- stunnel-users - stunnel.org

Re: [stunnel-users] Stunnel License
by Bansal, Gaurav (Gaurav) 24 Sep '08

24 Sep '08

We are compiling stunnel source without any modification for different platform supported of our product. Then we are running stunnel as a standalone process after making changes to stunnel.conf file. In stunnel.conf file we are providing location of certificates and ports to be used We would distribute stunnel binary along with our product. Given the scenario I have mentioned do you foresee legal problems in usage of stunnel. I understand that OpenSSL uses OpenSSL license but I got this for openssl website. ==================================================== On many systems including the major Linux and BSD distributions, yes (the GPL does not place restrictions on using libraries that are part of the normal operating system distribution). On other systems, the situation is less clear. Some GPL software copyright holders claim that you infringe on their rights if you use OpenSSL with their software on operating systems that don't normally include OpenSSL. If you develop open source software that uses OpenSSL, you may find it useful to choose another license than the GPL, or state explicitly that "This program is released under the GPL with the additional exemption that compiling, linking, and/or using OpenSSL is allowed." If you are using GPL software developed by others, you may want to ask the copyright holder for permission to use their software with OpenSSL. ===================================================== Specifically I am concerned if Stunnel states that compiling, linking, and/or using OpenSSL is allowed Thanks Gaurav ________________________________ From: Bansal, Gaurav (Gaurav) Sent: Wednesday, September 24, 2008 5:27 PM To: 'webmaster(a)stunnel.org'; 'stunnel-users(a)mirt.net'; 'stunnel-users-owner(a)mirt.net'; 'Michal.Trojnara(a)mirt.net' Subject: Stunnel License Hi, We are planning to use Stunnel to encrypt traffic between Apache mod_jk and AJP connector of JBoss Tomcat. It seems that Stunnel uses OpenSSL APIs. Since Stunnel is available under GPL license, the license terms prevents us from using Stunnel in our product since it exposes OpenSSL which is also available under GPL license. I would like to know if there is also a commercial license available for stunnel? I would appreciate if you can throw pointers on how to package Stunnel with a commercial product. Thank Gaurav

2 1

Stunnel License
by Bansal, Gaurav (Gaurav) 24 Sep '08

24 Sep '08

Hi, We are planning to use Stunnel to encrypt traffic between Apache mod_jk and AJP connector of JBoss Tomcat. It seems that Stunnel uses OpenSSL APIs. Since Stunnel is available under GPL license, the license terms prevents us from using Stunnel in our product since it exposes OpenSSL which is also available under GPL license. I would like to know if there is also a commercial license available for stunnel? I would appreciate if you can throw pointers on how to package Stunnel with a commercial product. Thank Gaurav

1 0

Re: [stunnel-users] Compiled Stunnel 4.25 with OpenSSL 0.9.8h
by Nelgraine 22 Sep '08

22 Sep '08

Thanks for your reply. I’ve found out that Solaris 10 machine has default OpenSSL 0.9.7d located in /usr/local/ssl/bin. Update OpenSSL 0.9.8h using this command: ../config -fPIC shared no-idea threads make depend make make test make install But unfortunately the gcc link to old openssl 0.9.7d. How to update the link in gcc? Any help would be greatly appreciated. Thanks! Regards, Nelgraine --- On Sun, 9/21/08, stunnel-users-request(a)mirt.net <stunnel-users-request(a)mirt.net> wrote: > From: stunnel-users-request(a)mirt.net <stunnel-users-request(a)mirt.net> > Subject: stunnel-users Digest, Vol 50, Issue 15 > To: stunnel-users(a)mirt.net > Date: Sunday, September 21, 2008, 6:00 PM > Send stunnel-users mailing list submissions to > stunnel-users(a)mirt.net > > To subscribe or unsubscribe via the World Wide Web, visit > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body > 'help' to > stunnel-users-request(a)mirt.net > > You can reach the person managing the list at > stunnel-users-owner(a)mirt.net > > When replying, please edit your Subject line so it is more > specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. stunnel 4.26 released (Michal Trojnara) > 2. Re: Compiled Stunnel 4.25 with OpenSSL 0.9.8h > on Solaris 10 > (Michal Trojnara) > 3. stunnel 4.26 released (Michal Trojnara) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 20 Sep 2008 23:13:50 +0200 > From: Michal Trojnara <Michal.Trojnara(a)mobi-com.net> > Subject: [stunnel-users] stunnel 4.26 released > To: 'stunnel-users(a)mirt.net' > <stunnel-users(a)mirt.net>, > stunnel-announce(a)mirt.net, openssl-users(a)openssl.org > Message-ID: > <86cf5ffd468849a8dba392b1d3bc6bb3(a)mobi-com.net> > Content-Type: text/plain; charset=US-ASCII; format=flowed > > Dear Users, > > Version 4.26, 2008.09.20, urgency: MEDIUM: > * New features > - Win32 DLLs for OpenSSL 0.9.8i. > - /etc/hosts.allow and /etc/hosts.deny no longer need to > be copied to > the chrooted directory, as the libwrap processes are no > longer > chrooted. > - A more informative error messages for invalid port > number specified > in stunnel.conf file. > - Support for Microsoft Visual C++ 9.0 Express Edition. > * Bugfixes > - Killing all libwrap processes at stunnel shutdown > fixed. > - A minor bug in stunnel.init sample SysV startup file > fixed. > > Home page/download: http://stunnel.mirt.net/ > > sha1sum for stunnel-4.24.tar.gz file: > 1c9f5dd6b21f354c356cd9100899a90a83068c68 > > Best regards, > Mike > > > > ------------------------------ > > Message: 2 > Date: Sun, 21 Sep 2008 00:13:07 +0200 > From: Michal Trojnara <Michal.Trojnara(a)mobi-com.net> > Subject: Re: [stunnel-users] Compiled Stunnel 4.25 with > OpenSSL 0.9.8h > on Solaris 10 > To: 'stunnel-users(a)mirt.net' > <stunnel-users(a)mirt.net> > Message-ID: > <6cb62b05bc25b1da1f8992ceadb133d4(a)mobi-com.net> > Content-Type: text/plain; charset=US-ASCII; format=flowed > > On 2008-09-19, at 04:36, Nelgraine wrote: > > Undefined first referenced > > symbol in file > > BIO_set_flags protocol.o > > SSL_CTX_set_info_callback ctx.o > > ld: fatal: Symbol referencing errors. No output > written to stunnel > > Is it possible that your system has more than one copy of > the OpenSSL > libraries? > Maybe gcc tries to link against the old ones instead of the > new ones? > > > 1. Should I need to upgrade OpenSSL 0.9.8h into > OpenSSL 0.9.8i? > > I don't think this could cause your problem. > > > 2. I have installed openssl 0.9.8h on Solaris 10 and > created several > > ca certificates. > > - If I will upgrade OpenSSL 0.9.8h into OpenSSL > 0.9.8i, should I > > also recreate ca certificates? > > No, you don't have to recreate your certificates. > > Best regards, > Mike > > > > ------------------------------ > > Message: 3 > Date: Sat, 20 Sep 2008 23:13:50 +0200 > From: Michal Trojnara <Michal.Trojnara(a)mobi-com.net> > Subject: [stunnel-users] stunnel 4.26 released > To: 'stunnel-users(a)mirt.net' > <stunnel-users(a)mirt.net>, > stunnel-announce(a)mirt.net, openssl-users(a)openssl.org > Message-ID: > <86cf5ffd468849a8dba392b1d3bc6bb3(a)mobi-com.net> > Content-Type: text/plain; charset=US-ASCII; format=flowed > > Dear Users, > > Version 4.26, 2008.09.20, urgency: MEDIUM: > * New features > - Win32 DLLs for OpenSSL 0.9.8i. > - /etc/hosts.allow and /etc/hosts.deny no longer need to > be copied to > the chrooted directory, as the libwrap processes are no > longer > chrooted. > - A more informative error messages for invalid port > number specified > in stunnel.conf file. > - Support for Microsoft Visual C++ 9.0 Express Edition. > * Bugfixes > - Killing all libwrap processes at stunnel shutdown > fixed. > - A minor bug in stunnel.init sample SysV startup file > fixed. > > Home page/download: http://stunnel.mirt.net/ > > sha1sum for stunnel-4.24.tar.gz file: > 1c9f5dd6b21f354c356cd9100899a90a83068c68 > > Best regards, > Mike > > ______________________________________________________________________ > OpenSSL Project > http://www.openssl.org > User Support Mailing List > openssl-users(a)openssl.org > Automated List Manager > majordomo(a)openssl.org > > > ------------------------------ > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > End of stunnel-users Digest, Vol 50, Issue 15 > *********************************************

1 0

Compiled Stunnel 4.25 with OpenSSL 0.9.8h on Solaris 10
by Nelgraine 20 Sep '08

20 Sep '08

Ive read this article Compiling Stunnel 4.21 on Solaris 10 http://stunnel.mirt.net/pipermail/stunnel-users/2008-March/001895.html I've been also experiencing this kind of problem but I've Compiled Stunnel 4.25 with OpenSSL 0.9.8h on Solaris 10. Configure: # ./configure --prefix=/usr/local/stunnel-4.25 --with-ssl=/usr/local/openssl-0.9.8h configure: **************************************** success Make Error: gcc -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/local/openssl-0.9.8h/include -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o pty.o libwrap.o -lz -ldl -lsocket -lnsl -lpthread -L/usr/local/openssl-0.9.8h/lib -lssl -lcrypto -lwrap Undefined first referenced symbol in file BIO_set_flags protocol.o SSL_CTX_set_info_callback ctx.o ld: fatal: Symbol referencing errors. No output written to stunnel My Question is: 1. Should I need to upgrade OpenSSL 0.9.8h into OpenSSL 0.9.8i? 2. I have installed openssl 0.9.8h on Solaris 10 and created several ca certificates. - If I will upgrade OpenSSL 0.9.8h into OpenSSL 0.9.8i, should I also recreate ca certificates? Any help would be greatly appreciated.

2 1

stunnel 4.26 released
by Michal Trojnara 20 Sep '08

20 Sep '08

Dear Users, Version 4.26, 2008.09.20, urgency: MEDIUM: * New features - Win32 DLLs for OpenSSL 0.9.8i. - /etc/hosts.allow and /etc/hosts.deny no longer need to be copied to the chrooted directory, as the libwrap processes are no longer chrooted. - A more informative error messages for invalid port number specified in stunnel.conf file. - Support for Microsoft Visual C++ 9.0 Express Edition. * Bugfixes - Killing all libwrap processes at stunnel shutdown fixed. - A minor bug in stunnel.init sample SysV startup file fixed. Home page/download: http://stunnel.mirt.net/ sha1sum for stunnel-4.24.tar.gz file: 1c9f5dd6b21f354c356cd9100899a90a83068c68 Best regards, Mike

1 0

Re: [stunnel-users] STunnel as a Relay server
by Ludolf Holzheid 19 Sep '08

19 Sep '08

On Thu, 2008-09-18 15:02:56 -0400, Thomas O'Hare wrote: > Ludolf > > Just got this as the main mail server was down for several days. > > The Win EXE that installs the STunnel service is what I meant. Is there > a way to edit the configuration text file to skip tunneling. There is > an ancient app on some PCs that can use only port 25 and we want to use > STunnel to do both SSL & non-SSL relays so we do not have to install & > maintain 2 different packages to basically do the same thing. Thomas, Of course, you get a clear-text port redirector if you connect two instances of stunnel running on the same machine, one acting as client, the other one as server. But again, I think this is oversized and not easier to set up than a simple TCP port redirector. Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Bug in tools stunnel.init
by Kevin A. McGrail 17 Sep '08

17 Sep '08

Hi Michael, I've upgraded to stunnel 4.25 and found a few small bugs in the init script. In stunnel.init.in, I'm pretty sure the DAEMON line should be DAEMON=@prefix@/bin/stunnel and not DAEMON=@prefix@/etc/stunnel Also, when the parent process is killed with stop, I see Sep 17 14:34:16 server stunnel: warning: can't get client address: Bad file descriptor because the child processes seem to stick around. I've modified the init script to kill the main process using the pid file and then using pidof to identify and kill the remaining child processes. Is this expected behavior? regards, KAM

2 2

Non-SSL Relay
by Thomas O'Hare 17 Sep '08

17 Sep '08

Hello I know the obvious and goes against what it was made for, but... Is there a way to use STunnel as a relay server w/o SSL? IOW, if you put STunnel in a number of installations but one or more PCs need a non-SSL server, can they use it? It would beat having to install "2" relay servers on each PC. -- Thanks, ~ Thomas O'Hare ~ Web, Wireless, Network, Database & Systems Software/Hardware Operations Manager | Virtual FoxPro User Group Tom(a)VFUG.Org | http://www.VFUG.Org/

1 0

STunnel as a Relay server
by Thomas O'Hare 16 Sep '08

16 Sep '08

I know this is against what STunnel was made for but... There are Stunnel installations on client PCs but they also need to use STunnel to also send to non-SSL entities -- since it is easier then installing 2 relay/proxy servers. Is there a way to make STunnel into a non-SSL relay server? -- Thanks, ~ Thomas O'Hare ~ Web, Wireless, Network, Database & Systems Software/Hardware Operations Manager | Virtual FoxPro User Group Tom(a)VFUG.Org | http://www.VFUG.Org/

2 1

What is the difference between "all" and "SSLv3" for sslVersion?
by Christopher Hunt 14 Sep '08

14 Sep '08

Hi there, I would like to understand the difference between specifying an sslVersion of "all" vs "SSLv3" when I see that the client is attempting SSLv3. I have a Java 1.5 ssl client connecting to an stunnel endpoint. If I specify an sslVersion of "all" in my stunnel configuration then the client is able to connect. When I see it connect, it appears to have connected as SSLv3 i.e.: 2008.09.14 15:59:20 LOG7[98326:2690846624]: https accepted FD=12 from 127.0.0.1:59812 2008.09.14 15:59:20 LOG7[98326:2952859648]: https started 2008.09.14 15:59:20 LOG7[98326:2952859648]: FD 12 in non-blocking mode 2008.09.14 15:59:20 LOG7[98326:2952859648]: TCP_NODELAY option set on local socket 2008.09.14 15:59:20 LOG7[98326:2952859648]: Waiting for a libwrap process 2008.09.14 15:59:20 LOG7[98326:2952859648]: Acquired libwrap process #0 2008.09.14 15:59:20 LOG7[98326:2952859648]: Releasing libwrap process #0 2008.09.14 15:59:20 LOG7[98326:2952859648]: Released libwrap process #0 2008.09.14 15:59:20 LOG7[98326:2952859648]: https permitted by libwrap from 127.0.0.1:59812 2008.09.14 15:59:20 LOG5[98326:2952859648]: https accepted connection from 127.0.0.1:59812 2008.09.14 15:59:20 LOG7[98326:2952859648]: SSL state (accept): before/ accept initialization 2008.09.14 15:59:21 LOG7[98326:2952859648]: SSL state (accept): SSLv3 read client hello A etc. If I substitute "SSLv3" for the value of sslVersion then I get: 2008.09.14 15:56:26 LOG7[98297:2690846624]: https accepted FD=12 from 127.0.0.1:59795 2008.09.14 15:56:26 LOG7[98297:2952859648]: https started 2008.09.14 15:56:26 LOG7[98297:2952859648]: FD 12 in non-blocking mode 2008.09.14 15:56:26 LOG7[98297:2952859648]: TCP_NODELAY option set on local socket 2008.09.14 15:56:26 LOG7[98297:2952859648]: Waiting for a libwrap process 2008.09.14 15:56:26 LOG7[98297:2952859648]: Acquired libwrap process #0 2008.09.14 15:56:26 LOG7[98297:2952859648]: Releasing libwrap process #0 2008.09.14 15:56:26 LOG7[98297:2952859648]: Released libwrap process #0 2008.09.14 15:56:26 LOG7[98297:2952859648]: https permitted by libwrap from 127.0.0.1:59795 2008.09.14 15:56:26 LOG5[98297:2952859648]: https accepted connection from 127.0.0.1:59795 2008.09.14 15:56:26 LOG7[98297:2952859648]: SSL state (accept): before/ accept initialization 2008.09.14 15:56:27 LOG3[98297:2952859648]: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number I have also tried specifying "SSLv2" (client disconnected complaining that v2 was not supported) and "TLSv1" (yields the same error as "SSLv3". My version of stunnel is: stunnel 4.25 on i686-apple-darwin9.4.0 with OpenSSL 0.9.7l 28 Sep 2006 Thank you in advance for any explanation on the difference between "all" and "SSLv3". Kind regards, Christopher

1 0

Stunnel on Vista gets "readsocket: Connection reset by peer"
by Scarsdale_James＠emc.com 10 Sep '08

10 Sep '08

Hi, I'm trying to use stunnel 4.25 on Vista over the Microsoft Loopback Adapter, but I always get the following error shown next to ">>>" below. Note that the session seems to have been negotiated okay. I found some notes about using "Run as administrator", but I still get the same behavior with this. The same setup works fine on XP. Any ideas before I start looking at code? Thanks, Jim 2008.09.10 15:27:42 LOG7[2844:692]: RAND_status claims sufficient entropy for the PRNG 2008.09.10 15:27:42 LOG7[2844:692]: PRNG seeded successfully 2008.09.10 15:27:42 LOG7[2844:692]: Certificate: stunnel.pem 2008.09.10 15:27:42 LOG7[2844:692]: Certificate loaded 2008.09.10 15:27:42 LOG7[2844:692]: Key file: stunnel.pem 2008.09.10 15:27:42 LOG7[2844:692]: Private key loaded 2008.09.10 15:27:42 LOG7[2844:692]: SSL context initialized for service smb 2008.09.10 15:27:42 LOG5[2844:692]: stunnel 4.25 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2008.09.10 15:27:42 LOG5[2844:692]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2008.09.10 15:27:42 LOG5[2844:2656]: No limit detected for the number of clients 2008.09.10 15:27:42 LOG7[2844:2656]: FD 248 in non-blocking mode 2008.09.10 15:27:42 LOG7[2844:2656]: SO_REUSEADDR option set on accept socket 2008.09.10 15:27:42 LOG7[2844:2656]: smb bound to 192.168.0.253:139 2008.09.10 15:28:13 LOG7[2844:2656]: smb accepted FD=240 from 192.168.0.253:49238 2008.09.10 15:28:13 LOG7[2844:2656]: Creating a new thread 2008.09.10 15:28:13 LOG7[2844:2656]: New thread created 2008.09.10 15:28:13 LOG7[2844:2856]: smb started 2008.09.10 15:28:13 LOG7[2844:2856]: FD 240 in non-blocking mode 2008.09.10 15:28:13 LOG7[2844:2856]: TCP_NODELAY option set on local socket 2008.09.10 15:28:13 LOG5[2844:2856]: smb accepted connection from 192.168.0.253:49238 2008.09.10 15:28:13 LOG7[2844:2856]: FD 264 in non-blocking mode 2008.09.10 15:28:13 LOG7[2844:2856]: smb connecting 128.221.79.49:10005 2008.09.10 15:28:13 LOG7[2844:2856]: connect_wait: waiting 10 seconds 2008.09.10 15:28:13 LOG7[2844:2856]: connect_wait: connected 2008.09.10 15:28:13 LOG5[2844:2856]: smb connected remote server from 128.221.79.44:49239 2008.09.10 15:28:13 LOG7[2844:2856]: Remote FD=264 initialized 2008.09.10 15:28:13 LOG7[2844:2856]: TCP_NODELAY option set on remote socket 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): before/connect initialization 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 write client hello A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 read server hello A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 read server certificate A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 read server done A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 write client key exchange A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 write change cipher spec A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 write finished A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 flush data 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 read finished A 2008.09.10 15:28:13 LOG7[2844:2856]: 1 items in the session cache 2008.09.10 15:28:13 LOG7[2844:2856]: 1 client connects (SSL_connect()) 2008.09.10 15:28:13 LOG7[2844:2856]: 1 client connects that finished 2008.09.10 15:28:13 LOG7[2844:2856]: 0 client renegotiations requested 2008.09.10 15:28:13 LOG7[2844:2856]: 0 server connects (SSL_accept()) 2008.09.10 15:28:13 LOG7[2844:2856]: 0 server connects that finished 2008.09.10 15:28:13 LOG7[2844:2856]: 0 server renegotiations requested 2008.09.10 15:28:13 LOG7[2844:2856]: 0 session cache hits 2008.09.10 15:28:13 LOG7[2844:2856]: 0 session cache misses 2008.09.10 15:28:13 LOG7[2844:2856]: 0 session cache timeouts 2008.09.10 15:28:13 LOG6[2844:2856]: SSL connected: new session negotiated 2008.09.10 15:28:13 LOG6[2844:2856]: SSL connected: new session negotiated 2008.09.10 15:28:13 LOG6[2844:2856]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 >>> 2008.09.10 15:28:44 LOG3[2844:2856]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2008.09.10 15:28:44 LOG5[2844:2856]: Connection reset: 153 bytes sent to SSL, 0 bytes sent to socket 2008.09.10 15:28:44 LOG7[2844:2856]: smb finished (0 left) Relevant info stunnel.conf on client: [smb] accept = 192.168.0.253:139 connect = [server ipaddress]:10005 Relevant info stunnel.conf on server: [smb] accept = 10005 connect = 139 ;connect = 445

1 0

Stunnel on Vista gets "readsocket: Connection reset by peer"
by Scarsdale_James＠emc.com 10 Sep '08

10 Sep '08

Hi, I'm trying to use stunnel 4.25 on Vista over the Microsoft Loopback Adapter, but I always get the following error shown next to ">>>" below. Note that the SSL session appears to have been negotiated okay. I found some notes about using "Run as adminstrator" on Vista, but I still get the same behavior with this. The same setup works fine on XP. Any ideas before I start looking at code? Thanks, Jim 2008.09.10 15:27:42 LOG7[2844:692]: RAND_status claims sufficient entropy for the PRNG 2008.09.10 15:27:42 LOG7[2844:692]: PRNG seeded successfully 2008.09.10 15:27:42 LOG7[2844:692]: Certificate: stunnel.pem 2008.09.10 15:27:42 LOG7[2844:692]: Certificate loaded 2008.09.10 15:27:42 LOG7[2844:692]: Key file: stunnel.pem 2008.09.10 15:27:42 LOG7[2844:692]: Private key loaded 2008.09.10 15:27:42 LOG7[2844:692]: SSL context initialized for service smb 2008.09.10 15:27:42 LOG5[2844:692]: stunnel 4.25 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2008.09.10 15:27:42 LOG5[2844:692]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2008.09.10 15:27:42 LOG5[2844:2656]: No limit detected for the number of clients 2008.09.10 15:27:42 LOG7[2844:2656]: FD 248 in non-blocking mode 2008.09.10 15:27:42 LOG7[2844:2656]: SO_REUSEADDR option set on accept socket 2008.09.10 15:27:42 LOG7[2844:2656]: smb bound to 192.168.0.253:139 2008.09.10 15:28:13 LOG7[2844:2656]: smb accepted FD=240 from 192.168.0.253:49238 2008.09.10 15:28:13 LOG7[2844:2656]: Creating a new thread 2008.09.10 15:28:13 LOG7[2844:2656]: New thread created 2008.09.10 15:28:13 LOG7[2844:2856]: smb started 2008.09.10 15:28:13 LOG7[2844:2856]: FD 240 in non-blocking mode 2008.09.10 15:28:13 LOG7[2844:2856]: TCP_NODELAY option set on local socket 2008.09.10 15:28:13 LOG5[2844:2856]: smb accepted connection from 192.168.0.253:49238 2008.09.10 15:28:13 LOG7[2844:2856]: FD 264 in non-blocking mode 2008.09.10 15:28:13 LOG7[2844:2856]: smb connecting [server ip]:10005 2008.09.10 15:28:13 LOG7[2844:2856]: connect_wait: waiting 10 seconds 2008.09.10 15:28:13 LOG7[2844:2856]: connect_wait: connected 2008.09.10 15:28:13 LOG5[2844:2856]: smb connected remote server from 128.221.79.44:49239 2008.09.10 15:28:13 LOG7[2844:2856]: Remote FD=264 initialized 2008.09.10 15:28:13 LOG7[2844:2856]: TCP_NODELAY option set on remote socket 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): before/connect initialization 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 write client hello A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 read server hello A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 read server certificate A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 read server done A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 write client key exchange A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 write change cipher spec A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 write finished A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 flush data 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 read finished A 2008.09.10 15:28:13 LOG7[2844:2856]: 1 items in the session cache 2008.09.10 15:28:13 LOG7[2844:2856]: 1 client connects (SSL_connect()) 2008.09.10 15:28:13 LOG7[2844:2856]: 1 client connects that finished 2008.09.10 15:28:13 LOG7[2844:2856]: 0 client renegotiations requested 2008.09.10 15:28:13 LOG7[2844:2856]: 0 server connects (SSL_accept()) 2008.09.10 15:28:13 LOG7[2844:2856]: 0 server connects that finished 2008.09.10 15:28:13 LOG7[2844:2856]: 0 server renegotiations requested 2008.09.10 15:28:13 LOG7[2844:2856]: 0 session cache hits 2008.09.10 15:28:13 LOG7[2844:2856]: 0 session cache misses 2008.09.10 15:28:13 LOG7[2844:2856]: 0 session cache timeouts 2008.09.10 15:28:13 LOG6[2844:2856]: SSL connected: new session negotiated 2008.09.10 15:28:13 LOG6[2844:2856]: SSL connected: new session negotiated 2008.09.10 15:28:13 LOG6[2844:2856]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 >>> 2008.09.10 15:28:44 LOG3[2844:2856]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2008.09.10 15:28:44 LOG5[2844:2856]: Connection reset: 153 bytes sent to SSL, 0 bytes sent to socket 2008.09.10 15:28:44 LOG7[2844:2856]: smb finished (0 left) Relevant info stunnel.conf on client: [smb] accept = 192.168.0.253:139 connect = [server ip]:10005 Relevant info stunnel.conf on server: [smb] accept = 10005 connect = 139 ;connect = 445

1 0

Building STunnel 4.25 with OpenSSL 0.9.8h on Windows
by Paul Coleman 10 Sep '08

10 Sep '08

Hi everyone, I've recently been trying to compile STunnel for Windows, but have found so many conflicting reports of the best way to do it on the website / other sites, that I'm now well and truly confused! I've got MSVS 2005, but have also tried with mingw, and cygwin - and also on Linux using mingw32. I'm unsure as to whether I need some Makefile.w32, whether I need to compile OpenSSL from source, where I need to put OpenSSL libraries when they're done, if I need to run Configure, etc etc. I'm not looking for a complete step by step guide including 'cd to x, type this' (although I wouldn't complain! :P), but a general poke in the right direction would be great. Thanks for your help, --Paul

1 0

Re: [stunnel-users] Help using stunnel for the first time
by Jilin Zhang 09 Sep '08

09 Sep '08

try: http://localhost:1515 > Hi, > > I'm trying to use stunnel for the first time (on Mac OS X 10.5), and > I'm not having much luck. > > First of all, I downloaded the source and installed stunnel > successfully. I then setup a config file as follows (where myhost is > the host i am connecting to): > > client=yes > verify=0 > [psuedo-https] > accept=1515 > connect=myhost:443 > TIMEOUTclose = 0 > > Then, I run the following on the command line: > /usr/local/bin/stunnel ./stunnel.config > > It appears that stunnel runs without error, and if I do 'ps aux | grep > stunnel' there are 4 stunnel processes running. > > Then, as a test, I try to connect to port 1515 from my web browser by > visiting https://localhost:1515, but it just hangs there... nothing. > > Any suggestions? > > Thanks! > > Ian > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > >

2 1

Help using stunnel for the first time
by Ian Baxter 09 Sep '08

09 Sep '08

Hi, I'm trying to use stunnel for the first time (on Mac OS X 10.5), and I'm not having much luck. First of all, I downloaded the source and installed stunnel successfully. I then setup a config file as follows (where myhost is the host i am connecting to): client=yes verify=0 [psuedo-https] accept=1515 connect=myhost:443 TIMEOUTclose = 0 Then, I run the following on the command line: /usr/local/bin/stunnel ./stunnel.config It appears that stunnel runs without error, and if I do 'ps aux | grep stunnel' there are 4 stunnel processes running. Then, as a test, I try to connect to port 1515 from my web browser by visiting https://localhost:1515, but it just hangs there... nothing. Any suggestions? Thanks! Ian

1 0

Re: [stunnel-users] A Calypso user needs your help with stunnel
by John Bryant 09 Sep '08

09 Sep '08

Dear Ludolf et al: Thank you very much for your recent communication. I drew up what I thought I needed, based on your answer, in the configuration file. As might be expected in that I'm a novice at this, I still have a few more questions: 1. I tried it with and without the "Authentification stuff". Either way, after modifying stunnel.conf, and running stunnel.exe, stunnel.exe bombed with the following error: "Stunnel server down" (log said: ************** 2008.09.02 14:20:17 LOG7[16442455:16274811]: RAND_status claims sufficient entropy for the PRNG 2008.09.02 14:20:17 LOG7[16442455:16274811]: PRNG seeded successfully 2008.09.02 14:20:17 LOG3[16442455:16274811]: Error loading verify certificates from certs.pem 2008.09.02 14:20:17 LOG3[16442455:16274811]: error stack: B084002 : error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib 2008.09.02 14:20:17 LOG3[16442455:16274811]: error stack: 2006D080 : error:2006D080:BIO routines:BIO_new_file:no such file 2008.09.02 14:20:17 LOG3[16442455:16274811]: SSL_CTX_load_verify_locations: 2001002: error:02001002:system library:fopen:No such file or directory 2008.09.02 14:20:17 LOG3[16442455:16274811]: Server is down What caused this? ************** 2. My other question is: Do I need to put stunnel.exe in the startup folder? Does it automatically reference stunnel.conf (that is what I was assuming)? When I get it to run correctly, automatically referencing stunnel, conf, then can I run Calypso with the settings changed to tie in with the stunnel conf file? All of the above I was assuming was true, but I'm just asking to make sure. Thanks! Lenny

3 6

Respawn stunnel
by Joe Kemp 08 Sep '08

08 Sep '08

What is the best way to setup stunnel to respawn if it crashes? I have looked at inittab (probably would have to have stunnel run in foreground?) or the procautostart.cpp utility. Any other ideas? Is there an easier way. Joe A. Kemp CapWIN Senior Systems Architect (O) 301-614-3727 (C) 301-502-1281

2 1

Re: [stunnel-users] Scripting stunnel to load automatically when OS X 10.5 server starts up -plist
by Christopher Hunt 04 Sep '08

04 Sep '08

On 04/09/2008, at 8:00 PM, stunnel-users-request(a)mirt.net wrote: > Here is my plist. I put this in /Library/LaunchDaemons. What do you > think? --Thanks, Allen Firstly have you considered using Lingon to maintain your plist? That could help you. > <?xml version="1.0" encoding="UTF-8"?> > <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd > "> > <plist version="1.0"> > <dict> > <key>KeepAlive</key> > <true/> > <key>Label</key> > <string>stunnel_startup</string> > <key>ProgramArguments</key> > <array> > <string>/opt/local/bin/stunnel</string> > </array> > <key>RunAtLoad</key> > <true/> > </dict> > </plist> The most obvious thing that stands out is that you aren't supplying a config file argument to stunnel. How's it going to locate your config file? You might want to check your system.log file using the Console application and watch for messages. You also need to use launchctl to load your plist - Lingon makes this pretty straightforward. Cheers, -C

1 0

Scripting stunnel to load automatically when OS X 10.5 server starts up -plist
by Allen 03 Sep '08

03 Sep '08

Thank you Chris and Tom, for your responses, Here is my plist. I put this in /Library/LaunchDaemons. What do you think? --Thanks, Allen <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd "> <plist version="1.0"> <dict> <key>KeepAlive</key> <true/> <key>Label</key> <string>stunnel_startup</string> <key>ProgramArguments</key> <array> <string>/opt/local/bin/stunnel</string> </array> <key>RunAtLoad</key> <true/> </dict> </plist>

1 1

Re: [stunnel-users] Scripting stunnel to load automatically when OS X 10.5 server starts up -any solution?
by Christopher Hunt 03 Sep '08

03 Sep '08

On 03/09/2008, at 8:00 PM, stunnel-users-request(a)mirt.net wrote: > Does anybody have a solution that will start up stunnel on OS X > bootup? ... Sounds to me like a launchd config error. How about sending through the plist? Cheers, -C

2 1

Starting stunnel automatically on OS X system startup
by Allen 02 Sep '08

02 Sep '08

Does anybody have a solution that will start up stunnel on OS X bootup? I've installed stunnel on a Leopard server (OS 10.4.5.4) to make a smtp SSL relay work (and it works fine). The problem is, we'd have to type in /opt/local/bin/stunnel on the command line every time the server is rebooted. Rather than having to create a /Library/ SystemStartup/diretory_structure_with_plist_etc., has somebody done this, and can lead me in the right direction, in the interest of time? I've just run out of time, and I kinda think that somebody must have done this already. Thanks! Allen

1 1

A Calypso user needs your help with stunnel
by John Bryant 02 Sep '08

02 Sep '08

Dear folks: I am trying to install stunnel so that I can have an SSL capability with Calypso. I was guided to the stunnel.org site by instructions at: http://www.windowsbbs.com/courier-email-client/35188-ssl-connection-really-…. (the instructions that I am referring to are duplicated below, under the first line of asterisks - they mention later versions of stunnel, but do not update their instructions for them adequately) I could not understand the instructions at your site that told about modifying the conf file with the LATEST version of stunnel.exe, which I did download and install and that's as far as I got - couldn't understand the options as clearly as I had the others, so uninstalled it.) (Tried downloading the OLD version, 4.05 exe, mentioned in the instructions and the two dll files,and making all the changes to THAT conf.txt file, etc, but THAT did not work because when I ran the shortcut to the conf.txt file that I had put in the Start folder, the computer gave me, when connected, a "cannot find 1 1/4 dll" message, and then an "illegal op" and a "cannot run due to restrictions on your computer" message (when not connected, just the latter two). I know you don't want to hear about old versions but it was logical for me to try since I could not figure out how to use the latest version.) So what do I do now? Thanks! Lenora (do not give up on me, I have computers in my background, etc. etc) ************** (Excerpts from the thread at the url listed above) http://www.windowsbbs.com/courier-email-client/35188-ssl-connection-really-… A week ago I provided instructions for using stunnel to provide SSL functionality for Calypso/Courier - in case your email provider requires SSL, which Calypso and Courier do not yet support. Those instructions were correct if your email provider uses the dedicated SSL ports - 465 for smtps, 995 for pop3s, 993 for imap4s. They were incomplete if your email provider uses the standard ports - 25 for smtp, 110 for pop3, [N/A - 143 for imap4]. Normally when the SSL ports are being used the entire conversation is encrypted with SSL. stunnel will initiate the session with the standard SSL protocol. However, if the standard ports are being used the session is initiated without SSL and then switches to SSL using an smtp or pop3 specific protocol (STARTTLS or STLS). stunnel needs to be told this, or it wont work on the standard ports. For the standard ports an extra line is required in the configuration file. To use stunnel do the following: 1) download the following files from http://www.stunnel.org/download/binaries.html stunnel-4.05.exe (version may be higher when you go there) libssl32.dll libeay32.dll and put them into a directory such as C:\Program Files\Stunnel\ 2) create a shortcut to stunnel-4.05.exe in the same directory [in WinXP do this by right clicking on it and selecting Create Shortcut] 3) edit the shortcut by right clicking on it and selecting Properties Modify the Target to look like this "C:\Program Files\Stunnel\stunnel-4.05.exe" stunnel-conf.txt (Optional) Rename the shortcut to remove the "Shortcut to ". 4) create the file stunnel-conf.txt in the same directory, and put the following lines in it: ----starting with next line---- # GLOBAL OPTIONS client = yes output = stunnel-log.txt debug=4 taskbar = yes # SERVICE-LEVEL OPTIONS [POP3 (ISP name)] accept = 127.0.0.1:108 connect = myISPs.POP3server.net:995 [SMTP (ISP name)] accept = 127.0.0.1:107 connect = myISPs.SMTPserver.net:465 ----ending with previous line---- Change the server names (before colons), and perhaps ports (after colons), to be correct for your ISP. Change ISP name too. Save and exit. 4b) if your email provider uses standard ports for either smtp or pop3, make either or both of the following changes to your stunnel-conf.txt file: [POP3 (ISP name)] accept = 127.0.0.1:108 connect = myISPs.POP3server.net:110 protocol = pop3 [SMTP (ISP name)] accept = 127.0.0.1:107 connect = myISPs.SMTPserver.net:25 protocol = smtp Once again, change the server names (before colons) to be correct for your ISP. Change ISP name too. Save and exit. 4c) if you have two email providers requiring SSL you can add a second set of services like so: [POP3 (2nd ISP name)] accept = 127.0.0.1:106 connect = my2ndISPs.POP3server.net:995 [SMTP (2nd ISP name)] accept = 127.0.0.1:105 connect = my2ndISPs.SMTPserver.net:465 Each email provider requires its own two ports (e.g. 108+107, 106+105), but 2 email accounts at a single provider can share the same pair of ports. However, if an email provider only uses SSL for one of smtp or pop3, you only need one of the two service sections. Once again, change the server names (before colons) to be correct for your ISP. Change ISP name too. Save and exit. 5) put a copy of that shortcut into your Start Menu's Programs/Startup folder [normally, by dragging shortcut over Start button, over Programs, over Startup, then drop it in Startup list.] 6) edit your Calypso/Courier Account Properties to change your mail servers. Incoming: Port 108 Server 127.0.0.1 Outgoing: Port 107 Server 127.0.0.1 [this is done differently for Calypso and Courier, due to Courier's new approach to SMTP servers] If an email provider only uses SSL for one of smtp or pop3, you only need to change one of the two mail servers. If you set up more than one email provider for SSL, change each account's properties to the corresponding ports. Now when you check or send email Calypso/Courier will communicate with stunnel, which will connect to your ISP's mail servers via SSL. The shortcut in Startup will rerun stunnel each time you reboot. You should just double-click on the shortcut in the program folder to run stunnel the first time. Hope this helps. Greg ************* Later addition (later on same thread): I just reinstalled all of my computer and I forgot to backup my sTunnel config! Anyway, the instructions have changed a bit as of sTunnel version 4.12... sTunnel is now distributed as an installer EXE, and the auxiliary DLLs are installed by default. The only step that really changes is step 1. All you have to do is to download the sTunnel installer and run it. There is no need to download the other files. The rest stays pretty much the same. ********** Question from somebody: First of all, I want to thank you for posting this very useful 'how to' -- this is what foruming is all about I have two questions (for anyone): 1. When using Stunnel, does it completely encrypt the user name, password, and the contents of the email, or just the contents? 2. The Stunnel website (www.stunnel.org) mentions that you'd also need the OpenSSL Libraries to make it work. But I did not download them, and still managed to make the Stunnel work with Courier. Am I (still) missing something? ************ Answer: 1. stunnel establishes an ssl tunnel (hence the name) between your computer and the email server. So every byte travelling between the two is encrypted. It's like establishing a VPN between your computer and the server. 2. As gmagana posted at the start of the month, they seem to have enhanced the installation process - such that you don't need to worry about the extra files. Isn't open source great! ********* Final comment: Looks like I can finally use Courier with Google's Gmail (http://gmail.google.com) to send/receive encrypted email. (End of excerpts)

2 1

Re: [stunnel-users] failed to build stunnel 4.25 under VS 2005
by Michal Trojnara 29 Aug '08

29 Aug '08

On Fri, 29 Aug 2008 00:00:56 +0800, "Ericdai" <pcix133(a)hotmail.com> wrote: > I try to build Stunnel 4.25 under VS2005 ,but failed Today I updated stunnel, so it can be built with Visual C++ 2008 (known also as Visual C++ 9.0). My plan is to release stunnel 4.26 next week. > prototypes.h(428) : error C2081: 'socklen_t' : name in formal > parameter list illegal I had no problem with socklen_t. Maybe it's specific to the old version of Visual C++. > I also suggest build a windows client only version > n It only can be running on windows > n It only can act as a client > n I think it can reduce the code size and runtime footprice smaller Not really. The difference would be negligible. Best regards, Mike

1 0

failed to build stunnel 4.25 under VS 2005
by Ericdai 28 Aug '08

28 Aug '08

I try to build Stunnel 4.25 under VS2005 ,but failed cl -MD -W3 -Ox -O2 -Ob2 -Gs0 -GF -Gy -GL -nologo -I"..\..\ssl\inc32" -DUSE_WIN32 -D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE -DHAVE_GETADDRINFO -DHAVE_GETNAMEINFO -D_MBCS /c stunnel.c stunnel.c prototypes.h(428) : error C2081: 'socklen_t' : name in formal parameter list illegal stunnel.c(206) : error C2065: 'socklen_t' : undeclared identifier stunnel.c(206) : error C2146: syntax error : missing ';' before identifier 'addrlen' stunnel.c(206) : error C2065: 'addrlen' : undeclared identifier I use nmake -f vc.mak to do it Anyone has build it successfully ,pls help me ! Another way ,is there a stunnel solution or project file ? I also suggest build a windows client only version n It only can be running on windows n It only can act as a client n I think it can reduce the code size and runtime footprice smaller Thanks and best regards Eric dai

1 0

Re: [stunnel-users] In chrooted environment system times defaults to UTC
by Ivan Lezhnjov Jr. 22 Aug '08

22 Aug '08

Friday 22 August 2008 you wrote: > I noticed that when running stunnel from within the jail it logs its > messages with syslong using UTC. > > My question is how would one reconcile timezone of chrooted stunnel with a > system one? > > The issue illustrated: > > Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: stunnel 4.17 on > i686-pc-linux-gnu with OpenSSL 0.9.8h 28 May 2008 > Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: Threading:PTHREAD > SSL:ENGINE Sockets:POLL,IPv4 > Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: 500 clients > allowed Aug 22 12:29:40 xerxes stunnel: LOG5[26570:3086773168]: 5101 > connected from 127.0.0.1:1469 > Aug 22 09:29:40 xerxes stunnel: LOG5[26570:3086773168]: VERIFY OK: > depth=0, /C=UA/ST=ARC/L=Simferopol/O=HOMELAB/CN=sega.localnet > > xerxes' localtime is GMT+3 and sega's too, but stunnel runs on sega in > chrooted environment and thus uses UTC (if it's not chrooted it reports > localtime to syslog facility). > > Any ideas? Jee that was simple! cp /etc/localtime /var/lib/stunnel/etc/ (on each machine where stunnel runs) and you're done :^) -- Ivan Lezhnjov Jr. Europe, Ukraine, Simferopol Running Source Mage GNU/Linux, kernel version 2.6.24 build #5 +----------------------------------------------------------------------+ Key ID 0x5811D90C Key Fingerprint 2A52 5C8C 38BE C04F D8DE A169 19E2 E49A 5811 D90C Use GPG Exercise Your Right To Privacy

1 0

In chrooted environment system times defaults to UTC
by Ivan Lezhnjov Jr. 22 Aug '08

22 Aug '08

I noticed that when running stunnel from within the jail it logs its messages with syslong using UTC. My question is how would one reconcile timezone of chrooted stunnel with a system one? The issue illustrated: Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: stunnel 4.17 on i686-pc-linux-gnu with OpenSSL 0.9.8h 28 May 2008 Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: 500 clients allowed Aug 22 12:29:40 xerxes stunnel: LOG5[26570:3086773168]: 5101 connected from 127.0.0.1:1469 Aug 22 09:29:40 xerxes stunnel: LOG5[26570:3086773168]: VERIFY OK: depth=0, /C=UA/ST=ARC/L=Simferopol/O=HOMELAB/CN=sega.localnet xerxes' localtime is GMT+3 and sega's too, but stunnel runs on sega in chrooted environment and thus uses UTC (if it's not chrooted it reports localtime to syslog facility). Any ideas? -- Ivan Lezhnjov Jr. Europe, Ukraine, Simferopol Running Source Mage GNU/Linux, kernel version 2.6.24 build #5 +----------------------------------------------------------------------+ Key ID 0x5811D90C Key Fingerprint 2A52 5C8C 38BE C04F D8DE A169 19E2 E49A 5811 D90C Use GPG Exercise Your Right To Privacy

1 0

Certificates, Servers & Clients. Clarify this please.
by Ivan Lezhnjov Jr. 22 Aug '08

22 Aug '08

Now that I've read a bunch of articles and have seen a pile of examples of how pairs of a certificate and a private key can be created I must say they all suggest different approaches and techniques to creating certificates and ultimately bewildered me. Could anyone please explain as simply as possible, in layman's terms what exactly must be done? Let's talk about simple scenario with two hosts (A & B) involved, both running stunnel. Let us assume host A is the server and host B is the client. cert = CAfile = must be created. And we use verify level 3 (verify = 3) So, what exactly do we do now? And what happens in the dialog between these two machines? -- Ivan Lezhnjov Jr. Europe, Ukraine, Simferopol Running Source Mage GNU/Linux, kernel version 2.6.24 build #5 +----------------------------------------------------------------------+ Key ID 0x5811D90C Key Fingerprint 2A52 5C8C 38BE C04F D8DE A169 19E2 E49A 5811 D90C Use GPG Exercise Your Right To Privacy

1 0

Can't start stunnel (dies mysteriously)
by Ivan Lezhnjov Jr. 19 Aug '08

19 Aug '08

Hello there I run stunnel version 4.21 and openssl version 0.9.8h. In my setup I aim to create a tunnel to send log files through to a centralized loghost. Host A (loghost) runs Source Mage GNU/Linux (with stunnel 4.21, openssl 0.9.8h) and host B runs Slackware 11 system (with stunnel 4.17, openssl 0.9.8h). The problem is that stunnel starts on host B but won't start on host A. Here's the snippet of /var/log/messages that records stunnel start-up event: root@sega:/home/users/ilj % stunnel && tail /var/log/messages -n 3 Aug 19 16:17:37 sega stunnel: LOG5[29146:3082634944]: stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.8h 28 May 2008 Aug 19 16:17:37 sega stunnel: LOG5[29146:3082634944]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Aug 19 16:17:37 sega stunnel: LOG5[29146:3082634944]: 500 clients allowed I've actually been trying to run stunnel for the first time ever so I don't really know if this output confirms that everything is alright but judging solely from what is put in log file it seems stunnel has started successfully. Unfortunately, this isn't quite true root@sega:/home/users/ilj % ps ax | grep stun 29618 pts/4 R+ 0:00 grep stun So, this is the problem I have. It doesn't start on host A. Host A has the following stunnel configuration: root@sega:/home/users/ilj % cat /etc/stunnel/stunnel.conf cert = /etc/stunnel/syslog-ng-server.pem CAfile = /etc/stunnel/syslog-ng-client.pem verify = 3 [5101] accept = 217.117.75.2:5101 connect = 127.0.0.1:1999 Host B sports a little bit different configuration file: root@xerxes:~ % cat /etc/stunnel/stunnel.conf client = yes cert = /etc/stunnel/syslog-ng-client.pem CAfile = /etc/stunnel/syslog-ng-server.pem verify = 3 [5101] accept = 127.0.0.1:1999 connect = 217.117.75.2:5101 On both hosts (A & B) I run stunnel standalone as root. > 4. Output of "stunnel -f -D 7 <your-parameters>". Erm.. it doesn't seem to work for me. There's no -D parameter according to man stunnel. The following information below is about host A only: root@sega:/home/users/ilj % stunnel -version stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.8h 28 May 2008 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /usr/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none root@sega:/home/users/ilj % uname -a Linux sega 2.6.24 #5 SMP PREEMPT Wed May 7 18:22:29 EEST 2008 i686 GNU/Linux root@sega:/home/users/ilj % gaze from /usr/lib/libc.a glibc-2.7:/usr/lib/libc.a root@sega:/home/users/ilj % gcc -v Reading specs from /usr/lib/gcc/i686-pc-linux-gnu/4.2.3/specs Target: i686-pc-linux-gnu Configured with: /usr/src/gcc-4.2.3/configure --host=i686-pc-linux-gnu --prefix=/usr --infodir=/usr/share/info --mandir=/usr/share/man --enable-threads=posix --with-system-zlib Thread model: posix gcc version 4.2.3 root@sega:/home/users/ilj % gaze installed | grep openssl openssl:20080615:installed:0.9.8h -- Ivan Lezhnjov Jr. Europe, Ukraine, Simferopol Running Source Mage GNU/Linux, kernel version 2.6.24 build #5 +----------------------------------------------------------------------+ Key ID 0x5811D90C Key Fingerprint 2A52 5C8C 38BE C04F D8DE A169 19E2 E49A 5811 D90C Use GPG Exercise Your Right To Privacy

1 0

Disable libwrap at runtime?
by Jans, Kert 16 Aug '08

16 Aug '08

Hi, Is it possible to disable libwrap support at runtime? I've reviewed the archives and documentation and cannot determine if this is possible. I know it is possible to compile-out support for libwrap by using: configure --disable-libwrap Is compiling-out support the only way? I'd like to disable support in a pre-build version of stunnel. Regards, Kert

2 1

Re: [stunnel-users] Mutual SSL Authentication
by Christopher Hunt 15 Aug '08

15 Aug '08

Ah ha - "verify = 3" - thanks! On 15/08/2008, at 9:12 AM, Brian Hatch wrote: >> > Mutual authentication uses the verify option on both > ends, rather than just on one end. Both sides verify, > and both sides present a certificate.

2 1

Re: [stunnel-users] Mutual SSL Authentication
by Christopher Hunt 14 Aug '08

14 Aug '08

On 14/08/2008, at 8:00 PM, Michal.Trojnara(a)mobi-com.net wrote: > Sure. Stunnel supports mutual SSL authentication. > Please read the fine manual for details. Hi Mike, Thanks for the reply. I did quite a lot of trawling on the web, your website and the stunnel man pages and couldn't find any guidance on mutual ssl authentication configuration. Are you able to give me a pointer, perhaps a URL to something that contains an example? Thanks again. Cheers, -C

1 0

Stunnel connection drops after four http requests
by Renner, Christopher R 13 Aug '08

13 Aug '08

With quite a bit of help from a list member here, I have stunnel 4.25 running on OSX 1.5.4 (PHP development environment). Problem is I can only get four http requests to the server before the connection is dropped. Stunnel is still running in the background.

1 0

Mutual SSL Authentication
by Christopher Hunt 13 Aug '08

13 Aug '08

Hi there, Does stunnel have any in-built support for mutual SSL authentication? If not are there plans to incorporate support? Cheers, -C

2 1

question
by Ted Ehrlich 12 Aug '08

12 Aug '08

1 0

OSX 10.5 install?
by Renner, Christopher R 11 Aug '08

11 Aug '08

> >> Hi, >> >> New list member here. I¹m going through the archives now, and have Googled >> my way to exhaustion, looking for up-to-date instructions to install stunnel >> on a Mac desktop. >> >> I do PHP web application development and need to be able to connect to a NAS >> space via stunnel on my desktop dev environment in order to simulate the live >> environment. >> >> Does anyone 1) have a link to current OSX install instructions, or 2) care to >> share such instructions with me off the top of your head? >> >> I tried working through this darwinports page ( >> http://stunnel.darwinports.com/) but 1) it sends me to Macports.org for the >> .dmg file thereby installing macports and not darwinports....and after that >> the ³port² command is unrecognized in terminal when trying to install >> stunnel. >> >> >> Thanks. >>

2 1

Socket connection status
by Jeffrey Buck 08 Aug '08

08 Aug '08

Hi, I'm running stunnel 4.04 on ia64-redhat-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003. I have basically taken a generic TCP interface and implemented a STUNNEL client/server setup to allow the connection to transfer data using SSL. I have an issue with checking the status of the connection when a connection attempt is made. We are using ObjectSpace libraries for all of our tcp related connections so I don't have the low level calls that are actually being made, but here is a brief description of what is happenning.... We create an os_tcp_socket object and call the connect_to() method. This establishes a connection to the stunnel client on my local machine....which in turn makes the connection the the stunnel server on the remote machine. The problem I'm am having is when I can't get to the remote machine. After the connect_to() call, we check the status of the socket and unless I sleep for 5-10 seconds, it always seems to think that the connection is ok...which kind-of makes sense because it is able to connect to the stunnel client port since it is local...but in fact, if there isn't access to the remote machine, eventually stunnel will close that initial connection to that socket (that where the 5-10 second delay seems to help). The status I really want is weather or not the entire connection was successful through stunnel to the remote machine. Is there a better way to do this other than putting a sleep() in. Right now I have a 10 second sleep in between the connect_to() call and the status check on the local/client stunnel TCP port. That seems to be enough time for stunnel to attept to complete the connection and kill the connection to it's local/client port so that when I check the status of it, it comes back bad. If this is the best way to do it...what is the amount of time needed for stunnel to attempt to complete it's connection to the remote machine? Thanks! Jeff

2 3

Yahoo SSL
by Bernie Murciano 29 Jul '08

29 Jul '08

1 0

Re: [stunnel-users] help with stunnell
by Ludolf Holzheid 28 Jul '08

28 Jul '08

On Thu, 2008-07-24 23:37:22 -0700, vinodsreehari(a)yahoo.com wrote: > [..] > > I configured stnnel in one server as server mode ,for accepting > connection on 8070 ,and connect to 80 . It works only if i specify > https://ipaddress:8070 This is because the default port for https is 443. If you'd configure stunnel to accept on port 443, `https://ipaddress' would work. > I have configured one client server also to accept connection on 80 > and redirect to teh 8070 of server. I want to know that is that teh > way its working . If there is a stunnel instance on the client machine accepting connections on port 80 and connecting to the web server at the https port (default or not), a user could specify `http://localhost' to connect to the web server (and the traffic between the client machine and the server would be secured). > And is it possible to implement the same in a live enviroment ,in > which teh webserver will run on different port ,but users dont need > to specify the port number . Yes. As soon as the destination port for the 'first hop' of a redirected/tunneled connection is the default port for the protocol in question, there is no need to specify the port number. The port numbers of 'intermediate hops' are configuration options for the two stunnel instances (in this case), so the user dosn't have to care about them. HTH, Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Re: [stunnel-users] Wrong documentation
by Sandeep Kumar 25 Jul '08

25 Jul '08

On Thu, Jul 24, 2008 at 9:39 PM, Brian Hatch <bri(a)stunnel.org> wrote: > In the neigborhood of 2008-07-24 09:40 +0530, Sandeep Kumar mentioned: > > > Look at this page > http://www.stunnel.org/faq/stunnel.html#configuration_file > > In service level options section, under the explanation of "CRLpath" it > is > > said that all files in it should be of the form XXXXXXXX.0. But my > stunnnel > > setup worked only when i names as XXXXXXXX.r0 instead of XXXXXXXX.0. > > What version of openssl are you running? stunnel 4.15 with OpenSSL 0.9.8b > > > > -- > Brian Hatch "Have you asked Kirk if > Systems and he'd like the job?" > Security Engineer "You can't hide from me! > http://www.ifokr.org/bri/ I will find you. > > Every message PGP signed > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.2.1 (GNU/Linux) > > iD8DBQFIiKlFVkMj8/ymYEsRAmKxAJ9CTLp0Xi8n1VxdFup/kBUuZe6scwCfcvyu > WQG8BlfrUV8RcP31/ZUEbJk= > =EBgc > -----END PGP SIGNATURE----- > > -- Sandeep Kumar http://students.iiit.ac.in/~sandeep_kr

1 0

Help on configuring Stunnel
by Patel Dippen-CDP054 24 Jul '08

24 Jul '08

I downloaded the pre-compiled Windows version of Stunnel (stunnel-4.25-installer.exe). We need to deploy this on 2 machines A and B. The way it works is: - B connects to A - then A connects to B How should I configure Stunnel on machine A, since, in the first case A is the Server and in the 2nd scenario A becomes the Client. Questions on deploying Stunnel on machine A: - Can I run just 1 instance of Stunnel on machine A? It seems I cannot since I have to set the "client = yes" in the 2nd scenario - Do I need to run multiple instances, 1 running as the Server and the 2nd as the Client? Here is the config file I used on the machine A: **************************** cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [iPerfS] accept = 5010 connect = 127.0.0.1:5001 [iPerfS] accept = 5002 connect = 12.50.0.25:5020 **************************** Here is the config file I used on the machine B: **************************** cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [iPerfC] accept = 5001 connect = 12.50.0.26:5010 [iPerfS] accept = 5020 connect = 127.0.0.1:5002 **************************** Regards, Dippen

1 0

Stunnel 4.24 patch to allow stunnel to search for the OCSP responder within an X.509 certificate's AIA extension.
by Bruce Keats 24 Jul '08

24 Jul '08

Hi all, This patch also fixes a problem with stunnel accepting an "unknown" response as "good" and allows the connection to be setup. An OCSP responder can return one of three responses (good, revoked, unknown), however the code would accept "unknown" as good. This patch fixes that problem and treats an "unknown" response as a failure. Stunnel can query an OCSP responder to determine the revocation status of a certificate when stunnel is verifying the certificate. The code works great, however it is uses a preconfigured OCSP responder. The OCSP responder's IP/hostname is specified in the stunnel configuration file as a URI. I found this rather restrictive, so I added code to extract the OCSP responder's URI from the certificate. As per RFC 3280, one of the valid extensions for X.509 certificate is the Authority Information Access (AIA) where the "accessMethod" can be "is-ad-ocsp" to identify the OCSP responders location as per RFC2560. There can be more than one OCSP responder listed in the AIA because it is a sequence. Each location is queried in the order they appear within the certificate until either a "good" or "revoked" response is received. If an "known" response or a failure then the next OCSP responder is checked. If all OCSP responder queries result in failure then the validation also fails.. A new configuration option "OCSPaia" was added. If the "OCSPaia=yes" then the stunnel will look for the OCSP responder(s) within the certificate's AIA. The locally configured "OCSP=<url>" overrides the OCSPaia option. Bruce

1 0

Wrong documentation
by Sandeep Kumar 24 Jul '08

24 Jul '08

Look at this page http://www.stunnel.org/faq/stunnel.html#configuration_file In service level options section, under the explanation of "CRLpath" it is said that all files in it should be of the form XXXXXXXX.0. But my stunnnel setup worked only when i names as XXXXXXXX.r0 instead of XXXXXXXX.0. -- Sandeep Kumar http://students.iiit.ac.in/~sandeep_kr

1 0

help with stunnel port forwarding
by vinod bhasi 23 Jul '08

23 Jul '08

Hi, Please help me with stunnel port forwarding . My apache is running at port 8000 .I want this to be forwarded to 80 so that normal users dont need to specify the port number . Can anyone help me with the configuration in both client and server side .Im confused as stunnel wont run with same port used by apache. Any help will be appreciated Thanks in advancve Vinod Bhasi Did you know? You can CHAT without downloading messenger. Go to http://in.webmessenger.yahoo.com/

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 48, Issue 13
by Patrick Dung 21 Jul '08

21 Jul '08

Message: 3 Date: Mon, 21 Jul 2008 11:34:22 +0200 From: Micha? Trojnara <Michal.Trojnara(a)mobi-com.net> Subject: Re: [stunnel-users] Problem with Solaris 10u5 x86 and Stunnel 4.25 To: stunnel-users(a)mirt.net Message-ID: <2a3f79f5f6dd65f2ced02b2e9929368b(a)mirt.net> Content-Type: text/plain; charset="UTF-8" http://stunnel.mirt.net/pipermail/stunnel-users/2008-June/002021.html Mike On Sat, 19 Jul 2008 01:53:17 -0700 (PDT), Patrick Dung <patrick_dkt(a)yahoo.com.hk> wrote: > Hi > > I use this to compile stunnel: > The gcc and openssl is from Solaris SFW. > > # export CC=/usr/sfw/bin/gcc > # ./configure --with-threads=pthread --with-ssl=/usr/sfw > --localstatedir=/var > > After installing and starting stunnel, I found there are mutiple stunnel > processes. > There is a PID file which store one of the stunnel process. > I have tried to kill that PID, stunnel is bring down. > But there other stunnel processes running. > > Any ideas? > > Regards > Patrick > > > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users I see. Thanks for reply. Yesterday, I have tried to compile stunnel with Sun Studio. It got problem linking with libwrap, so I turned off libwrap support. And it compile (without knowing there is a libwrap patch) and there is only one single running stunnel process. Regards Patrick

1 0

stunnel exits silently on startup
by Luis López de Quintana 21 Jul '08

21 Jul '08

Problem: stunnel doesn't run: ldq@ldq:~$ stunnel4 /etc/stunnel.cnf ldq@ldq:~$ ps aux | grep stunnel ldq 15683 0.0 0.0 2332 1392 pts/0 S+ 11:08 0:00 man stunnel ldq 25289 0.0 0.0 1776 608 pts/1 S+ 11:59 0:00 grep stunnel stunnel.cnf: ldq@ldq:~$ cat /etc/stunnel.cnf client = yes debug = debug [nntps] accept = 127.0.0.1:1109 connect = news.giganews.com:443 Version: stunnel 4.140-5ubuntu1 libc6 ldq@ldq:~$ uname -a Linux ldq 2.6.18.5 SMP Thu May 8 01:31:23 UTC 2008 x86_64 GNU/Linux -- LdQ

2 2

Problem with Solaris 10u5 x86 and Stunnel 4.25
by Patrick Dung 19 Jul '08

19 Jul '08

Hi I use this to compile stunnel: The gcc and openssl is from Solaris SFW. # export CC=/usr/sfw/bin/gcc # ./configure --with-threads=pthread --with-ssl=/usr/sfw --localstatedir=/var After installing and starting stunnel, I found there are mutiple stunnel processes. There is a PID file which store one of the stunnel process. I have tried to kill that PID, stunnel is bring down. But there other stunnel processes running. Any ideas? Regards Patrick

1 0

Config Sanity Check
by Caplan, Michael 19 Jul '08

19 Jul '08

Hi There, I am working through an issue with a script that builds a socket connection to stunnel. Stunnel is being used to relay to an Apache web server. I'm building a localhost TCP connection on port 54322, and writing my HTTP data. When reading data back from the socket connection in my script I'm sometimes getting nothing, and other times getting the proper result. I can confirm that the web server is always receiving the request and returning a proper response. Wireshark shows SSL data being transmitted and received, so stunnel is doing its thing. However, the response does not seem to be relayed to my script on the other side of stunnel *sometimes*. My hunch is that I am doing something wrong with my script, but I am hoping that an stunnel guru can rule out any oddities with my stunnel setup. My config is below as well as the output of my log file. Any thoughts? Thanks! Mike cert = connector.pem debug = 7 output = c:\ssl.log ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [registerserver] client = yes accept =54321 connect =www.int.ddx.com:443 [connector2server] client = yes accept =54322 connect =asd.int.ddx.com:443 [server2connector] accept = 54323 connect = 9000 2008.07.18 21:41:41 LOG7[13648:13748]: Snagged 64 random bytes from C:/.rnd 2008.07.18 21:41:41 LOG7[13648:13748]: Wrote 1024 new random bytes to C:/.rnd 2008.07.18 21:41:41 LOG7[13648:13748]: RAND_status claims sufficient entropy for the PRNG 2008.07.18 21:41:41 LOG7[13648:13748]: PRNG seeded successfully 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate loaded 2008.07.18 21:41:41 LOG7[13648:13748]: Key file: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Private key loaded 2008.07.18 21:41:41 LOG7[13648:13748]: SSL context initialized for service registerserver 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate loaded 2008.07.18 21:41:41 LOG7[13648:13748]: Key file: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Private key loaded 2008.07.18 21:41:41 LOG7[13648:13748]: SSL context initialized for service connector2server 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate loaded 2008.07.18 21:41:41 LOG7[13648:13748]: Key file: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Private key loaded 2008.07.18 21:41:41 LOG7[13648:13748]: SSL context initialized for service server2connector 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Certificate loaded 2008.07.18 21:41:41 LOG7[13648:13748]: Key file: connector.pem 2008.07.18 21:41:41 LOG7[13648:13748]: Private key loaded 2008.07.18 21:41:41 LOG7[13648:13748]: SSL context initialized for service test 2008.07.18 21:41:41 LOG5[13648:13748]: stunnel 4.25 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2008.07.18 21:41:41 LOG5[13648:13748]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2008.07.18 21:41:46 LOG7[13476:13096]: Snagged 64 random bytes from C:/.rnd 2008.07.18 21:41:47 LOG7[13476:13096]: Wrote 1024 new random bytes to C:/.rnd 2008.07.18 21:41:47 LOG7[13476:13096]: RAND_status claims sufficient entropy for the PRNG 2008.07.18 21:41:47 LOG7[13476:13096]: PRNG seeded successfully 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate loaded 2008.07.18 21:41:47 LOG7[13476:13096]: Key file: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Private key loaded 2008.07.18 21:41:47 LOG7[13476:13096]: SSL context initialized for service registerserver 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate loaded 2008.07.18 21:41:47 LOG7[13476:13096]: Key file: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Private key loaded 2008.07.18 21:41:47 LOG7[13476:13096]: SSL context initialized for service connector2server 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate loaded 2008.07.18 21:41:47 LOG7[13476:13096]: Key file: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Private key loaded 2008.07.18 21:41:47 LOG7[13476:13096]: SSL context initialized for service server2connector 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Certificate loaded 2008.07.18 21:41:47 LOG7[13476:13096]: Key file: connector.pem 2008.07.18 21:41:47 LOG7[13476:13096]: Private key loaded 2008.07.18 21:41:47 LOG7[13476:13096]: SSL context initialized for service test 2008.07.18 21:41:47 LOG5[13476:13096]: stunnel 4.25 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2008.07.18 21:41:47 LOG5[13476:13096]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 Please consider the environment before printing this email. E-mail messages may contain viruses, worms, or other malicious code. By reading the message and opening any attachments, the recipient accepts full responsibility for taking protective action against such code. Henry Schein is not liable for any loss or damage arising from this message. The information in this email is confidential and may be legally privileged. It is intended solely for the addressee(s). Access to this e-mail by anyone else is unauthorized.

1 0

Difference between verify level 2 and 3
by Sandeep Kumar 16 Jul '08

16 Jul '08

Hi, I searched a lot on google, in the archives, and in the FAQ page, but could not find the differences between verify levels 2 and 3, other than the one line explanation given on the FAQ/man page. Specifically, I want to ask: 1. Is verify level 3 same as 2, but asks for client certificates as well? (Seems unlikely but still..) 2. Since verify level 2 also demands CApath/CAfile to be present, then it also is ultimately verifying against locally installed certs, which is supposed to be level 3's behaviour? Thanks & regards, Sandeep Kumar http://web.iiit.ac.in/~sandeep_kr

2 2

stunnel-portforwarding
by vinod bhasi 16 Jul '08

16 Jul '08

Hi All, I am a newbie as far as stunnel is concerned. I need help urgently on how to do port forwarding with Stunnel. Any help is appreciated. Thanks and Regards, Vinod Bhasi Save all your chat conversations. Find them online at http://in.messenger.yahoo.com/webmessengerpromo.php

1 0

SSL with SMTP problem - sTunnel 4.25 Windows
by dscycler 14 Jul '08

14 Jul '08

I am using sTunnel 4.25 for Windows to send and receive e-mail from a GoldMine client. sTunnel has worked well over the years but am having an issue with a particular mail host, Live Office. They have implemented SMTP SSL on port 25. The debug log is as follows: 2008.07.14 13:45:11 LOG7[2136:5356]: smtp accepted FD=224 from 127.0.0.1:1907 2008.07.14 13:45:11 LOG7[2136:5356]: Creating a new thread 2008.07.14 13:45:11 LOG7[2136:5356]: New thread created 2008.07.14 13:45:11 LOG7[2136:4944]: smtp started 2008.07.14 13:45:11 LOG7[2136:4944]: FD 224 in non-blocking mode 2008.07.14 13:45:11 LOG5[2136:4944]: smtp accepted connection from 127.0.0.1:1907 2008.07.14 13:45:11 LOG7[2136:4944]: FD 232 in non-blocking mode 2008.07.14 13:45:11 LOG7[2136:4944]: smtp connecting 64.70.94.196:25 2008.07.14 13:45:11 LOG7[2136:4944]: connect_wait: waiting 10 seconds 2008.07.14 13:45:11 LOG7[2136:4944]: connect_wait: connected 2008.07.14 13:45:11 LOG5[2136:4944]: smtp connected remote server from 127.0.0.1:1908 2008.07.14 13:45:11 LOG7[2136:4944]: Remote FD=232 initialized 2008.07.14 13:45:11 LOG7[2136:4944]: SSL state (connect): before/connect initialization 2008.07.14 13:45:11 LOG7[2136:4944]: SSL state (connect): SSLv3 write client hello A 2008.07.14 13:45:11 LOG7[2136:4944]: SSL alert (write): fatal: handshake failure 2008.07.14 13:45:11 LOG3[2136:4944]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2008.07.14 13:45:11 LOG5[2136:4944]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.07.14 13:45:11 LOG7[2136:4944]: smtp finished (0 left) I am looking for help to troubleshoot the connection problem. Is this an sTunnel issue or a mail server issue? Are there conf file settings to address the issue? Thanks, DavidS

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users