- stunnel-users - stunnel.org

Stunnel for secure email connections; email headers ?
by Lee 23 May '09

23 May '09

Hello, I have been dabbling with Stunnel in order to do the following: Connect with remote POP3, IMAP and SMTP servers using a secure connection; Path those connections on my Windows XP desktop pc through Avast Anti-Virus and/or Popfile to Mozilla Thunderbird. After much fiddling and grinding of my rusty mental muscles, I appear to have everything working and pathing properly. However I am not confident and some amount of luck has been involved in settling on the apparently correct pathing, ports settings and stunnel.conf So, my question here is; Can I look for anything in the email headers to verify that I am actually achieving a locally made secure connection using Stunnel? Or, if necessary, can I force something into the headers to show this? As I imply, results/clues suggest all is in place correctly, but part of me doesn't really believe I have actually done it. :) Thanks very much, Lee UK --- avast! Antivirus: Outbound message clean. Virus Database (VPS): 090523-0, 23/05/2009 Tested on: 5/23/2009 23:25:18 avast! - copyright (c) 1988-2009 ALWIL Software. http://www.avast.com

1 0

Multiple SSL Versions
by Jeremy 22 May '09

22 May '09

Hi, Is there any way to make the sslVersion version take multiple options? I would like to restrict things to TLSv1 or SSLv3 but it seems only one option can be specified. I tried specifying this in the cipher section instead of ALL but couldn't seem to get it to work. Also here is something a little weird I've noticed, if anyone else has ran into it before and knows what's going on. With sites set to use TLSv1, sometimes while testing a HTTPS site using Firefox SSL (when both SSLv3 and TLSv1 is enabled in Firefox) sometimes the site won't come up. It feels like Firefox is using a weird SSL version to do the SSL certificate verification but once you trust the certificate it uses the right settings. I've set sslVersion = all, and trusted the SSL certificate in Firefox, then set sslVersion = TLSv1 again and I can get to the site ok at that point. Kind of weird. I'm probably just going to have to leave sslVersion = all, but Nessus and other security scans really like things locked down to just TLSv1 or SSLv3. stunnel: LOG5[17972:3086609296]: https-site01 accepted connection from 1.2.3.4:50878 stunnel: LOG3[17972:3086609296]: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number stunnel: LOG5[17972:3086609296]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket

2 1

Can't connect to Yahoo POP3
by Gary Kuznitz 18 May '09

18 May '09

Hi, I wonder if you could possibly help me get Stunnel ver. 4.26 working with Yahoo.com email? I have been trying to get it working and can't see what the problem is. I do have it working with Gmail just fine. My email client is setup with: Email server 127.0.0.1 Email user: 127.0.0.1/11011/MuUserName(a)yahoo.com Email password: <InsertPassword> Port 9999 My email client is connecting to K9 K9 connects to Stunnel on port 11011 I'm running this in Win '98se I'm following the instructions to use Yahoo POP3 Free at: http://sajeevnairs.blogspot.com/2009/03/pop3-access-in-yahoo-mail-free.html I think it's saying: SSL alert (read): fatal: bad certificate How can I get a god certificate for Stunnel to use? How would I set that up in Stunnel? Conf: cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [pop3_DslextremeGmail] accept = 127.0.0.1:11010 connect = pop.gmail.com:995 delay = yes [pop3_Yahoo] accept = 127.0.0.1:11011 connect = pop.mail.yahoo.com:995 delay = yes Log: 2009.05.14 15:48:12 LOG7[16278859:16041803]: RAND_status claims sufficient entropy for the PRNG 2009.05.14 15:48:12 LOG7[16278859:16041803]: PRNG seeded successfully 2009.05.14 15:48:12 LOG7[16278859:16041803]: Certificate: stunnel.pem 2009.05.14 15:48:12 LOG7[16278859:16041803]: Certificate loaded 2009.05.14 15:48:12 LOG7[16278859:16041803]: Key file: stunnel.pem 2009.05.14 15:48:12 LOG7[16278859:16041803]: Private key loaded 2009.05.14 15:48:12 LOG7[16278859:16041803]: SSL context initialized for service pop3_DslextremeDocfxitGmail 2009.05.14 15:48:12 LOG7[16278859:16041803]: Certificate: stunnel.pem 2009.05.14 15:48:12 LOG7[16278859:16041803]: Certificate loaded 2009.05.14 15:48:12 LOG7[16278859:16041803]: Key file: stunnel.pem 2009.05.14 15:48:12 LOG7[16278859:16041803]: Private key loaded 2009.05.14 15:48:12 LOG7[16278859:16041803]: SSL context initialized for service pop3_Docfxit_Yahoo 2009.05.14 15:48:12 LOG5[16278859:16041803]: stunnel 4.26 on x86-pc-mingw32-gnu with OpenSSL 0.9.8i 15 Sep 2008 2009.05.14 15:48:12 LOG5[16278859:16041803]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv4 2009.05.14 15:48:12 LOG5[16278859:16039767]: No limit detected for the number of clients 2009.05.14 15:48:12 LOG7[16278859:16039767]: FD 56 in non-blocking mode 2009.05.14 15:48:12 LOG7[16278859:16039767]: SO_REUSEADDR option set on accept socket 2009.05.14 15:48:12 LOG7[16278859:16039767]: pop3_DslextremeDocfxitGmail bound to 127.0.0.1:11010 2009.05.14 15:48:12 LOG7[16278859:16039767]: FD 60 in non-blocking mode 2009.05.14 15:48:12 LOG7[16278859:16039767]: SO_REUSEADDR option set on accept socket 2009.05.14 15:48:12 LOG7[16278859:16039767]: pop3_Docfxit_Yahoo bound to 127.0.0.1:11011 2009.05.14 15:48:30 LOG7[16278859:16039767]: pop3_Docfxit_Yahoo accepted FD=64 from 127.0.0.1:1105 2009.05.14 15:48:30 LOG7[16278859:16039767]: Creating a new thread 2009.05.14 15:48:30 LOG7[16278859:16039767]: New thread created 2009.05.14 15:48:30 LOG7[16278859:16038719]: pop3_Docfxit_Yahoo started 2009.05.14 15:48:30 LOG7[16278859:16038719]: FD 64 in non-blocking mode 2009.05.14 15:48:30 LOG7[16278859:16038719]: TCP_NODELAY option set on local socket 2009.05.14 15:48:30 LOG5[16278859:16038719]: pop3_Docfxit_Yahoo accepted connection from 127.0.0.1:1105 2009.05.14 15:48:30 LOG7[16278859:16038719]: FD 76 in non-blocking mode 2009.05.14 15:48:30 LOG7[16278859:16038719]: pop3_Docfxit_Yahoo connecting 68.142.206.14:995 2009.05.14 15:48:30 LOG7[16278859:16038719]: connect_wait: waiting 10 seconds 2009.05.14 15:48:30 LOG7[16278859:16038719]: connect_wait: connected 2009.05.14 15:48:30 LOG5[16278859:16038719]: pop3_Docfxit_Yahoo connected remote server from 192.168.1.3:1106 2009.05.14 15:48:30 LOG7[16278859:16038719]: Remote FD=76 initialized 2009.05.14 15:48:30 LOG7[16278859:16038719]: TCP_NODELAY option set on remote socket 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): before/connect initialization 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 write client hello A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 read server hello A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 read server certificate A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 read server certificate request A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 read server done A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 write client certificate A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 write client key exchange A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 write certificate verify A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 write change cipher spec A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 write finished A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 flush data 2009.05.14 15:48:30 LOG3[16278859:16038719]: SSL_connect: Peer suddenly disconnected 2009.05.14 15:48:30 LOG5[16278859:16038719]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.05.14 15:48:30 LOG7[16278859:16038719]: pop3_Docfxit_Yahoo finished (0 left) Thank you for looking at it... Gary

4 8

Re: [stunnel-users] Can't connect to Yahoo POP3
by Gary Kuznitz 15 May '09

15 May '09

I made some changes... On 15 May 2009 at 12:40, stunnel-users(a)mirt.net (Gary Kuznitz <docfxit(a)theoffice.la>) commented about Re: [stunnel-users] Can't connect t: > Thank you for the reply... > > On 15 May 2009 at 20:55, Michal (Michal Trojnara <Michal.Trojnara(a)mobi-com.net>) commented about Re: [stunnel-users] Can't connect to Yahoo POP3: > > > Gary Kuznitz wrote: > > > How can I get a god certificate for Stunnel to use? > > > How would I set that up in Stunnel? > > > > You don't really need a certificate for an SSL client. Just disable it. > > How can I disable it? > > > You rather want to setup server certificate verification with "CAfile" > > and "verify". > > I have un-commented: > CAfile = certs.pem I commented out the above line. Now I'm getting a new error. Here is the log: 2009.05.15 16:32:30 LOG7[16267607:16279139]: RAND_status claims sufficient entropy for the PRNG 2009.05.15 16:32:30 LOG7[16267607:16279139]: PRNG seeded successfully 2009.05.15 16:32:31 LOG7[16267607:16279139]: Certificate: stunnel.pem 2009.05.15 16:32:31 LOG7[16267607:16279139]: Certificate loaded 2009.05.15 16:32:31 LOG7[16267607:16279139]: Key file: stunnel.pem 2009.05.15 16:32:31 LOG7[16267607:16279139]: Private key loaded 2009.05.15 16:32:31 LOG3[16267607:16279139]: Either CApath or CAfile has to be used for authentication 2009.05.15 16:32:31 LOG3[16267607:16279139]: Server is down > verify = 2 > > That gave me an error: > 2009.05.15 12:38:13 LOG3[16278859:16279139]: Error loading verify certificates > from certs.pem > 2009.05.15 12:38:13 LOG3[16278859:16279139]: error stack: B084002 : > error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib > 2009.05.15 12:38:13 LOG3[16278859:16279139]: error stack: 2006D080 : > error:2006D080:BIO routines:BIO_new_file:no such file > 2009.05.15 12:38:13 LOG3[16278859:16279139]: SSL_CTX_load_verify_locations: > 2001002: error:02001002:system library:fopen:No such file or directory > > > > ; Some performance tunings > > > socket = l:TCP_NODELAY=1 > > > socket = r:TCP_NODELAY=1 > > > > IMHO it's not a good idea for non-interactive connections, e.g. pop3. > > I will comment out both of the above. > > > > [pop3_DslextremeGmail] > > > accept = 127.0.0.1:11010 > > > connect = pop.gmail.com:995 > > > delay = yes > > > > > > [pop3_Yahoo] > > > accept = 127.0.0.1:11011 > > > connect = pop.mail.yahoo.com:995 > > > delay = yes > > [cut] > > > 2009.05.14 15:48:12 LOG7[16278859:16041803]: SSL context initialized > > > for service pop3_Docfxit_Yahoo > > > > I guess you use a different configuration file, as pop3_Docfxit_Yahoo > > is not defined in the one you sent. > > I'm sorry. I'm really using [pop3_Yahoo] > > After I make a change to the conf. file Do I have to re-boot the PC or is it > enough to exit out of Stunnel and launch it again? > > Thank you, > > Gary Kuznitz > > > Best regards, > > Mike > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)mirt.net > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > >

1 0

Preventing "choose a digital certificate" pop-up in IE
by Wallace Winfrey 08 May '09

08 May '09

Hello I have browsed the archives but have not found the answer to this question... I have stunnel set up to handle https connections. It sits on a CentOS server alongside HAProxy and works fine with every browser except for Internet Explorer. When I connect with Internet Explorer, I get a blank "Please choose a digital certificate" pop-up. I am pretty sure I have a configuration issue. Here's what I have: socket=l:TCP_NODELAY=1 socket=r:TCP_NODELAY=1 options = NO_SSLv2 ciphers=ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM output = /var/log/stunnel.log [my.host.name] accept=my.external.IP:443 connect=127.0.0.1:8101 xforwardedfor=yes CAfile=/etc/stunnel/GlobalSign.pem cert=/etc/stunnel/my.host.name.pem verify=1 How do we turn off the request for the client certificate in IE? Here are my details....thanks in advance. w * stunnel-4.15-2.el5.1 * I am running it standalone: /usr/sbin/stunnel /etc/stunnel/stunnel.conf * /usr/sbin/stunnel -version stunnel 4.15 on i686-pc-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Auth:LIBWRAP Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none * uname -a: Linux my.host.name 2.6.18-128.1.6.el5 #1 SMP Wed Apr 1 09:19:18 EDT 2009 i686 i686 i386 GNU/Linux * glibc version is 2.5-34 * gcc is not installed, using CentOS RPM * OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008

1 1

patch: TCP keep-alive socket options
by Ludolf Holzheid 08 May '09

08 May '09

Dear list, the attached patch allows for tweaking the TCP keep-alive socket options on Linux 2.4 and later. Thanks to the groundwork laid by Michal, this got fairly trivial. We use this to keep NAT table entries alive for connections that are expected to have idle periods longer than the NAT time-outs of the routers in involved. Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Odd termination of stunnel process...
by Robert Nickel 08 May '09

08 May '09

We've been happily using stunnel for quite some time now and have run into a strange problem. At seemingly random intervals, stunnel just freaks out an dies. I don't know if it's getting overwhelmed or what but I'm not seeing anything in the logs for stunnel or any other process. Any help is appreciated. Stunnel is being used to wrap a service that was written without use of the ssl libraries directly and connects to two remote web servers (that happen to be running on the same host, separate ports). Config information: OS: CentOS 5.1 OpenSSL: 0.9.8b stunnel -version: stunnel 4.15 on i686-redhat-linux-gnu with OpenSSL 0.9.8b 04 May 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Config file contents: client=yes foreground=no pid=/var/run/pid chroot=/path/to/chroot setuid=non-priv-user setgid=non-priv-group [webservice1] accept=127.0.0.1:11000 connect=172.16.0.1:11000 [webservice2] accept=127.0.0.1:11001 connect=172.16.0.1:11001 Below are the log lines just before the process disappears: May 4 19:49:18 host stunnel: LOG7[28683:3085368208]: Remote FD=15 initialized May 4 19:49:18 host stunnel: LOG7[28683:3085298576]: SSL state (connect): SSLv3 write client key exchange A May 4 19:49:18 host stunnel: LOG7[28683:3085298576]: SSL state (connect): SSLv3 write change cipher spec A May 4 19:49:18 host stunnel: LOG7[28683:3085298576]: SSL state (connect): SSLv3 write finished A May 4 19:49:18 host stunnel: LOG7[28683:3085716368]: SSL state (connect): SSLv3 read server hello A May 4 19:49:18 host stunnel: LOG7[28683:3085716368]: SSL state (connect): SSLv3 read server certificate A May 4 19:49:18 host stunnel: LOG7[28683:3085298576]: SSL state (connect): SSLv3 flush data May 4 19:49:18 host stunnel: LOG7[28683:3085368208]: SSL state (connect): before/connect initialization May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: SSL alert (write): fatal: handshake failure May 4 19:49:18 host stunnel: LOG3[28683:3085786000]: SSL_connect: 1408C095: error:1408C095:SSL routines:SSL3_GET_FINISHED:digest check failed May 4 19:49:18 host stunnel: LOG5[28683:3085786000]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: replay finished (8 left) May 4 19:49:18 host stunnel: LOG7[28683:3085368208]: SSL state (connect): SSLv3 write client hello A May 4 19:49:18 host stunnel: LOG7[28683:3085716368]: SSL state (connect): SSLv3 read server key exchange A May 4 19:49:18 host stunnel: LOG7[28683:3085716368]: SSL state (connect): SSLv3 read server done A May 4 19:49:18 host stunnel: LOG7[28683:3085928144]: replay accepted FD=18 from 127.0.0.1:40308 May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: replay started May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: FD 18 in non-blocking mode May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: FD 19 in non-blocking mode May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: FD 26 in non-blocking mode May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: Connection from 127.0.0.1:40308 permitted by libwrap May 4 19:49:18 host stunnel: LOG5[28683:3085786000]: replay connected from 127.0.0.1:40308 May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: FD 19 in non-blocking mode May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: replay connecting 160.33.167.33:11026 May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: connect_wait: waiting 10 seconds May 4 19:49:18 host stunnel: LOG7[28683:3085928144]: Cleaning up the signal pipe May 4 19:49:18 host stunnel: LOG6[28683:3085928144]: Child process 13775 finished with code 0 May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: SSL alert (write): fatal: handshake failure May 4 19:49:18 host stunnel: LOG3[28683:3085646736]: SSL_connect: 1408C095: error:1408C095:SSL routines:SSL3_GET_FINISHED:digest check failed May 4 19:49:18 host stunnel: LOG5[28683:3085646736]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket May 4 19:49:18 host stunnel: LOG7[28683:3085716368]: SSL state (connect): SSLv3 write client key exchange A May 4 19:49:18 host stunnel: LOG7[28683:3085716368]: SSL state (connect): SSLv3 write change cipher spec A May 4 19:49:18 host stunnel: LOG7[28683:3085716368]: SSL state (connect): SSLv3 write finished A May 4 19:49:18 host stunnel: LOG7[28683:3085716368]: SSL state (connect): SSLv3 flush data May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: replay finished (8 left) May 4 19:49:18 host stunnel: LOG7[28683:3085855632]: connect_wait: connected May 4 19:49:18 host stunnel: LOG7[28683:3085855632]: Remote FD=17 initialized May 4 19:49:18 host stunnel: LOG7[28683:3085855632]: SSL state (connect): before/connect initialization May 4 19:49:18 host stunnel: LOG7[28683:3085855632]: SSL state (connect): SSLv3 write client hello A May 4 19:49:18 host stunnel: LOG7[28683:3085928144]: replay accepted FD=22 from 127.0.0.1:40310 May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: replay started May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: FD 22 in non-blocking mode May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: FD 23 in non-blocking mode May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: FD 26 in non-blocking mode May 4 19:49:18 host stunnel: LOG7[28683:3085928144]: Cleaning up the signal pipe May 4 19:49:18 host stunnel: LOG6[28683:3085928144]: Child process 13777 finished with code 0 May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: Connection from 127.0.0.1:40310 permitted by libwrap May 4 19:49:18 host stunnel: LOG5[28683:3085646736]: replay connected from 127.0.0.1:40310 May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: FD 23 in non-blocking mode May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: replay connecting 160.33.167.33:11026 May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: connect_wait: waiting 10 seconds May 4 19:49:18 host stunnel: LOG7[28683:3085507472]: SSL state (connect): SSLv3 read server hello A May 4 19:49:18 host stunnel: LOG7[28683:3085507472]: SSL state (connect): SSLv3 read server certificate A May 4 19:49:18 host stunnel: LOG7[28683:3085507472]: SSL state (connect): SSLv3 read server key exchange A May 4 19:49:18 host stunnel: LOG7[28683:3085507472]: SSL state (connect): SSLv3 read server done A May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: connect_wait: connected May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: Remote FD=19 initialized May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: SSL state (connect): before/connect initialization May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: SSL state (connect): SSLv3 write client hello A May 4 19:49:18 host stunnel: LOG7[28683:3085298576]: SSL alert (write): fatal: handshake failure May 4 19:49:18 host stunnel: LOG3[28683:3085298576]: SSL_connect: 1408C095: error:1408C095:SSL routines:SSL3_GET_FINISHED:digest check failed May 4 19:49:18 host stunnel: LOG5[28683:3085298576]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket May 4 19:49:18 host stunnel: LOG7[28683:3085298576]: replay finished (8 left) May 4 19:49:18 host stunnel: LOG7[28683:3085507472]: SSL state (connect): SSLv3 write client key exchange A May 4 19:49:18 host stunnel: LOG7[28683:3085507472]: SSL state (connect): SSLv3 write change cipher spec A May 4 19:49:18 host stunnel: LOG7[28683:3085507472]: SSL state (connect): SSLv3 write finished A May 4 19:49:18 host stunnel: LOG7[28683:3085507472]: SSL state (connect): SSLv3 flush data May 4 19:49:18 host stunnel: LOG7[28683:3085925264]: SSL alert (write): fatal: handshake failure May 4 19:49:18 host stunnel: LOG3[28683:3085925264]: SSL_connect: 1408C095: error:1408C095:SSL routines:SSL3_GET_FINISHED:digest check failed May 4 19:49:18 host stunnel: LOG5[28683:3085925264]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket May 4 19:49:18 host stunnel: LOG7[28683:3085925264]: replay finished (7 left) May 4 19:49:18 host stunnel: LOG7[28683:3085368208]: SSL state (connect): SSLv3 read server hello A May 4 19:49:18 host stunnel: LOG7[28683:3085368208]: SSL state (connect): SSLv3 read server certificate A May 4 19:49:18 host stunnel: LOG7[28683:3085368208]: SSL state (connect): SSLv3 read server key exchange A May 4 19:49:18 host stunnel: LOG7[28683:3085368208]: SSL state (connect): SSLv3 read server done A May 4 19:49:18 host stunnel: LOG7[28683:3085577104]: SSL state (connect): SSLv3 read server hello A May 4 19:49:18 host stunnel: LOG7[28683:3085577104]: SSL state (connect): SSLv3 read server certificate A May 4 19:49:18 host stunnel: LOG7[28683:3085577104]: SSL state (connect): SSLv3 read server key exchange A May 4 19:49:18 host stunnel: LOG7[28683:3085577104]: SSL state (connect): SSLv3 read server done A [stunnel vanishes at this point. No core, no logs. POOF!] The lines that stand out to me are the SSL_connect digest errors, the finished lines (showing the number of queued requests in parenthesis?) and the fatal handshake failure. Another odd log entry that I'm seeing often is this transfer() loop error: May 4 21:12:53 host stunnel: LOG3[14341:3085822864]: transfer() loop executes not transferring any data May 4 21:12:53 host stunnel: LOG3[14341:3085822864]: please report the problem to Michal.Trojnara(a)mirt.net May 4 21:12:53 host stunnel: LOG3[14341:3085822864]: socket open: rd=no wr=yes, ssl open: rd=no wr=no May 4 21:12:53 host stunnel: LOG3[14341:3085822864]: socket ready: rd=yes wr=no, ssl ready: rd=no wr=no May 4 21:12:53 host stunnel: LOG3[14341:3085822864]: ssl want: rd=no wr=no May 4 21:12:53 host stunnel: LOG3[14341:3085822864]: socket input buffer: 0 byte(s), ssl input buffer: 29 byte(s) May 4 21:12:53 host stunnel: LOG3[14341:3085822864]: check_SSL_pending=0, ssl_closing=3 May 4 21:12:53 host stunnel: LOG5[14341:3085822864]: Connection reset: 238 bytes sent to SSL, 225 bytes sent to socket Don't know if it's related but might as well post it along as a possible symptom. Thanks, --Robert

2 1

[PATCH] Fix undefined aliasing in libwrap.c
by Miloslav Trmac 02 May '09

02 May '09

Hello, The attached patch changes the code not to access a part of a char[...] array using an int *, which is undefined in ISO C. Using memcpy() is safe. I would have posted it on in the BTS, but it doesn't allow me even to log in... Thank you, Mirek

3 4

Re: [stunnel-users] stunnel-users Digest, Vol 57, Issue 10
by Brian P Hinz 22 Apr '09

22 Apr '09

>> Does stunnel support the use of the aNULL cipher suites? I can't >> seem to make it work, stunnel just fails with a "no shared >> ciphers" message. I don't think that the problem is with openssl >> or the client, since when I test it with s_server the handshake >> completes. >> > > >Review the default cipher list. > >Do... > >stunnel -version > > >Then edit configuration file ciphers options to suit requirements. I was trying to get stunnel working with anonymous ciphers (SSL_DH_anon_WITH_RC4_MD5_128, etc.) from a java based client and found that s_server succeeded while stunnel failed with the "no shared ciphers" message because it has routines to initialize a temporary DH key in the absence of a certificate. Here's a sloppy patch that just borrows those routines from the s_server source code. This is against an older version of stunnel (RHEL4u7 based system), but the latest version also fails without similar patching. Cheers, -brian # cat /usr/src/redhat/SOURCES/stunnel-4.05-dhe.patch --- stunnel-4.05/src/ssl.c.dhe 2004-01-25 14:26:03.000000000 -0500 +++ stunnel-4.05/src/ssl.c 2009-04-22 00:11:10.000000000 -0400 @@ -236,6 +236,32 @@ return -1; /* FAILED */ } +static unsigned char dh512_p[]={ + 0xDA,0x58,0x3C,0x16,0xD9,0x85,0x22,0x89,0xD0,0xE4,0xAF,0x75, + 0x6F,0x4C,0xCA,0x92,0xDD,0x4B,0xE5,0x33,0xB8,0x04,0xFB,0x0F, + 0xED,0x94,0xEF,0x9C,0x8A,0x44,0x03,0xED,0x57,0x46,0x50,0xD3, + 0x69,0x99,0xDB,0x29,0xD7,0x76,0x27,0x6B,0xA2,0xD3,0xD4,0x12, + 0xE2,0x18,0xF4,0xDD,0x1E,0x08,0x4C,0xF6,0xD8,0x00,0x3E,0x7C, + 0x47,0x74,0xE8,0x33, +}; + +static unsigned char dh512_g[]={ + 0x02, +}; + +static DH *get_dh512(void); + +static DH *get_dh512(void) { + DH *dh=NULL; + + if ((dh=DH_new()) == NULL) return(NULL); + dh->p=BN_bin2bn(dh512_p,sizeof(dh512_p),NULL); + dh->g=BN_bin2bn(dh512_g,sizeof(dh512_g),NULL); + if ((dh->p == NULL) || (dh->g == NULL)) + return(NULL); + return(dh); +} + static int init_dh(void) { #ifdef USE_DH FILE *fp; @@ -274,6 +300,12 @@ log(LOG_INFO, "Diffie-Hellman initialized with %d bit key", 8*DH_size(dh)); DH_free(dh); +#else + DH *dh=NULL; + log(LOG_INFO,"Using default temp DH parameters\n"); + dh=get_dh512(); + SSL_CTX_set_tmp_dh(ctx,dh); + DH_free(dh); #endif /* USE_DH */ return 0; /* OK */ }

1 0

aNULL ciphers
by Brian P Hinz 20 Apr '09

20 Apr '09

Hi, Does stunnel support the use of the aNULL cipher suites? I can't seem to make it work, stunnel just fails with a "no shared ciphers" message. I don't think that the problem is with openssl or the client, since when I test it with s_server the handshake completes. Thanks, -brian

1 0

Issue resolving path to .conf using DFS and changing from "by name" to "by IP address"
by Peterson, Stephen 17 Apr '09

17 Apr '09

We use stunnel 4.20 and encountered a problem today and hope someone may be able to provide some insight to a solution. Our client machines are all Windows XP machines with stunnel started as a service. Those installs of stunnel have the path to the .conf as part of the path to the executable. The path to the .conf uses a DFS share. Our network administrator changed our DFS share from "by name" to "by IP address" and then the client services could not resolve the location of the .conf file when the services started on the next start up of client machines. Has anyone encountered this before and what did you do to fix it? Thanks for any assistance. Stephen

1 0

error during multithreaded operation
by Dale Kingsbury 13 Apr '09

13 Apr '09

OS: Windows 2003 SP2 SDK: 2003 R2 SDK We have a multithreaded application that uses a REST-style interface to an SSL-enabled UNIX box that only uses AES. I tried using WinHTTP, but unfortunately, AES is broken in the 2003 version of WinHTTP (confirmed by M$). SO, I hook up stunnel, which works fine when I only start one thread, but if I use more than 1 thread, I get the following error in the stunnel.log. Note that the error is on thread 7140, and the connection is immediately closed. I have retry logic that re-starts failed threads, and the restarted thread works the second time. (of course, the first has finished, so it is essentially running by itself.) The other item of interest is that each thread is sending about 500,000 bytes of data in chunks of 16,000 bytes, and my trace shows that it usually fails after having written more than 100,000 bytes successfully. Any suggestions or help would be greatly appreciated... 2009.04.10 13:17:01 LOG7[3016:7040]: SSL state (connect): SSLv3 flush data 2009.04.10 13:17:01 LOG7[3016:7140]: SSL alert (write): fatal: decrypt error <<<<< ----- NOTE FAILS HERE ON thread 7140 2009.04.10 13:17:01 LOG7[3016:7040]: SSL state (connect): SSLv3 read finished A 2009.04.10 13:17:01 LOG7[3016:7040]: 0 items in the session cache 2009.04.10 13:17:01 LOG7[3016:7040]: 20 client connects (SSL_connect()) 2009.04.10 13:17:01 LOG7[3016:7040]: 19 client connects that finished 2009.04.10 13:17:01 LOG7[3016:7040]: 0 client renegotiations requested 2009.04.10 13:17:01 LOG7[3016:7040]: 0 server connects (SSL_accept()) 2009.04.10 13:17:01 LOG7[3016:7040]: 0 server connects that finished 2009.04.10 13:17:01 LOG7[3016:7040]: 0 server renegotiations requested 2009.04.10 13:17:01 LOG7[3016:7040]: 0 session cache hits 2009.04.10 13:17:01 LOG7[3016:7040]: 0 session cache misses 2009.04.10 13:17:01 LOG7[3016:7040]: 0 session cache timeouts 2009.04.10 13:17:01 LOG6[3016:7040]: SSL connected: new session negotiated 2009.04.10 13:17:01 LOG6[3016:7040]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2009.04.10 13:17:01 LOG3[3016:7140]: SSL_connect: 1408C095: error:1408C095:SSL routines:SSL3_GET_FINISHED:digest check failed 2009.04.10 13:17:01 LOG5[3016:7140]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.04.10 13:17:01 LOG7[3016:7140]: bycast-write-1 finished (1 left) Configuratation file: ;Stunnel configuration for Acuo. ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client=yes verify=0 ; Service-level configuration [bycast-read-1] accept = 18080 connect = 10.220.8.100:8080 ;ciphers=AES128-SHA:AES256-SHA TIMEOUTclose = 0 sslVersion = TLSv1 Dale Kingsbury Founder - Lead Software Engineer Phone: 651-744-9225 << NOTE new number Fax: 651-730-4231 Cel: 651-592-5204 email: dale(a)acuotech.com <mailto:[email protected]> RSNA Booth #4980

2 1

Re: [stunnel-users] OpenSSL Vulnerabilities
by Cal Webster 09 Apr '09

09 Apr '09

On Thu, 2009-04-09 at 12:08 -0500, Guy wrote: > Cal Webster wrote: > > > > Do these SSL libraries still require "MSVCR90.dll" from the > > "Visual C++ Redistributables"? > > > > I appreciate the swift response. :-) > > > > > No, the only Microsoft C Runtime Library dependency is MSVCRT.DLL > (see below output) Thank you. I see that. I've also confirmed by uninstalling "Visual C++ Redistributables" and the OpenSSL package from "slproweb.com". The stunnel service starts up and runs fine with the latest stunnel version 4.27b2. -----------[From stunnel.log]----------- 2009.04.09 14:56:11 LOG7[1240:1236]: RAND_status claims sufficient entropy for the PRNG 2009.04.09 14:56:11 LOG7[1240:1236]: PRNG seeded successfully 2009.04.09 14:56:11 LOG7[1240:1236]: SSL context initialized for service vnc1 2009.04.09 14:56:11 LOG7[1240:1236]: SSL context initialized for service vnc2 2009.04.09 14:56:11 LOG7[1240:1236]: SSL context initialized for service vnc3 2009.04.09 14:56:11 LOG5[1240:1236]: stunnel 4.27 on x86-pc-mingw32-gnu with OpenSSL 0.9.8k 25 Mar 2009 2009.04.09 14:56:11 LOG5[1240:1236]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv4 2009.04.09 14:56:11 LOG5[1240:1260]: No limit detected for the number of clients 2009.04.09 14:56:11 LOG7[1240:1260]: FD 312 in non-blocking mode 2009.04.09 14:56:11 LOG7[1240:1260]: SO_REUSEADDR option set on accept socket 2009.04.09 14:56:11 LOG7[1240:1260]: vnc1 bound to 127.0.0.1:5973 2009.04.09 14:56:11 LOG7[1240:1260]: FD 320 in non-blocking mode 2009.04.09 14:56:11 LOG7[1240:1260]: SO_REUSEADDR option set on accept socket 2009.04.09 14:56:11 LOG7[1240:1260]: vnc2 bound to 127.0.0.1:5972 2009.04.09 14:56:11 LOG7[1240:1260]: FD 328 in non-blocking mode 2009.04.09 14:56:11 LOG7[1240:1260]: SO_REUSEADDR option set on accept socket 2009.04.09 14:56:11 LOG7[1240:1260]: vnc3 bound to 127.0.0.1:15900 -----------[/From stunnel.log]----------- > > On Tue, 2009-04-07 at 19:34 -0500, Guy wrote: ... > $ listdlls -r stunnel > > ListDLLs v2.25 - DLL lister for Win9x/NT > Copyright (C) 1997-2004 Mark Russinovich > Sysinternals - www.sysinternals.com Thank you for the link. I've downloaded and installed the GUI version, "Process Explorer", on a test machine. I'm pleasantly surprised at its utility and light impact on system resources. One more question please: Will the Win32 binaries at the link you provided <ftp://stunnel.mirt.net/stunnel> keep up fairly closely with the latest OpenSSL releases? With OpenSSL so widely used it is constantly being evaluated for vulnerabilities. When they're found, it is patched quickly but dependent applications are sometimes slow to incorporate patched versions. Thanks again for your excellent help. ./Cal

1 0

Re: [stunnel-users] OpenSSL Vulnerabilities
by Cal Webster 09 Apr '09

09 Apr '09

Thank you Guy! I'll try the Win32 binaries and SSL libraries on a test machine. Do these SSL libraries still require "MSVCR90.dll" from the "Visual C++ Redistributables"? I appreciate the swift response. :-) ./Cal On Tue, 2009-04-07 at 19:34 -0500, Guy wrote: > Cal Webster wrote: > > > To update the OpenSSL libraries you must download and... > > > > > Find OpenSSL v.0.9.8k bins and stunnel-4.27b2-installer > (which includes OpenSSL v.0.9.8k DLLs) at: > > <ftp://stunnel.mirt.net/stunnel> >

1 0

OpenSSL Vulnerabilities
by Cal Webster 07 Apr '09

07 Apr '09

Will there be a security update of stunnel to address vulnerabilities outlined in CVE-2009-0590, CVE-2009-0591, and CVE-2009-0789? Alternatively, will stunnel use updated OpenSSL libraries on the host? It appears that this is true on Fedora RPM packages. For Example: ldd stunnel: ------------ libssl.so.7 => /lib64/libssl.so.7 (0x0000000006a3c000) libcrypto.so.7 => /lib64/libcrypto.so.7 (0x0000000007954000) ------------ rpm -q --requires stunnel ----------------------------------------- ... libcrypto.so.7 ... libssl.so.7 ... ----------------------------------------- rpm -ql openssl | egrep 'libcrypto.so.7|libssl.so.7' ----------------------------------------- /lib/libcrypto.so.7 /lib/libssl.so.7 ----------------------------------------- However, I don't know how to determine whether the same dependency works with Win32 dll's. For example, could we install "Win32 OpenSSL v0.9.8k Light" from the below link to resolve the vulnerabilities? http://www.slproweb.com/download/Win32OpenSSL_Light-0_9_8k.exe The description says that it "Installs the most commonly used essentials of Win32 OpenSSL v0.9.8k" but it doesn't say exactly what. Thanks for any insights or suggestions. Cal Webster

2 2

Re: [stunnel-users] Problem with name resolving when using delay option
by Michal Trojnara 06 Apr '09

06 Apr '09

Maksymilian Kowalik wrote: > So the workaround was as simple as creating etc directory inside chroot > and putting resolv.conf there. But still don't know whose bug it is > glibc's or stunnel's? It's not really a bug. It's rather an inherent property of chrooted environments. They often require some files and/or devices to work properly. Pozdrowienia z Polski, Mike

1 0

Re: [stunnel-users] Problem with name resolving when using delay option
by Aron Griffis 06 Apr '09

06 Apr '09

Maksymilian Kowalik wrote: [Mon Apr 06 2009, 08:56:02AM EDT] > So the workaround was as simple as creating etc directory > inside chroot and putting resolv.conf there. But still don't > know whose bug it is glibc's or stunnel's? Neither, it's your bug. :-) As you discovered, you need resolv.conf in the chroot. Aron

1 0

Updating OpenSSL used by stunnel
by Peter Droop 06 Apr '09

06 Apr '09

Hi, I am running stunnel 4.25 with openssl 0.9.8h on Windows 2003 Server. There are some security updates out for openssl, that are not available on stunnel.org. Can I update openssl by just replacing libeay32.dll and libssl32.dll in the stunnel installation directory? I downloaded the dlls from http://www.slproweb.com/products/Win32OpenSSL.html. Thanks, Peter

1 0

GPL patches
by Michal Trojnara 01 Apr '09

01 Apr '09

Dear Users, I've just uploaded some patches sent to stunnel-users list over the years to ftp://stunnel.mirt.net/stunnel/contrib/. Please remember my policy is *not* to include any GPL code into the official stunnel distribution. If you're brave you're free to apply the patches yourself, or even create a fork of stunnel with some additional functionality. Just be aware there were already some security vulnerabilities (including remote code execution) discovered in the 3rd party stunnel patches. For this reason I also don't recommend stunnel package/port maintainers to include any 3rd party code with stunnel. Best regards, Mike

1 0

Can't get NTLM authentication to work with proxy connect.
by Rudy Ghani 01 Apr '09

01 Apr '09

Hi there, My stunnel client is on an Active Directory-authenticated XP workstation, which needs to connect via a web proxy that authenticates using NTLM. I populated my login details in protocolUsername and protocolPassword, but the connection just dies when it reaches the proxy server. Looking at the log, I get the following:- 2009.04.01 08:20:39 LOG6[2140:2892]: SSL connected: new session negotiated 2009.04.01 08:20:39 LOG6[2140:2892]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2009.04.01 15:34:09 LOG7[2140:2708]: ssh3 accepted FD=356 from 127.0.0.1:1026 2009.04.01 15:34:09 LOG7[2140:2708]: Creating a new thread 2009.04.01 15:34:09 LOG7[2140:2708]: New thread created 2009.04.01 15:34:09 LOG7[2140:3896]: ssh3 started 2009.04.01 15:34:09 LOG7[2140:3896]: FD 356 in non-blocking mode 2009.04.01 15:34:09 LOG7[2140:3896]: TCP_NODELAY option set on local socket 2009.04.01 15:34:09 LOG5[2140:3896]: ssh3 accepted connection from 127.0.0.1:1026 2009.04.01 15:34:09 LOG7[2140:3896]: FD 472 in non-blocking mode 2009.04.01 15:34:09 LOG7[2140:3896]: ssh3 connecting 129.32.20.14:8080 2009.04.01 15:34:09 LOG7[2140:3896]: connect_wait: waiting 10 seconds 2009.04.01 15:34:09 LOG7[2140:3896]: connect_wait: connected 2009.04.01 15:34:09 LOG5[2140:3896]: ssh3 connected remote server from 130.32.82.203:1027 2009.04.01 15:34:09 LOG7[2140:3896]: Remote FD=472 initialized 2009.04.01 15:34:09 LOG7[2140:3896]: TCP_NODELAY option set on remote socket 2009.04.01 15:34:09 LOG5[2140:3896]: Negotiations for connect (client side) started 2009.04.01 15:34:09 LOG7[2140:3896]: -> CONNECT xxxx.ath.cx:443 HTTP/1.1 2009.04.01 15:34:09 LOG7[2140:3896]: -> Host: xxxx.ath.cx:443 2009.04.01 15:34:09 LOG7[2140:3896]: -> Proxy-Connection: keep-alive 2009.04.01 15:34:09 LOG7[2140:3896]: -> Proxy-Authorization: NTLM TlRMTVNTUAABAAAAAgIAAA== 2009.04.01 15:34:09 LOG7[2140:3896]: -> 2009.04.01 15:34:09 LOG3[2140:3896]: Unexpected socket close (fdgetline) 2009.04.01 15:34:09 LOG5[2140:3896]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.04.01 15:34:09 LOG7[2140:3896]: ssh3 finished (1 left) If I decode the NTLM auth string, I only get the NTLMSSP header, which seems to be incomplete. If I recall correctly the domain and workstation info should be passed on as well. So question is, how do I get this to work? Is there any specific format that I need to use when using the protocol* settings for NTLM? Thanks and regards.

1 0

SSL CTX use RSA Private Key error
by G K 27 Mar '09

27 Mar '09

Hello all. I am trying to set up stunnel for use on my machine. I shouldn't have a problem with iptables. But I do run tor/privoxy on a regular basis if that matters. I also have set up my gpg keys too. The following is the error I get. I did do some Googling but I'm not quite understanding what I'm looking for to change or modify. I know the error is the SSL CTX RSA private key. Wed Mar 25, 19:39 # /etc/rc.d/stunnel start :: Starting stunnel [BUSY] 2009.03.25 19:39:21 LOG7[7490:3082353408]: Snagged 64 random bytes from /root/.rnd 2009.03.25 19:39:21 LOG7[7490:3082353408]: Wrote 1024 new random bytes to /root/.rnd 2009.03.25 19:39:21 LOG7[7490:3082353408]: RAND_status claims sufficient entropy for the PRNG 2009.03.25 19:39:21 LOG7[7490:3082353408]: PRNG seeded successfully 2009.03.25 19:39:21 LOG7[7490:3082353408]: Certificate: /etc/stunnel/mail.pem 2009.03.25 19:39:21 LOG7[7490:3082353408]: Certificate loaded 2009.03.25 19:39:21 LOG7[7490:3082353408]: Key file: /etc/stunnel/mail.pem 2009.03.25 19:39:21 LOG3[7490:3082353408]: error stack: 140B3009 : error:140B3009:SSL routines:SSL_CTX_use_RSAPrivateKey_file:PEM lib 2009.03.25 19:39:21 LOG3[7490:3082353408]: SSL_CTX_use_RSAPrivateKey_file: 906D06C: error:0906D06C:PEM routines:PEM_read_bio:no start line stunnel 4.25-1 Linux vampypengy 2.6.28-ARCH #1 SMP PREEMPT Tue Mar 17 06:42:43 UTC 2009 i686 Genuine Intel(R) CPU T2060 @ 1.60GHz GenuineIntel GNU/Linux glibc 2.9-4 Using built-in specs. Target: i686-pc-linux-gnu Configured with: ../configure --prefix=/usr --enable-shared --enable-languages=c,c++,fortran,objc,obj-c++,treelang --enable-threads=posix --mandir=/usr/share/man --infodir=/usr/share/info --enable-__cxa_atexit --disable-multilib --libdir=/usr/lib --libexecdir=/usr/lib --enable-clocale=gnu --disable-libstdcxx-pch --with-tune=generic Thread model: posix gcc version 4.3.3 (GCC) OpenSSL 0.9.8j 07 Jan 2009 perl-net-ssleay 1.30-2

3 4

stunnel 4.26 MS SQL connetion - works on Vista, not on XP
by zervakos 25 Mar '09

25 Mar '09

Greetings, I was wondering if anyone's come across anything like this. I want to encrypt connections for MS SQL Server 2008 Express from a Windows XP client to a Windows 2003 Server. Following these instructions: http://www.securityfocus.com/infocus/1677 I was able to configure encrypted connections by pointing SQL Server Management Studio to 127.0.0.1 on _either_ XP or Vista and then that gets tunneled over to the Windows 2003 Server running SQL Server 2008 Express. I can browse the database tables, etc. Now the problem. I have users that make use of a thin client that connects directly to the SQL Server. It has one config file that I've pointed to 127.0.0.1. When I run this thin client on Vista, it works great, however, when running it on XP, stunnel tries to connect, but then gives up after several attempts. Here's what I see in the server log before connecting: 2009.03.23 12:26:59 LOG7[284564:274684]: RAND_status claims sufficient entropy for the PRNG 2009.03.23 12:26:59 LOG7[284564:274684]: PRNG seeded successfully 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Key file: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Private key loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded verify certificates from CAcert.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded CAcert.pem revocation lookup file 2009.03.23 12:26:59 LOG7[284564:274684]: Verify directory set to certificates 2009.03.23 12:26:59 LOG7[284564:274684]: Added certificates revocation lookup directory 2009.03.23 12:26:59 LOG5[284564:274684]: Peer certificate location certificates 2009.03.23 12:26:59 LOG7[284564:274684]: SSL context initialized for service vnc 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Key file: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Private key loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded verify certificates from CAcert.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded CAcert.pem revocation lookup file 2009.03.23 12:26:59 LOG7[284564:274684]: Verify directory set to certificates 2009.03.23 12:26:59 LOG7[284564:274684]: Added certificates revocation lookup directory 2009.03.23 12:26:59 LOG5[284564:274684]: Peer certificate location certificates 2009.03.23 12:26:59 LOG7[284564:274684]: SSL context initialized for service mssql 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Key file: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Private key loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded verify certificates from CAcert.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded CAcert.pem revocation lookup file 2009.03.23 12:26:59 LOG7[284564:274684]: Verify directory set to certificates 2009.03.23 12:26:59 LOG7[284564:274684]: Added certificates revocation lookup directory 2009.03.23 12:26:59 LOG5[284564:274684]: Peer certificate location certificates 2009.03.23 12:26:59 LOG7[284564:274684]: SSL context initialized for service rdp 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Certificate loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Key file: server.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Private key loaded 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded verify certificates from CAcert.pem 2009.03.23 12:26:59 LOG7[284564:274684]: Loaded CAcert.pem revocation lookup file 2009.03.23 12:26:59 LOG7[284564:274684]: Verify directory set to certificates 2009.03.23 12:26:59 LOG7[284564:274684]: Added certificates revocation lookup directory 2009.03.23 12:26:59 LOG5[284564:274684]: Peer certificate location certificates 2009.03.23 12:26:59 LOG7[284564:274684]: SSL context initialized for service http 2009.03.23 12:26:59 LOG5[284564:274684]: stunnel 4.26 on x86-pc-mingw32-gnu with OpenSSL 0.9.8i 15 Sep 2008 2009.03.23 12:26:59 LOG5[284564:274684]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2009.03.23 12:26:59 LOG5[284564:289192]: No limit detected for the number of clients 2009.03.23 12:27:00 LOG7[284564:289192]: FD 268 in non-blocking mode 2009.03.23 12:27:00 LOG7[284564:289192]: SO_REUSEADDR option set on accept socket 2009.03.23 12:27:00 LOG7[284564:289192]: mssql bound to WINDOWS_SQL_SERVER:14333 2009.03.23 12:27:00 LOG7[284564:289192]: FD 292 in non-blocking mode 2009.03.23 12:27:00 LOG7[284564:289192]: SO_REUSEADDR option set on accept socket And here's what I see after trying to connect from XP (this appears 16 more times in stunnel.log until stunnel gives up): 2009.03.23 12:29:48 LOG7[284564:289192]: mssql accepted FD=308 from Windows_XP_Client:1252 2009.03.23 12:29:48 LOG7[284564:289192]: Creating a new thread 2009.03.23 12:29:48 LOG7[284564:289192]: New thread created 2009.03.23 12:29:48 LOG7[284564:348604]: mssql started 2009.03.23 12:29:48 LOG7[284564:348604]: FD 308 in non-blocking mode 2009.03.23 12:29:48 LOG5[284564:348604]: mssql accepted connection from Windows_XP_Client:1252 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): before/accept initialization 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 read client hello A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 write server hello A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 write certificate A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 write certificate request A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 flush data 2009.03.23 12:29:48 LOG5[284564:348604]: CRL: verification passed 2009.03.23 12:29:48 LOG5[284564:348604]: VERIFY OK: depth=1, /C=PL/ST=Warsaw/L=Warsaw/O=Secure/OU=Secure Labs/CN=CA/emailAddress=user(a)abc.com 2009.03.23 12:29:48 LOG5[284564:348604]: CRL: verification passed 2009.03.23 12:29:48 LOG5[284564:348604]: VERIFY OK: depth=0, /C=PL/ST=Warsaw/L=Warsaw/O=Secure/OU=Secure Labs/CN=VNC Client/emailAddress=user(a)abc.com 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 read client certificate A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 read client key exchange A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 read certificate verify A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 read finished A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 write change cipher spec A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 write finished A 2009.03.23 12:29:48 LOG7[284564:348604]: SSL state (accept): SSLv3 flush data 2009.03.23 12:29:48 LOG7[284564:348604]: 1 items in the session cache 2009.03.23 12:29:48 LOG7[284564:348604]: 0 client connects (SSL_connect()) 2009.03.23 12:29:48 LOG7[284564:348604]: 0 client connects that finished 2009.03.23 12:29:48 LOG7[284564:348604]: 0 client renegotiations requested 2009.03.23 12:29:48 LOG7[284564:348604]: 1 server connects (SSL_accept()) 2009.03.23 12:29:48 LOG7[284564:348604]: 1 server connects that finished 2009.03.23 12:29:48 LOG7[284564:348604]: 0 server renegotiations requested 2009.03.23 12:29:48 LOG7[284564:348604]: 0 session cache hits 2009.03.23 12:29:48 LOG7[284564:348604]: 0 session cache misses 2009.03.23 12:29:48 LOG7[284564:348604]: 0 session cache timeouts 2009.03.23 12:29:48 LOG6[284564:348604]: SSL accepted: new session negotiated 2009.03.23 12:29:48 LOG6[284564:348604]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2009.03.23 12:29:48 LOG7[284564:348604]: FD 332 in non-blocking mode 2009.03.23 12:29:48 LOG7[284564:348604]: mssql connecting 127.0.0.1:1433 2009.03.23 12:29:48 LOG7[284564:348604]: connect_wait: waiting 10 seconds 2009.03.23 12:29:48 LOG7[284564:348604]: connect_wait: connected 2009.03.23 12:29:48 LOG5[284564:348604]: mssql connected remote server from 127.0.0.1:2001 2009.03.23 12:29:48 LOG7[284564:348604]: Remote FD=332 initialized 2009.03.23 12:29:48 LOG7[284564:348604]: SSL alert (read): warning: close notify 2009.03.23 12:29:48 LOG7[284564:348604]: SSL closed on SSL_read 2009.03.23 12:29:48 LOG7[284564:348604]: Socket write shutdown 2009.03.23 12:29:48 LOG7[284564:348604]: SSL write shutdown 2009.03.23 12:29:48 LOG7[284564:348604]: SSL alert (write): warning: close notify 2009.03.23 12:29:48 LOG6[284564:348604]: SSL_shutdown successfully sent close_notify 2009.03.23 12:29:48 LOG5[284564:348604]: Connection closed: 37 bytes sent to SSL, 52 bytes sent to socket 2009.03.23 12:29:48 LOG7[284564:348604]: mssql finished (0 left) The server's stunnel.conf: CAfile = CAcert.pem CApath = certificates cert = server.pem client = no verify = 3 debug = 7 output = stunnel.log [mssql] accept = WINDOWS_SQL_SERVER:14333 connect = 127.0.0.1:1433 The client's stunnel.conf: CAfile = CAcert.pem CApath = certificates cert = client.pem client = yes verify = 3 debug = 7 output = stunnel.log [mssql] accept = 127.0.0.1:1433 connect = WINDOWS_SQL_SERVER:14333 Things I've tried: - changed the compatibility settings of the thin client to work under ealier versions of Windows, this didn't help - regenerated certificates, no good - tried connecting without certificates, still no good I still haven't tried earlier versions of stunnel, but I figured I'd just check and see if may anyone's run across something like this before. From what I can tell, the combination of XP, the thin client and stunnel does not work. The thin client does work on XP when I do not use stunnel, but I need to have the connection encrypted. Any help greatly appreciated, thanks -- View this message in context: http://www.nabble.com/stunnel-4.26-MS-SQL-connetion---works-on-Vista%2C-not… Sent from the Stunnel - Users mailing list archive at Nabble.com.

3 2

Re: [stunnel-users] Using stunnel in a box having http client and http server.
by Joe Lau 23 Mar '09

23 Mar '09

So, my understanding is that I will need one stunnel for each remote web server that my http client is going to connnect to. For example if my http client want to connect to 3 remote web servers. I will need to setup the folllowing stunnels: Remote https Web Server #1 <------------- Stunnel #1 <---------- http client (http://localhost:81) (port 81) Remote https Web Server #1 <------------- Stunnel #2 <---------- http client (http://localhost:82) (port 82) Remote https Web Server #1 <------------- Stunnel #3 <---------- http client (http://localhost:83) (port 83) But I will need only one stunnel for my http server as follow: Remote https client #1 ------------+-----> Stunnel --------------- http server | (port 443) (port 80) Remote https client #2 ------------+ | ..... | | Remote https client #N-------------+ Is the following config file correct for my http server stunnel? client=no accept=443 connect=localhost:80 Thank you! -Joe -----Original Message----- From: Christophe Nanteuil [mailto:[email protected]] Sent: Monday, March 23, 2009 3:19 AM To: Joe Lau Cc: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Using stunnel in a box having http client and http server. 2009/3/20 Joe Lau <Jlau(a)extremenetworks.com>: > > Hello, Hello, > I am new to this list. > > I am planning to use stunnel on my box which has a http client and http server running on it. > I will need two stunnel instances, one for the http client and one for the http server respectively. It seems good. > > For my http client, my stunnel config file looks like this: > > client=yes > accept=80 > connect=remote_web_server:443 > > For my http server, my stunnel config file looks like this: > > client=no > accept=443 > > The problem I am facing is now I have two programs (i.e. 1) stunnel for http client and 2) http server) listening to the same port 80. > How do I resolve this conflict? Who is going to connect to your http "client" ? if it is your local browser (which seems the goal of the configuration), then you can configure the client with "accept=81" and then type in your browser's address bar "https://localhost:/81" -- Christophe Nanteuil DISCLAIMER: This e-mail and any attachments to it may contain confidential and proprietary material and is solely for the use of the intended recipient. Any review, use, disclosure, distribution or copying of this transmittal is prohibited except by or on behalf of the intended recipient. If you have received this transmittal in error, please notify the sender and destroy this e-mail and any attachments and all copies, whether electronic or printed.

2 1

Re: [stunnel-users] Using stunnel in a box having http client and http server.
by Joe Lau 20 Mar '09

20 Mar '09

Hello, I am new to this list. I am planning to use stunnel on my box which has a http client and http server running on it. I will need two stunnel instances, one for the http client and one for the http server respectively. For my http client, my stunnel config file looks like this: client=yes accept=80 connect=remote_web_server:443 For my http server, my stunnel config file looks like this: client=no accept=443 The problem I am facing is now I have two programs (i.e. 1) stunnel for http client and 2) http server) listening to the same port 80. How do I resolve this conflict? Thank you very much for the help. Regards, -Joe DISCLAIMER: This e-mail and any attachments to it may contain confidential and proprietary material and is solely for the use of the intended recipient. Any review, use, disclosure, distribution or copying of this transmittal is prohibited except by or on behalf of the intended recipient. If you have received this transmittal in error, please notify the sender and destroy this e-mail and any attachments and all copies, whether electronic or printed.

1 0

Is this possible? Stunnel FIPS mode with rdesktop to secured Microsoft terminal server
by David W Blaine 16 Mar '09

16 Mar '09

Hi list, I was wondering if this solution is possible? Linux Linux Windows Server 2003 rdesktop ----> Stunnel client ------> Terminal Server no enc FIPS mode FIPS mode I know there is doco's about how to setup a Stunnel using client and server setups on either side but Windows admins here are unlikely to install Stunnel on their side. They have enabled FIPS mode on their Windows servers and disconnected all the Linux/UNIX admins from their Terminal Server. So I was wondering if I could get away with a client only solution? Dave

1 1

persistent SSL connection
by Dorai Ashok 16 Mar '09

16 Mar '09

Hi all, I was able to setup stunnel between two hosts successfully but the only problem I am facing is that, the SSL connection between the two hosts is not persistent. For every connection I make to the stunnel client, a new SSL connection is established by the stunnel client to the stunnel server. Is there a configuration variable in stunnel which can make the SSL connection between stunnel client and server persistent ? Thanks, -Dorai.

3 3

Re: [stunnel-users] persistent SSL connection
by Peter Pentchev 16 Mar '09

16 Mar '09

On Mon, Mar 16, 2009 at 12:59:16PM +0100, delaage.pierre(a)free.fr wrote: > Quoting Peter Pentchev <roam(a)ringlet.net>: You might want to fix your mailer's idea of quoting, since I did not write what you yourself wrote :) You wrote: > For persistent connexion, use ssh tunneling instead of stunnel. Unless, of course, you are trying to communicate with a third-party product that speaks SSL - if either the client or the server is not under your control, there's no way to make them use multiplexed SSH connections instead of SSL :) But if it's just stunnel on both sides, then yes, SSH tunneling may be a better choice for multiplexing, although it has its own problems - most often related to connection keepalive, especially if there is some kind of firewalling gateway on the path. G'luck, Peter -- Peter Pentchev roam(a)ringlet.net roam(a)space.bg roam(a)FreeBSD.org PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint FDBA FD79 C26F 3C51 C95E DF9E ED18 B68D 1619 4553 Hey, out there - is it *you* reading me, or is it someone else?

1 0

Re: [stunnel-users] Configuring stunnel to use p12 and p7b in client mode
by Eduard Witteveen 14 Mar '09

14 Mar '09

Pierre and List, Thanks for the answer. Maybe i wasn't clear enough in my question: 1 - I have a p12 and p7b file, which work in firefox and iexplore. 2 - I want to setup a tunnel, so the encryption is done by stunnel and not by the browser(so i can 'talk' normal http for soap) Removing the password sounds like a good idea, so i started with this. However, somehow my openssl doesnt know the command pkey. (as mentioned: http://www.openssl.org/docs/apps/pkey.html) > $ openssl pkey > openssl:Error: 'pkey' is an invalid command. > openssl version > OpenSSL 0.9.8g 19 Oct 2007 And > openssl.exe pkey > openssl:Error: 'pkey' is an invalid command. > openssl version > OpenSSL 0.9.8i 15 Sept 2008 I searched the net for the error message, but i couldnt find a solution (i did find more questions regarding this on mailinglists) On Thu, 2009-03-12 at 08:21 +0100, delaage.pierre(a)free.fr wrote: > Selon Eduard Witteveen <eduard(a)nergens.org>: > Hello, > In such case a definitive solution is to remove password protection of the > private key, although it is not good for your security, so be careful. > See info at openssl.org : > http://www.openssl.org/docs/apps/pkey.html#EXAMPLES > > "... > To remove the pass phrase on an RSA private key: > > openssl pkey -in key.pem -out keyout.pem > ..." > > and then regenerate a p12 file for your browsers. > > I do not know ways to specify the password in stunnel, but I think this should > not be a good idea. > Anyway ie and firefox should be able to cache your password at least for a > session, so... > > Yours sincerely, > Pierre Delaage > > > Hello, > > > > I'm trying to get stunnel running on my local system, so it will connect > > to the remote a host, which requires authentication with this p12 > > file(with password). I also have the chain of trust which is in the p7b > > file. > > > > The reason why i want to do this, is that the remote host exposes a soap > > interface by https, and i think it would be a good idea to tunnel the > > communications with stunnel, so a transparant configuration can be used. > > Also, this would mean there is no configuration needed for the browser > > anymore, since it can connect to the localhost instead of to the > > remoteserver. > > > > I've tested the p12(certificate PKCS12?) and (trust chain PKCS7?) files > > with internet explorer and firefox. They work(i can browse the > > remotehost), but i still have to enter the password. > > > > I've converted the p12 and p7b files into dem files with the following > > commands: > > > > > openssl pkcs12 -in certificate.p12 -out certificate.pem > > > Enter Import Password: > > > MAC verified OKK > > > Enter PEM pass phrase: > > > Verifying - Enter PEM pass phrase > > > > firefox: store as PEM with chain > > chain.p7b --> chain.pem > > > > Config: > > > key=certificate.pem > > > CAfile=chain.pem > > > client=yes > > > debug=7 > > > output=stunnel.log > > > verify=1 > > > [http] > > > accept=80 > > > connect=www.remoteserver.com:443 > > > TIMEOUTclose=0 > > > > Command: > > > sudo /usr/bin/stunnel4 stunnel.conf > > > > Error: > > > 009.03.11 00:58:10 LOG5[30424:3082909360]: Threading:PTHREAD > > > SSL:ENGINE > > > Sockets:POLL,IPv6 Auth:LIBWRAP > > > 2009.03.11 00:58:10 LOG6[30424:3082909360]: file ulimit = 1024 (can be > > > changed with 'ulimit -n') > > > 2009.03.11 00:58:10 LOG6[30424:3082909360]: poll() used - no > > > FD_SETSIZE > > > limit for file descriptors > > > 2009.03.11 00:58:10 LOG5[30424:3082909360]: 500 clients allowed > > > 2009.03.11 00:58:10 LOG7[30424:3082909360]: FD 10 in non-blocking mode > > > 2009.03.11 00:58:10 LOG7[30424:3082909360]: FD 11 in non-blocking mode > > > 2009.03.11 00:58:10 LOG7[30424:3082909360]: FD 12 in non-blocking mode > > > 2009.03.11 00:58:10 LOG7[30424:3082909360]: SO_REUSEADDR option set on > > > accept socket > > > 2009.03.11 00:58:10 LOG7[30424:3082909360]: http bound to 0.0.0.0:80 > > > 2009.03.11 00:58:10 LOG7[30430:3082909360]: Created pid file > > > /var/run/stunnel4.pid > > > > > > 2009.03.11 00:58:20 LOG7[30430:3082909360]: http accepted FD=13 from > > > 127.0.0.1:59793 > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: http started > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: FD 13 in non-blocking mode > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Waiting for a libwrap > > > process > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Acquired libwrap process > > > #0 > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Releasing libwrap process > > > #0 > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Released libwrap process > > > #0 > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: http permitted by libwrap > > > from > > > 127.0.0.1:59793 > > > 2009.03.11 00:58:20 LOG5[30430:3082738576]: http accepted connection > > > from > > > 127.0.0.1:59793 > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: FD 14 in non-blocking mode > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: http connecting > > > ${REMOTESERVER_IP}:443 > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: connect_wait: waiting 10 > > > seconds > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: connect_wait: connected > > > 2009.03.11 00:58:20 LOG5[30430:3082738576]: http connected remote > > > server > > > from 10.0.2.15:38710 > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Remote FD=14 initialized > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: SSL state (connect): > > > before/connect initialization > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: SSL state (connect): SSLv3 > > > write > > > client hello A > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: SSL state (connect): SSLv3 > > > read > > > server hello A > > > 2009.03.11 00:58:20 LOG4[30430:3082738576]: VERIFY ERROR: depth=0, > > > error=unable to get local issuer certificate: ${UNIQUE NAME} > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: SSL alert (write): fatal: > > > bad > > > certificate > > > 2009.03.11 00:58:20 LOG3[30430:3082738576]: SSL_connect: 14090086: > > > error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate > > > verify > > > failed > > > 2009.03.11 00:58:20 LOG5[30430:3082738576]: Connection reset: 0 bytes > > > sent > > > to SSL, 0 bytes sent to socket > > > 2009.03.11 00:58:20 LOG7[30430:3082738576]: http finished (0 left) > > (${UNIQUE NAME} / ${REMOTESERVER_IP} were replaced) > > > > Tested by connecting the browser to http://127.0.0.1:80/ > > > > How can i get stunnel to redirect http://127.0.0.1:80/ to > > http://remoteserver:443/ and use the certificate and chain to validate > > the connection? Any pointers would also be welcome, since i searched in > > google but i cannot find the correct information, while one would expect > > that this is not the first time that this is being tried. > > > > Thanks, > > > > Eduard Witteveen > > > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)mirt.net > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > >

1 0

Can stunnel do this?
by Miguel Beccari 13 Mar '09

13 Mar '09

I tried this configuration: client = yes debug = debug cert =/Users/etc/stunnel/stunnel.pem [imaps] accept = localhost:143 delay = yes connect = remote:993 and it worked! But if I change "accept = localhost:143" to "accept = localhost:993" it does not work. I need a imaps proxy. Logs does not say anything interesting (SSL accepted: new session negotiated) Thank you all, Miguel

1 0

Newbie Question - Moving stunnel to another machine
by Dave Nasralla 13 Mar '09

13 Mar '09

Hi, I'm pretty new to the unix command line and stunnel. I am running Mac OS 10.5 with the latest version of stunnel. I was able to get stunnel up and running on my computer and it is working fine ( - I installed X-Cold, used Darwinports, got it compiled and configured, and launching at bootup). My question is: If I have an identical Machine (same hardware and OS), is there an easy way to move stunnel over to it? I copied the stunnel executable and the configuration file over to the new machine. I ran it from the terminal command line. % /Applications/stunnel /Applications/stunnel.conf The original location on my machine was (/opt/local/bin/stunnel /opt/ local/etc/stunnel/stunnel.conf) No errors (got the prompt back). But no services start on the configured ports. Am I missing support files? Or am I being dumb to think you can simply copy the program over. I was hoping to not have to jump through the same hoops to get it up and running. Any direction would be appreciated. Thanks, dave naz PS It is a simple configuration to help non SSL Mail clients connect to GMail - no certs involved.

1 0

Configuring stunnel to use p12 and p7b in client mode
by Eduard Witteveen 11 Mar '09

11 Mar '09

Hello, I'm trying to get stunnel running on my local system, so it will connect to the remote a host, which requires authentication with this p12 file(with password). I also have the chain of trust which is in the p7b file. The reason why i want to do this, is that the remote host exposes a soap interface by https, and i think it would be a good idea to tunnel the communications with stunnel, so a transparant configuration can be used. Also, this would mean there is no configuration needed for the browser anymore, since it can connect to the localhost instead of to the remoteserver. I've tested the p12(certificate PKCS12?) and (trust chain PKCS7?) files with internet explorer and firefox. They work(i can browse the remotehost), but i still have to enter the password. I've converted the p12 and p7b files into dem files with the following commands: > openssl pkcs12 -in certificate.p12 -out certificate.pem > Enter Import Password: > MAC verified OKK > Enter PEM pass phrase: > Verifying - Enter PEM pass phrase firefox: store as PEM with chain chain.p7b --> chain.pem Config: > key=certificate.pem > CAfile=chain.pem > client=yes > debug=7 > output=stunnel.log > verify=1 > [http] > accept=80 > connect=www.remoteserver.com:443 > TIMEOUTclose=0 Command: > sudo /usr/bin/stunnel4 stunnel.conf Error: > 009.03.11 00:58:10 LOG5[30424:3082909360]: Threading:PTHREAD > SSL:ENGINE > Sockets:POLL,IPv6 Auth:LIBWRAP > 2009.03.11 00:58:10 LOG6[30424:3082909360]: file ulimit = 1024 (can be > changed with 'ulimit -n') > 2009.03.11 00:58:10 LOG6[30424:3082909360]: poll() used - no > FD_SETSIZE > limit for file descriptors > 2009.03.11 00:58:10 LOG5[30424:3082909360]: 500 clients allowed > 2009.03.11 00:58:10 LOG7[30424:3082909360]: FD 10 in non-blocking mode > 2009.03.11 00:58:10 LOG7[30424:3082909360]: FD 11 in non-blocking mode > 2009.03.11 00:58:10 LOG7[30424:3082909360]: FD 12 in non-blocking mode > 2009.03.11 00:58:10 LOG7[30424:3082909360]: SO_REUSEADDR option set on > accept socket > 2009.03.11 00:58:10 LOG7[30424:3082909360]: http bound to 0.0.0.0:80 > 2009.03.11 00:58:10 LOG7[30430:3082909360]: Created pid file > /var/run/stunnel4.pid > > 2009.03.11 00:58:20 LOG7[30430:3082909360]: http accepted FD=13 from > 127.0.0.1:59793 > 2009.03.11 00:58:20 LOG7[30430:3082738576]: http started > 2009.03.11 00:58:20 LOG7[30430:3082738576]: FD 13 in non-blocking mode > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Waiting for a libwrap > process > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Acquired libwrap process > #0 > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Releasing libwrap process > #0 > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Released libwrap process > #0 > 2009.03.11 00:58:20 LOG7[30430:3082738576]: http permitted by libwrap > from > 127.0.0.1:59793 > 2009.03.11 00:58:20 LOG5[30430:3082738576]: http accepted connection > from > 127.0.0.1:59793 > 2009.03.11 00:58:20 LOG7[30430:3082738576]: FD 14 in non-blocking mode > 2009.03.11 00:58:20 LOG7[30430:3082738576]: http connecting > ${REMOTESERVER_IP}:443 > 2009.03.11 00:58:20 LOG7[30430:3082738576]: connect_wait: waiting 10 > seconds > 2009.03.11 00:58:20 LOG7[30430:3082738576]: connect_wait: connected > 2009.03.11 00:58:20 LOG5[30430:3082738576]: http connected remote > server > from 10.0.2.15:38710 > 2009.03.11 00:58:20 LOG7[30430:3082738576]: Remote FD=14 initialized > 2009.03.11 00:58:20 LOG7[30430:3082738576]: SSL state (connect): > before/connect initialization > 2009.03.11 00:58:20 LOG7[30430:3082738576]: SSL state (connect): SSLv3 > write > client hello A > 2009.03.11 00:58:20 LOG7[30430:3082738576]: SSL state (connect): SSLv3 > read > server hello A > 2009.03.11 00:58:20 LOG4[30430:3082738576]: VERIFY ERROR: depth=0, > error=unable to get local issuer certificate: ${UNIQUE NAME} > 2009.03.11 00:58:20 LOG7[30430:3082738576]: SSL alert (write): fatal: > bad > certificate > 2009.03.11 00:58:20 LOG3[30430:3082738576]: SSL_connect: 14090086: > error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate > verify > failed > 2009.03.11 00:58:20 LOG5[30430:3082738576]: Connection reset: 0 bytes > sent > to SSL, 0 bytes sent to socket > 2009.03.11 00:58:20 LOG7[30430:3082738576]: http finished (0 left) (${UNIQUE NAME} / ${REMOTESERVER_IP} were replaced) Tested by connecting the browser to http://127.0.0.1:80/ How can i get stunnel to redirect http://127.0.0.1:80/ to http://remoteserver:443/ and use the certificate and chain to validate the connection? Any pointers would also be welcome, since i searched in google but i cannot find the correct information, while one would expect that this is not the first time that this is being tried. Thanks, Eduard Witteveen

1 0

Stunnel 4.26 compile issue against openssl 0.9.8j + openssl-fips-1.2
by David W Blaine 10 Mar '09

10 Mar '09

Hi all, When I compile against OpenSSL 0.9.8j + OpenSSL-FIPS-1.2 module on Centos 4.7, I get an error in client.c: client.o(.text+0x1dd): In function `init_ssl': /tmp/stunnel-4.27/src/client.c:333: undefined reference to `FIPS_set_prng_key' collect2: ld returned 1 exit status make[1]: *** [stunnel] Error 1 make[1]: Leaving directory `/tmp/stunnel-4.27/src' make: *** [all-recursive] Error 1 It seems this call is related to a bug in OpenSSL-FIPS-1.1.1 module according to the comments. Checking the references in the includes for both OpenSSL 0.9.8j and OpenSSL-FIPS-1.2, I found that the call should be "fips_set_prng_key" with 3 arguments (the above requires only 2). So based on the comments, I removed it and I was able to successfully compile and install. Not sure if that is the right thing to do??? Dave

2 3

email through clients where no port number defined - like Outlook Express
by Richard Brust 06 Mar '09

06 Mar '09

A few days ago, sent an email in regards to a CRM program attempting to access GMail where no port number definitions are possible. That email (or part of it) is below, but after a bit more diag, I found that the email client was communicating with stunnel, but was not getting past that to GMail (or stunnel was not getting to GMail, not sure how to tell). I also realized that the settings of this application are similar to Outlook Express - email server defined, but no ability to specify port number. Does anyone have stunnel working with Outlook Express? I have a feeling the stunnel settings for that would be similar to what I need. Thanks, and the original email is below I am attempting to send/receive to GMail through a CRM program (contains email client) called ACT! (http://www.act.com) ACT! only allows server addresses in the program configuration, NOT port numbers. (e.g. smtp.gmail.com or 127.0.0.1 - nothing else) I have configured stunnel 4.26 as such: ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [pop] accept = localhost:110 connect = pop.gmail.com:995 [smtp] accept = localhost:25 connect = smtp.gmail.com:465 and in ACT as such: SMTP as localhost POP as localhost (also have tried 127.0.0.1, but with no difference). Richard Brust richard_brust(a)yahoo.com

1 0

Stunnel for tunneling all traffic (vpn)
by BS TLC 06 Mar '09

06 Mar '09

Is it possible to create 2 virtual interfaces, for tunnelling all traffic (vpn)? With ssh program it's quite simple: with the -w option 2 new (tunnel) interfaces are created (for example tun0 and tun1), and it's possible to create a vpn for all type of traffic. Best regards __________________________________________________ Do You Yahoo!? Poco spazio e tanto spam? Yahoo! Mail ti protegge dallo spam e ti da tanto spazio gratuito per i tuoi file e i messaggi http://mail.yahoo.it

2 1

stunnel with libwrap does not disconnect from terminal
by Lars Kruse 02 Mar '09

02 Mar '09

Hi, starting with v4.21, stunnel does not disconnect from the terminal anymore. This can cause problems, if the caller does not redirect stdout/stderr to /dev/null. This did not happen with v4.20. The problem disappears, when I use he "--disable-libwrap" configure switch when compiling stunnel. I am running debian testing on i386 with the stunnel4 package 4.22-2. How to reproduce: 1) stunnel config file: setuid = lars pid = /tmp/stunnel.pid [server] connect = 8080 accept = 443 cert = /some/file 2) command line: cat stunnel.conf | stunnel4 -fd 0 3) process list: erker:~/ttt/stunnel/testing/stunnel-4.26# ps -ef| grep stun lars 29599 1 0 13:47 pts/1 00:00:00 src/stunnel -fd 0 lars 29600 1 0 13:47 pts/1 00:00:00 src/stunnel -fd 0 lars 29601 1 0 13:47 pts/1 00:00:00 src/stunnel -fd 0 lars 29602 1 0 13:47 pts/1 00:00:00 src/stunnel -fd 0 lars 29603 1 0 13:47 pts/1 00:00:00 src/stunnel -fd 0 lars 29604 1 0 13:47 ? 00:00:00 src/stunnel -fd 0 4) FDs of spawned processes: erker:~/ttt/stunnel/testing/stunnel-4.26# ls -l /proc/29599/fd lrwx------ 1 root root 64 Jan 10 13:50 1 -> /dev/pts/1 lrwx------ 1 root root 64 Jan 10 13:47 2 -> /dev/pts/1 lrwx------ 1 root root 64 Jan 10 13:50 3 -> socket:[903037] Is this the expected behaviour? I use stunnel in one of my projects (http://cryptonas.org) and it started to hang with v4.22. After redirecting stdout/stderr to /dev/null, the program works again. I assume, that stunnel should take care for stdout/stderr on its own, when started in daemon mode, right? thanks for your great work! Lars

4 6

No Tray Icon in XP SP3
by Zepp 02 Mar '09

02 Mar '09

Hi all: I am running Stunnel 4.26 in Windows XP SP3. The issue I'm having is that the tray icon is missing when I install and run Stunnel as a service. the program works fine, and it shows up on the process list okay, but no tray icon appears at all. I scanned the help file and saw an option called taskbar which is supposed to be toggled on by default. I added it to the conf file anyway, and it didn't make any difference. The only way I've been able to get the icon to show is to start Stunnel by adding a shortcut to the Startup folder. Is there an option I'm missing? Thanks much! Zepp

1 0

Simple audit of configuration?
by conover＠rahul.net 01 Mar '09

01 Mar '09

Is there a simple way to verify that an stunnel configuration is secure as expected, with no configuration errors? Thanks, John -- John Conover, conover(a)rahul.net, http://www.johncon.com/

1 0

GMail on Windows using ACT
by Richard Brust 24 Feb '09

24 Feb '09

I am attempting to send/receive to GMail through a CRM program (contains email client) called ACT! (http://www.act.com) ACT! only allows server addresses in the program configuration, NOT port numbers. (e.g. smtp.gmail.com or 127.0.0.1 - nothing else) I have configured *stunnel 4.26* as such: ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [pop] accept = localhost:110 connect = pop.gmail.com:995 [smtp] accept = localhost:25 connect = smtp.gmail.com:465 and in ACT as such: SMTP as localhost POP as localhost (also have tried 127.0.0.1, but with no difference). The log is below, but the short of it is that I still cannot get through to the GMail servers. I do not see any glaring errors below, but I'm sure there is something useful. Thank you for any help... 2009.02.24 13:34:35 LOG7[3752:2216]: RAND_status claims sufficient entropy for the PRNG 2009.02.24 13:34:35 LOG7[3752:2216]: PRNG seeded successfully 2009.02.24 13:34:35 LOG7[3752:2216]: SSL context initialized for service pop 2009.02.24 13:34:35 LOG7[3752:2216]: SSL context initialized for service smtp 2009.02.24 13:34:35 LOG5[3752:2216]: stunnel 4.26 on x86-pc-mingw32-gnu with OpenSSL 0.9.8i 15 Sep 2008 2009.02.24 13:34:35 LOG5[3752:2216]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2009.02.24 13:34:35 LOG5[3752:1576]: No limit detected for the number of clients 2009.02.24 13:34:35 LOG7[3752:1576]: FD 200 in non-blocking mode 2009.02.24 13:34:35 LOG7[3752:1576]: SO_REUSEADDR option set on accept socket 2009.02.24 13:34:35 LOG7[3752:1576]: pop bound to 127.0.0.1:110 2009.02.24 13:34:35 LOG7[3752:1576]: FD 208 in non-blocking mode 2009.02.24 13:34:35 LOG7[3752:1576]: SO_REUSEADDR option set on accept socket 2009.02.24 13:34:35 LOG7[3752:1576]: smtp bound to 127.0.0.1:25 2009.02.24 13:34:39 LOG7[3752:1576]: smtp accepted FD=216 from 127.0.0.1:3063 2009.02.24 13:34:39 LOG7[3752:1576]: Creating a new thread 2009.02.24 13:34:39 LOG7[3752:1576]: New thread created 2009.02.24 13:34:39 LOG7[3752:760]: smtp started 2009.02.24 13:34:39 LOG7[3752:760]: FD 216 in non-blocking mode 2009.02.24 13:34:39 LOG7[3752:760]: TCP_NODELAY option set on local socket 2009.02.24 13:34:39 LOG5[3752:760]: smtp accepted connection from 127.0.0.1:3063 2009.02.24 13:34:39 LOG7[3752:760]: FD 240 in non-blocking mode 2009.02.24 13:34:39 LOG7[3752:760]: smtp connecting 209.85.201.111:465 2009.02.24 13:34:39 LOG7[3752:760]: connect_wait: waiting 10 seconds 2009.02.24 13:34:39 LOG7[3752:760]: connect_wait: connected 2009.02.24 13:34:39 LOG5[3752:760]: smtp connected remote server from 192.168.1.100:3064 2009.02.24 13:34:39 LOG7[3752:760]: Remote FD=240 initialized 2009.02.24 13:34:39 LOG7[3752:760]: TCP_NODELAY option set on remote socket 2009.02.24 13:34:39 LOG7[3752:760]: SSL state (connect): before/connect initialization 2009.02.24 13:34:39 LOG7[3752:760]: SSL state (connect): SSLv3 write client hello A 2009.02.24 13:34:39 LOG7[3752:760]: SSL state (connect): SSLv3 read server hello A 2009.02.24 13:34:39 LOG7[3752:760]: SSL state (connect): SSLv3 read server certificate A 2009.02.24 13:34:39 LOG7[3752:760]: SSL state (connect): SSLv3 read server done A 2009.02.24 13:34:39 LOG7[3752:760]: SSL state (connect): SSLv3 write client key exchange A 2009.02.24 13:34:39 LOG7[3752:760]: SSL state (connect): SSLv3 write change cipher spec A 2009.02.24 13:34:39 LOG7[3752:760]: SSL state (connect): SSLv3 write finished A 2009.02.24 13:34:39 LOG7[3752:760]: SSL state (connect): SSLv3 flush data 2009.02.24 13:34:39 LOG7[3752:760]: SSL state (connect): SSLv3 read finished A 2009.02.24 13:34:39 LOG7[3752:760]: 1 items in the session cache 2009.02.24 13:34:39 LOG7[3752:760]: 1 client connects (SSL_connect()) 2009.02.24 13:34:39 LOG7[3752:760]: 1 client connects that finished 2009.02.24 13:34:39 LOG7[3752:760]: 0 client renegotiations requested 2009.02.24 13:34:39 LOG7[3752:760]: 0 server connects (SSL_accept()) 2009.02.24 13:34:39 LOG7[3752:760]: 0 server connects that finished 2009.02.24 13:34:39 LOG7[3752:760]: 0 server renegotiations requested 2009.02.24 13:34:39 LOG7[3752:760]: 0 session cache hits 2009.02.24 13:34:39 LOG7[3752:760]: 0 session cache misses 2009.02.24 13:34:39 LOG7[3752:760]: 0 session cache timeouts 2009.02.24 13:34:39 LOG6[3752:760]: SSL connected: new session negotiated 2009.02.24 13:34:39 LOG6[3752:760]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2009.02.24 13:34:39 LOG7[3752:760]: SSL socket closed on SSL_read 2009.02.24 13:34:39 LOG7[3752:760]: Socket write shutdown 2009.02.24 13:34:39 LOG5[3752:760]: Connection closed: 20 bytes sent to SSL, 226 bytes sent to socket 2009.02.24 13:34:39 LOG7[3752:760]: smtp finished (0 left) 2009.02.24 13:34:39 LOG7[3752:1576]: pop accepted FD=232 from 127.0.0.1:3065 2009.02.24 13:34:39 LOG7[3752:1576]: Creating a new thread 2009.02.24 13:34:39 LOG7[3752:1576]: New thread created 2009.02.24 13:34:39 LOG7[3752:376]: pop started 2009.02.24 13:34:39 LOG7[3752:376]: FD 232 in non-blocking mode 2009.02.24 13:34:39 LOG7[3752:376]: TCP_NODELAY option set on local socket 2009.02.24 13:34:39 LOG5[3752:376]: pop accepted connection from 127.0.0.1:3065 2009.02.24 13:34:39 LOG7[3752:376]: FD 240 in non-blocking mode 2009.02.24 13:34:39 LOG7[3752:376]: pop connecting 209.85.147.109:995 2009.02.24 13:34:39 LOG7[3752:376]: connect_wait: waiting 10 seconds 2009.02.24 13:34:42 LOG7[3752:376]: connect_wait: connected 2009.02.24 13:34:42 LOG5[3752:376]: pop connected remote server from 192.168.1.100:3066 2009.02.24 13:34:42 LOG7[3752:376]: Remote FD=240 initialized 2009.02.24 13:34:42 LOG7[3752:376]: TCP_NODELAY option set on remote socket 2009.02.24 13:34:42 LOG7[3752:376]: SSL state (connect): before/connect initialization 2009.02.24 13:34:42 LOG7[3752:376]: SSL state (connect): SSLv3 write client hello A 2009.02.24 13:34:42 LOG7[3752:376]: SSL state (connect): SSLv3 read server hello A 2009.02.24 13:34:42 LOG7[3752:376]: SSL state (connect): SSLv3 read server certificate A 2009.02.24 13:34:42 LOG7[3752:376]: SSL state (connect): SSLv3 read server done A 2009.02.24 13:34:42 LOG7[3752:376]: SSL state (connect): SSLv3 write client key exchange A 2009.02.24 13:34:42 LOG7[3752:376]: SSL state (connect): SSLv3 write change cipher spec A 2009.02.24 13:34:42 LOG7[3752:376]: SSL state (connect): SSLv3 write finished A 2009.02.24 13:34:42 LOG7[3752:376]: SSL state (connect): SSLv3 flush data 2009.02.24 13:34:42 LOG7[3752:376]: SSL state (connect): SSLv3 read finished A 2009.02.24 13:34:42 LOG7[3752:376]: 1 items in the session cache 2009.02.24 13:34:42 LOG7[3752:376]: 1 client connects (SSL_connect()) 2009.02.24 13:34:42 LOG7[3752:376]: 1 client connects that finished 2009.02.24 13:34:42 LOG7[3752:376]: 0 client renegotiations requested 2009.02.24 13:34:42 LOG7[3752:376]: 0 server connects (SSL_accept()) 2009.02.24 13:34:42 LOG7[3752:376]: 0 server connects that finished 2009.02.24 13:34:42 LOG7[3752:376]: 0 server renegotiations requested 2009.02.24 13:34:42 LOG7[3752:376]: 0 session cache hits 2009.02.24 13:34:42 LOG7[3752:376]: 0 session cache misses 2009.02.24 13:34:42 LOG7[3752:376]: 0 session cache timeouts 2009.02.24 13:34:42 LOG6[3752:376]: SSL connected: new session negotiated 2009.02.24 13:34:42 LOG6[3752:376]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2009.02.24 13:34:42 LOG7[3752:1576]: smtp accepted FD=264 from 127.0.0.1:3067 2009.02.24 13:34:42 LOG7[3752:1576]: Creating a new thread 2009.02.24 13:34:42 LOG7[3752:1576]: New thread created 2009.02.24 13:34:42 LOG7[3752:216]: smtp started 2009.02.24 13:34:42 LOG7[3752:216]: FD 264 in non-blocking mode 2009.02.24 13:34:42 LOG7[3752:216]: TCP_NODELAY option set on local socket 2009.02.24 13:34:42 LOG5[3752:216]: smtp accepted connection from 127.0.0.1:3067 2009.02.24 13:34:42 LOG7[3752:216]: FD 288 in non-blocking mode 2009.02.24 13:34:42 LOG7[3752:216]: smtp connecting 209.85.201.109:465 2009.02.24 13:34:42 LOG7[3752:216]: connect_wait: waiting 10 seconds 2009.02.24 13:34:42 LOG7[3752:216]: connect_wait: connected 2009.02.24 13:34:42 LOG5[3752:216]: smtp connected remote server from 192.168.1.100:3068 2009.02.24 13:34:42 LOG7[3752:216]: Remote FD=288 initialized 2009.02.24 13:34:42 LOG7[3752:216]: TCP_NODELAY option set on remote socket 2009.02.24 13:34:42 LOG7[3752:216]: SSL state (connect): before/connect initialization 2009.02.24 13:34:42 LOG7[3752:216]: SSL state (connect): SSLv3 write client hello A 2009.02.24 13:34:42 LOG7[3752:216]: SSL state (connect): SSLv3 read server hello A 2009.02.24 13:34:42 LOG7[3752:216]: SSL state (connect): SSLv3 read server certificate A 2009.02.24 13:34:42 LOG7[3752:216]: SSL state (connect): SSLv3 read server done A 2009.02.24 13:34:42 LOG7[3752:216]: SSL state (connect): SSLv3 write client key exchange A 2009.02.24 13:34:42 LOG7[3752:216]: SSL state (connect): SSLv3 write change cipher spec A 2009.02.24 13:34:42 LOG7[3752:216]: SSL state (connect): SSLv3 write finished A 2009.02.24 13:34:42 LOG7[3752:216]: SSL state (connect): SSLv3 flush data 2009.02.24 13:34:42 LOG7[3752:216]: SSL state (connect): SSLv3 read finished A 2009.02.24 13:34:42 LOG7[3752:216]: 2 items in the session cache 2009.02.24 13:34:42 LOG7[3752:216]: 2 client connects (SSL_connect()) 2009.02.24 13:34:42 LOG7[3752:216]: 2 client connects that finished 2009.02.24 13:34:42 LOG7[3752:216]: 0 client renegotiations requested 2009.02.24 13:34:42 LOG7[3752:216]: 0 server connects (SSL_accept()) 2009.02.24 13:34:42 LOG7[3752:216]: 0 server connects that finished 2009.02.24 13:34:42 LOG7[3752:216]: 0 server renegotiations requested 2009.02.24 13:34:42 LOG7[3752:216]: 0 session cache hits 2009.02.24 13:34:42 LOG7[3752:216]: 0 session cache misses 2009.02.24 13:34:42 LOG7[3752:216]: 0 session cache timeouts 2009.02.24 13:34:42 LOG6[3752:216]: SSL connected: new session negotiated 2009.02.24 13:34:42 LOG6[3752:216]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2009.02.24 13:34:43 LOG3[3752:216]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2009.02.24 13:34:43 LOG5[3752:216]: Connection reset: 63 bytes sent to SSL, 335 bytes sent to socket 2009.02.24 13:34:43 LOG7[3752:216]: smtp finished (1 left) 2009.02.24 13:35:43 LOG7[3752:376]: SSL socket closed on SSL_read 2009.02.24 13:35:43 LOG7[3752:376]: Socket write shutdown 2009.02.24 13:35:43 LOG5[3752:376]: Connection closed: 48 bytes sent to SSL, 131 bytes sent to socket 2009.02.24 13:35:43 LOG7[3752:376]: pop finished (0 left) Richard Brust rbrDataSolutions/ACT! Certified Consulting http://www.rbrDataSolutions.com 916/769-9411

1 0

Stunnel error
by Reinier van der Gugten 23 Feb '09

23 Feb '09

Hi, I use the STunnel tool to connect to my Ms-SQL database. And so far this works nice. However at one organization I have the following problem: << connect_wait: s_poll_wait timeout>> And the connection fails. Here is the log file and config file. Can you give me any hints how to check where it goes wrong? Thanks. Reinier. 2009.02.23 14:45:12 LOG7[2156:3096]: RAND_status claims sufficient entropy for the PRNG 2009.02.23 14:45:12 LOG7[2156:3096]: PRNG seeded successfully 2009.02.23 14:45:12 LOG7[2156:3096]: Certificate: stunnel.pem 2009.02.23 14:45:12 LOG7[2156:3096]: Certificate loaded 2009.02.23 14:45:12 LOG7[2156:3096]: Key file: stunnel.pem 2009.02.23 14:45:12 LOG7[2156:3096]: Private key loaded 2009.02.23 14:45:12 LOG7[2156:3096]: SSL context initialized for service SQLServer 2009.02.23 14:45:12 LOG5[2156:3096]: stunnel 4.26 on x86-pc-mingw32-gnu with OpenSSL 0.9.8i 15 Sep 2008 2009.02.23 14:45:12 LOG5[2156:3096]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2009.02.23 14:45:12 LOG5[2156:3852]: No limit detected for the number of clients 2009.02.23 14:45:12 LOG7[2156:3852]: FD 184 in non-blocking mode 2009.02.23 14:45:12 LOG7[2156:3852]: SO_REUSEADDR option set on accept socket 2009.02.23 14:45:12 LOG7[2156:3852]: SQLServer bound to 127.0.0.1:31433 2009.02.23 14:49:25 LOG7[2156:3852]: SQLServer accepted FD=208 from 127.0.0.1:2912 2009.02.23 14:49:25 LOG7[2156:3852]: Creating a new thread 2009.02.23 14:49:25 LOG7[2156:3852]: New thread created 2009.02.23 14:49:25 LOG7[2156:996]: SQLServer started 2009.02.23 14:49:25 LOG7[2156:996]: FD 208 in non-blocking mode 2009.02.23 14:49:25 LOG7[2156:996]: TCP_NODELAY option set on local socket 2009.02.23 14:49:25 LOG5[2156:996]: SQLServer accepted connection from 127.0.0.1:2912 2009.02.23 14:49:25 LOG7[2156:996]: FD 232 in non-blocking mode 2009.02.23 14:49:25 LOG7[2156:996]: SQLServer connecting 10.17.98.33:8080 2009.02.23 14:49:25 LOG7[2156:996]: connect_wait: waiting 60 seconds 2009.02.23 14:50:25 LOG6[2156:996]: connect_wait: s_poll_wait timeout 2009.02.23 14:50:25 LOG5[2156:996]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.02.23 14:50:25 LOG7[2156:996]: SQLServer finished (0 left) ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ;output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [SQLServer] accept = 127.0.0.1:31433 ;connect = xx.xx.xxx.xxx:443 connect = 10.17.98.33:8080 protocol = connect protocolHost = xx.xx.xxx.xxx:443 ;session cache timeout session = 60 ;time to wait for expected data TIMEOUTbusy = 60 ;time to wait for close_notify (set to 0 for buggy MSIE) ;TIMEOUTclose = 30 ;time to wait to connect a remote host TIMEOUTconnect = 60 ;time to keep an idle connection ;TIMEOUTidle = 60

1 0

Re: [stunnel-users] stunnel client connecting to host with dynamic
by Adamson H 13 Feb '09

13 Feb '09

>Adamson H wrote: >> Hi, stunnel 4.26 solves a number of issues running on FreeBSD. However, >> a stunnel client still has a problem reconnecting to a host with dynamic >> DNS service after the host IP has changed. Stunnel client seems unaware >> of the host update, pointing the dynamic DNS name to the old outdated >> IP. In order to get reconnected to the host, I have to create a cron >> script to detect the IP change and restart stunnel on the stunnel >> client. My client conf file has the following: >> >> [1873] >> accept = 1873 >> connect = hostname.dynaip.org:1873 >> >> The ip of hostname.dynaip.org changes at a random interval. > >The solution is: >delay = yes > >Best regards, >Mike >_______________________________________________ >stunnel-users mailing list >stunnel-users(a)mirt.net <mailto:[email protected]> >http://stunnel.mirt.net/mailman/listinfo/stunnel-users I added delay = yes to my stunnel client conf file and removed the cron script. The rsync job (873) failed after the IP of the stunnel host had changed. I had to manually restart stunnel to get the job done and put the cron script back again. delay = yes does not with work with ddns. Regards, Adamson H

3 4

stunnel hanging (libwrap)
by Ulrich Wisser 11 Feb '09

11 Feb '09

Hi, on my current project I have a strange error. Stunnel will work for months and suddenly stop accepting connections. At other times it will fail after a couple of hours. It doesn't crash. Connections are still accepted, but no SSL negotiation does take place. Please find a log below. It seems to be some problem with libwrap. As you can see in the logs the last usage of libwrap doesn't release libwrap properly. "Released libwrap process" log statement is missing. And after that just everything hangs waiting for libwrap. But why is this happening? Our host.allow and host.deny files are empty. libwrap is supposed to allow everything. Any suggestions are welcome! Thanks in advance Ulrich 2009.02.10 09:23:16 LOG7[24594:3083130544]: epp accepted FD=22 from 212.227.111.32:59551 2009.02.10 09:23:16 LOG7[24594:3082640272]: epp started 2009.02.10 09:23:16 LOG7[24594:3082640272]: FD 22 in non-blocking mode 2009.02.10 09:23:16 LOG7[24594:3082640272]: TCP_NODELAY option set on local socket 2009.02.10 09:23:16 LOG7[24594:3082640272]: Waiting for a libwrap process 2009.02.10 09:23:16 LOG7[24594:3082640272]: Acquired libwrap process #4 2009.02.10 09:23:16 LOG7[24594:3082640272]: Releasing libwrap process #4 2009.02.10 09:23:16 LOG7[24594:3082640272]: Released libwrap process #4 2009.02.10 09:23:16 LOG7[24594:3082640272]: epp permitted by libwrap from 212.227.111.32:59551 2009.02.10 09:23:16 LOG5[24594:3082640272]: epp accepted connection from 212.227.111.32:59551 2009.02.10 09:23:16 LOG7[24594:3082640272]: SSL state (accept): before/accept initialization 2009.02.10 09:23:16 LOG7[24594:3082640272]: SSL state (accept): SSLv3 read client hello A 2009.02.10 09:23:16 LOG7[24594:3082640272]: SSL state (accept): SSLv3 write server hello A 2009.02.10 09:23:16 LOG7[24594:3082640272]: SSL state (accept): SSLv3 write certificate A 2009.02.10 09:23:16 LOG7[24594:3082640272]: SSL state (accept): SSLv3 write server done A 2009.02.10 09:23:16 LOG7[24594:3082640272]: SSL state (accept): SSLv3 flush data 2009.02.10 09:23:16 LOG7[24594:3082918800]: Socket closed on read 2009.02.10 09:23:16 LOG7[24594:3082918800]: SSL write shutdown 2009.02.10 09:23:16 LOG7[24594:3082918800]: SSL alert (write): warning: close notify 2009.02.10 09:23:16 LOG6[24594:3082918800]: SSL socket closed on SSL_shutdown 2009.02.10 09:23:16 LOG7[24594:3082918800]: Socket write shutdown 2009.02.10 09:23:16 LOG5[24594:3082918800]: Connection closed: 2249 bytes sent to SSL, 1169 bytes sent to socket 2009.02.10 09:23:16 LOG7[24594:3082918800]: epp finished (5 left) 2009.02.10 09:23:16 LOG7[24594:3082709904]: SSL state (accept): SSLv3 read client key exchange A 2009.02.10 09:23:16 LOG7[24594:3082709904]: SSL state (accept): SSLv3 read finished A 2009.02.10 09:23:16 LOG7[24594:3082709904]: SSL state (accept): SSLv3 write change cipher spec A 2009.02.10 09:23:16 LOG7[24594:3082709904]: SSL state (accept): SSLv3 write finished A 2009.02.10 09:23:16 LOG7[24594:3082709904]: SSL state (accept): SSLv3 flush data 2009.02.10 09:23:16 LOG7[24594:3082709904]: 36 items in the session cache 2009.02.10 09:23:16 LOG7[24594:3082709904]: 0 client connects (SSL_connect()) 2009.02.10 09:23:16 LOG7[24594:3082709904]: 0 client connects that finished 2009.02.10 09:23:16 LOG7[24594:3082709904]: 0 client renegotiations requested 2009.02.10 09:23:16 LOG7[24594:3082709904]: 292 server connects (SSL_accept()) 2009.02.10 09:23:16 LOG7[24594:3082709904]: 290 server connects that finished 2009.02.10 09:23:16 LOG7[24594:3082709904]: 0 server renegotiations requested 2009.02.10 09:23:16 LOG7[24594:3082709904]: 41 session cache hits 2009.02.10 09:23:16 LOG7[24594:3082709904]: 1 session cache misses 2009.02.10 09:23:16 LOG7[24594:3082709904]: 6 session cache timeouts 2009.02.10 09:23:16 LOG6[24594:3082709904]: SSL accepted: new session negotiated 2009.02.10 09:23:16 LOG6[24594:3082709904]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2009.02.10 09:23:16 LOG7[24594:3082709904]: FD 16 in non-blocking mode 2009.02.10 09:23:16 LOG7[24594:3082709904]: epp connecting 127.0.0.1:9777 2009.02.10 09:23:16 LOG7[24594:3082709904]: connect_wait: waiting 10 seconds 2009.02.10 09:23:16 LOG7[24594:3082709904]: connect_wait: connected 2009.02.10 09:23:16 LOG5[24594:3082709904]: epp connected remote server from 127.0.0.1:40831 2009.02.10 09:23:16 LOG7[24594:3082709904]: Remote FD=16 initialized 2009.02.10 09:23:16 LOG7[24594:3082709904]: TCP_NODELAY option set on remote socket 2009.02.10 09:23:16 LOG7[24594:3082640272]: SSL state (accept): SSLv3 read client key exchange A 2009.02.10 09:23:16 LOG7[24594:3082640272]: SSL state (accept): SSLv3 read finished A 2009.02.10 09:23:16 LOG7[24594:3082640272]: SSL state (accept): SSLv3 write change cipher spec A 2009.02.10 09:23:16 LOG7[24594:3082640272]: SSL state (accept): SSLv3 write finished A 2009.02.10 09:23:16 LOG7[24594:3082640272]: SSL state (accept): SSLv3 flush data 2009.02.10 09:23:16 LOG7[24594:3082640272]: 37 items in the session cache 2009.02.10 09:23:16 LOG7[24594:3082640272]: 0 client connects (SSL_connect()) 2009.02.10 09:23:16 LOG7[24594:3082640272]: 0 client connects that finished 2009.02.10 09:23:16 LOG7[24594:3082640272]: 0 client renegotiations requested 2009.02.10 09:23:16 LOG7[24594:3082640272]: 292 server connects (SSL_accept()) 2009.02.10 09:23:16 LOG7[24594:3082640272]: 291 server connects that finished 2009.02.10 09:23:16 LOG7[24594:3082640272]: 0 server renegotiations requested 2009.02.10 09:23:16 LOG7[24594:3082640272]: 41 session cache hits 2009.02.10 09:23:16 LOG7[24594:3082640272]: 1 session cache misses 2009.02.10 09:23:16 LOG7[24594:3082640272]: 6 session cache timeouts 2009.02.10 09:23:16 LOG6[24594:3082640272]: SSL accepted: new session negotiated 2009.02.10 09:23:16 LOG6[24594:3082640272]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2009.02.10 09:23:16 LOG7[24594:3082640272]: FD 18 in non-blocking mode 2009.02.10 09:23:16 LOG7[24594:3082640272]: epp connecting 127.0.0.1:9777 2009.02.10 09:23:16 LOG7[24594:3082640272]: connect_wait: waiting 10 seconds 2009.02.10 09:23:16 LOG7[24594:3082640272]: connect_wait: connected 2009.02.10 09:23:16 LOG5[24594:3082640272]: epp connected remote server from 127.0.0.1:40832 2009.02.10 09:23:16 LOG7[24594:3082640272]: Remote FD=18 initialized 2009.02.10 09:23:16 LOG7[24594:3082640272]: TCP_NODELAY option set on remote socket 2009.02.10 09:23:16 LOG7[24594:3083127696]: Socket closed on read 2009.02.10 09:23:16 LOG7[24594:3083127696]: SSL write shutdown 2009.02.10 09:23:16 LOG7[24594:3083127696]: SSL alert (write): warning: close notify 2009.02.10 09:23:16 LOG6[24594:3083127696]: SSL socket closed on SSL_shutdown 2009.02.10 09:23:16 LOG7[24594:3083127696]: Socket write shutdown 2009.02.10 09:23:16 LOG5[24594:3083127696]: Connection closed: 2249 bytes sent to SSL, 1169 bytes sent to socket 2009.02.10 09:23:16 LOG7[24594:3083127696]: epp finished (4 left) 2009.02.10 09:23:30 LOG7[24594:3083130544]: epp accepted FD=15 from 62.116.129.3:3503 2009.02.10 09:23:30 LOG7[24594:3083127696]: epp started 2009.02.10 09:23:30 LOG7[24594:3083127696]: FD 15 in non-blocking mode 2009.02.10 09:23:30 LOG7[24594:3083127696]: TCP_NODELAY option set on local socket 2009.02.10 09:23:30 LOG7[24594:3083127696]: Waiting for a libwrap process 2009.02.10 09:23:30 LOG7[24594:3083127696]: Acquired libwrap process #4 2009.02.10 09:23:30 LOG7[24594:3083130544]: epp accepted FD=17 from 62.116.129.3:3504 2009.02.10 09:23:30 LOG7[24594:3082918800]: epp started 2009.02.10 09:23:30 LOG7[24594:3082918800]: FD 17 in non-blocking mode 2009.02.10 09:23:30 LOG7[24594:3082918800]: TCP_NODELAY option set on local socket 2009.02.10 09:23:30 LOG7[24594:3082918800]: Waiting for a libwrap process 2009.02.10 09:23:30 LOG7[24594:3083127696]: Releasing libwrap process #4 2009.02.10 09:23:45 LOG7[24594:3083130544]: epp accepted FD=23 from 62.116.129.3:35076 2009.02.10 09:23:45 LOG7[24594:3082779536]: epp started 2009.02.10 09:23:45 LOG7[24594:3082779536]: FD 23 in non-blocking mode 2009.02.10 09:23:45 LOG7[24594:3082779536]: TCP_NODELAY option set on local socket 2009.02.10 09:23:45 LOG7[24594:3082779536]: Waiting for a libwrap process 2009.02.10 09:23:48 LOG7[24594:3083130544]: epp accepted FD=24 from 212.209.10.53:4853 2009.02.10 09:23:48 LOG7[24594:3083058064]: epp started 2009.02.10 09:23:48 LOG7[24594:3083058064]: FD 24 in non-blocking mode 2009.02.10 09:23:48 LOG7[24594:3083058064]: TCP_NODELAY option set on local socket 2009.02.10 09:23:48 LOG7[24594:3083058064]: Waiting for a libwrap process 2009.02.10 09:24:01 LOG7[24594:3083130544]: epp accepted FD=25 from 62.116.129.3:35084 2009.02.10 09:24:01 LOG7[24594:3082570640]: epp started 2009.02.10 09:24:01 LOG7[24594:3082570640]: FD 25 in non-blocking mode 2009.02.10 09:24:01 LOG7[24594:3082570640]: TCP_NODELAY option set on local socket 2009.02.10 09:24:01 LOG7[24594:3082570640]: Waiting for a libwrap process 2009.02.10 09:24:50 LOG7[24594:3083130544]: epp accepted FD=26 from 91.203.4.58:3814 2009.02.10 09:24:50 LOG7[24594:3082501008]: epp started 2009.02.10 09:24:50 LOG7[24594:3082501008]: FD 26 in non-blocking mode 2009.02.10 09:24:50 LOG7[24594:3082501008]: TCP_NODELAY option set on local socket 2009.02.10 09:24:50 LOG7[24594:3082501008]: Waiting for a libwrap process 2009.02.10 09:25:29 LOG7[24594:3083130544]: epp accepted FD=27 from 87.96.215.128:34595 2009.02.10 09:25:29 LOG7[24594:3082431376]: epp started 2009.02.10 09:25:29 LOG7[24594:3082431376]: FD 27 in non-blocking mode 2009.02.10 09:25:29 LOG7[24594:3082431376]: TCP_NODELAY option set on local socket 2009.02.10 09:25:29 LOG7[24594:3082431376]: Waiting for a libwrap process 2009.02.10 09:25:40 LOG7[24594:3083130544]: epp accepted FD=28 from 195.249.40.26:36799 2009.02.10 09:25:40 LOG7[24594:3082361744]: epp started 2009.02.10 09:25:40 LOG7[24594:3082361744]: FD 28 in non-blocking mode

2 1

stunnel client connecting to host with dynamic dns service
by Adamson H 09 Feb '09

09 Feb '09

Hi, stunnel 4.26 solves a number of issues running on FreeBSD. However, a stunnel client still has a problem reconnecting to a host with dynamic DNS service after the host IP has changed. Stunnel client seems unaware of the host update, pointing the dynamic DNS name to the old outdated IP. In order to get reconnected to the host, I have to create a cron script to detect the IP change and restart stunnel on the stunnel client. My client conf file has the following: [1873] accept = 1873 connect = hostname.dynaip.org:1873 The ip of hostname.dynaip.org changes at a random interval. Please help. Adamosn H

2 1

Re: [stunnel-users] Stunnel via proxy CONNECT
by Michal Trojnara 09 Feb '09

09 Feb '09

kommersz wrote: > My understanding was that there was a patch merged into Stunnel codeline > with version 4.05 a long time ago which allows the parameters > "httpsproxy_dest" and some others to be used when specifying a [https] > connection in stunnel.conf. Your understanding is not correct, but similar functionality was re-implemented from scratch. You may consider Reading The Fine Manual at: http://stunnel.mirt.net/static/stunnel.html The relevant part is: protocol = proto application protocol to negotiate SSL currently supported: cifs, connect, imap, nntp, pop3, smtp protocolAuthentication = auth_type authentication type for protocol negotiations currently supported: basic, NTLM Currently authentication type only applies to 'connect' protocol. default: basic protocolHost = host:port destination address for protocol negotiations protocolPassword = password password for protocol negotiations protocolUsername = username username for protocol negotiations Best regards, Mike

1 0

Re: [stunnel-users] stunnel tls wrapper/proxy for xmpp
by C.J. Adams-Collier 04 Feb '09

04 Feb '09

On Mon, Feb 02, 2009 at 02:20:18PM -0800, Brian Hatch wrote: > Roughly around 2009-02-02 13:31 -0800, C.J. Adams-Collier broached: > > > I'm new here, and I didn't see anything relating to this after a quick > > glance at the archives. I'd like to start a stunnel connection > > connected to the google talk server and then connect finch up to that > > so that I can tap the clear xmpp session using tcpdump. Can one of > > you help me? > > 5222 requires starttls for xmpp, which stunnel doesn't support. > > 5223 is wrapped ssl and would work for you. Thanks Brian, That almost works, too! I think google only does TLS (5222) though. 23:01:03.594856 IP colliertech.org.35052 > od-in-f83.google.com.5223: S 2704797155:2704797155(0) win 5840 <mss 1460,sackOK,timestamp 133784958 0,nop,wscale 1> 23:01:06.591987 IP colliertech.org.35052 > od-in-f83.google.com.5223: S 2704797155:2704797155(0) win 5840 <mss 1460,sackOK,timestamp 133785708 0,nop,wscale 1> Was there a silent "yet" at the end of your "doesn't support" comment above? :) Do you need beta testers for this new feature? Cheers, C.J. > > -- > Brian Hatch Error 23 occurred when > Systems and attempting to report > Security Engineer error 23. > http://www.ifokr.org/bri/ > > Every message PGP signed

4 7

Error message vista
by Reinier van der Gugten 04 Feb '09

04 Feb '09

Hi, I use Stunnel for some of my customers. However I tried it myself (after a while, and after a reinstall of windows) and I get this error. Can anyone tell me how to get it to work again? I get the same error when I run it as administrator, or when I change the port from 443 to 4430. 2009.02.04 13:54:04 LOG7[2828:5668]: Snagged 64 random bytes from C:/.rnd 2009.02.04 13:54:04 LOG7[2828:5668]: Wrote 1024 new random bytes to C:/.rnd 2009.02.04 13:54:04 LOG7[2828:5668]: RAND_status claims sufficient entropy for the PRNG 2009.02.04 13:54:04 LOG7[2828:5668]: PRNG seeded successfully 2009.02.04 13:54:04 LOG7[2828:5668]: Certificate: stunnel.pem 2009.02.04 13:54:04 LOG7[2828:5668]: Certificate loaded 2009.02.04 13:54:04 LOG7[2828:5668]: Key file: stunnel.pem 2009.02.04 13:54:04 LOG7[2828:5668]: Private key loaded 2009.02.04 13:54:04 LOG7[2828:5668]: SSL context initialized for service SQLServer 2009.02.04 13:54:04 LOG5[2828:5668]: stunnel 4.26 on x86-pc-mingw32-gnu with OpenSSL 0.9.8i 15 Sep 2008 2009.02.04 13:54:04 LOG5[2828:5668]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2009.02.04 13:54:04 LOG5[2828:5672]: No limit detected for the number of clients 2009.02.04 13:54:04 LOG7[2828:5672]: FD 224 in non-blocking mode 2009.02.04 13:54:04 LOG7[2828:5672]: SO_REUSEADDR option set on accept socket 2009.02.04 13:54:04 LOG3[2828:5672]: Error binding SQLServer to 127.0.0.1:31433 2009.02.04 13:54:04 LOG3[2828:5672]: bind: Permission denied (WSAEACCES) (10013) 2009.02.04 13:54:04 LOG3[2828:5672]: Server is down My stunnel.conf looks like this (actual IP address has been modified): ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ;output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [SQLServer] accept = 127.0.0.1:31433 connect = 85.15.135.121:443 ; In case of a proxy server, use: ;connect = 10.3.2.50:8080 ;protocol = connect ;protocolHost = 85.15.135.121:443

2 1

crl next update field functionality seems incorrect
by Steve Hoffman 04 Feb '09

04 Feb '09

Regarding this piece of code in verify.c: if(X509_cmp_current_time(next_update)<0) { s_log(LOG_WARNING, "Found CRL is expired - " "revoking all certificates until you get updated CRL"); X509_STORE_CTX_set_error(callback_ctx, X509_V_ERR_CRL_HAS_EXPIRED); X509_OBJECT_free_contents(&obj); return 0; /* reject connection */ } I don't believe this is correct functionality. The "next update" field is not an expiration of the CRL, but more of an indicator that you, as the holder of the CRL, should obtain a new one. Snippet from this link: http://www.netscape.ca/browser/netscape8/help/en/ssl_help.html#next_update About the "Next Update" Date The browser uses the CRLs it has available to check the validity of certificates issued by the corresponding CAs. If a certificate is listed as revoked, the browser won't accept it as evidence of identity. A CA typically publishes an updated CRL at regular intervals. Every CRL includes a date, specified in the Next Update field, by which the CA will publish the next update of that CRL. In general, if the date in the Next Update field is earlier than the current date, you should obtain the most recent version of the CRL. To view CRL information and set up automatic CRL updating, see Viewing and Managing CRLs. CAs are required to produce a new CRL by the Next Update date. However, the absence of the most recent CRL does not by itself invalidate a certificate. For this reason, if the most recent CRL is not available, a certificate may be validated even though the most recent CRL shows it as expired. Automatic CRL updating can help to avoid this situation. I'd like to suggest removing this check. Thanks, Steve

3 2

error compilation stunnel-4.11 for ARM9
by mailinglist 03 Feb '09

03 Feb '09

Did you ever receive a answer for your problem. Ic have the same problem now. checking for socklen_t... yes configure: **************************************** PTY device files checking for "/dev/ptmx"... configure: error: cannot check for file existence when cross compiling Thanks in advance for you help Ebse

1 0

stunnel tls wrapper/proxy for xmpp
by C.J. Adams-Collier 02 Feb '09

02 Feb '09

Hey all, I'm new here, and I didn't see anything relating to this after a quick glance at the archives. I'd like to start a stunnel connection connected to the google talk server and then connect finch up to that so that I can tap the clear xmpp session using tcpdump. Can one of you help me? Thanks in advance, C.J. cjac@sh0:~/stunnel$ cat stunnel.conf client = yes connect = el-in-f125.google.com:5222 foreground = yes pid = /tmp/stunnel4.pid debug = 7 cjac@sh0:~/stunnel$ stunnel-4.26/src/stunnel stunnel.conf 2009.02.02 21:31:13 LOG6[24798:140190659815120]: Unable to retrieve any random data from /home/cjac/.rnd 2009.02.02 21:31:13 LOG7[24798:140190659815120]: Wrote 0 new random bytes to /home/cjac/.rnd 2009.02.02 21:31:13 LOG7[24798:140190659815120]: RAND_status claims sufficient entropy for the PRNG 2009.02.02 21:31:13 LOG7[24798:140190659815120]: PRNG seeded successfully 2009.02.02 21:31:13 LOG7[24798:140190659815120]: SSL context initialized for service stunnel 2009.02.02 21:31:13 LOG5[24798:140190659815120]: stunnel 4.26 on x86_64-unknown-linux-gnu with OpenSSL 0.9.8c 05 Sep 2006 2009.02.02 21:31:13 LOG5[24798:140190659815120]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 2009.02.02 21:31:13 LOG7[24798:140190659815120]: stunnel started 2009.02.02 21:31:13 LOG7[24798:140190659815120]: FD 0 in non-blocking mode 2009.02.02 21:31:13 LOG7[24798:140190659815120]: FD 1 in non-blocking mode 2009.02.02 21:31:13 LOG7[24798:140190659815120]: FD 4 in non-blocking mode 2009.02.02 21:31:13 LOG7[24798:140190659815120]: stunnel connecting 209.85.163.125:5222 2009.02.02 21:31:13 LOG7[24798:140190659815120]: connect_wait: waiting 10 seconds 2009.02.02 21:31:14 LOG7[24798:140190659815120]: connect_wait: connected 2009.02.02 21:31:14 LOG5[24798:140190659815120]: stunnel connected remote server from 172.16.9.3:55967 2009.02.02 21:31:14 LOG7[24798:140190659815120]: Remote FD=4 initialized 2009.02.02 21:31:14 LOG7[24798:140190659815120]: SSL state (connect): before/connect initialization 2009.02.02 21:31:14 LOG7[24798:140190659815120]: SSL state (connect): SSLv3 write client hello A 2009.02.02 21:31:14 LOG7[24798:140190659815120]: SSL alert (write): fatal: handshake failure 2009.02.02 21:31:14 LOG3[24798:140190659815120]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2009.02.02 21:31:14 LOG5[24798:140190659815120]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.02.02 21:31:14 LOG7[24798:140190659815120]: stunnel finished (0 left)

2 1

Fwd: Stunnel & Zimbra
by Allen 02 Feb '09

02 Feb '09

Hi folks, I'm reposting this from my email address on file, because it was initially rejected (I think because I sent it from my main business address, which is not the address I have listed with this group. My apologies. ------------ I've been using stunnel with Zimbra, on OS X Sever since last year and it's been working well (SSL tunnels should be seen and not heard ;-). I upgraded Zimbra yesterday to a new version, that apparently was supposed to fix its instability running on the OS X platform. However, the upgrade wound up breaking the mail server's ability to send email. From Zimbra's web client, it appears like mail is getting sent (there's a little green sent mail box that pops up right after you click on the send button). Mail never arrives at the client end. I can still receive mail into the Zimbra account when I send to it from my business or personal email account. I provisoned and reloaded posffix, etc., and still can't receive mail on the other end. No stunnel settings have changed since before the upgrade. Here are the stunnel-related file outputs: ----------------------------------------------------------------- root# cat /opt/local/etc/stunnel/stunnel.conf client = yes foreground = no [smtps] accept = 5000 connect = server_name.x.y.com:465 (server name changed to protect the innocent ;-) ----------------------------------------------------------------- cat /opt/zimbra/conf/relay_password server_name.domain.com [email protected]:fakepassword --------------------------------------------- With the real usernames, password, domains, etc., those two (above) stunnel files worked perfectly well with stunnel, and sending mail was not a problem. That was --until I upgraded Zimbra. I realize that this is a stunnel forum and the Zimbra-related forum deals with all their issues. However, I'm wondering if somebody out there in stunnel land might have a light bulb going off regarding this issue. Perhaps there's something that I'm overlooking? Thanks! Allen

1 0

Identification Propagation patch using stunnel client certificates
by Christophe Nanteuil 02 Feb '09

02 Feb '09

Hello, NB : this patch is provided as alpha version : it handles only 1 request at a time for each administrative and ident servers. Why to use this patch ? This patch can be useful when : - you provide access to Internet via your stunnel server and when your legislation enforces you to keep logs of who connected where and when. In this case, you will have Squid logs filled with identification of stunnel clients in a very simple way : nothing to ask to the client as it uses automatically its certificate to fill in the identity fields. - you want to implement several profile access for your clients accessing your web proxy/server : as the proxy will ask ident request to stunnel, you can create filter groups to allow / denied access (with redirection to a page that you can customize) depending on stunnel answer : see filtergroups option of DansGuardian or acl options in squid. Patch to version : 4.26 Type : new feature Description : Identification Propagation using stunnel client certificates The patch proposes to extend the identification propagation provided by the directive 'EXEC=' to directive 'CONNECT=' when using client certificates. With EXEC directive, Subject name and Issuer Name of clients are put in environment variables, which allows the program to determine identity of the stunnel client. This patch adds an ident server functionality to stunnel, compliant with RFC 1413, to allow propagation of identification to remote hosts specified by the service directive 'CONNECT='. Additionnaly, this patch provides an admnistrative server "bound" to the Ident server : on the administrative socket (default port 127.0.0.1:790), you can request number of users currently connected and list them. How to use this patch ? You just have to add a 'identServer=yes' directive to services that you want to propagate identification. For example, you can use this patch when connecting to a DansGuardian web proxy (installed on proxy.example.com) with the option authplugin = '/etc/dansguardian/ authplugins/ident.conf' enabled in the configuration file (or when connecting to a Squid web proxy compiled with --enable-ident-lookups option), and the following stunnel configuration file (located in /etc/ssl/stunnel/stunnel-ident.conf) : ... [WEB] accept=8080 connect=proxy.example.com:8080 identServer=yes ... Stunnel will create a listening socket on 0.0.0.0:113 and answer requests initiated by DansGuardian. -- Christophe Nanteuil

2 4

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users