stunnel-users

1 participants
3311 discussions

Error message vista
by Reinier van der Gugten 04 Feb '09

04 Feb '09

Hi, I use Stunnel for some of my customers. However I tried it myself (after a while, and after a reinstall of windows) and I get this error. Can anyone tell me how to get it to work again? I get the same error when I run it as administrator, or when I change the port from 443 to 4430. 2009.02.04 13:54:04 LOG7[2828:5668]: Snagged 64 random bytes from C:/.rnd 2009.02.04 13:54:04 LOG7[2828:5668]: Wrote 1024 new random bytes to C:/.rnd 2009.02.04 13:54:04 LOG7[2828:5668]: RAND_status claims sufficient entropy for the PRNG 2009.02.04 13:54:04 LOG7[2828:5668]: PRNG seeded successfully 2009.02.04 13:54:04 LOG7[2828:5668]: Certificate: stunnel.pem 2009.02.04 13:54:04 LOG7[2828:5668]: Certificate loaded 2009.02.04 13:54:04 LOG7[2828:5668]: Key file: stunnel.pem 2009.02.04 13:54:04 LOG7[2828:5668]: Private key loaded 2009.02.04 13:54:04 LOG7[2828:5668]: SSL context initialized for service SQLServer 2009.02.04 13:54:04 LOG5[2828:5668]: stunnel 4.26 on x86-pc-mingw32-gnu with OpenSSL 0.9.8i 15 Sep 2008 2009.02.04 13:54:04 LOG5[2828:5668]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2009.02.04 13:54:04 LOG5[2828:5672]: No limit detected for the number of clients 2009.02.04 13:54:04 LOG7[2828:5672]: FD 224 in non-blocking mode 2009.02.04 13:54:04 LOG7[2828:5672]: SO_REUSEADDR option set on accept socket 2009.02.04 13:54:04 LOG3[2828:5672]: Error binding SQLServer to 127.0.0.1:31433 2009.02.04 13:54:04 LOG3[2828:5672]: bind: Permission denied (WSAEACCES) (10013) 2009.02.04 13:54:04 LOG3[2828:5672]: Server is down My stunnel.conf looks like this (actual IP address has been modified): ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ;output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [SQLServer] accept = 127.0.0.1:31433 connect = 85.15.135.121:443 ; In case of a proxy server, use: ;connect = 10.3.2.50:8080 ;protocol = connect ;protocolHost = 85.15.135.121:443

2 1

crl next update field functionality seems incorrect
by Steve Hoffman 04 Feb '09

04 Feb '09

Regarding this piece of code in verify.c: if(X509_cmp_current_time(next_update)<0) { s_log(LOG_WARNING, "Found CRL is expired - " "revoking all certificates until you get updated CRL"); X509_STORE_CTX_set_error(callback_ctx, X509_V_ERR_CRL_HAS_EXPIRED); X509_OBJECT_free_contents(&obj); return 0; /* reject connection */ } I don't believe this is correct functionality. The "next update" field is not an expiration of the CRL, but more of an indicator that you, as the holder of the CRL, should obtain a new one. Snippet from this link: http://www.netscape.ca/browser/netscape8/help/en/ssl_help.html#next_update About the "Next Update" Date The browser uses the CRLs it has available to check the validity of certificates issued by the corresponding CAs. If a certificate is listed as revoked, the browser won't accept it as evidence of identity. A CA typically publishes an updated CRL at regular intervals. Every CRL includes a date, specified in the Next Update field, by which the CA will publish the next update of that CRL. In general, if the date in the Next Update field is earlier than the current date, you should obtain the most recent version of the CRL. To view CRL information and set up automatic CRL updating, see Viewing and Managing CRLs. CAs are required to produce a new CRL by the Next Update date. However, the absence of the most recent CRL does not by itself invalidate a certificate. For this reason, if the most recent CRL is not available, a certificate may be validated even though the most recent CRL shows it as expired. Automatic CRL updating can help to avoid this situation. I'd like to suggest removing this check. Thanks, Steve

3 2

error compilation stunnel-4.11 for ARM9
by mailinglist 03 Feb '09

03 Feb '09

Did you ever receive a answer for your problem. Ic have the same problem now. checking for socklen_t... yes configure: **************************************** PTY device files checking for "/dev/ptmx"... configure: error: cannot check for file existence when cross compiling Thanks in advance for you help Ebse

1 0

stunnel tls wrapper/proxy for xmpp
by C.J. Adams-Collier 02 Feb '09

02 Feb '09

Hey all, I'm new here, and I didn't see anything relating to this after a quick glance at the archives. I'd like to start a stunnel connection connected to the google talk server and then connect finch up to that so that I can tap the clear xmpp session using tcpdump. Can one of you help me? Thanks in advance, C.J. cjac@sh0:~/stunnel$ cat stunnel.conf client = yes connect = el-in-f125.google.com:5222 foreground = yes pid = /tmp/stunnel4.pid debug = 7 cjac@sh0:~/stunnel$ stunnel-4.26/src/stunnel stunnel.conf 2009.02.02 21:31:13 LOG6[24798:140190659815120]: Unable to retrieve any random data from /home/cjac/.rnd 2009.02.02 21:31:13 LOG7[24798:140190659815120]: Wrote 0 new random bytes to /home/cjac/.rnd 2009.02.02 21:31:13 LOG7[24798:140190659815120]: RAND_status claims sufficient entropy for the PRNG 2009.02.02 21:31:13 LOG7[24798:140190659815120]: PRNG seeded successfully 2009.02.02 21:31:13 LOG7[24798:140190659815120]: SSL context initialized for service stunnel 2009.02.02 21:31:13 LOG5[24798:140190659815120]: stunnel 4.26 on x86_64-unknown-linux-gnu with OpenSSL 0.9.8c 05 Sep 2006 2009.02.02 21:31:13 LOG5[24798:140190659815120]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 2009.02.02 21:31:13 LOG7[24798:140190659815120]: stunnel started 2009.02.02 21:31:13 LOG7[24798:140190659815120]: FD 0 in non-blocking mode 2009.02.02 21:31:13 LOG7[24798:140190659815120]: FD 1 in non-blocking mode 2009.02.02 21:31:13 LOG7[24798:140190659815120]: FD 4 in non-blocking mode 2009.02.02 21:31:13 LOG7[24798:140190659815120]: stunnel connecting 209.85.163.125:5222 2009.02.02 21:31:13 LOG7[24798:140190659815120]: connect_wait: waiting 10 seconds 2009.02.02 21:31:14 LOG7[24798:140190659815120]: connect_wait: connected 2009.02.02 21:31:14 LOG5[24798:140190659815120]: stunnel connected remote server from 172.16.9.3:55967 2009.02.02 21:31:14 LOG7[24798:140190659815120]: Remote FD=4 initialized 2009.02.02 21:31:14 LOG7[24798:140190659815120]: SSL state (connect): before/connect initialization 2009.02.02 21:31:14 LOG7[24798:140190659815120]: SSL state (connect): SSLv3 write client hello A 2009.02.02 21:31:14 LOG7[24798:140190659815120]: SSL alert (write): fatal: handshake failure 2009.02.02 21:31:14 LOG3[24798:140190659815120]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2009.02.02 21:31:14 LOG5[24798:140190659815120]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.02.02 21:31:14 LOG7[24798:140190659815120]: stunnel finished (0 left)

2 1

Fwd: Stunnel & Zimbra
by Allen 02 Feb '09

02 Feb '09

Hi folks, I'm reposting this from my email address on file, because it was initially rejected (I think because I sent it from my main business address, which is not the address I have listed with this group. My apologies. ------------ I've been using stunnel with Zimbra, on OS X Sever since last year and it's been working well (SSL tunnels should be seen and not heard ;-). I upgraded Zimbra yesterday to a new version, that apparently was supposed to fix its instability running on the OS X platform. However, the upgrade wound up breaking the mail server's ability to send email. From Zimbra's web client, it appears like mail is getting sent (there's a little green sent mail box that pops up right after you click on the send button). Mail never arrives at the client end. I can still receive mail into the Zimbra account when I send to it from my business or personal email account. I provisoned and reloaded posffix, etc., and still can't receive mail on the other end. No stunnel settings have changed since before the upgrade. Here are the stunnel-related file outputs: ----------------------------------------------------------------- root# cat /opt/local/etc/stunnel/stunnel.conf client = yes foreground = no [smtps] accept = 5000 connect = server_name.x.y.com:465 (server name changed to protect the innocent ;-) ----------------------------------------------------------------- cat /opt/zimbra/conf/relay_password server_name.domain.com [email protected]:fakepassword --------------------------------------------- With the real usernames, password, domains, etc., those two (above) stunnel files worked perfectly well with stunnel, and sending mail was not a problem. That was --until I upgraded Zimbra. I realize that this is a stunnel forum and the Zimbra-related forum deals with all their issues. However, I'm wondering if somebody out there in stunnel land might have a light bulb going off regarding this issue. Perhaps there's something that I'm overlooking? Thanks! Allen

1 0

Identification Propagation patch using stunnel client certificates
by Christophe Nanteuil 02 Feb '09

02 Feb '09

Hello, NB : this patch is provided as alpha version : it handles only 1 request at a time for each administrative and ident servers. Why to use this patch ? This patch can be useful when : - you provide access to Internet via your stunnel server and when your legislation enforces you to keep logs of who connected where and when. In this case, you will have Squid logs filled with identification of stunnel clients in a very simple way : nothing to ask to the client as it uses automatically its certificate to fill in the identity fields. - you want to implement several profile access for your clients accessing your web proxy/server : as the proxy will ask ident request to stunnel, you can create filter groups to allow / denied access (with redirection to a page that you can customize) depending on stunnel answer : see filtergroups option of DansGuardian or acl options in squid. Patch to version : 4.26 Type : new feature Description : Identification Propagation using stunnel client certificates The patch proposes to extend the identification propagation provided by the directive 'EXEC=' to directive 'CONNECT=' when using client certificates. With EXEC directive, Subject name and Issuer Name of clients are put in environment variables, which allows the program to determine identity of the stunnel client. This patch adds an ident server functionality to stunnel, compliant with RFC 1413, to allow propagation of identification to remote hosts specified by the service directive 'CONNECT='. Additionnaly, this patch provides an admnistrative server "bound" to the Ident server : on the administrative socket (default port 127.0.0.1:790), you can request number of users currently connected and list them. How to use this patch ? You just have to add a 'identServer=yes' directive to services that you want to propagate identification. For example, you can use this patch when connecting to a DansGuardian web proxy (installed on proxy.example.com) with the option authplugin = '/etc/dansguardian/ authplugins/ident.conf' enabled in the configuration file (or when connecting to a Squid web proxy compiled with --enable-ident-lookups option), and the following stunnel configuration file (located in /etc/ssl/stunnel/stunnel-ident.conf) : ... [WEB] accept=8080 connect=proxy.example.com:8080 identServer=yes ... Stunnel will create a listening socket on 0.0.0.0:113 and answer requests initiated by DansGuardian. -- Christophe Nanteuil

2 4

Stunnel seems broken with oracle http server
by Mailing List SVR 01 Feb '09

01 Feb '09

Hi all, stunnel seems broken with https served by oracle http server, look at the following one for example: https://www.orange.sk/ I'm not able to have http->to https working with that web site, it is a stunnel specific problem or an oracle one? thanks Nicola

2 2

stunnel question when using two BCM5820 SSL accelerator card
by q p 30 Jan '09

30 Jan '09

Hello,stunnel-users I have two BCM5820 SSL accelerator card in one Freebsd 7.1 host. But when I plug in two ssl accel card and make stress test by Web Application Stress Tool , I get same banchmark ,about 70reqs/s , 50% cpu usage, as one ssl accel card in box. On another word, it seems only one accle card is working another one is idle. Is there someone has simialer problem as me? How to make the another card work? #pciconf -lv ubsec0@pci0:2:3:0: class=0x0b4000 card=0x001014e4 chip=0x582014e4 rev=0x10 hdr=0x00 vendor = 'Broadcom Corporation' device = 'BCM 5820 Crypto Accelerator' class = processor ubsec1@pci0:2:4:0: class=0x0b4000 card=0x001014e4 chip=0x582014e4 rev=0x10 hdr=0x00 vendor = 'Broadcom Corporation' device = 'BCM 5820 Crypto Accelerator' class = processor Stunnel Version 4.26 # make -D WITH_STUNNEL_SSL_ENGINE install clean Openssl Version 0.9.8e CPU P4 1.6A MEM 512M [root@proxy /usr/ports/security/stunnel]# stunnel -version stunnel 4.26 on i386-portbld-freebsd7.1 with OpenSSL 0.9.8e 23 Feb 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/tmp/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = AES:CAMELLIA:ALL:!ADH:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none [root@proxy /usr/ports/security/]# openssl version OpenSSL 0.9.8e 23 Feb 2007 BTW:MY SITE IS ALSO BOMBED BY MANY SPAM MAIL EVERYDAY, BUT NOT ALL MAILS FROM CHINESE IS SPAM, ACTUALLY USA IS THE SECOND SPAM SOURCE COUNTURY. ALL OF US HATE SPAM.

1 0

Feature request: set environment variable for inetd-type program
by Michael Renner 27 Jan '09

27 Jan '09

Moin, I am not a programmer, I am a writer and user, so I have to ask kindly for a additional stunnel feature I need the ability to push some information from the stunnel client side to the server side. To be more concrete: a self written script that is called by stunnels 'exec' statement need some settings, e.g. username and password. My idea is to configure this in the client side stunnel.conf and pass this as a environment variable to this script. There is no chance to pack these stings in a client certificate, because everybody who is able to handle snoop/tcpdump will be able to read this. I imagine a configuration like this: client stunnel.conf [foo] accept = 127.0.0.1:1234 connect = 192.0.20.0:443 env = "SUSER=renner" env = "SPASS=geheim" server stunnel.conf [foo] accept = 192.0.20.0:443 exec = /opt/foo/script.sh env = yes My question to the developers: do you think this is a helpful feature, also for others? Greetings -- |Michael Renner E-mail: michael.renner(a)gmx.de | |D-81541 Munich Germany ICQ: #112280325 | |Germany Don't drink as root! ESC:wq

4 4

Stunnel 4.26 - AIX 5.3
by Spence, Thomas Civ 844 CS/SCBX 26 Jan '09

26 Jan '09

Dear Users, * I'm running Stunnel 4.26 as a service, but it dies on logoff... * Could you tell me which one should I put comment "/* ... */" at stunnel.c or protocol.c so I want stunnel's daemon won't stop running. * I am using stunnel.conf, like this: ------- pid = cert = /usr/local/ssl/private/stunnel.pem output = stunnel.log [tssl] accept = 992 exec = /usr/sbin/telnetd ------- *stunnel.log ------- [/usr/local/etc/stunnel]# cat *.log 2009.01.21 16:42:54 LOG7[462906:1]: Snagged 64 random bytes from //.rnd 2009.01.21 16:42:54 LOG7[462906:1]: Wrote 1024 new random bytes to //.rnd 2009.01.21 16:42:54 LOG7[462906:1]: RAND_status claims sufficient entropy for the PRNG 2009.01.21 16:42:54 LOG7[462906:1]: PRNG seeded successfully 2009.01.21 16:42:55 LOG7[462906:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2009.01.21 16:42:55 LOG7[462906:1]: Certificate loaded 2009.01.21 16:42:55 LOG7[462906:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2009.01.21 16:42:55 LOG7[462906:1]: Private key loaded 2009.01.21 16:42:55 LOG7[462906:1]: SSL context initialized for service tssl 2009.01.21 16:42:55 LOG5[462906:1]: stunnel 4.26 on powerpc-ibm-aix5.3.0.0 with OpenSSL 0.9.8j 07 Jan 2009 2009.01.21 16:42:55 LOG5[462906:1]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2009.01.21 16:42:55 LOG6[462906:1]: file ulimit = 65534 (can be changed with 'ulimit -n') 2009.01.21 16:42:55 LOG6[462906:1]: poll() used - no FD_SETSIZE limit for file descriptors 2009.01.21 16:42:55 LOG5[462906:1]: 31999 clients allowed 2009.01.21 16:42:55 LOG7[462906:1]: FD 10 in non-blocking mode 2009.01.21 16:42:55 LOG7[462906:1]: FD 11 in non-blocking mode 2009.01.21 16:42:55 LOG7[462906:1]: FD 12 in non-blocking mode 2009.01.21 16:42:55 LOG7[462906:1]: SO_REUSEADDR option set on accept socket 2009.01.21 16:42:55 LOG7[462906:1]: tssl bound to 0.0.0.0:992 2009.01.21 16:42:55 LOG7[540758:1]: No pid file being created 2009.01.21 16:43:17 LOG7[540758:1]: tssl accepted FD=0 from x.x.x.x:3532 2009.01.21 16:43:17 LOG7[540758:258]: tssl started 2009.01.21 16:43:17 LOG7[540758:258]: FD 0 in non-blocking mode 2009.01.21 16:43:17 LOG7[540758:258]: Waiting for a libwrap process 2009.01.21 16:43:17 LOG7[540758:258]: Acquired libwrap process #0 2009.01.21 16:43:17 LOG7[540758:258]: Releasing libwrap process #0 2009.01.21 16:43:17 LOG7[540758:258]: Released libwrap process #0 2009.01.21 16:43:17 LOG7[540758:258]: tssl permitted by libwrap from x.x.x.x:3532 2009.01.21 16:43:17 LOG5[540758:258]: tssl accepted connection from x.x.x.x:3532 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): before/accept initialization 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 read client hello A 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 write server hello A 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 write certificate A 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 write server done A 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 flush data 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 read client key exchange A 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 read finished A 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 write change cipher spec A 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 write finished A 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 flush data 2009.01.21 16:43:17 LOG7[540758:258]: 1 items in the session cache 2009.01.21 16:43:17 LOG7[540758:258]: 0 client connects (SSL_connect()) 2009.01.21 16:43:17 LOG7[540758:258]: 0 client connects that finished 2009.01.21 16:43:17 LOG7[540758:258]: 0 client renegotiations requested 2009.01.21 16:43:17 LOG7[540758:258]: 1 server connects (SSL_accept()) 2009.01.21 16:43:17 LOG7[540758:258]: 1 server connects that finished 2009.01.21 16:43:17 LOG7[540758:258]: 0 server renegotiations requested 2009.01.21 16:43:17 LOG7[540758:258]: 0 session cache hits 2009.01.21 16:43:17 LOG7[540758:258]: 0 session cache misses 2009.01.21 16:43:17 LOG7[540758:258]: 0 session cache timeouts 2009.01.21 16:43:17 LOG6[540758:258]: SSL accepted: new session negotiated 2009.01.21 16:43:17 LOG6[540758:258]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2009.01.21 16:43:17 LOG7[540758:258]: bind#1: Invalid argument (22) 2009.01.21 16:43:17 LOG7[540758:258]: bind#2: Invalid argument (22) 2009.01.21 16:43:17 LOG6[540758:258]: Local mode child started (PID=639170) 2009.01.21 16:43:17 LOG7[540758:258]: Remote FD=13 initialized 2009.01.21 16:43:34 LOG7[540758:258]: Socket closed on read 2009.01.21 16:43:34 LOG7[540758:258]: SSL write shutdown 2009.01.21 16:43:34 LOG7[540758:258]: SSL alert (write): warning: close notify 2009.01.21 16:43:34 LOG6[540758:258]: SSL socket closed on SSL_shutdown 2009.01.21 16:43:34 LOG7[540758:258]: Socket write shutdown 2009.01.21 16:43:34 LOG5[540758:258]: Connection closed: 8360 bytes sent to SSL, 101 bytes sent to socket 2009.01.21 16:43:34 LOG7[540758:258]: tssl finished (0 left) ------- Your help will be appreciate... Thank you. ________________________________ Tom Spence AIX Sys Adm ABIDES System Support 844th CS/SCBX Pentagon - MD822

3 10

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users