough information. Brian Mander Programmer Analyst II Omni Hotels (402) 952-6564 bmander(a)omnihotels.com <mailto:[email protected]> Learn more about Omni Hotels sensational summer vacation packages <http://www.omnihotels.com/exclusiveoffers/summer07.aspx> ideal for exploring great destinations with family and friends.

1 0

Stunnel Scalability Question
by Ankur Upadhyaya 18 Jul '07

18 Jul '07

Hi, I have an application with the following characteristics and am trying to determine if Stunnel would be a suitable option for securing my transmissions (in particular, will it scale): - Each of my clients is connected to the Internet via a 56Kbps modem. My server has whatever bandwidth it needs. - Each client "transaction" consists of (a) connecting to a central server using a TCP/IP-based protocol, (b) uploading a 512KB block of data and (c) disconnecting. - Our server needs to be able to handle 2000 concurrent clients under peak loads. - Under the peak load above, I would like to limit the time a client takes to perform a "transaction" to around five minutes or so (uploading 512KB at (56Kbps / 2) = 28Kbps should take ~2.5 minutes). My questions are: (1) Do I have any reason to believe that Stunnel will simply not be able to scale to handle the load described above (i.e. a steady load of 2000 concurrent clients connecting, uploading half a megabyte of data and disconnecting)? (2) If Stunnel can handle this - do you have any thoughts on what sort of machine (or machines) I should be running my server-side Stunnel daemon(s) on? I am particularly concerned about CPU usage. I apologize in advance for any overlap between this query and past threads in the archive/information on the website - I wanted to make sure that I ran the specific requirements above past somebody with experience using Stunnel. Thanks, Ankur

1 0

bind error
by ictforever 07 Jul '07

07 Jul '07

Hi,I use stunnel 4.20 with syslog-ng 2.0,os is centos 5.0.but there are bind errors: ........................... 2007.06.22 05:56:36 LOG7[2898:3086632640]: SO_REUSEADDR option set on accept socket 2007.06.22 05:56:36 LOG3[2898:3086632640]: Error binding 5141 to 192.168.0.1:5141 2007.06.22 05:56:36 LOG3[2898:3086632640]: bind: Cannot assign requested address (99) The stunnel conf : ............................ cert = /usr/local/stunnel/etc/stunnel/syslog-ng-server.pem CAfile = /usr/local/stunnel/etc/stunnel/syslog-ng-client.pem [5141] accept = 192.168.0.1:5141 connect = 127.0.0.1:514 How to correct it?Any suggestion and advice are appreciated. Thanks. Regards.

3 2

stunnel on windows 2003
by John M. Andre 06 Jul '07

06 Jul '07

I've looked around the site, through the help file, and through the archives but I still can't find the answer to my question. I hope someone on this list can give me some insight. I am new to SSL but I have a brand new server and I'm trying to set it up to use stunnel to secure communications over POP, IMAP, SMTP, etc. However, as I look through the documentation, it is clearly written for unix admins. Is there anything that will guide someone how to setup stunnel on windows? Ideally a step-by-step but anything would be nice. Thanks, John

1 0

Out-of-band data
by Richard's Hotmail 03 Jul '07

03 Jul '07

Hi, In the Stunnel FAQ (see snippet below) it says that STUNNEL does not support OOB processing (except if OOB is set to in-line); can someone please tell me if this restriction is still in place? Does OpenSSL not support the sending and receiving of the OOB character? Some other restriction? Cheers Richard Maher Can I use stunnel to protect [insert random protocol here]? Stunnel should be able to secure any random protocol as long as the protocol satisfies the following requirements: 1.. The protocol is TCP, not UDP. 2.. The protocol doesn't use multiple connections, like ftp. 3.. The protocol doesn't depend on Out Of Band (OOB) data, 4.. Remote site can't use an application-specific protocol, like ssltelnet, where SSL is a negotiated option, save for those protocols already supported by the -n argument to Stunnel.

1 0

HTTPS Connect patches for 4.20
by Gym Crazy 02 Jul '07

02 Jul '07

Hi Folks Wonder if you can help me. A predecessor of mine set up stunnel version 4.05 on OpenBSD 3.8. He didn't leave much documentation unfortunately. He also used a patch and re-compiled it. That patch was connect-proxy.mwald.patch. We are getting some performance issues and want to of course move to the latest stable stunnel release 4.20, before asking for any help but we are in a bit of a bind. We are firstly not sure if there is an updated connect-proxy.mwald.patch that works well with stunnel 4.20 (I have searched and searched but can't seem to find any). Or else if there is a patch that performs the same type of function as connect-proxy.mwald.patch but that is stable to use with stunnel 4.20. Any help would be greatly appreciated :-D Regards Paul H ____________________________________________________________________________________ Luggage? GPS? Comic books? Check out fitting gifts for grads at Yahoo! Search http://search.yahoo.com/search?fr=oni_on_mail&p=graduation+gifts&cs=bz

1 0

Re: [stunnel-users] Certificates and public/private keys
by Dario Teixeira 28 Jun '07

28 Jun '07

> Should you not be looking at > http://httpd.apache.org/docs/2.0/ssl/ssl_howto.html > and > https://www.opensc-project.org/files/doc/apache-client-authentication(v0 > .5.1).pdf Hi, Thanks for the reply! I didn't mention it before, but I won't be using Apache or any other mainstream webserver. Most likely I will be using Ocsigen (http://www.ocsigen.org/). Now, the latest development release of Ocsigen already has basic support for SSL, but it can't handle yet client authentication. In short, I am still looking for an stunnel-based solution. Any ideas? Thanks again for your time and attention! Cheers, Dario ___________________________________________________________ Yahoo! Answers - Got a question? Someone out there knows the answer. Try it now. http://uk.answers.yahoo.com/

2 1

HTTPS Connect patches for 4.20
by Gym Crazy 28 Jun '07

28 Jun '07

Hi Folks Wonder if you can help me. A predecessor of mine set up stunnel version 4.05 on OpenBSD 3.8. He didn't leave much documentation unfortunately. He also used a patch and re-compiled it. That patch was connect-proxy.mwald.patch. We are getting some performance issues and want to of course move to the latest stable stunnel release 4.20, before asking for any help but we are in a bit of a bind. We are firstly not sure if there is an updated connect-proxy.mwald.patch that works well with stunnel 4.20 (I have searched and searched but can't seem to find any). Or else if there is a patch that performs the same type of function as connect-proxy.mwald.patch but that is stable to use with stunnel 4.20. Any help would be greatly appreciated :-D Regards Paul H ____________________________________________________________________________________ Looking for a deal? Find great prices on flights and hotels with Yahoo! FareChase. http://farechase.yahoo.com/

1 0

Certificates and public/private keys
by Dario Teixeira 26 Jun '07

26 Jun '07

Dear Stunnel users, I have a webserver running on a machine behind a firewall. I can easily punch a hole on the firewall, allowing any user on the Internet to access the webserver. However, I want to restrict access *only* to some people, those in possession of a secret key. At first sight, this seems like a job for plain ssh tunneling rather than stunnel, but as far as I understand it, ssh tunnels require that the connecting users have an account on the server machine. That won't happen here. It seems that stunnel is therefore more appropriate for this particular problem. Now, the port forwarding mechanics seem similar to those in ssh. I have no problems understanding those. The only problems I am having are figuring out the generation of keys. My excuses if I am using a terminology based on ssh or if I am way off about the capabilities of stunnel, but how can I generate the server's private and public keys? (the latter to be handed out to the clients) I have followed the instructions in the README.Debian file that accompanies the Debian stunnel4 package to produce a stunnel.pem certificate. With it, I have successfully established a stunnel connection between two machines. However, I have to use the same stunnel.pem file on both the client and the server, which strikes me as dangerous. Which parts are really needed on the client and server? Thanks in advance for your help! Cheers, Dario ___________________________________________________________ Yahoo! Answers - Got a question? Someone out there knows the answer. Try it now. http://uk.answers.yahoo.com/

2 1

Preferred way to start stunnel @boot time
by Van 26 Jun '07

26 Jun '07

So I've got stunnel running perfectly on my linux server to forward ssl requests to my pop and imap ports. I need to make sure this happens automatically if the machine is rebooted. On the stunnel site it talks about running stunnel either as a daemon or running stunnel out of xinetd. I was just wondering, which way do people using it out there think is preferable? And why? Neither seems as direct or simple as putting @reboot root /sbin/start_stunnel into my crontab, which is what I did (start_stunnel being a shell script with the proper command and some comments). Just another uneventful way to do the same thing? -Van

2 1

Java Applet Client for STUNNEL-fronted server
by Richard's Hotmail 21 Jun '07

21 Jun '07

Hi, I'm new to the list and apologize if this question is inappropriate, or quite basic, but I really hope someone can help. I currently have an intranet-resident JAVA Applet that connects back to the Application Server via standard TCP/IP sockets using the java.net.Socket class, and everything is peachy. What I'm looking at doing now is making it Internet friendly by providing host authentication (don't care about client authentication at the mo) and strong cryptography between client and server. OpenSSL and Stunnel (I don't want to have to make the Application Server SSL compatible if I don't have to) are available on the server box therefore I would dearly love an example of a JAVA client that can talk javax.net.SSL (or something else) to a Stunnel-fronted server. (Less is definitely more here - The least number of client keys and or certificate-generations the better!) Can anyone please help me with this? Obviously example-code would be ideal, as would first-hand accounts of the trials and tribulations, but I'll certainly settle for web-references to the appropriate docs or other relevant material! Are all the JSSE libraries/code reqd bundled with the JDK and runtime JVM ready? Is there a better way? (Sadly IPsec is not an option here) Maybe there's an alternate solution that can preserve the client's true IP address and present it to the Application Server's "Listen"? Cheers Richard Maher

1 0

Re: [stunnel-users] Trying to get stunnel to work for forwarding pop3sto ipop3 port
by Van 21 Jun '07

21 Jun '07

Getting closer. I now get- [van@mailserver ]$ sudo stunnel /usr/local/etc/stunnel/stunnel.conf localhost:ipop3 2007.06.21 11:51:27 LOG4[15899:3086476992]: Wrong permissions on /usr/ local/etc/stunnel/mail.pem 2007.06.21 11:51:27 LOG4[15899:3086476992]: Wrong permissions on /usr/ local/etc/stunnel/mail.pem 2007.06.21 11:51:27 LOG4[15899:3086476992]: Wrong permissions on /usr/ local/etc/stunnel/mail.pem But that doesn't make sense to me. mail.pem permissions are the same as my cert's and it works fine. [van@mailserver change_passwd]$ ls -al /usr/local/etc/stunnel/mail.pem -rw-r--r-- 1 root root 2942 Jun 20 18:21 /usr/local/etc/stunnel/ mail.pem [van@mailserver change_passwd]$ ls -al /etc/httpd/certs/www.crt -rw-r--r-- 1 root root 1074 Jun 1 12:30 /etc/httpd/certs/www.crt Is the error misleading? Or what should the mail.pem perms be? Van On Jun 20, 2007, at 9:33 PM, Kevin Cook wrote: > > If you are using a stunnel.conf file, I would replace the '-d pop3s > -r' > with the absolute path to the .conf file: > > sudo /usr/local/sbin/stunnel /usr/local/etc/stunnel/stunnel.conf > > I believe command line options were typically used more in older > versions, but now all configuration is done in the configuration file. > > > Kevin > > -----Original Message----- > From: Van [mailto:[email protected]] > Sent: Wednesday, June 20, 2007 6:03 PM > To: stunnel-users(a)mirt.net > Subject: [stunnel-users] Trying to get stunnel to work for forwarding > pop3sto ipop3 port > > Hello, > > This is my introduction to stunnel. I've inherited control of a > pop3 and > imap server running Red Hat Linux 4 that I want to access via pop3s > and > imaps. I'm starting out with securing the pop3 since most users are > using it. > > I downloaded stunnel 4.20 and compiled it according to the > instructions > on stunnel.org. > > I read the certificates section of the site and made a new .pem file > that I named mail.pem and have in the /usr/local/etc/stunnel/ > directory > that /usr/local/etc/stunnel/stunnel.conf asks for. But when I try to > run stunnel like in the Examples section I get : > > [van@mailserver ~]$ sudo /usr/local/sbin/stunnel -d pop3s -r > localhost:ipop3 > 2007.06.20 17:59:54 LOG3[25516:3086419648]: -d: No such file or > directory (2) > Syntax: > stunnel [<filename>] ] -fd <n> | -help | -version | -sockets > <filename> - use specified config file instead of /usr/local/ > etc/stunnel/stunnel.conf > -fd <n> - read the config file from a file descriptor > -help - get config file help > -version - display version and defaults > -sockets - display default socket options > > I'm a little lost here. Never dealt with a .pem file before stunnel. > I have a self-signed cert I'm successfully using for https webmail on > the server and guessing stunnel couldn't see that, I appended my file > 'mailserver.crt' into my mail.pem file and edited stunnel.conf so it > has > > ;CAfile = /usr/local/etc/stunnel/certs.pem CAfile = > /usr/local/etc/stunnel/mail.pem > > but no dice. Same result. > > Trying to debug, I find 'stunnel -V' also gives the same result. > > Can someone point out what's going wrong? > > > -Van > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > >

2 2

Trying to get stunnel to work for forwarding pop3s to ipop3 port
by Van 20 Jun '07

20 Jun '07

Hello, This is my introduction to stunnel. I've inherited control of a pop3 and imap server running Red Hat Linux 4 that I want to access via pop3s and imaps. I'm starting out with securing the pop3 since most users are using it. I downloaded stunnel 4.20 and compiled it according to the instructions on stunnel.org. I read the certificates section of the site and made a new .pem file that I named mail.pem and have in the /usr/local/etc/stunnel/ directory that /usr/local/etc/stunnel/stunnel.conf asks for. But when I try to run stunnel like in the Examples section I get : [van@mailserver ~]$ sudo /usr/local/sbin/stunnel -d pop3s -r localhost:ipop3 2007.06.20 17:59:54 LOG3[25516:3086419648]: -d: No such file or directory (2) Syntax: stunnel [<filename>] ] -fd <n> | -help | -version | -sockets <filename> - use specified config file instead of /usr/local/ etc/stunnel/stunnel.conf -fd <n> - read the config file from a file descriptor -help - get config file help -version - display version and defaults -sockets - display default socket options I'm a little lost here. Never dealt with a .pem file before stunnel. I have a self-signed cert I'm successfully using for https webmail on the server and guessing stunnel couldn't see that, I appended my file 'mailserver.crt' into my mail.pem file and edited stunnel.conf so it has ;CAfile = /usr/local/etc/stunnel/certs.pem CAfile = /usr/local/etc/stunnel/mail.pem but no dice. Same result. Trying to debug, I find 'stunnel -V' also gives the same result. Can someone point out what's going wrong? -Van

1 0

stunnel client mode and CA chains
by Domenico Andreoli 13 Jun '07

13 Jun '07

Hi, I have always successfully used openssl/stunnel but now I am facing a new problem, a variation of the usual client-side authentication documentented everywhere. I have a root CA and child CA which is signed by the root one. I have also a client certificate that is signed only by the child CA. In order to verify the certificate signature using openssl I need to specify both the CA certificates, this works as expected. What I would like to achieve is to authenticate the clients using a stunnel server having only the root CA certificate. Is there some stunnel client configuration switch that allows to push the child CA certificate? One looking interesting is (from the manpage): cert = pemfile certificate chain PEM file name A PEM is always needed in server mode. Specifying this flag in client mode will use this certificate chain as a client side certificate chain. Using client side certs is optional. The certificates must be in PEM format and must be sorted starting with the certificate to the highest level (root CA). in particular "The certificates must be in PEM format and must be sorted starting with the certificate to the highest level (root CA)" lets me hope but I am not able to understand how it works. I made many tries but on server side I always get a "VERIFY ERROR: depth=1, error=invalid CA certificate:" referring to the child CA certificate and then a "SSL3_GET_CLIENT_CERTIFICATE:no certificate returned" followed by connection shutdown. Supposing the client private key is in a separate file, if I put the certificates in the order specified by the manpage I get a key mismatching error upon stunnel startup. If instead I put the client certificate as first, then server do not authenticate it. Where am I wrong? I cannot change the server configuration, it must work as it is. I have hundreds of them and I can update them only using the SSL connection. Thanks for any help. Regards, Domenico -----[ Domenico Andreoli, aka cavok --[ http://www.dandreoli.com/gpgkey.asc ---[ 3A0F 2F80 F79C 678A 8936 4FEE 0677 9033 A20E BC50

1 0

Issue with Stunnel / TCP Wrappers
by Kevin Cook 11 Jun '07

11 Jun '07

I have been a user of Stunnel for several years, but as of recent need to be able to deny TCP/IP requests dynamically on an IP address basis. I am attempting to use TCP wrappers, but not getting it to work with Stunnel. The Solaris 9 implementation I am using currently runs in a chroot'ed environment, so I am placing the hosts.deny file in this path (/chrootpath/etc/hosts.deny), as well as /usr/etc per everything I have read. This is not working. I am using a non-standard port not defined in /etc/services (29444). Any ideas?

1 0

stunnel autostart at boot
by Grant Kohler 11 Jun '07

11 Jun '07

Has anybody created a startup script to load stunnel when a machine boots? Thanks, -Grant

1 0

Re: [stunnel-users] [PATCH?] Senting a list of accepted CAs to the client
by Kevin Martin 07 Jun '07

07 Jun '07

Has anyone any information on this? It affects the ability of Thunderbird users (in this case) to use secure communications with IMAP mail servers using TLS/SSL. Please see the bugzillas below. Thanks. Kevin Martin https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=237962 and list posting from 4/2007: Hello, stunnel currently does not send a list of accepted CAs, see e.g. https://bugzilla.mozilla.org/show_bug.cgi?id=327001 Sending the list was #if 0-ed out sometime between stunnel 3.22 and 4.00, with no change log entry AFAICS. Does anyone remember know why was it disabled, and whether it is safe to reenable (e. g. using the attached patch)? Thanks, Mirek <patch snipped>...see the list posting from 4/2007 above for the attached patch.

1 0

regarding CRLpath
by piyush tewari 07 Jun '07

07 Jun '07

Hi, I m using crl but it is woking only in the case of using CRLfile. That is when I use the CRLfile , the client having the revoked certificate is now not able to connect to the server. But when I m providing the CRLpath in the stunnel config file , the client is still able to connect. That is CRL is working in the case of CRLfile entry and not working in the case of CRLpath. The entry that i have specified is CRLpath = C:\Stunnel\debug\revoked So where is the flaw. I know that in case of the CRLfile , it is necessary to restart the stunnel , whenever the CRL changes. But in case of CRLpath , whether it is necessary to restart the stunnel or not. regards piyush --------------------------------- You snooze, you lose. Get messages ASAP with AutoCheck in the all-new Yahoo! Mail Beta.

1 0

Problem with 'verify=3'
by Koenraad Lelong 05 Jun '07

05 Jun '07

Hi, I would like to have a secure access to a Firebird database server. When I configure verify = 2 on the server I can connect, but I would like to have verify = 3 and this does not work. This is my stunnel.conf : client = no foreground = yes setuid = stunnel setgid = nogroup pid = /var/run/stunnel.pid debug = 7 output = /var/log/stunnel.log socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 3 CApath = /etc/stunnel/certs/ CAfile = /etc/stunnel/cacert.pem cert = /etc/stunnel/server.pem [firebird] accept = 3052 connect = localhost:gds_db output of stunnel -version : stunnel 4.14 on i686-suse-linux-gnu PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 Global options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /etc/stunnel/stunnel.pem pid = /var/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds I'm running OpenSuse 10.1 on the server. This is the log when I can't connect (verify = 3) : 2007.06.05 13:18:55 LOG5[15150:3083052720]: stunnel 4.14 on i686-suse-linux-gnu PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 2007.06.05 13:18:55 LOG7[15150:3083052720]: Snagged 64 random bytes from /root/.rnd 2007.06.05 13:18:55 LOG7[15150:3083052720]: Wrote 1024 new random bytes to /root/.rnd 2007.06.05 13:18:55 LOG7[15150:3083052720]: RAND_status claims sufficient entropy for the PRNG 2007.06.05 13:18:55 LOG6[15150:3083052720]: PRNG seeded successfully 2007.06.05 13:18:55 LOG7[15150:3083052720]: Certificate: /etc/stunnel/server.pem 2007.06.05 13:18:55 LOG7[15150:3083052720]: Key file: /etc/stunnel/server.pem 2007.06.05 13:18:55 LOG7[15150:3083052720]: Loaded verify certificates from /etc/stunnel/cacert.pem 2007.06.05 13:18:55 LOG7[15150:3083052720]: Verify directory set to /etc/stunnel/certs/ 2007.06.05 13:18:55 LOG5[15150:3083052720]: Peer certificate location /etc/stunnel/certs/ 2007.06.05 13:18:55 LOG6[15150:3083052720]: file ulimit = 1024 (can be changed with 'ulimit -n') 2007.06.05 13:18:55 LOG6[15150:3083052720]: poll() used - no FD_SETSIZE limit for file descriptors 2007.06.05 13:18:55 LOG5[15150:3083052720]: 500 clients allowed 2007.06.05 13:18:55 LOG7[15150:3083052720]: FD 5 in non-blocking mode 2007.06.05 13:18:55 LOG7[15150:3083052720]: FD 6 in non-blocking mode 2007.06.05 13:18:55 LOG7[15150:3083052720]: FD 7 in non-blocking mode 2007.06.05 13:18:55 LOG7[15150:3083052720]: SO_REUSEADDR option set on accept socket 2007.06.05 13:18:55 LOG7[15150:3083052720]: firebird bound to 0.0.0.0:3052 2007.06.05 13:18:55 LOG7[15150:3083052720]: Created pid file /var/run/stunnel.pid 2007.06.05 13:19:02 LOG7[15150:3083052720]: firebird accepted FD=8 from 192.168.0.13:25651 2007.06.05 13:19:02 LOG7[15150:3083049888]: firebird started 2007.06.05 13:19:02 LOG7[15150:3083049888]: FD 8 in non-blocking mode 2007.06.05 13:19:02 LOG7[15150:3083049888]: TCP_NODELAY option set on local socket 2007.06.05 13:19:02 LOG7[15150:3083049888]: FD 9 in non-blocking mode 2007.06.05 13:19:02 LOG7[15150:3083049888]: FD 11 in non-blocking mode 2007.06.05 13:19:02 LOG7[15150:3083052720]: Cleaning up the signal pipe 2007.06.05 13:19:02 LOG6[15150:3083052720]: Child process 15152 finished with code 0 2007.06.05 13:19:02 LOG7[15150:3083049888]: Connection from 192.168.0.13:25651 permitted by libwrap 2007.06.05 13:19:02 LOG5[15150:3083049888]: firebird connected from 192.168.0.13:25651 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): before/accept initialization 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 read client hello A 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write server hello A 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write certificate A 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write certificate request A 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 flush data 2007.06.05 13:19:02 LOG5[15150:3083049888]: VERIFY OK: depth=1, /C=BE/ST=Vlaams Brabant/L=Diest/O=ACE electronics n.v./OU=IT/CN=Certificate Authority/emailAddress=postmaster.ace-electronics.be 2007.06.05 13:19:02 LOG4[15150:3083049888]: VERIFY ERROR ONLY MY: no cert for /C=BE/ST=Vlaams Brabant/L=Diest/O=ACE electronics n.v./OU=IT/CN=client/emailAddress=postmaster.ace-electronics.be 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL alert (write): fatal: certificate unknown 2007.06.05 13:19:02 LOG3[15150:3083049888]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2007.06.05 13:19:02 LOG7[15150:3083049888]: firebird finished (0 left) 2007.06.05 13:19:04 LOG7[15150:3083052720]: firebird accepted FD=8 from 192.168.0.13:25653 2007.06.05 13:19:04 LOG7[15150:3083049888]: firebird started 2007.06.05 13:19:04 LOG7[15150:3083049888]: FD 8 in non-blocking mode 2007.06.05 13:19:04 LOG7[15150:3083049888]: TCP_NODELAY option set on local socket 2007.06.05 13:19:04 LOG7[15150:3083049888]: FD 9 in non-blocking mode 2007.06.05 13:19:04 LOG7[15150:3083049888]: FD 11 in non-blocking mode 2007.06.05 13:19:04 LOG7[15150:3083052720]: Cleaning up the signal pipe 2007.06.05 13:19:04 LOG6[15150:3083052720]: Child process 15154 finished with code 0 2007.06.05 13:19:04 LOG7[15150:3083049888]: Connection from 192.168.0.13:25653 permitted by libwrap 2007.06.05 13:19:04 LOG5[15150:3083049888]: firebird connected from 192.168.0.13:25653 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): before/accept initialization 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 read client hello A 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write server hello A 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write certificate A 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write certificate request A 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 flush data 2007.06.05 13:19:04 LOG5[15150:3083049888]: VERIFY OK: depth=1, /C=BE/ST=Vlaams Brabant/L=Diest/O=ACE electronics n.v./OU=IT/CN=Certificate Authority/emailAddress=postmaster.ace-electronics.be 2007.06.05 13:19:04 LOG4[15150:3083049888]: VERIFY ERROR ONLY MY: no cert for /C=BE/ST=Vlaams Brabant/L=Diest/O=ACE electronics n.v./OU=IT/CN=client/emailAddress=postmaster.ace-electronics.be 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL alert (write): fatal: certificate unknown 2007.06.05 13:19:04 LOG3[15150:3083049888]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2007.06.05 13:19:04 LOG7[15150:3083049888]: firebird finished (0 left) 2007.06.05 13:19:09 LOG3[15150:3083052720]: Received signal 2; terminating 2007.06.05 13:19:09 LOG7[15150:3083052720]: removing pid file /var/run/stunnel.pid I put the client cert in /etc/stunnel/certs and I ran 'c_rehash /etc/stunnel/certs'. What am I missing ? Thanks for any input. Regards, Koenraad Lelong.

1 0

Problem with verify = 3
by Koenraad Lelong 05 Jun '07

05 Jun '07

Hi, I would like to have a secure access to a Firebird database server. When I configure verify = 2 on the server I can connect, but I would like to have verify = 3 and this does not work. This is my stunnel.conf : client = no foreground = yes setuid = stunnel setgid = nogroup pid = /var/run/stunnel.pid debug = 7 output = /var/log/stunnel.log socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 3 CApath = /etc/stunnel/certs/ CAfile = /etc/stunnel/cacert.pem cert = /etc/stunnel/server.pem [firebird] accept = 3052 connect = localhost:gds_db output of stunnel -version : stunnel 4.14 on i686-suse-linux-gnu PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 Global options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /etc/stunnel/stunnel.pem pid = /var/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds I'm running OpenSuse 10.1 on the server. This is the log when I can't connect (verify = 3) : 2007.06.05 13:18:55 LOG5[15150:3083052720]: stunnel 4.14 on i686-suse-linux-gnu PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 2007.06.05 13:18:55 LOG7[15150:3083052720]: Snagged 64 random bytes from /root/.rnd 2007.06.05 13:18:55 LOG7[15150:3083052720]: Wrote 1024 new random bytes to /root/.rnd 2007.06.05 13:18:55 LOG7[15150:3083052720]: RAND_status claims sufficient entropy for the PRNG 2007.06.05 13:18:55 LOG6[15150:3083052720]: PRNG seeded successfully 2007.06.05 13:18:55 LOG7[15150:3083052720]: Certificate: /etc/stunnel/server.pem 2007.06.05 13:18:55 LOG7[15150:3083052720]: Key file: /etc/stunnel/server.pem 2007.06.05 13:18:55 LOG7[15150:3083052720]: Loaded verify certificates from /etc/stunnel/cacert.pem 2007.06.05 13:18:55 LOG7[15150:3083052720]: Verify directory set to /etc/stunnel/certs/ 2007.06.05 13:18:55 LOG5[15150:3083052720]: Peer certificate location /etc/stunnel/certs/ 2007.06.05 13:18:55 LOG6[15150:3083052720]: file ulimit = 1024 (can be changed with 'ulimit -n') 2007.06.05 13:18:55 LOG6[15150:3083052720]: poll() used - no FD_SETSIZE limit for file descriptors 2007.06.05 13:18:55 LOG5[15150:3083052720]: 500 clients allowed 2007.06.05 13:18:55 LOG7[15150:3083052720]: FD 5 in non-blocking mode 2007.06.05 13:18:55 LOG7[15150:3083052720]: FD 6 in non-blocking mode 2007.06.05 13:18:55 LOG7[15150:3083052720]: FD 7 in non-blocking mode 2007.06.05 13:18:55 LOG7[15150:3083052720]: SO_REUSEADDR option set on accept socket 2007.06.05 13:18:55 LOG7[15150:3083052720]: firebird bound to 0.0.0.0:3052 2007.06.05 13:18:55 LOG7[15150:3083052720]: Created pid file /var/run/stunnel.pid 2007.06.05 13:19:02 LOG7[15150:3083052720]: firebird accepted FD=8 from 192.168.0.13:25651 2007.06.05 13:19:02 LOG7[15150:3083049888]: firebird started 2007.06.05 13:19:02 LOG7[15150:3083049888]: FD 8 in non-blocking mode 2007.06.05 13:19:02 LOG7[15150:3083049888]: TCP_NODELAY option set on local socket 2007.06.05 13:19:02 LOG7[15150:3083049888]: FD 9 in non-blocking mode 2007.06.05 13:19:02 LOG7[15150:3083049888]: FD 11 in non-blocking mode 2007.06.05 13:19:02 LOG7[15150:3083052720]: Cleaning up the signal pipe 2007.06.05 13:19:02 LOG6[15150:3083052720]: Child process 15152 finished with code 0 2007.06.05 13:19:02 LOG7[15150:3083049888]: Connection from 192.168.0.13:25651 permitted by libwrap 2007.06.05 13:19:02 LOG5[15150:3083049888]: firebird connected from 192.168.0.13:25651 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): before/accept initialization 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 read client hello A 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write server hello A 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write certificate A 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write certificate request A 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 flush data 2007.06.05 13:19:02 LOG5[15150:3083049888]: VERIFY OK: depth=1, /C=BE/ST=Vlaams Brabant/L=Diest/O=ACE electronics n.v./OU=IT/CN=Certificate Authority/emailAddress=postmaster.ace-electronics.be 2007.06.05 13:19:02 LOG4[15150:3083049888]: VERIFY ERROR ONLY MY: no cert for /C=BE/ST=Vlaams Brabant/L=Diest/O=ACE electronics n.v./OU=IT/CN=client/emailAddress=postmaster.ace-electronics.be 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL alert (write): fatal: certificate unknown 2007.06.05 13:19:02 LOG3[15150:3083049888]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2007.06.05 13:19:02 LOG7[15150:3083049888]: firebird finished (0 left) 2007.06.05 13:19:04 LOG7[15150:3083052720]: firebird accepted FD=8 from 192.168.0.13:25653 2007.06.05 13:19:04 LOG7[15150:3083049888]: firebird started 2007.06.05 13:19:04 LOG7[15150:3083049888]: FD 8 in non-blocking mode 2007.06.05 13:19:04 LOG7[15150:3083049888]: TCP_NODELAY option set on local socket 2007.06.05 13:19:04 LOG7[15150:3083049888]: FD 9 in non-blocking mode 2007.06.05 13:19:04 LOG7[15150:3083049888]: FD 11 in non-blocking mode 2007.06.05 13:19:04 LOG7[15150:3083052720]: Cleaning up the signal pipe 2007.06.05 13:19:04 LOG6[15150:3083052720]: Child process 15154 finished with code 0 2007.06.05 13:19:04 LOG7[15150:3083049888]: Connection from 192.168.0.13:25653 permitted by libwrap 2007.06.05 13:19:04 LOG5[15150:3083049888]: firebird connected from 192.168.0.13:25653 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): before/accept initialization 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 read client hello A 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write server hello A 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write certificate A 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write certificate request A 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 flush data 2007.06.05 13:19:04 LOG5[15150:3083049888]: VERIFY OK: depth=1, /C=BE/ST=Vlaams Brabant/L=Diest/O=ACE electronics n.v./OU=IT/CN=Certificate Authority/emailAddress=postmaster.ace-electronics.be 2007.06.05 13:19:04 LOG4[15150:3083049888]: VERIFY ERROR ONLY MY: no cert for /C=BE/ST=Vlaams Brabant/L=Diest/O=ACE electronics n.v./OU=IT/CN=client/emailAddress=postmaster.ace-electronics.be 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL alert (write): fatal: certificate unknown 2007.06.05 13:19:04 LOG3[15150:3083049888]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2007.06.05 13:19:04 LOG7[15150:3083049888]: firebird finished (0 left) 2007.06.05 13:19:09 LOG3[15150:3083052720]: Received signal 2; terminating 2007.06.05 13:19:09 LOG7[15150:3083052720]: removing pid file /var/run/stunnel.pid I put the client cert in /etc/stunnel/certs and I ran 'c_rehash /etc/stunnel/certs'. What am I missing ? Thanks for any input. Regards, Koenraad Lelong.

1 0

certificate revocation
by piyush tewari 05 Jun '07

05 Jun '07

Hi , I am using Stunnel to protect one of my server. I am able to configure the stunnel properly with the help of stunnel. Now i am trying to use the revocation list concept in the stunnel. For using the stunnel revocation list i performed the following steps. 1. for generating the CRL file openssl ca -gencrl -keyfile ca_key -cert ca_crt -out my_crl.pem 2. for revoking the certificates openssl ca -revoke bad_crt_file -keyfile ca_key -cert ca_crt The entry specified in the stunnel.conf file is:- CRLfile = my_crl.pem Surprisingly the client is still able to connect to the server. Is it the problem in my configuration or it is a bug of stunnel. Regards, Piyush --------------------------------- Need a vacation? Get great deals to amazing places on Yahoo! Travel.

1 0

plz help me in debugging the code
by piyush tewari 04 Jun '07

04 Jun '07

Hello Friends, I am facing problems in debugging the source code of stunnel. the behaviour of the code is very unexpected for me. the return statement is not returning from the function. (Line 145 of gui.c file). Sameway when i debug line no 1266 of the options.c , that is "name=default_config_file;" , the df pointer gets it's value that means it is executing another line , line no 1305 of options.c itself "df=file_open(name, 0);". I am not getting this working of the stunnel code. And the other problem that i m facing is that during the debugging , many variables are not showing their occupied value. So please help me in understanding this working and resolving it. Thank you.. Regards Piyush --------------------------------- --------------------------------- Pinpoint customers who are looking for what you sell.

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users