- stunnel-users - stunnel.org

transpartent=destination setting fails with runtime error
by Stefan Lauterbach 03 Sep '12

03 Sep '12

*In the latest versions of stunnel including stunnel-4.54b8, activating the option for transparent destination with transparent=destination fails. The following error is found in the log with this configuration (tested on CentOS 6.2 and 6.3): INTERNAL ERROR: No target for remote socket This bug seems to be introduced with version 4.51 by rewriting the code and introducing additional sanity checks for the configuration. The following patch seems to resolve the problem: --- src/client.c.~1~ 2012-03-05 12:11:06.000000000 +0100 +++ src/client.c 2012-08-27 00:29:36.000000000 +0200 @@ -303,7 +303,7 @@ c->bind_addr=NULL; /* don't bind */ /* setup c->remote_fd, now */ - if(c->opt->option.remote) { /* try remote first for exec+connect targets */ + if(c->opt->option.remote || c->opt->option.transparent_dst) { /* try remote first for exec+connect targets */ c->remote_fd.fd=connect_remote(c); } else if(c->opt->option.program) { /* exec+connect uses local fd */ c->remote_fd.fd=connect_local(c); *

1 0

MySQL replication + SSL/stunnel
by Gareth Evans 27 Aug '12

27 Aug '12

Hello, I'm failing miserably to implement replication over any kind of SSL (that is, MySQL's native (alleged) SSL support) or stunnel. I'd be grateful for any tips or advice. I have tried using OpenSSL and MySQL in various flavours: CentOS 6.2, OpenSSL v1.0.0, MySQL v5.1.63 Ubuntu 12.04, OpenSSL v1.0.1, MySQL v 5.5.24 and stunnel4 on both - certs created with OpenSSL in each case. I get an eror 1045 access denied from the MySQL native SSL approach, and mysql -u ejbkslave -pejbkslavepw -h127.0.0.1 -P3307 ERROR 2013 (HY000): Lost connection to MySQL server at 'reading initial communication packet', system error: 104 from stunnel (connecting two Ubuntu 12.04 VM's on my PC, with the latest updates) - if you know what causes this error and/or could point me towards some good documentation, I'd be grateful. I've copied and amended stunnel.conf-sample and just added debug and accept/connect info in each case. I've seen various reports around the web that OpenSSL+MySQL don't work together at the moment, but it seems some people can repicate the problem while others can't - I've tried the previous version of OpenSSL (1.0.0e on Ubuntu) still without success. Most frustrating!! Thanks Gareth

2 1

Stunnel performance about multiple session
by Yuqiong Sun 27 Aug '12

27 Aug '12

Hi, I am using stunnel as an encrypted channel between one server and multiple clients. Each client will transfer a very small piece of data every 20 seconds. Therefore I want to compare the tradeoff between maintaining multiple sessions with tearing down and re-establish connection every time. I read the performance table in stunnel doc and got a brief idea, but I hope to evaluate the performance for my specific hardware and software setup to make a better decision. I guess my question is how to measure the Max. concurrent sessions? Should I start multiple stunnel instances on client side? Also, how can I tear down a connection automatically after each time data transfer? Thanks Yuqiong

2 1

Behavior
by Javier 17 Aug '12

17 Aug '12

Hi, I want to report 2 different behaviors, one, related to logs and, the other, to close delay. - About the logs, there is a funny thing. If you reload stunnel.conf the log style and amount of information differs from the starting one. I'm under Windows 2000 and these are the general options in stunnel.conf: debug = debug delay = yes output = stunnel.log fips = no The differences can be seen in the attached text file. First part is how is being seen if you don't reload the conf file. The second, after you reload. I, by myself, prefer the second log style. - About the close delay, I don't know when it started to happen (maybe in the version you removed the multiple instance of stunnel or maybe later), but what happens is that stunnel delays about 1-2 seconds to close. It didn't happen before. It was immediately. And has nothing to do with how many services you have, it delays with one service or ten services or… whatever. My system specs, the same as above. But it happens in Windows XP as well, and with the latest 4.54 beta too (the one that has removed the annoying app error (thank you so much for this :-) )). Have a look to them ;-) and confirm if possible :-) Thanks.

1 0

Stunnel high memory usage?
by Matt Wise 16 Aug '12

16 Aug '12

We use Stunnel 4.5.2 in our environment of Ubuntu 10.04/12.04 systems in various clouds. We're leveraging PGPool for SSL encryption of a lot of different types of traffic ... Zookeeper, Postgresql, and AMQP traffic are some examples for us. Mostly everything works great .. its fast, and very reliable. I've just noticed though that on a particular group of machines we are seeing really high memory usage on the Stunnel process that seems to grow and grow over time. I found this Stunnel process using over 350MB of ram yesterday ... and on an m1.small in Amazon, thats a big chunk! Here's our client config file: > cert = /etc/stunnel/localhost-pgpool.pem > key = /etc/stunnel/localhost-pgpool.key > CAfile = /etc/stunnel/localhost-pgpool_ca.pem > verify = 2 > delay = no > sslVersion = TLSv1 > client = yes > setuid = stunnel4 > setgid = stunnel4 > pid = /var/lib/stunnel4/localhost-pgpool.stunnel4.pid > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > TIMEOUTconnect = 2 > session = 86400 > debug = 4 > [localhost-pgpool] > accept = 127.0.0.1:5001 > failover = rr > connect = prod-pgpool1-uswest1:6433 > connect = prod-pgpool2-uswest1:6433 My first thought was that perhaps the Session cache was too large... so I dropped it to '3600'. Now instead of 360MB, I'm seeing Stunnel sit at around 170MB. Is the session ID cache just caching thousands and thousands of new session IDs without properly re-using them? It seems like the session ID cache should never have more than: Currently_Used_Session_IDs + Session_IDs_unused_but_last_used_within_the_last_hour Any thoughts on what might be going on? --Matt

1 0

Application Failed to Initialize Properly (0xc0150002)
by Thomas Eifert 09 Aug '12

09 Aug '12

New problem here. Stunnel version 4.53. I just did a fresh install of Windows XP Pro x86 SP3, and did all the Windows updates as well. Whenever I try to launch Stunnel or install the service, I get the error: "Application Failed to Initialize Properly (0xc0150002)" I've never seen this before. I thought it might have something to do with not having the Visual C++ Redistributables, so I installed those too, with the same result. Has anyone else seen this issue? Regards, Thomas -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

3 4

Stunnel waits for a long time if client does not negotiate SSL
by Denis Solovyov 09 Aug '12

09 Aug '12

Hello, I use stunnel 4.53 to provide pop3s for existing pop3 service. I start stunnel from xinetd, and then exec pop3 utility from stunnel. If a legal pop3s client connects to a server, everything's fine. But if I try to do "telnet host 995" with a simple telnet client and then just do nothing (or even close telnet client without quitting) stunnel process keeps waiting for a very long time (actually maybe forever, I just kill it). The last line in log in such case "Service [stunnel] accepted connection from xx.xx.xx.xx:xxxx". No stunnel TIMEOUT* options have effect in this situation. What can I do to avoid such "waiting"? Maybe stunnel should have something like "SSL negotiation timeout"? Or is there a way to emulate it? (Analyzing `ps` or `netstat` is a bad idea of course.) With the best regards, Denis Solovyov

2 3

Re: [stunnel-users] Application Failed to Initialize Properly (0xc0150002)
by Generic Poster 08 Aug '12

08 Aug '12

Hi Thomas, I have the exact same error when trying to run stunnel on a virtual XP machine under windows 7. I asked here and the only reply I got was that it sounded like a configuration problem. I have tried everything I can think of, but to no avail. I just gave up trying in the end. Wednesday, August 8, 2012, 2:20:43 AM, you wrote: > New problem here. Stunnel version 4.53. > I just did a fresh install of Windows XP Pro x86 SP3, and did all the > Windows updates as well. > Whenever I try to launch Stunnel or install the service, I get the error: > "Application Failed to Initialize Properly (0xc0150002)" > I've never seen this before. I thought it might have something to do > with not having the Visual C++ Redistributables, so I installed those too, > with the same result. > Has anyone else seen this issue? > Regards, > Thomas -- Best regards, GP

2 1

Getting Stunnel to Work Under Windows 7 64-bit
by Hacker, Dietmar 06 Aug '12

06 Aug '12

Some thoughts about a thread from may: Stunnel works ok under Windows7 64bit. But: There are some windows7-specific security restraints one should be aware of: Windows7 does not allow programs to have write-access to c:\program files and c:\program files (x86) (win7 64bit). You can find the logfile in hidden directory c:\users\Youruser\appdata\local\virtualstore\program files\stunnel\stunnel.log ( Youruser is the windows user which started stunnel ) If you want a common logfile for all users, either you install stunnel in another writeable directory (security risk ?) or if installing in program files change your stunnel.conf file to have the log file in a writeable directory e.g. c:\temp or the standard common data directory c:\programData (also a hidden directory ) I use stunnel as a service and defined "output = c:\programData\stunnel\stunnel.log" stunnel writes there and only users with admin access could change the logfile. Dietmar Hacker

1 0

Build stunnel 4.53 binaries for windows error
by Anton Tkachev 01 Aug '12

01 Aug '12

Hey Guys, I'm trying to build stunnel 4.53 binaries for windows on Debian Squeeze x86 using instructions in INSTALL.W32 file. I use the latest openssl-1.0.1c (libssl-dev debian package installed also). At the last step 'make stunnel.exe' returns following error: # make stunnel.exe i586-mingw32msvc-gcc -c -I/usr/src/openssl-0.9.8s-fips/inc32 -mthreads -fstack-protector -O2 -Wall -Wextra -Wno-long-long -pedantic -o str.obj str.c In file included from str.c:38: common.h:392:33: error: openssl/opensslconf.h: No such file or directory common.h:405:27: error: openssl/lhash.h: No such file or directory common.h:406:25: error: openssl/ssl.h: No such file or directory common.h:407:25: error: openssl/err.h: No such file or directory common.h:408:66: error: openssl/crypto.h: No such file or directory common.h:409:26: error: openssl/rand.h: No such file or directory common.h:411:25: error: openssl/md4.h: No such file or directory common.h:413:25: error: openssl/des.h: No such file or directory common.h:417:28: error: openssl/engine.h: No such file or directory In file included from str.c:38: common.h:449: warning: return type defaults to ‘int’ common.h: In function ‘STACK_OF’: common.h:449: error: expected declaration specifiers before ‘*’ token In file included from str.c:39: prototypes.h:50: error: storage class specified for parameter ‘LOG_MODE’ prototypes.h:61: error: storage class specified for parameter ‘SOCKADDR_UNION’ prototypes.h:64: error: expected specifier-qualifier-list before ‘SOCKADDR_UNION’ prototypes.h:67: warning: struct has no members prototypes.h:67: error: storage class specified for parameter ‘SOCKADDR_LIST’ prototypes.h:72: error: storage class specified for parameter ‘COMP_TYPE’ prototypes.h:78: error: expected specifier-qualifier-list before ‘COMP_TYPE’ prototypes.h:114: warning: struct has no members prototypes.h:114: error: storage class specified for parameter ‘GLOBAL_OPTIONS’ prototypes.h:116: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘global_options’ prototypes.h:124: error: expected specifier-qualifier-list before ‘SSL_CTX’ prototypes.h:222: error: storage class specified for parameter ‘SERVICE_OPTIONS’ prototypes.h:224: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘service_options’ prototypes.h:236: error: storage class specified for parameter ‘VAL_TYPE’ prototypes.h:244: error: storage class specified for parameter ‘OPT_UNION’ prototypes.h:250: error: expected specifier-qualifier-list before ‘VAL_TYPE’ prototypes.h:252: error: storage class specified for parameter ‘SOCK_OPT’ prototypes.h:256: error: storage class specified for parameter ‘CONF_TYPE’ prototypes.h:269: error: storage class specified for parameter ‘s_poll_set’ prototypes.h:278: error: storage class specified for parameter ‘DISK_FILE’ prototypes.h:285: error: storage class specified for parameter ‘FD’ prototypes.h:290: error: storage class specified for parameter ‘max_clients’ prototypes.h:291: error: storage class specified for parameter ‘num_clients’ prototypes.h:327: warning: parameter names (without types) in function declaration prototypes.h:347: error: storage class specified for parameter ‘cli_index’ prototypes.h:347: error: storage class specified for parameter ‘opt_index’ prototypes.h:350: error: expected ‘)’ before ‘*’ token prototypes.h:355: error: expected declaration specifiers or ‘...’ before ‘CONF_TYPE’ prototypes.h:361: error: expected specifier-qualifier-list before ‘SERVICE_OPTIONS’ prototypes.h:363: warning: struct has no members prototypes.h:363: error: storage class specified for parameter ‘UI_DATA’ prototypes.h:365: error: expected ‘)’ before ‘*’ token prototypes.h:370: error: expected ‘)’ before ‘*’ token prototypes.h:374: error: expected declaration specifiers before ‘s_poll_set’ prototypes.h:375: error: expected ‘)’ before ‘*’ token prototypes.h:376: error: expected ‘)’ before ‘*’ token prototypes.h:377: error: expected ‘)’ before ‘*’ token prototypes.h:378: error: expected ‘)’ before ‘*’ token prototypes.h:379: error: expected ‘)’ before ‘*’ token prototypes.h:380: error: expected ‘)’ before ‘*’ token prototypes.h:381: error: expected ‘)’ before ‘*’ token prototypes.h:401: error: expected specifier-qualifier-list before ‘SSL’ prototypes.h:422: error: storage class specified for parameter ‘CLI’ prototypes.h:424: error: expected declaration specifiers before ‘CLI’ prototypes.h:426: error: expected ‘)’ before ‘*’ token prototypes.h:430: error: expected ‘)’ before ‘*’ token prototypes.h:431: error: expected ‘)’ before ‘*’ token prototypes.h:432: error: expected ‘)’ before ‘*’ token prototypes.h:433: error: expected ‘)’ before ‘*’ token prototypes.h:434: error: expected ‘)’ before ‘*’ token prototypes.h:436: error: expected ‘)’ before ‘*’ token prototypes.h:450: error: storage class specified for parameter ‘PROTOCOL_TYPE’ prototypes.h:453: error: expected ‘)’ before ‘*’ token prototypes.h:457: error: expected ‘)’ before ‘*’ token prototypes.h:458: error: expected ‘)’ before ‘*’ token prototypes.h:459: error: expected ‘)’ before ‘*’ token prototypes.h:460: error: expected ‘)’ before ‘*’ token prototypes.h:461: error: expected ‘)’ before ‘*’ token prototypes.h:462: warning: type defaults to ‘int’ in declaration of ‘SOCKADDR_UNION’ prototypes.h:462: error: expected ‘;’, ‘,’ or ‘)’ before ‘*’ token prototypes.h:493: error: storage class specified for parameter ‘SECTION_CODE’ prototypes.h:495: warning: parameter names (without types) in function declaration prototypes.h:496: warning: parameter names (without types) in function declaration prototypes.h:500: error: expected declaration specifiers or ‘...’ before ‘CLI’ prototypes.h:526: error: storage class specified for parameter ‘hwnd’ prototypes.h:530: error: expected ‘)’ before ‘*’ token prototypes.h:535: error: storage class specified for parameter ‘GETADDRINFO’ prototypes.h:536: error: storage class specified for parameter ‘FREEADDRINFO’ prototypes.h:538: error: storage class specified for parameter ‘GETNAMEINFO’ prototypes.h:539: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘s_getaddrinfo’ prototypes.h:540: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘s_freeaddrinfo’ prototypes.h:541: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘s_getnameinfo’ prototypes.h:550: error: expected declaration specifiers before ‘DISK_FILE’ prototypes.h:551: error: expected ‘)’ before ‘*’ token prototypes.h:552: error: expected ‘)’ before ‘*’ token prototypes.h:553: error: expected ‘)’ before ‘*’ token prototypes.h:563: error: expected ‘)’ before ‘*’ token str.c:49: error: storage class specified for parameter ‘canary’ str.c:50: error: storage class specified for parameter ‘canary_initialized’ str.c:50: error: parameter ‘canary_initialized’ is initialized str.c:52: error: storage class specified for parameter ‘ALLOC_LIST’ str.c:55: error: expected specifier-qualifier-list before ‘ALLOC_LIST’ str.c:57: warning: struct has no members str.c:57: error: storage class specified for parameter ‘ALLOC_TLS’ str.c:60: error: expected specifier-qualifier-list before ‘ALLOC_LIST’ str.c:67: warning: struct has no members str.c:59: warning: empty declaration str.c:73: error: expected ‘)’ before ‘*’ token str.c:74: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘*’ token str.c:75: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘*’ token str.c:77: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:85: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:95: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:175: error: storage class specified for parameter ‘tls_index’ str.c:177: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:181: error: expected ‘)’ before ‘*’ token str.c:185: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘*’ token str.c:191: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:198: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:210: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:228: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:262: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:291: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:315: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:326: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘*’ token common.h:449: warning: type of ‘SSL_COMP’ defaults to ‘int’ str.c:175: error: declaration for parameter ‘tls_index’ but no such parameter str.c:57: error: declaration for parameter ‘ALLOC_TLS’ but no such parameter str.c:52: error: declaration for parameter ‘ALLOC_LIST’ but no such parameter str.c:50: error: declaration for parameter ‘canary_initialized’ but no such parameter str.c:49: error: declaration for parameter ‘canary’ but no such parameter prototypes.h:581: error: declaration for parameter ‘str_printf’ but no such parameter prototypes.h:580: error: declaration for parameter ‘str_vprintf’ but no such parameter prototypes.h:579: error: declaration for parameter ‘str_dup’ but no such parameter prototypes.h:577: error: declaration for parameter ‘str_free_debug’ but no such parameter prototypes.h:575: error: declaration for parameter ‘str_detach_debug’ but no such parameter prototypes.h:573: error: declaration for parameter ‘str_realloc_debug’ but no such parameter prototypes.h:571: error: declaration for parameter ‘str_alloc_debug’ but no such parameter prototypes.h:570: error: declaration for parameter ‘str_stats’ but no such parameter prototypes.h:569: error: declaration for parameter ‘str_cleanup’ but no such parameter prototypes.h:568: error: declaration for parameter ‘str_canary_init’ but no such parameter prototypes.h:567: error: declaration for parameter ‘str_init’ but no such parameter prototypes.h:562: error: declaration for parameter ‘libwrap_init’ but no such parameter prototypes.h:557: error: declaration for parameter ‘tstr2str’ but no such parameter prototypes.h:556: error: declaration for parameter ‘str2tstr’ but no such parameter prototypes.h:537: error: declaration for parameter ‘GETNAMEINFO’ but no such parameter prototypes.h:536: error: declaration for parameter ‘FREEADDRINFO’ but no such parameter prototypes.h:534: error: declaration for parameter ‘GETADDRINFO’ but no such parameter prototypes.h:528: error: declaration for parameter ‘passwd_cb’ but no such parameter prototypes.h:526: error: declaration for parameter ‘hwnd’ but no such parameter prototypes.h:500: error: declaration for parameter ‘create_client’ but no such parameter prototypes.h:499: error: declaration for parameter ‘stunnel_thread_id’ but no such parameter prototypes.h:498: error: declaration for parameter ‘stunnel_process_id’ but no such parameter prototypes.h:497: error: declaration for parameter ‘sthreads_init’ but no such parameter prototypes.h:496: error: declaration for parameter ‘leave_critical_section’ but no such parameter prototypes.h:495: error: declaration for parameter ‘enter_critical_section’ but no such parameter prototypes.h:493: error: declaration for parameter ‘SECTION_CODE’ but no such parameter prototypes.h:479: error: declaration for parameter ‘local_getnameinfo’ but no such parameter prototypes.h:463: error: declaration for parameter ‘s_gai_strerror’ but no such parameter prototypes.h:452: error: declaration for parameter ‘find_protocol_id’ but no such parameter prototypes.h:450: error: declaration for parameter ‘PROTOCOL_TYPE’ but no such parameter prototypes.h:425: error: declaration for parameter ‘client_thread’ but no such parameter prototypes.h:422: error: declaration for parameter ‘CLI’ but no such parameter prototypes.h:395: error: declaration for parameter ‘make_sockets’ but no such parameter prototypes.h:394: error: declaration for parameter ‘get_socket_error’ but no such parameter prototypes.h:393: error: declaration for parameter ‘set_socket_options’ but no such parameter prototypes.h:366: error: declaration for parameter ‘sslerror’ but no such parameter prototypes.h:363: error: declaration for parameter ‘UI_DATA’ but no such parameter prototypes.h:356: error: declaration for parameter ‘apply_conf’ but no such parameter prototypes.h:355: error: declaration for parameter ‘parse_conf’ but no such parameter prototypes.h:354: error: declaration for parameter ‘parse_commandline’ but no such parameter prototypes.h:349: error: declaration for parameter ‘ssl_init’ but no such parameter prototypes.h:347: error: declaration for parameter ‘opt_index’ but no such parameter prototypes.h:347: error: declaration for parameter ‘cli_index’ but no such parameter prototypes.h:343: error: declaration for parameter ‘pty_allocate’ but no such parameter prototypes.h:339: error: declaration for parameter ‘s_strerror’ but no such parameter prototypes.h:338: error: declaration for parameter ‘log_error’ but no such parameter prototypes.h:337: error: declaration for parameter ‘sockerror’ but no such parameter prototypes.h:336: error: declaration for parameter ‘ioerror’ but no such parameter prototypes.h:334: error: declaration for parameter ‘fatal_debug’ but no such parameter prototypes.h:328: error: declaration for parameter ‘s_log’ but no such parameter prototypes.h:327: error: declaration for parameter ‘log_flush’ but no such parameter prototypes.h:326: error: declaration for parameter ‘log_close’ but no such parameter prototypes.h:325: error: declaration for parameter ‘log_open’ but no such parameter prototypes.h:317: error: declaration for parameter ‘set_nonblock’ but no such parameter prototypes.h:316: error: declaration for parameter ‘s_accept’ but no such parameter prototypes.h:315: error: declaration for parameter ‘s_socketpair’ but no such parameter prototypes.h:314: error: declaration for parameter ‘s_pipe’ but no such parameter prototypes.h:313: error: declaration for parameter ‘s_socket’ but no such parameter prototypes.h:311: error: declaration for parameter ‘get_limits’ but no such parameter prototypes.h:306: error: declaration for parameter ‘stunnel_info’ but no such parameter prototypes.h:302: error: declaration for parameter ‘signal_post’ but no such parameter prototypes.h:298: error: declaration for parameter ‘bind_ports’ but no such parameter prototypes.h:297: error: declaration for parameter ‘unbind_ports’ but no such parameter prototypes.h:296: error: declaration for parameter ‘daemon_loop’ but no such parameter prototypes.h:295: error: declaration for parameter ‘main_configure’ but no such parameter prototypes.h:294: error: declaration for parameter ‘main_initialize’ but no such parameter prototypes.h:291: error: declaration for parameter ‘num_clients’ but no such parameter prototypes.h:290: error: declaration for parameter ‘max_clients’ but no such parameter prototypes.h:285: error: declaration for parameter ‘FD’ but no such parameter prototypes.h:278: error: declaration for parameter ‘DISK_FILE’ but no such parameter prototypes.h:269: error: declaration for parameter ‘s_poll_set’ but no such parameter prototypes.h:256: error: declaration for parameter ‘CONF_TYPE’ but no such parameter prototypes.h:252: error: declaration for parameter ‘SOCK_OPT’ but no such parameter prototypes.h:244: error: declaration for parameter ‘OPT_UNION’ but no such parameter prototypes.h:236: error: declaration for parameter ‘VAL_TYPE’ but no such parameter prototypes.h:222: error: declaration for parameter ‘SERVICE_OPTIONS’ but no such parameter prototypes.h:114: error: declaration for parameter ‘GLOBAL_OPTIONS’ but no such parameter prototypes.h:72: error: declaration for parameter ‘COMP_TYPE’ but no such parameter prototypes.h:67: error: declaration for parameter ‘SOCKADDR_LIST’ but no such parameter prototypes.h:61: error: declaration for parameter ‘SOCKADDR_UNION’ but no such parameter prototypes.h:50: error: declaration for parameter ‘LOG_MODE’ but no such parameter str.c:342: error: expected ‘{’ at end of input common.h:449: warning: unused parameter ‘SSL_COMP’ str.c:175: warning: unused parameter ‘tls_index’ str.c:57: warning: unused parameter ‘ALLOC_TLS’ str.c:52: warning: unused parameter ‘ALLOC_LIST’ str.c:50: warning: unused parameter ‘canary_initialized’ str.c:49: warning: unused parameter ‘canary’ prototypes.h:581: warning: unused parameter ‘str_printf’ prototypes.h:580: warning: unused parameter ‘str_vprintf’ prototypes.h:579: warning: unused parameter ‘str_dup’ prototypes.h:577: warning: unused parameter ‘str_free_debug’ prototypes.h:575: warning: unused parameter ‘str_detach_debug’ prototypes.h:573: warning: unused parameter ‘str_realloc_debug’ prototypes.h:571: warning: unused parameter ‘str_alloc_debug’ prototypes.h:570: warning: unused parameter ‘str_stats’ prototypes.h:569: warning: unused parameter ‘str_cleanup’ prototypes.h:568: warning: unused parameter ‘str_canary_init’ prototypes.h:567: warning: unused parameter ‘str_init’ prototypes.h:562: warning: unused parameter ‘libwrap_init’ prototypes.h:557: warning: unused parameter ‘tstr2str’ prototypes.h:556: warning: unused parameter ‘str2tstr’ prototypes.h:537: warning: unused parameter ‘GETNAMEINFO’ prototypes.h:536: warning: unused parameter ‘FREEADDRINFO’ prototypes.h:534: warning: unused parameter ‘GETADDRINFO’ prototypes.h:528: warning: unused parameter ‘passwd_cb’ prototypes.h:526: warning: unused parameter ‘hwnd’ prototypes.h:500: warning: unused parameter ‘create_client’ prototypes.h:499: warning: unused parameter ‘stunnel_thread_id’ prototypes.h:498: warning: unused parameter ‘stunnel_process_id’ prototypes.h:497: warning: unused parameter ‘sthreads_init’ prototypes.h:496: warning: unused parameter ‘leave_critical_section’ prototypes.h:495: warning: unused parameter ‘enter_critical_section’ prototypes.h:493: warning: unused parameter ‘SECTION_CODE’ prototypes.h:479: warning: unused parameter ‘local_getnameinfo’ prototypes.h:463: warning: unused parameter ‘s_gai_strerror’ prototypes.h:452: warning: unused parameter ‘find_protocol_id’ prototypes.h:450: warning: unused parameter ‘PROTOCOL_TYPE’ prototypes.h:425: warning: unused parameter ‘client_thread’ prototypes.h:422: warning: unused parameter ‘CLI’ prototypes.h:395: warning: unused parameter ‘make_sockets’ prototypes.h:394: warning: unused parameter ‘get_socket_error’ prototypes.h:393: warning: unused parameter ‘set_socket_options’ prototypes.h:366: warning: unused parameter ‘sslerror’ prototypes.h:363: warning: unused parameter ‘UI_DATA’ prototypes.h:356: warning: unused parameter ‘apply_conf’ prototypes.h:355: warning: unused parameter ‘parse_conf’ prototypes.h:354: warning: unused parameter ‘parse_commandline’ prototypes.h:349: warning: unused parameter ‘ssl_init’ prototypes.h:347: warning: unused parameter ‘opt_index’ prototypes.h:347: warning: unused parameter ‘cli_index’ prototypes.h:343: warning: unused parameter ‘pty_allocate’ prototypes.h:339: warning: unused parameter ‘s_strerror’ prototypes.h:338: warning: unused parameter ‘log_error’ prototypes.h:337: warning: unused parameter ‘sockerror’ prototypes.h:336: warning: unused parameter ‘ioerror’ prototypes.h:334: warning: unused parameter ‘fatal_debug’ prototypes.h:328: warning: unused parameter ‘s_log’ prototypes.h:327: warning: unused parameter ‘log_flush’ prototypes.h:326: warning: unused parameter ‘log_close’ prototypes.h:325: warning: unused parameter ‘log_open’ prototypes.h:317: warning: unused parameter ‘set_nonblock’ prototypes.h:316: warning: unused parameter ‘s_accept’ prototypes.h:315: warning: unused parameter ‘s_socketpair’ prototypes.h:314: warning: unused parameter ‘s_pipe’ prototypes.h:313: warning: unused parameter ‘s_socket’ prototypes.h:311: warning: unused parameter ‘get_limits’ prototypes.h:306: warning: unused parameter ‘stunnel_info’ prototypes.h:302: warning: unused parameter ‘signal_post’ prototypes.h:298: warning: unused parameter ‘bind_ports’ prototypes.h:297: warning: unused parameter ‘unbind_ports’ prototypes.h:296: warning: unused parameter ‘daemon_loop’ prototypes.h:295: warning: unused parameter ‘main_configure’ prototypes.h:294: warning: unused parameter ‘main_initialize’ prototypes.h:291: warning: unused parameter ‘num_clients’ prototypes.h:290: warning: unused parameter ‘max_clients’ prototypes.h:285: warning: unused parameter ‘FD’ prototypes.h:278: warning: unused parameter ‘DISK_FILE’ prototypes.h:269: warning: unused parameter ‘s_poll_set’ prototypes.h:256: warning: unused parameter ‘CONF_TYPE’ prototypes.h:252: warning: unused parameter ‘SOCK_OPT’ prototypes.h:244: warning: unused parameter ‘OPT_UNION’ prototypes.h:236: warning: unused parameter ‘VAL_TYPE’ prototypes.h:222: warning: unused parameter ‘SERVICE_OPTIONS’ prototypes.h:114: warning: unused parameter ‘GLOBAL_OPTIONS’ prototypes.h:72: warning: unused parameter ‘COMP_TYPE’ prototypes.h:67: warning: unused parameter ‘SOCKADDR_LIST’ prototypes.h:61: warning: unused parameter ‘SOCKADDR_UNION’ prototypes.h:50: warning: unused parameter ‘LOG_MODE’ make: *** [str.obj] Error 1 It seems it has hardcoded path to openssl (/usr/src/openssl-0.9.8s-fips). I tried to change this path to the right one in Makefile*, but with no luck - I get the same error. I also tried to build stunnel with openssl-0.9.8s, but openssl configure command from the instruction doesn't work: root@debian:/usr/src/openssl-0.9.8s-i586# ./Configure --cross-compile-prefix=i586-mingw32msvc- mingw shared zlib-dynamic Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [experimental-<cipher> ...] [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-Kxxx] [no-hw-xxx|no-hw] [[no-]threads] [[no-]shared] [[no-]zlib|zlib-dynamic] [enable-montasm] [no-asm] [no-dso] [no-krb5] [386] [--prefix=DIR] [--openssldir=OPENSSLDIR] [--with-xxx[=vvv]] [--test-sanity] os/compiler[:flags] Regards, Anton.

3 11

"application failed to initialize properly"
by Generic Poster 31 Jul '12

31 Jul '12

Hello Stunnel-users, Whenever I run Stunnel from a Windows 7 Virtual XP machine I receive the following error message: --------------------------- stunnel.exe - Application Error --------------------------- The application failed to initialize properly (0xc0150002). Click on OK to terminate the application. --------------------------- Any ideas as to what causes it or how I can get around the problem? The result is the same regardless of version. -- Best regards, Generic

2 1

Newbie: Success, now failure???
by Roger Bohl (Sr.) 25 Jul '12

25 Jul '12

For several days, I've been using Stunnel (with Blat) successfully (possibly with no intervening re-boots). A day or so ago, the system was re booted Today, however, Stunnel failed. I got the following Stunnel reply message: No limit detected for the number of clients stunnel 4.53 on x86-pc-mingw32-gnu platform Compiled/running with OpenSSL 0.9.8s-fips 4 Jan 2012 Threading:WIN32 SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:SELECT+IPv6 Reading configuration from file stunnel.conf FIPS mode is enabled Compression not enabled Snagged 64 random bytes from .rnd Wrote 1024 new random bytes to .rnd PRNG seeded successfully Initializing inetd mode configuration Certificate: client.pem Certificate loaded Key file: client.pem Private key loaded SSL options set: 0x00000004 Accept option is not allowed in inetd mode Remove accept option or define a [section] Server is down The stunnel.conf file in the Stunnel directory is: CAfile = cert.pem cert = client.pem client = yes RNDfile = .rnd [gmail smtp] ; (I may have had this in or out before. In "cleaning up" various files, I may have thought this to be a comment, and removed it.) accept = 25 connect = smtp.gmail.com:465 The program fails both with and without the [gmail smtp] line included. Except, possibly, for removing ;[comment] lines, no other changes occurred. Can somebody give me a clue as to the cause, and suggest the fix. I'm running Windows Vista. (I found the 17+ page instruction file, by Michal Trojnara, but didn't see a solution, there.) Thanks. Roger Bohl rhbohl(a)gmail.com 707-939-8459 PDT

1 0

please unsubscribe my email - thx
by Rüdiger Konte 24 Jul '12

24 Jul '12

1 0

stunnel and http
by John 23 Jul '12

23 Jul '12

I am running the latest stunnel for Windows on 64-bit Win7 as an application, not as a service. I simply unzipped everything to one folder, configured the "stunnel.conf" file; and when I need to run the program, I can open a command prompt in its folder and type "stunnel stunnel.conf". It then reads my stunnel.conf file and works its magic. This works fine for capturing the data from those programs which I can configure to use localhost and a specific port because I can configure stunnel.conf with accept = ip.address:port Now I have a program that I want to use to download some text files from the internet using http or https. However, this program cannot be manually configured to make a connection with a certain IP and port. Instead, I have to give it an alias-like name, which it then maps to one of several different domain names, makes a DNS query for the IP and transmits to that address the instructions for downloading some text files. So, is it possible to have stunnel "capture" any and all http transports (port 80) or https transports (port 443) from a specific program, regardless of which IP that connection was destined for, so that I can then direct this data traffic from stunnel to socat or from stunnel to an http proxy which I can manually direct to a specific connection? Is this a kind of thing for which stunnel can be used? If so, where can I find the instructions for setting it up? Thanks.

2 2

Reboot Requires Manual: "service stunnel restart"
by John Vasko 21 Jul '12

21 Jul '12

On FreeBSD 9.0 stunnel 4.43 works fine after running "service stunnel restart", but stunnel fails loading on boot. My desired config includes: /usr/local/etc/stunnel/stunnel.conf -------------------------------------------- [attsmtp] client = yes verify = 0 accept = 2525 connect = smtp.att.yahoo.com:465 delay = yes Please advise. See below for messages after bootup: /var/run/stunnel/stunnel.log ------------------------------------ 2012.07.21 02:52:06 LOG7[1378:675300096]: No limit detected for the number of clients 2012.07.21 02:52:06 LOG7[1378:675300096]: signal_pipe: FD=3 allocated (non-blocking mode) 2012.07.21 02:52:06 LOG7[1378:675300096]: signal_pipe: FD=4 allocated (non-blocking mode) 2012.07.21 02:52:06 LOG5[1378:675300096]: stunnel 4.43 on i386-portbld-freebsd9.0 platform 2012.07.21 02:52:06 LOG5[1378:675300096]: Compiled/running with OpenSSL 1.0.0e 6 Sep 2011 2012.07.21 02:52:06 LOG5[1378:675300096]: Threading:PTHREAD SSL:ENGINE Auth:LIBWRAP Sockets:POLL,IPv6 2012.07.21 02:52:06 LOG5[1378:675300096]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf 2012.07.21 02:52:06 LOG7[1378:675300096]: Snagged 64 random bytes from //.rnd 2012.07.21 02:52:06 LOG7[1378:675300096]: Wrote 1024 new random bytes to //.rnd 2012.07.21 02:52:06 LOG7[1378:675300096]: PRNG seeded successfully 2012.07.21 02:52:08 LOG6[1378:675300096]: Initializing SSL context for service attsmtp 2012.07.21 02:52:08 LOG7[1378:675300096]: SSL options set: 0x00000004 2012.07.21 02:52:08 LOG6[1378:675300096]: SSL context initialized 2012.07.21 02:52:08 LOG5[1378:675300096]: Configuration successful 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=5 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=6 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=6 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=7 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=7 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=8 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=8 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=9 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=9 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=10 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: accept socket: FD=11 allocated (non-blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: Option SO_REUSEADDR set on accept socket 2012.07.21 02:52:08 LOG7[1378:675300096]: Service attsmtp bound to 0.0.0.0:2525 2012.07.21 02:52:08 LOG7[1378:675300096]: Service attsmtp opened FD=11 2012.07.21 02:52:08 LOG7[1378:675300096]: Created pid file /stunnel.pid 2012.07.21 02:52:15 LOG7[1378:675300096]: Dispatching signals from the signal pipe 2012.07.21 02:52:15 LOG3[1378:675300096]: Received signal 2; terminating 2012.07.21 02:52:15 LOG7[1378:675300096]: str_stats: 43 block(s), 3554 byte(s) 2012.07.21 02:52:15 LOG7[1378:675300096]: removing pid file /stunnel.pid

1 1

Re: [stunnel-users] Reverse tunnel with middle server
by Javier 19 Jul '12

19 Jul '12

[To the mailing list: Sorry for these non-english messages, I started, previously, a private communication to avoid it] On Thu, 19 Jul 2012 20:26:45 +0200 "Jorge A." <curruscataphractus(a)gmail.com> wrote: > Hola Javier, > > Igual no me he explicado bien. Lo que quiero es conectar dos > máquinas, una dentro de una NAT detrás de un router que no tiene > redirigidos los puertos a la máquina claro, pero que sí tiene > Internet y acceso a la máquina servidor. Esto me sigue sin quedar claro. Ya perdonarás. Una (Objetivo) está conectada a un router, que sirve internet a una red local, pero que no tiene redirigidos los puertos a la máquina que tiene el servidor http. Esta no tiene acceso a internet porque no se le ha configurado una puerta de enlace y además no la pueden alcanzar porque no hay puertos redirigidos hacia ella. Hasta ahí, todo bien ;) Lo que quería saber es si la máquina que hace de Servidor hacia internet está en la misma subred local o no que la máquina objetivo. El que la máquina objetivo vea al servidor no implica necesariamente que el servidor vea al objetivo. Además, si está conectada al mismo router, porque decías que era accesible desde internet. Lo que entiendo es que quieres redirigir el tráfico proveniente al servidor desde el exterior al objetivo http. Si el servidor, ve a la máquina http, bastaría con decir en la configuración de stunnel que conecte con el servidor http de esa maquina indicándole la ip:puerto. Por eso te dije que no tenía mayor complicación. En esa configuración no hace falta que la máquina objetivo tenga un servidor stunnel y viceversa para comunicarse entre ellos. La comunicación entre el servidor y la máquina objetivo puede ser abierta sin problemas. Lo importante ya existe, que el servidor haga de puente ssl entre internet y el objetivo http. > Durante el día de hoy lo he conseguido hacer más o menos usando > pppd y stunnel entre 2 linux pero no sé si sería posible hacerlo > sólo con stunnel (y *ifconfig*, *ip*, *route* o similares). Sobre > todo porque la máquina cliente objetivo está bastante limitada y no > puedo instalar de manera fácil pppd (tiene un kernel custom, hay > que compilar el módulo pppd del kernel, el demonio, etc). > > Lo que estoy mirando ahora es el comando *ip tunnel* para per si > puedo hacer algo parecido con pppd pero no sé si me estoy dando > golpes contra la pared. > > Muchas gracias de antemano por tu ayuda. De nada, aunque con Linux he topado. Conozco muy por encima los comandos. Pero, olvidándonos de las herramientas a utilizar, sabiendo exactamente el entorno en el que están esas máquinas, todo es coser y cantar, a no ser que sea un imposible ;) De ahí la importancia de saber si están en la misma red local o no, etc. Saludos.

1 1

Reverse tunnel with middle server
by Jorge A. 18 Jul '12

18 Jul '12

Hi everyone, I've search into archives trying to found a solution for my problem without success. The problem is simple: make a machine available on HTTP port when it's behind a e.g. common DSL. I have a middle server for which I have full access to install any program, linux. What I was trying to do is the following: Three machines: Middle server (Server), Target (linux machine behind DSL) and Client. Same stunnel version on both Server and Target. Latests. Server is available on the Internet, running stunnel Target is behind a nat router, e.g. inside a common DSL. I assume this must run stunnel as well. Client connects to Server and Server forwards traffic to Target seamlessly. As far as I know, running stunnel on client mode from e.g. Target and trying to connect to whichever service on Server does not work on reverse: you cannot connect backwards to target. Am I correct? If not, how do I configure both ends and how do I know port to use to connect to Target (log file?) ? What I've tested: 1. Run stunnel on Server on server mode accepting ('accept') connections on a fixed port, e.g. 5000. Here, as far as I know, you must define the 'connect' directive to forward traffic to either local or remote host. The problem is, from Server, you don't know Target ip nor it's accessible 2. Run stunnel on Server and, on Target launch stunnel on client mode to try Thanks in advance and congratulations as it's a great piece of software. Best regards, Jorge

1 0

Stunnel on WIndows Server 2008 R2 SP1 x 64 fails - Microsoft.VC90.CRT.MANIFEST
by Rüdiger Konte 15 Jul '12

15 Jul '12

Hi Stunnel users, I am trying to run stunnel "4.53 installer.exe" on a MS Windows Server 2008 R2 SP1 64 Bit (under VMWARE Workstation 6.5 as a virtual system; Physical Host OS is WIN7 Ultimate 32 BIT) The installation of stunnel was done as an "Administrator" and it ran through without issues. But I cannot se any service running. And when I try to launch the stunnel shortcut on the desktop, i got a error message like: "The application was unable to start correctly (0xc0150002). Click OK to close the application." I assume it has something to do with the Microsoft.VC90.CRT.MANIFEST file. But i am not an expert. This is shown in the Event log: ########################## Protokollname: Application Quelle: SideBySide Datum: 15.07.2012 12:17:01 Ereignis-ID: 35 Aufgabenkategorie:Keine Ebene: Fehler Schlüsselwörter:Klassisch Benutzer: Nicht zutreffend Computer: WIN-C1K2E115MV1 Beschreibung: Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files (x86)\stunnel\LIBEAY32.dll". Fehler in Manifest- oder Richtliniendatei "C:\Program Files (x86)\stunnel\Microsoft.VC90.CRT.MANIFEST" in Zeile 4. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8". Definition: Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Ereignis-XML: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="SideBySide" /> <EventID Qualifiers="49409">35</EventID> <Level>2</Level> <Task>0</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2012-07-15T10:17:01.000000000Z" /> <EventRecordID>197</EventRecordID> <Channel>Application</Channel> <Computer>WIN-C1K2E115MV1</Computer> <Security /> </System> <EventData> <Data>Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"</Data> <Data>Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161"</Data> <Data>C:\Program Files (x86)\stunnel\LIBEAY32.dll</Data> <Data>C:\Program Files (x86)\stunnel\Microsoft.VC90.CRT.MANIFEST</Data> <Data>4</Data> ########################## I ran the MS tool sxstrace.exe to get more details: See the outcome below: ######################################### INFORMATION: Die Manifestsdefinitionsidentität ist "Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161"". FEHLER: Die im Manifest gefundene Komponentenidentität stimmt nicht mit der Identität der angeforderten Komponente überein. Verweis: Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8". Definition: Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161". FEHLER: Bei der Generierung des Aktivierungskontextes ist ein Fehler aufgetreten. Beendet die Generierung des Aktivierungskontextes. ######################################### Is anything missing? .NET or another library ? Note: I installed on the same server in a different snapshot stunnel version 4.4 and it seems to work, at least no error message. But i want to use the latest version. Any help would be nice. Best Rudi

1 0

Conf question: HTTP to HTTPS with SNI
by John Moser 03 Jul '12

03 Jul '12

I have a particular task I need to accomplish in which an HTTP-only caching proxy server is to accept SSL. The architecture in mind is as follows: - Receive request { HTTP request: - Received by caching proxy at localhost:80 HTTPS request: - Received by Pound - Decoded to HTTP - X-FROM-SSL header added - Forwarded to localhost:80 (caching proxy) } Proxy receives HTTP request - Perform caching - If X-FROM-SSL, forward to localhost:8088 - Else forward to HTTP server It is at this point that two design options come into play, both using stunnel. Either use SNI or use stunnel and HTTP. Via SNI, this would appear as follows: Stunnel receives HTTP request - Forward to https://http-server:443/ with SNI This of course requires that stunnel can read the 'Host' header out of an HTTP request and use that for SNI automatically (there's some 300 virtual hosts on that server). If not, this is infeasible. Which is my question, of course: can this be done? If this isn't an option, then the next logical way to handle this problem is: Stunnel receives HTTP request: - SSL encrypt - Forward to http-server:8443 http-server receives HTTP over stunnel - stunnel receives on http-server:8443 - Decrypt and forward to http://localhost:80/ In this way the entire connection would be encrypted, and the HTTP server would see the Host: header and use that to figure out the virtual host etc. Is that the better/only way?

1 0

more than 1000 concurrent connections?
by Trenton Ashburn 03 Jul '12

03 Jul '12

Hi There - I'd like to use stunnel as the SSL termination point for a bunch of persistent TCP connections. I'm running it on an EC2 instance and it's only allowing me about 1000 concurrent connections. It doesn't matter if the connections come from one client IP or two. How can I raise this limit? I've already raised the OS tcp connection limit with ulimit and it doesn't improve things. Thanks, T

4 5

Re: [stunnel-users] Interoperability problems with .net client software
by josealf＠rocketmail.com 30 Jun '12

30 Jun '12

Not as far as I know. You need to check with the client application developers. Maybe they can use a debugger to trace the program flow and see where and why it fails (assuming they understand the protocols and the tools). The application must be coded to present the certificate, and my guess (just a guess), is that it isn't or is blocking before getting to that point. -----Original Message----- From: ProPharma Systems AG - Gregor Bürgisser <g.buergisser(a)propharma.ch> Date: Fri, 29 Jun 2012 06:59:14 To: <josealf(a)rocketmail.com> Subject: Re: [stunnel-users] Interoperability problems with .net client software Yes I did. Also the CA used to sign the server cert. All to no avail. Do you know if there are any (known) interoperability issues between stunnel and .net applications? On 06/28/2012 02:05 PM, josealf(a)rocketmail.com wrote: > Looks like your client is not presenting the certificate to the stunnel server. Maybe because it does not trust the server certificate? Did you import your stunnel server cert into windows certificate store? > > > -----Original Message----- > From: ProPharma Systems AG - Gregor Bürgisser > <g.buergisser(a)propharma.ch> > Sender: stunnel-users-bounces(a)stunnel.org > Date: Thu, 28 Jun 2012 12:48:53 > To:<stunnel-users(a)stunnel.org> > Subject: [stunnel-users] Interoperability problems with .net client software > > Hi all, > > I'm using stunnel 4.53 under Linux to secure a service. There are two > different clients connecting to this service: My own client, also Linux > based and using libcurl and another (third party!) client being > developed using Microsoft .net stuff. > > Of course with my own client all works well. But we are not able to get > the Microsoft client running. stunnel keeps on telling: > > SSL_accept: 140890C7: error:140890C7:SSL > routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate > > We have tried diffierent things... I will outline them here if you think > it is helpful (in short: tried using certificates generated on the > Microsoft side, then tried using certificates created on the Linux side). > If "verify" ist set to 0 or 1 it works (of course) but with a higher > value the above message is logged. > > Are there any known pitfalls, problems or whatsoever when using stunnel > with a .net client? > Any advice would be appreciated! > > Regards, > Gregor > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

clean installation on Windows
by John 29 Jun '12

29 Jun '12

Hello. I would like to install stunnel on 64-bit Win7, and I would like to know whether it is possible to do so by just unzipping the downloaded files into one folder and then clicking on the main executable, that is, to avoid making registry entries, etc. I would like to have a minimal impact to whatever extent is possible. Can it be done in this way, or does it need the whole shebang installer procedure to be run?

4 5

Stunnel, Pan and the SSL23_GET_SERVER_HELLO:unknown protocol
by mike 28 Jun '12

28 Jun '12

Hello All, Running Debian 6.0, stunnel4 and Pan 0.133 I have set up Pan and installed stunnel so that I can use ssl with nntp. Installing Pan and stunnel was easy. I've edited Pan to use localhost:119 and edited my config file in stunnel to point to my nntp server. I have allowed nntp in my hosts.allow for ALL:ALL. The problem I am running into is that Pan does not connect. I get the following error: Error reading from localhost. Connection reset by peer Checking with the following openssl command produced this error: root@triglav:/etc/stunnel# openssl s_client -ssl3 -connect localhost:119 CONNECTED(00000003) write:errno=104 Looking at the logs for stunnel I see many repetitions of this message: 2012.06.25 14:18:26 LOG7[16355:3074153328]: nntp started 2012.06.25 14:18:26 LOG7[16355:3074153328]: FD 13 in non-blocking mode 2012.06.25 14:18:26 LOG7[16355:3074153328]: TCP_NODELAY option set on local socket 2012.06.25 14:18:26 LOG7[16355:3074153328]: Waiting for a libwrap process 2012.06.25 14:18:26 LOG7[16355:3074153328]: Acquired libwrap process #0 2012.06.25 14:18:26 LOG7[16355:3074153328]: Releasing libwrap process #0 2012.06.25 14:18:26 LOG7[16355:3074153328]: Released libwrap process #0 2012.06.25 14:18:26 LOG7[16355:3074153328]: nntp permitted by libwrap from 127.0.0.1:59451 2012.06.25 14:18:26 LOG5[16355:3074153328]: nntp accepted connection from 127.0.0.1:59451 2012.06.25 14:18:26 LOG7[16355:3074153328]: FD 14 in non-blocking mode 2012.06.25 14:18:26 LOG6[16355:3074153328]: connect_blocking: connecting 209.197.15.238:119 2012.06.25 14:18:26 LOG7[16355:3074153328]: connect_blocking: s_poll_wait 209.197.15.238:119: waiting 10 seconds 2012.06.25 14:18:26 LOG5[16355:3074153328]: connect_blocking: connected 209.197.15.238:119 2012.06.25 14:18:26 LOG5[16355:3074153328]: nntp connected remote server from 192.168.2.56:51455 2012.06.25 14:18:26 LOG7[16355:3074153328]: Remote FD=14 initialized 2012.06.25 14:18:26 LOG7[16355:3074153328]: TCP_NODELAY option set on remote socket 2012.06.25 14:18:26 LOG7[16355:3074153328]: SSL state (connect): before/connect initialization 2012.06.25 14:18:26 LOG7[16355:3074153328]: SSL state (connect): SSLv2/v3 write client hello A 2012.06.25 14:18:26 LOG3[16355:3074153328]: SSL_connect: 140770FC: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol 2012.06.25 14:18:26 LOG5[16355:3074153328]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2012.06.25 14:18:26 LOG7[16355:3074153328]: nntp finished (0 left) Anyone know what is missing? It almost looks like it cant talk in either SSLv2 or v3 which makes no sense. Here is my stunnel config: ; Sample stunnel configuration file by Michal Trojnara 2002-2009 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of the chroot jail) ; Certificate/key is needed in server mode and optional in client mode ;cert = /etc/ssl/certs/stunnel.pem ;key = /etc/ssl/certs/stunnel.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = all ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside the chroot jail pid = /stunnel4.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = zlib ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = /var/log/stunnel4/stunnel.log foreground = no ; Use it for client mode client = yes ; Service-level configuration [nntp] accept = localhost:119 connect = news.aliant.net:119 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini

2 4

Interoperability problems with .net client software
by ProPharma Systems AG - Gregor Bürgisser 28 Jun '12

28 Jun '12

Hi all, I'm using stunnel 4.53 under Linux to secure a service. There are two different clients connecting to this service: My own client, also Linux based and using libcurl and another (third party!) client being developed using Microsoft .net stuff. Of course with my own client all works well. But we are not able to get the Microsoft client running. stunnel keeps on telling: SSL_accept: 140890C7: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate We have tried diffierent things... I will outline them here if you think it is helpful (in short: tried using certificates generated on the Microsoft side, then tried using certificates created on the Linux side). If "verify" ist set to 0 or 1 it works (of course) but with a higher value the above message is logged. Are there any known pitfalls, problems or whatsoever when using stunnel with a .net client? Any advice would be appreciated! Regards, Gregor

2 1

Accept on same port to ethernet aliases
by John Morrison 27 Jun '12

27 Jun '12

Hi, Is it possible to configure stunnel to use the same port on different IP addresses that are Ethernet aliases? I have successfully set up a configuration file accepting SSL connections. Firstly I did this on all IP addresses by using the following configuration lines: accept = 443 connect = 80 This worked correctly. I then attempted to setup a second configuration file on an aliased Ethernet address. The configuration file settings are: test1.conf accept = 10.168.1.132:443 connect = 10.168.1.132:80 test2.conf accept = 10.168.1.133:443 connect = 10.168.1.133:80 Stunnel is able to start the first configuration file, but not the second. The error message I can see when I run the second configuration file in the foreground is: accept socket: FD=11 allocated (non-blocking mode) Option SO_REUSEADDR set on accept socket Error binding https to 10.168.1.133:443 bind: Address already in use (98) and if I telnet to 10.168.1.133 on port 443 the connection is accepted. I have attempted to use the binding socket options in the configuration files as described in the manual: socket = a:SO_BINDTODEVICE=eth0:0 and socket = a:SO_BINDTODEVICE=eth0:1 However in this case stunnel will not start either configuration file. The error message I receive is: Option SO_REUSEADDR set on accept socket SO_BINDTODEVICE: No such device (19) Is there a different way to configure stunnel to allow this to work? My ipconfig settings are below. I am running the ubuntu 10.04 version of stunnel. The version output is: stunnel 4.35 on x86_64-pc-linux-gnu with OpenSSL 1.0.0e 6 Sep 2011 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Thanks, John eth0:0 Link encap:Ethernet HWaddr 3c:4a:92:6d:0b:08 inet addr:10.168.1.132 Bcast:10.168.1.132 Mask:255.255.255.255 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Interrupt:16 Memory:f4000000-f4012800 eth0:1 Link encap:Ethernet HWaddr 3c:4a:92:6d:0b:08 inet addr:10.168.1.133 Bcast:10.168.1.133 Mask:255.255.255.255 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Interrupt:16 Memory:f4000000-f4012800

2 2

Confused about stunnel + haproxy
by Robin Lee Powell 27 Jun '12

27 Jun '12

I've set up stunnel + haproxy using the "protocol = proxy" method, but stunnel doesn't seem to pass to haproxy any information about the source IP of the original connection, which I thought was the point of using this method? Can someone tell me what I'm missng? I just want to have haproxy with SSL support without losing the client IP information completely. -Robin -- http://singinst.org/ : Our last, best hope for a fantastic future. .i ko na cpedu lo nu stidi vau loi jbopre .i danfu lu na go'i li'u .e lu go'i li'u .i ji'a go'i lu na'e go'i li'u .e lu go'i na'i li'u .e lu no'e go'i li'u .e lu to'e go'i li'u .e lu lo mamta be do cu sofybakni li'u

1 1

socket status
by Dee Ayy 20 Jun '12

20 Jun '12

My socket in Eiffel will report that it is connected, but when it tries to write to the socket, it will fail and report Connection reset by peer I/O error The syslog shows 1) ... accepted connection from 127.0.0.1:.. 2) connect_blocking: getsockopt A_REMOTE_IP:A_REMOTE_PORT: Connection refused (111) 3) Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket I believe that my socket is connecting locally fine 127.0.0.1:.. in step 1, and then the remote connection via stunnel is failing in step 2, but I have tried to write to the socket in between steps 1 and 2. Is this proper behavior? How can I know the status of the remote connection? Wait a while and then test? Is the socket state really just the state of the local stunnel connection? Should stunnel report a different state (as seen by my socket) until it determines the remote socket state?

1 0

What version of stunnel am I using?
by Dee Ayy 20 Jun '12

20 Jun '12

I don't see a version here stunnel -version 2012.06.20 16:44:05 LOG7[25078:3074172608]: RAND_status claims sufficient entropy for the PRNG 2012.06.20 16:44:05 LOG7[25078:3074172608]: PRNG seeded successfully 2012.06.20 16:44:05 LOG3[25078:3074172608]: /etc/stunnel/stunnel.pem: No such file or directory (2) apt-cache search stunnel on Ubuntu has stunnel4

1 0

Error connecting through IE6
by Karl Kloppenborg 15 Jun '12

15 Jun '12

Hey Stunnel guys! I've got a bit of an issue in which users on ie6 cannot connect through HTTPs to my haproxy cluster, they get a 404 page cannot be displayed. Works fine in all other browsers ;) The logs from Stunnel are: 2012.06.13 01:06:09 LOG7[28347:47884616028640]: local socket: FD=14 allocated (non-blocking mode) 2012.06.13 01:06:09 LOG7[28347:47884616028640]: Service incoming-https accepted FD=14 from [ClientIP]:1208 2012.06.13 01:06:09 LOG7[28347:1078843712]: Service incoming-https started 2012.06.13 01:06:09 LOG7[28347:1078843712]: Option TCP_NODELAY set on local socket 2012.06.13 01:06:09 LOG7[28347:1078843712]: Waiting for a libwrap process 2012.06.13 01:06:09 LOG7[28347:1078843712]: Acquired libwrap process #0 2012.06.13 01:06:09 LOG7[28347:1078843712]: Releasing libwrap process #0 2012.06.13 01:06:09 LOG7[28347:1078843712]: Released libwrap process #0 2012.06.13 01:06:09 LOG7[28347:1078843712]: Service incoming-https permitted by libwrap from [ClientIP]:1208 2012.06.13 01:06:09 LOG5[28347:1078843712]: Service incoming-https accepted connection from [ClientIP]:1208 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): before/accept initialization 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 read client hello A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 write server hello A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 write certificate A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 write server done A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 flush data 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 read client key exchange A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 read finished A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 write change cipher spec A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 write finished A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 flush data 2012.06.13 01:06:09 LOG7[28347:1078843712]: 1 items in the session cache 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 client connects (SSL_connect()) 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 client connects that finished 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 client renegotiations requested 2012.06.13 01:06:09 LOG7[28347:1078843712]: 1 server connects (SSL_accept()) 2012.06.13 01:06:09 LOG7[28347:1078843712]: 1 server connects that finished 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 server renegotiations requested 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 session cache hits 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 external session cache hits 2012.06.13 01:06:09 LOG7[28347:1078843712]: 1 session cache misses 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 session cache timeouts 2012.06.13 01:06:09 LOG6[28347:1078843712]: SSL accepted: new session negotiated 2012.06.13 01:06:09 LOG6[28347:1078843712]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2012.06.13 01:06:09 LOG7[28347:1078843712]: remote socket: FD=15 allocated (non-blocking mode) 2012.06.13 01:06:09 LOG6[28347:1078843712]: connect_blocking: connecting [HAPROXY IP]:81 2012.06.13 01:06:09 LOG7[28347:1078843712]: connect_blocking: s_poll_wait [HAPROXY IP]:81: waiting 10 seconds 2012.06.13 01:06:09 LOG5[28347:1078843712]: connect_blocking: connected [HAPROXY IP]:81 2012.06.13 01:06:09 LOG5[28347:1078843712]: Service incoming-https connected remote server from [HAPROXY IP]:55823 2012.06.13 01:06:09 LOG7[28347:1078843712]: Remote FD=15 initialized 2012.06.13 01:06:09 LOG7[28347:1078843712]: Option TCP_NODELAY set on remote socket 2012.06.13 01:06:09 LOG5[28347:1078843712]: Error detected on SSL (read) file descriptor: Connection reset by peer (104) 2012.06.13 01:06:09 LOG5[28347:1078843712]: Connection reset: 0 bytes sent to SSL, 320 bytes sent to socket 2012.06.13 01:06:09 LOG7[28347:1078843712]: Service incoming-https finished (0 left) 2012.06.13 01:06:09 LOG7[28347:1078843712]: str_stats: 0 block(s), 0 data byte(s), 0 control byte(s) Could stunnel be at play here or am I looking at the wrong thing? Thanks! Karl. Karl Kloppenborg Programming Ninja Crucial Paradigm Pty Ltd Suite 1 Level 3 104-106 Commonwealth St Surry Hills NSW 2010 Australia 1300 884 839 - Sales & Support (AU Only) <https://support.crucialp.com/> Click here for the Support Desk d: 02 8202 9994 f: 02 92818261 m: 0416 236 908 e: <mailto:[email protected]> karl(a)crucial.com.au Crucial Paradigm is a leading Web Hosting provider that specialises in Cloud solutions. We are commited to keeping our planet green, please reduce, reuse and recycle your office paper. Description: crucial_2012

2 3

Stunnel 4.53 for win32 - without config file
by Ivanko B 14 Jun '12

14 Jun '12

How to bypass reading any config file so that all needed options were fed from command line ? (security reasons)

5 7

Re: [stunnel-users] Getting Stunnel to Work Under Windows 7 64-bit
by Brian Wilkins 14 Jun '12

14 Jun '12

I should note that I have been running stunnel 4.45 on Windows 7 since Oct-2011 with no problems whatsoever. It has been running non-stop on Windows 7 to this date with no problems. I have not upgraded to the latest because I have not been able to have time to test the FIPS changes with my configuration yet. Brian

4 6

stunnel version 4.53 says SSL server needs a certificate on Windows 7?
by Wayne Walter 13 Jun '12

13 Jun '12

I have been using stunnel previous versions just fine. It didn't apparently have the feature of a certificate in SSL server mode. That's alright but not necessary for us as we're simply running a localhost server to tunnel to the remote server. Anyway, I have read the FAQ tutorial and such related to this and tried everything. No mater what I do with the cert or key settings it still gives this same error here's the complete output.... No limit detected for the number of clients stunnel 4.53 on x86-pc-mingw32-gnu platform Compiled/running with OpenSSL 0.9.8s-fips 4 Jan 2012 Threading:WIN32 SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:SELECT+IPv6 Reading configuration from file stunnel.conf FIPS mode is enabled Compression not enabled Snagged 64 random bytes from C:/.rnd Wrote 0 new random bytes to C:/.rnd PRNG seeded successfully Initializing service section [FIX] Section FIX: SSL server needs a certificate Server is down And here is the stunnel.conf file contents: ; Certificate/key is needed in server mode and optional in client mode cert = stunnel.pem ;key = stunnel.pem ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 [FIX] accept = 127.0.0.1:5679 connect = 216.52.236.112:5680 TIMEOUTconnect = 5 [FIXLIVE] accept = 127.0.0.1:5680 connect = 216.52.236.185:51581 TIMEOUTconnect = 5 Please not that stunnel came installed with an stunnel.pem file. I tried uncommenting the config line for the key. Also regenerated the key using openssh per instructions. I tried using absolute path to the cert file. Nothing makes any difference. Is this a defect in stunnel? Or am I doing something wrong?

2 1

Re: [stunnel-users] Log rollover
by Michael Curran 11 Jun '12

11 Jun '12

Windows our linux? Linux just add the log file location to the file that are part of rotate.d and thats solved daily. Sent from my Verizon Wireless 4GLTE smartphone. From : Brian Wilkins Subject : [stunnel-users] Log rollover I have noticed my stunnel log has reached 100MB on an unmanned system. Is there an option to cause the stunnel log to rollover and delete the old log file after a pre-defined period of time? If not, I can try adding it to log.c. Brian -----Original Message----- From: Brian Wilkins Sent: 6/11/2012 3:48:22 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Log rollover I have noticed my stunnel log has reached 100MB on an unmanned system. Is there an option to cause the stunnel log to rollover and delete the old log file after a pre-defined period of time? If not, I can try adding it to log.c. Brian

2 1

Log rollover
by Brian Wilkins 11 Jun '12

11 Jun '12

I have noticed my stunnel log has reached 100MB on an unmanned system. Is there an option to cause the stunnel log to rollover and delete the old log file after a pre-defined period of time? If not, I can try adding it to log.c. Brian

1 0

Using stunnel with Brother MFC-8890
by Scott McKeown 08 Jun '12

08 Jun '12

Hi Rolando, Can you please give us a bit more detail. What have you tried doing? How is your network setup? Whats your current STunnel Configuration file settings? Hopefully with this information we should be able to assist. -- With Kind Regards. Scott McKeown Loadbalancer.org http://www.loadbalancer.org

1 0

Using stunnel with Brother MFC-8890
by Rolando Pineda 07 Jun '12

07 Jun '12

Hi, Someone can help me to use stunnel and set up my Brother MFC-8890 to send email through SSL using the stunnel? Thanks in advanced. -- Saludos, _____________ Rolando Pineda

1 0

stunnel - haproxy setup with protocol = proxy
by Scott McKeown 07 Jun '12

07 Jun '12

Hi Robert, I've been doing some work on both HAProxy and STunnel myself over the last month or so. Your actual configuration files both look fine but one thing that you possibly missed is that you will have needed to have build HAProxy with the TProxy flag enabled, and I'm going to guess that you have also written and applied the Firewall rules for the transparent proxy. I've attached a DRAFT pdf of the work that I have been doing, its a very basic how-to on setting up both STunnel and HAProxy in Transparent mode on a Centos 6.2 system. -- With Kind Regards. Scott McKeown Loadbalancer.org http://www.loadbalancer.org

2 4

stunnel - haproxy setup with protocol = proxy
by Robert Garcia 07 Jun '12

07 Jun '12

I am trying to setup stunnel with protocol = proxy through haproxy to my apache2 cluster. I have been using haproxy for a while, and wanted to try this before having to go to nginx, or some other proxy. My config works fine as is if I remove the "accept proxy" from the haproxy.cfg and the protocol=proxy from stunnel config, as soon as those are in, I get a 502 bad gateway. My haproxy.cfg: global log 127.0.0.1 local0 log 127.0.0.1 local1 debug #log loghost local0 info maxconn 50000 #chroot /usr/share/haproxy user haproxy group haproxy daemon #debug #quiet defaults log global mode http option httplog option dontlognull option forwardfor retries 3 option redispatch maxconn 50000 contimeout 5000 clitimeout 60000 srvtimeout 300000 stats uri /haproxy_xxxx stats realm Global\ statistics stats auth xxxxxx:xxxxxxx frontend dev-stg bind *:80 mode http timeout client 5m option forwardfor default_backend dev-www frontend dev-stg-ssl bind *:81 accept-proxy mode http option httpclose option forwardfor timeout client 5m default_backend dev-www backend dev-www mode http timeout connect 10s timeout server 600s balance roundrobin #begin_web_config server ws1 10.0.2.10 maxconn 1000 check port 80 #end_web_config stats uri /haproxy_xxxx stats realm Global\ statistics stats auth xxxxxx:xxxxxxx My stunnel config: ; ***************************************************************************** ; * Global Options * ; ***************************************************************************** ; A copy of some devices and system files is needed within the chroot jail ; Chroot conflicts with configuration file reload and many other features chroot = /var/lib/stunnel4/ ; Chroot jail can be escaped if setuid option is not used setuid = stunnel4 setgid = stunnel4 ; PID is created inside the chroot jail pid = /stunnel4.pid ; Debugging stuff (may useful for troubleshooting) debug = 7 output = /var/log/stunnel4/stunnel.log ; ***************************************************************************** ; * Service Defaults (may also be specified in individual service sections) * ; ***************************************************************************** ; Certificate/key is needed in server mode and optional in client mode cert = /usr/local/certs/server.crt key = /usr/local/certs/server.key ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; The following options provide additional security at some performance penalty ; Default ECDH/DH parameters are strong/conservative, so it is quite safe to ; comment out these lines in order to get a performance boost ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ***************************************************************************** ; * Service Definitions (remove all services for inetd mode) * ; ***************************************************************************** ; Example SSL server mode services ; Example SSL front-end to a web server [proxy] accept = 443 connect = 127.0.0.1:81 ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SSL ; It does not use SSL close-notify alert designed to prevent truncation attacks TIMEOUTclose = 0 protocol = proxy ; vim:ft=dosini And here is the syslog for haproxy and stunner (ip address in log and cfgs are changed to protect the innocent ;-) ) Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193127680]: Service [proxy] accepted (FD=3) from 1.2.3.4:35045 Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: Service [proxy] started Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG5[1737:140557193119488]: Service [proxy] accepted connection from 1.2.3.4:35045 Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG6[1737:140557193119488]: connect_blocking: connecting 127.0.0.1:81 Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: connect_blocking: s_poll_wait 127.0.0.1:81: waiting 10 seconds Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG5[1737:140557193119488]: connect_blocking: connected 127.0.0.1:81 Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG5[1737:140557193119488]: Service [proxy] connected remote server from 127.0.0.1:49010 Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: Remote socket (FD=8) initialized Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG6[1737:140557193119488]: Server-mode proxy protocol negotiations started Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: -> PROXY TCP4 1.2.3.4 10.0.2.9 35045 443 Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG6[1737:140557193119488]: Server-mode proxy protocol negotiations succeeded Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG6[1737:140557193119488]: SSL accepted: new session negotiated Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG6[1737:140557193119488]: Negotiated TLSv1/SSLv3 ciphersuite: DHE-RSA-AES256-SHA (256-bit encryption) Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG6[1737:140557193119488]: Compression: null, expansion: null Jun 7 07:10:50 localhost haproxy[1710]: 1.2.3.4:35045 [07/Jun/2012:07:10:50.496] dev-stg-ssl dev-www/ws1 214/0/1/-1/216 502 754 - - PH-- 0/0/0/0/0 0/0 "GET / HTTP/1.1" Jun 7 07:10:50 localhost haproxy[1710]: 1.2.3.4:35045 [07/Jun/2012:07:10:50.496] dev-stg-ssl dev-www/ws1 214/0/1/-1/216 502 754 - - PH-- 0/0/0/0/0 0/0 "GET / HTTP/1.1" Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: Socket closed on read Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: Sending close_notify alert Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG6[1737:140557193119488]: SSL_shutdown successfully sent close_notify alert Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG3[1737:140557193119488]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG5[1737:140557193119488]: Connection closed: 204 byte(s) sent to SSL, 137 byte(s) sent to socket Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: Remote socket (FD=8) closed Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: Local socket (FD=3) closed Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: Service [proxy] finished (0 left) 1.2.3.4 = my external ip I am testing with 10.0.2.9 = haproxy/stunnel server 10.0.2.10 = my apache server Any ideas greatly appreciated. -- Robert Garcia BigHead Technology 15520 Coutolenc Rd Magalia, Ca 95954 ph: 530.645.4040 x222 fax: 530.645.4040 rgarcia(a)bighead.net (mailto:[email protected]) - http://bighead.net/

1 0

Re: [stunnel-users] Outlook and stunnel
by James Devine 05 Jun '12

05 Jun '12

I'm using stunnel as a reverse proxy. I have an smtp server smtp1 and an stunnel server proxy1. Clients connect to and negotiate ssl on proxy1 which then connects to smtp1 via a plaintext connection. stunnel does not reside on the client. If I connect the client directly to smtp1 via ssl it works fine. On Tue, Jun 5, 2012 at 12:20 PM, Pierre DELAAGE <delaage.pierre(a)free.fr>wrote: > Hmmm if you are using stunnel on client side (as suggested by your > correction) it is that YOU DO NOT WANT TO USE SSL OPTION in OUTLOOK. > > because stunnel will act as an "almost transparent' ssl tunnel. > > So in outlook : uncheck ssl option and give "localhost" as your smtp > server. > > and adapt local port according to your stunnel conf. > > Apart from that : I use stunnel on the server ONLY, with self signed > certificate coming from openssl, > and outlook configured as ssl client is working. > SSLversion = all is always GOOD > > works with stunnel 4.20 on linux mandriva 2008, outlook 2007 > > Pierre > > > > Le 05/06/2012 20:08, James Devine a écrit : > > > On Tue, Jun 5, 2012 at 10:52 AM, James Devine <fxmulder(a)gmail.com> wrote: > >> I am trying to setup stunnel to ssl proxy mail to an smtp server and this >> seems to work fine for thunderbird but when I try using outlook 2010 to >> connect via ssl I get the error: >> >> Send test e-mail message: Your server does not support the connection >> encryption type you have specified. Try changing the encryption method. >> >> For sslVersion I have the option of SSLv3 and TLSv1, all and SSLv2 do >> not seem to work so I'm not sure if that is the problem >> >> Anyone else run in to this or know what I might do to resolve it? >> > > I can get it to work if I setup ssl on the end server directly and bypass > stunnel > > > _______________________________________________ > stunnel-users mailing [email protected]://stunnel.mirt.net/mailman/listinfo/stunnel-users > > >

1 0

Outlook and stunnel
by James Devine 05 Jun '12

05 Jun '12

I am trying to setup stunnel to ssl proxy mail to an smtp server and this seems to work fine for thunderbird but when I try using outlook 2010 to connect via ssl I get the error: Send test e-mail message: Your server does not support the connection encryption type you have specified. Try changing the encryption method. For sslVersion I have the option of SSLv3 and TLSv1, all and SSLv2 do not seem to work so I'm not sure if that is the problem Anyone else run in to this or know what I might do to resolve it?

1 1

stunnel 4.53 released
by Michal Trojnara 03 Jun '12

03 Jun '12

Dear Users, I have released version 4.53 of stunnel. This is major a bugfix release. Upgrade is highly recommended. The ChangeLog entry: Version 4.53, 2012.03.19, urgency: MEDIUM: * New features - Added client-mode "sni" option to directly control the value of TLS Server Name Indication (RFC 3546) extension. - Added support for IP_FREEBIND socket option with a pached Linux kernel. - Glibc-specific dynamic allocation tuning was applied to help unused memory deallocation. - Non-blocking OCSP implementation. * Bugfixes - Compilation fixes for old versions of OpenSSL (tested against 0.9.6). - Usage of uninitialized variables fixed in exec+connect services. - Occasional logging subsystem crash with exec+connect services. - OpenBSD compilation fix (thx to Michele Orru'). - Session id context initialized with session name rather than a constant. - Fixed handling of a rare inetd mode use case, where either stdin or stdout is a socket, but not both of them at the same time. - Fixed missing OPENSSL_Applink http://www.openssl.org/support/faq.html#PROG2 - Fixed crash on termination with FORK threading model. - Fixed dead canary after configuration reload with open connections. - Fixed missing file descriptors passed to local mode processes. - Fixed required jmp_buf alignment on Itanium platform. - Removed creating /dev/zero in the chroot jail on Solaris platform. - Fixed detection of WSAECONNREFUSED Winsock error. - Missing Microsoft.VC90.CRT.manifest added to Windows installer. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.53.tar.gz: 3e640aa4c96861d10addba758b66e99e7c5aec8697764f2a59ca2268901b8e57 Best regards, Mike

3 2

Re: [stunnel-users] BEAST Attack
by Scott McKeown 31 May '12

31 May '12

Hi Mike, Thank you for your input. I'll rebuild today and retest. Our company openly supports Open Source projects that we use and we will continue to do so. However, since we are still in a R&D position with STunnel at the moment I thought it would be better to continue to use the users group. I'll post again once I've rebuilt and tested, which might not be until the end of next week now as we have an nice extended weekend in the UK for the Golden Jubilee which is nice. ~Yours, Scott -- With Kind Regards. Scott McKeown Loadbalancer.org http://www.loadbalancer.org

1 0

Re: [stunnel-users] BEAST Attack
by Scott McKeown 30 May '12

30 May '12

Hi Michal, Thanks for following this up. I'm using the latest build of STunnel v4.53 as shown below (I check the site once a week just to make sure too) # stunnel -version stunnel 4.53 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.0-fips 29 Mar 2010 Threading:PTHREAD SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:POLL+IPv6 Global options: debug = daemon.notice pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH (with "fips = no") session = 300 seconds sslVersion = TLSv1 (with "fips = yes") sslVersion = TLSv1 for client, all for server (with "fips = no") stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none I've also included a copy of my stunnel.cfg file below: # more /etc/stunnel/stunnel.cfg # STunnel configuration file generated by loadbalancer.org appliance setgid = nobody pid = /stunnel.pid debug = 0 [S1] accept = 192.168.82.182:443 connect = 192.168.82.181:81 cert = /etc/loadbalancer.org/certs/S1.pem ciphers = RC4:HIGH:!MD5:!aNULL options = NO_SSLv2 protocol = proxy I'm looking to include the STunnel Product within our Loadbalancer Appliance in our next upcoming release but with everyone now using the SSL checker that I mentioned in one of my last e-Mails more customers are becoming concerned about MITM Attacks etc. so I would really like to get this solved before I move forward with the project. Oh, I guess I should also mention that this is running on a Centos 6.2 box. ~Yours, Scott

2 1

BEAST Attack
by Scott McKeown 29 May '12

29 May '12

Hi All, Has anyone looked at the current issue with the BEAST Attack. I'm looking at https://www.ssllabs.com/ssltest/index.html which can be used for testing SSL Certificates I also use Pound Proxy which I have now patched and this has removed the threat. However, I don't seem to be able to get the same result from a STunnel installation. If anyone can give some advice that would be great. ~Yours, Scott

3 5

limit to number of services
by Terren Suydam 25 May '12

25 May '12

Hi there, I seem to be hitting a limit on the number of stunnel services I can run simultaneously. According to the log, they appear to set up without any issues, but after 64 services they don't pass traffic. Is this something stunnel itself limits, or is it an OS limitation? I am running the latest windows build on Windows Server 2008. Either way, is there an easy way to increase the number of services? Thanks, Terren

1 0

Stunnel quitted unexpectedly repeated for a number of times
by Im Q 24 May '12

24 May '12

Hi all, We have encountered a strange situation that stunnel We have the following setup in our production servers. > Windows [ ... -> Apache -> Stunnel 4.50 ] --> AIX [Stunnel 4.50 -> JBoss] * As we had experienced the Stunnel in AIX died in a random time during testing stage, we added a cron job to start Stunnel in case stunnel disappeared. Recently, in our production servers, the stunnel disappeared and being started by corn repeatedly during a short period of time in the same day. We so far encounter similar problem for 2 times. Below are the restart time of the most recent incident. > 09:22:00,09:38:00,09:45:00, > 10:24:00,10:34:00,10:50:00, > 11:06:00,11:16:01,11:17:00,11:19:00,11:22:00,11:23:00,11:29:01,11:32:00,11:34:01,11:35:00,11:39:01 We found that in the logs, they always ended with the following: > 2012.05.23 11:16:03 LOG7[12517524:1]: Dispatching signals from the signal pipe > ... > 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD > ...(same message repeatly for serveral time) > 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD Here is the active options in config file: [Windows Side] > debug = 7 > output = D:\app-logs\stunnel\stunnel.log > verify = 0 > options = NO_SSLv2 > client = yes > taskbar = no > [prdweb01_out_app01] > accept = PRDWEB01:18009 > connect = PRDAPP01:18010 > [prdweb01_out_app02] > accept = PRDWEB01:18019 > connect = PRDAPP02:18010 [AIX Side] > pid = /opt/stunnel/4.50/prd/stunnel0-app/stunnel.pid > debug = 7 > output = /opt/stunnel/4.50/prd/stunnel0-app/log/stunnel.log > cert = /opt/stunnel/4.50/prd/stunnel0-app/PRD.certnew-b64.cer > key = /opt/stunnel/4.50/prd/stunnel0-app/PRD.private.key > options = NO_SSLv2 > [prdweb_in] > accept = PRDAPP01:18010 > connect = PRDAPP01:8009 Start up command > nohup stunnel /opt/stunnel/4.50/prd/stunnel0-app/stunnel-server.conf Attached at the end is the one of the log during the incident. Is there any suggestion on how to find out the cause of the problem? What are the possible causes that would make it disappeared after those processing of SIGCHLD signal? What may caused the signal dispatching other than killing them manually for shutdown? Thank you very much! Best Regards, Jacky -- LOG FILE CONTENT BELOW -- 2012.05.23 11:16:01 LOG7[11862064:1]: Clients allowed=31999 2012.05.23 11:16:01 LOG5[11862064:1]: stunnel 4.50 on powerpc-ibm-aix6.1.0.0 platform 2012.05.23 11:16:01 LOG5[11862064:1]: Compiled/running with OpenSSL 0.9.8m 25 Feb 2010 2012.05.23 11:16:01 LOG5[11862064:1]: Threading:PTHREAD SSL:ENGINE Auth:none Sockets:POLL,IPv6 2012.05.23 11:16:01 LOG5[11862064:1]: Reading configuration from file /opt/stunnel/4.50/prd/stunnel0-app/stunnel-server.conf 2012.05.23 11:16:01 LOG6[11862064:1]: Unable to retrieve any random data from /home/appadmin/.rnd 2012.05.23 11:16:01 LOG7[11862064:1]: Wrote 0 new random bytes to /home/appadmin/.rnd 2012.05.23 11:16:01 LOG7[11862064:1]: PRNG seeded successfully 2012.05.23 11:16:01 LOG6[11862064:1]: Initializing SSL context for service prdweb_in 2012.05.23 11:16:01 LOG4[11862064:1]: Insecure file permissions on /opt/stunnel/4.50/prd/stunnel0-app/PRD.private.key 2012.05.23 11:16:01 LOG7[11862064:1]: Certificate: /opt/stunnel/4.50/prd/stunnel0-app/PRD.certnew-b64.cer 2012.05.23 11:16:01 LOG7[11862064:1]: Certificate loaded 2012.05.23 11:16:01 LOG7[11862064:1]: Key file: /opt/stunnel/4.50/prd/stunnel0-app/PRD.private.key 2012.05.23 11:16:01 LOG7[11862064:1]: Private key loaded 2012.05.23 11:16:01 LOG7[11862064:1]: Could not load DH parameters from /opt/stunnel/4.50/prd/stunnel0-app/PRD.certnew-b64.cer 2012.05.23 11:16:01 LOG7[11862064:1]: Using hardcoded DH parameters 2012.05.23 11:16:01 LOG7[11862064:1]: DH initialized with 2048-bit key 2012.05.23 11:16:01 LOG7[11862064:1]: SSL options set: 0x01000004 2012.05.23 11:16:01 LOG6[11862064:1]: SSL context initialized 2012.05.23 11:16:01 LOG5[11862064:1]: Configuration successful 2012.05.23 11:16:01 LOG7[11862064:1]: Option SO_REUSEADDR set on accept socket 2012.05.23 11:16:01 LOG7[11862064:1]: Service prdweb_in bound to 10.18.7.71:18010 2012.05.23 11:16:01 LOG7[11862064:1]: Service prdweb_in opened FD=7 2012.05.23 11:16:01 LOG7[12517524:1]: Created pid file /opt/stunnel/4.50/prd/stunnel0-app/stunnel.pid 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=0 from 10.18.7.11:61657 2012.05.23 11:16:01 LOG7[12517524:258]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:258]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:258]: Service prdweb_in accepted connection from 10.18.7.11:61657 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=1 from 10.18.7.11:61685 2012.05.23 11:16:01 LOG7[12517524:515]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:515]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:515]: Service prdweb_in accepted connection from 10.18.7.11:61685 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=2 from 10.18.7.11:61667 2012.05.23 11:16:01 LOG7[12517524:772]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:772]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:772]: Service prdweb_in accepted connection from 10.18.7.11:61667 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=9 from 10.18.7.11:61659 2012.05.23 11:16:01 LOG7[12517524:1029]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:1029]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:1029]: Service prdweb_in accepted connection from 10.18.7.11:61659 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=10 from 10.18.7.12:64270 2012.05.23 11:16:01 LOG7[12517524:1286]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:1286]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:1286]: Service prdweb_in accepted connection from 10.18.7.12:64270 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=11 from 10.18.7.11:61669 2012.05.23 11:16:01 LOG7[12517524:1543]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:1543]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:1543]: Service prdweb_in accepted connection from 10.18.7.11:61669 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=12 from 10.18.7.12:64268 2012.05.23 11:16:01 LOG7[12517524:1800]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:1800]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:1800]: Service prdweb_in accepted connection from 10.18.7.12:64268 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=13 from 10.18.7.11:61671 2012.05.23 11:16:01 LOG7[12517524:2057]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:2057]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:2057]: Service prdweb_in accepted connection from 10.18.7.11:61671 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=14 from 10.18.7.11:61673 2012.05.23 11:16:01 LOG7[12517524:2314]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:2314]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:2314]: Service prdweb_in accepted connection from 10.18.7.11:61673 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=15 from 10.18.7.11:61677 2012.05.23 11:16:01 LOG7[12517524:2571]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:2571]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:2571]: Service prdweb_in accepted connection from 10.18.7.11:61677 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=16 from 10.18.7.11:61676 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=18 from 10.18.7.12:64272 2012.05.23 11:16:01 LOG7[12517524:3085]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:3085]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:3085]: Service prdweb_in accepted connection from 10.18.7.12:64272 2012.05.23 11:16:01 LOG7[12517524:2828]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:2828]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:2828]: Service prdweb_in accepted connection from 10.18.7.11:61676 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=17 from 10.18.7.11:61661 2012.05.23 11:16:01 LOG7[12517524:3342]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:3342]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:3342]: Service prdweb_in accepted connection from 10.18.7.11:61661 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=19 from 10.18.7.11:61687 2012.05.23 11:16:01 LOG7[12517524:3599]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:3599]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:3599]: Service prdweb_in accepted connection from 10.18.7.11:61687 2012.05.23 11:16:01 LOG6[12517524:1286]: SSL accepted: new session negotiated 2012.05.23 11:16:01 LOG6[12517524:1286]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2012.05.23 11:16:01 LOG6[12517524:1286]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:01 LOG5[12517524:1286]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:01 LOG5[12517524:1286]: Service prdweb_in connected remote server from 10.18.7.71:56505 2012.05.23 11:16:01 LOG7[12517524:1286]: Remote FD=20 initialized 2012.05.23 11:16:01 LOG7[12517524:1286]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=21 from 10.18.7.11:61663 2012.05.23 11:16:01 LOG7[12517524:3856]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:3856]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:3856]: Service prdweb_in accepted connection from 10.18.7.11:61663 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=22 from 10.18.7.11:61665 2012.05.23 11:16:01 LOG7[12517524:4113]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=23 from 10.18.7.12:64274 2012.05.23 11:16:01 LOG7[12517524:4370]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:4113]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG7[12517524:4370]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:4370]: Service prdweb_in accepted connection from 10.18.7.12:64274 2012.05.23 11:16:01 LOG5[12517524:4113]: Service prdweb_in accepted connection from 10.18.7.11:61665 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=24 from 10.18.7.11:61681 2012.05.23 11:16:01 LOG7[12517524:4627]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:4627]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:4627]: Service prdweb_in accepted connection from 10.18.7.11:61681 2012.05.23 11:16:01 LOG6[12517524:1800]: SSL accepted: new session negotiated 2012.05.23 11:16:01 LOG6[12517524:1800]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2012.05.23 11:16:01 LOG6[12517524:1800]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:01 LOG5[12517524:1800]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:01 LOG5[12517524:1800]: Service prdweb_in connected remote server from 10.18.7.71:35492 2012.05.23 11:16:01 LOG7[12517524:1800]: Remote FD=25 initialized 2012.05.23 11:16:01 LOG7[12517524:1800]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=26 from 10.18.7.11:61689 2012.05.23 11:16:01 LOG7[12517524:4884]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:4884]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:4884]: Service prdweb_in accepted connection from 10.18.7.11:61689 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=27 from 10.18.7.12:64276 2012.05.23 11:16:01 LOG7[12517524:5141]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:5141]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:5141]: Service prdweb_in accepted connection from 10.18.7.12:64276 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=28 from 10.18.7.12:64278 2012.05.23 11:16:01 LOG7[12517524:5398]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:5398]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:5398]: Service prdweb_in accepted connection from 10.18.7.12:64278 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=29 from 10.18.7.12:64280 2012.05.23 11:16:01 LOG7[12517524:5655]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:5655]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:5655]: Service prdweb_in accepted connection from 10.18.7.12:64280 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=30 from 10.18.7.11:61680 2012.05.23 11:16:01 LOG7[12517524:5912]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:5912]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:5912]: Service prdweb_in accepted connection from 10.18.7.11:61680 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=31 from 10.18.7.12:64282 2012.05.23 11:16:01 LOG7[12517524:6169]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:6169]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:6169]: Service prdweb_in accepted connection from 10.18.7.12:64282 2012.05.23 11:16:01 LOG6[12517524:3085]: SSL accepted: new session negotiated 2012.05.23 11:16:01 LOG6[12517524:3085]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2012.05.23 11:16:01 LOG6[12517524:3085]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:01 LOG5[12517524:3085]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:01 LOG5[12517524:3085]: Service prdweb_in connected remote server from 10.18.7.71:52373 2012.05.23 11:16:01 LOG7[12517524:3085]: Remote FD=32 initialized 2012.05.23 11:16:01 LOG7[12517524:3085]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=33 from 10.18.7.11:61683 2012.05.23 11:16:01 LOG7[12517524:6426]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:6426]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:6426]: Service prdweb_in accepted connection from 10.18.7.11:61683 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=34 from 10.18.7.12:64284 2012.05.23 11:16:01 LOG7[12517524:6683]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:6683]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:6683]: Service prdweb_in accepted connection from 10.18.7.12:64284 2012.05.23 11:16:01 LOG6[12517524:258]: SSL accepted: new session negotiated 2012.05.23 11:16:01 LOG6[12517524:258]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2012.05.23 11:16:01 LOG6[12517524:258]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:01 LOG5[12517524:258]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:01 LOG5[12517524:258]: Service prdweb_in connected remote server from 10.18.7.71:33167 2012.05.23 11:16:01 LOG7[12517524:258]: Remote FD=35 initialized 2012.05.23 11:16:01 LOG7[12517524:258]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:02 LOG6[12517524:4370]: SSL accepted: new session negotiated 2012.05.23 11:16:02 LOG6[12517524:4370]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2012.05.23 11:16:02 LOG6[12517524:4370]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:4370]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:4370]: Service prdweb_in connected remote server from 10.18.7.71:53609 2012.05.23 11:16:02 LOG7[12517524:4370]: Remote FD=36 initialized 2012.05.23 11:16:02 LOG7[12517524:4370]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:02 LOG6[12517524:5398]: SSL accepted: new session negotiated 2012.05.23 11:16:02 LOG6[12517524:5398]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2012.05.23 11:16:02 LOG6[12517524:5398]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:5398]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:5398]: Service prdweb_in connected remote server from 10.18.7.71:40822 2012.05.23 11:16:02 LOG7[12517524:5398]: Remote FD=37 initialized 2012.05.23 11:16:02 LOG7[12517524:5398]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:02 LOG7[12517524:1]: Service prdweb_in accepted FD=38 from 10.18.7.11:61691 2012.05.23 11:16:02 LOG7[12517524:6940]: Service prdweb_in started 2012.05.23 11:16:02 LOG7[12517524:6940]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:02 LOG5[12517524:6940]: Service prdweb_in accepted connection from 10.18.7.11:61691 2012.05.23 11:16:02 LOG6[12517524:5655]: SSL accepted: new session negotiated 2012.05.23 11:16:02 LOG6[12517524:5655]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2012.05.23 11:16:02 LOG6[12517524:5655]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:5655]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:5655]: Service prdweb_in connected remote server from 10.18.7.71:53430 2012.05.23 11:16:02 LOG7[12517524:5655]: Remote FD=39 initialized 2012.05.23 11:16:02 LOG7[12517524:5655]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:02 LOG7[12517524:1]: Service prdweb_in accepted FD=40 from 10.18.7.12:64286 2012.05.23 11:16:02 LOG7[12517524:7197]: Service prdweb_in started 2012.05.23 11:16:02 LOG7[12517524:7197]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:02 LOG5[12517524:7197]: Service prdweb_in accepted connection from 10.18.7.12:64286 2012.05.23 11:16:02 LOG7[12517524:5655]: SSL closed on SSL_read 2012.05.23 11:16:02 LOG7[12517524:5655]: Sending socket write shutdown 2012.05.23 11:16:02 LOG7[12517524:1]: Service prdweb_in accepted FD=41 from 10.18.7.11:61693 2012.05.23 11:16:02 LOG7[12517524:7454]: Service prdweb_in started 2012.05.23 11:16:02 LOG7[12517524:7454]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:02 LOG5[12517524:7454]: Service prdweb_in accepted connection from 10.18.7.11:61693 2012.05.23 11:16:02 LOG7[12517524:1]: Service prdweb_in accepted FD=42 from 10.18.7.11:61695 2012.05.23 11:16:02 LOG7[12517524:7711]: Service prdweb_in started 2012.05.23 11:16:02 LOG7[12517524:7711]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:02 LOG5[12517524:7711]: Service prdweb_in accepted connection from 10.18.7.11:61695 2012.05.23 11:16:02 LOG6[12517524:515]: SSL accepted: new session negotiated 2012.05.23 11:16:02 LOG6[12517524:515]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2012.05.23 11:16:02 LOG6[12517524:515]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:515]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:515]: Service prdweb_in connected remote server from 10.18.7.71:50558 2012.05.23 11:16:02 LOG7[12517524:515]: Remote FD=43 initialized 2012.05.23 11:16:02 LOG7[12517524:515]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:02 LOG6[12517524:1029]: SSL accepted: new session negotiated 2012.05.23 11:16:02 LOG6[12517524:1029]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2012.05.23 11:16:02 LOG6[12517524:1029]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:1029]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:1029]: Service prdweb_in connected remote server from 10.18.7.71:57414 2012.05.23 11:16:02 LOG7[12517524:1029]: Remote FD=44 initialized 2012.05.23 11:16:02 LOG7[12517524:1029]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:02 LOG7[12517524:1]: Service prdweb_in accepted FD=45 from 10.18.7.12:64288 2012.05.23 11:16:02 LOG7[12517524:7968]: Service prdweb_in started 2012.05.23 11:16:02 LOG7[12517524:7968]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:02 LOG5[12517524:7968]: Service prdweb_in accepted connection from 10.18.7.12:64288 2012.05.23 11:16:02 LOG7[12517524:1]: Service prdweb_in accepted FD=46 from 10.18.7.12:64290 2012.05.23 11:16:02 LOG7[12517524:8225]: Service prdweb_in started 2012.05.23 11:16:02 LOG7[12517524:8225]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:02 LOG5[12517524:8225]: Service prdweb_in accepted connection from 10.18.7.12:64290 2012.05.23 11:16:02 LOG6[12517524:772]: SSL accepted: new session negotiated 2012.05.23 11:16:02 LOG6[12517524:772]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2012.05.23 11:16:02 LOG6[12517524:772]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:772]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:772]: Service prdweb_in connected remote server from 10.18.7.71:33957 2012.05.23 11:16:02 LOG7[12517524:772]: Remote FD=47 initialized 2012.05.23 11:16:02 LOG7[12517524:772]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:02 LOG6[12517524:8225]: SSL accepted: previous session reused 2012.05.23 11:16:02 LOG6[12517524:8225]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:8225]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:02 LOG6[12517524:7968]: SSL accepted: previous session reused 2012.05.23 11:16:02 LOG5[12517524:8225]: Service prdweb_in connected remote server from 10.18.7.71:36648 2012.05.23 11:16:02 LOG6[12517524:7968]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:02 LOG7[12517524:8225]: Remote FD=48 initialized 2012.05.23 11:16:02 LOG7[12517524:8225]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:02 LOG5[12517524:7968]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:7968]: Service prdweb_in connected remote server from 10.18.7.71:38529 2012.05.23 11:16:02 LOG7[12517524:7968]: Remote FD=49 initialized 2012.05.23 11:16:02 LOG7[12517524:7968]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:02 LOG7[12517524:1]: Service prdweb_in accepted FD=50 from 10.18.7.11:61697 2012.05.23 11:16:02 LOG7[12517524:8482]: Service prdweb_in started 2012.05.23 11:16:02 LOG7[12517524:8482]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:02 LOG5[12517524:8482]: Service prdweb_in accepted connection from 10.18.7.11:61697 2012.05.23 11:16:02 LOG6[12517524:3599]: SSL accepted: new session negotiated 2012.05.23 11:16:02 LOG6[12517524:3599]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2012.05.23 11:16:02 LOG6[12517524:3599]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:3599]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:3599]: Service prdweb_in connected remote server from 10.18.7.71:65426 2012.05.23 11:16:02 LOG7[12517524:3599]: Remote FD=51 initialized 2012.05.23 11:16:02 LOG7[12517524:3599]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:02 LOG6[12517524:3856]: SSL accepted: new session negotiated 2012.05.23 11:16:02 LOG6[12517524:3856]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2012.05.23 11:16:02 LOG6[12517524:3856]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:3856]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:3856]: Service prdweb_in connected remote server from 10.18.7.71:51278 2012.05.23 11:16:02 LOG7[12517524:3856]: Remote FD=52 initialized 2012.05.23 11:16:02 LOG7[12517524:3856]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:02 LOG7[12517524:3856]: SSL closed on SSL_read 2012.05.23 11:16:02 LOG7[12517524:3856]: Sending socket write shutdown 2012.05.23 11:16:02 LOG7[12517524:4370]: SSL closed on SSL_read 2012.05.23 11:16:02 LOG7[12517524:4370]: Sending socket write shutdown 2012.05.23 11:16:02 LOG7[12517524:1]: Service prdweb_in accepted FD=53 from 10.18.7.11:61699 2012.05.23 11:16:02 LOG7[12517524:8739]: Service prdweb_in started 2012.05.23 11:16:02 LOG7[12517524:8739]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:02 LOG5[12517524:8739]: Service prdweb_in accepted connection from 10.18.7.11:61699 2012.05.23 11:16:02 LOG6[12517524:4113]: SSL accepted: new session negotiated 2012.05.23 11:16:02 LOG6[12517524:4113]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2012.05.23 11:16:02 LOG6[12517524:4113]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:4113]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:4113]: Service prdweb_in connected remote server from 10.18.7.71:33279 2012.05.23 11:16:02 LOG7[12517524:4113]: Remote FD=54 initialized 2012.05.23 11:16:02 LOG7[12517524:4113]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:02 LOG6[12517524:8482]: SSL accepted: previous session reused 2012.05.23 11:16:02 LOG7[12517524:4113]: SSL closed on SSL_read 2012.05.23 11:16:02 LOG7[12517524:4113]: Sending socket write shutdown 2012.05.23 11:16:02 LOG6[12517524:8482]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:8482]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:8482]: Service prdweb_in connected remote server from 10.18.7.71:50727 2012.05.23 11:16:02 LOG7[12517524:8482]: Remote FD=55 initialized 2012.05.23 11:16:02 LOG7[12517524:8482]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:02 LOG7[12517524:1]: Service prdweb_in accepted FD=56 from 10.18.7.11:61701 2012.05.23 11:16:02 LOG7[12517524:8996]: Service prdweb_in started 2012.05.23 11:16:02 LOG7[12517524:8996]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:02 LOG5[12517524:8996]: Service prdweb_in accepted connection from 10.18.7.11:61701 2012.05.23 11:16:02 LOG7[12517524:1]: Service prdweb_in accepted FD=57 from 10.18.7.11:61703 2012.05.23 11:16:02 LOG7[12517524:9253]: Service prdweb_in started 2012.05.23 11:16:02 LOG7[12517524:9253]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:02 LOG5[12517524:9253]: Service prdweb_in accepted connection from 10.18.7.11:61703 2012.05.23 11:16:02 LOG7[12517524:1]: Service prdweb_in accepted FD=58 from 10.18.7.11:61705 2012.05.23 11:16:02 LOG7[12517524:1]: Service prdweb_in accepted FD=59 from 10.18.7.11:61707 2012.05.23 11:16:02 LOG7[12517524:9510]: Service prdweb_in started 2012.05.23 11:16:02 LOG7[12517524:9510]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:02 LOG5[12517524:9510]: Service prdweb_in accepted connection from 10.18.7.11:61705 2012.05.23 11:16:02 LOG7[12517524:9767]: Service prdweb_in started 2012.05.23 11:16:02 LOG7[12517524:9767]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:02 LOG5[12517524:9767]: Service prdweb_in accepted connection from 10.18.7.11:61707 2012.05.23 11:16:02 LOG7[12517524:1]: Service prdweb_in accepted FD=60 from 10.18.7.11:61709 2012.05.23 11:16:02 LOG7[12517524:10024]: Service prdweb_in started 2012.05.23 11:16:02 LOG7[12517524:10024]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:02 LOG5[12517524:10024]: Service prdweb_in accepted connection from 10.18.7.11:61709 2012.05.23 11:16:02 LOG7[12517524:1]: Service prdweb_in accepted FD=61 from 10.18.7.12:64292 2012.05.23 11:16:02 LOG7[12517524:10281]: Service prdweb_in started 2012.05.23 11:16:02 LOG7[12517524:10281]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:02 LOG5[12517524:10281]: Service prdweb_in accepted connection from 10.18.7.12:64292 2012.05.23 11:16:03 LOG6[12517524:5912]: SSL accepted: new session negotiated 2012.05.23 11:16:03 LOG6[12517524:5912]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2012.05.23 11:16:03 LOG6[12517524:5912]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:5912]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:5912]: Service prdweb_in connected remote server from 10.18.7.71:59860 2012.05.23 11:16:03 LOG7[12517524:5912]: Remote FD=62 initialized 2012.05.23 11:16:03 LOG7[12517524:5912]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:03 LOG6[12517524:8739]: SSL accepted: previous session reused 2012.05.23 11:16:03 LOG6[12517524:8739]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:8739]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:8739]: Service prdweb_in connected remote server from 10.18.7.71:33186 2012.05.23 11:16:03 LOG7[12517524:8739]: Remote FD=63 initialized 2012.05.23 11:16:03 LOG7[12517524:8739]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:03 LOG6[12517524:8996]: SSL accepted: previous session reused 2012.05.23 11:16:03 LOG6[12517524:8996]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:8996]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:8996]: Service prdweb_in connected remote server from 10.18.7.71:46952 2012.05.23 11:16:03 LOG7[12517524:8996]: Remote FD=64 initialized 2012.05.23 11:16:03 LOG7[12517524:8996]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:03 LOG6[12517524:9510]: SSL accepted: previous session reused 2012.05.23 11:16:03 LOG6[12517524:9510]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:9510]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:9510]: Service prdweb_in connected remote server from 10.18.7.71:48237 2012.05.23 11:16:03 LOG7[12517524:9510]: Remote FD=65 initialized 2012.05.23 11:16:03 LOG7[12517524:9510]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:03 LOG6[12517524:9253]: SSL accepted: previous session reused 2012.05.23 11:16:03 LOG6[12517524:9253]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:9253]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:9253]: Service prdweb_in connected remote server from 10.18.7.71:54984 2012.05.23 11:16:03 LOG7[12517524:9253]: Remote FD=66 initialized 2012.05.23 11:16:03 LOG7[12517524:9253]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:03 LOG6[12517524:9767]: SSL accepted: previous session reused 2012.05.23 11:16:03 LOG6[12517524:9767]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:9767]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:9767]: Service prdweb_in connected remote server from 10.18.7.71:33305 2012.05.23 11:16:03 LOG7[12517524:9767]: Remote FD=67 initialized 2012.05.23 11:16:03 LOG7[12517524:9767]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:03 LOG6[12517524:10024]: SSL accepted: previous session reused 2012.05.23 11:16:03 LOG6[12517524:10024]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:10024]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:10024]: Service prdweb_in connected remote server from 10.18.7.71:48123 2012.05.23 11:16:03 LOG6[12517524:7197]: SSL accepted: previous session reused 2012.05.23 11:16:03 LOG6[12517524:7197]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:7197]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:7197]: Service prdweb_in connected remote server from 10.18.7.71:38228 2012.05.23 11:16:03 LOG7[12517524:7197]: Remote FD=69 initialized 2012.05.23 11:16:03 LOG7[12517524:7197]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:03 LOG6[12517524:6683]: SSL accepted: previous session reused 2012.05.23 11:16:03 LOG6[12517524:6683]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:6683]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:6683]: Service prdweb_in connected remote server from 10.18.7.71:51522 2012.05.23 11:16:03 LOG7[12517524:6683]: Remote FD=70 initialized 2012.05.23 11:16:03 LOG7[12517524:6683]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:03 LOG6[12517524:10281]: SSL accepted: previous session reused 2012.05.23 11:16:03 LOG6[12517524:10281]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:10281]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:10281]: Service prdweb_in connected remote server from 10.18.7.71:51109 2012.05.23 11:16:03 LOG7[12517524:10281]: Remote FD=71 initialized 2012.05.23 11:16:03 LOG7[12517524:10281]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:03 LOG7[12517524:10024]: Remote FD=68 initialized 2012.05.23 11:16:03 LOG7[12517524:1]: Dispatching signals from the signal pipe 2012.05.23 11:16:03 LOG7[12517524:10024]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD

1 0

Re: [stunnel-users] Stunnel not working
by Ludolf Holzheid 21 May '12

21 May '12

On Mon, 2012-05-21 18:09:35 +1000, Peter Connor wrote: > > Hi > I tried to reload stunnel.conf but I received error message says "Stunnel server is down due to error. You need to exit and correct the problem. Click OK to see the error log window". So I looked in error log window, it says: > "Server is downReading configuration from file stunnel.confFIPS mode is enabledCompression not enabledSnagged 64 random bytes from C:/.rndWrote 1024 new random bytes to C:/.rndPRNG seeded successfullyLine 66: "connect secure.giganews.com:563": No '=' found > Server is down" > My operating system windows home XP. Any ideas how to fix this problem. Please help. Thanks > Peter Peter, I don't know why you are asking me and not the stunnel users list. Anyway, it seems to be what the error log says: Line 66 of your stunnel.conf is lacking an equal sign. HTH, Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

First message flows through second one does not
by George Cardenas 19 May '12

19 May '12

I been chasing my tail a few days now reading through every post and searching in the internet how to work around this issue. The first message will flow though but any other messages after that wont. The log doesn't tell me anything besides that the first attempt sent more bytes than the second attempt. Can someone see anything else I might have overlooked? 2012.05.18 12:07:14 LOG7[2236:3940]: Service [SMTP Outgoing] accepted (FD=360) from 127.0.0.1:1638 2012.05.18 12:07:14 LOG7[2236:3940]: Creating a new thread 2012.05.18 12:07:14 LOG7[2236:3940]: New thread created 2012.05.18 12:07:14 LOG7[2236:580]: Service [SMTP Outgoing] started 2012.05.18 12:07:14 LOG5[2236:580]: Service [SMTP Outgoing] accepted connection from 127.0.0.1:1638 2012.05.18 12:07:14 LOG6[2236:580]: connect_blocking: connecting 157.56.234.134:587 2012.05.18 12:07:14 LOG7[2236:580]: connect_blocking: s_poll_wait 157.56.234.134:587: waiting 10 seconds 2012.05.18 12:07:14 LOG5[2236:580]: connect_blocking: connected 157.56.234.134:587 2012.05.18 12:07:14 LOG5[2236:580]: Service [SMTP Outgoing] connected remote server from 10.0.0.65:1639 2012.05.18 12:07:14 LOG7[2236:580]: Remote socket (FD=372) initialized 2012.05.18 12:07:14 LOG6[2236:580]: Client-mode smtp protocol negotiations started 2012.05.18 12:07:14 LOG7[2236:580]: <- 220 pod51011.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 18 May 2012 16:07:13 +0000 2012.05.18 12:07:14 LOG7[2236:580]: -> 220 pod51011.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 18 May 2012 16:07:13 +0000 2012.05.18 12:07:14 LOG7[2236:580]: -> EHLO localhost 2012.05.18 12:07:14 LOG7[2236:580]: <- 250-pod51011.outlook.com Hello [65.23.214.191] 2012.05.18 12:07:14 LOG7[2236:580]: <- 250-SIZE 36700160 2012.05.18 12:07:14 LOG7[2236:580]: <- 250-PIPELINING 2012.05.18 12:07:14 LOG7[2236:580]: <- 250-DSN 2012.05.18 12:07:14 LOG7[2236:580]: <- 250-ENHANCEDSTATUSCODES 2012.05.18 12:07:14 LOG7[2236:580]: <- 250-STARTTLS 2012.05.18 12:07:14 LOG7[2236:580]: <- 250-AUTH 2012.05.18 12:07:14 LOG7[2236:580]: <- 250-8BITMIME 2012.05.18 12:07:14 LOG7[2236:580]: <- 250-BINARYMIME 2012.05.18 12:07:14 LOG7[2236:580]: <- 250 CHUNKING 2012.05.18 12:07:14 LOG7[2236:580]: -> STARTTLS 2012.05.18 12:07:14 LOG7[2236:580]: <- 220 2.0.0 SMTP server ready 2012.05.18 12:07:14 LOG6[2236:580]: Client-mode smtp protocol negotiations succeeded 2012.05.18 12:07:15 LOG6[2236:580]: SSL connected: new session negotiated 2012.05.18 12:07:15 LOG6[2236:580]: Negotiated TLSv1/SSLv3 ciphersuite: AES128-SHA (128-bit encryption) 2012.05.18 12:07:15 LOG6[2236:580]: Compression: null, expansion: null 2012.05.18 12:07:18 LOG7[2236:580]: SSL socket closed on SSL_read 2012.05.18 12:07:18 LOG7[2236:580]: Sent socket write shutdown 2012.05.18 12:07:18 LOG5[2236:580]: Connection closed: 1498 byte(s) sent to SSL, 498 byte(s) sent to socket 2012.05.18 12:07:18 LOG7[2236:580]: Remote socket (FD=372) closed 2012.05.18 12:07:18 LOG7[2236:580]: Local socket (FD=360) closed 2012.05.18 12:07:18 LOG7[2236:580]: Service [SMTP Outgoing] finished (0 left) 2012.05.18 12:07:18 LOG7[2236:580]: str_stats: 12 block(s), 298 data byte(s), 504 control byte(s) 2012.05.18 12:08:05 LOG7[2236:3940]: Service [SMTP Outgoing] accepted (FD=336) from 127.0.0.1:1644 2012.05.18 12:08:05 LOG7[2236:3940]: Creating a new thread 2012.05.18 12:08:05 LOG7[2236:3940]: New thread created 2012.05.18 12:08:05 LOG7[2236:4044]: Service [SMTP Outgoing] started 2012.05.18 12:08:05 LOG5[2236:4044]: Service [SMTP Outgoing] accepted connection from 127.0.0.1:1644 2012.05.18 12:08:05 LOG6[2236:4044]: connect_blocking: connecting 157.56.236.118:587 2012.05.18 12:08:05 LOG7[2236:4044]: connect_blocking: s_poll_wait 157.56.236.118:587: waiting 10 seconds 2012.05.18 12:08:05 LOG5[2236:4044]: connect_blocking: connected 157.56.236.118:587 2012.05.18 12:08:05 LOG5[2236:4044]: Service [SMTP Outgoing] connected remote server from 10.0.0.65:1645 2012.05.18 12:08:05 LOG7[2236:4044]: Remote socket (FD=376) initialized 2012.05.18 12:08:05 LOG6[2236:4044]: Client-mode smtp protocol negotiations started 2012.05.18 12:08:05 LOG7[2236:4044]: <- 220 pod51011.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 18 May 2012 16:08:04 +0000 2012.05.18 12:08:05 LOG7[2236:4044]: -> 220 pod51011.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 18 May 2012 16:08:04 +0000 2012.05.18 12:08:05 LOG7[2236:4044]: -> EHLO localhost 2012.05.18 12:08:05 LOG7[2236:4044]: <- 250-pod51011.outlook.com Hello [65.23.214.191] 2012.05.18 12:08:05 LOG7[2236:4044]: <- 250-SIZE 36700160 2012.05.18 12:08:05 LOG7[2236:4044]: <- 250-PIPELINING 2012.05.18 12:08:05 LOG7[2236:4044]: <- 250-DSN 2012.05.18 12:08:05 LOG7[2236:4044]: <- 250-ENHANCEDSTATUSCODES 2012.05.18 12:08:05 LOG7[2236:4044]: <- 250-STARTTLS 2012.05.18 12:08:05 LOG7[2236:4044]: <- 250-AUTH 2012.05.18 12:08:05 LOG7[2236:4044]: <- 250-8BITMIME 2012.05.18 12:08:05 LOG7[2236:4044]: <- 250-BINARYMIME 2012.05.18 12:08:05 LOG7[2236:4044]: <- 250 CHUNKING 2012.05.18 12:08:05 LOG7[2236:4044]: -> STARTTLS 2012.05.18 12:08:06 LOG7[2236:4044]: <- 220 2.0.0 SMTP server ready 2012.05.18 12:08:06 LOG6[2236:4044]: Client-mode smtp protocol negotiations succeeded 2012.05.18 12:08:06 LOG6[2236:4044]: SSL connected: new session negotiated 2012.05.18 12:08:06 LOG6[2236:4044]: Negotiated TLSv1/SSLv3 ciphersuite: AES128-SHA (128-bit encryption) 2012.05.18 12:08:06 LOG6[2236:4044]: Compression: null, expansion: null 2012.05.18 12:08:06 LOG7[2236:4044]: SSL socket closed on SSL_read 2012.05.18 12:08:06 LOG7[2236:4044]: Sent socket write shutdown 2012.05.18 12:08:06 LOG5[2236:4044]: Connection closed: 6 byte(s) sent to SSL, 48 byte(s) sent to socket 2012.05.18 12:08:06 LOG7[2236:4044]: Remote socket (FD=376) closed 2012.05.18 12:08:06 LOG7[2236:4044]: Local socket (FD=336) closed 2012.05.18 12:08:06 LOG7[2236:4044]: Service [SMTP Outgoing] finished (0 left) 2012.05.18 12:08:06 LOG7[2236:4044]: str_stats: 12 block(s), 298 data byte(s), 504 control byte(s)

2 1

Problem With GMail
by Van Brown 09 May '12

09 May '12

I am trying to use stunnel to act as a forwarder to GMail. My config file looks like:client = yes socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [gmail] accept = 25 connect = smtp.gmail.com:465 ;CAfile = peer-gmail.pem ;verify = 3 I saved the peer certificate and when I attempt to send mail, the log looks like this: 2012.05.08 16:01:35 LOG5[31036:19408]: Service [gmail] connected remote server from 192.168.1.9:42580 2012.05.08 16:01:35 LOG4[31036:19408]: CERT: Verification error: unable to get local issuer certificate 2012.05.08 16:01:35 LOG4[31036:19408]: Certificate check failed: depth=1, /C=US/O=Google Inc/CN=Google Internet Authority 2012.05.08 16:01:35 LOG3[31036:19408]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed 2012.05.08 16:01:35 LOG5[31036:19408]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2012.05.08 16:02:35 LOG5[31036:34312]: Service [gmail] accepted connection from 192.168.1.10:49303 2012.05.08 16:02:35 LOG5[31036:34312]: connect_blocking: connected 173.194.79.108:465 2012.05.08 16:02:35 LOG5[31036:34312]: Service [gmail] connected remote server from 192.168.1.9:42619 2012.05.08 16:02:36 LOG4[31036:34312]: CERT: Verification error: unable to get local issuer certificate 2012.05.08 16:02:36 LOG4[31036:34312]: Certificate check failed: depth=1, /C=US/O=Google Inc/CN=Google Internet Authority 2012.05.08 16:02:36 LOG3[31036:34312]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed 2012.05.08 16:02:36 LOG5[31036:34312]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket Please tell me what I'm doing wrong so I can fix it. Van Brown

2 1

Compiling stunnel without a cert
by Donovan Sydow 08 May '12

08 May '12

I'm trying to automate the compilation of stunnel from source and was curious if there was a hidden flag to prevent stunnel from trying to generate a certificate after running make install. I do know I can make a file called stunnel.pem in the system configuration directory prior to running make install to prevent the cert from being made, but ideally wanted a way to have stunnel install without having a cert pregenerated. I didn't see any configure flags to prevent this behavior. Does any one know how to bypass this requirement and compile without generating a certificate or having one already exist? Alternately I would be interested in hearing any suggestions on how to quietly generate the initial certificate as well in an automated (i.e. no input, quiet, etc.) fashion. Cheers, Donovan

1 0