stunnel-users

5 participants
3315 discussions

stunnel on Windows with pkcs11
by Neil M. 10 Nov '06

10 Nov '06

Can anyone provide more details in how to get this setup working? I've setup stunnel in client mode just fine for normal SSL operations, but now I need to load a client certificate from a token. I've looked at the example in the documentation and changed the paths accordingly, but that doesn't seem to work, stunnel errors out complaining about a DSO. Neil

1 0

FD_SETSIZE and file ulimit
by Arunkumar Arumugam 10 Nov '06

10 Nov '06

Hi Guys - I have a stunnel setup in a linux box kernel 2.4 Advanced sever release 2.1AS (pensacola) . I am trying to increase the number of file descriptors with which stunnel could handle. So I did a ulimit -n 4096 for root and restarted the stunnel process. Now in the stunnel logs i see, ..... FD_SETSIZE=1024, file ulimit=4096- > 500 clients allowed. I dont completely understand the relation between FD_SETSIZE and file ulimit. I also read that a single stunnel connection might use around 2 or 3 file descriptors. So what is the cap on the number of file descriptors used by stunnel. To make it use , around 4096 file descriptors should i recompile the stunnel again with FD_SETSIZE set to 4096.? -- ARUN ARUMUGAM Galbraith's Law of Human Nature: Faced with the choice between changing ones' mind and proving that there is no need to do so, almost everybody gets busy on the proof.

2 1

stunnel 4.16 wrapped around an ldap server causing very slow binds
by Mark McCoy 05 Nov '06

05 Nov '06

Hey all, I have an instance of stunnel 4.16 on Solaris 10 that I am trying to use to wrap Sun Directory Server LDAP traffic in SSL. LDAP 'binds' take over 2 minutes to complete using stunnel, but only a split second (as they should) when using an SSH tunnel. I have disabled tcpwrappers per the stunnel FAQ with no results, and tried settting delay = "yes" and "no", with no differences in the results. An interesting thing is that if I try to bind using the wrong password, the "Invalid Credentials" error returns immediately. Using the correct password, the bind hangs for over 2 minutes. Any ideas on what to look for? ------------- Output of stunnel -version: stunnel 4.16 on sparc-sun-solaris2.10 with OpenSSL 0.9.8c 05 Sep 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Global options debug = 5 pid = /usr/local/stunnel/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/stunnel/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /usr/local/stunnel/etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none -------------- -- Mark McCoy -- Professional Unix geek Here in America we are descended in blood and in spirit from revolutionists and rebels - men and women who dared to dissent from accepted doctrine. As their heirs, may we never confuse honest dissent with disloyal subversion. -- Dwight D. Eisenhower

2 1

newbie sendmail + smtp question
by Fred nietzsche 03 Nov '06

03 Nov '06

My ISP requires all my mail to go to mail.myISP.net via SSL to port 465. I have sendmail compiled with STARTTLS, configured authinfo and I've set up sendmail's smarthost to send everything to mail.myISP.net I run stunnel like this. stunnel /etc/stunnel/stunnel.conf -c -d 25 -r mail.myISP.net:465 There are no errors in the log. I can see stunnel listening on 25 with netstat. When I try to send mail I get: bash-3.00# sendmail -v sc00b123(a)yahoo.com <test sc00b123(a)yahoo.com... Connecting to [127.0.0.1] via relay... Which just hangs for ever. My stunnel.conf looks like: cert = /etc/stunnel/mail.pem chroot = /var/stunnel/ setuid = nobody setgid = nogroup pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel.log [smtp] accept = 25 connect = 465 Thanks for any help, hints, etc.. --------------------------------- Low, Low, Low Rates! Check out Yahoo! Messenger's cheap PC-to-Phone call rates.

1 0

stunnel[2840]: Error binding pop3s to 0.0.0.0:995
by fxper 02 Nov '06

02 Nov '06

I'm trying to use stunnel on a redhat machine to securely check email, via xinetd via pop3d. My /etc/xinetd.d/pop3s looks like this: service pop3s { socket_type = stream wait = no user = root server = /usr/sbin/stunnel log_on_success += USERID log_on_failure += USERID disable = no } And netstat just shows xinetd on 995: netstat -apn|grep 995 tcp 0 0 0.0.0.0:995 0.0.0.0:* LISTEN 2797/xinetd When I try to check mail with my client hitting port 995, I get this in /var/log/secure using debug level 7: Nov 1 16:17:24 myhostname xinetd[2797]: START: pop3s pid=2840 from=x.x.x.x Nov 1 16:17:54 myhostname stunnel[2840]: stunnel 4.04 on i386-redhat-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 Nov 1 16:17:54 myhostname stunnel[2840]: Snagged 64 random bytes from /dev/urandom Nov 1 16:17:54 myhostname stunnel[2840]: RAND_status claims sufficient entropy for the PRNG Nov 1 16:17:54 myhostname stunnel[2840]: PRNG seeded successfully Nov 1 16:17:54 myhostname stunnel[2840]: Certificate: /usr/share/ssl/certs/stunnel.pem Nov 1 16:17:54 myhostname stunnel[2840]: Key file: /usr/share/ssl/certs/stunnel.pem Nov 1 16:17:54 myhostname stunnel[2840]: FD_SETSIZE=1024, file ulimit=1024 -> 500 clients allowed Nov 1 16:17:54 myhostname stunnel[2840]: FD 4 in non-blocking mode Nov 1 16:17:54 myhostname stunnel[2840]: SO_REUSEADDR option set on accept socket Nov 1 16:17:54 myhostname stunnel[2840]: Error binding pop3s to 0.0.0.0:995 Nov 1 16:17:54 myhostname stunnel[2840]: bind: Address already in use (98) Any suggestions? Thanks! --------------------------------- Want to start your own business? Learn how on Yahoo! Small Business.

1 0

How to disable SSLv2
by Tommi Nieminen 30 Oct '06

30 Oct '06

I'm using Stunnel 4.18. I would like to disable SSLv2, but allow SSLv3 and TLSv1. Is this currently possible in Stunnel? I've tried two things so far: first I tried to use the option options = SSL_OP_NO_SSLv2 (from "man SSL_CTX_set_options") It didn't work. This is what I got: 2006.10.27 18:32:48 LOG7[6358:3082897088]: Snagged 64 random bytes from /root/.rnd 2006.10.27 18:32:48 LOG7[6358:3082897088]: Wrote 1024 new random bytes to /root/.rnd 2006.10.27 18:32:48 LOG7[6358:3082897088]: RAND_status claims sufficient entropy for the PRNG 2006.10.27 18:32:48 LOG7[6358:3082897088]: PRNG seeded successfully file /etc/stunnel/stunnel.conf line 18: Illegal SSL option Nothing gets logged, the above is the response to the startup command. The other thing I tried, though I really didn't expect it to work, was replacing the "options" option with sslVersion = SSLv3 TLSv1 This option seems to accept only one version at a time, or alternatively all of them with "all" on the right hand side, so this failed, stunnel didn't start. Any suggestions? The only thing I can think of is that the SSL option SSL_OP_NO_SSLv2 is something that should have been when configuring the OpenSSL installation, and since I have a readily wrapped package, it has not been included there. In that case I could install OpenSSL from the scratch. But before I try that, I thought I would ask if somebody were already familiar with the problem. Tommi Nieminen --------------------------------------------------- Here is the stunnel config file I was using: CAfile = /etc/stunnel/root-cert.pem cert = /etc/stunnel/device-cert.pem key = /etc/stunnel/device-key.pem output = /var/log/stunnel/stunnel.log pid = /var/run/stunnel/stunnel.pid debug = 7 client = no [https] accept = 443 connect = 192.168.10.17:5010 verify = 1 options = SSL_OP_NO_SSLv2 ;sslVersion = SSLv3 TLSv1

2 2

stunnel patch for extra logging
by Steven Van Acker 29 Oct '06

29 Oct '06

Hi, we use stunnel in server-mode where an SSL enabled client can connect to our stunnel, and then stunnel connects to a non-SSL backend server. The backend server logs incoming connections from stunnel (source IP and port), but stunnel doesn't log the same information. This makes it difficult to match logs between stunnel and the backend. This patch solves exactly this problem. I rewrote the patch so that it can be cleanly applied to any future (and past) version of stunnel. >From the website: "How do I get a patch included into the release versions of Stunnel? Only patches released into the public domain stand a chance of getting into the actual Stunnel source. This means revised BSD patches are likely acceptable. Original BSD and GNU patches are not for example." Since I would like very much that this patch makes it into the next release, I'll release it into the public domain or any other license that makes this possible. kind regards, Steven -- My amazon wishlist: http://www.amazon.com/gp/registry/1DB4XNEIEQBPB

2 1

Re: [stunnel-users] Fork Error
by Michal Trojnara 29 Oct '06

29 Oct '06

On Friday 27 October 2006 22:39, John O'Fallon wrote: > I do believe, though, that the problem is due to a change in Stunnel > between version 4.15 and 4.17, since the crash occurs when running > 4.17, but reverting to 4.15 on exactly the same system clears it up. > I have seen this on at least 2 different Mac servers. Please make some tests for me: 1. Try: ./configure --disable-libwrap make clean make make install 2. Check if there are some zombies produced by stunnel. 3. Include your configuration file and the output of "stunnel -version" with your next email. Best regards, Mike

1 0

SMTP & TLS
by Eric B. 27 Oct '06

27 Oct '06

Hi, I've been looking over using stunnel to secure SMTP connections, but am a little confused about how the protocol works. From what I've read, the STARTTLS command is used to allow a client/server to upgrade a connection from plaintext to SSL secured. Further to that, from what I understand, the concept is to allow/use a single port to initiate all connections - ex: port 25. >From what I can tell from stunnel however, is that once stunnel issues the STARTTLS command, if the client doesn't respond in kind, then the connection is terminated. I've tried reading the RFC, but can't seem to find what happens in the case where the client rejects or does not respond to the STARTTLS command. Logicially, I would expect the SMTP connection to continue normally in plaintext. Apparently, this is not how stunnel works. Can someone please help fill in the blanks for me please? What is supposed to happen if the client refuses the STARTTLS request from the server? If the connection is supposed to die, why bother with the STARTTLS request at all, and not just impose the SSL encrypted tunnel from the very beginning (as per the old SSMTP specs)? Thanks, Eric

1 0

Fork Error
by John O'Fallon 27 Oct '06

27 Oct '06

Since upgrading to Stunnel 4.17, I occasionally get the following error: 2006.10.18 23:08:45 LOG3[7007:25232896]: fork: Resource temporarily unavailable (35) 2006.10.18 23:08:45 LOG5[7007:25232896]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket The problem doesn't occur right away, but after some number of hits on the server. Reverting to Stunnel 4.15 corrects the problem. This is an OS X 10.4 Mac. I haven't confirmed the problem with 4.18, because the release notes indicate mainly changes relevant to Win32. Has any one else seen the problem? Michal, any thoughts? TIA, John

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users