- stunnel-users - stunnel.org

Setting up Stunnel with Gmail.
by Roger 24 Sep '07

24 Sep '07

Hi, A simple question from a technical learner! I use Gmail's POP3 & SMTP [SSL] servers for three Gmail accounts using Thunderbird as my email client. I would like to know EXACTLY how to set up stunnel so that my anti-virus program ( NOD32) can scan messages being sent and received by SSL on ports 995 & 465. I have Open SSL installed: downloaded but not yet installed stunnel set up. I have tried before to use stunnel, but failed as I keep getting message, as I recall, to the effect that localhost is not recognised. There are detailed explanations on the web for configuring with Spampal, but I don't have, or need Spampal! Thanks, Roger

2 1

Re: [stunnel-users] Relaying OOB data [Was: A series of minor patchesfrom Debian]
by Richard's Hotmail 24 Sep '07

24 Sep '07

Hi Luis, Thanks for the detailed reply! > Ok, been reading. The short answer is no. Oh well :-( I guess that's what IPsec's for. > The longer answer is SSL doesn't support OOB data, so that's why > not. I did read your post saying you've read specs where it says it > does, but I could find no such. Take a look at RFC4346, section 6.2 > http://tools.ietf.org/html/rfc4346#page-14 > Take a look also at this thread: > http://www1.ietf.org/mail-archive/web/tls/current/msg01041.html Doesn't that thread suggest that OOB functionality is part of the SSLv3 standard? Is version three one of those "yet to be" standards that is still a long way off? Renamed TLS? (I found several RFCs dealing with this, anyone know which is the relevant one? I couldn't find "Urgent", "OOB" or "band" in 4346) My understanding (imagination maybe) is that the OOB character is to be packaged up as a single byte record surrounded with the SSL wrapper with a bit set that says it's the OOB character. I would now like stunnel just to dequeue it from SSL and then set the MSG_OOB flag and replay it to the application port. So it's sort of quasi-OOB to Stunnel and then true-OOB to the receiving port. > The argument (almost) in full: > - SSL doesn't define anything like OOB data in its streams, so > anything we did in stunnel would be an extension, and not > interoperable. And, anyways, would have to be done in openssl and not > in stunnel, I think. I must be confused about what's available (the only SSL code I've cut is simple Java client stuff) 'cos I'm sure I've seen patch-comments that say something like "make sure stunnel handles OOB data correctly" and isn't there some sort of OOB INLINE configuration parameter. Is there really northing available after the SSL_Read that identifies the data as an OOB character? Anyway, thanks again for the reply. Cheers Richard Maher PS. Does anyone out there know of a lower-level version of Stunnel (or something else) that spoofs the originating host-address when replaying the connection on the local server? It sure would be useful for client identification, and for reducing DoS attacks! ----- Original Message ----- From: "Luis Rodrigo Gallardo Cruz" <rodrigo(a)nul-unu.com> To: <stunnel-users(a)mirt.net> Sent: Tuesday, September 18, 2007 9:14 AM Subject: [stunnel-users] Relaying OOB data [Was: A series of minor patchesfrom Debian] > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

A series of minor patches from Debian
by Luis Rodrigo Gallardo Cruz 23 Sep '07

23 Sep '07

Hello. I have recently become the maintainer for the Debian package of stunnel. During the adoption process I noticed a few things that I think would be good to fix in the code. I will be sending the patches to this list (unless a better place for this is pointed out) as separate mails, to allow them to have individual responses, but thought I'd better introduce myself first. Thank you all, -- Rodrigo Gallardo GPG-Fingerprint: 7C81 E60C 442E 8FBC D975 2F49 0199 8318 ADC9 BC28

4 14

[patch] FSF postal address is outdated
by Luis Rodrigo Gallardo Cruz 14 Sep '07

14 Sep '07

The following long but rather trivial patch fixes up the FSF's postal address in the licencing statements for source files. This is a minor change, mostly for the benefit of tying up loose ends. ---------------------------------------------------------------------- diff --git a/src/client.c b/src/client.c index 6b3c5a4..a578b81 100644 --- a/src/client.c +++ b/src/client.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/common.h b/src/common.h index c666086..f96a537 100644 --- a/src/common.h +++ b/src/common.h @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. */ #ifndef COMMON_H diff --git a/src/ctx.c b/src/ctx.c index 90dbdbc..dd4e01b 100644 --- a/src/ctx.c +++ b/src/ctx.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/env.c b/src/env.c index c195950..cbf105d 100644 --- a/src/env.c +++ b/src/env.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/file.c b/src/file.c index 5075b77..e00a82b 100644 --- a/src/file.c +++ b/src/file.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/gui.c b/src/gui.c index df1d6a8..d820b15 100644 --- a/src/gui.c +++ b/src/gui.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/log.c b/src/log.c index 0e3f927..45186b2 100644 --- a/src/log.c +++ b/src/log.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/network.c b/src/network.c index 98b1f5a..dfb76fa 100644 --- a/src/network.c +++ b/src/network.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/nogui.c b/src/nogui.c index deeca5b..a02cea7 100644 --- a/src/nogui.c +++ b/src/nogui.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/options.c b/src/options.c index bad281b..25a6e81 100644 --- a/src/options.c +++ b/src/options.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/protocol.c b/src/protocol.c index f579138..218450c 100644 --- a/src/protocol.c +++ b/src/protocol.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/prototypes.h b/src/prototypes.h index 004a576..50b2aec 100644 --- a/src/prototypes.h +++ b/src/prototypes.h @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. */ #ifndef PROTOTYPES_H diff --git a/src/pty.c b/src/pty.c index d44a624..645492b 100644 --- a/src/pty.c +++ b/src/pty.c @@ -17,7 +17,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/resolver.c b/src/resolver.c index 6180113..84133cc 100644 --- a/src/resolver.c +++ b/src/resolver.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/ssl.c b/src/ssl.c index 84c79ee..7797747 100644 --- a/src/ssl.c +++ b/src/ssl.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/sthreads.c b/src/sthreads.c index de8388a..7588f61 100644 --- a/src/sthreads.c +++ b/src/sthreads.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/stunnel.c b/src/stunnel.c index bdb5dd3..3312cca 100644 --- a/src/stunnel.c +++ b/src/stunnel.c @@ -20,7 +20,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/verify.c b/src/verify.c index 72fcdb2..88b010b 100644 --- a/src/verify.c +++ b/src/verify.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL ---------------------------------------------------------------------- -- Rodrigo Gallardo GPG-Fingerprint: 7C81 E60C 442E 8FBC D975 2F49 0199 8318 ADC9 BC28

1 0

[patch] Move shared library into app specific dir
by Luis Rodrigo Gallardo Cruz 14 Sep '07

14 Sep '07

While upgrading the Debian package for stunnel, I noticed that it installs a shared library into /usr/lib/libstunnel.so This is recommended against by Debian policy, because misguided users might end up linking against it. The following (minor) patch moves the library into /usr/lib/stunnel/ which is a better location for it. ---------------------------------------------------------------------- Index: stunnel-4.20/src/Makefile.am =================================================================== --- stunnel-4.20.orig/src/Makefile.am 2007-07-24 20:36:58.000000000 -0500 +++ stunnel-4.20/src/Makefile.am 2007-07-24 20:39:04.000000000 -0500 @@ -17,7 +17,7 @@ # Unix shared library -lib_LTLIBRARIES = libstunnel.la +pkglib_LTLIBRARIES = libstunnel.la libstunnel_la_SOURCES = $(shared_sources) libstunnel_la_LDFLAGS = -avoid-version @@ -27,7 +27,7 @@ # Additional compiler flags -AM_CPPFLAGS = -DLIBDIR='"$(libdir)"' -DCONFDIR='"$(sysconfdir)/stunnel"' -DPIDFILE='"$(prefix)/var/run/stunnel/stunnel.pid"' +AM_CPPFLAGS = -DLIBDIR='"$(pkglibdir)"' -DCONFDIR='"$(sysconfdir)/stunnel"' -DPIDFILE='"$(prefix)/var/run/stunnel/stunnel.pid"' # Win32 executable ---------------------------------------------------------------------- -- Rodrigo Gallardo GPG-Fingerprint: 7C81 E60C 442E 8FBC D975 2F49 0199 8318 ADC9 BC28

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 38, Issue 2
by Saraka, Luc 12 Sep '07

12 Sep '07

-----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of stunnel-users-request(a)mirt.net Sent: Wednesday, September 12, 2007 6:00 AM To: stunnel-users(a)mirt.net Subject: stunnel-users Digest, Vol 38, Issue 2 Send stunnel-users mailing list submissions to stunnel-users(a)mirt.net To subscribe or unsubscribe via the World Wide Web, visit http://stunnel.mirt.net/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)mirt.net You can reach the person managing the list at stunnel-users-owner(a)mirt.net When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. certificates, openssl and stunnel on windows (David Schulberg) 2. [RE] certificates, openssl and stunnel on windows (algol sigfrid) ---------------------------------------------------------------------- Message: 1 Date: Wed, 12 Sep 2007 00:12:02 +1000 From: "David Schulberg" <davids(a)evertech.com.au> Subject: [stunnel-users] certificates, openssl and stunnel on windows To: <stunnel-users(a)mirt.net> Message-ID: <000001c7f47d$be12f030$1401a8c0@microsensexp> Content-Type: text/plain; charset="iso-8859-1" Hi All, Without wishing to sound na?ve I find this whole subject area to be extraordinarily riddled with cryptic explanations of how to configure stunnel to work with a key and certificate. Using openssl I have generated a file including RSA private key and certificate which stunnel running as a server happily digests. Now I want to create the cer file that Windows will happily digest on the client side. Short of ripping the certificate out of the stunnel.pem file that I created using the command openssl req -new -x509 -days 365 -nodes -config stunnel.cnf -out stunnel.pem -keyout stunnel.pem what are the steps to getting that holy grail with a 'cer' extension? Please educate David ------------------------------ Message: 2 Date: Tue, 11 Sep 2007 22:04:38 -0400 (EDT) From: "algol sigfrid" <m1a2(a)lycos.com> Subject: [stunnel-users] [RE] certificates, openssl and stunnel on windows To: <stunnel-users(a)mirt.net> Message-ID: <20070911220438.HM.0000000000001Lm(a)m1a2.bos-mail-wwl12.lycos.com> Content-Type: text/plain; charset="us-ascii" An HTML attachment was scrubbed... URL: http://stunnel.mirt.net/pipermail/stunnel-users/attachments/20070911/f7d 17618/attachment-0001.html ------------------------------ _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users End of stunnel-users Digest, Vol 38, Issue 2 ********************************************

1 0

certificates, openssl and stunnel on windows
by David Schulberg 12 Sep '07

12 Sep '07

Hi All, Without wishing to sound naïve I find this whole subject area to be extraordinarily riddled with cryptic explanations of how to configure stunnel to work with a key and certificate. Using openssl I have generated a file including RSA private key and certificate which stunnel running as a server happily digests. Now I want to create the cer file that Windows will happily digest on the client side. Short of ripping the certificate out of the stunnel.pem file that I created using the command openssl req -new -x509 -days 365 -nodes -config stunnel.cnf -out stunnel.pem -keyout stunnel.pem what are the steps to getting that holy grail with a 'cer' extension? Please educate David

2 1

[RE] certificates, openssl and stunnel on windows
by algol sigfrid 12 Sep '07

12 Sep '07

1 0

Problem with stunnel 4.20 on Fedora 7
by Andrew M Dunn 29 Aug '07

29 Aug '07

I can't get stunnel to run on a freshly-installed Fedora 7 system. It fails with "Error resolving '0.0.0.0': servname is not supported for ai_socktype" but the usual other causes of that error (ie. ports not defined in /etc/services, bad settings in /etc/nsswitch.conf) are not the culprit this time. COMMAND LINE: /usr/sbin/stunnel /home/amdunn/security/stunnel.conf COMMAND OUTPUT: 2007.08.29 11:44:12 LOG3[13614:3086243520]: Error resolving '0.0.0.0': servname is not supported for ai_socktype (EAI_SERVICE) file /home/amdunn/security/stunnel.conf line 10: Failed to resolve accepting address STUNNEL.CONF FILE: ; ; stunnel file for testing 443 access to local http server ; cert=/home/amdunn/security/xxxxxxx key=/home/amdunn/security/yyyyyyy foreground=yes ; ; [sweb] accept=443 ; https port connect=80 ; standard httpd listening port TIMEOUTclose=0 ; must set this or IE waits 60sec on page end client=no STUNNEL -VERSION OUTPUT: stunnel 4.20 on i686-redhat-linux-gnu with OpenSSL 0.9.8b 04 May 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none -- Andrew M. Dunn VE3XAD Managing Director, Axis Computing Technologies Vice-President, South Simcoe Railway www.AndyDunn.CA

1 0

Mac stunnel not attempting to connect to host
by Michael Kreykenbohm 28 Aug '07

28 Aug '07

I'v used FreeBsd with stunnel without problem, so I'm a little stumped that it doesn't work properly on darwin for Mac. I recall that it might get hung up in the ssl certificates, but I can't find where to look and openssl -connect works perfectly. Any help, appreciated. Symptom: The stunnel is running in debug mode, the client makes a connection to stunnel, stunnel reports the connection stunnel does not attempt to connect to the host (the connect string) No messages suggest it is trying, no network logic show it is connecting. (Since I am using it for email, I can not copy and paste from the orginal to send this email) openssl connects fine to the server and get the correct results Any ideas how/ where to find out what is wrong with the Mac. Thanks stunnel 4.20 on i686-apple-darwin8.10.1 with OpenSSL 0.9.7l 28 Sep 2006 Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv4 Auth:LIBWRAP Global options debug = 5 pid = /opt/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /opt/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /opt/local/etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none 2007.08.26 20:28:51 LOG7[207:2684407808]: RAND_status claims sufficient entropy for the PRNG 2007.08.26 20:28:51 LOG7[207:2684407808]: PRNG seeded successfully 2007.08.26 20:28:51 LOG7[207:2684407808]: Certificate: /opt/local/etc/stunnel/stunnel.pem 2007.08.26 20:28:51 LOG7[207:2684407808]: Certificate loaded 2007.08.26 20:28:51 LOG7[207:2684407808]: Key file: /opt/local/etc/stunnel/stunnel.pem 2007.08.26 20:28:51 LOG7[207:2684407808]: Private key loaded 2007.08.26 20:28:51 LOG7[207:2684407808]: SSL context initialized for service pop3s 2007.08.26 20:28:51 LOG7[207:2684407808]: Certificate: /opt/local/etc/stunnel/stunnel.pem 2007.08.26 20:28:51 LOG7[207:2684407808]: Certificate loaded 2007.08.26 20:28:51 LOG7[207:2684407808]: Key file: /opt/local/etc/stunnel/stunnel.pem 2007.08.26 20:28:51 LOG7[207:2684407808]: Private key loaded 2007.08.26 20:28:51 LOG7[207:2684407808]: SSL context initialized for service smtps 2007.08.26 20:28:51 LOG5[207:2684407808]: stunnel 4.20 on i686-apple-darwin8.10.1 with OpenSSL 0.9.7l 28 Sep 2006 2007.08.26 20:28:51 LOG5[207:2684407808]: Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv4 Auth:LIBWRAP 2007.08.26 20:28:51 LOG6[207:2684407808]: file ulimit = 256 (can be changed with 'ulimit -n') 2007.08.26 20:28:51 LOG6[207:2684407808]: FD_SETSIZE = 1024 (some systems allow to increase this value) 2007.08.26 20:28:51 LOG5[207:2684407808]: 125 clients allowed 2007.08.26 20:28:51 LOG7[207:2684407808]: FD 4 in non-blocking mode 2007.08.26 20:28:51 LOG7[207:2684407808]: FD 6 in non-blocking mode 2007.08.26 20:28:51 LOG7[207:2684407808]: FD 7 in non-blocking mode 2007.08.26 20:28:51 LOG7[207:2684407808]: SO_REUSEADDR option set on accept socket 2007.08.26 20:28:51 LOG7[207:2684407808]: pop3s bound to 0.0.0.0:995 2007.08.26 20:28:51 LOG7[207:2684407808]: FD 8 in non-blocking mode 2007.08.26 20:28:51 LOG7[207:2684407808]: SO_REUSEADDR option set on accept socket 2007.08.26 20:28:51 LOG7[207:2684407808]: smtps bound to 0.0.0.0:5526 2007.08.26 20:28:51 LOG7[207:2684407808]: Created pid file /tmp/stunnel.pid 2007.08.26 20:29:04 LOG7[207:2684407808]: pop3s accepted FD=9 from 127.0.0.1:49162 2007.08.26 20:29:04 LOG7[207:25185792]: pop3s started 2007.08.26 20:29:04 LOG7[207:25185792]: FD 9 in non-blocking mode 2007.08.26 20:29:04 LOG7[207:25185792]: FD 10 in non-blocking mode 2007.08.26 20:29:04 LOG7[207:25185792]: FD 11 in non-blocking mode 2007.08.26 20:29:04 LOG7[207:25185792]: Connection from 127.0.0.1:49162 permitted by libwrap 2007.08.26 20:29:04 LOG5[207:25185792]: pop3s accepted connection from 127.0.0.1:49162 2007.08.26 20:29:04 LOG7[207:25185792]: SSL state (accept): before/accept initialization 2007.08.26 20:29:04 LOG7[207:2684407808]: Cleaning up the signal pipe 2007.08.26 20:29:04 LOG6[207:2684407808]: Child process 212 finished with code 0 <<-- at this point I have done nothing but connect to the stunnel, so I don;t know why it should finished with code 0 yet, and has not closed the connect on the other side.

1 0

[RFC,PATCH] Port stunnel to NSS
by Miloslav Trmac 28 Aug '07

28 Aug '07

Hello, As a part of Fedora's atttempt to rely on a single, FIPS certified. crypto implementation[1], I have prepared a port of stunnel to NSS, activated by passing --with-nss to configure. The port relies on a currently unreleased version of nss_compat_ossl[2]. The NSS interface is rather different from OpenSSL, and many options that are configured explicitly by applications with OpenSSL are either not available to applications with NSS, or configured using external tools in a "NSS database", which stores certificates, private keys and configuration settings. In particular: - The EGD (option "EGD") is not supported. - "RSA support" (loading keys as "RSA PRIVATE KEY" instead of "ANY PRIVATE KEY") is irrelevant, keys are stored in the NSS database - DH key exchange is not supported for the server side - compression (option "compression") is not supported - OpenSSL engines (options "engine", "engineCtrl") are not supported; PKCS#11 plugins are configured in the NSS database - CRLs (options "CRLpath", "CRLfile") are not configured; all CRLs stored in the NSS database are used automatically - OCSP (options "OCSP", "OCSPflag") is not supported in the current port; NSS supports OCSP, but a CA certificate must be specified along with the OCSP URL. - OpenSSL options (option "options") are not supported - NTLM authentication for the "CONNECT" protocol is not supported because NSS currently does not implement MD4 - certificates (option "cert") are stored in the NSS database; the "cert" option contains a nickname of a certificate stored in the database - CA certificates (options "CApath", "CAfile") are stored in the NSS database - error_depth on certificate verification failure is not supported To convert an existing stunnel set up to NSS, at minimum it is necessary to: - select a NSS database directory, $SSL_DIR $ certutil -d $SSL_DIR -N - import server and CA certificates: $ certutil -d $SSL_DIR -A -n server_cert_nickname -i server_cert.pem - import server private key: $ openssl pkcs12 -export -in server_key.pem -out server_key.pfx $ pk12util -d $SSL_DIR -i server_key.pfx - modify stunnel.conf to use "server_cert_nickname" instead of path to "server_cert.pem" in "cert" - when starting stunnel, make sure $SSL_DIR is present in the environment I'm afraid the incompatibilities are large, but the current NSS design really requires a database, and it does not work well with separate files. We'd like to include this NSS port of stunnel in Fedora 8 (if it doesn't prove to be too buggy). I'll be grateful for any comments. Mirek [1] http://fedoraproject.org/wiki/FedoraCryptoConsolidation [2] http://rcritten.fedorapeople.org/nss_compat_ossl.html

1 0

RFC3280 support
by Nagasundaram, Sekhar 22 Aug '07

22 Aug '07

Hello: I have hopefully a quick question. Does Stunnel support reason codes identified in RFC 3280? Thanks all Regards Sekhar Nagasundaram <<Nagasundaram, Sekhar.vcf>>

1 0

Will stunnel service need to be restarted after the configuration changes.
by Zhijiang Lu 15 Aug '07

15 Aug '07

Hi All, After some changes being made to the stunnel configuration file, do I need to restart the stunnel service to pick up the changes? I would think it is desirable to load up the new configurations, and make runtime changes correspondingly. Restarting stunnel will disrupt the currently running sessions. Thanks, -Mark

2 1

Application level encryption or driver level encryption
by atsushi kataoka 12 Aug '07

12 Aug '07

Hi, I have to secure one of my proprietary remote connection server running on windows XP . One option is to secure using the stunnel.Other options are writing some drivers for windows. Presently we are evaluating which option is better whether to opt for application level - stunnel or go for driver - some network filter driver. Can somebody tell me what will be advantages of following application level approach. One more point what is the impact on the performance of using stunnel. Regards.

1 0

Stunnel writing strange timestamps into my logs
by Van 10 Aug '07

10 Aug '07

I was looking through /var/log/messages for another reason and I notice this (representitive log snippet below) It's 10:50 am and while automount is writing messages that jibe with the correct time (see line 5 for example. This part of my log is from about 90 min ago), stunnel seems to be 4 hours ahead, labelling things as happening at about 1pm while everything else is happening about 9am. Where is stunnel getting it's time from? And why a separate source? How can I correct this? - Van Aug 10 13:13:01 <myserver> stunnel: LOG5[29760:3086109600]: pop3s connected remote server from 127.0.0.1:54923 Aug 10 13:13:03 <myserver> stunnel: LOG5[29760:3086109600]: Connection closed: 211 bytes sent to SSL, 56 bytes sent to socket Aug 10 13:13:34 <myserver> stunnel: LOG5[29760:3086109600]: imaps accepted connection from XX.XX.61.109:1409 Aug 10 13:13:34 <myserver> stunnel: LOG5[29760:3086109600]: imaps connected remote server from 127.0.0.1:54927 Aug 10 09:14:13 <myserver> automount[30173]: >> mount: mount to NFS server 'mgm' failed: System Error: Connection timed out. Aug 10 09:14:13 <myserver> automount[30173]: mount(nfs): nfs: mount failure mgm:/bmgm on /nfs/bmgm Aug 10 09:14:13 <myserver> automount[30173]: failed to mount /nfs/bmgm Aug 10 13:14:18 <myserver> stunnel: LOG5[29760:3086109600]: Connection closed: 1013 bytes sent to SSL, 271 bytes sent to socket Aug 10 13:16:02 <myserver> stunnel: LOG5[29760:3086109600]: pop3s accepted connection from XX.XX.61.195:1057 Aug 10 13:16:02 <myserver> stunnel: LOG5[29760:3086109600]: pop3s connected remote server from 127.0.0.1:54947 Aug 10 13:16:02 <myserver> stunnel: LOG5[29760:3086109600]: Connection closed: 150 bytes sent to SSL, 41 bytes sent to socket Aug 10 13:18:01 <myserver> stunnel: LOG5[29760:3086109600]: pop3s accepted connection from 71.167.170.42:60220 Aug 10 13:18:01 <myserver> stunnel: LOG5[29760:3086109600]: pop3s connected remote server from 127.0.0.1:54948 Aug 10 13:18:03 <myserver> stunnel: LOG5[29760:3086109600]: Connection closed: 211 bytes sent to SSL, 56 bytes sent to socket Aug 10 13:18:39 <myserver> stunnel: LOG5[29760:3086109600]: imaps accepted connection from XX.XX.61.109:1410 Aug 10 13:18:39 <myserver> stunnel: LOG5[29760:3086109600]: imaps connected remote server from 127.0.0.1:54952 Aug 10 13:19:23 <myserver> stunnel: LOG5[29760:3086109600]: Connection closed: 1013 bytes sent to SSL, 271 bytes sent to socket Aug 10 09:20:31 <myserver> automount[30282]: >> mount: mount to NFS server 'mgm' failed: System Error: Connection timed out. Aug 10 09:20:31 <myserver> automount[30282]: mount(nfs): nfs: mount failure mgm:/bmgm on /nfs/bmgm Aug 10 09:20:31 <myserver> automount[30282]: failed to mount /nfs/bmgm Aug 10 13:23:01 <myserver> stunnel: LOG5[29760:3086109600]: pop3s accepted connection from 71.167.170.42:60225

1 0

Tunneling though an Http proxy
by Honka 10 Aug '07

10 Aug '07

Hi there, i'm trying to set up stunnel on my laptop which I use at work, and i'm trying to tunnel to my home pc for remote desktop. The only open ports on the work network are 8080, 80 and 443. So I have setup the tunnel to port 8080 onto my home pc and had it working across the network at home. (via internal and external ip's) however it isn't working here. I am assuming because we have an http proxy which requires authentication. So i'm wondering, how can I make stunnel use and authenticate with this proxy so that it will work? Cheers Honka

1 0

Make Install Error
by Morris Hooten - SLS Business Infrastructure 05 Aug '07

05 Aug '07

why do i get this when running make install at the very end? i'm trying to install in a full root solaris 10 zone thanks SunOS mknod: Not owner chmod: WARNING: can't access /usr/local/var/lib/stunnel/dev/zero make[2]: *** [install-data-local] Error 1 make[2]: Leaving directory `/stunnel/stunnel-4.20/tools' make[1]: *** [install-am] Error 2 make[1]: Leaving directory `/stunnel/stunnel-4.20/tools' make: *** [install-recursive] Error 1

1 0

Make Install Error
by Morris Hooten - SLS Business Infrastructure 05 Aug '07

05 Aug '07

why do i get this when running make install at the very end? thanks SunOS mknod: Not owner chmod: WARNING: can't access /usr/local/var/lib/stunnel/dev/zero make[2]: *** [install-data-local] Error 1 make[2]: Leaving directory `/stunnel/stunnel-4.20/tools' make[1]: *** [install-am] Error 2 make[1]: Leaving directory `/stunnel/stunnel-4.20/tools' make: *** [install-recursive] Error 1

1 0

Make Install Error
by Morris Hooten - SLS Business Infrastructure 05 Aug '07

05 Aug '07

why do i get this when running make install at the very end? thanks SunOS mknod: Not owner chmod: WARNING: can't access /usr/local/var/lib/stunnel/dev/zero make[2]: *** [install-data-local] Error 1 make[2]: Leaving directory `/stunnel/stunnel-4.20/tools' make[1]: *** [install-am] Error 2 make[1]: Leaving directory `/stunnel/stunnel-4.20/tools' make: *** [install-recursive] Error 1

1 0

Stunnel message about SSL_shutdown/SSL_get_error
by Lachance, Mario 03 Aug '07

03 Aug '07

Hi, I have been using openssl_0.9.7g and stunnel_4.10 on Solaris 9 without problem for 2 years in a production environment. I want to upgrade to openssl_0.9.8e and stunnel_4.20 on solaris 10. I have done some test on a development system and I have seen a new message in stunnel log file. Old message with openssl_0.9.7g and stunnel_4.10 on Solaris 9 was : Aug 3 14:51:58 solario stunnel[345]: [ID 702911 local6.notice] Too many retries on SSL shutdown New message with openssl_0.9.8e and stunnel_4.20 on solaris 10 is : Aug 3 14:42:30 daprxuu stunnel: [ID 821868 local6.error] LOG3[20957:4]: SSL_shutdown/SSL_get_error returned 6 I don't know if this new message has replaced the old one I was getting. Can someone tell me what is behind this message "_shutdown/SSL_get_error returned 6"? Please note that I am able to transfer message with both system (stunnel 4.10 and stunnel 4.20) from a windows client without any apparent problem. Thank you for your help, Mario Avis de confidentialité: Ce message est confidentiel, protégé par le secret professionnel et à l'usage exclusif du destinataire. Toute autre personne est avisée qu'il lui est strictement interdit de le diffuser, distribuer ou reproduire. Si vous avez reçu ce message par erreur, avisez-nous immédiatement par téléphone et effacez toute copie. Confidentiality Notice: This e-mail is confidential, privileged and intended for the exclusive use of the addressee. Any other person is strictly prohibited from disclosing, distributing or reproducing it. If you have received this e-mail by mistake, please notify us immediately by telephone and delete all copies.

1 0

Re: [stunnel-users] stunnel hanging during negotation with an smtp server
by Hans Werner Strube 01 Aug '07

01 Aug '07

Jason J. Corso wrote: > [ssmtp] > accept = 127.0.0.1:25 > connect = xxxxxx:465 > protocol = smtp > ------- > > However, when I try to send a mail, it appears to hang while > negotiating with the remote server. Here is the output: ... > 2007.07.31 15:41:25 LOG7[5511:25183744]: Negotiations for smtp(server > side) started > 2007.07.31 15:41:25 LOG7[5511:25183744]: RFC 2487 detected Your stunnel seems to be running in server mode. For client mode, add client = yes Also, if you need pure SSL rather than TLS negotiation, remove protocol = smtp

2 1

stunnel hanging during negotation with an smtp server
by Jason J. Corso 31 Jul '07

31 Jul '07

Please help: I'm trying to use stunnel to connect to a secure SMTP server -- I'm using MS Entourage 2004 on an Intel 10.4 Mac. Entourage cannot connect directly to the SMTP server over SSL because it no longer supports NTLM version 1 authentication, which the SMTP server uses. I believe stunnel can be used to workaround this problem (if I'm wrong, please say so), i.e., Entourage can connect locally to stunnel which will then connect to the remote server over SSL properly. I built and installed stunnel version 4.04-12 via Fink (compiled from source via Fink) and OpenSSL 0.9.7i-4 also via Fink. I have the following configuration file: ------ # Comment it out on Win32 cert = /sw/etc/stunnel/stunnel.pem chroot = /sw/var/run/stunnel/ # PID is created inside chroot jail pid = /stunnel.pid setuid = nobody setgid = nogroup # Some debugging stuff debug = 7 output = /dev/stdout foreground = yes [ssmtp] accept = 127.0.0.1:25 connect = xxxxxx:465 protocol = smtp ------- However, when I try to send a mail, it appears to hang while negotiating with the remote server. Here is the output: 2007.07.31 15:41:19 LOG5[5511:2684407808]: stunnel 4.04 on i386-apple-darwin8.10.1 PTHREAD+LIBWRAP with OpenSSL 0.9.7i 14 Oct 2005 2007.07.31 15:41:19 LOG7[5511:2684407808]: Snagged 64 random bytes from xxx/.rnd 2007.07.31 15:41:19 LOG7[5511:2684407808]: Wrote 1024 new random bytes to xxx/.rnd 2007.07.31 15:41:19 LOG7[5511:2684407808]: RAND_status claims sufficient entropy for the PRNG 2007.07.31 15:41:19 LOG6[5511:2684407808]: PRNG seeded successfully 2007.07.31 15:41:19 LOG7[5511:2684407808]: Certificate: /sw/etc/stunnel/stunnel.pem 2007.07.31 15:41:19 LOG7[5511:2684407808]: Key file: /sw/etc/stunnel/stunnel.pem 2007.07.31 15:41:19 LOG5[5511:2684407808]: FD_SETSIZE=1024, file ulimit=256 -> 125 clients allowed 2007.07.31 15:41:19 LOG7[5511:2684407808]: FD 6 in non-blocking mode 2007.07.31 15:41:19 LOG7[5511:2684407808]: SO_REUSEADDR option set on accept socket 2007.07.31 15:41:19 LOG7[5511:2684407808]: ssmtp bound to 127.0.0.1:25 2007.07.31 15:41:19 LOG7[5511:2684407808]: FD 7 in non-blocking mode 2007.07.31 15:41:19 LOG7[5511:2684407808]: FD 8 in non-blocking mode 2007.07.31 15:41:19 LOG7[5511:2684407808]: Created pid file /stunnel.pid 2007.07.31 15:41:25 LOG7[5511:2684407808]: ssmtp accepted FD=9 from 127.0.0.1:50091 2007.07.31 15:41:25 LOG7[5511:2684407808]: FD 9 in non-blocking mode 2007.07.31 15:41:25 LOG7[5511:25183744]: ssmtp started 2007.07.31 15:41:25 LOG5[5511:25183744]: ssmtp connected from 127.0.0.1:50091 2007.07.31 15:41:25 LOG7[5511:25183744]: FD 10 in non-blocking mode 2007.07.31 15:41:25 LOG7[5511:25183744]: ssmtp connecting xxx.xxx.xxx.xxx:465 2007.07.31 15:41:25 LOG7[5511:25183744]: remote connect #1: EINPROGRESS: retrying 2007.07.31 15:41:25 LOG7[5511:25183744]: waitforsocket: FD=10, DIR=write 2007.07.31 15:41:25 LOG7[5511:25183744]: waitforsocket: ok 2007.07.31 15:41:25 LOG7[5511:25183744]: Remote FD=10 initialized 2007.07.31 15:41:25 LOG7[5511:25183744]: Negotiations for smtp(server side) started 2007.07.31 15:41:25 LOG7[5511:25183744]: RFC 2487 detected 2007.07.31 15:41:25 LOG7[5511:25183744]: waitforsocket: FD=10, DIR=read ********* HANGS HERE *********** ...and I have to kill it. I am very new to stunnel and openssl. So, I may be making a simple mistake. But, I could not find the solution on the mailing list or the web. What am I doing wrong? To be clear, the server is using SSL for SMTP. I am able to send mail directly via the smtp server from other mail clients like Thunderbird. Thanks. Any help is much appreciated. Jason

1 0

Re: [stunnel-users] Stunnel Scalability Question
by Ankur Upadhyaya 30 Jul '07

30 Jul '07

Hi Michal, Thank you for your help with this. My stunnel -version output can be found below. Ankur stunnel 4.20 on i686-pc-linux-gnu with OpenSSL 0.9.8b 04 May 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none

2 1

Stunnel on Freebsd not running
by The Volo 30 Jul '07

30 Jul '07

i recently installed the latest stable version 4.20 on a shell running freebsd, i dont have root i had to install it on my account. Compile was successfull, i renamed the default stunnel.conf.. and edited it, i am running stunnel as a client and added this line at the end of stunnel.conf: [eggdrop] accept = 127.0.0.1:12345 connect = irc.efnet.net:6667 when i run stunnel it doesnt do nothing besides sending me to a new bash command line.. [volo@partyline (~/)]$ /home/volo/stunnel/sbin/stunnel /home/volo/stunnel/etc/stunnel/stunnel.conf [volo@partyline (~/)]$ I type ps -x to see if stunnel is running but i dont see it on the list and no pid file exist either. Any ideas on how i can fix this ? i dont see what i am doing wrong trying to run stunnel.. Trying to run stunnel to connect to irc and my eggdrop to connect to stunnel access ip:port thanks

2 1

Automatically Stopping Stunnel
by Brian Mander 19 Jul '07

19 Jul '07

We have stunnel configured to accept connections on a port from an outside company and forward it to a port where we have a tcplistener set up. The problem is that if our tcplistener goes down the company sending us info does not have their software configured to know if we get their info or not. Is there a way to stop allowing connections or shut stunnel down if it can not connect to the port. I hope this is enough information. Brian Mander Programmer Analyst II Omni Hotels (402) 952-6564 bmander(a)omnihotels.com <mailto:[email protected]> Learn more about Omni Hotels sensational summer vacation packages <http://www.omnihotels.com/exclusiveoffers/summer07.aspx> ideal for exploring great destinations with family and friends.

1 0

Stunnel Scalability Question
by Ankur Upadhyaya 18 Jul '07

18 Jul '07

Hi, I have an application with the following characteristics and am trying to determine if Stunnel would be a suitable option for securing my transmissions (in particular, will it scale): - Each of my clients is connected to the Internet via a 56Kbps modem. My server has whatever bandwidth it needs. - Each client "transaction" consists of (a) connecting to a central server using a TCP/IP-based protocol, (b) uploading a 512KB block of data and (c) disconnecting. - Our server needs to be able to handle 2000 concurrent clients under peak loads. - Under the peak load above, I would like to limit the time a client takes to perform a "transaction" to around five minutes or so (uploading 512KB at (56Kbps / 2) = 28Kbps should take ~2.5 minutes). My questions are: (1) Do I have any reason to believe that Stunnel will simply not be able to scale to handle the load described above (i.e. a steady load of 2000 concurrent clients connecting, uploading half a megabyte of data and disconnecting)? (2) If Stunnel can handle this - do you have any thoughts on what sort of machine (or machines) I should be running my server-side Stunnel daemon(s) on? I am particularly concerned about CPU usage. I apologize in advance for any overlap between this query and past threads in the archive/information on the website - I wanted to make sure that I ran the specific requirements above past somebody with experience using Stunnel. Thanks, Ankur

1 0

bind error
by ictforever 07 Jul '07

07 Jul '07

Hi,I use stunnel 4.20 with syslog-ng 2.0,os is centos 5.0.but there are bind errors: ........................... 2007.06.22 05:56:36 LOG7[2898:3086632640]: SO_REUSEADDR option set on accept socket 2007.06.22 05:56:36 LOG3[2898:3086632640]: Error binding 5141 to 192.168.0.1:5141 2007.06.22 05:56:36 LOG3[2898:3086632640]: bind: Cannot assign requested address (99) The stunnel conf : ............................ cert = /usr/local/stunnel/etc/stunnel/syslog-ng-server.pem CAfile = /usr/local/stunnel/etc/stunnel/syslog-ng-client.pem [5141] accept = 192.168.0.1:5141 connect = 127.0.0.1:514 How to correct it?Any suggestion and advice are appreciated. Thanks. Regards.

3 2

stunnel on windows 2003
by John M. Andre 06 Jul '07

06 Jul '07

I've looked around the site, through the help file, and through the archives but I still can't find the answer to my question. I hope someone on this list can give me some insight. I am new to SSL but I have a brand new server and I'm trying to set it up to use stunnel to secure communications over POP, IMAP, SMTP, etc. However, as I look through the documentation, it is clearly written for unix admins. Is there anything that will guide someone how to setup stunnel on windows? Ideally a step-by-step but anything would be nice. Thanks, John

1 0

Out-of-band data
by Richard's Hotmail 04 Jul '07

04 Jul '07

Hi, In the Stunnel FAQ (see snippet below) it says that STUNNEL does not support OOB processing (except if OOB is set to in-line); can someone please tell me if this restriction is still in place? Does OpenSSL not support the sending and receiving of the OOB character? Some other restriction? Cheers Richard Maher Can I use stunnel to protect [insert random protocol here]? Stunnel should be able to secure any random protocol as long as the protocol satisfies the following requirements: 1.. The protocol is TCP, not UDP. 2.. The protocol doesn't use multiple connections, like ftp. 3.. The protocol doesn't depend on Out Of Band (OOB) data, 4.. Remote site can't use an application-specific protocol, like ssltelnet, where SSL is a negotiated option, save for those protocols already supported by the -n argument to Stunnel.

1 0

HTTPS Connect patches for 4.20
by Gym Crazy 02 Jul '07

02 Jul '07

Hi Folks Wonder if you can help me. A predecessor of mine set up stunnel version 4.05 on OpenBSD 3.8. He didn't leave much documentation unfortunately. He also used a patch and re-compiled it. That patch was connect-proxy.mwald.patch. We are getting some performance issues and want to of course move to the latest stable stunnel release 4.20, before asking for any help but we are in a bit of a bind. We are firstly not sure if there is an updated connect-proxy.mwald.patch that works well with stunnel 4.20 (I have searched and searched but can't seem to find any). Or else if there is a patch that performs the same type of function as connect-proxy.mwald.patch but that is stable to use with stunnel 4.20. Any help would be greatly appreciated :-D Regards Paul H ____________________________________________________________________________________ Luggage? GPS? Comic books? Check out fitting gifts for grads at Yahoo! Search http://search.yahoo.com/search?fr=oni_on_mail&p=graduation+gifts&cs=bz

1 0

Re: [stunnel-users] Certificates and public/private keys
by Dario Teixeira 28 Jun '07

28 Jun '07

> Should you not be looking at > http://httpd.apache.org/docs/2.0/ssl/ssl_howto.html > and > https://www.opensc-project.org/files/doc/apache-client-authentication(v0 > .5.1).pdf Hi, Thanks for the reply! I didn't mention it before, but I won't be using Apache or any other mainstream webserver. Most likely I will be using Ocsigen (http://www.ocsigen.org/) Now, the latest development release of Ocsigen already has basic support for SSL, but it can't handle yet client authentication. In short, I am still looking for an stunnel-based solution. Any ideas? Thanks again for your time and attention! Cheers, Dario ___________________________________________________________ Yahoo! Answers - Got a question? Someone out there knows the answer. Try it now. http://uk.answers.yahoo.com/

2 1

HTTPS Connect patches for 4.20
by Gym Crazy 28 Jun '07

28 Jun '07

Hi Folks Wonder if you can help me. A predecessor of mine set up stunnel version 4.05 on OpenBSD 3.8. He didn't leave much documentation unfortunately. He also used a patch and re-compiled it. That patch was connect-proxy.mwald.patch. We are getting some performance issues and want to of course move to the latest stable stunnel release 4.20, before asking for any help but we are in a bit of a bind. We are firstly not sure if there is an updated connect-proxy.mwald.patch that works well with stunnel 4.20 (I have searched and searched but can't seem to find any). Or else if there is a patch that performs the same type of function as connect-proxy.mwald.patch but that is stable to use with stunnel 4.20. Any help would be greatly appreciated :-D Regards Paul H ____________________________________________________________________________________ Looking for a deal? Find great prices on flights and hotels with Yahoo! FareChase. http://farechase.yahoo.com/

1 0

Certificates and public/private keys
by Dario Teixeira 27 Jun '07

27 Jun '07

Dear Stunnel users, I have a webserver running on a machine behind a firewall. I can easily punch a hole on the firewall, allowing any user on the Internet to access the webserver. However, I want to restrict access *only* to some people, those in possession of a secret key. At first sight, this seems like a job for plain ssh tunneling rather than stunnel, but as far as I understand it, ssh tunnels require that the connecting users have an account on the server machine. That won't happen here. It seems that stunnel is therefore more appropriate for this particular problem. Now, the port forwarding mechanics seem similar to those in ssh. I have no problems understanding those. The only problems I am having are figuring out the generation of keys. My excuses if I am using a terminology based on ssh or if I am way off about the capabilities of stunnel, but how can I generate the server's private and public keys? (the latter to be handed out to the clients) I have followed the instructions in the README.Debian file that accompanies the Debian stunnel4 package to produce a stunnel.pem certificate. With it, I have successfully established a stunnel connection between two machines. However, I have to use the same stunnel.pem file on both the client and the server, which strikes me as dangerous. Which parts are really needed on the client and server? Thanks in advance for your help! Cheers, Dario ___________________________________________________________ Yahoo! Answers - Got a question? Someone out there knows the answer. Try it now. http://uk.answers.yahoo.com/

2 1

Preferred way to start stunnel @boot time
by Van 27 Jun '07

27 Jun '07

So I've got stunnel running perfectly on my linux server to forward ssl requests to my pop and imap ports. I need to make sure this happens automatically if the machine is rebooted. On the stunnel site it talks about running stunnel either as a daemon or running stunnel out of xinetd. I was just wondering, which way do people using it out there think is preferable? And why? Neither seems as direct or simple as putting @reboot root /sbin/start_stunnel into my crontab, which is what I did (start_stunnel being a shell script with the proper command and some comments). Just another uneventful way to do the same thing? -Van

2 1

Java Applet Client for STUNNEL-fronted server
by Richard's Hotmail 22 Jun '07

22 Jun '07

Hi, I'm new to the list and apologize if this question is inappropriate, or quite basic, but I really hope someone can help. I currently have an intranet-resident JAVA Applet that connects back to the Application Server via standard TCP/IP sockets using the java.net.Socket class, and everything is peachy. What I'm looking at doing now is making it Internet friendly by providing host authentication (don't care about client authentication at the mo) and strong cryptography between client and server. OpenSSL and Stunnel (I don't want to have to make the Application Server SSL compatible if I don't have to) are available on the server box therefore I would dearly love an example of a JAVA client that can talk javax.net.SSL (or something else) to a Stunnel-fronted server. (Less is definitely more here - The least number of client keys and or certificate-generations the better!) Can anyone please help me with this? Obviously example-code would be ideal, as would first-hand accounts of the trials and tribulations, but I'll certainly settle for web-references to the appropriate docs or other relevant material! Are all the JSSE libraries/code reqd bundled with the JDK and runtime JVM ready? Is there a better way? (Sadly IPsec is not an option here) Maybe there's an alternate solution that can preserve the client's true IP address and present it to the Application Server's "Listen"? Cheers Richard Maher

1 0

Re: [stunnel-users] Trying to get stunnel to work for forwarding pop3sto ipop3 port
by Van 21 Jun '07

21 Jun '07

Getting closer. I now get- [van@mailserver ]$ sudo stunnel /usr/local/etc/stunnel/stunnel.conf localhost:ipop3 2007.06.21 11:51:27 LOG4[15899:3086476992]: Wrong permissions on /usr/ local/etc/stunnel/mail.pem 2007.06.21 11:51:27 LOG4[15899:3086476992]: Wrong permissions on /usr/ local/etc/stunnel/mail.pem 2007.06.21 11:51:27 LOG4[15899:3086476992]: Wrong permissions on /usr/ local/etc/stunnel/mail.pem But that doesn't make sense to me. mail.pem permissions are the same as my cert's and it works fine. [van@mailserver change_passwd]$ ls -al /usr/local/etc/stunnel/mail.pem -rw-r--r-- 1 root root 2942 Jun 20 18:21 /usr/local/etc/stunnel/ mail.pem [van@mailserver change_passwd]$ ls -al /etc/httpd/certs/www.crt -rw-r--r-- 1 root root 1074 Jun 1 12:30 /etc/httpd/certs/www.crt Is the error misleading? Or what should the mail.pem perms be? Van On Jun 20, 2007, at 9:33 PM, Kevin Cook wrote: > > If you are using a stunnel.conf file, I would replace the '-d pop3s > -r' > with the absolute path to the .conf file: > > sudo /usr/local/sbin/stunnel /usr/local/etc/stunnel/stunnel.conf > > I believe command line options were typically used more in older > versions, but now all configuration is done in the configuration file. > > > Kevin > > -----Original Message----- > From: Van [mailto:[email protected]] > Sent: Wednesday, June 20, 2007 6:03 PM > To: stunnel-users(a)mirt.net > Subject: [stunnel-users] Trying to get stunnel to work for forwarding > pop3sto ipop3 port > > Hello, > > This is my introduction to stunnel. I've inherited control of a > pop3 and > imap server running Red Hat Linux 4 that I want to access via pop3s > and > imaps. I'm starting out with securing the pop3 since most users are > using it. > > I downloaded stunnel 4.20 and compiled it according to the > instructions > on stunnel.org. > > I read the certificates section of the site and made a new .pem file > that I named mail.pem and have in the /usr/local/etc/stunnel/ > directory > that /usr/local/etc/stunnel/stunnel.conf asks for. But when I try to > run stunnel like in the Examples section I get : > > [van@mailserver ~]$ sudo /usr/local/sbin/stunnel -d pop3s -r > localhost:ipop3 > 2007.06.20 17:59:54 LOG3[25516:3086419648]: -d: No such file or > directory (2) > Syntax: > stunnel [<filename>] ] -fd <n> | -help | -version | -sockets > <filename> - use specified config file instead of /usr/local/ > etc/stunnel/stunnel.conf > -fd <n> - read the config file from a file descriptor > -help - get config file help > -version - display version and defaults > -sockets - display default socket options > > I'm a little lost here. Never dealt with a .pem file before stunnel. > I have a self-signed cert I'm successfully using for https webmail on > the server and guessing stunnel couldn't see that, I appended my file > 'mailserver.crt' into my mail.pem file and edited stunnel.conf so it > has > > ;CAfile = /usr/local/etc/stunnel/certs.pem CAfile = > /usr/local/etc/stunnel/mail.pem > > but no dice. Same result. > > Trying to debug, I find 'stunnel -V' also gives the same result. > > Can someone point out what's going wrong? > > > -Van > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > >

2 2

Trying to get stunnel to work for forwarding pop3s to ipop3 port
by Van 21 Jun '07

21 Jun '07

Hello, This is my introduction to stunnel. I've inherited control of a pop3 and imap server running Red Hat Linux 4 that I want to access via pop3s and imaps. I'm starting out with securing the pop3 since most users are using it. I downloaded stunnel 4.20 and compiled it according to the instructions on stunnel.org. I read the certificates section of the site and made a new .pem file that I named mail.pem and have in the /usr/local/etc/stunnel/ directory that /usr/local/etc/stunnel/stunnel.conf asks for. But when I try to run stunnel like in the Examples section I get : [van@mailserver ~]$ sudo /usr/local/sbin/stunnel -d pop3s -r localhost:ipop3 2007.06.20 17:59:54 LOG3[25516:3086419648]: -d: No such file or directory (2) Syntax: stunnel [<filename>] ] -fd <n> | -help | -version | -sockets <filename> - use specified config file instead of /usr/local/ etc/stunnel/stunnel.conf -fd <n> - read the config file from a file descriptor -help - get config file help -version - display version and defaults -sockets - display default socket options I'm a little lost here. Never dealt with a .pem file before stunnel. I have a self-signed cert I'm successfully using for https webmail on the server and guessing stunnel couldn't see that, I appended my file 'mailserver.crt' into my mail.pem file and edited stunnel.conf so it has ;CAfile = /usr/local/etc/stunnel/certs.pem CAfile = /usr/local/etc/stunnel/mail.pem but no dice. Same result. Trying to debug, I find 'stunnel -V' also gives the same result. Can someone point out what's going wrong? -Van

1 0

stunnel client mode and CA chains
by Domenico Andreoli 13 Jun '07

13 Jun '07

Hi, I have always successfully used openssl/stunnel but now I am facing a new problem, a variation of the usual client-side authentication documentented everywhere. I have a root CA and child CA which is signed by the root one. I have also a client certificate that is signed only by the child CA. In order to verify the certificate signature using openssl I need to specify both the CA certificates, this works as expected. What I would like to achieve is to authenticate the clients using a stunnel server having only the root CA certificate. Is there some stunnel client configuration switch that allows to push the child CA certificate? One looking interesting is (from the manpage): cert = pemfile certificate chain PEM file name A PEM is always needed in server mode. Specifying this flag in client mode will use this certificate chain as a client side certificate chain. Using client side certs is optional. The certificates must be in PEM format and must be sorted starting with the certificate to the highest level (root CA). in particular "The certificates must be in PEM format and must be sorted starting with the certificate to the highest level (root CA)" lets me hope but I am not able to understand how it works. I made many tries but on server side I always get a "VERIFY ERROR: depth=1, error=invalid CA certificate:" referring to the child CA certificate and then a "SSL3_GET_CLIENT_CERTIFICATE:no certificate returned" followed by connection shutdown. Supposing the client private key is in a separate file, if I put the certificates in the order specified by the manpage I get a key mismatching error upon stunnel startup. If instead I put the client certificate as first, then server do not authenticate it. Where am I wrong? I cannot change the server configuration, it must work as it is. I have hundreds of them and I can update them only using the SSL connection. Thanks for any help. Regards, Domenico -----[ Domenico Andreoli, aka cavok --[ http://www.dandreoli.com/gpgkey.asc ---[ 3A0F 2F80 F79C 678A 8936 4FEE 0677 9033 A20E BC50

1 0

Issue with Stunnel / TCP Wrappers
by Kevin Cook 11 Jun '07

11 Jun '07

I have been a user of Stunnel for several years, but as of recent need to be able to deny TCP/IP requests dynamically on an IP address basis. I am attempting to use TCP wrappers, but not getting it to work with Stunnel. The Solaris 9 implementation I am using currently runs in a chroot'ed environment, so I am placing the hosts.deny file in this path (/chrootpath/etc/hosts.deny), as well as /usr/etc per everything I have read. This is not working. I am using a non-standard port not defined in /etc/services (29444). Any ideas?

1 0

stunnel autostart at boot
by Grant Kohler 11 Jun '07

11 Jun '07

Has anybody created a startup script to load stunnel when a machine boots? Thanks, -Grant

1 0

Re: [stunnel-users] [PATCH?] Senting a list of accepted CAs to the client
by Kevin Martin 07 Jun '07

07 Jun '07

Has anyone any information on this? It affects the ability of Thunderbird users (in this case) to use secure communications with IMAP mail servers using TLS/SSL. Please see the bugzillas below. Thanks. Kevin Martin https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=237962 and list posting from 4/2007: Hello, stunnel currently does not send a list of accepted CAs, see e.g. https://bugzilla.mozilla.org/show_bug.cgi?id=327001 Sending the list was #if 0-ed out sometime between stunnel 3.22 and 4.00, with no change log entry AFAICS. Does anyone remember know why was it disabled, and whether it is safe to reenable (e. g. using the attached patch)? Thanks, Mirek <patch snipped>...see the list posting from 4/2007 above for the attached patch.

1 0

regarding CRLpath
by piyush tewari 07 Jun '07

07 Jun '07

Hi, I m using crl but it is woking only in the case of using CRLfile. That is when I use the CRLfile , the client having the revoked certificate is now not able to connect to the server. But when I m providing the CRLpath in the stunnel config file , the client is still able to connect. That is CRL is working in the case of CRLfile entry and not working in the case of CRLpath. The entry that i have specified is CRLpath = C:\Stunnel\debug\revoked So where is the flaw. I know that in case of the CRLfile , it is necessary to restart the stunnel , whenever the CRL changes. But in case of CRLpath , whether it is necessary to restart the stunnel or not. regards piyush --------------------------------- You snooze, you lose. Get messages ASAP with AutoCheck in the all-new Yahoo! Mail Beta.

1 0

Problem with 'verify=3'
by Koenraad Lelong 05 Jun '07

05 Jun '07

Hi, I would like to have a secure access to a Firebird database server. When I configure verify = 2 on the server I can connect, but I would like to have verify = 3 and this does not work. This is my stunnel.conf : client = no foreground = yes setuid = stunnel setgid = nogroup pid = /var/run/stunnel.pid debug = 7 output = /var/log/stunnel.log socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 3 CApath = /etc/stunnel/certs/ CAfile = /etc/stunnel/cacert.pem cert = /etc/stunnel/server.pem [firebird] accept = 3052 connect = localhost:gds_db output of stunnel -version : stunnel 4.14 on i686-suse-linux-gnu PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 Global options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /etc/stunnel/stunnel.pem pid = /var/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds I'm running OpenSuse 10.1 on the server. This is the log when I can't connect (verify = 3) : 2007.06.05 13:18:55 LOG5[15150:3083052720]: stunnel 4.14 on i686-suse-linux-gnu PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 2007.06.05 13:18:55 LOG7[15150:3083052720]: Snagged 64 random bytes from /root/.rnd 2007.06.05 13:18:55 LOG7[15150:3083052720]: Wrote 1024 new random bytes to /root/.rnd 2007.06.05 13:18:55 LOG7[15150:3083052720]: RAND_status claims sufficient entropy for the PRNG 2007.06.05 13:18:55 LOG6[15150:3083052720]: PRNG seeded successfully 2007.06.05 13:18:55 LOG7[15150:3083052720]: Certificate: /etc/stunnel/server.pem 2007.06.05 13:18:55 LOG7[15150:3083052720]: Key file: /etc/stunnel/server.pem 2007.06.05 13:18:55 LOG7[15150:3083052720]: Loaded verify certificates from /etc/stunnel/cacert.pem 2007.06.05 13:18:55 LOG7[15150:3083052720]: Verify directory set to /etc/stunnel/certs/ 2007.06.05 13:18:55 LOG5[15150:3083052720]: Peer certificate location /etc/stunnel/certs/ 2007.06.05 13:18:55 LOG6[15150:3083052720]: file ulimit = 1024 (can be changed with 'ulimit -n') 2007.06.05 13:18:55 LOG6[15150:3083052720]: poll() used - no FD_SETSIZE limit for file descriptors 2007.06.05 13:18:55 LOG5[15150:3083052720]: 500 clients allowed 2007.06.05 13:18:55 LOG7[15150:3083052720]: FD 5 in non-blocking mode 2007.06.05 13:18:55 LOG7[15150:3083052720]: FD 6 in non-blocking mode 2007.06.05 13:18:55 LOG7[15150:3083052720]: FD 7 in non-blocking mode 2007.06.05 13:18:55 LOG7[15150:3083052720]: SO_REUSEADDR option set on accept socket 2007.06.05 13:18:55 LOG7[15150:3083052720]: firebird bound to 0.0.0.0:3052 2007.06.05 13:18:55 LOG7[15150:3083052720]: Created pid file /var/run/stunnel.pid 2007.06.05 13:19:02 LOG7[15150:3083052720]: firebird accepted FD=8 from 192.168.0.13:25651 2007.06.05 13:19:02 LOG7[15150:3083049888]: firebird started 2007.06.05 13:19:02 LOG7[15150:3083049888]: FD 8 in non-blocking mode 2007.06.05 13:19:02 LOG7[15150:3083049888]: TCP_NODELAY option set on local socket 2007.06.05 13:19:02 LOG7[15150:3083049888]: FD 9 in non-blocking mode 2007.06.05 13:19:02 LOG7[15150:3083049888]: FD 11 in non-blocking mode 2007.06.05 13:19:02 LOG7[15150:3083052720]: Cleaning up the signal pipe 2007.06.05 13:19:02 LOG6[15150:3083052720]: Child process 15152 finished with code 0 2007.06.05 13:19:02 LOG7[15150:3083049888]: Connection from 192.168.0.13:25651 permitted by libwrap 2007.06.05 13:19:02 LOG5[15150:3083049888]: firebird connected from 192.168.0.13:25651 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): before/accept initialization 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 read client hello A 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write server hello A 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write certificate A 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write certificate request A 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 flush data 2007.06.05 13:19:02 LOG5[15150:3083049888]: VERIFY OK: depth=1, /C=BE/ST=Vlaams Brabant/L=Diest/O=ACE electronics n.v./OU=IT/CN=Certificate Authority/emailAddress=postmaster.ace-electronics.be 2007.06.05 13:19:02 LOG4[15150:3083049888]: VERIFY ERROR ONLY MY: no cert for /C=BE/ST=Vlaams Brabant/L=Diest/O=ACE electronics n.v./OU=IT/CN=client/emailAddress=postmaster.ace-electronics.be 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL alert (write): fatal: certificate unknown 2007.06.05 13:19:02 LOG3[15150:3083049888]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2007.06.05 13:19:02 LOG7[15150:3083049888]: firebird finished (0 left) 2007.06.05 13:19:04 LOG7[15150:3083052720]: firebird accepted FD=8 from 192.168.0.13:25653 2007.06.05 13:19:04 LOG7[15150:3083049888]: firebird started 2007.06.05 13:19:04 LOG7[15150:3083049888]: FD 8 in non-blocking mode 2007.06.05 13:19:04 LOG7[15150:3083049888]: TCP_NODELAY option set on local socket 2007.06.05 13:19:04 LOG7[15150:3083049888]: FD 9 in non-blocking mode 2007.06.05 13:19:04 LOG7[15150:3083049888]: FD 11 in non-blocking mode 2007.06.05 13:19:04 LOG7[15150:3083052720]: Cleaning up the signal pipe 2007.06.05 13:19:04 LOG6[15150:3083052720]: Child process 15154 finished with code 0 2007.06.05 13:19:04 LOG7[15150:3083049888]: Connection from 192.168.0.13:25653 permitted by libwrap 2007.06.05 13:19:04 LOG5[15150:3083049888]: firebird connected from 192.168.0.13:25653 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): before/accept initialization 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 read client hello A 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write server hello A 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write certificate A 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write certificate request A 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 flush data 2007.06.05 13:19:04 LOG5[15150:3083049888]: VERIFY OK: depth=1, /C=BE/ST=Vlaams Brabant/L=Diest/O=ACE electronics n.v./OU=IT/CN=Certificate Authority/emailAddress=postmaster.ace-electronics.be 2007.06.05 13:19:04 LOG4[15150:3083049888]: VERIFY ERROR ONLY MY: no cert for /C=BE/ST=Vlaams Brabant/L=Diest/O=ACE electronics n.v./OU=IT/CN=client/emailAddress=postmaster.ace-electronics.be 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL alert (write): fatal: certificate unknown 2007.06.05 13:19:04 LOG3[15150:3083049888]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2007.06.05 13:19:04 LOG7[15150:3083049888]: firebird finished (0 left) 2007.06.05 13:19:09 LOG3[15150:3083052720]: Received signal 2; terminating 2007.06.05 13:19:09 LOG7[15150:3083052720]: removing pid file /var/run/stunnel.pid I put the client cert in /etc/stunnel/certs and I ran 'c_rehash /etc/stunnel/certs'. What am I missing ? Thanks for any input. Regards, Koenraad Lelong.

1 0

Problem with verify = 3
by Koenraad Lelong 05 Jun '07

05 Jun '07

Hi, I would like to have a secure access to a Firebird database server. When I configure verify = 2 on the server I can connect, but I would like to have verify = 3 and this does not work. This is my stunnel.conf : client = no foreground = yes setuid = stunnel setgid = nogroup pid = /var/run/stunnel.pid debug = 7 output = /var/log/stunnel.log socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 3 CApath = /etc/stunnel/certs/ CAfile = /etc/stunnel/cacert.pem cert = /etc/stunnel/server.pem [firebird] accept = 3052 connect = localhost:gds_db output of stunnel -version : stunnel 4.14 on i686-suse-linux-gnu PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 Global options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /etc/stunnel/stunnel.pem pid = /var/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds I'm running OpenSuse 10.1 on the server. This is the log when I can't connect (verify = 3) : 2007.06.05 13:18:55 LOG5[15150:3083052720]: stunnel 4.14 on i686-suse-linux-gnu PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 2007.06.05 13:18:55 LOG7[15150:3083052720]: Snagged 64 random bytes from /root/.rnd 2007.06.05 13:18:55 LOG7[15150:3083052720]: Wrote 1024 new random bytes to /root/.rnd 2007.06.05 13:18:55 LOG7[15150:3083052720]: RAND_status claims sufficient entropy for the PRNG 2007.06.05 13:18:55 LOG6[15150:3083052720]: PRNG seeded successfully 2007.06.05 13:18:55 LOG7[15150:3083052720]: Certificate: /etc/stunnel/server.pem 2007.06.05 13:18:55 LOG7[15150:3083052720]: Key file: /etc/stunnel/server.pem 2007.06.05 13:18:55 LOG7[15150:3083052720]: Loaded verify certificates from /etc/stunnel/cacert.pem 2007.06.05 13:18:55 LOG7[15150:3083052720]: Verify directory set to /etc/stunnel/certs/ 2007.06.05 13:18:55 LOG5[15150:3083052720]: Peer certificate location /etc/stunnel/certs/ 2007.06.05 13:18:55 LOG6[15150:3083052720]: file ulimit = 1024 (can be changed with 'ulimit -n') 2007.06.05 13:18:55 LOG6[15150:3083052720]: poll() used - no FD_SETSIZE limit for file descriptors 2007.06.05 13:18:55 LOG5[15150:3083052720]: 500 clients allowed 2007.06.05 13:18:55 LOG7[15150:3083052720]: FD 5 in non-blocking mode 2007.06.05 13:18:55 LOG7[15150:3083052720]: FD 6 in non-blocking mode 2007.06.05 13:18:55 LOG7[15150:3083052720]: FD 7 in non-blocking mode 2007.06.05 13:18:55 LOG7[15150:3083052720]: SO_REUSEADDR option set on accept socket 2007.06.05 13:18:55 LOG7[15150:3083052720]: firebird bound to 0.0.0.0:3052 2007.06.05 13:18:55 LOG7[15150:3083052720]: Created pid file /var/run/stunnel.pid 2007.06.05 13:19:02 LOG7[15150:3083052720]: firebird accepted FD=8 from 192.168.0.13:25651 2007.06.05 13:19:02 LOG7[15150:3083049888]: firebird started 2007.06.05 13:19:02 LOG7[15150:3083049888]: FD 8 in non-blocking mode 2007.06.05 13:19:02 LOG7[15150:3083049888]: TCP_NODELAY option set on local socket 2007.06.05 13:19:02 LOG7[15150:3083049888]: FD 9 in non-blocking mode 2007.06.05 13:19:02 LOG7[15150:3083049888]: FD 11 in non-blocking mode 2007.06.05 13:19:02 LOG7[15150:3083052720]: Cleaning up the signal pipe 2007.06.05 13:19:02 LOG6[15150:3083052720]: Child process 15152 finished with code 0 2007.06.05 13:19:02 LOG7[15150:3083049888]: Connection from 192.168.0.13:25651 permitted by libwrap 2007.06.05 13:19:02 LOG5[15150:3083049888]: firebird connected from 192.168.0.13:25651 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): before/accept initialization 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 read client hello A 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write server hello A 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write certificate A 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write certificate request A 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL state (accept): SSLv3 flush data 2007.06.05 13:19:02 LOG5[15150:3083049888]: VERIFY OK: depth=1, /C=BE/ST=Vlaams Brabant/L=Diest/O=ACE electronics n.v./OU=IT/CN=Certificate Authority/emailAddress=postmaster.ace-electronics.be 2007.06.05 13:19:02 LOG4[15150:3083049888]: VERIFY ERROR ONLY MY: no cert for /C=BE/ST=Vlaams Brabant/L=Diest/O=ACE electronics n.v./OU=IT/CN=client/emailAddress=postmaster.ace-electronics.be 2007.06.05 13:19:02 LOG7[15150:3083049888]: SSL alert (write): fatal: certificate unknown 2007.06.05 13:19:02 LOG3[15150:3083049888]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2007.06.05 13:19:02 LOG7[15150:3083049888]: firebird finished (0 left) 2007.06.05 13:19:04 LOG7[15150:3083052720]: firebird accepted FD=8 from 192.168.0.13:25653 2007.06.05 13:19:04 LOG7[15150:3083049888]: firebird started 2007.06.05 13:19:04 LOG7[15150:3083049888]: FD 8 in non-blocking mode 2007.06.05 13:19:04 LOG7[15150:3083049888]: TCP_NODELAY option set on local socket 2007.06.05 13:19:04 LOG7[15150:3083049888]: FD 9 in non-blocking mode 2007.06.05 13:19:04 LOG7[15150:3083049888]: FD 11 in non-blocking mode 2007.06.05 13:19:04 LOG7[15150:3083052720]: Cleaning up the signal pipe 2007.06.05 13:19:04 LOG6[15150:3083052720]: Child process 15154 finished with code 0 2007.06.05 13:19:04 LOG7[15150:3083049888]: Connection from 192.168.0.13:25653 permitted by libwrap 2007.06.05 13:19:04 LOG5[15150:3083049888]: firebird connected from 192.168.0.13:25653 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): before/accept initialization 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 read client hello A 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write server hello A 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write certificate A 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 write certificate request A 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL state (accept): SSLv3 flush data 2007.06.05 13:19:04 LOG5[15150:3083049888]: VERIFY OK: depth=1, /C=BE/ST=Vlaams Brabant/L=Diest/O=ACE electronics n.v./OU=IT/CN=Certificate Authority/emailAddress=postmaster.ace-electronics.be 2007.06.05 13:19:04 LOG4[15150:3083049888]: VERIFY ERROR ONLY MY: no cert for /C=BE/ST=Vlaams Brabant/L=Diest/O=ACE electronics n.v./OU=IT/CN=client/emailAddress=postmaster.ace-electronics.be 2007.06.05 13:19:04 LOG7[15150:3083049888]: SSL alert (write): fatal: certificate unknown 2007.06.05 13:19:04 LOG3[15150:3083049888]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2007.06.05 13:19:04 LOG7[15150:3083049888]: firebird finished (0 left) 2007.06.05 13:19:09 LOG3[15150:3083052720]: Received signal 2; terminating 2007.06.05 13:19:09 LOG7[15150:3083052720]: removing pid file /var/run/stunnel.pid I put the client cert in /etc/stunnel/certs and I ran 'c_rehash /etc/stunnel/certs'. What am I missing ? Thanks for any input. Regards, Koenraad Lelong.

1 0

certificate revocation
by piyush tewari 05 Jun '07

05 Jun '07

Hi , I am using Stunnel to protect one of my server. I am able to configure the stunnel properly with the help of stunnel. Now i am trying to use the revocation list concept in the stunnel. For using the stunnel revocation list i performed the following steps. 1. for generating the CRL file openssl ca -gencrl -keyfile ca_key -cert ca_crt -out my_crl.pem 2. for revoking the certificates openssl ca -revoke bad_crt_file -keyfile ca_key -cert ca_crt The entry specified in the stunnel.conf file is:- CRLfile = my_crl.pem Surprisingly the client is still able to connect to the server. Is it the problem in my configuration or it is a bug of stunnel. Regards, Piyush --------------------------------- Need a vacation? Get great deals to amazing places on Yahoo! Travel.

1 0

plz help me in debugging the code
by piyush tewari 04 Jun '07

04 Jun '07

Hello Friends, I am facing problems in debugging the source code of stunnel. the behaviour of the code is very unexpected for me. the return statement is not returning from the function. (Line 145 of gui.c file). Sameway when i debug line no 1266 of the options.c , that is "name=default_config_file;" , the df pointer gets it's value that means it is executing another line , line no 1305 of options.c itself "df=file_open(name, 0);". I am not getting this working of the stunnel code. And the other problem that i m facing is that during the debugging , many variables are not showing their occupied value. So please help me in understanding this working and resolving it. Thank you.. Regards Piyush --------------------------------- --------------------------------- Pinpoint customers who are looking for what you sell.

2 1

Re: [stunnel-users] stunnel-4.20 server loop on AIX 5.3
by Peter Heimann 04 Jun '07

04 Jun '07

Michal Trojnara <Michal.Trojnara(a)mobi-com.net> wrote on 31.05.2007 20:48:08: > An alternative workaround would be changing: > continue; > to: > sleep(1); > continue; If OpenSSL has been compiled with IBM cc, most new stunnel connections then result in EAGAIN once. sleep(1) seems to prevent an endless loop, but most requests now need at least one second to be processed. Compiling OpenSSL with IBM xlc_r, as you proposed, is definitely the better solution and prevents the EAGAIN errors. -- Regards Peter Heimann _______________________________________________________________ SMS schreiben mit WEB.DE FreeMail - einfach, schnell und kostenguenstig. Jetzt gleich testen! http://f.web.de/?mc=021192

1 0

Re: [stunnel-users] stunnel-4.20 server loop on AIX 5.3
by Peter Heimann 03 Jun '07

03 Jun '07

Michal Trojnara <Michal.Trojnara(a)mobi-com.net> wrote on 31.05.2007 20:48:08: > On Monday 28 May 2007 20:51, Peter Heimann wrote: > > Under heavy usage, stunnel-4.20 on AIX 5.3 enters into a loop with high > > CPU load. > > SSL_accept() returns with error, SSL_get_error() returns 5 > > (SSL_ERROR_SYSCALL). get_last_socket_error() returns EAGAIN, and the loop > > continues without end. Nevertheless, new connection requests still get > > processed. > Could it be the problem described at the end of this page: > https://www.systinet.com/doc/ssc-65/waspc/html/extlibs.install.openssl.html Indeed. Further experiments on AIX 5.3: OpenSSL 0.9.8e configured as "./Configure no-idea threads", compiled with "cc" (IBM XL C Compiler 7.0), stunnel 4.20 --> loop in init_ssl() OpenSSL 0.9.8e configured as "./Configure no-idea threads", compiled with "xlc_r" (IBM XL C Compiler 7.0, thread-safe variant), stunnel 4.20 --> no problem OpenSSL 0.9.8e configured as "./Configure no-idea threads", compiled with "gcc" (GCC version 4.1.1), stunnel 4.20 --> no problem Thanks for the hint. -- Regards Peter Heimann _______________________________________________________________ SMS schreiben mit WEB.DE FreeMail - einfach, schnell und kostenguenstig. Jetzt gleich testen! http://f.web.de/?mc=021192

1 0

Plz help the n00b (syslog-ng & stunnel)
by F.M. Taylor 31 May '07

31 May '07

Greetings all. Seemed simple enough, but I can seem to get it to work. I have obviously missed something simple. Here is the info you will need (and probably some you won't). I have tried every combination of options I can think of, and I have searched the archives and the web. It looks like it is almost working, but the server I am trying to connect to never sees the data (however "they" have it working on "their" systems, so it must be me). "They" say it connects, talks a little, no real data xfer, closes, then more data (followed by the obligatory TCP_RSTs for dead connects). [insert begging] [root@bofh stunnel-4.20]# stunnel /etc/stunnel/stunnel.conf 2007.05.25 10:43:00 LOG7[20728:182894198944]: Snagged 64 random bytes from /root/.rnd 2007.05.25 10:43:00 LOG7[20728:182894198944]: Wrote 1024 new random bytes to /root/.rnd 2007.05.25 10:43:00 LOG7[20728:182894198944]: RAND_status claims sufficient entropy for the PRNG 2007.05.25 10:43:00 LOG7[20728:182894198944]: PRNG seeded successfully 2007.05.25 10:43:00 LOG7[20728:182894198944]: Configuration SSL options: 0x00000FFF 2007.05.25 10:43:00 LOG7[20728:182894198944]: SSL options set: 0x00000FFF 2007.05.25 10:43:00 LOG7[20728:182894198944]: SSL context initialized for service 5140 [root@bofh stunnel-4.20]# tail -f /var/log/stunnel4/stunnel.log 2007.05.25 10:43:00 LOG5[20728:182894198944]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Auth:LIBWRAP 2007.05.25 10:43:00 LOG6[20728:182894198944]: file ulimit = 1024 (can be changed with 'ulimit -n') 2007.05.25 10:43:00 LOG6[20728:182894198944]: poll() used - no FD_SETSIZE limit for file descriptors 2007.05.25 10:43:00 LOG5[20728:182894198944]: 500 clients allowed 2007.05.25 10:43:00 LOG7[20728:182894198944]: FD 4 in non-blocking mode 2007.05.25 10:43:00 LOG7[20728:182894198944]: FD 5 in non-blocking mode 2007.05.25 10:43:00 LOG7[20728:182894198944]: FD 6 in non-blocking mode 2007.05.25 10:43:00 LOG7[20728:182894198944]: SO_REUSEADDR option set on accept socket 2007.05.25 10:43:00 LOG7[20728:182894198944]: 5140 bound to 127.0.0.1:5140 2007.05.25 10:43:00 LOG7[20729:182894198944]: Created pid file /var/run/stunnel4/stunnel.pid 2007.05.25 10:43:29 LOG7[20729:182894198944]: 5140 accepted FD=7 from 127.0.0.1:64820 2007.05.25 10:43:29 LOG7[20729:1073809760]: 5140 started 2007.05.25 10:43:29 LOG7[20729:1073809760]: FD 7 in non-blocking mode 2007.05.25 10:43:29 LOG7[20729:1073809760]: TCP_NODELAY option set on local socket 2007.05.25 10:43:29 LOG7[20729:1073809760]: FD 8 in non-blocking mode 2007.05.25 10:43:29 LOG7[20729:1073809760]: FD 9 in non-blocking mode 2007.05.25 10:43:29 LOG7[20729:1073809760]: Connection from 127.0.0.1:64820 permitted by libwrap 2007.05.25 10:43:29 LOG7[20729:182894198944]: Cleaning up the signal pipe 2007.05.25 10:43:29 LOG5[20729:1073809760]: 5140 accepted connection from 127.0.0.1:64820 2007.05.25 10:43:29 LOG6[20729:182894198944]: Child process 20748 finished with code 0 2007.05.25 10:43:29 LOG7[20729:1073809760]: FD 8 in non-blocking mode 2007.05.25 10:43:29 LOG7[20729:1073809760]: 5140 connecting xxx.xxx.xxx.xxx:5140 2007.05.25 10:43:29 LOG7[20729:1073809760]: connect_wait: waiting 10 seconds 2007.05.25 10:43:29 LOG7[20729:1073809760]: connect_wait: connected 2007.05.25 10:43:29 LOG5[20729:1073809760]: 5140 connected remote server from 192.168.2.23:64821 2007.05.25 10:43:29 LOG7[20729:1073809760]: Remote FD=8 initialized 2007.05.25 10:43:29 LOG7[20729:1073809760]: TCP_NODELAY option set on remote socket 2007.05.25 10:43:29 LOG7[20729:1073809760]: SSL state (connect): before/connect initialization 2007.05.25 10:43:29 LOG7[20729:1073809760]: SSL state (connect): SSLv3 write client hello A 2007.05.25 10:43:29 LOG7[20729:1073809760]: SSL state (connect): SSLv3 read server hello A 2007.05.25 10:43:29 LOG7[20729:1073809760]: SSL state (connect): SSLv3 read server certificate A 2007.05.25 10:43:29 LOG7[20729:1073809760]: SSL state (connect): SSLv3 read server done A 2007.05.25 10:43:29 LOG7[20729:1073809760]: SSL state (connect): SSLv3 write client key exchange A 2007.05.25 10:43:29 LOG7[20729:1073809760]: SSL state (connect): SSLv3 write change cipher spec A 2007.05.25 10:43:29 LOG7[20729:1073809760]: SSL state (connect): SSLv3 write finished A 2007.05.25 10:43:29 LOG7[20729:1073809760]: SSL state (connect): SSLv3 flush data 2007.05.25 10:43:29 LOG7[20729:1073809760]: SSL state (connect): SSLv3 read finished A 2007.05.25 10:43:29 LOG7[20729:1073809760]: 1 items in the session cache 2007.05.25 10:43:29 LOG7[20729:1073809760]: 1 client connects (SSL_connect()) 2007.05.25 10:43:29 LOG7[20729:1073809760]: 1 client connects that finished 2007.05.25 10:43:29 LOG7[20729:1073809760]: 0 client renegotiations requested 2007.05.25 10:43:29 LOG7[20729:1073809760]: 0 server connects (SSL_accept()) 2007.05.25 10:43:29 LOG7[20729:1073809760]: 0 server connects that finished 2007.05.25 10:43:29 LOG7[20729:1073809760]: 0 server renegotiations requested 2007.05.25 10:43:29 LOG7[20729:1073809760]: 0 session cache hits 2007.05.25 10:43:29 LOG7[20729:1073809760]: 0 session cache misses 2007.05.25 10:43:29 LOG7[20729:1073809760]: 0 session cache timeouts 2007.05.25 10:43:29 LOG6[20729:1073809760]: SSL connected: new session negotiated 2007.05.25 10:43:29 LOG6[20729:1073809760]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2007.05.25 10:43:29 LOG7[20729:1073809760]: SSL alert (read): warning: close notify 2007.05.25 10:43:29 LOG7[20729:1073809760]: SSL closed on SSL_read 2007.05.25 10:43:29 LOG7[20729:1073809760]: Socket write shutdown 2007.05.25 10:43:29 LOG7[20729:1073809760]: SSL write shutdown 2007.05.25 10:43:29 LOG7[20729:1073809760]: SSL alert (write): warning: close notify 2007.05.25 10:43:29 LOG6[20729:1073809760]: SSL_shutdown successfully sent close_notify 2007.05.25 10:43:29 LOG5[20729:1073809760]: Connection closed: 303 bytes sent to SSL, 0 bytes sent to socket 2007.05.25 10:43:29 LOG7[20729:1073809760]: 5140 finished (0 left) /etc/stunnel/stunnel.conf setuid = stunnel4 setgid = stunnel4 pid = /var/run/stunnel4/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log [5140] client = yes options = ALL accept = 127.0.0.1:5140 connect = xxx.xxx.xxx.xxx:5140 [root@bofh stunnel-4.20]# tail /var/log/syslog May 25 10:57:35 bofh syslog-ng[1926]: EOF occurred while idle; fd='11' May 25 10:57:35 bofh syslog-ng[1926]: Connection broken; time_reopen='60' May 25 10:58:37 bofh syslog-ng[1926]: EOF occurred while idle; fd='11' May 25 10:58:37 bofh syslog-ng[1926]: Connection broken; time_reopen='60' May 25 10:59:38 bofh syslog-ng[1926]: EOF occurred while idle; fd='11' May 25 10:59:38 bofh syslog-ng[1926]: Connection broken; time_reopen='60' -- ......\\|//........^^^^^........)))((........%%%%%........,,,,,...... ......(- -)........(o o)........(- o)........(0-0)........(* *)...... +--ooO-(_)-Ooo--oo0-(_)-0oo--ooO-(_)-Ooo--oo0-(_)-0oo--ooO-(_)-Ooo--+ | F.M. (Mike) Taylor........'Recedite, plebes! Gero rem imperialem!'| | 'Ecce potestas casei'..............GIAC GSEC & GCFW Certified.....| | Desk: 4-1872...........................C: 812-841-1876............| +-------------------------------------------------------------------+

1 2

Please help in difficulty in debugging the Stunnel code
by piyush tewari 31 May '07

31 May '07

Hello Friends, I am facing problems in debugging the source code of stunnel. When i debug line no 1266 of the options.c , that is "name=default_config_file;" , the df pointer gets it's value that means it is executing another line , line no 1305 of options.c itself "df=file_open(name, 0);". I am not getting this working of the stunnel code. And the other problem that i m facing is that during the debugging , many variables are not showing their occupied value. So please help me in understanding this working and resolving it. Thank you very much in advance for this help. warm regards Pkt --------------------------------- Get the free Yahoo! toolbar and rest assured with the added security of spyware protection.

1 0