stunnel-users

3 participants
3308 discussions

"application failed to initialize properly"
by Generic Poster 31 Jul '12

31 Jul '12

Hello Stunnel-users, Whenever I run Stunnel from a Windows 7 Virtual XP machine I receive the following error message: --------------------------- stunnel.exe - Application Error --------------------------- The application failed to initialize properly (0xc0150002). Click on OK to terminate the application. --------------------------- Any ideas as to what causes it or how I can get around the problem? The result is the same regardless of version. -- Best regards, Generic

2 1

Newbie: Success, now failure???
by Roger Bohl (Sr.) 25 Jul '12

25 Jul '12

For several days, I've been using Stunnel (with Blat) successfully (possibly with no intervening re-boots). A day or so ago, the system was re booted Today, however, Stunnel failed. I got the following Stunnel reply message: No limit detected for the number of clients stunnel 4.53 on x86-pc-mingw32-gnu platform Compiled/running with OpenSSL 0.9.8s-fips 4 Jan 2012 Threading:WIN32 SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:SELECT+IPv6 Reading configuration from file stunnel.conf FIPS mode is enabled Compression not enabled Snagged 64 random bytes from .rnd Wrote 1024 new random bytes to .rnd PRNG seeded successfully Initializing inetd mode configuration Certificate: client.pem Certificate loaded Key file: client.pem Private key loaded SSL options set: 0x00000004 Accept option is not allowed in inetd mode Remove accept option or define a [section] Server is down The stunnel.conf file in the Stunnel directory is: CAfile = cert.pem cert = client.pem client = yes RNDfile = .rnd [gmail smtp] ; (I may have had this in or out before. In "cleaning up" various files, I may have thought this to be a comment, and removed it.) accept = 25 connect = smtp.gmail.com:465 The program fails both with and without the [gmail smtp] line included. Except, possibly, for removing ;[comment] lines, no other changes occurred. Can somebody give me a clue as to the cause, and suggest the fix. I'm running Windows Vista. (I found the 17+ page instruction file, by Michal Trojnara, but didn't see a solution, there.) Thanks. Roger Bohl rhbohl(a)gmail.com 707-939-8459 PDT

1 0

please unsubscribe my email - thx
by Rüdiger Konte 24 Jul '12

24 Jul '12

1 0

stunnel and http
by John 22 Jul '12

22 Jul '12

I am running the latest stunnel for Windows on 64-bit Win7 as an application, not as a service. I simply unzipped everything to one folder, configured the "stunnel.conf" file; and when I need to run the program, I can open a command prompt in its folder and type "stunnel stunnel.conf". It then reads my stunnel.conf file and works its magic. This works fine for capturing the data from those programs which I can configure to use localhost and a specific port because I can configure stunnel.conf with accept = ip.address:port Now I have a program that I want to use to download some text files from the internet using http or https. However, this program cannot be manually configured to make a connection with a certain IP and port. Instead, I have to give it an alias-like name, which it then maps to one of several different domain names, makes a DNS query for the IP and transmits to that address the instructions for downloading some text files. So, is it possible to have stunnel "capture" any and all http transports (port 80) or https transports (port 443) from a specific program, regardless of which IP that connection was destined for, so that I can then direct this data traffic from stunnel to socat or from stunnel to an http proxy which I can manually direct to a specific connection? Is this a kind of thing for which stunnel can be used? If so, where can I find the instructions for setting it up? Thanks.

2 2

Reboot Requires Manual: "service stunnel restart"
by John Vasko 21 Jul '12

21 Jul '12

On FreeBSD 9.0 stunnel 4.43 works fine after running "service stunnel restart", but stunnel fails loading on boot. My desired config includes: /usr/local/etc/stunnel/stunnel.conf -------------------------------------------- [attsmtp] client = yes verify = 0 accept = 2525 connect = smtp.att.yahoo.com:465 delay = yes Please advise. See below for messages after bootup: /var/run/stunnel/stunnel.log ------------------------------------ 2012.07.21 02:52:06 LOG7[1378:675300096]: No limit detected for the number of clients 2012.07.21 02:52:06 LOG7[1378:675300096]: signal_pipe: FD=3 allocated (non-blocking mode) 2012.07.21 02:52:06 LOG7[1378:675300096]: signal_pipe: FD=4 allocated (non-blocking mode) 2012.07.21 02:52:06 LOG5[1378:675300096]: stunnel 4.43 on i386-portbld-freebsd9.0 platform 2012.07.21 02:52:06 LOG5[1378:675300096]: Compiled/running with OpenSSL 1.0.0e 6 Sep 2011 2012.07.21 02:52:06 LOG5[1378:675300096]: Threading:PTHREAD SSL:ENGINE Auth:LIBWRAP Sockets:POLL,IPv6 2012.07.21 02:52:06 LOG5[1378:675300096]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf 2012.07.21 02:52:06 LOG7[1378:675300096]: Snagged 64 random bytes from //.rnd 2012.07.21 02:52:06 LOG7[1378:675300096]: Wrote 1024 new random bytes to //.rnd 2012.07.21 02:52:06 LOG7[1378:675300096]: PRNG seeded successfully 2012.07.21 02:52:08 LOG6[1378:675300096]: Initializing SSL context for service attsmtp 2012.07.21 02:52:08 LOG7[1378:675300096]: SSL options set: 0x00000004 2012.07.21 02:52:08 LOG6[1378:675300096]: SSL context initialized 2012.07.21 02:52:08 LOG5[1378:675300096]: Configuration successful 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=5 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=6 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=6 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=7 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=7 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=8 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=8 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=9 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=9 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=10 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: accept socket: FD=11 allocated (non-blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: Option SO_REUSEADDR set on accept socket 2012.07.21 02:52:08 LOG7[1378:675300096]: Service attsmtp bound to 0.0.0.0:2525 2012.07.21 02:52:08 LOG7[1378:675300096]: Service attsmtp opened FD=11 2012.07.21 02:52:08 LOG7[1378:675300096]: Created pid file /stunnel.pid 2012.07.21 02:52:15 LOG7[1378:675300096]: Dispatching signals from the signal pipe 2012.07.21 02:52:15 LOG3[1378:675300096]: Received signal 2; terminating 2012.07.21 02:52:15 LOG7[1378:675300096]: str_stats: 43 block(s), 3554 byte(s) 2012.07.21 02:52:15 LOG7[1378:675300096]: removing pid file /stunnel.pid

1 1

Re: [stunnel-users] Reverse tunnel with middle server
by Javier 19 Jul '12

19 Jul '12

[To the mailing list: Sorry for these non-english messages, I started, previously, a private communication to avoid it] On Thu, 19 Jul 2012 20:26:45 +0200 "Jorge A." <curruscataphractus(a)gmail.com> wrote: > Hola Javier, > > Igual no me he explicado bien. Lo que quiero es conectar dos > máquinas, una dentro de una NAT detrás de un router que no tiene > redirigidos los puertos a la máquina claro, pero que sí tiene > Internet y acceso a la máquina servidor. Esto me sigue sin quedar claro. Ya perdonarás. Una (Objetivo) está conectada a un router, que sirve internet a una red local, pero que no tiene redirigidos los puertos a la máquina que tiene el servidor http. Esta no tiene acceso a internet porque no se le ha configurado una puerta de enlace y además no la pueden alcanzar porque no hay puertos redirigidos hacia ella. Hasta ahí, todo bien ;) Lo que quería saber es si la máquina que hace de Servidor hacia internet está en la misma subred local o no que la máquina objetivo. El que la máquina objetivo vea al servidor no implica necesariamente que el servidor vea al objetivo. Además, si está conectada al mismo router, porque decías que era accesible desde internet. Lo que entiendo es que quieres redirigir el tráfico proveniente al servidor desde el exterior al objetivo http. Si el servidor, ve a la máquina http, bastaría con decir en la configuración de stunnel que conecte con el servidor http de esa maquina indicándole la ip:puerto. Por eso te dije que no tenía mayor complicación. En esa configuración no hace falta que la máquina objetivo tenga un servidor stunnel y viceversa para comunicarse entre ellos. La comunicación entre el servidor y la máquina objetivo puede ser abierta sin problemas. Lo importante ya existe, que el servidor haga de puente ssl entre internet y el objetivo http. > Durante el día de hoy lo he conseguido hacer más o menos usando > pppd y stunnel entre 2 linux pero no sé si sería posible hacerlo > sólo con stunnel (y *ifconfig*, *ip*, *route* o similares). Sobre > todo porque la máquina cliente objetivo está bastante limitada y no > puedo instalar de manera fácil pppd (tiene un kernel custom, hay > que compilar el módulo pppd del kernel, el demonio, etc). > > Lo que estoy mirando ahora es el comando *ip tunnel* para per si > puedo hacer algo parecido con pppd pero no sé si me estoy dando > golpes contra la pared. > > Muchas gracias de antemano por tu ayuda. De nada, aunque con Linux he topado. Conozco muy por encima los comandos. Pero, olvidándonos de las herramientas a utilizar, sabiendo exactamente el entorno en el que están esas máquinas, todo es coser y cantar, a no ser que sea un imposible ;) De ahí la importancia de saber si están en la misma red local o no, etc. Saludos.

1 1

Reverse tunnel with middle server
by Jorge A. 18 Jul '12

18 Jul '12

Hi everyone, I've search into archives trying to found a solution for my problem without success. The problem is simple: make a machine available on HTTP port when it's behind a e.g. common DSL. I have a middle server for which I have full access to install any program, linux. What I was trying to do is the following: Three machines: Middle server (Server), Target (linux machine behind DSL) and Client. Same stunnel version on both Server and Target. Latests. Server is available on the Internet, running stunnel Target is behind a nat router, e.g. inside a common DSL. I assume this must run stunnel as well. Client connects to Server and Server forwards traffic to Target seamlessly. As far as I know, running stunnel on client mode from e.g. Target and trying to connect to whichever service on Server does not work on reverse: you cannot connect backwards to target. Am I correct? If not, how do I configure both ends and how do I know port to use to connect to Target (log file?) ? What I've tested: 1. Run stunnel on Server on server mode accepting ('accept') connections on a fixed port, e.g. 5000. Here, as far as I know, you must define the 'connect' directive to forward traffic to either local or remote host. The problem is, from Server, you don't know Target ip nor it's accessible 2. Run stunnel on Server and, on Target launch stunnel on client mode to try Thanks in advance and congratulations as it's a great piece of software. Best regards, Jorge

1 0

Stunnel on WIndows Server 2008 R2 SP1 x 64 fails - Microsoft.VC90.CRT.MANIFEST
by Rüdiger Konte 15 Jul '12

15 Jul '12

Hi Stunnel users, I am trying to run stunnel "4.53 installer.exe" on a MS Windows Server 2008 R2 SP1 64 Bit (under VMWARE Workstation 6.5 as a virtual system; Physical Host OS is WIN7 Ultimate 32 BIT) The installation of stunnel was done as an "Administrator" and it ran through without issues. But I cannot se any service running. And when I try to launch the stunnel shortcut on the desktop, i got a error message like: "The application was unable to start correctly (0xc0150002). Click OK to close the application." I assume it has something to do with the Microsoft.VC90.CRT.MANIFEST file. But i am not an expert. This is shown in the Event log: ########################## Protokollname: Application Quelle: SideBySide Datum: 15.07.2012 12:17:01 Ereignis-ID: 35 Aufgabenkategorie:Keine Ebene: Fehler Schlüsselwörter:Klassisch Benutzer: Nicht zutreffend Computer: WIN-C1K2E115MV1 Beschreibung: Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files (x86)\stunnel\LIBEAY32.dll". Fehler in Manifest- oder Richtliniendatei "C:\Program Files (x86)\stunnel\Microsoft.VC90.CRT.MANIFEST" in Zeile 4. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8". Definition: Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Ereignis-XML: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="SideBySide" /> <EventID Qualifiers="49409">35</EventID> <Level>2</Level> <Task>0</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2012-07-15T10:17:01.000000000Z" /> <EventRecordID>197</EventRecordID> <Channel>Application</Channel> <Computer>WIN-C1K2E115MV1</Computer> <Security /> </System> <EventData> <Data>Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"</Data> <Data>Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161"</Data> <Data>C:\Program Files (x86)\stunnel\LIBEAY32.dll</Data> <Data>C:\Program Files (x86)\stunnel\Microsoft.VC90.CRT.MANIFEST</Data> <Data>4</Data> ########################## I ran the MS tool sxstrace.exe to get more details: See the outcome below: ######################################### INFORMATION: Die Manifestsdefinitionsidentität ist "Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161"". FEHLER: Die im Manifest gefundene Komponentenidentität stimmt nicht mit der Identität der angeforderten Komponente überein. Verweis: Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8". Definition: Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161". FEHLER: Bei der Generierung des Aktivierungskontextes ist ein Fehler aufgetreten. Beendet die Generierung des Aktivierungskontextes. ######################################### Is anything missing? .NET or another library ? Note: I installed on the same server in a different snapshot stunnel version 4.4 and it seems to work, at least no error message. But i want to use the latest version. Any help would be nice. Best Rudi

1 0

Conf question: HTTP to HTTPS with SNI
by John Moser 03 Jul '12

03 Jul '12

I have a particular task I need to accomplish in which an HTTP-only caching proxy server is to accept SSL. The architecture in mind is as follows: - Receive request { HTTP request: - Received by caching proxy at localhost:80 HTTPS request: - Received by Pound - Decoded to HTTP - X-FROM-SSL header added - Forwarded to localhost:80 (caching proxy) } Proxy receives HTTP request - Perform caching - If X-FROM-SSL, forward to localhost:8088 - Else forward to HTTP server It is at this point that two design options come into play, both using stunnel. Either use SNI or use stunnel and HTTP. Via SNI, this would appear as follows: Stunnel receives HTTP request - Forward to https://http-server:443/ with SNI This of course requires that stunnel can read the 'Host' header out of an HTTP request and use that for SNI automatically (there's some 300 virtual hosts on that server). If not, this is infeasible. Which is my question, of course: can this be done? If this isn't an option, then the next logical way to handle this problem is: Stunnel receives HTTP request: - SSL encrypt - Forward to http-server:8443 http-server receives HTTP over stunnel - stunnel receives on http-server:8443 - Decrypt and forward to http://localhost:80/ In this way the entire connection would be encrypted, and the HTTP server would see the Host: header and use that to figure out the virtual host etc. Is that the better/only way?

1 0

more than 1000 concurrent connections?
by Trenton Ashburn 02 Jul '12

02 Jul '12

Hi There - I'd like to use stunnel as the SSL termination point for a bunch of persistent TCP connections. I'm running it on an EC2 instance and it's only allowing me about 1000 concurrent connections. It doesn't matter if the connections come from one client IP or two. How can I raise this limit? I've already raised the OS tcp connection limit with ulimit and it doesn't improve things. Thanks, T

4 5

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users