stunnel-users

4 participants
3309 discussions

stunnel problem on hp-ux 11.11
by matt.miller＠accenture.com 13 Sep '06

13 Sep '06

System specs: HP-UX 11.11 Stunnel 4.15 OpenSSL 0.8.7i Config File: ; Certificate/key is needed in server mode and optional in client mode ;cert = /opt/iexpress/stunnel/etc/stunnel/mail.pem ;key = /opt/iexpress/stunnel/etc/stunnel/mail.pem ; Some security enhancements for UNIX systems - comment them out on Win32 ;chroot = /opt/iexpress/stunnel/var/lib/stunnel/ ;setuid = nobody ;setgid = nogroup ; PID is created inside chroot jail pid = /tmp/stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /opt/iexpress/stunnel/etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /opt/iexpress/stunnel/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ;foreground = yes output = stunnel.log ; Service-level configuration [pop3s] ; Use it for client mode client = yes ;accept = 995 ;connect = 110 accept = localhost:110 connect = POP3S.MAILSERVER:995 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini Problem: When I try to execute the following command "telnet localhost 110" I get an entry in the stunnel log file and I am unable to connect to the secure pop3 server. I know that this is not a firewall issue because I can telnet directly to the POP3S.MAILSERVER on port 995 and establish a connection, I also know that the server works fine because I set up stunnel on my windows xp machine and that did not have a problem establishing a connection. Any help on this issue would be great. Here is the log I am getting 2006.08.10 18:23:03 LOG5[16138:1]: stunnel 4.15 on hppa2.0w-hp-hpux11.11 with Op 2006.08.10 09:43:55 LOG5[7158:1]: 2000 clients allowed 2006.08.10 09:43:55 LOG7[7158:1]: FD 4 in non-blocking mode 2006.08.10 09:43:55 LOG7[7158:1]: FD 5 in non-blocking mode 2006.08.10 09:43:55 LOG7[7158:1]: FD 6 in non-blocking mode 2006.08.10 09:43:55 LOG7[7158:1]: SO_REUSEADDR option set on accept socket 2006.08.10 09:43:55 LOG7[7158:1]: pop3s bound to 127.0.0.1:110 2006.08.10 09:43:55 LOG7[7263:1]: Created pid file /tmp/stunnel.pid 2006.08.10 16:15:45 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57040 2006.08.10 16:15:45 LOG3[7263:1]: Connection rejected: create_client failed 2006.08.10 16:30:34 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57156 2006.08.10 16:30:34 LOG3[7263:1]: Connection rejected: create_client failed 2006.08.10 16:45:34 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57275 2006.08.10 16:45:34 LOG3[7263:1]: Connection rejected: create_client failed 2006.08.10 17:00:36 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57401 2006.08.10 17:00:36 LOG3[7263:1]: Connection rejected: create_client failed 2006.08.10 17:15:36 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57506 2006.08.10 17:15:36 LOG3[7263:1]: Connection rejected: create_client failed 2006.08.10 17:30:35 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57614 2006.08.10 17:30:35 LOG3[7263:1]: Connection rejected: create_client failed Matt T. Miller Accenture Minneapolis, MN USA 612-277-1826 aim: mttmiller8 email: matt.miller(a)accenture.com This message is for the designated recipient only and may contain privileged, proprietary, or otherwise private information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the email by you is prohibited.

1 0

RE: [stunnel-users] stunnel and AJP
by Jones Scott - sjones 13 Sep '06

13 Sep '06

Any chance you could send me a sample configuration file? :) Just got it install and going to start trying to get it setup. I am going to try to end the tunnel on a BigIP box. So just set it up on the apache server and hope it can end on the BigIP box. Thanks -----Original Message----- From: Richard.Hall [mailto:[email protected]] Sent: Friday, August 25, 2006 4:08 PM To: Jones Scott - sjones Cc: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] stunnel and AJP Jason, On Fri, 25 Aug 2006, Jones Scott - sjones wrote: > Has anyone used stunnel to secure AJP traffic from apache to jboss Short answer: Yes. - Apache + mod_jk configured to talk to stunnel client on localhost rather than to JBoss AJP13 port - stunnel client talks to remote stunnel server - stunnel server talks to JBoss AJP13 port on _its_ localhost. Works a treat :-) We've even done it with a third machine in the middle, running an stunnel server and client back-to-back. Just don't ask why! HTH, Richard ************************************************************************* The information contained in this communication is confidential, is intended only for the use of the recipient named above, and may be legally privileged. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please resend this communication to the sender and delete the original message or any copy of it from your computer system. Thank you. *************************************************************************

2 1

stunnel going to BigIP ssl
by Jones Scott - sjones 13 Sep '06

13 Sep '06

Has anyone used stunnel to end at a BipIP to decode the ssl traffic? If so, any issues or concerns? Thanks *************************************************************************** The information contained in this communication is confidential, is intended only for the use of the recipient named above, and may be legally privileged. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please resend this communication to the sender and delete the original message or any copy of it from your computer system. Thank You. ****************************************************************************

1 0

"SSL_read returned WANT_READ: retrying" at 30Hz
by Vincent Lascaux 12 Sep '06

12 Sep '06

Hi, I'm trying to use rsync (2.6.8) through STunnel (4.16) to synchronize two PC over the internet (they both have the same version of stunnel and rsync). On the server, I have STunnel running with this configuration: cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=0 socket = r:TCP_NODELAY=0 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log [rsync] accept = 273 connect = 873 On the client I have this configuration: cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=0 socket = r:TCP_NODELAY=0 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log client = yes [rsync] accept = 873 connect = UrlOfMyServer:273 Then I connect with rsync using rsync -a -h --progress --stats --partial Account@localhost::RemotePath LocalPath I think the connection is not really stable. RSync sometimes hang. The log file on the client side show 2006.09.11 21:33:11 LOG7[2008:1468]: SSL_read returned WANT_READ: retrying at 30Hz (that's right, it means 30 times a second). My log file nearly gets bigger faster than my downloaded file ;) Is it expected? What does this line mean? I turned TCP_NODELAY to 0 thinking that it my give me synchronous sockets and that it would remove that error, but it didn't... Any help appreciated, Thanks -- Vincent

2 3

Stunnel 4.17 released
by Michal Trojnara 10 Sep '06

10 Sep '06

This is a bugfix release. Upgrade is recommended. Version 4.17, 2006.09.10, urgency: MEDIUM: * New features - Win32 DLLs for OpenSSL 0.9.8c. * Bugfixes - Problem with detecting getaddrinfo() in ./configure fixed. - Compilation problem due to misplaced #endif in ssl.c fixed. - Duplicate 220 in smtp_server() function in protocol.c fixed. - Minor os2.mak update. - Minor update of safestring()/safename() macros. sha1sum for stunnel-4.17.tar.gz file: 7a0ea800935e798bf938756000b57d002a99c280 Homepage and download: http://stunnel.mirt.net/ Best regards, Mike

1 0

Multiple HTTPS endpoints
by Andrew Culross 07 Sep '06

07 Sep '06

Can I use stunnel to connect mutiple https endpoints? I'm wondering if a config file like the below would work: [https] accept = 9876 connect = xxx.xxx.xxx.xxx:443 [https] accept = 9875 connect =yyy.yyy.yyy.yyy:443 Thanks in advance ! Andrew Culross TwoFour Systems (914) 220-8849 www.TwoFour.Com The views and opinions expressed in this e-mail message are the sender's own and do not necessarily represent the views and opinions of {TwoFour Systems, LLC or F-O-R Software, LLC}

1 0

Re: [stunnel-users] RFC 2487 test in smtp_server not reliable
by Hans Werner Strube 07 Sep '06

07 Sep '06

Hans Werner Strube wrote: > Michal Trojnara wrote: ... > > I'm going to do it the hard way and add another parameter to > > s_poll_wait() function. > > > > IMHO the timeout should be between 100ms and 500ms. What do you think? > > I have not tested the minimum required. However, it should be as short > as possible, since for a client using TLS, the full delay will always > occur on starting a connection. ... I have now done some measurements using snoop on a Solaris Ultra 2 SMTP server (100 MBit/s) with a Windows XP SP2 client (AMD Duron 1 GHz, 56 kBit/s phone-line modem, SeaMonkey 1.04 mail sender [equivalent to Thunderbird 1.5.x]). The delays between the end of initial connection handshake and the first nonzero data packet for six connections were usually between 10 and 100 ms but once reached 150 ms. Thus, 200 ms may be a reasonable value (although the sample is too small to rule out rare failures).

1 0

windows load levels
by Alex Turner 05 Sep '06

05 Sep '06

Guys, Bit of a newbie question here - but very import to me at least. We are looking to secure a web server that does no currently support SSL. One reason for this is that we want to be able to run the server on multiple hosts and doing so means sharing the sessions etc :-( So - I am interested if anyone has tested the stuffing out of stunnel on windows. IE seeing how well it could handle several hundred sockets simultaneously. Not only from a resource point of view, but from a scaling (n, n**2 etc) point of view. Any input at all will be very welcome. Soon I will be starting some test of my own using JMeter to load test. If anyone is interested in the results I will be happy to post. Cheers AJ Alexander J Turner Ph.D. HYPERLINK "http://www.deployview.com"www.deployview.com HYPERLINK "http://www.nerds-central.blogspot.com"www.nerds-central.blogspot.com HYPERLINK "http://www.project-network.com"www.project-network.com -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.405 / Virus Database: 268.11.7/437 - Release Date: 04/09/2006

2 1

Stunnel and CryptoApi
by Marco Aldegheri 05 Sep '06

05 Sep '06

Hello list! Someone knows if there is any way to integrate a Windows stunnel in client mode with the Windows Certificate Store? As OpenVPN does with the cryptoapicert parameter in my opinion it would be very useful because: 1. the private key would not just reside in a pem file but could be set not exportable. 2. the private key could be saved on a smartcard. I found a japaneese wstunnel project that seems to do it but I couldn't find any document about it in english and the gui is only in japaneese. Any hints? Thank you, Marco Aldegheri __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Real address of client
by Gonzalo Diethelm 03 Sep '06

03 Sep '06

Hello, linux: Linux asus-gonzo 2.6.15-26-686 #1 SMP PREEMPT Thu Aug 3 03:13:28 UTC 2006 i686 GNU/Linux stunnel: stunnel 4.14 on i486-pc-linux-gnu PTHREAD+POLL+IPv6+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 apache: Apache/2.0.55 I am using stunnel in Ubuntu to provide https serving to an http-only Apache installation. The stunnel config is: cert = /home/gonzo/src/bg/run/SSL/server.crt key = /home/gonzo/src/bg/run/SSL/server.crt chroot = /var/run/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = no [https] accept = 443 connect = 80 TIMEOUTclose = 0 Everything works perfectly, except for one minor detail: on the server, my PHP scripts do not have access to the real IP address of the client, and they always see this value as 127.0.0.1. I am aware the manual says that, if you use -l or -L, there will be an additional REMOTE_HOST environment variable with the desired IP address, but I am not sure how to make this work from a setup like mine, where the http server process is already running. Any help or hints are greatly appreciated. Best regards, -- Gonzalo Diethelm gonzalo.diethelm(a)aditiva.com

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users