stunnel-users

4 participants
3315 discussions

Infinite client timeout
by Dario Mariani 18 Oct '06

18 Oct '06

Hi all, i'm a new user :) I'm deploying stunnel into a big enterprise, so i have met a lot of interesting details about Stunnel :) I have a little problem now: a Stunnel channel connecting BEA Weblogic -> Oracle listener. BEA has the BIG problem of _completely locking_ when the connection goes down: when the connection comes up again, bea doesn't work. This is not an issue, because there's a keepalive feature that can be activated in BEA. In a case, we _cannot_ activate the keepalive, so we must try to keep the BEA -> stunnel client conection open indefinitely. I think this must apply to the other parts of the connection, but i'm not sure (if the bea -> client connection remains active, the client then can renegotiate the connection without bea noticing it? and the server -> oracle connection?) Ok, i'm a little confused here :) Can you help me with this issue? Bye, dario.

1 0

New feature - PayPal donations
by Michal Trojnara 16 Oct '06

16 Oct '06

Dear Users, Since PayPal finally decided to provide full support for users in Poland I've added a donation button on the web page. http://stunnel.mirt.net/ I really appreciate each donation. 8-) Best regards, Mike

1 0

"Peer suddenly disconnected" after upgrade to 4.18
by Asarian 13 Oct '06

13 Oct '06

Hello, I'm a long time user of stunnel. Yesterday I finally upgraded to stunnel 4.18. Can't get it to work anymore, though. :( Here is the relevant part of my config: ----------------------- cert = /etc/stunnel.pem key = /etc/stunnel.pem ciphers = ALL:!ADH:RC4+RSA:+SSLv2:@STRENGTH sslVersion = SSLv2 setuid = nobody setgid = nobody socket = l:TCP_NODELAY=1 debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none [pop3s] accept = 995 exec = /usr/local/libexec/inet-qpopper execargs = inet-qpopper -s transparent = yes [imaps] accept = 993 exec = /usr/local/libexec/imapd execargs = imapd transparent = yes ----------------------- With the exception of a few keyword changes, this is the config I've always used. But I always get these errors now: Oct 14 00:57:40 asarian-host stunnel: LOG5[49682:134621184]: pop3s connected from 192.168.79.4:2576 Oct 14 00:57:40 asarian-host stunnel: LOG3[49682:134621184]: SSL_accept: Peer suddenly disconnected Oct 14 00:57:40 asarian-host stunnel: LOG3[49682:134621184]: SSL_accept: Peer suddenly disconnected Oct 14 00:57:40 asarian-host stunnel: LOG5[49682:134621184]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Oct 14 00:57:40 asarian-host stunnel: LOG5[49682:134621184]: pop3s connected from 192.168.1.4:2579 Oct 14 00:57:40 asarian-host stunnel: LOG3[49682:134621184]: SSL_accept: Peer suddenly disconnected Oct 14 00:57:40 asarian-host stunnel: LOG5[49682:134621184]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket The cert and key are good (I use em for Apache, too). I also tried SSLv3, but got this error: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number But I like to get it working with SSLv2 first; then I'll worry about the other thing later. :) I hope someone can tell me what I'm doing wrong. Thanks, - Mark

1 0

SegFault with stunnel
by Beyerle, Christian 12 Oct '06

12 Oct '06

Hello Everyone, I try to encrypt a Mysql-Connection between two host which run Suse Linux 10.1. On the Server runs a mysql database, on the client runs barnyard (a plugin for snort) which should write into the mysql database. I installed stunnel 4.14 on x86_64-suse-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 on both servers. The Configuration file on the Server (mysql) looks like: client = no debug = 7777777 output = /var/log/stunnel.log [mysqls] accept = 10439 connect = 127.0.0.1:3306 Stunnel seems to run well: lsof -i -n | grep stunnel stunnel 25330 stunnel 6u IPv4 371490 TCP *:10439 (LISTEN) On the client: [mysqls] client = yes accept = 127.0.0.1:3306 connect = 172.16.1.80:10439 Stunnel seems to run as well as on the server: stunnel 16634 stunnel 6u IPv4 22487 TCP 127.0.0.1:mysql (LISTEN) If i start barnyard that should connect to port 3306, barnyard cannot open the port and quits. I looked in my syslog and found the following entry: Oct 12 14:10:28 CLIENT kernel: stunnel[10991]: segfault at 0000000055697fb0 rip 000055555555b793 rsp 00005555556b0520 error 4 Oct 12 14:10:28 CLIENT barnyard[10997]: FATAL ERROR: Failed to connect to database snort:[email protected]/sensors: Lost connection to MySQL server during query Oct 12 14:10:28 CLIENT barnyard[10997]: Exiting I find no log of stunnel which help me to understand the reason of the crash. After this stunnel not too seem runnign anymore on the port: lsof -i -n | grep stunnel (no output) Does anybody have an idea??? Thank you for the help, -- Chris

1 0

[stunnel-users]Plan for new authorisation method in Stunnel
by Thomas Thiele 11 Oct '06

11 Oct '06

Hello Stunnel Users, I am planning to develop a new authorisation method for Stunnel which I need for work. This method will be an addition to the existing methods for checking certificates. The idea is to use the subject names and the alternative names of the certificates to allow or drop connections. The subject and alternative names of the machines/clients that are allowed to connect to the server will be written into the Stunnel config. While checking the certificates, the subject and alternative names from the Stunnel config will be compared with the subject and alternative names in the certirficate from the connection request. If one of the names from the Stunnel config matches with the names from the certificate then the connection will be allowed. This is the basic idea of my project. Is anyone already working on something like that or do you have any ideas or suggestions for me? Best Regards, Thomas Thiele -- GMX DSL-Flatrate 0,- Euro* - Überall, wo DSL verfügbar ist! NEU: Jetzt bis zu 16.000 kBit/s! http://www.gmx.net/de/go/dsl

2 1

libstunnel.so
by Andrew Schulman 05 Oct '06

05 Oct '06

The Debian stunnel (actually stunnel4) package includes /usr/lib/libstunnel.so. I have two questions about this file: (1) What is its purpose? ldd shows that /usr/bin/stunnel doesn't depend on it. So is this the shared library referred to in stunnel(1), under the 'transparent' option? The man page says that to use 'transparent' one has to LD_PRELOAD env.so, but I don't find any env.so. I see that env.c is used in building libstunnel.a, so I'm guessing that the man page meant to say libstunnel.so instead of env.so. (2) How does one build it? configure includes a --with-shared-libs option, but even when that's enabled I don't get a libstunnel.so when I build. And I can't find any make targets for any .so files. Yet Debian includes this file. Thanks, Andrew.

1 0

Configure can't find openssl in Ubuntu
by Tommi Nieminen 04 Oct '06

04 Oct '06

Hello, I have an Ubuntu 6.06.1 (Dapper) where I'm trying to install Stunnel. First I tried to install Stunnel using Ubuntu's package manager (apt-get install stunnel4). The installation went very smoothly but the fact that stunnel didn't recognize the -V switch left me with an uneasy feeling that something else might be lacking, too. The Ubuntu package in question contains Stunnel 4.14. Stunnel 3.26, installed from another package, does recognize the -V switch. So then I tried several times installing stunnel from source. A few obstacles I managed to overcome, but now that the configure script stops telling that it can't find SSL directory checking for SSL directory... Not found Couldn't find your SSL library installation dir Use --with-ssl option to fix this problem I'm out of resources. The script seems to check the existence of ssl.h file: checkssldir() { : if test -f "$1/include/openssl/ssl.h" Despite the fact that I have OpenSSL 0.9.8a on my machine, I don't have ssl.h file anywhere, I checked that with find. I tried installing Linux headers, but that didn't help (well I didn't expect it to help, but I couldn't think of anything). Is there some package I should get, that doesn't come with the openssl package or how should I solve this problem? Any ideas? Another problem that I had when I was experimenting with Stunnel 3.26 was the fact, that I couldn't start it up. It kept asking for the -r or -l switch. What I want to do with Stunnel is to decrypt the traffic coming in on one interface and then forward it to another machine through another interface. I tried several different configuration files, this is one of them (without indentations): cert = stunnel.pem key = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 1 debug = 7 output = stunnel.log client = no [https] accept = 443 connect = 192.168.10.17:5010 TIMEOUTclose = 0 I didn't get any debug information and -f switch didn't give anything more. I tried the Windows version (4.18) on another pc and it seemed to do exactly what I wanted. (the config file may have been slightly different, at least no debug was set. I really would like to get this working on a Linux box, too. Tommi Nieminen

3 3

Convert to SSL
by Bob 04 Oct '06

04 Oct '06

Hello all, I have been looking online at the examples but can't seem to quite figure out how to do this. We are currently using stunnel to receive SSL message and redirect them as regular messages but now I need to go the other way first. Is it possible to setup stunnel to receive an non-SSL messages and redirect it as an SSL message? and can this be done in the current config file or do I have to run 2 stunnel daemons? Also, the new one has to validate certificates. -- _______________________________________________________________________ Thanks, Bob (bobif(a)adelphia.net) YahooIM: bobifx AOLIM: bobifmd ICQ: 111083556

1 0

"SSL3_GET_RECORD:wrong version number" error
by James Brown 04 Oct '06

04 Oct '06

I am having problems connecting to stunnel and was hoping someone could help me. When starting stunnel and then trying to send an SSL-encrypted email through it I get: $ sudo /usr/local/sbin/stunnel /sw/etc/stunnel/stunnel.conf -D 465 -r 25 2006.10.04 11:03:28 LOG7[29230:2684415368]: Snagged 64 random bytes from /Users/jlbrown/.rnd 2006.10.04 11:03:28 LOG7[29230:2684415368]: Wrote 1024 new random bytes to /Users/jlbrown/.rnd 2006.10.04 11:03:28 LOG7[29230:2684415368]: RAND_status claims sufficient entropy for the PRNG 2006.10.04 11:03:28 LOG7[29230:2684415368]: PRNG seeded successfully 2006.10.04 11:03:28 LOG7[29230:2684415368]: Certificate: /Users/ jlbrown/%1.pem 2006.10.04 11:03:28 LOG7[29230:2684415368]: Certificate loaded 2006.10.04 11:03:28 LOG7[29230:2684415368]: Key file: /Users/jlbrown/% 1.pem 2006.10.04 11:03:28 LOG7[29230:2684415368]: Private key loaded 2006.10.04 11:03:28 LOG7[29230:2684415368]: SSL context initialized for service ssmtp 2006.10.04 11:03:28 LOG5[29230:2684415368]: stunnel 4.18 on powerpc- apple-darwin8.8.0 with OpenSSL 0.9.7i 14 Oct 2005 2006.10.04 11:03:28 LOG5[29230:2684415368]: Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv4 Auth:LIBWRAP 2006.10.04 11:03:28 LOG6[29230:2684415368]: file ulimit = 256 (can be changed with 'ulimit -n') 2006.10.04 11:03:28 LOG6[29230:2684415368]: FD_SETSIZE = 1024 (some systems allow to increase this value) 2006.10.04 11:03:28 LOG5[29230:2684415368]: 125 clients allowed 2006.10.04 11:03:28 LOG7[29230:2684415368]: FD 6 in non-blocking mode 2006.10.04 11:03:28 LOG7[29230:2684415368]: FD 7 in non-blocking mode 2006.10.04 11:03:28 LOG7[29230:2684415368]: FD 8 in non-blocking mode 2006.10.04 11:03:28 LOG7[29230:2684415368]: SO_REUSEADDR option set on accept socket 2006.10.04 11:03:28 LOG7[29230:2684415368]: ssmtp bound to 0.0.0.0:465 James-Browns-Computer-2:~/stunnel-4.18 jlbrown$ 2006.10.04 11:03:28 LOG7[29231:2684415368]: Created pid file /usr/local/var/run/stunnel/ stunnel.pid 2006.10.04 11:08:08 LOG7[29231:2684415368]: ssmtp accepted FD=9 from 127.0.0.1:64235 2006.10.04 11:08:08 LOG7[29231:25188864]: ssmtp started 2006.10.04 11:08:08 LOG7[29231:25188864]: FD 9 in non-blocking mode 2006.10.04 11:08:08 LOG7[29231:25188864]: TCP_NODELAY option set on local socket 2006.10.04 11:08:08 LOG7[29231:25188864]: FD 10 in non-blocking mode 2006.10.04 11:08:08 LOG7[29231:25188864]: FD 11 in non-blocking mode 2006.10.04 11:08:08 LOG7[29231:25188864]: Connection from 127.0.0.1:64235 permitted by libwrap 2006.10.04 11:08:08 LOG5[29231:25188864]: ssmtp connected from 127.0.0.1:64235 2006.10.04 11:08:08 LOG7[29231:2684415368]: Cleaning up the signal pipe 2006.10.04 11:08:08 LOG7[29231:25188864]: FD 10 in non-blocking mode 2006.10.04 11:08:08 LOG7[29231:25188864]: ssmtp connecting 127.0.0.1:25 2006.10.04 11:08:08 LOG7[29231:25188864]: connect_wait: waiting 10 seconds 2006.10.04 11:08:08 LOG6[29231:2684415368]: Child process 29421 finished with code 0 2006.10.04 11:08:08 LOG7[29231:25188864]: connect_wait: connected 2006.10.04 11:08:08 LOG7[29231:25188864]: Remote FD=10 initialized 2006.10.04 11:08:08 LOG7[29231:25188864]: TCP_NODELAY option set on remote socket 2006.10.04 11:08:08 LOG7[29231:25188864]: SSL state (connect): before/ connect initialization 2006.10.04 11:08:08 LOG7[29231:25188864]: SSL state (connect): SSLv3 write client hello A 2006.10.04 11:08:08 LOG7[29231:25188864]: SSL alert (write): fatal: handshake failure 2006.10.04 11:08:08 LOG3[29231:25188864]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2006.10.04 11:08:08 LOG5[29231:25188864]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.10.04 11:08:08 LOG7[29231:25188864]: ssmtp finished (0 left) Any suggestions as to what is causing this and how I can fix it? I got the same thing on another machine, with stunnel 4.04 and OpenSSL 0.9.7d. My stunnel.conf file is: cert = /Users/jlbrown/%1.pem key = /Users/jlbrown/%1.pem debug=7 output=/dev/stdout ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Service-level configuration [ssmtp] client = yes accept = 465 connect = 192.168.1.31:25 Thanks, James.

2 1

Thanks
by Eric S. Eberhard 03 Oct '06

03 Oct '06

For the help ... I believe I got it. Was I got that debug bug fixed I could tell what was going on. In the end I just stopped fighting it and downloaded prngd and ran it for a while. Interestingly, once I did this, it continues to work fine w/out prngd up and running. It did something I don't understand to my random file (apparently the old one was not good enough) and now it works!##$ Don't understand it, but it works! I still have some other application problem but I appear to get responses now. Thanks, Eric This email sent by: Eric S. Eberhard (928) 567-3727 Voice (928) 567-6122 Fax 928-301-7537 -- you may call any time day or night, I turn it off when I sleep :-) Please try to use a land line first (reception often poor). Note the change in the domain from vicspdi.com to vicsmba.com !!!! For Metropolis support and VICS MBA Support!!!! http://www.vicsmba.com Completely updated web site of personal pictures with many new pictures! Includes horses, dogs, Corvairs, and more. http://www.vicsmba.com/ourpics/index.html Corvair pictures including the Judson setup on our 62 Sedan and lots of pictures of Cheryl's 62 Monza Wagon and our 62 Spyder convertible. http://www.vicsmba.com/ourpics/corvairs.html My younger brother Martin has started a very serious car company. A hot rod (very fast) electric roadster is the first offering. The chassis is built by Lotus to their specs. Check it out: http://www.teslamotors.com

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users