- stunnel-users - stunnel.org

Stunnel 4 Multiple Processes on Ubuntu 8.04
by Armen Ayvazian 19 May '08

19 May '08

Greetings. I'm running the stock stunnel 4.21 on Ubuntu 8.04 (version and configs listed below) as a stand-alone daemon to pass connections between ssl-enabled SMTP, POP3, and IMAP clients and their respective servers, which run on the same machine as stunnel. In previous instances of Stunnel (v4.15) I've managed to successfully get the daemon to switch to a non-root user and use only a single process. I now find, however, that I get 6 processes and 5 continue to run as root with only one (albeit the one listening on the specified sockets) switching down to the specified user. Does anyone have any idea why I both can't set uid/gid and why I've now got so many processes? # ps aux | grep stunnel root 22702 0.0 0.1 3604 428 pts/1 S 11:24 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf root 22703 0.0 0.1 3604 428 pts/1 S 11:24 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf root 22704 0.0 0.1 3604 428 pts/1 S 11:24 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf root 22705 0.0 0.1 3604 428 pts/1 S 11:24 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf root 22706 0.0 0.1 3604 428 pts/1 S 11:24 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf stunnel4 22707 0.0 0.2 3720 932 ? Ss 11:24 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf # lsof -i | grep stunnel stunnel4 22707 stunnel4 11u IPv4 55934 TCP emily:pop3s (LISTEN) stunnel4 22707 stunnel4 12u IPv4 55935 TCP emily:imaps (LISTEN) stunnel4 22707 stunnel4 13u IPv4 55936 TCP emily:ssmtp (LISTEN) I'm invoking stunnel simply as /usr/sbin/stunnel4 /etc/stunnel4/stunnel.conf: cert = /etc/stunnel/stunnel.pem sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [pop3s] accept = 64.5.53.172:995 connect = 64.5.53.172:110 [imaps] accept = 64.5.53.172:993 connect = 64.5.53.172:143 [ssmtp] accept = 64.5.53.172:465 connect = 64.5.53.172:25 Version Info: stunnel 4.21 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none

1 0

stunnel and OCSP verification: strange behaviour
by Andreas Ntaflos 19 May '08

19 May '08

Hi list, [My apologies, I accidentally tried to send this message to stunnel-announce earlier.] I have a quick question regarding the use of stunnel with verification against an OCSP responder. I am using stunnel 4.20 and (for testing) 4.23 but I don't see any difference in the behaviour of both. The main problem is that stunnel accepts and establishes connections from clients even if those clients had their certificates revoked and the OCSP responder correctly informs stunnel about it. Consider the following configuration: foreground = yes CAfile = /path/to/cacert.pem cert = /path/to/stunnel_cert.pem key = /path/to/stunnel_key.pem debug = 7 [clientauth] accept = localhost:43434 connect = localhost:43433 verify = 2 OCSP = http://localhost:43435 The OCSP responder runs on localhost:43435 as you can see. Client verification is enabled. Using openssl to manually check against the responder works fine: openssl ocsp -issuer cacert.pem -CAfile cacert.pem -url \ http://localhost:43435 -cert revoked_cert.pem Response verify OK /path/to/revoked_cert.pem: revoked This Update: May 15 15:38:46 2008 GMT Next Update: May 15 17:04:32 2008 GMT Revocation Time: May 15 15:38:26 2008 GMT The relevant portion of stunnel's debug output looks like this: [...] Starting OCSP verification FD 8 in non-blocking mode connect_wait: waiting 10 seconds connect_wait: connected OCSP server connected FD 8 in blocking mode FD 8 in non-blocking mode OCSP response received OCSP verification passed: status=0, reason=-1208427072 VERIFY OK: depth=1, /CN=The CA/C=AT/ST=SomeState/L=SomeCity/O=The \ Organisation/emailAddress=camaster(a)the-organisation.invalid Starting OCSP verification FD 8 in non-blocking mode connect_wait: waiting 10 seconds connect_wait: connected OCSP server connected FD 8 in blocking mode FD 8 in non-blocking mode OCSP response received OCSP verification passed: status=1, reason=-1 VERIFY OK: depth=0, /C=AT/ST=SomeState/O=The Organisation/CN=this is a \ revoked cert SSL state (accept): SSLv3 read client certificate A [...] As far as I can see the OCSP verification works fine here, too, and at depth 0 stunnel finds the certificate to have been revoked (status=1 indicates that, I believe). The connection, however, is not rejected. Is there any way to have stunnel reject the connection when the client certificate has been revoked? Where would I configure this? The only way I have found yet was to patch src/verify.c but surely there must be a more convenient approach to this? On a related matter: if stunnel cannot and will not reject the connection upon a negative response from the OCSP, what would be the best way to script stunnel so that it rejects such a connection? I am asking because I am in the process of writing a few Python scripts that incorporate stunnel to aid in testing of some SSL-speaking components. Such a client component without a valid, non-revoked certificate must not be able to connect. I mean what good is OCSP verification if the result of the process, i.e. the responders answer "the certificate is valid" or "the certificate is no longer valid" doesn't matter to stunnel? Am I missing the point somewhere? I'd appreciate any insights on this. Kind regards, Andreas -- Andreas "daff" Ntaflos Vienna, Austria GPG Fingerprint: 6234 2E8E 5C81 C6CB E5EC 7E65 397C E2A8 090C A9B4

2 2

Reg:IPV6 support on stunnel
by Sandhya 15 May '08

15 May '08

> Stunnel version: > stunnel 4.09 on armv5tejl-unknown-linux-gnu PTHREAD+POLL+IPv6+LIBWRAP with > OpenSSL 0.9.7e 25 Oct 2004 > > My conf file Information: > cert = /usr/local/www/certs/server.pem > key = /usr/local/www/certs/privkey-server.pem > pid = /var/run/stunnel_kvm.pid > client = no > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > socket = a:TCP_NODELAY=1 > [ms] > accept = 1234 > connect = 1236 > > Please find the Config.log file attached. > > Please let me know if any other information is needed or you want me try > some commands on stunnel. > > Thanks for the help > > Sandhya R > > ----- Original Message ----- > From: "Michal Trojnara" <Michal.Trojnara(a)mobi-com.net> > To: <stunnel-users(a)mirt.net> > Sent: Wednesday, May 14, 2008 7:06 PM > Subject: Re: [stunnel-users] Reg:IPV6 support on stunnel > > >> >> Sandhya wrote: >> >>> I have enabled IPV6 ip When my client tries to connect to my ipv6 ip and >>> the port(stunnel listens) where my it is listening...Its failed to >>> connect. >> >> Please send us: >> - the output of "stunnel -version", >> - your stunnel.conf file, >> - your debug level logs. >> >> Best regards, >> Mike >> >> _______________________________________________ >> stunnel-users mailing list >> stunnel-users(a)mirt.net >> http://stunnel.mirt.net/mailman/listinfo/stunnel-users >> >

1 1

Fw: Reg:IPV6 support on stunnel
by Sandhya 14 May '08

14 May '08

----- Original Message ----- From: Sandhya To: stunnel-users(a)mirt.net Sent: Wednesday, May 14, 2008 6:43 PM Subject: [stunnel-users] Reg:IPV6 support on stunnel Hi, I am newbie to stunnel.As mentioned in some of your posts i just gone through ..how to enable ipv6 support. While configuring i did the same by giving the following command. ./configure --enable-ipv6 make make install and i ran stunnel which listens at some port and i have my own server which listens for stunnel. I have enabled IPV6 ip When my client tries to connect to my ipv6 ip and the port(stunnel listens) where my it is listening...Its failed to connect. Could you please throw some light on how to enable IPV6 support for stunnel apart from what i tried. Thanks in advance Sandhya -------------------------------------------------------------------------------- _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

Reg:IPV6 support on stunnel
by Sandhya 14 May '08

14 May '08

Hi, I am newbie to stunnel.As mentioned in some of your posts i just gone through ..how to enable ipv6 support. While configuring i did the same by giving the following command. ./configure --enable-ipv6 make make install and i ran stunnel which listens at some port and i have my own server which listens for stunnel. I have enabled IPV6 ip When my client tries to connect to my ipv6 ip and the port(stunnel listens) where my it is listening...Its failed to connect. Could you please throw some light on how to enable IPV6 support for stunnel apart from what i tried. Thanks in advance Sandhya

1 0

Reg:IPV6 support on stunnel
by Sandhya 13 May '08

13 May '08

Hi, I am newbie to stunnel.As mentioned in some of your posts i just gone through ..how to enable ipv6 support. While configuring i did the same by giving the following command. ./configure --enable-ipv6 make make install and i ran stunnel which listens at some port and i have my own server which listens for stunnel. I have enabled IPV6 ip When my client tries to connect to my ipv6 ip and the port(stunnel listens) where my it is listening...Its failed to connect. Could you please throw some light on how to enable IPV6 support for stunnel apart from what i tried. Thanks in advance Sandhya

1 0

Re: [stunnel-users] HTTPS connections aborted
by Matthias Kellermann 09 May '08

09 May '08

Hi Aleksandar, Aleksandar Lazic wrote: > The timing events at 6st position. > > http://haproxy.1wt.eu/download/1.3/doc/haproxy-en.txt > > > --- > 4.2.3) Timing events > -------------------- > . > . > . > > Other cases ('xx' means any value to be ignored) : > -1/xx/xx/xx/Tt: the client was not able to send its complete request > in time, > or that it aborted it too early. > Tq/-1/xx/xx/Tt: it was not possible to process the request, maybe because > servers were out of order. > Tq/Tw/-1/xx/Tt: the connection could not establish on the server. > Either it > refused it or it timed out after Tt-(Tq+Tw) ms. > Tq/Tw/Tc/-1/Tt: the server has accepted the connection but did not > return a > complete response in time, or it closed its connexion > unexpectedly, after Tt-(Tq+Tw+Tc) ms. thanks, I'll have a look at it. -Matthias

1 0

Feature request - verify fall-back
by Sudhaker Raj 09 May '08

09 May '08

Hi Team, I wish to use stunnel for following use-case (to create a highly-protected website which can be accessed only using a valid client-cert). gateway.example.com:443 -> public.example.com:80 (when client-cert verification fails) gateway.example.com:443 -> intranet.example.com:80 (when client-cert verification ok - normally hidden from public) As of now stunnel simply drops the connection when service is configured to verify the client certificate and verification fails. Is it possible to add a fall-back connect when verification fails. [protected-web] verify=3 accept=443 connect=intranet.example.com:80 noverify=public.example.com:80 I guess it will be a nice addition to stunnel's feature list. Thanks, Sudhaker

3 3

launch stunnel server daemon from php?
by Wesley Kenzie 05 May '08

05 May '08

I am having problems launching stunnel from a php "exec" command. I would like to have it launch as a server daemon and then have the exec command return control to the php script. The best I have been able to do is launch it in foreground with a command like "/usr/local/bin/stunnel /etc/stunnel/test.conf &" but control never returns to the php script. I do not want to use inetd mode, and would prefer to specify command line arguments, but I see they are no longer available in version 4. Any ideas? . . . . . Wesley Kenzie wkenzie(a)gmail.com

2 2

HTTPS connections aborted
by Matthias Kellermann 05 May '08

05 May '08

Hi list, I've set up a loadbalancer with haproxy and I'm using stunnel to have HTTPS on the loadbalancer. Every connection on port 443 is forwarded by stunnel to port 80 where haproxy listens. Some facts: FreeBSD 6.2 i386 stunnel 4.22 OpenSSL 0.9.7e-p1 gcc version 3.4.6 [FreeBSD] 20060305 Here is my stunnel.conf: sslVersion = all chroot = /var/tmp/stunnel setuid = stunnel setgid = nogroup pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 3 [https] cert = /usr/local/etc/stunnel/ssl/mycert.pem accept=localip:443 connect=localip:80 Some of my customers using HTTPS are claiming about aborted connections with MS Internet Explorer. They get a message about "secure and unsecure objects on this site, proceed?". When clicking yes they get a IE error message: "site not found". (Sorry, I don't know the exact english error message because customers use german version of IE). Of course there are only HTTPS objects on the page. In my logs I've lot of these entries: SSL_accept: Peer suddenly disconnected From time to time I'll get this error: SSL_read: Connection reset by peer (54) or: SSL_read: Operation timed out (60) or: SSL_write: Broken pipe (32) At the moment I have no idea where these errors come from and if they really belong to the error the customer gets with his IE browser. Any ideas what could cause these error messages? Thanks in advance, Matthias

2 1

Stunnel <=> p2p
by mluft 05 May '08

05 May '08

Hi, i just started working with stunnel, and i'm really impressed! But i've got 2 questions: * How is it realized, that a setup like this: accept = 15000 connect = 16000 also encrypts the reply of the app which listens on port 16000? Is there a kind of masquerading? * I think of a tool like tsocks or socksify: "tsocks application" redirects all traffic from application over an socks proxy. Is it possible to realize such a redirection with stunnel? So that all outgoing traffic of an application gets encrypted? I know that i can build point-to-point tunnels, but that's not possible for my scenario... Thanks & Cheers, Matthias

1 0

Stunnel 4.23 xforwardfor patch
by Rene Plattner 05 May '08

05 May '08

Dear stunnel users! I noticed that the xforwardfor patch does not work any more on version > 4.20! This is due an function renaming in stunnel! After adding xforwardfor patch for version 4.20 see options.c: Simply replace log_raw(...); to s_log(LOG_RAW,...); chears, -- Dipl.-Ing. Rene' Plattner Zentraler Informatikdienst (ZID) Universität Innsbruck, Österreich Technikerstr. 13 A-6020 Innsbruck Tel: ++43512/507-2360 Fax: ++43512/507-2944

1 0

Can stunnel be configured to listen for multiple IP addresses and access different email hosts?
by F Boyd Crow 03 May '08

03 May '08

I have attempted to use stunnel to retrieve POP3 SSL mail from two different ISPs: pop.att.yahoo.com and pop.gmail.com. I have tried putting in separate Access/Connect line pairs under [pop3s] either point to the different ports on 127.0.0.1 whch is an Exchange Server 2003 machine. I have tried pointing both to the same port. In either case, the first POP3 host is accessed but not the second. I have also tried one Access line and two separate connects. It works fine with one Access line and one Connect line but a previous post on this subject indicated I should be able to do retrievals from two separate sites and I do not see how. I am using the POP3 Connection Manager on Small Business Server 2003. I set the email server to 127.0.0.1 and use port 9995. The corresponding section of the stunnel.conf file is client = yes debug = 7 ; Service-level configuration [pop3s] accept = 9995 connect = pop.gmail.com:995 ;does not work with two separate pop3s, either with two separate accept ports or one common final comment is my own. Has anyone successfully accessed mail from two POP3 servers through stunnel or have any suggestions? Boyd

1 0

stunnel 4.23 released
by Michal Trojnara 03 May '08

03 May '08

Dear Users, I have just released a new version of stunnel. Please find below the ChangeLog entry: Version 4.23, 2008.05.03, urgency: HIGH: * Bugfixes - Local privilege escalation bug on Windows NT based systems fixed. A local user could exploit stunnel running as a service to gain localsystem privileges. Home page/download: http://stunnel.mirt.net/ sha1sum for stunnel-4.23.tar.gz file: d0fef8b518a44b9623692381a53680e0b4b01686 Best regards, Mike

1 0

Re: [stunnel-users] launch stunnel server daemon from php?
by Wesley Kenzie 02 May '08

02 May '08

No, that does not work either. I can get stunnel to start fine outside of php, but not as an exec or shell_exec from within a running script, or even from within php -a interactively. I can get other programs to work fine this way, so it is specific to the stunnel executable as best I can tell. I have tried running various forms of bash scripts too, but none do any better. Ideas? . . . . . Wesley On Fri, May 2, 2008 at 12:52 PM, Ludolf Holzheid < lholzheid(a)bihl-wiedemann.de> wrote: > On Fri, 2008-05-02 12:32:19 -0700, Wesley Kenzie wrote: > > Yes. Without this stunnel would not launch. With foreground = no and > with > > the trailing & on the command line I got it to launch, but still control > > will not return to my php script ... > > > > . . . . . > > Wesley > > > > On Fri, May 2, 2008 at 12:29 PM, Ludolf Holzheid < > > lholzheid(a)bihl-wiedemann.de> wrote: > > > > > On Fri, 2008-05-02 12:19:38 -0700, Wesley Kenzie wrote: > > > > I am having problems launching stunnel from a php "exec" command. I > > > would > > > > like to have it launch as a server daemon and then have the exec > command > > > > return control to the php script. > > > > > > Did you try to specify ``foreground = no'' in the configuration file? > > Wesley, > > I must confess that I don't know php and its `exec' command. There > must be something special about it. > > I would try to start a shell, which starts stunnel, which, in turn, > detaches itself to the background (i.e. something like "/bin/sh -c > '/usr/local/bin/stunnel /etc/stunnel/test.conf'"). So that the process > started by `exec' finishes and hopefully control returns to php. > > hth, > > Ludolf > > -- > > A: Because it messes up the order in which people normally read text. > Q: Why is top-posting such a bad thing? > A: Top-posting. > Q: What is the most annoying thing in e-mail? >

1 0

Re: [stunnel-users] launch stunnel server daemon from php?
by Wesley Kenzie 02 May '08

02 May '08

Yes. Without this stunnel would not launch. With foreground = no and with the trailing & on the command line I got it to launch, but still control will not return to my php script ... . . . . . Wesley On Fri, May 2, 2008 at 12:29 PM, Ludolf Holzheid < lholzheid(a)bihl-wiedemann.de> wrote: > On Fri, 2008-05-02 12:19:38 -0700, Wesley Kenzie wrote: > > I am having problems launching stunnel from a php "exec" command. I > would > > like to have it launch as a server daemon and then have the exec command > > return control to the php script. > > Did you try to specify ``foreground = no'' in the configuration file? > > Ludolf > > -- > > --------------------------------------------------------------- > Ludolf Holzheid Tel: +49 621 339960 > Bihl+Wiedemann GmbH Fax: +49 621 3392239 > Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de > D-68199 Mannheim, Germany > --------------------------------------------------------------- >

1 0

Verify=3 restart needed ?
by Edouard Dessioux 30 Apr '08

30 Apr '08

Hi everyone, Sorry for the repost, but in the web mailing list, my previous message appears weird, so I thought I could re-post it. I'm using stunnel v4.16 on a Windows 2003 Server, and I'm working with stunnel in verify=3 mode. I wanted to know if the stunnel needs to be restarted after a certificates has been removed ? If not, how long is the certificate considered valid after the file has been removed ? Regards, Edouard DESSIOUX Directeur de Projets Tibco Mobile 3, rue Danton - 92240 Malakoff Tél : +33 (0)1 55 58 04 59 - Fax : +33 (0)1 55 58 03 89 - Mob. +33 (0)6 34 02 61 54 E-mail : edessioux(a)tibco.fr - www.tibcomobile.fr Faites un geste pour la planète, n'imprimez ce message que si nécessaire.

3 3

to use certificate and key file in another machine
by Xiaoming Dong 29 Apr '08

29 Apr '08

Stunnel Version 4.2.1 Run in windows 2k3 When I configured stunnel to use cert from another windows machine (I already mapped the drive to this machine). Restarting stunnel got following error: 2008.04.29 10:01:32 LOG7[3568:1792]: Snagged 64 random bytes from C:/.rnd 2008.04.29 10:01:32 LOG7[3568:1792]: Wrote 1024 new random bytes to C:/.rnd 2008.04.29 10:01:32 LOG7[3568:1792]: RAND_status claims sufficient entropy for the PRNG 2008.04.29 10:01:32 LOG7[3568:1792]: PRNG seeded successfully 2008.04.29 10:01:32 LOG3[3568:1792]: V:\Program Files\client_cert\private\client_key.pem: No such process (3) 2008.04.29 10:01:32 LOG3[3568:1792]: Server is down Does anybody have any clue? Thanks, -Xiaoming ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

1 0

Will fwknop work?
by richard.woodman＠cox.net 29 Apr '08

29 Apr '08

If I understand the question correctly, isn't this what "port knocking" or single packet authorization (e.g. fwknop) is supposed to do? I have used fwknop and SSH in our lab, but only with Linux and iptables. However, I think fwknop is supposed to interface with more than just iptables on the local box (meaning you would not have to use a Linux box to replace your current firewall). I think you can use fwknop to monitor syslog and parse for specific events and then open the port. In other words, your current firewall reports to your syslog server and fwknop parses the log file for the security event associated with the reception of a SPA packet on your outside interface. Fwknop then sends your firewall (through a script?) whatever command is required to open the port you want and redirect it to the appropriate inside machine (or you could simply enable / disable a preconfigured rule). I am not a scripting guru so I may be WAY off base here and if I am, I apologize for leading you astray. Anyway, you might want to check out the following: http://cipherdyne.org/fwknop/ --> FireWall KNock Operator home page http://fwknop.darwinports.com/ --> OS X fwknop client There is also a Windows UI version that is supposed to create SPA packets without using fwknop / PERL or running under Cygwin but I have not used that. Richard On 4/29/08 7:50 PM, "jz(a)ellingtongeologic.com" <jz(a)ellingtongeologic.com> wrote: > > Good Morning Mike: > > I had a question and sent to the list (it might have not gone thru) The > question was that: is it possible for stunnel to go to the router, for > example, 10.10.1.1, to scan for a port of interest and see whether there is a > request thru that port? so the nat router would not have to forward the port > to the stunnel of my local machine, e.g. 10.10.1.188, on which stunnel is > listening for port 8888 and will relay it to 5631 of the local program. > > Thanks

1 0

how to enable TLS?
by Zhang Weiwu 26 Apr '08

26 Apr '08

Dear all I just configured stunnel for pop+ssl which works fine. What I want is actually smtp+tls. Is there a way to do so? I tried to configure thunderbird to access the port stunnel is listening to, with TLS. Then I got "Connectioin to xxx.xxx.xxx timed out". Best regards -- Real Softservice Huateng Tower, Unit 1788 Jia 302 3rd area of Jinsong, Chao Yang Tel: +86 (10) 8773 0650 ext 603 Mobile: 135 9950 2413 http://www.realss.com

1 0

Query regarding stunnel performance
by Arati.Kumar＠ubs.com 25 Apr '08

25 Apr '08

Hi, Does anyone know if there are any known issue with stunnel 4.05 and oracle 10g (especially in retrieving blobs) ? . Our application uses stunnel to communicate with oracle database. We are currently experiencing massive performance degradation after upgrading oracle from 9i to 10g (almost 6 times slower from what it was in 9i). Our application stores some data in blobs this seems to be the root cause of slower performance. Pls can someone let me know if there are any known issues with stunnel and 10g blob retrieving ? Also If an upgrade is recommended, which is the stable version we must be switching to? Thanks, Ararti Visit our website at http://www.ubs.com This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. E-mails are not encrypted and cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message which arise as a result of e-mail transmission. If verification is required please request a hard-copy version. This message is provided for informational purposes and should not be construed as a solicitation or offer to buy or sell any securities or related financial instruments. UBS Limited is a company registered in England & Wales under company number 2035362, whose registered office is at 1 Finsbury Avenue, London, EC2M 2PP, United Kingdom. UBS AG (London Branch) is registered as a branch of a foreign company under number BR004507, whose registered office is at 1 Finsbury Avenue, London, EC2M 2PP, United Kingdom. UBS Clearing and Execution Services Limited is a company registered in England & Wales under company number 03123037, whose registered office is at 1 Finsbury Avenue, London, EC2M 2PP, United Kingdom.

1 0

Linux FIPS compile libary question
by Joe Kemp 23 Apr '08

23 Apr '08

I am compiling stunnel on Centos 5 that has a regular Openssl 0.9.8b rpm installed. I have put my FIPS openssl in /usr/local/sslfips112. Configure with: ./configure --with-ssl=/usr/local/sslfips112 --enable-fips --disable-libwrap Make's linker line: /bin/sh ../libtool --tag=CC --mode=link FIPSLD_CC=gcc /usr/local/sslfips112/bin/fipsld -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/local/sslfips112/include -lldap -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o auth.o pty.o libwrap.o -lz -ldl -lutil -lnsl -lpthread -L/usr/local/sslfips112/lib -lssl -lcrypto FIPSLD_CC=gcc /usr/local/sslfips112/bin/fipsld -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/local/sslfips112/include -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o auth.o pty.o libwrap.o -lldap -lz -ldl -lutil -lnsl -lpthread -L/usr/local/sslfips112/lib -lssl -lcrypto This builds a stunnel that seems to run fine. During startup it says "stunnel is in FIPS mode." But if I run "ldd stunnel" it shows it needs /lib/libssl.so.6. While stunnel is running lsof shows it has that library open also. Why does my FIPS stunnel build still use the 0.9.8b shared library? Shouldn't all of the ssl dependencies been handled by the static FIPS openssl library during linking? The same issue exists for libcrypt.

4 6

stunnel wildcard question
by neve_capricorn＠gmx.de 17 Apr '08

17 Apr '08

hi, iam pulling my hair out with an wildcard ssl certificate / stunnel configuration. i use stunnel 4.2.2 and latest openSSL release. i have a signed wildcard certificate from comodo. when i add the .crt, .key and .ca-bundle file into an apache configuration, everything work fine in firefox and ie. when i try to use stunnel with the same certificates i got problems in firefox when i disable ; Authentication stuff ; verify =1 and when i set verify=1 i got problems in IE .7 (a dialog box pops and ask for identification the certificates). can someone maybe help me out,please? a demo is here: https://ssl1.medialib.de (works fine in firefox) https://ssl1.medialib.de (problem in IE7) thank you very much & best gary

1 0

Verify=3 cache expiration
by Edouard Dessioux 16 Apr '08

16 Apr '08

Hi everyone, I'm using stunnel v4.16 on a Windows 2003 Server, and I'm working with stunnel in verify=3 mode. I wanted to know if the stunnel needs to be restarted after a certificates has been removed ? If not, how long is the cache expiration delay before being taken into account ? Regards, Edouard DESSIOUX Directeur de Projets Tibco Mobile 3, rue Danton - 92240 Malakoff Tél : +33 (0)1 55 58 04 59 - Fax : +33 (0)1 55 58 03 89 - Mob. +33 (0)6 34 02 61 54 E-mail : edessioux(a)tibco.fr - www.tibcomobile.fr Faites un geste pour la planète, n'imprimez ce message que si nécessaire.

1 0

SCM repo?
by Alberto Giménez 12 Apr '08

12 Apr '08

Hello, Is there any public SCM (SVN, GIT, whatever) repository? I haven't seen anything on the website and I'd like to try to implement a new feature. Thanks in advance. -- Alberto Giménez

2 1

Stunnel 4.22 compiling issues on Solaris 10
by cod3fr3ak 09 Apr '08

09 Apr '08

I have sucessfully compiled Stunnel 4.22 on Solaris 10, but still recieve the sam errors during the configure. Initially I tried using Openssl-0.9.8f from Sun Freeware. Then I built and compiled Openssl-0.9.8g, but I still recieved the following errors on the build: configure: **************************************** SSL checking for SSL directory... /usr/local/ssl checking for obsolete RSAref library... no checking /usr/local/ssl/include/openssl/engine.h usability... yes checking /usr/local/ssl/include/openssl/engine.h presence... no configure: WARNING: /usr/local/ssl/include/openssl/engine.h: accepted by the compiler, rejected by the preprocessor! configure: WARNING: /usr/local/ssl/include/openssl/engine.h: proceeding with the compiler's result checking for /usr/local/ssl/include/openssl/engine.h... yes <ftp://ftp.sunfreeware.com/pub/freeware/sparc/10/openssl-0.9.8f-sol10-sparc-…>

1 0

Using stunnel + haproxy for SSL support
by Alberto Giménez 04 Apr '08

04 Apr '08

Hi, I'm having trouble using stunnel and haproxy to load balance https and http traffic. To be honest, I really don't know wether it is stunnel or haproxy related so I am going to contact both lists :) I have set up a haproxy load balancer as http proxy for two backend Apache2 webservers. It works fine. I also have stunnel on the same LB to add SSL suport (with xforwardedfor patch installed). It works fine (mostly). The issue is related to Apache trailing slash thingie. If I query https://haproxy.domain.loc/hatest/ it works perfectly, but if I omit the trailing slash: https://haproxy.domain.loc/hatest then following things happen: - Browser makes SSL connection with stunnel on port 443. - stunnel deciphers and forwards the request on the haproxy attached to LB's port 80. - haproxy (now using plain http) forwards to one of the backends. - Apache2 located on the backend replies with "301 moved permanently" to force the browser to add the trailing slash. As Apache was queried by *haproxy in plain http*, the 301 includes http:// on the Location header. HTTPS is over from now! - The client browser then rewrites the address to http://haproxy.domain.loc/hatest/ and SSL is lost forever. I've been googling and searching the lists but nothing found, just this old message: http://mirt.net/pipermail/stunnel-users/2007-January/001437.html Has anyone found a workaround for that issue? Thanks in advance. -- Alberto Giménez

2 1

Problems with Stunnel 4.22 build
by GGrant 04 Apr '08

04 Apr '08

There's a problem with the Stunnel 4.22 build as there's undefined IDs in the resources.rc file. To get around this get the resources.rc file from an earlier build (e.g. Stunnel 4.21) and replace it. It should compile happily -- View this message in context: http://www.nabble.com/Problems-with-Stunnel-4.22-build-tp16491431p16491431.… Sent from the Stunnel - Users mailing list archive at Nabble.com.

1 0

23 secs to list 5000 files using stunnel and samba on linux
by Paul Kerin 04 Apr '08

04 Apr '08

Hi I'm using the following s/w versions on RHEL3: Stunnel: 4.04 (also experimenting with 4.22, no difference so far) Samba: 3.0.9-1.3E.10 Kernel: 2.4.21-32.0.1.EL Stunnel is used to encrypt samba connections from linux clients because redhat 3 doesn't support NTLMv2 (cifs not standard and probably not an option). To list 5000 files (simply typing ls within a mounted directory on the client) it consistently takes around 20-23 seconds to return the data. Listing is almost instantaneous when using a windows client, or using a linux client without stunnel. As a side note, if I pipe the result to /dev/null it takes around 9 seconds (?). The network forwarding path from the samba client to samba server is: smbclient > localhost:924 > stunnel > remotehost:923 > stunnel > samba server (port 446) Tcpdump shows that when using stunnel about 10500 packets are generated, minus stunnel it's more like 500. I'd expect some overhead related to SSL, but 21 times the traffic seems a little excessive. I've experimented with socket options such as TCP_NODELAY, SO_LINGER, SO_RCVLOWAT, SO_OOBINLINE, etc with no improvement at all. However, my understanding of these is pretty superficial so I'm not confident I've exhausted all options here (ie perhaps combining multiple settings at once). I've got stunnel debug set to 7 on client and server. No errors and no logging at all except for the initial handshake when the mount is created. Including the tcpdump would probably be excessive at this stage. In summary, using stunnel the data gets transmitted in packets usually containing around 200 bytes, whereas without stunnel it's mostly 1408 byte packets. Any suggestions? Thanks Paul

4 4

Stunnel Newbie - Compiling Stunnel and adding patches for Windows
by GGrant 02 Apr '08

02 Apr '08

Hi, I've downloaded the Stunnel source code and I am trying to compile it with the Visual C++ compiler (cl.exe). I am not sure what to do as I cannot find the Makefile.w32. So how do I go about it? Also how do you apply a user patch to the source code/ Must I copy and paste the code to the required files? Cheers -- View this message in context: http://www.nabble.com/Stunnel-Newbie---Compiling-Stunnel-and-adding-patches… Sent from the Stunnel - Users mailing list archive at Nabble.com.

1 0

Stunnel-Openssl: Problems with certificate chain
by Pietro Di Primo 31 Mar '08

31 Mar '08

Hi, My name is Pietro Di Primo and I work on the INFN Grid project (http://grid.infn.it/) I'm trying to develop an application based on stunnel. Everything works well when I use user certificates (signed by our CA), but i need to use (on the client side) a particular proxy. This proxy contains a public and a private key, and the public key of the user that generated it (I atteched a file with a such proxy). On the server side I have the CA certificate but not the user's one, so I can't verify the client (unable to get local issuer certificate). I tried to get the user certificate using the SSL_get_peer_cert_chain function on the server, but it returns NULL. On the client side I tried SSL_CTX_use_certificate_chain_file, Also I tried to get a STACK_OF(X509) and use SSL_CTX_use_certificate (for proxy certificate), and SSL_CTX_add_extra_chain_cert (to include the user's certificate), but it still doesn't work. Can you help me please? Best Regards -- --- Ing. Pietro Di Primo INFN - Istituto Nazionale di Fisica Nucleare Grid Computing Research Area Via S. Sofia 78 95123 CATANIA (Italy) Voice : +39 095 378-5446/5517 Fax. : +39 095 378 5518 Mobile : +39 320 8591527 E-mail : pietro.diprimo(a)ct.infn.it Skype : pietrodiprimo

1 0

Re: [stunnel-users] Enhancement request - Increase thread stack size
by Mccue, Richard Alan 26 Mar '08

26 Mar '08

Michal Trojnara wrote: >> I load an engine into Stunnel to access the private key. The engine loads >> without incident, but Stunnel consistently aborts when creating a session >> with the first peer because the thread stack is too small. > > I'm not sure if it's a good idea to sacrifice stunnel scalability for > compatibility with this engine. Thread stack size is one of the main > limitations for the number of concurrent threads on 32-bit platforms. IMHO > it's better to fix the engine code to allocate its buffers on the heap.> > > What do you think? All things considered, I must agree that reducing the engine use of the stack would be the better solution. I'll look it over and see if I can find anything sizable on the stack to move. Thanks for the suggestion! - Rich

2 2

New libwrap code
by Randy McMurchy 26 Mar '08

26 Mar '08

Hi all, My apologies if this has been discussed (I've reviewed the archives since 4.21 was released), and if so please just point me in the right direction. I read in some of the messages there's been a revamp (overhaul, changes, whatever) of the libwrap code in Stunnel-4.21. I'm not having any issues using the new version, however, I'm seeing it spawn 5 processes where in every other version I've used in the past there has always only been one process spawned. Here's what I see: root 3408 1 0 17:50 pts/10 00:00:00 /usr/bin/stunnel root 3409 1 0 17:50 pts/10 00:00:00 /usr/bin/stunnel root 3410 1 0 17:50 pts/10 00:00:00 /usr/bin/stunnel root 3411 1 0 17:50 pts/10 00:00:00 /usr/bin/stunnel root 3412 1 0 17:50 pts/10 00:00:00 /usr/bin/stunnel stunnel 3413 1 0 17:50 ? 00:00:00 /usr/bin/stunnel Is this a product of the new libwrap code? I turned debug messages WAY up and I see over and over startup messages for all 5 processes. Example of one: 2008.03.25 17:50:24 LOG5[3407:3082803904]: stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.8e 23 Feb 2007 2008.03.25 17:50:24 LOG5[3407:3082803904]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Auth:LIBWRAP 2008.03.25 17:50:24 LOG6[3407:3082803904]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.03.25 17:50:24 LOG6[3407:3082803904]: poll() used - no FD_SETSIZE limit for file descriptors 2008.03.25 17:50:24 LOG5[3407:3082803904]: 500 clients allowed 2008.03.25 17:50:24 LOG7[3407:3082803904]: FD 9 in non-blocking mode 2008.03.25 17:50:24 LOG7[3407:3082803904]: FD 10 in non-blocking mode 2008.03.25 17:50:24 LOG7[3407:3082803904]: FD 11 in non-blocking mode 2008.03.25 17:50:24 LOG7[3407:3082803904]: SO_REUSEADDR option set on accept socket 2008.03.25 17:50:24 LOG7[3407:3082803904]: swat bound to 0.0.0.0:904 2008.03.25 17:50:24 LOG7[3413:3082803904]: Created pid file /run/stunnel.pid 2008.03.25 17:50:42 LOG7[3413:3082803904]: swat accepted FD=12 from 192.168.11.212:1535 2008.03.25 17:50:42 LOG7[3413:3086076816]: swat started 2008.03.25 17:50:42 LOG7[3413:3086076816]: FD 12 in non-blocking mode 2008.03.25 17:50:42 LOG7[3413:3086076816]: Waiting for a libwrap process 2008.03.25 17:50:42 LOG7[3413:3086076816]: Acquired libwrap process #0 2008.03.25 17:50:42 LOG7[3413:3086076816]: Releasing libwrap process #0 2008.03.25 17:50:42 LOG7[3413:3086076816]: Released libwrap process #0 2008.03.25 17:50:42 LOG7[3413:3086076816]: swat permitted by libwrap from 192.168.11.212:1535 2008.03.25 17:50:42 LOG5[3413:3086076816]: swat accepted connection from 192.168.11.212:1535 When I connect to swat (Samba config tool) it again goes through a process of using all 5 of the system processes. Sorry for being so verbose here. My question is: Has something changed so that there is more than one process spawned (and used) when Stunnel is started? Any help would be appreciated. -- Randy

1 0

Enhancement request - Increase thread stack size
by Mccue, Richard Alan 25 Mar '08

25 Mar '08

I load an engine into Stunnel to access the private key. The engine loads without incident, but Stunnel consistently aborts when creating a session with the first peer because the thread stack is too small. I rebuilt Stunnel 4.21 on my test machine after increasing the stack size parameter and it fixed the problem. Here is the diff: --------------------- # diff -b common.h common.h_orig 33c33 < #define STACK_SIZE 32768*4 --- > #define STACK_SIZE 32768 42c42 < #define STACK_SIZE 65536*4 --- > #define STACK_SIZE 65536 --------------------- Could this enhancement be included in the next Stunnel release? Regards, Rich

1 0

HTTPS being redirected back to HTTP
by Steven Buehler 25 Mar '08

25 Mar '08

I have tested several versions of stunnel up to version 4.21 on SLES 9 and 10. I am trying to use stunnel to implement TLS 1.0 for HTTPS on a Lotus Domino server. I am able to connect to the Domino server with a web browser with HTTPS successfully. However, once I log into the server it drops me back down to HTTP. I suspect the Domino server is sending a redirect back to HTTP during the login because if I change the URL back to HTTPS in the browser after the login, it re-establishes the HTTPS connection. I've checked with Lotus support and there is nothing that can be done on the Domino server to prevent this. Is there anyway to handle this in stunnel so that the requests remain as HTTPS requests to the browser? Here is the services section of my stunnel.conf [https] sslVersion = TLSv1 accept = gsvatestm02.er.usgs.gov:443 connect = gsvatestm02.er.usgs.gov:80 TIMEOUTclose = 0

2 1

possible stunnel memory leak
by Stefano Stabellini 25 Mar '08

25 Mar '08

Hi all, I may have found a possible memory leak in stunnel (version 4.15) when used with pthreads. What I am seeing is the memory usage going up when connections open and never going down, no matter if all the connections close. It is really easy to reproduce it: I have started two stunnel instances communicating with each other, the first one acting as a server (config file stunnel.1) and executing cat, the second one acting as a client (config file stunnel.2) and opening port 5556. Then I execute the script I have attached that simply opens 500 connections using netcat to port 5556. If you cat /proc/<stunnel pid>/status you can see that the memory usage is about 300MB. The problem is that even after all the connections are closed the memory usage stays (more or less) the same. I tried to find the bug myself using valgrind, but I couldn't get far, it seems that valgrind gets confused by openssl so doesn't print very useful informations. I really appreciate any help you can give me; just tell me if you need any other info. Best Regards, Stefano Stabellini #!/bin/bash i=1 while test $i -lt 520 do cat script | nc 127.0.0.1 5556 &>/dev/null & echo $i i=$(( $i + 1 )) done foreground = yes [test] accept = 5555 cert = /etc/ssl/certs/stunnel.pem exec = cat foreground = yes [test] accept = 5556 cert = /etc/ssl/certs/stunnel.pem client = yes connect = 5555

1 0

IMAPS stunnel on older OSX Mac: SSL3_GET_RECORD:wrong version number
by Tom Shaw 23 Mar '08

23 Mar '08

1. compiled and installed stunnel on older OSX Mac. Tried connectiong via IMAPS and POP3S using Apple OSX Mail and I get the errors shown in line 4. Process works when I change my .conf file to contain sslVersion = SSLv2. I'm a neophyte to ssl and I have no idea what is wrong or where to start or if this situation is OK. Any help is appreciated. Also this needs to be backward compatible to OSX 10.3.9 which is why the compiling on Panther. 2. stunnel version 4.20 3. standalone via sudo from command line 4. error message Mar 23 10:49:52 musky stunnel: LOG5[2941:25192960]: imaps accepted connection from 206.208.58.127:37295 Mar 23 10:49:52 musky stunnel: LOG3[2941:25192960]: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number Mar 23 10:49:52 musky stunnel: LOG5[2941:25192960]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 5. $ /usr/local/sbin/stunnel -version stunnel 4.20 on powerpc-apple-darwin7.9.0 with OpenSSL 0.9.7l 28 Sep 2006 Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv4 Auth:LIBWRAP Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none 6. $ uname -a Darwin musky.oitc.com 7.9.0 Darwin Kernel Version 7.9.0: Wed Mar 30 20:11:17 PST 2005; root:xnu/xnu-517.12.7.obj~1/RELEASE_PPC Power Macintosh powerpc 7. Your libc version if you use Linux. 8. $ gcc -v Reading specs from /usr/libexec/gcc/darwin/ppc/3.3/specs Thread model: posix gcc version 3.3 20030304 (Apple Computer, Inc. build 1666) 9. $ openssl version OpenSSL 0.9.7l 28 Sep 2006 10. My conf ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /usr/local/etc/stunnel/secure_mail.pem ;key = /usr/local/etc/stunnel/secure_mail.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv2 ; Some security enhancements for UNIX systems - comment them out on Win32 ;chroot = /usr/local/var/lib/stunnel/ ;setuid = nobody ;setgid = nobody ;setgid = nogroup ; PID is created inside chroot jail pid = /var/run/stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /usr/local/etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ;output = stunnel.log ; Use it for client mode ;client = yes ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 587 [sldap] accept = 636 connect = 389 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini

1 0

What is the stable version of Stunnel?
by Randy McMurchy 22 Mar '08

22 Mar '08

Hi all, Can anyone say for sure what is the stable version of Stunnel? On the main Stunnel web site page ( http://www.stunnel.org ) and in the announcement for the version it says the new 4.21 version is experimental. However, on the download page ( http://www.stunnel.org/download/source.html ) the 4.21 version is flagged as the stable version. Sort of confusing. -- Randy

2 1

compiling stunnel 4.21 on solaris 10
by cod3fr3ak 14 Mar '08

14 Mar '08

Is this not compatible with Openssl 0.9.8f? I think 0.9.8g only reacently came out. Is this the only thing wrong. All my other applications work with this version of openssl. BTW I am using the sunfreeware version, because I wanted to avoid having to compile a bunch of software. i was planning to only compile Stunnel, and maybe swatch. I'll compile Openssl if there is no other way but I'd rather not. Any ideas? R

1 0

bidirectional tunnel
by Leo Cherepanov 14 Mar '08

14 Mar '08

Hello. First of all - thanx a lot, I'm using stunnel every day and it helps me. It will help me even more :) if I can make bidirectional tunnel between external server S and computer C behind nat-proxy-firewall. Of course, C is initiator. I mean after tunnel is up, there is a port-forward C:port1->S:port2 (already works) _and_ S:port3->C:port4 Once again, S has an external ip, C has a private ip. Is this schema posible? Thanx en avance.

1 0

SSLV3 decompression failure???
by Earl Stenlund 13 Mar '08

13 Mar '08

I've been running into the error below: SSL_connect: 14094406: error:14094406:SSL routines:SSL3_READ_BYTES:sslv3 alert decompression failure Running Vista SP1 with stunnel 4.21 connecting to newshosting. It seems to come and go. Any ideas on what is causing this or how to fix it? Thanks, Earl

1 0

Re: [stunnel-users] Compiling Stunnel 4.21 on Solaris 10
by cod3fr3ak 13 Mar '08

13 Mar '08

Is this not compatible with Openssl 0.9.8f? I think 0.9.8g only reacently came out. Is this the only thing wrong. All my other applications work with this version of openssl. BTW I am using the sunfreeware version, because I wanted to avoid having to compile a bunch of software. i was planning to only compile Stunnel, and maybe swatch. I'll compile Openssl if there is no other way but I'd rather not. Any ideas? R

1 0

Compiling Stunnel 4.21 on Solaris 10
by cod3fr3ak 13 Mar '08

13 Mar '08

I am trying to compile Stunnel 4.21 on Solaris 10 with no luck. I am using Openssl 0.9.8f. After running configure, I run make and receive the following output: (truncated for size) ------------------------------------------------------- /bin/bash ../libtool --tag=CC --mode=link gcc -m64 -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/local/ssl/include -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o pty.o -lz -ldl -lsocket -lnsl -lpthread -L/usr/local/ssl/lib -lssl -lcrypto gcc -m64 -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/local/ssl/include -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o pty.o -lz -ldl -lsocket -lnsl -lpthread -L/usr/local/ssl/lib -lssl -lcrypto Undefined first referenced symbol in file BIO_set_flags protocol.o SSL_CTX_set_info_callback ctx.o ld: fatal: Symbol referencing errors. No output written to stunnel collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `stunnel' Current working directory /tmp/stunnel-4.20/src *** Error code 1 The following command caused the error: failcom='exit 1'; \ for f in x $MAKEFLAGS; do \ case $f in \ *=* | --[!k]*);; \ *k*) failcom='fail=yes';; \ esac; \ done; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='src doc tools'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || eval $failcom; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' I have tried Stunnel version 4.21, 4.20 with the same results. I have used Stunnel to help build several secure log servers in the past, and I've never had problems getting it compiled and installed. Any help would be greatly appreciated. cod3fr3ak

1 0

Re: [stunnel-users] stunnel not seeing ca bundle files
by Ludolf Holzheid 12 Mar '08

12 Mar '08

On Wed, 2008-03-12 09:05:17 -0700, sf.techguy(a)gmail.com wrote: > [..] > > Tried the command above on the 1st of 5 crt files (openssl pkcs12 -in > filename.crt -out filename.pem), and am getting this error: > > 19319:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong > tag:tasn_dec.c:1007: > 19319:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 > error:tasn_dec.c:305:Type=PKCS12 > > Any ideas why that might be happening? It seems your files do not contain a PKCS#12 structure (containing the key and the whole certificate chain). I should have recognize this by the fact you have one file for each certificate. Sorry. Maybe you should give the x509 openssl command a try: openssl x509 -in filename.crt -inform DES -out filename.pem HTH, Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

stunnel not seeing ca bundle files
by sf.techguy＠gmail.com 12 Mar '08

12 Mar '08

I'm running stunnel 4.14 on Darwin 7.0.0 (Mac OS X Server 10.4.11), with OpenSSL 0.9.71. I purchased a security certificate from comodo, and was able to get it installed and working (mostly) with stunnel, but when I browse to the website, I get an error that the the browser can't verify the identity of the site, due to a problem w/the security cert. I called comodo, and they the error is caused by stunnel not seeing the intermediate certificate files that they told me need to be installed in order for their certificate to work. These files were: ComodoUTNServerCA.crt UTNAddTrustServerCA.crt AddTrustExternalCARoot.crt EssentialSSLCA.crt my_server_net.crt I modified stunnel.conf, and included this line: CApath = ca-certs/ (<- dir path, relative to chroot, containing above files) But the error persists. Can anyone tell me if what comodo support is telling me is even correct? I've verified that my .key and .crt files match by running: $ openssl x509 -noout -modulus -in server.crt | openssl md5 $ openssl rsa -noout -modulus -in server.key | openssl md5 And the output of both matches. Not sure what to try next. Any help much appreciated! Thanks in advance...

3 2

(no subject)
by Eddie Castelli 11 Mar '08

11 Mar '08

Dear all, Some years ago I have installed Apache, PHP and mySQL. Now I need to update. Unfortunately I can't remember if I installed a package or individual program elements. Could please someone help me and guide me trough as I need urgently the update. Many thanks in advance. -- best regards Eddie

3 3

behaviour on remote disconnection
by Marek Jarycki 11 Mar '08

11 Mar '08

Hi. I'm using 3.26 version of stunnel. How to disallow creating local sockets (on client side) when remote (server) is not available? My application detects socket creation errors and it works without stunnel, but in stunnel the socket is always opening correctly so I have to wait for timeouts to discover network disconnection. Regards, deimoss

2 1

Re: [stunnel-users] unknown protocol error (140770FC) with xinetd
by Ian Pilcher 10 Mar '08

10 Mar '08

Ian Pilcher wrote: > ... and the (non-working) server-side stunnel configuration: > > cert = /etc/stunnel/rsyncs_cert.pem > key = /etc/stunnel/private/rsyncs_key.pem > client = no > pid = /var/run/stunnel.pid > RNDfile = /var/run/stunnel/random_seed > foreground = yes > debug = debug > output = /var/run/stunnel/stunnel.log > > exec = /usr/bin/rsync > execargs = rsync --daemon Amazing how sending off the question gets the old brain cells working (or maybe it was the second cup of coffee). The problem was "foreground = yes". Since xinet.d redirects stderr back over the network connection, the stunnel startup messages were going back to the client. For some reason, the client didn't think that was a proper SSL handshake. ;-) -- ======================================================================== Ian Pilcher arequipeno(a)gmail.com ========================================================================

1 0

unknown protocol error (140770FC) with xinetd
by Ian Pilcher 10 Mar '08

10 Mar '08

I am trying to set up rsync over SSL with stunnel. I've got things working when I run stunnel standalone on both systems, but I have been unable to get things working when I run stunnel via xinetd on the server (haven't tried using xinet on the client yet). Here is the (standalone) server configuration that works: cert = /etc/stunnel/rsyncs_cert.pem key = /etc/stunnel/private/rsyncs_key.pem client = no pid = /var/run/stunnel.pid RNDfile = /var/run/stunnel/random_seed foreground = yes debug = debug ;output = /var/run/stunnel/stunnel.log [rsyncs] accept = 2873 exec = /usr/bin/rsync execargs = rsync --daemon Here is the (non-working) server-side xinetd configuration: # default: off # description: rsync tunneled over SSL (stunnel) service rsyncs { disable = no flags = IPv4 socket_type = stream wait = no user = root server = /usr/sbin/stunnel } ... and the (non-working) server-side stunnel configuration: cert = /etc/stunnel/rsyncs_cert.pem key = /etc/stunnel/private/rsyncs_key.pem client = no pid = /var/run/stunnel.pid RNDfile = /var/run/stunnel/random_seed foreground = yes debug = debug output = /var/run/stunnel/stunnel.log exec = /usr/bin/rsync execargs = rsync --daemon Trying to connect to the non-working configuration with openssl s_client, I get: CONNECTED(00000003) write to 0x9b9e938 [0x9b9f068] (133 bytes => 133 (0x85)) 0000 - 80 83 01 03 01 00 5a 00-00 00 20 00 00 39 00 00 ......Z... ..9.. 0010 - 38 00 00 35 00 00 16 00-00 13 00 00 0a 07 00 c0 8..5............ 0020 - 00 00 33 00 00 32 00 00-2f 03 00 80 00 00 66 00 ..3..2../.....f. 0030 - 00 05 00 00 04 01 00 80-00 00 63 00 00 62 00 00 ..........c..b.. 0040 - 15 00 00 12 00 00 09 06-00 40 00 00 65 00 00 64 [email protected] 0050 - 00 00 14 00 00 11 00 00-08 00 00 06 04 00 80 00 ................ 0060 - 00 03 02 00 80 3e b4 89-34 c1 e6 93 97 2d 8d ca .....>..4....-.. 0070 - 90 e1 4c 51 e1 71 c7 54-ed 52 0c 6e 2e 47 90 9b ..LQ.q.T.R.n.G.. 0080 - 8e c6 73 3d d8 ..s=. read from 0x9b9e938 [0x9ba45c8] (7 bytes => 7 (0x7)) 0000 - 32 30 30 38 2e 30 33 2008.03 18523:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:567: The server log shows: 2008.03.10 11:32:23 LOG5[18563:3086215456]: stunnel 4.20 on i386-redhat-linux-gnu with OpenSSL 0.9.8b 04 May 2006 2008.03.10 11:32:23 LOG5[18563:3086215456]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.03.10 11:32:23 LOG7[18563:3086215456]: stunnel started 2008.03.10 11:32:23 LOG7[18563:3086215456]: FD 0 in non-blocking mode 2008.03.10 11:32:23 LOG7[18563:3086215456]: FD 1 in non-blocking mode 2008.03.10 11:32:23 LOG7[18563:3086215456]: FD 4 in non-blocking mode 2008.03.10 11:32:23 LOG7[18563:3086215456]: FD 5 in non-blocking mode 2008.03.10 11:32:23 LOG7[18563:3086215456]: Connection from 127.0.0.1:38481 permitted by libwrap 2008.03.10 11:32:23 LOG5[18563:3086215456]: stunnel accepted connection from 127.0.0.1:38481 2008.03.10 11:32:23 LOG7[18563:3086215456]: SSL state (accept): before/accept initialization 2008.03.10 11:32:23 LOG7[18563:3086215456]: SSL state (accept): SSLv3 read client hello A 2008.03.10 11:32:23 LOG7[18563:3086215456]: SSL state (accept): SSLv3 write server hello A 2008.03.10 11:32:23 LOG7[18563:3086215456]: SSL state (accept): SSLv3 write certificate A 2008.03.10 11:32:23 LOG7[18563:3086215456]: SSL state (accept): SSLv3 write server done A 2008.03.10 11:32:23 LOG3[18563:3086215456]: SSL_accept: Peer suddenly disconnected 2008.03.10 11:32:23 LOG5[18563:3086215456]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.03.10 11:32:23 LOG7[18563:3086215456]: stunnel finished (0 left) Anyone have any ideas? Thanks! -- ======================================================================== Ian Pilcher arequipeno(a)gmail.com ========================================================================

1 0

Windows FIPS compile
by Joe Kemp 10 Mar '08

10 Mar '08

I am trying to get stunnel to compile against a fips openssl. I read in install.fips that it is not yet supported. Is anyone currently working on this? If so I would love to join forces or any info on the specific issues would help get me started. Thanks. -Joe

2 2