- stunnel-users - stunnel.org

Install, Starting & Using Stunnel on OS X.
by m i l e s 20 Jun '09

20 Jun '09

Hi I'm a newbie to stunnel. I have a couple of questions....ok, a zillion. However I'll stick to the basics. I found this in the archives that apply to my situation: http://marc.info/?l=stunnel-users&m=121848237124000&w=2 I followed those instructions that Tom Shaw gave, and I can't tell whether or not this thing is installed at all. http://marc.info/?l=stunnel-users&m=121848703131936&w=2 I think that the files are in the right places. And now when I type in stunnel on the command line, I get this as a response: 2009.06.20 12:27:37 LOG7[582:2691602208]: Snagged 64 random bytes from /Users/miles/.rnd 2009.06.20 12:27:37 LOG7[582:2691602208]: Wrote 1024 new random bytes to /Users/miles/.rnd 2009.06.20 12:27:37 LOG7[582:2691602208]: RAND_status claims sufficient entropy for the PRNG 2009.06.20 12:27:37 LOG7[582:2691602208]: PRNG seeded successfully 2009.06.20 12:27:37 LOG3[582:2691602208]: stunnel.pem: No such file or directory (2) I suppose that's an improvement over the command line returning no response for stunnel. So I guess it installed. I have a feeling that the config file (the sample that came with) is what's causing it to respond the way that it is... However, I also see that its throwing an error about the PEM file, that it thinks that its not there. Is there any way to check to see if its pointing at the right file for the pem ? Or to use another crt file ? Now the question becomes how the hell do I start this thing ? (I'm running leopard [10.5.7] for test purposes, but I'll have to do this all over again for a tiger install [10.4.11]...) Then once I get it started, how the hell do I initiate what needs doing ? I tried this ->> stunnel -o /Users/Miles/config.lgo -c -d 80 -r 134.84.119.230:636 Which returns -> 2009.06.20 13:34:32 LOG3[738:2691602208]: -o: No such file or directory (2) Obviously its yapping about a file, in this case I'm assuming the log file where its being referenced. Here's what I'm trying to do: I'm trying to set up a secure tunnel to an ldap server at umn.edu. I got this to work a while back but now I have to set this up from scratch....it was set up for me the last time. I wasn't paying attention and now Im kicking myself. The example I post is running in client mode and not server mode ? I was looking at THIS page: http://radio.weblogs.com/0100683/stories/2002/03/23/settingUpStunnelUnderMa… I'm not entirely certain that what I want to do is run in client mode given what I'm wanting to do... Any help would be a great relief. Thanks ahead of time... Sincerely, Miles.

1 0

Re: [stunnel-users] 4.26 works OK, 4.27 will not POP email
by Jeff Salisbury 17 Jun '09

17 Jun '09

Guy, Your suggestion fixed the problem. Thank you! Regards, Jeff Guy wrote: > Jeff Salisbury wrote: > > >> Greetings, We have been using Stunnel 4.26 to facilitate the >> sending and receiving of email with an email client that is not >> SSL enabled. Version 4.26 has been working great. However, when >> we upgrade to 4.27, we are unable to POP email (we can send >> email). We did not change our Stunnel.conf file. >> >> Can anyone advise us what we need to do to get 4.27 working? >> I've included our Stunnel.conf file contents, and the Stunnel log >> output below. >> >> > > > > Try: sslVersion = TLSv1 > > > See below. > > > > Your Modified Configuration File: > > ##### > # GLOBAL OPTIONS > > client = yes > #output = C:\Documents and Settings\All Users\Application Data\stunnel-log.txt > debug = 7 > taskbar = yes > > sslVersion = TLSv1 > > # SERVICE-LEVEL OPTIONS > > [pop3] > accept=995 > connect=mail.OurPOP.com:995 > > [smtp] > accept=465 > connect=mail.OurSMTP.com:465 > # > ##### > > > > Configuration File Used: > > ##### > # > client = yes > debug = debug > output = _test.log > rndbytes = 256 > rndfile = t:\tmp\randseed.bin > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > > sslVersion = TLSv1 > > [YOUR-POP3S] > accept=TUNNEL-01:110 > connect=216.97.239.60:995 > > [YOUR-SMTPS] > accept=TUNNEL-01:25 > connect=216.97.239.60:465 > # > ##### > > > > Stunnel Debug Output Log: > > Snagged 256 random bytes from t:\tmp\randseed.bin > Wrote 1024 new random bytes to t:\tmp\randseed.bin > RAND_status claims sufficient entropy for the PRNG > PRNG seeded successfully > SSL context initialized for service YOUR-POP3S > SSL context initialized for service YOUR-SMTPS > stunnel 4.27 on x86-pc-mingw32-gnu with OpenSSL 0.9.8k 25 Mar 2009 > Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 > No limit detected for the number of clients > FD 1884 in non-blocking mode > SO_REUSEADDR option set on accept socket > YOUR-POP3S bound to 127.0.10.1:110 > FD 1876 in non-blocking mode > SO_REUSEADDR option set on accept socket > YOUR-SMTPS bound to 127.0.10.1:25 > YOUR-POP3S accepted FD=1860 from 127.0.10.1:1599 > Creating a new thread > New thread created > YOUR-POP3S started > FD 1860 in non-blocking mode > TCP_NODELAY option set on local socket > YOUR-POP3S accepted connection from 127.0.10.1:1599 > FD 1836 in non-blocking mode > connect_blocking: connecting 216.97.239.60:995 > connect_blocking: s_poll_wait 216.97.239.60:995: waiting 10 seconds > connect_blocking: connected 216.97.239.60:995 > YOUR-POP3S connected remote server from 10.10.10.10:1600 > Remote FD=1836 initialized > TCP_NODELAY option set on remote socket > SSL state (connect): before/connect initialization > SSL state (connect): SSLv3 write client hello A > SSL state (connect): SSLv3 read server hello A > SSL state (connect): SSLv3 read server certificate A > SSL state (connect): SSLv3 read server done A > SSL state (connect): SSLv3 write client key exchange A > SSL state (connect): SSLv3 write change cipher spec A > SSL state (connect): SSLv3 write finished A > SSL state (connect): SSLv3 flush data > SSL state (connect): SSLv3 read finished A > 1 items in the session cache > 1 client connects (SSL_connect()) > 1 client connects that finished > 0 client renegotiations requested > 0 server connects (SSL_accept()) > 0 server connects that finished > 0 server renegotiations requested > 0 session cache hits > 0 session cache misses > 0 session cache timeouts > SSL connected: new session negotiated > Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 > Socket closed on read > SSL write shutdown > SSL alert (write): warning: close notify > SSL socket closed on SSL_shutdown > Socket write shutdown > Connection closed: 49 bytes sent to SSL, 90 bytes sent to socket > YOUR-POP3S finished (0 left) > YOUR-SMTPS accepted FD=1844 from 127.0.10.1:1601 > Creating a new thread > New thread created > YOUR-SMTPS started > FD 1844 in non-blocking mode > TCP_NODELAY option set on local socket > YOUR-SMTPS accepted connection from 127.0.10.1:1601 > FD 1836 in non-blocking mode > connect_blocking: connecting 216.97.239.60:465 > connect_blocking: s_poll_wait 216.97.239.60:465: waiting 10 seconds > connect_blocking: connected 216.97.239.60:465 > YOUR-SMTPS connected remote server from 10.10.10.10:1602 > Remote FD=1836 initialized > TCP_NODELAY option set on remote socket > SSL state (connect): before/connect initialization > SSL state (connect): SSLv3 write client hello A > SSL state (connect): SSLv3 read server hello A > SSL state (connect): SSLv3 read server certificate A > SSL state (connect): SSLv3 read server done A > SSL state (connect): SSLv3 write client key exchange A > SSL state (connect): SSLv3 write change cipher spec A > SSL state (connect): SSLv3 write finished A > SSL state (connect): SSLv3 flush data > SSL state (connect): SSLv3 read finished A > 1 items in the session cache > 1 client connects (SSL_connect()) > 1 client connects that finished > 0 client renegotiations requested > 0 server connects (SSL_accept()) > 0 server connects that finished > 0 server renegotiations requested > 0 session cache hits > 0 session cache misses > 0 session cache timeouts > SSL connected: new session negotiated > Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 > Socket closed on read > SSL write shutdown > SSL alert (write): warning: close notify > SSL socket closed on SSL_shutdown > Socket write shutdown > Connection closed: 78 bytes sent to SSL, 423 bytes sent to socket > YOUR-SMTPS finished (0 left) > > > > POP3 Transaction Log: > > CONNECT : Looking up host name TUNNEL-01... > CONNECT : Host name TUNNEL-01 found > CONNECT : Connecting to host TUNNEL-01 [127.0.10.1:110]... > CONNECT : Connected to host TUNNEL-01 [127.0.10.1:110] > POP REPLY : +OK Hello there. > POP SEND : USER username > POP REPLY : +OK Password required. > POP SEND : PASS ********** > POP REPLY : -ERR Login failed. > POP SEND : QUIT > POP REPLY : +OK Better luck next time. > DISCONNECT: Disconnected from server > > > > SMTP Transaction Log: > > CONNECT : Looking up host name TUNNEL-01... > CONNECT : Host name TUNNEL-01 found > CONNECT : Connecting to host TUNNEL-01 [127.0.10.1:25]... > CONNECT : Connected to host TUNNEL-01 [127.0.10.1:25] > SMTP REPLY: 220-crimson.lunarbreeze.com ESMTP Exim 4.69 #1 Tue, 16 Jun 2009 14:45:25 -0700 > SMTP SEND : EHLO computername > SMTP REPLY: 250-crimson.lunarbreeze.com Hello 123,123.123.123 [123,123.123.123] > SMTP REPLY: 250-SIZE 52428800 > SMTP REPLY: 250-PIPELINING > SMTP REPLY: 250-AUTH PLAIN LOGIN > SMTP REPLY: 250 HELP > SMTP SEND : AUTH PLAIN xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx== > SMTP REPLY: 535 Incorrect authentication data > SMTP SEND : QUIT > SMTP REPLY: 221 crimson.lunarbreeze.com closing connection > DISCONNECT: Disconnected from server > >

1 0

4.26 works OK, 4.27 will not POP email
by Jeff Salisbury 14 Jun '09

14 Jun '09

Greetings, We have been using Stunnel 4.26 to facilitate the sending and receiving of email with an email client that is not SSL enabled. Version 4.26 has been working great. However, when we upgrade to 4.27, we are unable to POP email (we can send email). We did not change our Stunnel.conf file. Can anyone advise us what we need to do to get 4.27 working? I've included our Stunnel.conf file contents, and the Stunnel log output below. Regards, Jeff ===================================================== # GLOBAL OPTIONS client = yes #output = C:\Documents and Settings\All Users\Application Data\stunnel-log.txt debug = 7 taskbar = yes # SERVICE-LEVEL OPTIONS [pop3] accept=995 connect=mail.OurPOP.com:995 [smtp] accept=465 connect=mail.OurSMTP.com:465 ===================================================== 2009.06.14 14:03:03 LOG7[3348:540]: RAND_status claims sufficient entropy for the PRNG 2009.06.14 14:03:03 LOG7[3348:540]: PRNG seeded successfully 2009.06.14 14:03:03 LOG7[3348:540]: SSL context initialized for service pop3 2009.06.14 14:03:03 LOG7[3348:540]: SSL context initialized for service smtp 2009.06.14 14:03:03 LOG5[3348:540]: stunnel 4.27 on x86-pc-mingw32-gnu with OpenSSL 0.9.8k 25 Mar 2009 2009.06.14 14:03:03 LOG5[3348:540]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2009.06.14 14:03:03 LOG5[3348:3668]: No limit detected for the number of clients 2009.06.14 14:03:03 LOG7[3348:3668]: FD 204 in non-blocking mode 2009.06.14 14:03:03 LOG7[3348:3668]: SO_REUSEADDR option set on accept socket 2009.06.14 14:03:03 LOG7[3348:3668]: pop3 bound to 0.0.0.0:995 2009.06.14 14:03:03 LOG7[3348:3668]: FD 212 in non-blocking mode 2009.06.14 14:03:03 LOG7[3348:3668]: SO_REUSEADDR option set on accept socket 2009.06.14 14:03:03 LOG7[3348:3668]: smtp bound to 0.0.0.0:465 2009.06.14 14:03:11 LOG7[3348:3668]: pop3 accepted FD=228 from 127.0.0.1:2027 2009.06.14 14:03:11 LOG7[3348:3668]: Creating a new thread 2009.06.14 14:03:11 LOG7[3348:3668]: New thread created 2009.06.14 14:03:11 LOG7[3348:3668]: pop3 accepted FD=244 from 127.0.0.1:2026 2009.06.14 14:03:11 LOG7[3348:3668]: Creating a new thread 2009.06.14 14:03:11 LOG7[3348:3668]: New thread created 2009.06.14 14:03:11 LOG7[3348:1144]: pop3 started 2009.06.14 14:03:11 LOG7[3348:1144]: FD 228 in non-blocking mode 2009.06.14 14:03:11 LOG5[3348:1144]: pop3 accepted connection from 127.0.0.1:2027 2009.06.14 14:03:11 LOG7[3348:1144]: FD 268 in non-blocking mode 2009.06.14 14:03:11 LOG6[3348:1144]: connect_blocking: connecting 216.97.239.60:995 2009.06.14 14:03:11 LOG7[3348:4060]: pop3 started 2009.06.14 14:03:11 LOG7[3348:4060]: FD 244 in non-blocking mode 2009.06.14 14:03:11 LOG5[3348:4060]: pop3 accepted connection from 127.0.0.1:2026 2009.06.14 14:03:11 LOG7[3348:4060]: FD 280 in non-blocking mode 2009.06.14 14:03:11 LOG6[3348:4060]: connect_blocking: connecting 216.97.239.60:995 2009.06.14 14:03:11 LOG7[3348:1144]: connect_blocking: s_poll_wait 216.97.239.60:995: waiting 10 seconds 2009.06.14 14:03:11 LOG7[3348:4060]: connect_blocking: s_poll_wait 216.97.239.60:995: waiting 10 seconds 2009.06.14 14:03:11 LOG5[3348:1144]: connect_blocking: connected 216.97.239.60:995 2009.06.14 14:03:11 LOG5[3348:1144]: pop3 connected remote server from 192.168.0.55:2028 2009.06.14 14:03:11 LOG7[3348:1144]: Remote FD=268 initialized 2009.06.14 14:03:11 LOG7[3348:1144]: SSL state (connect): before/connect initialization 2009.06.14 14:03:11 LOG7[3348:1144]: SSL state (connect): SSLv3 write client hello A 2009.06.14 14:03:11 LOG5[3348:4060]: connect_blocking: connected 216.97.239.60:995 2009.06.14 14:03:11 LOG5[3348:4060]: pop3 connected remote server from 192.168.0.55:2029 2009.06.14 14:03:11 LOG7[3348:4060]: Remote FD=280 initialized 2009.06.14 14:03:11 LOG7[3348:4060]: SSL state (connect): before/connect initialization 2009.06.14 14:03:11 LOG7[3348:4060]: SSL state (connect): SSLv3 write client hello A 2009.06.14 14:03:11 LOG7[3348:1144]: SSL alert (read): fatal: handshake failure 2009.06.14 14:03:11 LOG3[3348:1144]: SSL_connect: 14094410: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure 2009.06.14 14:03:11 LOG5[3348:1144]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.06.14 14:03:11 LOG7[3348:1144]: pop3 finished (1 left) 2009.06.14 14:03:11 LOG7[3348:4060]: SSL alert (read): fatal: handshake failure 2009.06.14 14:03:11 LOG3[3348:4060]: SSL_connect: 14094410: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure 2009.06.14 14:03:11 LOG5[3348:4060]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.06.14 14:03:11 LOG7[3348:4060]: pop3 finished (0 left)

1 0

Silence after "Acquired libwrap process"
by James Brown 12 Jun '09

12 Jun '09

I'm trying to use stunnel to send email with SSL authentication. Sending the email with Apple's Mail.app with 'use default ports' selected. stunnel.log output: 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Snagged 64 random bytes from /Users/jlbrown/.rnd 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Wrote 1024 new random bytes to /Users/jlbrown/.rnd 2009.06.12 09:58:17 LOG7[41897:140735078037248]: RAND_status claims sufficient entropy for the PRNG 2009.06.12 09:58:17 LOG7[41897:140735078037248]: PRNG seeded successfully 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Certificate: /etc/ postfix/smtpd.cert 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Certificate loaded 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Key file: /etc/ postfix/smtpd.key 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Private key loaded 2009.06.12 09:58:17 LOG7[41897:140735078037248]: SSL context initialized for service ssmtp 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Certificate: /etc/ postfix/smtpd.cert 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Certificate loaded 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Key file: /etc/ postfix/smtpd.key 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Private key loaded 2009.06.12 09:58:17 LOG7[41897:140735078037248]: SSL context initialized for service ssmtp2 2009.06.12 09:58:17 LOG5[41897:140735078037248]: stunnel 4.27 on i686- apple-darwin9.7.0 with OpenSSL 0.9.7l 28 Sep 2006 2009.06.12 09:58:17 LOG5[41897:140735078037248]: Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv6 Auth:LIBWRAP 2009.06.12 09:58:17 LOG6[41897:140735078037248]: file ulimit = 256 (can be changed with 'ulimit -n') 2009.06.12 09:58:17 LOG6[41897:140735078037248]: FD_SETSIZE = 1024 (some systems allow to increase this value) 2009.06.12 09:58:17 LOG5[41897:140735078037248]: 125 clients allowed 2009.06.12 09:58:17 LOG7[41897:140735078037248]: FD 10 in non-blocking mode 2009.06.12 09:58:17 LOG7[41897:140735078037248]: FD 11 in non-blocking mode 2009.06.12 09:58:17 LOG7[41897:140735078037248]: FD 12 in non-blocking mode 2009.06.12 09:58:17 LOG7[41897:140735078037248]: SO_REUSEADDR option set on accept socket 2009.06.12 09:58:17 LOG7[41897:140735078037248]: ssmtp bound to 0.0.0.0:465 2009.06.12 09:58:17 LOG7[41897:140735078037248]: FD 13 in non-blocking mode 2009.06.12 09:58:17 LOG7[41897:140735078037248]: SO_REUSEADDR option set on accept socket 2009.06.12 09:58:17 LOG7[41897:140735078037248]: ssmtp2 bound to 0.0.0.0:587 2009.06.12 09:58:17 LOG7[41903:140735078037248]: Created pid file /usr/ local/var/run/stunnel/stunnel.pid 2009.06.12 09:58:56 LOG7[41903:140735078037248]: ssmtp2 accepted FD=14 from 192.168.1.10:64996 2009.06.12 09:58:56 LOG7[41903:4295561216]: ssmtp2 started 2009.06.12 09:58:56 LOG7[41903:4295561216]: FD 14 in non-blocking mode 2009.06.12 09:58:56 LOG7[41903:4295561216]: TCP_NODELAY option set on local socket 2009.06.12 09:58:56 LOG7[41903:4295561216]: Waiting for a libwrap process 2009.06.12 09:58:56 LOG7[41903:4295561216]: Acquired libwrap process #0 2009.06.12 10:00:04 LOG7[41903:140735078037248]: ssmtp2 accepted FD=15 from 192.168.1.10:65006 2009.06.12 10:00:04 LOG7[41903:4295675904]: ssmtp2 started 2009.06.12 10:00:04 LOG7[41903:4295675904]: FD 15 in non-blocking mode 2009.06.12 10:00:04 LOG7[41903:4295675904]: TCP_NODELAY option set on local socket 2009.06.12 10:00:04 LOG7[41903:4295675904]: Waiting for a libwrap process 2009.06.12 10:00:04 LOG7[41903:4295675904]: Acquired libwrap process #1 2009.06.12 10:01:04 LOG7[41903:140735078037248]: ssmtp accepted FD=16 from 192.168.1.10:65013 2009.06.12 10:01:04 LOG7[41903:4295790592]: ssmtp started 2009.06.12 10:01:04 LOG7[41903:4295790592]: FD 16 in non-blocking mode 2009.06.12 10:01:04 LOG7[41903:4295790592]: TCP_NODELAY option set on local socket 2009.06.12 10:01:04 LOG7[41903:4295790592]: Waiting for a libwrap process 2009.06.12 10:01:04 LOG7[41903:4295790592]: Acquired libwrap process #2 2009.06.12 10:03:56 LOG6[41903:4295561216]: read_blocking: s_poll_wait timeout 2009.06.12 10:03:56 LOG5[41903:4295561216]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.06.12 10:03:56 LOG7[41903:4295561216]: ssmtp2 finished (2 left) 2009.06.12 10:03:56 LOG7[41903:140735078037248]: ssmtp accepted FD=14 from 192.168.1.10:65022 2009.06.12 10:03:56 LOG7[41903:4295561216]: ssmtp started 2009.06.12 10:03:56 LOG7[41903:4295561216]: FD 14 in non-blocking mode 2009.06.12 10:03:56 LOG7[41903:4295561216]: TCP_NODELAY option set on local socket 2009.06.12 10:03:56 LOG7[41903:4295561216]: Waiting for a libwrap process 2009.06.12 10:03:56 LOG7[41903:4295561216]: Acquired libwrap process #3 2009.06.12 10:05:04 LOG6[41903:4295675904]: read_blocking: s_poll_wait timeout 2009.06.12 10:05:04 LOG5[41903:4295675904]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.06.12 10:05:04 LOG7[41903:4295675904]: ssmtp2 finished (2 left) 2009.06.12 10:05:04 LOG7[41903:140735078037248]: ssmtp accepted FD=15 from 192.168.1.10:65028 2009.06.12 10:05:04 LOG7[41903:4295675904]: ssmtp started 2009.06.12 10:05:04 LOG7[41903:4295675904]: FD 15 in non-blocking mode 2009.06.12 10:05:04 LOG7[41903:4295675904]: TCP_NODELAY option set on local socket 2009.06.12 10:05:04 LOG7[41903:4295675904]: Waiting for a libwrap process 2009.06.12 10:05:04 LOG7[41903:4295675904]: Acquired libwrap process #4 2009.06.12 10:06:04 LOG6[41903:4295790592]: read_blocking: s_poll_wait timeout 2009.06.12 10:06:04 LOG5[41903:4295790592]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.06.12 10:06:04 LOG7[41903:4295790592]: ssmtp finished (2 left) 2009.06.12 10:06:04 LOG7[41903:140735078037248]: ssmtp accepted FD=16 from 192.168.1.10:65032 2009.06.12 10:06:04 LOG7[41903:4295790592]: ssmtp started 2009.06.12 10:06:04 LOG7[41903:4295790592]: FD 16 in non-blocking mode 2009.06.12 10:06:04 LOG7[41903:4295790592]: TCP_NODELAY option set on local socket 2009.06.12 10:06:04 LOG7[41903:4295790592]: Waiting for a libwrap process 2009.06.12 10:08:56 LOG6[41903:4295561216]: read_blocking: s_poll_wait timeout 2009.06.12 10:08:56 LOG5[41903:4295561216]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.06.12 10:08:56 LOG7[41903:4295561216]: ssmtp finished (2 left) 2009.06.12 10:08:56 LOG7[41903:140735078037248]: ssmtp2 accepted FD=14 from 192.168.1.10:65040 2009.06.12 10:08:56 LOG7[41903:4295561216]: ssmtp2 started 2009.06.12 10:08:56 LOG7[41903:4295561216]: FD 14 in non-blocking mode 2009.06.12 10:08:56 LOG7[41903:4295561216]: TCP_NODELAY option set on local socket 2009.06.12 10:08:56 LOG7[41903:4295561216]: Waiting for a libwrap process 2009.06.12 10:10:04 LOG6[41903:4295675904]: read_blocking: s_poll_wait timeout 2009.06.12 10:10:04 LOG5[41903:4295675904]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.06.12 10:10:04 LOG7[41903:4295675904]: ssmtp finished (2 left) 2009.06.12 10:10:04 LOG7[41903:140735078037248]: ssmtp accepted FD=15 from 192.168.1.10:65044 2009.06.12 10:10:04 LOG7[41903:4295675904]: ssmtp started 2009.06.12 10:10:04 LOG7[41903:4295675904]: FD 15 in non-blocking mode 2009.06.12 10:10:04 LOG7[41903:4295675904]: TCP_NODELAY option set on local socket 2009.06.12 10:10:04 LOG7[41903:4295675904]: Waiting for a libwrap process 2009.06.12 10:11:04 LOG7[41903:140735078037248]: ssmtp accepted FD=17 from 192.168.1.10:65048 2009.06.12 10:11:04 LOG7[41903:4295905280]: ssmtp started 2009.06.12 10:11:04 LOG7[41903:4295905280]: FD 17 in non-blocking mode 2009.06.12 10:11:04 LOG7[41903:4295905280]: TCP_NODELAY option set on local socket 2009.06.12 10:11:04 LOG7[41903:4295905280]: Waiting for a libwrap process 2009.06.12 10:13:56 LOG7[41903:140735078037248]: ssmtp accepted FD=18 from 192.168.1.10:65060 2009.06.12 10:13:56 LOG7[41903:4297134080]: ssmtp started 2009.06.12 10:13:56 LOG7[41903:4297134080]: FD 18 in non-blocking mode 2009.06.12 10:13:56 LOG7[41903:4297134080]: TCP_NODELAY option set on local socket 2009.06.12 10:13:56 LOG7[41903:4297134080]: Waiting for a libwrap process 2009.06.12 10:15:04 LOG7[41903:140735078037248]: ssmtp accepted FD=19 from 192.168.1.10:65063 2009.06.12 10:15:04 LOG7[41903:4297211904]: ssmtp started 2009.06.12 10:15:04 LOG7[41903:4297211904]: FD 19 in non-blocking mode 2009.06.12 10:15:04 LOG7[41903:4297211904]: TCP_NODELAY option set on local socket 2009.06.12 10:15:04 LOG7[41903:4297211904]: Waiting for a libwrap process 2009.06.12 10:18:56 LOG7[41903:140735078037248]: ssmtp2 accepted FD=20 from 192.168.1.10:65090 2009.06.12 10:18:56 LOG7[41903:4297326592]: ssmtp2 started 2009.06.12 10:18:56 LOG7[41903:4297326592]: FD 20 in non-blocking mode 2009.06.12 10:18:56 LOG7[41903:4297326592]: TCP_NODELAY option set on local socket 2009.06.12 10:18:56 LOG7[41903:4297326592]: Waiting for a libwrap process 2009.06.12 10:20:04 LOG7[41903:140735078037248]: ssmtp2 accepted FD=21 from 192.168.1.10:65093 2009.06.12 10:20:04 LOG7[41903:4297441280]: ssmtp2 started 2009.06.12 10:20:04 LOG7[41903:4297441280]: FD 21 in non-blocking mode 2009.06.12 10:20:04 LOG7[41903:4297441280]: TCP_NODELAY option set on local socket 2009.06.12 10:20:04 LOG7[41903:4297441280]: Waiting for a libwrap process 2009.06.12 10:23:56 LOG7[41903:140735078037248]: ssmtp2 accepted FD=22 from 192.168.1.10:65111 2009.06.12 10:23:56 LOG7[41903:4297555968]: ssmtp2 started 2009.06.12 10:23:56 LOG7[41903:4297555968]: FD 22 in non-blocking mode 2009.06.12 10:23:56 LOG7[41903:4297555968]: TCP_NODELAY option set on local socket 2009.06.12 10:23:56 LOG7[41903:4297555968]: Waiting for a libwrap process 2009.06.12 10:25:04 LOG7[41903:140735078037248]: ssmtp accepted FD=23 from 192.168.1.10:65113 2009.06.12 10:25:04 LOG7[41903:4297670656]: ssmtp started 2009.06.12 10:25:04 LOG7[41903:4297670656]: FD 23 in non-blocking mode 2009.06.12 10:25:04 LOG7[41903:4297670656]: TCP_NODELAY option set on local socket 2009.06.12 10:25:04 LOG7[41903:4297670656]: Waiting for a libwrap process 2009.06.12 10:28:56 LOG7[41903:140735078037248]: ssmtp2 accepted FD=24 from 192.168.1.10:65125 2009.06.12 10:28:56 LOG7[41903:4297785344]: ssmtp2 started 2009.06.12 10:28:56 LOG7[41903:4297785344]: FD 24 in non-blocking mode 2009.06.12 10:28:56 LOG7[41903:4297785344]: TCP_NODELAY option set on local socket 2009.06.12 10:28:56 LOG7[41903:4297785344]: Waiting for a libwrap process 2009.06.12 10:30:04 LOG7[41903:140735078037248]: ssmtp2 accepted FD=25 from 192.168.1.10:65128 2009.06.12 10:30:04 LOG7[41903:4297900032]: ssmtp2 started 2009.06.12 10:30:04 LOG7[41903:4297900032]: FD 25 in non-blocking mode 2009.06.12 10:30:04 LOG7[41903:4297900032]: TCP_NODELAY option set on local socket 2009.06.12 10:30:04 LOG7[41903:4297900032]: Waiting for a libwrap process 2009.06.12 10:33:56 LOG7[41903:140735078037248]: ssmtp2 accepted FD=26 from 192.168.1.10:65299 2009.06.12 10:33:56 LOG7[41903:4298014720]: ssmtp2 started 2009.06.12 10:33:56 LOG7[41903:4298014720]: FD 26 in non-blocking mode 2009.06.12 10:33:56 LOG7[41903:4298014720]: TCP_NODELAY option set on local socket 2009.06.12 10:33:56 LOG7[41903:4298014720]: Waiting for a libwrap process 2009.06.12 10:35:04 LOG7[41903:140735078037248]: ssmtp2 accepted FD=27 from 192.168.1.10:65326 2009.06.12 10:35:04 LOG7[41903:4298129408]: ssmtp2 started 2009.06.12 10:35:04 LOG7[41903:4298129408]: FD 27 in non-blocking mode 2009.06.12 10:35:04 LOG7[41903:4298129408]: TCP_NODELAY option set on local socket 2009.06.12 10:35:04 LOG7[41903:4298129408]: Waiting for a libwrap process 2009.06.12 10:40:04 LOG7[41903:140735078037248]: ssmtp accepted FD=28 from 192.168.1.10:65365 2009.06.12 10:40:04 LOG7[41903:4298244096]: ssmtp started 2009.06.12 10:40:04 LOG7[41903:4298244096]: FD 28 in non-blocking mode 2009.06.12 10:40:04 LOG7[41903:4298244096]: TCP_NODELAY option set on local socket 2009.06.12 10:40:04 LOG7[41903:4298244096]: Waiting for a libwrap process 2009.06.12 10:45:04 LOG7[41903:140735078037248]: ssmtp accepted FD=29 from 192.168.1.10:65377 2009.06.12 10:45:04 LOG7[41903:4298358784]: ssmtp started 2009.06.12 10:45:04 LOG7[41903:4298358784]: FD 29 in non-blocking mode 2009.06.12 10:45:04 LOG7[41903:4298358784]: TCP_NODELAY option set on local socket 2009.06.12 10:45:04 LOG7[41903:4298358784]: Waiting for a libwrap process 2009.06.12 10:50:04 LOG7[41903:140735078037248]: ssmtp accepted FD=30 from 192.168.1.10:65406 2009.06.12 10:50:04 LOG7[41903:4298473472]: ssmtp started 2009.06.12 10:50:04 LOG7[41903:4298473472]: FD 30 in non-blocking mode 2009.06.12 10:50:04 LOG7[41903:4298473472]: TCP_NODELAY option set on local socket 2009.06.12 10:50:04 LOG7[41903:4298473472]: Waiting for a libwrap process Stunnel is running on Mac OS X 10.5.7. Any help would be much appreciated. James.

1 0

Re: [stunnel-users] 1 server and more desktops
by aaa aaa 08 Jun '09

08 Jun '09

Hello Carter, thank you very much for your help and nice examples. I will try it in my local network. Have a good day. Mia ---- Pôvodná správa ---- Od koho: Carter Browne <cbrowne(a)cbcs-usa.com> Komu: aaa aaa <miamia(a)inMail.sk> Dátum: 8. 6. 2009 17:52:00 Predmet: Re: [stunnel-users] 1 server and more desktops Mia, I work in both Windows and Linux, so I use a Windows approach - copying files where in Linux a link would be more appropriate. Assume server.pem is the server full server certificate including the private key and client1.pem is a full client certificate including the key. The first step is to make a copy of the server certificate and delete the lines starting with -----BEGIN RSA PRIVATE KEY------ down through the blank line after -----END RSA PRIVATE KEY----- Initial I call this server-pub.pem The command: openssl x509 -in server-pub.pem -subject_hash -noout will print out the hash for the server key (as 8 hexadecimal digits), for example abcef012 Then I rename server-pub.pem to abcdef012.0 I repeat the same process for each client key, so that client1.pem in this example would have a public key named 987654fe.0 (assuming that the hash of 987654fe). In the client1 configuration: cert = client1.pem key = client1.pem verify = 3 cafile = abcdef012.0 In the server configuration cert = server1.pem key = server1.pem verify = 3 capath = capath In the capath directory is 987654fe.0 ... Plus the hashes of the other clients. In Windows, the capath is under the stunnel directory. The client certificates can also be concatenated in a single file. If you use a directory, it is not necessary to restart stunnel if you add a new client. If you use a concatenated file, you do have to restart stunnel if you add a client. There are some notes in the documentation about the structure of a concatenated file. I hope this helps. Carter Carter Browne CBCS cbrowne(a)cbcs-usa.com 781-721-2890 aaa aaa wrote: > Hi Carter, > > thank you. I am trying to use scenario with self-signed certificates > exactly like you are using it. Could you please write me some examples > of config for server and clients? I don't know where to put private > keys and how to set up server for acceptation of certificates from > clients only - server must reject all communication without/or with > other certificates as are stored in his folder. > > thank you in advance > > regards, > mia > > ---- Pôvodná správa ---- > Od koho: Carter Browne <cbrowne(a)cbcs-usa.com> > Komu: aaa aaa <miamia(a)inMail.sk> > Dátum: 8. 6. 2009 15:00:00 > Predmet: Re: [stunnel-users] 1 server and more desktops > > I do this using self-signed certificates and verify=2 or verify=3. The > remote computers would only have the servers public certificate their > CAfile (or CApath). The server must have all the remote computers > public certificates in its CAfile or CApath. See the rules about how to > build those. If you are only using self-signed certificates, you can > use verify=3, otherwise you will have to use verify=2. Each port that > you want to forward must be in you stunnel.conf file - without knowing > what you are trying to do, it is hard to be more specific. > > Carter > > Carter Browne > CBCS > cbrowne(a)cbcs-usa.com > 781-721-2890 > > > > aaa aaa wrote: > > hello Christophe, > > > > thanks for your answer. Sorry for any misunderstanding. Well, I just > > wanted to ask if it is able to set stunnel for working with more > > certificates? So it means that I don't want to have secured tunnel > > between remote and local computer only but also between one remote and > > many local computers with more certificates? Every local computer > > should have own certificate. > > > > Is this possible? > > > > thank you. > > > > ---- Pôvodná správa ---- > > Od koho: Christophe Nanteuil <christophe.nanteuil(a)gmail.com> > > Komu: aaa aaa <miamia(a)inmail.sk> > > Dátum: 7. 6. 2009 16:27:00 > > Predmet: Re: [stunnel-users] 1 server and more desktops > > > > Hello, > > > > Stunnel is an application oriented tunnel, not a machine oriented > > tunnel. Please, be more precise in your requests if you want someone > > to be able to help you. It seems also that the stunnel documentation > > pages are worh reading in your case. > > > > Regards, > > > > -- > > Christophe > > > > > > 2009/6/7 aaa aaa <miamia(a)inmail.sk>: > > > Hello, > > > > > > I have one server and 3 desktops (PC1,PC2,PC3). I need to do this: > > every pc > > > should communicate with server with his own certificate and server > > should > > > sends anwser back to the computer encrypted for this one pc only. > > > > > > Example: PC3 {with server's public key} sends data to server and > server > > > sends answer to PC3 (encrypted wiht unique PC3's public key). > > > then PC2 {with server's public key} sends data to server and server > > sends > > > answer to PC2 (encrypted wiht unique PC2's public key). and so > on... how > > > should I configure stunnel for this? > > > > > > And another question > how should I configure all computers (server, > > > pc1,pc2,pc3) to accept communication over secured stunnel only and > > drop all > > > other unsecured communication? > > > > > > > > > thank you in advance. > > > regards, Mia > > > ---------- > > > Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. > > Domena, > > > webhosting, e-mail a seo od 10 centov/denne. > > > > > > _______________________________________________ > > > stunnel-users mailing list > > > stunnel-users(a)mirt.net > > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > > > > > > ---------- > > Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk > > <http://www.inpage.sk/>. Domena, webhosting, e-mail a seo od 10 > > centov/denne. > > ------------------------------------------------------------------------ > > > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)mirt.net > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > ---------- > Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk > <http://www.inpage.sk/>. Domena, webhosting, e-mail a seo od 10 > centov/denne. ---------- Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. Domena, webhosting, e-mail a seo od 10 centov/denne.

1 0

Re: [stunnel-users] 1 server and more desktops
by aaa aaa 08 Jun '09

08 Jun '09

Hi Carter, thank you. I am trying to use scenario with self-signed certificates exactly like you are using it. Could you please write me some examples of config for server and clients? I don't know where to put private keys and how to set up server for acceptation of certificates from clients only - server must reject all communication without/or with other certificates as are stored in his folder. thank you in advance regards, mia > ---- Pôvodná správa ---- > Od koho: Carter Browne <cbrowne(a)cbcs-usa.com> > Komu: aaa aaa <miamia(a)inMail.sk> > Dátum: 8. 6. 2009 15:00:00 > Predmet: Re: [stunnel-users] 1 server and more desktops > > I do this using self-signed certificates and verify=2 or verify=3. The > remote computers would only have the servers public certificate their > CAfile (or CApath). The server must have all the remote computers > public certificates in its CAfile or CApath. See the rules about how to > build those. If you are only using self-signed certificates, you can > use verify=3, otherwise you will have to use verify=2. Each port that > you want to forward must be in you stunnel.conf file - without knowing > what you are trying to do, it is hard to be more specific. > > Carter > > Carter Browne > CBCS > cbrowne(a)cbcs-usa.com > 781-721-2890 > > > > aaa aaa wrote: > > hello Christophe, > > > > thanks for your answer. Sorry for any misunderstanding. Well, I just > > wanted to ask if it is able to set stunnel for working with more > > certificates? So it means that I don't want to have secured tunnel > > between remote and local computer only but also between one remote and > > many local computers with more certificates? Every local computer > > should have own certificate. > > > > Is this possible? > > > > thank you. > > > > ---- Pôvodná správa ---- > > Od koho: Christophe Nanteuil <christophe.nanteuil(a)gmail.com> > > Komu: aaa aaa <miamia(a)inmail.sk> > > Dátum: 7. 6. 2009 16:27:00 > > Predmet: Re: [stunnel-users] 1 server and more desktops > > > > Hello, > > > > Stunnel is an application oriented tunnel, not a machine oriented > > tunnel. Please, be more precise in your requests if you want someone > > to be able to help you. It seems also that the stunnel documentation > > pages are worh reading in your case. > > > > Regards, > > > > -- > > Christophe > > > > > > 2009/6/7 aaa aaa <miamia(a)inmail.sk>: > > > Hello, > > > > > > I have one server and 3 desktops (PC1,PC2,PC3). I need to do this: > > every pc > > > should communicate with server with his own certificate and server > > should > > > sends anwser back to the computer encrypted for this one pc only. > > > > > > Example: PC3 {with server's public key} sends data to server and > server > > > sends answer to PC3 (encrypted wiht unique PC3's public key). > > > then PC2 {with server's public key} sends data to server and server > > sends > > > answer to PC2 (encrypted wiht unique PC2's public key). and so > on... how > > > should I configure stunnel for this? > > > > > > And another question > how should I configure all computers (server, > > > pc1,pc2,pc3) to accept communication over secured stunnel only and > > drop all > > > other unsecured communication? > > > > > > > > > thank you in advance. > > > regards, Mia > > > ---------- > > > Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. > > Domena, > > > webhosting, e-mail a seo od 10 centov/denne. > > > > > > _______________________________________________ > > > stunnel-users mailing list > > > stunnel-users(a)mirt.net > > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > > > > > > ---------- > > Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk > > <http://www.inpage.sk/>. Domena, webhosting, e-mail a seo od 10 > > centov/denne. > > ------------------------------------------------------------------------ > > > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)mirt.net > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > ---------- > Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk > <http://www.inpage.sk/>. Domena, webhosting, e-mail a seo od 10 > centov/denne. ---------- Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. Domena, webhosting, e-mail a seo od 10 centov/denne.

1 0

Stunnel client hangs in background mode when smartcard is used
by John Abloyer 08 Jun '09

08 Jun '09

Hi! I have a problem when running ssh over stunnel in background mode ('foreground' out-commented in config file). In foreground mode, everything works fine. I'm using a modified OpenSSL, adding an engine that is dedicated to communicate with a smartcard reader. The scenario is: - Starting stunnel on server, extract from config file: [ssh] accept = myserver:122 connect = 22 - Starting stunnel on client, extract from config file: engine = myengine engineNum = 1 client = yes [ssh] accept = 22 connect = myserver:122 I come to here, than it hangs: ... 2009.06.08 15:08:22 LOG7[472:3054680976]: SSL state (connect): SSLv3 read server certificate A 2009.06.08 15:08:22 LOG7[472:3054680976]: SSL state (connect): SSLv3 read server certificate request A 2009.06.08 15:08:22 LOG7[472:3054680976]: SSL state (connect): SSLv3 read server done A 2009.06.08 15:08:22 LOG7[472:3054680976]: SSL state (connect): SSLv3 write client certificate A 2009.06.08 15:08:22 LOG7[472:3054680976]: SSL state (connect): SSLv3 write client key exchange A - - - - - - - But when I run in foreground mode, it all works fine and stunnel continues and I get the ssh login prompt. I'm running RHEL 5.2, OpenSSL 0.9.8*, stunnel 4.27 Any help would be appreciated Rgds JA

1 0

start parameters
by Sebastian Rose-Indorf 07 Jun '09

07 Jun '09

Hello, a short question: Which start parameters are there for Stunnel v4.xx? Thanks, Seb. _ ASCII ribbon campaign against HTML e-mail ( ) & proprietary e-mail formats X / \ www.asciiribbon.org

1 0

Re: [stunnel-users] 1 server and more desktops
by aaa aaa 07 Jun '09

07 Jun '09

hello Christophe, thanks for your answer. Sorry for any misunderstanding. Well, I just wanted to ask if it is able to set stunnel for working with more certificates? So it means that I don't want to have secured tunnel between remote and local computer only but also between one remote and many local computers with more certificates? Every local computer should have own certificate. Is this possible? thank you. ---- Pôvodná správa ---- Od koho: Christophe Nanteuil <christophe.nanteuil(a)gmail.com> Komu: aaa aaa <miamia(a)inmail.sk> Dátum: 7. 6. 2009 16:27:00 Predmet: Re: [stunnel-users] 1 server and more desktops Hello, Stunnel is an application oriented tunnel, not a machine oriented tunnel. Please, be more precise in your requests if you want someone to be able to help you. It seems also that the stunnel documentation pages are worh reading in your case. Regards, -- Christophe 2009/6/7 aaa aaa <miamia(a)inmail.sk>: > Hello, > > I have one server and 3 desktops (PC1,PC2,PC3). I need to do this: every pc > should communicate with server with his own certificate and server should > sends anwser back to the computer encrypted for this one pc only. > > Example: PC3 {with server's public key} sends data to server and server > sends answer to PC3 (encrypted wiht unique PC3's public key). > then PC2 {with server's public key} sends data to server and server sends > answer to PC2 (encrypted wiht unique PC2's public key). and so on... how > should I configure stunnel for this? > > And another question > how should I configure all computers (server, > pc1,pc2,pc3) to accept communication over secured stunnel only and drop all > other unsecured communication? > > > thank you in advance. > regards, Mia > ---------- > Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. Domena, > webhosting, e-mail a seo od 10 centov/denne. > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > ---------- Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. Domena, webhosting, e-mail a seo od 10 centov/denne.

1 0

stunnel through httpd
by Chatty 07 Jun '09

07 Jun '09

Hello, I've got the crazy idea to run stunnel behind an existing, SSL-enabled, basic-auth-using httpd. Configuration would be as follows: 1. put some stunnel.cgi into /usr/www/cgi-bin which would call stunnel binary 2. start stunnel client with -r https://login:[email protected]/cgi-bin/stunnel.cgi Advantages (assumed you're behind a proxy which allows only 443 as outgoing port): a. You can still access other WebIFs on that server. b. You don't have to administer another web server including authentication, certificates and so on. May be stunnel is not the best tool for the above scenario (I reckon stunnel is currently unable to fulfill this)... I hope someone can shed some light on this. Cheers, Chatty.

1 0