- stunnel-users - stunnel.org

RE: [stunnel-users] Vista not connecting to port 139
by Neil Aggarwal 29 Apr '07

29 Apr '07

Alaric: This is strange. When I go to the Security Center, it says the McAfee Personal Firewall is on, but I can't find it in the Start menu, Services, or anywhere else. Any ideas? Thanks, Neil -- Neil Aggarwal, (832)245-7314, www.JAMMConsulting.com FREE! Eliminate junk email and reclaim your inbox. Visit http://www.spammilter.com for details. -----Original Message----- From: Alaric Dailey [mailto:[email protected]] Sent: Thursday, April 26, 2007 3:48 PM To: 'Neil Aggarwal' Subject: RE: [stunnel-users] Vista not connecting to port 139 I would check the windows firewall, or any other security suite you may have. -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Neil Aggarwal Sent: Thursday, April 26, 2007 15:30 To: stunnel-users(a)mirt.net Subject: [stunnel-users] Vista not connecting to port 139 Hello: I am trying to map a network drive over an stunnel connection. The server is Linux and the client machine is Windows Vista (Ugh!). I have stunnel installed and working. I have the following in my stunnel.conf: client = yes delay = yes [netDrives] accept = 222.222.222.222:139 connect = www.jammconsulting.com:2139 When I go to map the network drive on vista, I use this command: net use x: \\222.222.222.222\MyShare mypass /user:myuser It eventually gives me an error message about network path not found. Looking at the stunnel window, there are no messages about any connections to the stunnel. If I do: telnet 222.222.222.222 139 the telnet session connects and I see messages about a connection in the stunnel window. Any ideas why Vista is not using port 139? Thanks, Neil -- Neil Aggarwal, (832)245-7314, www.JAMMConsulting.com FREE! Eliminate junk email and reclaim your inbox. Visit http://www.spammilter.com for details. _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

Re: [stunnel-users] Handshake failure
by RUTSCHLE Yves 27 Apr '07

27 Apr '07

RUTSCHLE Yves wrote: > Argh. After removing all my debugging printf's, it turns out it doesn't seem > to work after all. Which, if it has to do with signals and timing, is only > partly surprising. Ok, nothing to do with any of that. Deep inside OpenSSL, there is a call to gmtime_r. Deep somewhere in hell (I hope), someone decided that LynxOS' gmtime_r functions would have its arguments *reversed*. REVERSED. I guess they were going for SIXPO complience. So that call would write rubbish in the stack, hence no returning from the call and segfault instead. So, nothing to do with stunnel after all. Thanks for the support anyway! :) Y. - TGIFriday

1 0

[PATCH?] Senting a list of accepted CAs to the client
by Miloslav Trmac 27 Apr '07

27 Apr '07

Hello, stunnel currently does not send a list of accepted CAs, see e.g. https://bugzilla.mozilla.org/show_bug.cgi?id=327001#c20 . Sending the list was #if 0-ed out sometime between stunnel 3.22 and 4.00, with no change log entry AFAICS. Does anyone remember know why was it disabled, and whether it is safe to reenable (e. g. using the attached patch)? Thanks, Mirek

1 0

Vista not connecting to port 139
by Neil Aggarwal 26 Apr '07

26 Apr '07

Hello: I am trying to map a network drive over an stunnel connection. The server is Linux and the client machine is Windows Vista (Ugh!). I have stunnel installed and working. I have the following in my stunnel.conf: client = yes delay = yes [netDrives] accept = 222.222.222.222:139 connect = www.jammconsulting.com:2139 When I go to map the network drive on vista, I use this command: net use x: \\222.222.222.222\MyShare mypass /user:myuser It eventually gives me an error message about network path not found. Looking at the stunnel window, there are no messages about any connections to the stunnel. If I do: telnet 222.222.222.222 139 the telnet session connects and I see messages about a connection in the stunnel window. Any ideas why Vista is not using port 139? Thanks, Neil -- Neil Aggarwal, (832)245-7314, www.JAMMConsulting.com FREE! Eliminate junk email and reclaim your inbox. Visit http://www.spammilter.com for details.

1 0

Stunnel on Vista
by Neil Aggarwal 26 Apr '07

26 Apr '07

Hello: Has anyone used stunnel on Vista? For some stupid reason, it tells me I can't save the stunnel.conf file. Thanks, Neil -- Neil Aggarwal, (214)986-3533, www.JAMMConsulting.com FREE! Eliminate junk email and reclaim your inbox. Visit http://www.spammilter.com for details.

2 2

Re: [stunnel-users] Handshake failure
by RUTSCHLE Yves 26 Apr '07

26 Apr '07

Michal Trojnara wrote: >Some systems require to reset signal handler each time a signal was >received, while for others the handler is executed recursively destroying >CPU stack of running stunnel process. Ah. That'd explain it. Thanks for the tip and the explanations! Y.

1 0

Handshake failure
by RUTSCHLE Yves 26 Apr '07

26 Apr '07

Hello, I am trying to set up a stunnel between two machines running LynxOS, which is a POSIX derivative. I've compiled OpenSSL 0.9.8e, and stunnel 4.20: stunnel 4.20 on i386-unknown-lynxos with OpenSSL 0.9.8e 23 Feb 2007 Threading:FORK SSL:ENGINE Sockets:POLL,IPv4 [...] I use the following config files: ////// server side debug=7 foreground=yes pid= CAfile=valid_certs key=privkey.pem cert=cert.pem verify=1 [SSLTunnel] accept=1235 connect=1234 ////// end server side ////// client side debug=7 foreground=yes pid= CAfile=valid_certs key=privkey.pem cert=cert.pem verify=1 client=yes [SSLTunnel] accept=4234 connect=173.16.1.10:1235 ////// end client side (It's run from different directories so the PEM files are different) After running both stunnels, I connect to the client side and see a beginning of handshake; however, it then breaks down: from afar, it looks like the client doesn't take the server certificate: ///// server trace 2007.04.25 15:33:22 LOG7[58:0]: Snagged 64 random bytes from /home/st07815/.rnd 2007.04.25 15:33:22 LOG7[58:0]: Wrote 1024 new random bytes to /home/st07815/.rnd 2007.04.25 15:33:22 LOG7[58:0]: RAND_status claims sufficient entropy for the PRNG 2007.04.25 15:33:22 LOG7[58:0]: PRNG seeded successfully 2007.04.25 15:33:22 LOG7[58:0]: Certificate: cert.pem 2007.04.25 15:33:22 LOG7[58:0]: Certificate loaded 2007.04.25 15:33:22 LOG7[58:0]: Key file: privkey.pem 2007.04.25 15:33:22 LOG7[58:0]: Private key loaded 2007.04.25 15:33:22 LOG7[58:0]: Loaded verify certificates from valid_certs 2007.04.25 15:33:22 LOG7[58:0]: Loaded valid_certs revocation lookup file 2007.04.25 15:33:22 LOG7[58:0]: SSL context initialized for service SSLTunnel 2007.04.25 15:33:22 LOG5[58:0]: stunnel 4.20 on i386-unknown-lynxos with OpenSSL 0.9.8e 23 Feb 2007 2007.04.25 15:33:22 LOG5[58:0]: Threading:FORK SSL:ENGINE Sockets:POLL,IPv4 2007.04.25 15:33:22 LOG6[58:0]: file ulimit = 64 (can be changed with 'ulimit -n') 2007.04.25 15:33:22 LOG6[58:0]: poll() used - no FD_SETSIZE limit for file descriptors 2007.04.25 15:33:22 LOG5[58:0]: 29 clients allowed 2007.04.25 15:33:22 LOG7[58:0]: FD 3 in non-blocking mode 2007.04.25 15:33:22 LOG7[58:0]: FD 4 in non-blocking mode 2007.04.25 15:33:22 LOG7[58:0]: FD 5 in non-blocking mode 2007.04.25 15:33:22 LOG7[58:0]: SO_REUSEADDR option set on accept socket 2007.04.25 15:33:22 LOG7[58:0]: SSLTunnel bound to 0.0.0.0:1235 2007.04.25 15:33:22 LOG7[58:0]: No pid file being created (end of init, waiting for connection) 2007.04.25 15:34:17 LOG7[58:0]: SSLTunnel accepted FD=6 from 173.16.1.7:1092 2007.04.25 15:34:17 LOG7[68:0]: SSLTunnel started 2007.04.25 15:34:17 LOG7[68:0]: FD 6 in non-blocking mode 2007.04.25 15:34:17 LOG5[68:0]: SSLTunnel accepted connection from 173.16.1.7:1092 2007.04.25 15:34:17 LOG7[68:0]: SSL state (accept): before/accept initialization 2007.04.25 15:34:17 LOG7[68:0]: SSL state (accept): SSLv3 read client hello A 2007.04.25 15:34:17 LOG7[68:0]: SSL state (accept): SSLv3 write server hello A 2007.04.25 15:34:17 LOG7[68:0]: SSL state (accept): SSLv3 write certificate A 2007.04.25 15:34:17 LOG7[68:0]: SSL state (accept): SSLv3 write certificate request A 2007.04.25 15:34:17 LOG7[68:0]: SSL state (accept): SSLv3 flush data 2007.04.25 15:34:19 LOG3[68:0]: SSL_accept: Peer suddenly disconnected 2007.04.25 15:34:19 LOG5[68:0]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.04.25 15:34:19 LOG7[58:0]: Cleaning up the signal pipe 2007.04.25 15:34:19 LOG7[58:0]: Process 68 finished with code 0 (0 left) ///// end server trace ///// client trace 2007.04.25 15:33:59 LOG7[12:0]: Snagged 64 random bytes from /home/st07815/.rnd 2007.04.25 15:33:59 LOG7[12:0]: Wrote 1024 new random bytes to /home/st07815/.rnd 2007.04.25 15:33:59 LOG7[12:0]: RAND_status claims sufficient entropy for the PRNG 2007.04.25 15:33:59 LOG7[12:0]: PRNG seeded successfully 2007.04.25 15:33:59 LOG7[12:0]: Certificate: cert.pem 2007.04.25 15:33:59 LOG7[12:0]: Certificate loaded 2007.04.25 15:33:59 LOG7[12:0]: Key file: privkey.pem 2007.04.25 15:33:59 LOG7[12:0]: Private key loaded 2007.04.25 15:33:59 LOG7[12:0]: Loaded verify certificates from valid_certs 2007.04.25 15:33:59 LOG7[12:0]: Loaded valid_certs revocation lookup file 2007.04.25 15:33:59 LOG7[12:0]: SSL context initialized for service SSLTunnel 2007.04.25 15:33:59 LOG5[12:0]: stunnel 4.20 on i386-unknown-lynxos with OpenSSL 0.9.8e 23 Feb 2007 2007.04.25 15:33:59 LOG5[12:0]: Threading:FORK SSL:ENGINE Sockets:POLL,IPv4 2007.04.25 15:33:59 LOG6[12:0]: file ulimit = 64 (can be changed with 'ulimit -n') 2007.04.25 15:33:59 LOG6[12:0]: poll() used - no FD_SETSIZE limit for file descriptors 2007.04.25 15:33:59 LOG5[12:0]: 29 clients allowed 2007.04.25 15:33:59 LOG7[12:0]: FD 3 in non-blocking mode 2007.04.25 15:33:59 LOG7[12:0]: FD 4 in non-blocking mode 2007.04.25 15:33:59 LOG7[12:0]: FD 5 in non-blocking mode 2007.04.25 15:33:59 LOG7[12:0]: SO_REUSEADDR option set on accept socket 2007.04.25 15:33:59 LOG7[12:0]: SSLTunnel bound to 0.0.0.0:4234 2007.04.25 15:33:59 LOG7[12:0]: No pid file being created (end of init, waiting for connection) 2007.04.25 15:34:27 LOG7[12:0]: SSLTunnel accepted FD=6 from 152.14.101.54:64752 2007.04.25 15:34:27 LOG7[27:0]: SSLTunnel started 2007.04.25 15:34:27 LOG7[27:0]: FD 6 in non-blocking mode 2007.04.25 15:34:27 LOG5[27:0]: SSLTunnel accepted connection from 152.14.101.54:64752 2007.04.25 15:34:27 LOG7[27:0]: FD 5 in non-blocking mode 2007.04.25 15:34:27 LOG7[27:0]: SSLTunnel connecting 173.16.1.10:1235 2007.04.25 15:34:27 LOG7[27:0]: connect_wait: waiting 10 seconds 2007.04.25 15:34:27 LOG7[27:0]: connect_wait: connected 2007.04.25 15:34:27 LOG5[27:0]: SSLTunnel connected remote server from 173.16.1.7:1092 2007.04.25 15:34:27 LOG7[27:0]: Remote FD=5 initialized 2007.04.25 15:34:27 LOG7[27:0]: SSL state (connect): before/connect initialization 2007.04.25 15:34:27 LOG7[27:0]: SSL state (connect): SSLv3 write client hello A 2007.04.25 15:34:27 LOG7[27:0]: SSL state (connect): SSLv3 read server hello A 2007.04.25 15:34:28 LOG7[12:0]: Cleaning up the signal pipe 2007.04.25 15:34:28 LOG7[12:0]: Process 27 terminated on signal 11 (0 left) ///// end client trace Now the strange thing is that this very same setup works on Solaris, so I have something wrong with the port of either OpenSSL or stunnel on LynxOS. If someone could give me a hint as to where to start poking, I'd greatly appreciate it. TIA, Y.

2 2

Stunnel with Goldmine 6.70.61214
by Raymond Randall 26 Apr '07

26 Apr '07

Greetings! Use Goldmine with Gmail domain services. Have set up according to Mike Casteel's instructions. However, Goldmine will not download email from the Gmail (the GMail address: rayrandall(a)ethosadvisory.com). Here is the stunnel.conf file: client=yes [pop3] accept=9995 connect=pop.gmail.com:995 [smtp] accept=465 connect=smtp.gmail.com:465 POP and SMTP set to: 127.0.0.1 Here is the stunnel report: 2007.04.26 06:32:20 LOG3[1972:1996]: Error resolving 'pop.gmail.com': Neither nodename nor servname known (EAI_NONAME) Cannot resolve 'pop.gmail.com:995' - delaying DNS lookup 2007.04.26 06:32:20 LOG3[1972:1996]: Error resolving 'smtp.gmail.com': Neither nodename nor servname known (EAI_NONAME) Cannot resolve 'smtp.gmail.com:465' - delaying DNS lookup 2007.04.26 06:32:20 LOG5[1972:1996]: stunnel 4.16 on x86-pc-mingw32-gnu with OpenSSL 0.9.7e 25 Oct 2004 2007.04.26 06:32:20 LOG5[1972:1996]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2007.04.26 06:32:24 LOG5[1972:424]: No limit detected for the number of clients 2007.04.26 07:11:56 LOG5[1972:1204]: pop3 connected from 127.0.0.1:1600 2007.04.26 07:14:01 LOG5[1972:1204]: Connection closed: 2795 bytes sent to SSL, 662451 bytes sent to socket Perhaps this is a Goldmine configuration error. Not sure, and appreciate suggestions. Ray Randall -- Ethos Advisory Services Ray Randall 617-275-5565 Fax: 877-895-3756 http://www.ethosadvisory.com Information provided by Ethos is based on sources we believe reliable. Ethos does not offer legal or accounting services. Information contained in this email message is confidential and may contain privileged information. Any review or use of the information contained in this email message by persons other than the intended recipient(s) is prohibited. Content of this email is illustrative and educational; it is not a recommendation to purchase or sell. The examples presented do not take into consideration commissions, tax implications or other transaction costs, which may significantly affect the economic consequences of a given strategy. Mutual fund investing involves risk, including the possible loss of principal. Index performance returns do not reflect any management fees, transaction costs, or expenses. Past performance does not guarantee future results.

1 0

Connecting via rtmps to Red5 server
by David Schulberg 25 Apr '07

25 Apr '07

Hi, I have been led to stunnel as the way to get a Flash application to communicate securely with Red5 server. Red5 doesn't directly support ssl connectivity but using rtmps protocol (rtmp tunnelled via https) clients should be able to connect to Red5 if stunnel handles the encrypted traffic on port 443 and passes unencrypted communications back and forth to the Red5 on a port it expects to receive rtmp communication.. (refer http://www.adobe.com/devnet/flashcom/articles/firewalls_proxy04.html) The log file I get when I attempt to talk rtmps is shown below 2007.04.25 18:19:04 LOG7[3932:3384]: New thread created 2007.04.25 18:19:04 LOG7[3932:3664]: https started 2007.04.25 18:19:04 LOG7[3932:3664]: FD 224 in non-blocking mode 2007.04.25 18:19:04 LOG7[3932:3664]: TCP_NODELAY option set on local socket 2007.04.25 18:19:04 LOG5[3932:3664]: https accepted connection from 127.0.0.1:1249 2007.04.25 18:19:04 LOG7[3932:3664]: FD 248 in non-blocking mode 2007.04.25 18:19:04 LOG7[3932:3664]: https connecting 127.0.0.1:1935 2007.04.25 18:19:04 LOG7[3932:3664]: connect_wait: waiting 10 seconds 2007.04.25 18:19:04 LOG7[3932:3664]: connect_wait: connected 2007.04.25 18:19:04 LOG5[3932:3664]: https connected remote server from 127.0.0.1:1250 2007.04.25 18:19:04 LOG7[3932:3664]: Remote FD=248 initialized 2007.04.25 18:19:04 LOG7[3932:3664]: TCP_NODELAY option set on remote socket 2007.04.25 18:19:04 LOG7[3932:3664]: SSL state (connect): before/connect initialization 2007.04.25 18:19:04 LOG7[3932:3664]: SSL state (connect): SSLv3 write client hello A 2007.04.25 18:24:04 LOG6[3932:3664]: init_ssl: s_poll_wait timeout 2007.04.25 18:24:04 LOG5[3932:3664]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.04.25 18:24:04 LOG7[3932:3664]: https finished (0 left) The stunnel.conf file has the following settings that pertain specifically to this situation client = yes [https] accept = 443 connect = 1935 What I seem to see (according to the logfile) is that an ssl connection is successfully established but no subsequent communication takes place after the connection has been made. At this point my Flash application doesn't send any messages via the ssl connection which seems to implicate my client as being the source of my problem. I would appreciate any advice on how I can best investigate this whole situation to resolve the issue. Regards, David Schulberg email: davids(a)evertech.com.au

2 2

firewall very restricted!!
by Pitoniso Rikito Rikin 17 Apr '07

17 Apr '07

Ok guys look this... my only contact with the world is trought the WEB port 80 how i can establish a ssh connection trought this port, the only method avaible is the GET or POST.... well how i do this... help --------------------------------- LLama Gratis a cualquier PC del Mundo. Llamadas a fijos y móviles desde 1 céntimo por minuto. http://es.voice.yahoo.com

2 1

Using Client Authentication
by Ravi Gowda 16 Apr '07

16 Apr '07

Hi All, I am trying to have a setup where stunnel acts as a client to a server which requires client-Authentication. This is the snapshot of my stunnel.conf # Sample stunnel configuration file # Copyright by Michal Trojnara 2002 setuid = nobody setgid = nobody output = /etc/stunnel/out cert = /etc/stunnel/rtca-client.pem key = /etc/stunnel/rtca-client.ky # Authentication stuff verify = 2 # don't forget about c_rehash CApath # it is located inside chroot jail: #CApath = /certs # or simply use CAfile instead: CAfile = /etc/stunnel/rtca.pem ciphers = DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:DES-CBC3-MD5:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-SHA:IDEA-CBC-SHA:IDEA-CBC-MD5:RC2-CBC-MD5:DHE-DSS-RC4-SHA:RC4-SHA:RC4-MD5:RC4-MD5:RC4-64-MD5:EXP1024-DHE-DSS-DES-CBC-SHA:EXP1024-DES-CBC-SHA:EXP1024-RC2-CBC-MD5:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:DES-CBC-MD5:EXP1024-DHE-DSS-RC4-SHA:EXP1024-RC4-SHA:EXP1024-RC4-MD5:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-RC2-CBC-MD5:EXP-RC4-MD5:EXP-RC4-MD5 # Some debugging stuff debug = 7 output = /etc/stunnel/stunnel.log # Use it for client mode client = yes when I try to connect to the server, I am seeing that Stunnel is sending an empty certificate..which is making my server to reject connections. Can someone please help me out?? Thanks in Advance Ravi Gowda

1 0

Re: [stunnel-users] Setting up chain certificates on Stunnel.
by Hans Werner Strube 13 Apr '07

13 Apr '07

Satyajit Das wrote: > My server certificate > signed by intermediate CA > signed by Verisign CA > > I have the Verisign certificate on my clients trusted root CAs, however I am > > not able to get the SSL communication through. I believe this is because > stunnel should send all the three certificates for authentication and I > couldnt > configure stunnel to send across all the three certificates. > > Can anybody please help install all these certificates on stunnel. Simply concatenate the certificates (in PEM format) in the file specified by "cert = ..." and supply the key of your server certificate either in the same file or in the file specified by "key = ...".

1 0

stunnel-4.20 crash on AIX
by Peter O'Gorman 12 Apr '07

12 Apr '07

Hi, We built stunnel-4.20 on solaris, hpux, aix, tru64. irix and various linux hosts, and it works fine everywhere except hpux10.20 and aix. stunnel crashes with similar backtraces on AIX-4.3,5.1,5.2 and 5.3, not on the first client connect (using stunnel client=yes, connecting to s secure daytime server on another host, because everyone needs a secure daytime server :-p) but on the second connection. We have not tried server side yet, I assume results are similar. The backtrace looks like this: GDB: Program terminated with signal 11, Segmentation fault. #0 0xd0126b1c in _sigsetmask () from /usr/lib/libpthreads.a(shr_xpg5.o) (gdb) bt #0 0xd0126b1c in _sigsetmask () from /usr/lib/libpthreads.a(shr_xpg5.o) #1 0xd0127e5c in _p_sigaction () from /usr/lib/libpthreads.a(shr_xpg5.o) #2 0xd0315544 in sigaction () from /usr/lib/libc.a(shr.o) #3 0xd038beac in signal () from /usr/lib/libc.a(shr.o) #4 0x10006200 in sigchld_handler (sig=0) at network.c:350 #5 0x00004378 in ?? () Previous frame inner to this frame (corrupt stack?) dbx: sigchld_handler(sig = 0), line 350 in "network.c" _sigsetmask(??, ??, ??) at 0xd0126b1c _p_sigaction(??, ??, ??) at 0xd0127e58 raise.sigaction(??, ??, ??) at 0xd0315540 signal(??, ??) at 0xd038bea8 sigchld_handler(sig = 0), line 350 in "network.c" _sigsetmask(??, ??, ??) at 0xd0126b1c _p_sigaction(??, ??, ??) at 0xd0127e58 raise.sigaction(??, ??, ??) at 0xd0315540 signal(??, ??) at 0xd038bea8 sigchld_handler(sig = 0), line 350 in "network.c" _sigsetmask(??, ??, ??) at 0xd0126b1c _p_sigaction(??, ??, ??) at 0xd0127e58 raise.sigaction(??, ??, ??) at 0xd0315540 signal(??, ??) at 0xd038bea8 repeated forever. Line 350 of network.c says: signal(SIGCHLD, sigchld_handler); And that is in the signal handler, it seems like a normal thing to do, and I have no idea why, on AIX, it crashes. putting an #ifndef _AIX #endif around the signal() call "fixes" the crash, alternatively setting SIGCHLD to SIG_IGN on AIX "fixes" it, but I don't think that either solution is correct. I don't believe the signal handler will get called again as we do not reset the signal. (tests that assumtion and finds answer to riddle) Okay, problem identified. The signal_handler is being called repeatedly, causing an infinite loop that can only end in a crash. According to the AIX signal man page: The signal in libc.a does not set the SA_RESTART flag. It sets the signal mask to the signal whose action is being specified, and sets flags to SA_OLDSTYLE. The Berkeley Software Distribution (BSD) version of signal sets the SA_RESTART flag and preserves the current settings of the signal mask and flags. The BSD version can be used by compiling with the Berkeley Compatibility Library (libbsd.a). And indeed, no patches are required if I add -lbsd. Another solution would probably be to use sigaction if it is available. Meanwhile, please find attached a patch to add -lbsd on aix. Thanks for bearing with me while I figured this out :-) Peter

1 0

Setting up chain certificates on Stunnel.
by Satyajit Das 12 Apr '07

12 Apr '07

Hi , I am using stunnel as a wrapper to provide SSL functionalities for my server. Right now I am having problems setting up chained certificates on stunnel. My Problem -> My server certificate > signed by intermediate CA > signed by Verisign CA I have the Verisign certificate on my clients trusted root CAs, however I am not able to get the SSL communication through. I believe this is because stunnel should send all the three certificates for authentication and I couldnt configure stunnel to send across all the three certificates. Can anybody please help install all these certificates on stunnel. Thanks in advance, Satyajit

1 0

Cannot install stunnel as a service on Vista
by Neil Aggarwal 12 Apr '07

12 Apr '07

Hello: I cannot install stunnel as a service on Vista. I get a permission denied error. Is there a way to work around it? Thanks, Neil -- Neil Aggarwal, (214)986-3533, www.JAMMConsulting.com FREE! Eliminate junk email and reclaim your inbox. Visit http://www.spammilter.com for details.

2 1

forcing checking of local certificates every time
by san san 11 Apr '07

11 Apr '07

Hi, I am using stunnel with verify option with value 3. In value 3 the authentication is carried out using the local trusted certificates. I think stunnel does not check the local trusted certificates directory each and every time. If the connection has already been established then it does not check local trusted certificates , connection can be established using the certificates in cache. Is it possible to force to check the local trusted certificates every time. Regards

2 1

stunnel work with NAT
by atsushi kataoka 11 Apr '07

11 Apr '07

I have one question , does stunnel work with NAT ? I will explain the architecture There are some 10.0.0.XXXX machines and some are 192.0.0.XXXX machines. They are connected to each other via Router which does NAT. My VNC servers are installed on 10.0.0.XXXX and vnc clients on 192.0.0.XXXX I am not able to do the vnc from client to server. Now I want to encrypt the VNC traffic , can stunnel work with NAT? A Kataoka

1 0

running concurrent stunnel instances
by John Taylor 10 Apr '07

10 Apr '07

Greetings, I am running rsync through stunnel 4.20. Each end is a Dell dual cpu, dual core Xeon (each core with hyper-threading) 8 gigs of memory, running Win 2003 Server. The disks are 10K RPM Ultra-320 drives that use hardware raid-5. Right now, I have anywhere between 5 and 8 Scheduled Tasks running at the same time. The reason for this is that the backups need to run in parallel in order to finish within the 15 hour time window. Although I am not certain about an exact number, I believe I would be transferring about 300-400 gig of data each time. Even though I have a gigabit connection between the two servers, I am only seeing 5-6% network utilization. When running the same rsync batch file without stunnel encryption, the throughput was much higher. I would like to see about increasing my throughput with stunnel encryption running. I don't expect it to be as fast as running without stunnel, but I still think I should be able to do better than 5-6% throughput. I am also running a enhanced version of rsync that does not have any issues with NTFS disk fragmentation, since it preallocates the files to the final size before writing. I think the bottleneck is the CPU. To test out this theory, I would like to have multiple copies of the stunnel.exe running, each using their own config file and own port numbers. I don't think the problem is with rsync because it spawns a new process for each connection. Thus, the multiple rsync.exe processes get the advantage of running on top of multiple cores. This is not the case with stunnel.exe. It only uses 1 process, but 8 threads. I am hoping that multiple stunnel.exe instances will fix the bottleneck because each stunnel.exe process could then be running on it's own core. How can I accomplish this? Also, what is the fastest encryption cipher that stills has good security, over 64 bit, preferably at least 128 bit. Any help would be greatly appreciated. Thanks, -John Stunnel.conf on server: cert = my.pem verify = 3 CAfile = my.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 taskbar=no debug = 5 output = stunnel.log [rsynctnl] accept=12345 connect=873 ciphers = AES128-SHA Stunnel.conf on client: cert = my.pem taskbar = no socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 5 output = stunnel.log client = yes [rsynctnl] accept=12345 connect=10.9.8.7:12345 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

3 2

stunnel as ssh client and self signed certificates
by san san 07 Apr '07

07 Apr '07

Hi, I was planning to use stunnel for my rdp based product. I have several trivial doubts,but since i would be using the same in my product. I would like to know following 1.Actually i want to use stunnel in the same way as ssh i.e Client authentication only , i don't want server authentication at all in my client. So it is possible to not check any server certificate from client side. If i will be using client certificate 2.Is it possible to use self-signed certificate ? I am aware of the drawbacks of using self-signed certificates but because of some inevitable reason i have to use self-signed certificates. I am sorry for my poor knowledge. Regards

1 0

Is it possible to see the "real" IP of the client?
by Konrad Hammerer 05 Apr '07

05 Apr '07

Hi! I want to use STunnel to secure my IMAP connections to my mail server. It works fine but from now on the mail server shows 127.0.0.1 for the open imap client connections. Is there a way to get STunnel forward the real IP or is this impossible? Thanks, Konrad

2 1

How to generate my own certificate for my dynamic dns
by Konrad Hammerer 05 Apr '07

05 Apr '07

Hi! I read somewere, that it is possible to generate a certificate for STunnel. The certificate shipped with the stunnel installer is just for testing purpose, isn't it? So were can I get my own, secure certificate? Thanks, Konrad

2 1

User nobody logging in
by Dimitri Yioulos 29 Mar '07

29 Mar '07

Hi, folks. I've been using stunnel on our mail server (sendmail, spamassassin, clamav, mailscanner, mailwatch). I note the following being written to syslog, and wonder if stunnel is causing it: Mar 29 14:07:31 mail1 su(pam_unix)[29493]: session closed for user nobody Mar 29 14:08:00 mail1 stunnel: LOG5[15993:3076422576]: pop3s accepted connection from 192.168.100.58:1723 Mar 29 14:08:00 mail1 stunnel: LOG5[15993:3076422576]: pop3s connected remote server from 127.0.0.1:33540 Mar 29 14:08:00 mail1 stunnel: LOG5[15993:3076422576]: Connection closed: 138 bytes sent to SSL, 42 bytes sent to socket Mar 29 14:08:43 mail1 su(pam_unix)[29640]: session opened for user nobody by (uid=0) Mar 29 14:08:43 mail1 su(pam_unix)[29640]: session closed for user nobody Mar 29 14:09:00 mail1 stunnel: LOG5[15993:3076422576]: pop3s accepted connection from 192.168.100.58:1724 Mar 29 14:09:00 mail1 stunnel: LOG5[15993:3076422576]: pop3s connected remote server from 127.0.0.1:33544 Mar 29 14:09:00 mail1 stunnel: LOG5[15993:3076422576]: Connection closed: 138 bytes sent to SSL, 42 bytes sent to socket Mar 29 14:10:00 mail1 stunnel: LOG5[15993:3076422576]: pop3s accepted connection from 192.168.100.58:1725 Mar 29 14:10:00 mail1 stunnel: LOG5[15993:3076422576]: pop3s connected remote server from 127.0.0.1:33546 Mar 29 14:10:00 mail1 stunnel: LOG5[15993:3076422576]: Connection closed: 138 bytes sent to SSL, 42 bytes sent to socket Mar 29 14:10:11 mail1 su(pam_unix)[30025]: session opened for user nobody by (uid=0) Mar 29 14:10:11 mail1 su(pam_unix)[30025]: session closed for user nobody Mar 29 14:10:33 mail1 su(pam_unix)[30075]: session opened for user nobody by (uid=0) Mar 29 14:10:33 mail1 su(pam_unix)[30075]: session closed for user nobody Mar 29 14:11:00 mail1 stunnel: LOG5[15993:3076422576]: pop3s accepted connection from 192.168.100.58:1726 Mar 29 14:11:00 mail1 stunnel: LOG5[15993:3076422576]: pop3s connected remote server from 127.0.0.1:33559 Mar 29 14:11:00 mail1 stunnel: LOG5[15993:3076422576]: Connection closed: 138 bytes sent to SSL, 42 bytes sent to socket Mar 29 14:11:03 mail1 su(pam_unix)[30206]: session opened for user nobody by (uid=0) Mar 29 14:11:03 mail1 su(pam_unix)[30206]: session closed for user nobody Mar 29 14:11:06 mail1 su(pam_unix)[30215]: session opened for user nobody by (uid=0) Mar 29 14:11:06 mail1 su(pam_unix)[30215]: session closed for user nobody It's the sessions opened and closed for the user nobody that has me concerned. stunnel appears to be the only process being run by the user nobody. If, in fact, this is caused by stunnel, do I keep these (and only these) session opened/closed instances from being logged? Thanks. Dimitri -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

trouble shooting Pan issue
by eph man 29 Mar '07

29 Mar '07

hi, i'm trying to trouble shoot a problem with a newsreader called pan that i might be having. here's my setup: ubuntu 6.10 kernel 2.6.17 pan 0.14.2 stunnel4 4.150 i created a snntp.conf file with only: client = yes foreground = yes debug = 7 [nntps] accept = localhost:2000 connect = inetnews.worldnet.att.net:563 then i run stunnel4 and this is the output: ephman@wintermute:~$ sudo stunnel4 /etc/stunnel/snntp.conf 2007.03.29 13:54:47 LOG7[13414:3083015856]: RAND_status claims sufficient entropy for the PRNG 2007.03.29 13:54:47 LOG6[13414:3083015856]: PRNG seeded successfully 2007.03.29 13:54:47 LOG7[13414:3083015856]: SSL context initialized for service nntps 2007.03.29 13:54:47 LOG5[13414:3083015856]: stunnel 4.15 on i486-pc-linux-gnu with OpenSSL 0.9.8b 04 May 2006 2007.03.29 13:54:47 LOG5[13414:3083015856]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2007.03.29 13:54:47 LOG6[13414:3083015856]: file ulimit = 1024 (can be changed with 'ulimit -n') 2007.03.29 13:54:47 LOG6[13414:3083015856]: poll() used - no FD_SETSIZE limit for file descriptors 2007.03.29 13:54:47 LOG5[13414:3083015856]: 500 clients allowed 2007.03.29 13:54:47 LOG7[13414:3083015856]: FD 3 in non-blocking mode 2007.03.29 13:54:47 LOG7[13414:3083015856]: FD 4 in non-blocking mode 2007.03.29 13:54:47 LOG7[13414:3083015856]: FD 5 in non-blocking mode 2007.03.29 13:54:47 LOG7[13414:3083015856]: SO_REUSEADDR option set on accept socket 2007.03.29 13:54:47 LOG7[13414:3083015856]: nntps bound to 127.0.0.1:2000 2007.03.29 13:54:47 LOG7[13414:3083015856]: Created pid file /var/run/stunnel4.pid i then startup pan and it won't connect to the server the log file says: Thu, 29 Mar 2007 13:58:15 - Pan 0.14.2.91 Started Thu, 29 Mar 2007 13:58:15 - Directory "/home/ephman/.pan/messages/cache" contains 0.0 MB in 0 files Thu, 29 Mar 2007 13:58:15 - Directory "/home/ephman/.pan/messages/folders/pan.sent" contains 0.0 MB in 0 files Thu, 29 Mar 2007 13:58:15 - Directory "/home/ephman/.pan/messages/folders/pan.sendlater" contains 0.0 MB in 0 files Thu, 29 Mar 2007 13:58:15 - News server connection count: 0 Thu, 29 Mar 2007 13:58:19 - New connection 0x846da08 for inetnews.worldnet.att.net, port 563 Thu, 29 Mar 2007 13:59:21 - NNTP handshake failed: Error reading from socket. Thu, 29 Mar 2007 13:59:21 - Handshake failed: Error reading from socket. Thu, 29 Mar 2007 13:59:26 - New connection 0x84a5850 for inetnews.worldnet.att.net, port 563 any help or hints would be really helpful. thanks. be well, ephman

1 0

Simple Stunnel Question
by mdpeters 28 Mar '07

28 Mar '07

My goal is to have a web server transfer MySQL data via an AES tunnel to a MySQL database server with an added encryption card. Both systems have the same SSL and Stunnel software installed. My web servers database seems to be functioning as normal. I would like to verify that what I have is complete and effective. It is not apparent to me if I have finished construction or how to verify this works like I want it to. I'm not sure how I would verify that Stunnel is being used? Do I need to run Stunnel as a background service full time? Is there something I am missing here? Comments and advice is appreciated! ++++++ # /usr/local/sbin/stunnel -version stunnel 4.20 on sparc-sun-solaris2.10 with OpenSSL 0.9.8e 23 Feb 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none # gcc -v Reading specs from /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/specs Configured with: ../configure --with-as=/usr/ccs/bin/as --with-ld=/usr/ccs/bin/ld --disable-nls Thread model: posix gcc version 3.3.2 # uname -a SunOS slinky 5.10 Generic_118833-17 sun4u sparc SUNW,Ultra-80 # /usr/local/sbin/stunnel -sockets Socket option defaults: Option Accept Local Remote OS default SO_DEBUG -- -- -- 0 SO_DONTROUTE -- -- -- 0 SO_KEEPALIVE -- -- -- 0 SO_LINGER -- -- -- 0:0 SO_OOBINLINE -- -- -- 0 SO_RCVBUF -- -- -- 65535 SO_SNDBUF -- -- -- 65535 SO_RCVLOWAT -- -- -- -- SO_SNDLOWAT -- -- -- -- SO_RCVTIMEO -- -- -- -- SO_SNDTIMEO -- -- -- -- SO_REUSEADDR 1 -- -- 0 IP_TOS -- -- -- 0 IP_TTL -- -- -- 64 TCP_NODELAY -- -- -- 0 # openssl ciphers -v DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 DHE-DSS-AES256-SHA SSLv3 Kx=DH Au=DSS Enc=AES(256) Mac=SHA1 AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 EDH-RSA-DES-CBC3-SHA SSLv3 Kx=DH Au=RSA Enc=3DES(168) Mac=SHA1 EDH-DSS-DES-CBC3-SHA SSLv3 Kx=DH Au=DSS Enc=3DES(168) Mac=SHA1 DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 DES-CBC3-MD5 SSLv2 Kx=RSA Au=RSA Enc=3DES(168) Mac=MD5 DHE-RSA-AES128-SHA SSLv3 Kx=DH Au=RSA Enc=AES(128) Mac=SHA1 DHE-DSS-AES128-SHA SSLv3 Kx=DH Au=DSS Enc=AES(128) Mac=SHA1 AES128-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 IDEA-CBC-SHA SSLv3 Kx=RSA Au=RSA Enc=IDEA(128) Mac=SHA1 IDEA-CBC-MD5 SSLv2 Kx=RSA Au=RSA Enc=IDEA(128) Mac=MD5 RC2-CBC-MD5 SSLv2 Kx=RSA Au=RSA Enc=RC2(128) Mac=MD5 RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 RC4-MD5 SSLv2 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 EDH-RSA-DES-CBC-SHA SSLv3 Kx=DH Au=RSA Enc=DES(56) Mac=SHA1 EDH-DSS-DES-CBC-SHA SSLv3 Kx=DH Au=DSS Enc=DES(56) Mac=SHA1 DES-CBC-SHA SSLv3 Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 DES-CBC-MD5 SSLv2 Kx=RSA Au=RSA Enc=DES(56) Mac=MD5 EXP-EDH-RSA-DES-CBC-SHA SSLv3 Kx=DH(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-EDH-DSS-DES-CBC-SHA SSLv3 Kx=DH(512) Au=DSS Enc=DES(40) Mac=SHA1 export EXP-DES-CBC-SHA SSLv3 Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-RC2-CBC-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC2-CBC-MD5 SSLv2 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC4-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export EXP-RC4-MD5 SSLv2 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export ++++++

1 0

Stunnel support or OpenSSL in FIPS mode
by George Henson 26 Mar '07

26 Mar '07

All, Are there any current plans to include FIPS complaint mode in stunnel? I have asked some of my peers on other US Government projects and they indicated this would be a help to them as well. Looking at the users guide from the OpenSSL site (http://www.openssl.org/docs/fips/UserGuide-1.1.1.pdf) it would not appear to be a great amount of effort to make a stunnel that functions in a FIPS complaint mode. Attached I have included the patch I have created (with some help from friends). It does not do the final linking correctly as I am not very good with autmake. Please let me know what you think. Thank you George diff -u -r @stunnel-4.20/configure.ac stunnel-4.20/configure.ac --- @stunnel-4.20/configure.ac 2006-11-11 09:58:01.000000000 -0500 +++ stunnel-4.20/configure.ac 2007-03-26 18:35:09.000000000 -0400 @@ -260,6 +260,51 @@ CFLAGS="$CFLAGS -I$ssldir/include" LIBS="$LIBS -L$ssldir/lib -lssl -lcrypto" +AC_ARG_WITH(fips, + [ --with-fips Enable OpenSSL FIPS mode], + [ + if test "x$withval" != "xno" ; then + INCLUDES="=l$ssldir/include" + AC_CACHE_CHECK([for FIPS mode], ac_cv_fips, [ + AC_TRY_COMPILE( + [ #include <openssl/fips.h> ], + [ FIPS_mode_set(1); ], + [ ac_cv_fips="yes" ], + [ ac_cv_fips="no" ] + ) + ]) + fi + ] +) +if test "x$ac_cv_fips" = "xyes" ; then + CPPFLAGS="$CPPFLAGS -DOPENSSL_FIPS" + FIPS_MODE=yes + AC_SUBST(FIPS_MODE) +fi + +AC_ARG_WITH(fips, + [ --with-fips Enable OpenSSL FIPS mode], + [ + if test "x$withval" != "xno" ; then + INCLUDES="=l$ssldir/include" + AC_CACHE_CHECK([for FIPS mode], ac_cv_fips, [ + AC_TRY_COMPILE( + [ #include <openssl/fips.h> ], + [ FIPS_mode_set(1); ], + [ ac_cv_fips="yes" ], + [ ac_cv_fips="no" ] + ) + ]) + fi + ] +) +if test "x$ac_cv_fips" = "xyes" ; then + CPPFLAGS="$CPPFLAGS -DOPENSSL_FIPS" + FIPS_MODE=yes + AC_SUBST(FIPS_MODE) +fi +AM_CONDITIONAL(FIPS_MODE, test x$ac_cv_fips = xyes) + # Check for obsolete RSAref library AC_MSG_CHECKING([for obsolete RSAref library]) saved_LIBS="$LIBS" Only in stunnel-4.20: configure.ac.orig diff -u -r @stunnel-4.20/src/common.h stunnel-4.20/src/common.h --- @stunnel-4.20/src/common.h 2006-11-17 04:03:18.000000000 -0500 +++ stunnel-4.20/src/common.h 2007-03-26 18:35:03.000000000 -0400 @@ -321,6 +321,9 @@ #if SSLEAY_VERSION_NUMBER >= 0x00907000L #include <openssl/ocsp.h> #endif /* OpenSSL-0.9.7 */ +#ifdef OPENSSL_FIPS +#include <openssl/fips.h> +#endif #else /* HAVE_OPENSSL */ #include <lhash.h> #include <ssl.h> diff -u -r @stunnel-4.20/src/options.c stunnel-4.20/src/options.c --- @stunnel-4.20/src/options.c 2006-11-05 08:04:37.000000000 -0500 +++ stunnel-4.20/src/options.c 2007-03-26 18:35:03.000000000 -0400 @@ -556,7 +556,11 @@ /* ciphers */ switch(cmd) { case CMD_INIT: +#ifndef OPENSSL_FIPS section->cipher_list=SSL_DEFAULT_CIPHER_LIST; +#else + section->cipher_list="!ADH:!RC4:!RC2:!IDEA:!MD5:!NULL:TLSv1"; +#endif break; case CMD_EXEC: if(strcasecmp(opt, "ciphers")) @@ -564,7 +568,11 @@ section->cipher_list=stralloc(arg); return NULL; /* OK */ case CMD_DEFAULT: +#ifndef OPENSSL_FIPS log_raw("%-15s = %s", "ciphers", SSL_DEFAULT_CIPHER_LIST); +#else + log_raw("%-15s = %s", "ciphers", "!ADH:!RC4:!RC2:!IDEA:!MD5:!NULL:TLSv1"); +#endif break; case CMD_HELP: log_raw("%-15s = list of permitted SSL ciphers", "ciphers"); @@ -726,6 +734,31 @@ } #endif + /* fips mode */ +#ifndef USE_WIN32 + switch(cmd) { + case CMD_INIT: + options.option.fips_mode=0; + break; + case CMD_EXEC: + if(strcasecmp(opt, "fips")) + break; + if(!strcasecmp(arg, "yes")) + options.option.fips_mode = 1; + else if(!strcasecmp(arg, "no")) + options.option.fips_mode = 0; + else + return "argument should be either 'yes' or 'no'"; + return NULL; /* OK */ + case CMD_DEFAULT: + break; + case CMD_HELP: + log_raw("%-15s = yes|no FIPS mode", + "fips"); + break; + } +#endif + /* execargs */ #ifndef USE_WIN32 switch(cmd) { diff -u -r @stunnel-4.20/src/prototypes.h stunnel-4.20/src/prototypes.h --- @stunnel-4.20/src/prototypes.h 2006-11-11 08:03:05.000000000 -0500 +++ stunnel-4.20/src/prototypes.h 2007-03-26 18:35:03.000000000 -0400 @@ -142,6 +142,7 @@ unsigned int foreground:1; unsigned int syslog:1; /* log to syslog */ unsigned int rand_write:1; /* overwrite rand_file */ + unsigned int fips_mode:1; #ifdef USE_WIN32 unsigned int taskbar:1; /* enable the taskbar icon */ #endif diff -u -r @stunnel-4.20/src/stunnel.c stunnel-4.20/src/stunnel.c --- @stunnel-4.20/src/stunnel.c 2006-11-30 15:47:45.000000000 -0500 +++ stunnel-4.20/src/stunnel.c 2007-03-26 18:35:03.000000000 -0400 @@ -59,6 +59,7 @@ #ifndef USE_WIN32 int main(int argc, char* argv[]) { /* execution begins here 8-) */ +unsigned long e; main_initialize(argc>1 ? argv[1] : NULL, argc>2 ? argv[2] : NULL); signal(SIGPIPE, SIG_IGN); /* avoid 'broken pipe' signal */ @@ -72,6 +73,21 @@ signal(SIGHUP, signal_handler); /* signal(SIGSEGV, signal_handler); */ +#ifdef OPENSSL_FIPS + if(options.option.fips_mode) { + if (!FIPS_mode_set(1)) { + log_raw("Failed to enter FIPS mode"); + ERR_load_crypto_strings(); + while((e = ERR_get_error())) { + log_raw(ERR_error_string(e,NULL)); + } + return 1; /* failure */ + } else { + log_raw("FIPS mode enabled"); + } + } +#endif + main_execute(); return 0; /* success */

1 0

using an ocsp
by Samuel Landau 26 Mar '07

26 Mar '07

Hello, I am using stunnel 4.18 and openca-ocspd 1.5.1. The OCSPd uses a delegate certificate and the setup works when tested with openssl: $ openssl ocsp -issuer /home/landau/ssl/cacert.pem -serial 3 -url http://localhost:2560 -CAfile /home/landau/ssl/cacert.pem Response verify OK 3: good This Update: Mar 23 18:27:37 2007 GMT Next Update: Mar 26 10:56:33 2007 GMT But when it comes to using stunnel, I cannot figure out how to make it use properly the OCSP. I could see that stunnel 4.19 had more options for ocsp, but I am unsure this is related to my current issue. Besides, is there a way to have stunnel fall back on local cert/crl files if the ocsp server is not available ? Regards, -- Samuel Landau ____________________________________________________________________________ This email and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to which they are addressed. Access to this e-mail by anyone else is unauthorised. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited. E-mail messages are not necessarily secure. Archos does not accept responsibility for any changes made to this message after it was sent. 2007.03.26 12:59:05 LOG5[29250:3083020512]: stunnel 4.18 on i486-pc-linux-gnu with OpenSSL 0.9.8c 05 Sep 2006 2007.03.26 12:59:05 LOG5[29250:3083020512]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2007.03.26 12:59:05 LOG6[29250:3083020512]: file ulimit = 1024 (can be changed with 'ulimit -n') 2007.03.26 12:59:05 LOG6[29250:3083020512]: poll() used - no FD_SETSIZE limit for file descriptors 2007.03.26 12:59:05 LOG5[29250:3083020512]: 500 clients allowed 2007.03.26 12:59:05 LOG7[29250:3083020512]: FD 4 in non-blocking mode 2007.03.26 12:59:05 LOG7[29250:3083020512]: FD 5 in non-blocking mode 2007.03.26 12:59:05 LOG7[29250:3083020512]: FD 6 in non-blocking mode 2007.03.26 12:59:05 LOG7[29250:3083020512]: SO_REUSEADDR option set on accept socket 2007.03.26 12:59:05 LOG7[29250:3083020512]: server bound to 127.0.0.1:12345 2007.03.26 12:59:05 LOG7[29250:3083020512]: Created pid file /home/landau/stunnel4.pid 2007.03.26 12:59:12 LOG7[29250:3083020512]: server accepted FD=7 from 127.0.0.1:36200 2007.03.26 12:59:12 LOG7[29250:3082972080]: server started 2007.03.26 12:59:12 LOG7[29250:3082972080]: FD 7 in non-blocking mode 2007.03.26 12:59:12 LOG7[29250:3082972080]: TCP_NODELAY option set on local socket 2007.03.26 12:59:12 LOG7[29250:3082972080]: FD 8 in non-blocking mode 2007.03.26 12:59:12 LOG7[29250:3082972080]: FD 9 in non-blocking mode 2007.03.26 12:59:12 LOG7[29250:3083020512]: Cleaning up the signal pipe 2007.03.26 12:59:12 LOG6[29250:3083020512]: Child process 29252 finished with code 0 2007.03.26 12:59:12 LOG7[29250:3082972080]: Connection from 127.0.0.1:36200 permitted by libwrap 2007.03.26 12:59:12 LOG5[29250:3082972080]: server connected from 127.0.0.1:36200 2007.03.26 12:59:12 LOG7[29250:3082972080]: SSL state (accept): before/accept initialization 2007.03.26 12:59:12 LOG7[29250:3082972080]: SSL state (accept): SSLv3 read client hello A 2007.03.26 12:59:12 LOG7[29250:3082972080]: SSL state (accept): SSLv3 write server hello A 2007.03.26 12:59:12 LOG7[29250:3082972080]: SSL state (accept): SSLv3 write certificate A 2007.03.26 12:59:12 LOG7[29250:3082972080]: SSL state (accept): SSLv3 write certificate request A 2007.03.26 12:59:12 LOG7[29250:3082972080]: SSL state (accept): SSLv3 flush data 2007.03.26 12:59:12 LOG6[29250:3082972080]: *** starting OCSP verification *** 2007.03.26 12:59:12 LOG7[29250:3082972080]: FD 8 in non-blocking mode 2007.03.26 12:59:12 LOG7[29250:3082972080]: connect_wait: waiting 10 seconds 2007.03.26 12:59:12 LOG7[29250:3082972080]: connect_wait: connected 2007.03.26 12:59:12 LOG7[29250:3082972080]: OCSP server connected 2007.03.26 12:59:12 LOG7[29250:3082972080]: FD 8 in blocking mode 2007.03.26 12:59:12 LOG7[29250:3082972080]: FD 8 in non-blocking mode 2007.03.26 12:59:12 LOG6[29250:3082972080]: OCSP response received 2007.03.26 12:59:12 LOG3[29250:3082972080]: OCSP_basic_verify: 27069076: error:27069076:OCSP routines:OCSP_basic_verify:signer certificate not found 2007.03.26 12:59:12 LOG7[29250:3082972080]: SSL alert (write): fatal: certificate unknown 2007.03.26 12:59:12 LOG3[29250:3082972080]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2007.03.26 12:59:12 LOG5[29250:3082972080]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.03.26 12:59:12 LOG7[29250:3082972080]: server finished (0 left) 2007.03.26 12:59:16 LOG3[29250:3083020512]: Received signal 2; terminating 2007.03.26 12:59:16 LOG7[29250:3083020512]: removing pid file /home/landau/stunnel4.pid cert = landau.pem key = landau.key sslVersion = SSLv3 pid =/home/landau/ssl/stunnel4.pid socket =l:TCP_NODELAY=1 socket =r:TCP_NODELAY=1 compression =zlib foreground =yes verify =3 CApath =/home/landau/ssl/ CAfile =/home/landau/ssl/cacert.pem debug =7 output =/home/landau/ssl/stunnel4.log client =no [server] accept =localhost:12345 ocsp =http://localhost:2560 pty =no exec =/bin/bash execargs =bash

1 0

[win32] stunnel/OpenSSL/Synergy howto
by P. Jansen 25 Mar '07

25 Mar '07

Hi stunnel users and especially newbies, on http://stunnel.mirt.net/docs.html you can find a link to a stunnel/OpenSSL/Synergy howto for the Win32 platform. It is a short but hopefully useful doc how to install, configure and use stunnel. Feedback and comments are welcome. - Patrick

1 0

Solaris 10 and MySQL questions
by mdpeters 25 Mar '07

25 Mar '07

My goal is to have a web server transfer MySQL data via an AES tunnel to a MySQL database server with an added encryption card. Both systems have the same SSL and Stunnel software installed. My web servers database seems to be functioning as normal. I would like to verify that what I have is complete and effective. It is not apparent to me if I have finished construction or how to verify this works like I want it to. I'm not sure how I would verify that Stunnel is being used. Do I need to run Stunnel as a background service full time? Is there something I am missing here? ++++++ # /usr/local/sbin/stunnel -version stunnel 4.20 on sparc-sun-solaris2.10 with OpenSSL 0.9.8e 23 Feb 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none # gcc -v Reading specs from /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/specs Configured with: ../configure --with-as=/usr/ccs/bin/as --with-ld=/usr/ccs/bin/ld --disable-nls Thread model: posix gcc version 3.3.2 # uname -a SunOS slinky 5.10 Generic_118833-17 sun4u sparc SUNW,Ultra-80 # /usr/local/sbin/stunnel -sockets Socket option defaults: Option Accept Local Remote OS default SO_DEBUG -- -- -- 0 SO_DONTROUTE -- -- -- 0 SO_KEEPALIVE -- -- -- 0 SO_LINGER -- -- -- 0:0 SO_OOBINLINE -- -- -- 0 SO_RCVBUF -- -- -- 65535 SO_SNDBUF -- -- -- 65535 SO_RCVLOWAT -- -- -- -- SO_SNDLOWAT -- -- -- -- SO_RCVTIMEO -- -- -- -- SO_SNDTIMEO -- -- -- -- SO_REUSEADDR 1 -- -- 0 IP_TOS -- -- -- 0 IP_TTL -- -- -- 64 TCP_NODELAY -- -- -- 0 # openssl ciphers -v DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 DHE-DSS-AES256-SHA SSLv3 Kx=DH Au=DSS Enc=AES(256) Mac=SHA1 AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 EDH-RSA-DES-CBC3-SHA SSLv3 Kx=DH Au=RSA Enc=3DES(168) Mac=SHA1 EDH-DSS-DES-CBC3-SHA SSLv3 Kx=DH Au=DSS Enc=3DES(168) Mac=SHA1 DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 DES-CBC3-MD5 SSLv2 Kx=RSA Au=RSA Enc=3DES(168) Mac=MD5 DHE-RSA-AES128-SHA SSLv3 Kx=DH Au=RSA Enc=AES(128) Mac=SHA1 DHE-DSS-AES128-SHA SSLv3 Kx=DH Au=DSS Enc=AES(128) Mac=SHA1 AES128-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 IDEA-CBC-SHA SSLv3 Kx=RSA Au=RSA Enc=IDEA(128) Mac=SHA1 IDEA-CBC-MD5 SSLv2 Kx=RSA Au=RSA Enc=IDEA(128) Mac=MD5 RC2-CBC-MD5 SSLv2 Kx=RSA Au=RSA Enc=RC2(128) Mac=MD5 RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 RC4-MD5 SSLv2 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 EDH-RSA-DES-CBC-SHA SSLv3 Kx=DH Au=RSA Enc=DES(56) Mac=SHA1 EDH-DSS-DES-CBC-SHA SSLv3 Kx=DH Au=DSS Enc=DES(56) Mac=SHA1 DES-CBC-SHA SSLv3 Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 DES-CBC-MD5 SSLv2 Kx=RSA Au=RSA Enc=DES(56) Mac=MD5 EXP-EDH-RSA-DES-CBC-SHA SSLv3 Kx=DH(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-EDH-DSS-DES-CBC-SHA SSLv3 Kx=DH(512) Au=DSS Enc=DES(40) Mac=SHA1 export EXP-DES-CBC-SHA SSLv3 Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-RC2-CBC-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC2-CBC-MD5 SSLv2 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC4-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export EXP-RC4-MD5 SSLv2 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export ++++++

1 0

How to surf the web over proxy?
by P. Jansen 25 Mar '07

25 Mar '07

Hi, I know there is a way to do the following with SSH+PuTTY, with stunnel too? Do I need further software? Windows office computer --> (HTTP) --> Corporate firewall/proxy --> (HTTP) --> Home computer --> WWW Regards, Patrick

1 0

Stunnel 4.20 with TCP Wrappers 7.6 problem in configure.ac
by lists＠d-ra.ath.cx 18 Mar '07

18 Mar '07

Hi, the following patch makes stunnel 4.20 to operate with TCP wrappers 7.6. I had not tried other versions of stunnel nor TCP wrappers. The problem is the missing libnsl, so TCP wrappers will never be activated in ./configure Regards Dieter --- configure.ac.orig 2007-03-17 12:57:32.000000000 +0100 +++ configure.ac 2007-03-17 12:55:19.000000000 +0100 @@ -310,7 +310,7 @@ AC_MSG_RESULT([no (autodetecting)]) AC_MSG_CHECKING([for hosts_access in -lwrap]) saved_LIBS="$LIBS" - LIBS="$saved_LIBS -lwrap" + LIBS="$saved_LIBS -lwrap -lnsl" AC_LINK_IFELSE( [AC_LANG_PROGRAM( [[int hosts_access(); int allow_severity, deny_severity;]],

2 9

Getting a "Peer suddenly disconnected" error
by David Goodwin 09 Mar '07

09 Mar '07

Hey all, I'm getting this in the /var/adm/messages log on the server side when attempting to connect from the client: Mar 8 22:23:33 SERVERNAME stunnel: [ID 821868 daemon.error] LOG3[27429:4]: SSL_connect: Peer suddenly disconnected I have the server configured as follows: cat /etc/stunnel/stunnel.test.conf client=yes debug=debug cert=/etc/stunnel/stunnel.pem [sunrpc] accept=112 connect=127.0.0.1:111 TIMEOUTclose=10 This is started just by running stunnel with the config file and then starting rpcbind normally. The client is configured as follows: # cat /etc/stunnel/stunnel.test.conf client=yes debug=debug cert=/etc/stunnel/imnxnsm0.pem [sunrpc] accept=111 connect=SERVERNAME:112 The error shows up when I attempt to run "rpcinfo -p 127.0.0.1". Snoop is showing the following (adjusted to remove hostnames/ips): CLIENT -> SERVER TCP D=112 S=63986 Syn Seq=867918817 Len=0 Win=24820 Options=<nop,nop,sackOK,mss 1460> SERVER -> CLIENT TCP D=63986 S=112 Syn Ack=867918818 Seq=209756753 Len=0 Win=24820 Options=<nop,nop,sackOK,mss 1460> CLIENT -> SERVER TCP D=112 S=63986 Ack=209756754 Seq=867918818 Len=0 Win=24820 CLIENT -> SERVER TCP D=112 S=63986 Ack=209756754 Seq=867918818 Len=88 Win=24820 SERVER -> CLIENT TCP D=63986 S=112 Ack=867918906 Seq=209756754 Len=0 Win=24820 SERVER -> CLIENT TCP D=63986 S=112 Rst Seq=209756754 Len=0 Win=24820 I'm pretty new to stunnel, and am having a heck of a time getting this to work. This configuration is the closest I've been to success so far. Is there a better way for me to wrap rpcbind perhaps? Any help with this will be appreciated. Thanks, Civil

2 2

DLLs for OpenSSL 0.9.8e
by Michal Trojnara 09 Mar '07

09 Mar '07

Dear Users, I've built the DLLs for OpenSSL 0.9.8e. They're available for download from: ftp://stunnel.mirt.net/openssl/binary-0.9.8e-zdll/ Best regards, Mike

1 0

problem accesing a https site as a Windows version client
by Gustavo 09 Mar '07

09 Mar '07

I'm running stunnel version 4.2 on Windows XP I can access a lot of websites, example https://servicios.afip.gov.ar/tramites_con_clave_fiscal/misAportes/images/t… but CAN'T access https://apwebserver.rentasgcba.gov.ar/ablpatib_ssl/images/Actitud_BsAs_negr… apparently a response never arrives to my PC my conf file is cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 ; Use it for client mode client = yes ; Service-level configuration [https1] client = yes accept = 6001 connect = servicios.afip.gov.ar:443 TIMEOUTclose = 0 [https] client = yes accept = 6002 connect = apwebserver.rentasgcba.gov.ar:443 TIMEOUTclose = 5 ; vim:ft=dosini

2 1

Download speed affected with stunnel help needed please.
by tom hammond 07 Mar '07

07 Mar '07

Using HFS 2.1d http://www.rejetto.com and Stunnel 4.20 on single WinXP machine. The list of parameters you are using for stunnel, and if you are running it standalone or from inetd/xinetd: socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [https] accept = # connect = # TIMOUTclose = 0 I dont'understand 3-7 as given here: http://www.stunnel.org/support/ only used OpenSSL to make CERT Win32 OpenSSL v0.9.8e Light *************************************** Description: HFS is a webserver that can only utilize HTTP, therefore I turned to Stunnel to implement https. When using HTTPs: for UPLOADING I get full speed. When using HTTPs: for DOWNLoADING the speed in cut drastically, 20x slower. The odd thing is, multiple downloads can go at once eg: 20 connections @80kb/second However no single connection will get over 80 or 100kb/second I searched the net and couldn't find a solution, but continuously came across mention of "loopback" problems with stunnel and http servers (old posts) or saying stuff about Microsoft winsock, found a few mentions of VNC server having an option to "enable loopback connections" Another thing I saw but closed (oops) was mention of disabling an HTTP server in order to avoid loopback problems with HTTPS serving.(HFS has no option because it is designed to serve ONLY HTTP) I have tons of hope for an easy solution for the following reasons: #1, uploading works perfect #2 just downloaded demo of Easy File Sharing Web Server(not free like HFS) and the download speed works through HTTPS. I have no clue as to how to fix this, saw one entry in the stunnel config at ssl.org: socket = a:SO_BINDTODEVICE=lo I DID attempt to enter this line into the config under my 2 original entries, but then stunnel would not start. Thank you --------------------------------- TV dinner still cooling? Check out "Tonight's Picks" on Yahoo! TV.

1 0

init_ssl: s_poll_wait timeout
by William Biagi 06 Mar '07

06 Mar '07

I am using a Eudora client configured to use STARTLS to send mail through stunnel to a sendmail server. The stunnel config is as follows: cert = /usr/local/etc/stunnel/stunnel.pem key = /usr/local/etc/stunnel/stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 options = DONT_INSERT_EMPTY_FRAGMENTS delay = yes TIMEOUTconnect = 300 TIMEOUTbusy = 300 setuid = smtpauth setgid = smtpauth debug = 7 client = no foreground = yes pid = [smtps] accept = 465 connect = localhost:25 protocol=smtp When I send mail the connection is established with port 465 on stunnel but it fails to negotiate the ssl session. THis is the log: 2007.03.06 15:45:08 LOG7[17753:1024]: Snagged 64 random bytes from /root/.rnd 2007.03.06 15:45:08 LOG7[17753:1024]: Wrote 1024 new random bytes to /root/.rnd 2007.03.06 15:45:08 LOG7[17753:1024]: RAND_status claims sufficient entropy for the PRNG 2007.03.06 15:45:08 LOG7[17753:1024]: PRNG seeded successfully 2007.03.06 15:45:08 LOG7[17753:1024]: Configuration SSL options: 0x00000800 2007.03.06 15:45:08 LOG7[17753:1024]: SSL options set: 0x00000800 2007.03.06 15:45:08 LOG7[17753:1024]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2007.03.06 15:45:08 LOG7[17753:1024]: Certificate loaded 2007.03.06 15:45:08 LOG7[17753:1024]: Key file: /usr/local/etc/stunnel/stunnel.pem 2007.03.06 15:45:08 LOG7[17753:1024]: Private key loaded 2007.03.06 15:45:08 LOG7[17753:1024]: SSL context initialized for service smtps 2007.03.06 15:45:08 LOG5[17753:1024]: stunnel 4.20 on i686-pc-linux-gnu with OpenSSL 0.9.7l 28 Sep 2006 2007.03.06 15:45:08 LOG5[17753:1024]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 2007.03.06 15:45:08 LOG6[17753:1024]: file ulimit = 1024 (can be changed with 'ulimit -n') 2007.03.06 15:45:08 LOG6[17753:1024]: poll() used - no FD_SETSIZE limit for file descriptors 2007.03.06 15:45:08 LOG5[17753:1024]: 500 clients allowed 2007.03.06 15:45:08 LOG7[17753:1024]: FD 3 in non-blocking mode 2007.03.06 15:45:08 LOG7[17753:1024]: FD 4 in non-blocking mode 2007.03.06 15:45:08 LOG7[17753:1024]: FD 5 in non-blocking mode 2007.03.06 15:45:08 LOG7[17753:1024]: SO_REUSEADDR option set on accept socket 2007.03.06 15:45:08 LOG7[17753:1024]: smtps bound to 0.0.0.0:465 2007.03.06 15:45:08 LOG7[17753:1024]: No pid file being created 2007.03.06 15:45:18 LOG7[17753:1024]: smtps accepted FD=6 from 208.41.111.165:2542 2007.03.06 15:45:18 LOG7[17755:1026]: smtps started 2007.03.06 15:45:18 LOG7[17755:1026]: FD 6 in non-blocking mode 2007.03.06 15:45:18 LOG7[17755:1026]: TCP_NODELAY option set on local socket 2007.03.06 15:45:18 LOG5[17755:1026]: smtps accepted connection from 208.41.111.165:2542 2007.03.06 15:45:18 LOG7[17755:1026]: SSL state (accept): before/accept initialization 2007.03.06 15:45:20 LOG6[17755:1026]: init_ssl: s_poll_wait timeout 2007.03.06 15:45:20 LOG5[17755:1026]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.03.06 15:45:20 LOG7[17755:1026]: smtps finished (0 left) 2007.03.06 15:47:00 LOG3[17753:1024]: Received signal 2; terminating Can anyone tell me what I am doing wrong? BB

1 0

High CPU system usage on Solaris
by armando.salvatori＠accenture.com 05 Mar '07

05 Mar '07

We use stunnel process to encrypt Oracle connections from a set of 4-6 application server. On the DB server, 20 cpus Solaris machine running Oracle, we have more then 400 LWPS for stunnel and the relative 400 oracle connections. We experience a huge amount of cpu usage (system component), about 40%, after stunnel setup (stunnel 4.15 version) Is it usual? Do you have experience on similar situation? Do you have any suggestions to improve cpu usage or to address performance issue/tuning? Thank you very much AS This message is for the designated recipient only and may contain privileged, proprietary, or otherwise private information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the email by you is prohibited.

1 0

make compile error options.c parse_ocsp_url
by William Biagi 03 Mar '07

03 Mar '07

./configure was successful but the make gave me the following: Making all in src make[1]: Entering directory `/home/bbiagi/stunnel-4.20/src' if gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.20\" -DPACKAGE_STRING=\"stunnel\ 4.20\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.20\" -DHOST=\"i686-pc-linux-gnu\" -DCPU_I686=1 -DVENDOR_PC=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_TCPD_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBZ=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_GETCONTEXT=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/usr\" -DHAVE_OSSL_ENGINE_H=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/include -MT options.o -MD -MP -MF ".deps/options.Tpo" -c -o options.o options.c; \ then mv -f ".deps/options.Tpo" ".deps/options.Po"; else rm -f ".deps/options.Tpo"; exit 1; fi options.c: In function `parse_ocsp_url': options.c:1762: warning: implicit declaration of function `OCSP_parse_url' options.c:1767: structure has no member named `ocsp_addr' options.c:1769: structure has no member named `ocsp_path' options.c: In function `parse_ocsp_flag': options.c:1786: `OCSP_NOCERTS' undeclared (first use in this function) options.c:1786: (Each undeclared identifier is reported only once options.c:1786: for each function it appears in.) options.c:1787: `OCSP_NOINTERN' undeclared (first use in this function) options.c:1788: `OCSP_NOSIGS' undeclared (first use in this function) options.c:1789: `OCSP_NOCHAIN' undeclared (first use in this function) options.c:1790: `OCSP_NOVERIFY' undeclared (first use in this function) options.c:1791: `OCSP_NOEXPLICIT' undeclared (first use in this function) options.c:1792: `OCSP_NOCASIGN' undeclared (first use in this function) options.c:1793: `OCSP_NODELEGATED' undeclared (first use in this function) options.c:1794: `OCSP_NOCHECKS' undeclared (first use in this function) options.c:1795: `OCSP_TRUSTOTHER' undeclared (first use in this function) options.c:1796: `OCSP_RESPID_KEY' undeclared (first use in this function) options.c:1797: `OCSP_NOTIME' undeclared (first use in this function) options.c: At top level: options.c:1758: warning: `parse_ocsp_url' defined but not used options.c:1781: warning: `parse_ocsp_flag' defined but not used make[1]: *** [options.o] Error 1 make[1]: Leaving directory `/home/bbiagi/stunnel-4.20/src' make: *** [all-recursive] Error 1 I am trying to install on a red hat 7.3 with openssl-0.9.6b-18

2 1

RE: Stunnel Forks Out of Control
by Duncan Brown 24 Feb '07

24 Feb '07

Hi all, Ok, I've gone through my last log file for when this issue happens. There's "1130 finished (2 left)" (where 1030 is the port we're listening on) at 10:22am, for example. Then, the next "1130 finished" doesn't happen for about another 20 minutes (which is weird), and then says, "1131 finished (124 left)". It's at this point that a lot of "connection reset by peer"'s happen and "0 bytes sent to SSL" also happen. It looks as though there are a bunch of connections being accepted but not handled. Can anyone assist? The debug level 7 log file is available if necessary. Thanks again, guys. Cheers, Duncan

2 1

RE: Stunnel Forks Out of Control
by Duncan Brown 23 Feb '07

23 Feb '07

Hi all, As an update, it looks like I'm using Stunnel 4.15. I thought it said 4.20, unless I managed to compile an older version. Regardless, I think the problem is happening in both versions. It looks as though it can't catch up on processing cached requests or something. Does that help at all? Cheers, Duncan

1 0

Stunnel Forks Out of Control
by Duncan Brown 21 Feb '07

21 Feb '07

Hi all, I apologize if this issue appears in the archives but I've scoured them and can't find any similar instances (if this problem does occur in the archives then if someone could point it out to me I'd be grateful as well). So, here goes: I'm running Stunnel on Debian Linux. I run it in daemon mode and have the .conf file set to listen on a specific port and redirect to another port. Listening on the connecting end of Stunnel is another daemon I've created that listens on the same port for TCP traffic as part of a client-server application I have (a new process is forked for each connection). On the client end is a .NET application that communicates with the server via TCP with Stunnel installed. In my code, I've made sure that whenever a client-server session is finished, the server closes the socket, whether or not there was an error. Now, everything seems to work flawlessly for a period of time (this period of time is variable, from anywhere between 1 day to 1 month). Then, all of a sudden, Stunnel "explodes"; for example, while there might be one or two forks of my own daemon, there might be 128 instances of Stunnel, all of which are in a sleeping state (that is, if I run ps -aux, their "STAT" attribute is "S"), whereas before it exploded it was pretty much a 1:1 relationship. When it "explodes", I have to kill Stunnel and restart it, which is a pain in the rear-end given what I'm trying to do. Why is it doing this? How do I stop it from happening? I apologize again if this has already been brought up somewhere else, but I've been unable to find any references to any similar problems. If it's a "newbie" mistake or something I'll gladly accept it and learn from it. Please find below the information requested for a problem for the mailing list: - I'm using v4.20 - No parameters are used from the command-line when starting Stunnel; it just uses the standard .conf file which I've edited. - Output of "uname -a" : "Linux buffed 2.4.27-2-386 #1 Wed Aug 17 09:33:35 UTC 2005 i686 GNU/Linux" - I'm using libc v6 - Output of "gcc -v" : Reading specs from /usr/lib/gcc-lib/i486-linux/3.3.5/specs Configured with: ../src/configure -v --enable-languages=c,c++,java,f77,pascal,objc,ada,treelang --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --with-gxx-include-dir=/usr/include/c++/3.3 --enable-shared --enable-__cxa_atexit --with-system-zlib --enable-nls --without-included-gettext --enable-clocale=gnu --enable-debug --enable-java-gc=boehm --enable-java-awt=xlib --enable-objc-gc i486-linux Thread model: posix gcc version 3.3.5 (Debian 1:3.3.5-13) - I'm using OpenSSL v0.9.7e (25 Oct 2004) Thanks in advance for any help. Cheers, Duncan

1 0

Stunnel proxy aware
by Kennet Svanberg 21 Feb '07

21 Feb '07

Hi, I'm quite happy with stunnel-4.05 but don't know how to add any of the proxy patches to make my own windows binaries. I also saw that others have wondered http://linode.mirt.net/pipermail/stunnel-users/2006-December/001404.html

1 0

Stunnel on AIX 5.3 and AIX 5.2 - Solution
by Trevor Maistry 21 Feb '07

21 Feb '07

Hi, I downloaded stunnel version 4.05, changed the configuration file to use "cc" instead of "gcc" and compiled on AIX 5300-04 and AIX 5200-03. Compilations worked fine. However, you must compile on the machine you want to use it on. Otherwise you will have problems. Copy the "stunnel", "stunnel.pem" and sample "stunnel.conf-sample.in" files into /usr/local/bin. Rename the "stunnel.conf-sample.in" to " "stunnel.conf". Change the "stunnel.conf" accordingly and start "stunnel" like so "./stunnel stunnel.conf". Hope this helps. Regards, Trevor Maistry Principal Systems Consultant ============================================= Information and Communication Technology Division University of KwaZulu-Natal King George v Avenue, Durban, 4041 Tel : +2731-2602475 Fax: +2731-2602125 Cell: +2782-787-5583 Email : maistryt(a)ukzn.ac.za =============================================: Please find our Email Disclaimer here: http://www.ukzn.ac.za/disclaimer/

1 0

Re: new Cygwin maintainer for stunnel
by Michal Trojnara 20 Feb '07

20 Feb '07

On Tuesday 20 February 2007 20:59, Andrew Schulman wrote: > Please add Cygwin to the list of "known good" OSes at > http://stunnel.mirt.net/, and add me to the list of maintainers in the > PORTS file. Done. Thank you. Mike

1 0

help
by RICH 16 Feb '07

16 Feb '07

Hi to all i need help i have install stunnel rpm in mandriva but can not find the config file

1 0

stunnel on Qnx 6.3
by Rajashekhar Durgadmath 15 Feb '07

15 Feb '07

Hello All, I am facing problems running stunnel for Qnx 6.3 cross compiled on solaris. I want to provide a https front end to thtttpd (www.acme.com). stunnel starts but fails. Logs are like this: 1980.01.01 15:01:46 LOG5[1069085:1]: stunnel 4.20 on sparc-sun-solaris2.9 with OpenSSL 0.9.8 05 Jul 2005 1980.01.01 15:01:46 LOG5[1069085:1]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 1980.01.01 15:01:46 LOG6[1069085:1]: file ulimit = 1000 (can be changed with 'ulimit -n') 1980.01.01 15:01:46 LOG6[1069085:1]: poll() used - no FD_SETSIZE limit for file descriptors 1980.01.01 15:01:46 LOG5[1069085:1]: 488 clients allowed 1980.01.01 15:01:46 LOG7[1069085:1]: FD 4 in non-blocking mode 1980.01.01 15:01:46 LOG7[1069085:1]: FD 5 in non-blocking mode 1980.01.01 15:01:46 LOG7[1069085:1]: FD 6 in non-blocking mode 1980.01.01 15:01:46 LOG7[1069085:1]: SO_REUSEADDR option set on accept socket 1980.01.01 15:01:46 LOG7[1069085:1]: stunnel bound to xxx.xx.xxx.xxx:443 1980.01.01 15:01:46 LOG7[1073200:1]: Created pid file /stunnel.pid <Browser connects> 1980.01.01 15:05:12 LOG7[1073200:1]: stunnel accepted FD=7 from yyy.yy.yyy.yyy:64822 1980.01.01 15:05:12 LOG7[1073200:2]: stunnel started 1980.01.01 15:05:12 LOG7[1073200:2]: FD 7 in non-blocking mode 1980.01.01 15:05:12 LOG7[1073200:2]: TCP_NODELAY option set on local socket 1980.01.01 15:05:12 LOG5[1073200:2]: stunnel accepted connection from qqq.qqq.qqq.qqq:64822 1980.01.01 15:05:12 LOG5[1073200:2]: Server mode 1980.01.01 15:05:12 LOG7[1073200:2]: SSL state (accept): before/accept initialization 1980.01.01 15:05:12 LOG7[1073200:2]: SSL state (accept): SSLv3 read client hello A 1980.01.01 15:05:12 LOG7[1073200:2]: SSL state (accept): SSLv3 write server hello A 1980.01.01 15:05:12 LOG7[1073200:2]: SSL state (accept): SSLv3 write certificate A 1980.01.01 15:05:12 LOG7[1073200:2]: SSL state (accept): SSLv3 write server done A 1980.01.01 15:05:12 LOG7[1073200:2]: SSL state (accept): SSLv3 flush data 1980.01.01 15:05:12 LOG7[1073200:2]: SSL state (accept): SSLv3 read client key exchange A 1980.01.01 15:05:13 LOG7[1073200:2]: SSL state (accept): SSLv3 read finished A 1980.01.01 15:05:13 LOG7[1073200:2]: SSL state (accept): SSLv3 write change cipher spec A 1980.01.01 15:05:13 LOG7[1073200:2]: SSL state (accept): SSLv3 write finished A 1980.01.01 15:05:13 LOG7[1073200:2]: SSL state (accept): SSLv3 flush data 1980.01.01 15:05:13 LOG7[1073200:2]: 1 items in the session cache 1980.01.01 15:05:13 LOG7[1073200:2]: 0 client connects (SSL_connect()) 1980.01.01 15:05:13 LOG7[1073200:2]: 0 client connects that finished 1980.01.01 15:05:13 LOG7[1073200:2]: 0 client renegotiations requested 1980.01.01 15:05:13 LOG7[1073200:2]: 1 server connects (SSL_accept()) 1980.01.01 15:05:13 LOG7[1073200:2]: 1 server connects that finished 1980.01.01 15:05:13 LOG7[1073200:2]: 0 server renegotiations requested 1980.01.01 15:05:13 LOG7[1073200:2]: 0 session cache hits 1980.01.01 15:05:13 LOG7[1073200:2]: 1 session cache misses 1980.01.01 15:05:13 LOG7[1073200:2]: 0 session cache timeouts 1980.01.01 15:05:13 LOG6[1073200:2]: SSL accepted: new session negotiated 1980.01.01 15:05:13 LOG6[1073200:2]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 < SSL Negotiation done > 1980.01.01 15:08:49 LOG3[1073200:2]: remote socket: Address family not supported by protocol family (247) <<<<<< 1980.01.01 15:08:49 LOG5[1073200:2]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 1980.01.01 15:08:49 LOG7[1073200:2]: stunnel finished (0 left) I checked the address family; it is AF_INET :) socket syscall in client.c:989 is failing. I know the error "Address family not supported by protocol family (247)" says it all, but there are other applications running on the box which do the same thing and it works for them. Versions: OpenSSL 0.9.8 and stunnel 4.20. stunnel.conf ## stunnel.conf starts cert = /etc/localhost_cert.pem key = /etc/localhost_key.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = all ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /some_dir setuid = root setgid = root ; PID is created inside chroot jail pid = /stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /some_dir/stunnel.log [https] accept = <Qnx box IP>:443 connect = <Qnx box IP>:80 ## stunnel.conf end # uname -a QNX localhost 6.3.0 2006/04/27-13:08:16EST armbe It was configured thus: ./configure --prefix=/vob/nmi/3rd_party/stunnel --enable-dependency-tracking --with-ssl=/vob/nmi/3rd_party/openssl/ --build=armbe-qnx --host=sparc-sun-solaris2.9 --with-threads=pthread --disable-libwrap Removing the --disable-libwrap does not help. stunnel is started like this: stunnel /etc/stunnel.conf -d http -r localhost:http -p /etc This also did not help: stunnel /etc/stunnel.conf -d https -r localhost:http -p /etc stunnel /etc/stunnel.conf # stunnel -version stunnel 4.20 on sparc-sun-solaris2.9 with OpenSSL 0.9.8 05 Jul 2005 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Global options debug = 5 pid = /some_path/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /some_path/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /some_path/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Please reply, All comments appreciated. Cheers, Raj --------------------------------- New Yahoo! Mail is the ultimate force in competitive emailing. Find out more at the Yahoo! Mail Championships. Plus: play games and win prizes.

1 0

slow transfer of smtp
by jason kawaja 15 Feb '07

15 Feb '07

greetings. clients connects normally when not using ssl (stunnel). when using ssl the connection on the client end appears to take about a minute but does eventually work (mail is sent through encrypted). shown below is the log with debug=7 and a space between the area where a "pause" seems to be, ideas on what could be occurring during this time to induce the "pause"? client = machine making connection. server = machine running stunnel accepting the connection. 2007.02.14 12:24:06 LOG7[69377:134631424]: imaps accepted FD=9 from client:62847 2007.02.14 12:24:06 LOG7[69377:134633984]: imaps started 2007.02.14 12:24:06 LOG7[69377:134633984]: FD 9 in non-blocking mode 2007.02.14 12:24:06 LOG7[69377:134633984]: TCP_NODELAY option set on local socket 2007.02.14 12:24:06 LOG7[69377:134633984]: FD 10 in non-blocking mode 2007.02.14 12:24:06 LOG7[69377:134633984]: FD 11 in non-blocking mode 2007.02.14 12:24:06 LOG7[69377:134633984]: Connection from client: 62847 permitted by libwrap 2007.02.14 12:24:06 LOG5[69377:134633984]: imaps connected from client:62847 2007.02.14 12:24:06 LOG7[69377:134631424]: Cleaning up the signal pipe 2007.02.14 12:24:06 LOG6[69377:134631424]: Child process 69387 finished with code 0 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): before/ accept initialization 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 read client hello A 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 write server hello A 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 write certificate A 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 write server done A 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 flush data 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 read client key exchange A 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 read finished A 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 write change cipher spec A 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 write finished A 2007.02.14 12:24:06 LOG7[69377:134633984]: SSL state (accept): SSLv3 flush data 2007.02.14 12:24:06 LOG7[69377:134633984]: 1 items in the session cache 2007.02.14 12:24:06 LOG7[69377:134633984]: 0 client connects (SSL_connect()) 2007.02.14 12:24:06 LOG7[69377:134633984]: 0 client connects that finished 2007.02.14 12:24:06 LOG7[69377:134633984]: 0 client renegotiatations requested 2007.02.14 12:24:06 LOG7[69377:134633984]: 1 server connects (SSL_accept()) 2007.02.14 12:24:06 LOG7[69377:134633984]: 1 server connects that finished 2007.02.14 12:24:06 LOG7[69377:134633984]: 0 server renegotiatiations requested 2007.02.14 12:24:06 LOG7[69377:134633984]: 0 session cache hits 2007.02.14 12:24:06 LOG7[69377:134633984]: 0 session cache misses 2007.02.14 12:24:06 LOG7[69377:134633984]: 0 session cache timeouts 2007.02.14 12:24:06 LOG6[69377:134633984]: SSL accepted: new session negotiated 2007.02.14 12:24:06 LOG6[69377:134633984]: Negotiated ciphers: AES128- SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 2007.02.14 12:24:06 LOG7[69377:134633984]: FD 10 in non-blocking mode 2007.02.14 12:24:06 LOG7[69377:134633984]: imaps connecting server:143 2007.02.14 12:24:06 LOG7[69377:134633984]: connect_wait: waiting 10 seconds 2007.02.14 12:24:06 LOG7[69377:134633984]: connect_wait: connected 2007.02.14 12:24:06 LOG7[69377:134633984]: Remote FD=10 initialized 2007.02.14 12:24:06 LOG7[69377:134633984]: TCP_NODELAY option set on remote socket 2007.02.14 12:24:08 LOG7[69377:134631424]: ssmtp accepted FD=11 from client:62848 2007.02.14 12:24:08 LOG7[69377:134881280]: ssmtp started 2007.02.14 12:24:08 LOG7[69377:134881280]: FD 11 in non-blocking mode 2007.02.14 12:24:08 LOG7[69377:134881280]: TCP_NODELAY option set on local socket 2007.02.14 12:24:08 LOG7[69377:134881280]: FD 12 in non-blocking mode 2007.02.14 12:24:08 LOG7[69377:134881280]: FD 13 in non-blocking mode 2007.02.14 12:24:08 LOG7[69377:134881280]: Connection from client: 62848 permitted by libwrap 2007.02.14 12:24:08 LOG5[69377:134881280]: ssmtp connected from client:62848 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): before/ accept initialization 2007.02.14 12:24:08 LOG7[69377:134631424]: Cleaning up the signal pipe 2007.02.14 12:24:08 LOG6[69377:134631424]: Child process 69391 finished with code 0 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 read client hello A 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 write server hello A 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 write certificate A 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 write server done A 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 flush data 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 read client key exchange A 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 read finished A 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 write change cipher spec A 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 write finished A 2007.02.14 12:24:08 LOG7[69377:134881280]: SSL state (accept): SSLv3 flush data 2007.02.14 12:24:08 LOG7[69377:134881280]: 2 items in the session cache 2007.02.14 12:24:08 LOG7[69377:134881280]: 0 client connects (SSL_connect()) 2007.02.14 12:24:08 LOG7[69377:134881280]: 0 client connects that finished 2007.02.14 12:24:08 LOG7[69377:134881280]: 0 client renegotiatations requested 2007.02.14 12:24:08 LOG7[69377:134881280]: 2 server connects (SSL_accept()) 2007.02.14 12:24:08 LOG7[69377:134881280]: 2 server connects that finished 2007.02.14 12:24:08 LOG7[69377:134881280]: 0 server renegotiatiations requested 2007.02.14 12:24:08 LOG7[69377:134881280]: 0 session cache hits 2007.02.14 12:24:08 LOG7[69377:134881280]: 0 session cache misses 2007.02.14 12:24:08 LOG7[69377:134881280]: 0 session cache timeouts 2007.02.14 12:24:08 LOG6[69377:134881280]: SSL accepted: new session negotiated 2007.02.14 12:24:08 LOG6[69377:134881280]: Negotiated ciphers: AES128- SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 2007.02.14 12:24:08 LOG7[69377:134881280]: FD 12 in non-blocking mode 2007.02.14 12:24:08 LOG7[69377:134881280]: ssmtp connecting server:25 2007.02.14 12:24:08 LOG7[69377:134881280]: connect_wait: waiting 10 seconds 2007.02.14 12:24:08 LOG7[69377:134881280]: connect_wait: connected 2007.02.14 12:24:08 LOG7[69377:134881280]: Remote FD=12 initialized 2007.02.14 12:24:08 LOG7[69377:134881280]: TCP_NODELAY option set on remote socket 2007.02.14 12:25:06 LOG7[69377:134631424]: imaps accepted FD=13 from client:62850 2007.02.14 12:25:06 LOG7[69377:134882816]: imaps started 2007.02.14 12:25:06 LOG7[69377:134882816]: FD 13 in non-blocking mode 2007.02.14 12:25:06 LOG7[69377:134882816]: TCP_NODELAY option set on local socket 2007.02.14 12:25:06 LOG7[69377:134882816]: FD 14 in non-blocking mode 2007.02.14 12:25:06 LOG7[69377:134882816]: FD 15 in non-blocking mode 2007.02.14 12:25:06 LOG7[69377:134882816]: Connection from client: 62850 permitted by libwrap 2007.02.14 12:25:06 LOG5[69377:134882816]: imaps connected from client:62850 2007.02.14 12:25:06 LOG7[69377:134631424]: Cleaning up the signal pipe 2007.02.14 12:25:06 LOG7[69377:134882816]: SSL state (accept): before/ accept initialization 2007.02.14 12:25:06 LOG6[69377:134631424]: Child process 69478 finished with code 0 2007.02.14 12:25:06 LOG7[69377:134882816]: SSL state (accept): SSLv3 read client hello A 2007.02.14 12:25:06 LOG7[69377:134882816]: SSL state (accept): SSLv3 write server hello A 2007.02.14 12:25:06 LOG7[69377:134882816]: SSL state (accept): SSLv3 write change cipher spec A 2007.02.14 12:25:06 LOG7[69377:134882816]: SSL state (accept): SSLv3 write finished A 2007.02.14 12:25:06 LOG7[69377:134882816]: SSL state (accept): SSLv3 flush data 2007.02.14 12:25:06 LOG7[69377:134882816]: SSL state (accept): SSLv3 read finished A 2007.02.14 12:25:06 LOG7[69377:134882816]: 2 items in the session cache 2007.02.14 12:25:06 LOG7[69377:134882816]: 0 client connects (SSL_connect()) 2007.02.14 12:25:06 LOG7[69377:134882816]: 0 client connects that finished 2007.02.14 12:25:06 LOG7[69377:134882816]: 0 client renegotiatations requested 2007.02.14 12:25:06 LOG7[69377:134882816]: 3 server connects (SSL_accept()) 2007.02.14 12:25:06 LOG7[69377:134882816]: 3 server connects that finished 2007.02.14 12:25:06 LOG7[69377:134882816]: 0 server renegotiatiations requested 2007.02.14 12:25:06 LOG7[69377:134882816]: 1 session cache hits 2007.02.14 12:25:06 LOG7[69377:134882816]: 0 session cache misses 2007.02.14 12:25:06 LOG7[69377:134882816]: 0 session cache timeouts 2007.02.14 12:25:06 LOG6[69377:134882816]: SSL accepted: previous session reused 2007.02.14 12:25:06 LOG7[69377:134882816]: FD 14 in non-blocking mode 2007.02.14 12:25:06 LOG7[69377:134882816]: imaps connecting server:143 2007.02.14 12:25:06 LOG7[69377:134882816]: connect_wait: waiting 10 seconds 2007.02.14 12:25:06 LOG7[69377:134882816]: connect_wait: connected 2007.02.14 12:25:06 LOG7[69377:134882816]: Remote FD=14 initialized 2007.02.14 12:25:06 LOG7[69377:134882816]: TCP_NODELAY option set on remote socket -- Jason Kawaja, 2-4568 IT Expert, UF Dept of ECE

1 1

configure/compile issue on AIX&In-Reply-To=
by Trevor Maistry 09 Feb '07

09 Feb '07

Hi, Does anyone have a version of Stunnel which runs on AIX 5.3? Also, what is the idle timeout set to and how do I change it? Many thanks. Regards, Trevor Maistry Principal Systems Consultant ============================================= Information and Communication Technology Division University of KwaZulu-Natal King George v Avenue, Durban, 4041 Tel : +2731-2602475 Fax: +2731-2602125 Cell: +2782-787-5583 Email : maistryt(a)ukzn.ac.za =============================================: Please find our Email Disclaimer here: http://www.ukzn.ac.za/disclaimer/

1 0

"The most recent stable Stunnel version?"
by Roger Fulton 04 Feb '07

04 Feb '07

Hi, I've checked the support pages. I've browsed the mailing list archives. I've perused the ChangeLog file. I can't find an answer to this question: At http://www.stunnel.org/download/binaries.html is stated "The most recent stable Stunnel version is flagged with a red asterisk (*)." I've used two different browsers, and I'll be danged if I see *any* version marked with *any* asterisk, red or otherwise. Would someone kindly direct this Stunnel newbie to the "most recent stable Stunnel version?" TIA.

2 1

Oracle JDBC Failover not working
by Dario Mariani 02 Feb '07

02 Feb '07

Hi all. We have a problem here with this configuration. before stunnel: BEA Weblogic, 2 JDBC, server1:1521 and server2:1521 Two SunCluster nodes with Oracle OPS/RAC (active-active conf), with NO shared address. So "server1" and "server2" are the phisical address. after stunnel: the JDBC config is 127.0.0.1:10001 and 127.0.0.1:10002 stunnel client is 10001->server1:11521 and 10002->server2:11521 stunnel server is 11521->localhost:1521 When we shut down the server1 (so oracle, listener and stunnel server is not responding), BEA cannot failover. A quick analisys shows that: 1. the JDBC connects to stunnel client, that accept the connection 2. stunnel client fails to connect to stunnel server 3. stunnel client close the connection with the JDBC 4. the JDBC cannot deal with the situation and doesn't failover. It seems like JDBC doesn't failover when he can open a connection but oracle doesn't reply. What i need is: is possible for Stunnel client to FIRST try to connect to the server, and then eventually accept the connection from the jdbc? Bye, dario.

2 1

Intermediate Cert validation problem
by Eric McCombs 31 Jan '07

31 Jan '07

I'm experiencing a problem validating intermediate cert on our Stunnel configuration. We are using Stunnel to forward IMAP, POP and SMTP SSL ports from our vpn server to our internal mail server. We originally used a self-signed cert on the vpn server. When clients connect via Outlook, Outlook Express, Thunderbird and various cell phone mail programs they received a warning message (Unable to verify identity of xxx) about the self-signed cert. To resolve this issue we purchased a SSL cert from Verisign to install on the vpn server. We generated the key and CSR and received the new cert from Verisign, which also requires an intermediate cert for verification. We have tried various methods to have the certs validated, combining the key, intermediate cert and server cert in one file, pointing to the CA_file, etc. but continue to see the Unable to verify identity message. Has anybody else encountered this problem and found a way to resolve the problem? Thanks in advance. Eric McCombs

1 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users